last executing test programs: 4m32.258160256s ago: executing program 1 (id=1802): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x7fffffffffffffff, &(0x7f0000000340)="a877a75fc1034cdc3e847ab17c98187b8ab9c440f95db8b278e88528987a999ca9618923f404135f33a771670ac20dc577736fd116e1ba92e5fc2bfe3f4f20245b392c09a1450019dbf0255662449f4cc1198e6f20b329f6153317") mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000480)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f00000004c0)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f0000000500)={0x0, 0x20000, 0x0, 0x1, 0x154, 0x0, r3}, 0x0, 0x1, &(0x7f0000000580)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0x42, 0x0, 0x0}}, 0x0) setsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000600)=0x32, 0x4) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000240)=0x7) ptrace(0x8, r4) modify_ldt$write(0x1, &(0x7f0000000100)={0x1001}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x2c, 0x28, 0x107, 0x70bd2b, 0x0, {0x1, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @pid}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x5, 0x23, 0x0, 0x0, @str='\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) waitid(0x0, r0, 0x0, 0x8, &(0x7f0000000040)) ptrace$getregset(0x4205, r0, 0x202, &(0x7f0000000140)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) ptrace$ARCH_SHSTK_DISABLE(0x1e, r4, 0x1, 0x5002) syz_open_procfs(r0, &(0x7f0000000200)='clear_refs\x00') syz_usb_control_io(0xffffffffffffffff, &(0x7f00000003c0)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="200c080000000821c3546b"], 0x0, 0x0, 0x0, 0x0}, 0x0) 4m31.07114374s ago: executing program 1 (id=1808): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1400000010000100000000000a03000000000000000000070000000900010073797a300000000048000000090a0104000200000000000007000000140000001000010000000000000000000084000a"], 0x90}}, 0x20050800) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = syz_io_uring_setup(0x9, &(0x7f0000000140)={0x0, 0x2c6f, 0x0, 0x3, 0x3}, &(0x7f0000000640)=0x0, &(0x7f0000000680)=0x0, &(0x7f00000006c0)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000700)=@IORING_OP_NOP128={0x3f, 0x0, 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x5, 0x20, 0x0, {0x4}}) syz_io_uring_setup(0xf00, &(0x7f0000000780)={0x0, 0x0, 0x10000, 0x1000004, 0x55, 0x0, r2}, &(0x7f0000000800)=0x0, &(0x7f0000000840), &(0x7f0000000880)) syz_ublk_add_dev(r2, r6, r4, r5, &(0x7f00000008c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000940)=@new_dev={0x4, 0x3b4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x10}}}, 0x0) r7 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r7, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) ioctl$KVM_SET_LAPIC(r8, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc409541aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d7e083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e684fe16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f149319f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"}) 4m30.717683357s ago: executing program 1 (id=1809): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000300)={@multicast1, @local}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000340)=ANY=[@ANYBLOB="e0000001ac1414aa0000a40002000000ac"], 0x18) 4m30.578186983s ago: executing program 1 (id=1810): mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000440)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) (fail_nth: 10) 4m30.334382041s ago: executing program 1 (id=1811): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42c01, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000000c0)={"5e2a161b31f70bf30e1d927bb606f34efd3376aaabd9eb74ecaa3addcc999c36e7427b92d397577e118d163e6d7da212a9d3a242904e4bcfcfda295e1b1c2d43b66f62e46e7a37337a44694c9b7e15af1577e2715956f44aa7b4bae48788da9406c93d5313121fdfc8e83eaa50a17bef676f45cfee619c0cca8e763e89ff9af230242e6b2330d472167638c2cc64d788c1040322ae0e2204cf0632525c469a87c0c39d2160eea082af1cc195db217670b3d588c1c4449207506d6913d9cbfdb57e6984d9514d80b18056bc27f6c747c6de3bd7080fed3e836fbe2b6bf498da0d6dbe829e6c1fab999c3f38f657c7768b8dbbc51f39959a0b0bf7eee0e75473e17e0a0dffe16840151d5d7db9d3ebf0e12500005d961b2006b316e0eb5d55e70c763415d247e8d418be0a7139816f97d80cc733462550eeb41a15f7ddc65be4722ffe62751213d591509868df56995b3b80fb291b78acbee70451828bd0c0419153922a8b122b554266896008adb449b2e2efa1315ef2f4ce2e7cb87994200d259fe021b69923ae13edd59cfdf3f0b15754a58d01409e1588619088fe4ebe552ad9885dd5a5cdf055b5b17b54548e41d68ef7d8435321056a6f6e0588059e99c4c6d92a6e3296320d202aaa4827a383ef6a654b3493c6138346dac1faa634534935a102271b412c44527532ea4c0e347e9f414d075ac46d393f35f8459e1cb5d9935f2c428765b2465c44cd8108f9bcd470ab009a30a93f2fc8e61556b8169957b0d660c2582f8d750cfc336827307c2823490f21f05c5d3d45496ce800f05c266c00656f30a17aaef1eea051c6ea1e3203819ebb4ac4681be21b3e90f38bebb96596165a13839fcd0496cc3891c30f3fc4ca3dd665fe9f41eca1672da249ea30f45e8275c9b570055b45bb26f73732b7f94122b104e4f37dee1634b81a203367c6b68afb7c77d28fcccadd247d636e6aa1bbfab62b9a18980a6f9502dd2e2348a0cc4bec567300ce53ae19562a818d01340ca918d0cfa3fd9b96693448c196b31399d06e65673929f97f9d8e5e7dbc154e39c4b1363d46fc4a85c88f30e795f4423c63adf6fb471d5501cad367148d68af1c20f187196c02b3c558a64d06ae3b3df58551e8b05bc086840e0c1d00dd789288df6fb097b3fd3437682801023eeae6a6e87b419bf6f97c7d40c3af777ce9e2311f9e05caad86a6e0cf88a53acc9d3c118080238bd9867860d4117ce46d11ba66f4ad76348953e3e582298e79d08573d99d84bf39175e4c5ddae89c3922f7f828a4a7c6b7698b1a52228181dbaa61b65bb735c5d976431656f58a52755bb462f0d202a73b5fd6e04e55ade4bef4c1fdcc460ce280dc7e216a7843b726e0063842fea9de4a412f4b0c27ae7638a62ce255c3423c7ee290d338945c24f918ea58a19b100d7aef9ab9827eeb4cb4a795"}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000004c0)={0x2, 0x1, 0x1000, 0x2000, &(0x7f0000ff2000/0x2000)=nil}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000500)=0x1fff) (async) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000500)=0x1fff) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) socket$nl_route(0x10, 0x3, 0x0) close(0xffffffffffffffff) getpid() (async) r3 = getpid() syz_pidfd_open(r3, 0x0) (async) r4 = syz_pidfd_open(r3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000940)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000980)='./proc\x00', &(0x7f00000009c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc/thread-self/fail-nth\x00', 0x2, 0x103) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc/thread-self/fail-nth\x00', 0x2, 0x103) write(r5, &(0x7f0000000a40)='9', 0x1) mmap(0x0, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) (async) mmap(0x0, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) setns(r4, 0x24020000) (async) setns(r4, 0x24020000) mount(0x0, &(0x7f0000000540)='.\x00', 0x0, 0x3209864, 0x0) syz_clone(0xb2b60000, 0x0, 0xfffffffffffffcd1, 0x0, 0x0, 0x0) (async) r6 = syz_clone(0xb2b60000, 0x0, 0xfffffffffffffcd1, 0x0, 0x0, 0x0) r7 = syz_pidfd_open(r6, 0x0) setns(r7, 0x24020000) close(0xffffffffffffffff) (async) close(0xffffffffffffffff) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000b71000/0x400000)=nil) (async) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000b71000/0x400000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./config\x00', 0x1ed) mount(0x0, &(0x7f00000007c0)='./config\x00', &(0x7f0000000800)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) syz_open_dev$sg(&(0x7f0000000580), 0x0, 0x169801) 4m29.376777539s ago: executing program 1 (id=1814): unshare(0x6a060000) unshare(0x800) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x149040, 0x0) truncate(&(0x7f0000000080)='./file0\x00', 0x4) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x200000000000000) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8880, 0x85) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x1e5}, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r1, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x47f5, 0x80000, 0x1000000, 0x33d, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x20, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6a6c, 0x6449, 0x0, 0xfffffffd}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x40, 0x0, 0xffffffff}}], 0x1, 0x0, 0x0) 4m14.23645476s ago: executing program 32 (id=1814): unshare(0x6a060000) unshare(0x800) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x149040, 0x0) truncate(&(0x7f0000000080)='./file0\x00', 0x4) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x200000000000000) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8880, 0x85) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x1e5}, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r1, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x47f5, 0x80000, 0x1000000, 0x33d, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x20, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6a6c, 0x6449, 0x0, 0xfffffffd}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x40, 0x0, 0xffffffff}}], 0x1, 0x0, 0x0) 3m3.288636493s ago: executing program 0 (id=2244): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = syz_usb_connect$hid(0x7, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="1201100100000810ac05360200000000000109022d00010000800109040000010300020009210480fa01221603090581034000077dc4090600000000000000"], 0x0) r1 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000080)={0x1, 0x45db, 0x5, 0x1ff}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x8, &(0x7f0000000000)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r2 = mmap$KVM_VCPU(&(0x7f0000ffe000/0x1000)=nil, 0x0, 0x1000001, 0x10010, 0xffffffffffffffff, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x57}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0xb}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x8c}}, 0x4) syz_memcpy_off$KVM_EXIT_MMIO(r2, 0x20, &(0x7f00000000c0)="8c7c743f2d79b78283d6a032a1523935a28762815aa1b2d2", 0x0, 0x18) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="00a428000000"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$SIOCGETNODEID(r1, 0x89e1, &(0x7f0000000140)) 3m2.522928181s ago: executing program 0 (id=2246): syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000480)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0xc0, 0xa2, 0x2f, "1f65c683eb6a66557dcb637605ee80d5e3956e7a688d78c108c1636451bfe73d35eeb6db0cdfb8476243dda48e3ccf"}}) kexec_load(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f0000000000)="13c805fddc8fec4eff7aee9b1f1cb78e3dd63ec760067e7f04fe917300823c8018c59fed4a094e8975e12f2eb1ce6cd18f38f0f8140cdf15cad88a0f9d2fa1798233e08f9e5869c625d17a5648e610505b24f33578c47014afccb9dc54e77da8e13824b8ba82d077d87e8d3661da5974469b1f921f7d9053dfd15fe9121e54570b1ad57c9be1c63f8ca1694f6ca35698ff5f31e9dc70c57dcce8b83eb75d373ce9d675630016c7605b2ca429630f1215db795795c13e5488fb62409fb4d53df3aa29828195e669bd56e6203db5a096ae0671aa6330f61c7d0c5e2112af71033493e95f21d24558df66f597bbc01f1fea84", 0xf1, 0x4, 0xbb}, {&(0x7f0000000180)="154b", 0x2, 0x200000000000004, 0x4}], 0x0) 3m1.597115198s ago: executing program 0 (id=2252): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000580)={0x0, 0xc, &(0x7f00000005c0)=[{&(0x7f0000000600)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1, 0x0, 0x0, 0x8000000}, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, 0x0, 0x801, 0x0) write$rfkill(r1, 0x0, 0x0) 3m1.575367949s ago: executing program 0 (id=2254): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x4e21, @remote}}, 0x0, 0x0, 0x23, 0x0, "e83ae75240c2d6d8ec87bb53fab0910000000000000007a5922406b64cddaeb9d339ba3c35dc0a08df8e61740b7cf2d4e499d58654a4cf0fa0ce1f830c3079cffcfd00"}, 0xd8) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='bbr', 0x3) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) ioctl$KVM_GET_EMULATED_CPUID(r1, 0x4018aee2, &(0x7f0000000080)={0x1, 0x0, [{0x0, 0x84, 0x4, 0x9, 0x4, 0x0, 0xb}]}) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000240)=0xce, 0x4) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000019000/0x18000)=nil, 0x0, 0x0, 0x79, &(0x7f0000001500)=[@cr4={0x1, 0x8045}], 0x1) ioctl$KVM_X86_SET_MCE(0xffffffffffffffff, 0x4040ae9e, &(0x7f0000001580)={0x9b80000000000000, 0x3000, 0xfffffdfffffffffd, 0x8, 0x2}) connect$inet(r0, &(0x7f0000000280)={0x2, 0x4e20, @loopback}, 0x10) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f00000015c0)={0x8, 0x0, 0xfffffffd}, 0x24) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000002c0)=0x4, 0x4) sendmsg$inet(r0, &(0x7f0000000300)={0x0, 0x14, &(0x7f0000000340)=[{&(0x7f0000000380)=' ', 0x100120}], 0x1}, 0x0) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x2, &(0x7f0000000400)=[{&(0x7f0000000440)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000}, 0x700) r3 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r3, &(0x7f0000000000)={0x18, 0x2, {0xfffb, @private=0xa010102}}, 0x1e) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) syz_clone(0x2b00b100, 0x0, 0x0, 0x0, 0x0, 0x0) 3m0.642796358s ago: executing program 0 (id=2258): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/devcoredump/disabled\x00', 0x2, 0x0) syz_clone(0x81260000, &(0x7f0000000000)="0fd8f434d3ff68bf56f80ed26d4ca98d9e60aca43c8667cebdb8a266f144239d7f3bb0ecc026ed150a6d99be930c87151a438e8eeaabb34ed940f5343250708e5c39146d2a04", 0x46, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000140)="4b20379e0688a85f622b5a9238cb86b0159ae4f89642cefafc565b6a81fcb42ee49265b78961a8a75428e3b59d12cd9bdacbcc01ba484038b65b8236b8a08fa769af38864c4a0a36e0def3fd628684d9d15cb1a8eb04d0ba42e956098e2ca4f436d1e6a62fa3c180da718a5e47") write(r0, &(0x7f00000002c0)="b1", 0x1) 3m0.391112803s ago: executing program 0 (id=2262): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000200)=ANY=[@ANYBLOB="12010002000000404b0c00010001000000010902270001010080320904000003ff0000000705830308000a0705810220000007050202"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./dev/ttyUSB0\x00', 0x2, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2m44.940566304s ago: executing program 33 (id=2262): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000200)=ANY=[@ANYBLOB="12010002000000404b0c00010001000000010902270001010080320904000003ff0000000705830308000a0705810220000007050202"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./dev/ttyUSB0\x00', 0x2, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2m8.571196668s ago: executing program 5 (id=2565): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d10300000c000440000000000000000114000000110001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d1a3a700080003"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2m8.354491978s ago: executing program 5 (id=2566): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000480)=ANY=[@ANYBLOB="140000001300015b993dde440113e9"], 0x14}], 0x1}, 0x0) 2m8.059855344s ago: executing program 5 (id=2567): socket$alg(0x26, 0x5, 0x0) r0 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r0, &(0x7f0000000000)={&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10, &(0x7f0000000080)=[{&(0x7f00000000c0)='\b\x00', 0x2}, {&(0x7f0000000100)="96bc1480bb58", 0x6}], 0x2, &(0x7f0000000180)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101027f00000100000000001c000000000000000000000008000000", @ANYBLOB="15"], 0x40}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x15, @loopback}, 0x10) listen(r1, 0x5) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000300)={0x2, 0x15, @loopback}, 0x10) write(r2, &(0x7f0000000400)='PA', 0x2) 2m7.770367194s ago: executing program 5 (id=2570): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000140)='.\x00', &(0x7f0000000180)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) umount2(&(0x7f00000001c0)='./dev\x00', 0x7) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="7800000018002507b9409b14ffff00000202be04020506056403040c5c0009003f0020010a0000000d0085a168216b46d3", 0x31, 0x0, 0x0, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801") ioctl(r0, 0xc138fd0e, &(0x7f0000000000)) 2m7.405585377s ago: executing program 5 (id=2572): syz_usb_connect(0x5, 0x351, &(0x7f0000000040)={{0x12, 0x1, 0x310, 0x5, 0x2c, 0x80, 0x8, 0x157e, 0x300d, 0x5ce5, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x33f, 0x1, 0x0, 0x0, 0x0, 0x81, "", [{{0x9, 0x4, 0x3, 0x4, 0x9, 0xb1, 0x59, 0x8c, 0x0, [], [{{0x9, 0x5, 0xb, 0x4, 0x400, 0x4, 0x8, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x9, 0x7}]}}, {{0x9, 0x5, 0x8, 0x10, 0x3ff, 0x8, 0x8, 0xc0}}, {{0x9, 0x5, 0xb, 0x0, 0x3ff, 0x10, 0x1, 0xfb, [@generic={0xc6, 0x3, "e412c2dd433674706768fce8a8ee40e9987cf9ec656c7638ba56626365af89a082ac3bde1293a5e85e17ae6a05a6a0e9233d59cc875319a01b54c6d09154b2f035db66a924338946d1809402ad80e70210cdb85d11263767d707fb29b815f740d61e4fb828a2659443f76d94f4e1feca974a3330a850513f39fe412f24be087b52863e9c588f424adce6577ecfa89c48554e6f163b95b5f52c96c3d8b558369b37c4a6fe63dbce08df74c9c705a1697e4f6b5f117c8341ed8072b0a3da493e2285d1d9c6"}, @generic={0xc9, 0x8, "e736c0f686605e9b4e645d5e1d896b635b216645a30284202e0ddddd00173fbf95ab4d942031fab3299050f35df9a57e079af319d9e398000bb76df805b2108ce4ebb1f04e20df2988f7560d6c9bcb4e8d3d703624fa6c5d0f6c797fd93f7052884fc4338960622faddf87638d6c09f49604ce7c2ea2cc27c720892a34e9e6118e75622746bee130d55407d9e32ca5a02181553e5b669837689651d214c4fb609dbdc26d054ec2797d62f5262e8be9fe597ee40bf414ab482f82d14fdabc1b2274ae59ed90a1fb"}]}}, {{0x9, 0x5, 0xc, 0x2, 0x8, 0x6, 0x2, 0x7}}, {{0x9, 0x5, 0xc, 0x10, 0x40, 0xab, 0xf1, 0x3}}, {{0x9, 0x5, 0xe, 0x8, 0x3ff, 0x1, 0x89, 0xf, [@generic={0xc8, 0x22, "b48e92b66b9142cbe9a5118bfb35bd7aa53aa68fda6559347101240545f7c668f5b4fb661d829f61b968ef405668ac732540b65b0de0aeb924d904ddc3ad7ba9d30f6f452caf61971173971c618fb945e3d74422747f4af796a982a0795d985ca75f6e397c4cd2d9473a099c256749c56e42df144e8e626bedbb5453fea3decf0c2977286010265d4519412cd50c234b533eddf5eea4f96808484de1329c4823eca3a18dad77279f8fc9f74a1f6334c85ef211229346fa20d6247196f17125b713ee49d9691a"}, @uac_iso={0x7, 0x25, 0x1, 0x4, 0x3, 0xffff}]}}, {{0x9, 0x5, 0x80, 0x0, 0x40, 0x9, 0x1, 0x7f}}, {{0x9, 0x5, 0xd, 0x1a, 0x200, 0x7, 0x8, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0xa1, 0x8}, @generic={0x2c, 0x24, "bac50a90afac1ab62f46f45c275e250cd18b58aaea4e2fdbd7fdf5b8436d4a46f2dfada3dd7dc22a0e73"}]}}, {{0x9, 0x5, 0x1, 0x2, 0x40, 0x7, 0x48, 0xfa, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x8, 0x2}, @generic={0x3d, 0x8, "d9b59486d8c048d18cf2737596aa1475a953257357d68ab21b23d94ee54daa2820746a0dab8b98b143159b397b3dbda8fe87c3f7cbd7e9aa7726dc"}]}}]}}]}}]}}, 0x0) 2m6.976646143s ago: executing program 5 (id=2578): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000100)={@private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @local, 0xdb, 0x80, 0x401, 0x500, 0x7, 0x10080}) ioctl$AUTOFS_IOC_CATATONIC(0xffffffffffffffff, 0x9362, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000180)={0x4, 0x8002, 0x3, 0x8, 0x2}, 0x10) fcntl$setstatus(r1, 0x4, 0xc00) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r2, 0x4058587a, &(0x7f0000000380)={{r2, &(0x7f00000001c0)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x430200, &(0x7f0000000200)={@_ha_fsid={[0x1, 0x4]}, {0x10, 0x1a94, 0x80000000, 0x7}}, 0x0, &(0x7f0000000240), &(0x7f0000000280)=0x5cbb}, {[0x8, 0x2, 0x1, 0xffff]}, 0x9, 0x85, &(0x7f00000002c0)=""/133}) write$tcp_congestion(r3, &(0x7f0000000400)='westwood\x00', 0x9) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000480), r3) sendmsg$TIPC_NL_MON_GET(r4, &(0x7f0000000880)={&(0x7f0000000440), 0xc, &(0x7f0000000840)={&(0x7f00000004c0)={0x360, r5, 0x8, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x9c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x950}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2d}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1a3}]}]}, @TIPC_NLA_BEARER={0xf8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'wlan1\x00'}}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xafe6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x381}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2c}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x394}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xee3f}]}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb2c9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}]}]}, @TIPC_NLA_NODE={0xe0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x45, 0x4, {'gcm(aes)\x00', 0x1d, "1c2606e4d2b70df172e0df8395a0f3c370005298b8e8bf14368e11fd67"}}, @TIPC_NLA_NODE_KEY={0x3d, 0x4, {'gcm(aes)\x00', 0x15, "e4374cc2abde1d0c630ba0ef283c07dcc539ac8149"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "7c8b4fc26d881e47f49047cf6120143f65c895afb14ec6c51eb1de0d54e0c72410cfd8e9"}}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xd8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'ib', 0x3a, 'pimreg0\x00'}}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x274}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @rand_addr=0x64010101}}, {0x14, 0x2, @in={0x2, 0x4e21, @rand_addr=0x64010100}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1ff, @empty, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @local}}}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}]}]}, 0x360}}, 0x20008840) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r6, 0x8982, &(0x7f00000008c0)={0x8, 'veth1_to_team\x00', {'hsr0\x00'}, 0x5}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000900)={0x0, 0x7fff, 0x7}, &(0x7f0000000940)=0x8) syz_usb_connect(0x3, 0x366, &(0x7f0000000980)={{0x12, 0x1, 0x250, 0x18, 0x43, 0xf6, 0x8, 0x1199, 0x6835, 0x6f57, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x354, 0x2, 0x9, 0xfa, 0xb0, 0x40, "", [{{0x9, 0x4, 0xc9, 0xd, 0x1, 0xcd, 0x60, 0x86, 0x83, [], [{{0x9, 0x5, 0x1, 0x0, 0x3ff, 0x2b, 0x1, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x6e, 0x2}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x6, 0x3}]}}]}}, {{0x9, 0x4, 0xe6, 0x5, 0xc, 0x59, 0xfc, 0x75, 0x1, [], [{{0x9, 0x5, 0xb, 0x3, 0x10, 0xf9, 0x9, 0xc, [@generic={0xdd, 0xbc9ca436c635b92f, "993cb915aca2ccf5955fdbabc8c21ff4ccaa650be892e6f47eb6a352eea1231f0bde6d3431723c2e82f15a1fd8edc415d1453d2646f8a93c56cb3533f9c70b6360e9ddbe1577d51b6add3241f240c8c047e00b505df0b0c1a1f0edf984b794624667f5ccdc969bc45ce9653f8a936a3570bf4ad890c2edf710d10cc3d04b6f4586aa265f3fd2a3dae5bb0557d51c972bea9cd33ce6c6e26abfa0373abb45c1be379784755adfc4ba460c3989cf929c2201fe82f398c815d2c2d997346bc4bf2ac7094d55ca55592f0c9463688aabce589e920cd762d00ab8f08653"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x40, 0x3, 0x3, 0x9}}, {{0x9, 0x5, 0xf, 0x10, 0x400, 0x1, 0x0, 0x7}}, {{0x9, 0x5, 0x1, 0x0, 0x200, 0x8, 0xd, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xb2, 0x5}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x72, 0x1}]}}, {{0x9, 0x5, 0xf, 0x1, 0x20, 0x6, 0x2, 0xe}}, {{0x9, 0x5, 0x6, 0x0, 0x428, 0x1, 0x9, 0x3, [@generic={0x8d, 0x7, "a2ef1b4a3a7fa53b3b2f5e348a3f261de6e8203c9cd690a1743a3c6b0f2f80bf22cfc22844d4bd0ecb250a2c24cc51731e48d7f893ddeb2bb87119f43e31802a445c7bb41e967cdf3a16d1eca01f9e199a0966b96b7fc76487636efba71f16ce9c1aa925b0193930898a60d51bc061b4f499789f99a1e794e534386311647c152403633734754c439996ff"}]}}, {{0x9, 0x5, 0xf, 0x0, 0x40, 0xf4, 0x3, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x7f, 0x1}]}}, {{0x9, 0x5, 0xc, 0x2, 0x10, 0x7f, 0x9, 0xe, [@generic={0x101, 0x22, "52c7ba9ff605fa4b044537a31604647b16d3e071641050e48eb3c0d964bff0debeb3fa7f215d3c7b4865821b3aaf917af0e8bed7d519c1546af2e7dc300948a5cb451b0b3402b3d83ef27e8a6fe3bce6b94883f0549ac8df4c30b16398783410d55b100061d3893b2da7c9d7e90dd3660108d83a41a074b040859c1ee7e35687e4d115a95332f443b65b32870c536ee4d63377ce31ad0a5d60125bef828d2d66bdab22b867cbc2df43a5e22ca3d72e47ecbff1834489dcf4741278ce23fd8929dad63ac0f81e694222ac1f2772c79ddc6f13b132c75167196c946d509c55e4edbd5ee712fd4be90b0857c1bb381e3b3233b6e813f061c1ea28979d546247b4"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0xd5, 0x41}]}}, {{0x9, 0x5, 0x8, 0x2, 0x200, 0x3, 0x10, 0x3a}}, {{0x9, 0x5, 0x2, 0x4, 0x400, 0x6, 0xf4, 0x5d, [@generic={0x2f, 0x21, "3d9ccb5ca7f35053705f785f47711d183f3db7b23efe61cca1774a2c4a9c522f7669d6280c744df984e8f1f977"}]}}, {{0x9, 0x5, 0x4, 0x0, 0x200, 0x7, 0x80, 0x7}}, {{0x9, 0x5, 0xf, 0x3, 0x10, 0x2, 0x0, 0x4}}]}}]}}]}}, &(0x7f0000000ec0)={0xa, &(0x7f0000000d00)={0xa, 0x6, 0x310, 0x0, 0x48, 0xff, 0xff}, 0x10, &(0x7f0000000d40)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x4, 0x8, 0x5, 0x8, 0x6b}]}, 0x5, [{0x3c, &(0x7f0000000d80)=@string={0x3c, 0x3, "74a5527fc3e053ee1283986fc1c1e791ae7aa2c3d944f5768071763e8f8e47da75f0a3a203ee383159169553040336611d5ea3e8617ad476b91d"}}, {0x4, &(0x7f0000000dc0)=@lang_id={0x4, 0x3, 0x810}}, {0x4, &(0x7f0000000e00)=@lang_id={0x4, 0x3, 0x40b}}, {0x4, &(0x7f0000000e40)=@lang_id={0x4, 0x3, 0x3001}}, {0x4, &(0x7f0000000e80)=@lang_id={0x4, 0x3, 0x42a}}]}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000f40)={r7, 0x4}, &(0x7f0000000f80)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000fc0)={r7, @in={{0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x80, 0xc2b2, 0xfff, 0x5, 0x84}, &(0x7f0000001080)=0x98) setsockopt$inet_sctp_SCTP_REMOTE_UDP_ENCAPS_PORT(r3, 0x84, 0x84, &(0x7f00000010c0)={r8, @in={{0x2, 0x4e24, @remote}}, 0x4e20}, 0x90) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000001180)=0x14, 0x4) ioctl$XFS_IOC_SCRUBV_METADATA(r3, 0xc0285840, &(0x7f0000001200)={0xd6b, 0x5, 0x5, 0x0, 0x1, 0x1, 0x0, &(0x7f00000011c0)=[{0x3, 0xfe, 0x7}]}) ioctl$XFS_IOC_GETPARENTS(r6, 0xc028583e, &(0x7f00000012c0)={{[0x6, 0x50, 0xfffffffd]}, 0x0, 0x7, 0x6, 0x0, &(0x7f0000001240)=[{{@_ha_fsid={[0x2, 0x9]}, {0x6, 0x0, 0x72, 0xce0b}}, 0x7, 0x0, 'syz0\x00'}, {{@_ha_fsid={[0x4, 0x1]}, {0x6, 0xffff, 0x9, 0x9}}, 0x9, 0x0, 'hsr0\x00'}]}) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f0000001300)={0xb, 0x7, 0x1d5a, 0x9, '\x00', '\x00', '\x00', 0x0, 0xfffffff7, 0xc, 0x1000, "190ee52fe1c73237e86fb6b2ffe9cfa5"}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001480), r1) sendmsg$NL80211_CMD_CHANNEL_SWITCH(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000001440)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001540)={&(0x7f00000014c0)={0x6c, r9, 0x61a, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x3}], @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x51}, @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x10}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16f8}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x9}], @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x8}]]}, 0x6c}}, 0x8000000) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000015c0)=0x0) syz_open_procfs(r10, &(0x7f0000001600)='fd/3\x00') mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000008, 0x4000010, r3, 0xab406000) ioctl$XFS_IOC_EXCHANGE_RANGE(r3, 0x40285881, &(0x7f0000001640)={r4, 0x0, 0xb3, 0x8, 0x9, 0x1}) 2m5.957860497s ago: executing program 34 (id=2578): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000100)={@private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @local, 0xdb, 0x80, 0x401, 0x500, 0x7, 0x10080}) ioctl$AUTOFS_IOC_CATATONIC(0xffffffffffffffff, 0x9362, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000180)={0x4, 0x8002, 0x3, 0x8, 0x2}, 0x10) fcntl$setstatus(r1, 0x4, 0xc00) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r2, 0x4058587a, &(0x7f0000000380)={{r2, &(0x7f00000001c0)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x430200, &(0x7f0000000200)={@_ha_fsid={[0x1, 0x4]}, {0x10, 0x1a94, 0x80000000, 0x7}}, 0x0, &(0x7f0000000240), &(0x7f0000000280)=0x5cbb}, {[0x8, 0x2, 0x1, 0xffff]}, 0x9, 0x85, &(0x7f00000002c0)=""/133}) write$tcp_congestion(r3, &(0x7f0000000400)='westwood\x00', 0x9) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000480), r3) sendmsg$TIPC_NL_MON_GET(r4, &(0x7f0000000880)={&(0x7f0000000440), 0xc, &(0x7f0000000840)={&(0x7f00000004c0)={0x360, r5, 0x8, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x9c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x950}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2d}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1a3}]}]}, @TIPC_NLA_BEARER={0xf8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'wlan1\x00'}}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xafe6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x381}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2c}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x394}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xee3f}]}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb2c9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}]}]}, @TIPC_NLA_NODE={0xe0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x45, 0x4, {'gcm(aes)\x00', 0x1d, "1c2606e4d2b70df172e0df8395a0f3c370005298b8e8bf14368e11fd67"}}, @TIPC_NLA_NODE_KEY={0x3d, 0x4, {'gcm(aes)\x00', 0x15, "e4374cc2abde1d0c630ba0ef283c07dcc539ac8149"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "7c8b4fc26d881e47f49047cf6120143f65c895afb14ec6c51eb1de0d54e0c72410cfd8e9"}}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xd8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'ib', 0x3a, 'pimreg0\x00'}}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x274}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @rand_addr=0x64010101}}, {0x14, 0x2, @in={0x2, 0x4e21, @rand_addr=0x64010100}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1ff, @empty, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @local}}}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}]}]}, 0x360}}, 0x20008840) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r6, 0x8982, &(0x7f00000008c0)={0x8, 'veth1_to_team\x00', {'hsr0\x00'}, 0x5}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000900)={0x0, 0x7fff, 0x7}, &(0x7f0000000940)=0x8) syz_usb_connect(0x3, 0x366, &(0x7f0000000980)={{0x12, 0x1, 0x250, 0x18, 0x43, 0xf6, 0x8, 0x1199, 0x6835, 0x6f57, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x354, 0x2, 0x9, 0xfa, 0xb0, 0x40, "", [{{0x9, 0x4, 0xc9, 0xd, 0x1, 0xcd, 0x60, 0x86, 0x83, [], [{{0x9, 0x5, 0x1, 0x0, 0x3ff, 0x2b, 0x1, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x6e, 0x2}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x6, 0x3}]}}]}}, {{0x9, 0x4, 0xe6, 0x5, 0xc, 0x59, 0xfc, 0x75, 0x1, [], [{{0x9, 0x5, 0xb, 0x3, 0x10, 0xf9, 0x9, 0xc, [@generic={0xdd, 0xbc9ca436c635b92f, "993cb915aca2ccf5955fdbabc8c21ff4ccaa650be892e6f47eb6a352eea1231f0bde6d3431723c2e82f15a1fd8edc415d1453d2646f8a93c56cb3533f9c70b6360e9ddbe1577d51b6add3241f240c8c047e00b505df0b0c1a1f0edf984b794624667f5ccdc969bc45ce9653f8a936a3570bf4ad890c2edf710d10cc3d04b6f4586aa265f3fd2a3dae5bb0557d51c972bea9cd33ce6c6e26abfa0373abb45c1be379784755adfc4ba460c3989cf929c2201fe82f398c815d2c2d997346bc4bf2ac7094d55ca55592f0c9463688aabce589e920cd762d00ab8f08653"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x40, 0x3, 0x3, 0x9}}, {{0x9, 0x5, 0xf, 0x10, 0x400, 0x1, 0x0, 0x7}}, {{0x9, 0x5, 0x1, 0x0, 0x200, 0x8, 0xd, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xb2, 0x5}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x72, 0x1}]}}, {{0x9, 0x5, 0xf, 0x1, 0x20, 0x6, 0x2, 0xe}}, {{0x9, 0x5, 0x6, 0x0, 0x428, 0x1, 0x9, 0x3, [@generic={0x8d, 0x7, "a2ef1b4a3a7fa53b3b2f5e348a3f261de6e8203c9cd690a1743a3c6b0f2f80bf22cfc22844d4bd0ecb250a2c24cc51731e48d7f893ddeb2bb87119f43e31802a445c7bb41e967cdf3a16d1eca01f9e199a0966b96b7fc76487636efba71f16ce9c1aa925b0193930898a60d51bc061b4f499789f99a1e794e534386311647c152403633734754c439996ff"}]}}, {{0x9, 0x5, 0xf, 0x0, 0x40, 0xf4, 0x3, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x7f, 0x1}]}}, {{0x9, 0x5, 0xc, 0x2, 0x10, 0x7f, 0x9, 0xe, [@generic={0x101, 0x22, "52c7ba9ff605fa4b044537a31604647b16d3e071641050e48eb3c0d964bff0debeb3fa7f215d3c7b4865821b3aaf917af0e8bed7d519c1546af2e7dc300948a5cb451b0b3402b3d83ef27e8a6fe3bce6b94883f0549ac8df4c30b16398783410d55b100061d3893b2da7c9d7e90dd3660108d83a41a074b040859c1ee7e35687e4d115a95332f443b65b32870c536ee4d63377ce31ad0a5d60125bef828d2d66bdab22b867cbc2df43a5e22ca3d72e47ecbff1834489dcf4741278ce23fd8929dad63ac0f81e694222ac1f2772c79ddc6f13b132c75167196c946d509c55e4edbd5ee712fd4be90b0857c1bb381e3b3233b6e813f061c1ea28979d546247b4"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0xd5, 0x41}]}}, {{0x9, 0x5, 0x8, 0x2, 0x200, 0x3, 0x10, 0x3a}}, {{0x9, 0x5, 0x2, 0x4, 0x400, 0x6, 0xf4, 0x5d, [@generic={0x2f, 0x21, "3d9ccb5ca7f35053705f785f47711d183f3db7b23efe61cca1774a2c4a9c522f7669d6280c744df984e8f1f977"}]}}, {{0x9, 0x5, 0x4, 0x0, 0x200, 0x7, 0x80, 0x7}}, {{0x9, 0x5, 0xf, 0x3, 0x10, 0x2, 0x0, 0x4}}]}}]}}]}}, &(0x7f0000000ec0)={0xa, &(0x7f0000000d00)={0xa, 0x6, 0x310, 0x0, 0x48, 0xff, 0xff}, 0x10, &(0x7f0000000d40)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x4, 0x8, 0x5, 0x8, 0x6b}]}, 0x5, [{0x3c, &(0x7f0000000d80)=@string={0x3c, 0x3, "74a5527fc3e053ee1283986fc1c1e791ae7aa2c3d944f5768071763e8f8e47da75f0a3a203ee383159169553040336611d5ea3e8617ad476b91d"}}, {0x4, &(0x7f0000000dc0)=@lang_id={0x4, 0x3, 0x810}}, {0x4, &(0x7f0000000e00)=@lang_id={0x4, 0x3, 0x40b}}, {0x4, &(0x7f0000000e40)=@lang_id={0x4, 0x3, 0x3001}}, {0x4, &(0x7f0000000e80)=@lang_id={0x4, 0x3, 0x42a}}]}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000f40)={r7, 0x4}, &(0x7f0000000f80)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000fc0)={r7, @in={{0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x80, 0xc2b2, 0xfff, 0x5, 0x84}, &(0x7f0000001080)=0x98) setsockopt$inet_sctp_SCTP_REMOTE_UDP_ENCAPS_PORT(r3, 0x84, 0x84, &(0x7f00000010c0)={r8, @in={{0x2, 0x4e24, @remote}}, 0x4e20}, 0x90) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000001180)=0x14, 0x4) ioctl$XFS_IOC_SCRUBV_METADATA(r3, 0xc0285840, &(0x7f0000001200)={0xd6b, 0x5, 0x5, 0x0, 0x1, 0x1, 0x0, &(0x7f00000011c0)=[{0x3, 0xfe, 0x7}]}) ioctl$XFS_IOC_GETPARENTS(r6, 0xc028583e, &(0x7f00000012c0)={{[0x6, 0x50, 0xfffffffd]}, 0x0, 0x7, 0x6, 0x0, &(0x7f0000001240)=[{{@_ha_fsid={[0x2, 0x9]}, {0x6, 0x0, 0x72, 0xce0b}}, 0x7, 0x0, 'syz0\x00'}, {{@_ha_fsid={[0x4, 0x1]}, {0x6, 0xffff, 0x9, 0x9}}, 0x9, 0x0, 'hsr0\x00'}]}) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f0000001300)={0xb, 0x7, 0x1d5a, 0x9, '\x00', '\x00', '\x00', 0x0, 0xfffffff7, 0xc, 0x1000, "190ee52fe1c73237e86fb6b2ffe9cfa5"}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001480), r1) sendmsg$NL80211_CMD_CHANNEL_SWITCH(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000001440)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001540)={&(0x7f00000014c0)={0x6c, r9, 0x61a, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x3}], @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x51}, @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x10}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16f8}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x9}], @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x8}]]}, 0x6c}}, 0x8000000) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000015c0)=0x0) syz_open_procfs(r10, &(0x7f0000001600)='fd/3\x00') mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000008, 0x4000010, r3, 0xab406000) ioctl$XFS_IOC_EXCHANGE_RANGE(r3, 0x40285881, &(0x7f0000001640)={r4, 0x0, 0xb3, 0x8, 0x9, 0x1}) 1m10.817122149s ago: executing program 3 (id=2950): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d10300000c000440000000000000000114000000110001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, 0x0, 0x40) 1m10.645113466s ago: executing program 3 (id=2952): r0 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r0, 0xc2604110, &(0x7f0000000480)={0x0, [[0x9ef8, 0x7, 0x0, 0x4, 0x5d13, 0x9, 0x0, 0x8], [0x5c0, 0x80000000, 0xfffffffd, 0x0, 0x3a3, 0x0, 0xffffffff, 0x6f1], [0x7, 0x0, 0x0, 0xfffffffc, 0xc6df, 0x0, 0x4]], '\x00', [{0xfffffffd}, {0x3, 0x8}, {0x1}, {0x0, 0x3}, {0x3, 0x4, 0x0, 0x1, 0x1}, {0x18, 0x400}, {0xfffffffc, 0x5fe}, {0x0, 0x3}, {0x0, 0x3}, {0x0, 0x2}, {0x0, 0x8}, {0x7fffffe, 0x3}], '\x00', 0x1000}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000180)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4002, 0x80) r3 = syz_open_dev$ndb(&(0x7f0000000140), 0x0, 0x2283) ioctl$BLKRRPART(r3, 0x125f, 0x0) openat$dma_heap(0xffffffffffffff9c, &(0x7f00000002c0), 0x901080, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000300)={0x5, r1}) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GSUBSCRIP(r4, 0x89e0, &(0x7f0000000040)={'dummy0\x00', 0xa86, 0x1}) syz_open_dev$char_usb(0xc, 0xb4, 0x9) ioctl$VIDIOC_DQEVENT(r2, 0x80885659, &(0x7f00000003c0)) r5 = socket$kcm(0x29, 0x5, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000380), 0xffffff6a) sendfile(r5, r6, 0x0, 0xffffffff000) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 1m9.758527815s ago: executing program 3 (id=2957): r0 = socket$igmp(0x2, 0x3, 0x2) getresuid(&(0x7f0000000080)=0x0, &(0x7f0000000000), &(0x7f0000000140)) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r2, &(0x7f00000002c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) prctl$PR_SET_THP_DISABLE(0x44, 0x0) move_pages(0x0, 0x1efe, &(0x7f00000045c0), 0x0, &(0x7f0000004600), 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000004640), 0x241, 0x0) write$binfmt_aout(r7, &(0x7f0000004680)=ANY=[], 0xff2e) ioctl$TCSETS(r7, 0x40045431, &(0x7f00000046c0)={0x0, 0xfffffffc, 0xffffffff, 0x7fff, 0x6, "8c145fee49affdffffff02000018bfef4000"}) r8 = syz_open_pts(r7, 0x200) r9 = dup3(r8, r7, 0x0) prlimit64(r6, 0x8, &(0x7f00000000c0)={0x8, 0x3}, 0x0) pipe2(0x0, 0x0) ioctl$TIOCSTI(r9, 0x5412, &(0x7f0000004700)=0x12) write$FUSE_INIT(r2, &(0x7f0000002300)={0x50, 0x0, r3, {0x7, 0x28, 0x7fffffff, 0x4069a064, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xffffffec}}, 0x50) r10 = syz_open_dev$media(&(0x7f0000004600), 0x0, 0x0) r11 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r11, &(0x7f0000005480), 0x10) setsockopt$CAN_RAW_FILTER(r11, 0x65, 0x1, &(0x7f00000054c0), 0xf00) ioctl$ifreq_SIOCGIFINDEX_vcan(r11, 0x8933, &(0x7f0000005500)={'vcan0\x00', 0x0}) bind$can_raw(r11, &(0x7f0000005540)={0x1d, r12}, 0x10) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f0000000100)={0x80000000, 0x0, &(0x7f0000004880)=[{{}, {0x80000000, 0x0}}, {{}, {0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r10, 0xc0347c03, &(0x7f00000047c0)={{r14, r13, 0x1, [0x0, 0xf7df]}, {r14, r15, 0x4, [0x6]}, 0x1, [0x8, 0x3df]}) r16 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r16, &(0x7f0000004800)={0x0, 0x0, &(0x7f0000004840)={&(0x7f0000004900)=ANY=[@ANYBLOB="280000001c002100ffffffff0000000007000000080000000a0101011a00020077a9e20000000000b9fb17b295eba3a6a980c9d8d9a688a29c354617bbcb7474fa865993d21bdc8c030c028cad3c88cdcb817f91f245ce0636e5608986500c29cd520ca23272361bd744aefb6378634e082c4a266317c4dbeef108e1be319e1a9a1415c6432a1d9a8e849607c59d85e717bc27dde2efa0b675409d81018070f68c35d547b81e02fbfe68d82acbaf170e804ce5919cec744faea2e4073256cc5abe724ed3f9df4e36ec05afb52c13bf35d259ff72ba272226c6c2a17673ada882aa55783d4d564687b6ae10"], 0x28}}, 0x0) syz_fuse_handle_req(r2, &(0x7f0000002380)="4e7417f7f0afaa93ec1feb61e6ecf74becf5b64c4498ace47170e3439f9db3344aceab3d192ddef8789f7f826a9732df1f1165a989ed666ec2a96eb78b40d1fdd5d53d8c6d56a19efc82066d026cbaa27ee8352b2ab989070bacd96deb903134a387cf0cd7fa82de91ca1193f7ccbd5fb2bf8398e9e5e1bace8f81486378b42f308d9a55d3c14c642591f333cc6a6aae7abffd8de21e569c4cd0219c7b72b44c6b43a5c9b11226ac8cdb1760e405121fbe45ad7349b581cdf811c2cce1585a72ca327313353579454c3bad2460f16ba64d86984d8fd0d61be6902f1d5c92a4b1aa8ffbf256793899af036634d15895e11bbd29c1ce6f9a1114d48f9fcd624db25507c962549a97d4d21619202e112c08e486d7acc55d5ab8e591ed2da9b7e325fca61855a511c7170100f023a048978e5711eea42caa20405f64a5861b2f57e81644750a0eb3498c5ca76105ac6ab2c5c50e4f9b1ff72fcc6f3a01f98119cb4e8dafcf9e35426300018b8cc649c17fcf87999e0d6d1a4c501e9d92934f912b6740d191d9ca4c142b7782f83d3f4862989633eb043b21563a8360c47298fdbc3ce7ba271a5c317c9c66b6a535e2bfa7d7ae54c1ede664560b58e5d4de9cafb2d43cee207612e632cbab64c99b24363d2a57d064be77f0846d003dfcd2d26138a5f9b94205570e1137d5b72919551f25fcd73a5c612e4affc15a868413241eef86b65d0405de5a47384e51810784293333777efe59b8312e59f3bde54ca8a521932103473dce1d2db1f4fff7d338f98fe1243027acc019709d9eef6af6f8fcaa1b7bd6e5048955cfe725a9682bd3f5361057360fe4c163175606d89b380b295a0139dd06404aca8b1beb5a9be7e57964b74344fb1336e126d570e5cf2b64fdf6ca9d33d7b73b4c13c4ef9d1ffd2b82714a78a57b1bc630bbd6d4e63a847e1146376ed4c0585adcc053bd8acdc6df529f3b251de651d3e6398749402391c613f34a5f7e6099e76842e8d66a78cbaa590f6593bf87095bf4a1015a2cad2c13d8656db8f226387fc355a9fff471c93c3c10b265f7472523aeaa5d08f753a48b096b913f7c030d7355f68c9d71e66919373daecc64d14dba60283f49101d6360df9cfe65ea91338e31767b94a1e1463e134b6f19ba51d70da4391341231d5466dcaa39711f227d25f9b320a004243b4f8edec5d8a498b3732466e3bbb548368d20a78c172099647f5938ea6c1ff8c94a37313e871189cb9da58271add887459fc89e615e5c99a125fef828d661096f74fb8b4edb8cd703615b8c732995243b2c826b888eeeb089cf10bc187d36ece6ee30d60c46bd6fe0508aa8308dbf834fe0aaa12deaf4bb1b9337e63b13d6076c5245e27be4fd8cceb433b9608569fdc85dd6c04f37259851566f1f1983536aed757671fca1a3f6615ad5fed80ac36609c6f879f86d8c11a357a04a1113ae2d356433e11ae50169ea71ca614f7171508319cc0b7a9decdae434ed2bd3a313ab41999d09f3cfcaa80924129f77b89173b3a877b845285cbfa9e51fdc0fca6a3c72748cd88173cd8150c825bb0da72518485a3e159422dda9770dba5cb4343dbccc5fc1541e0a157a5295adb32ba7526ca16e6bca5342ce4e58e9cb567670a5acc03e2eaac39185085aba969c97174057026c1e170625c09061583142b21c91c0f8306392c2be9ed372ede666c3f1186ef70f493110e94cfebaaadba5938a29a669c94562e571e607f2fdba0c5721e2026b6a490f80afbbb5c71ac7f8a9fea566284bce2039f5b2405f811145f4ffbdd7e8febcaedfd162fc503e1a29bb63d88a465c66339f1553dde48991289451363ff349587e4099469a5052b4b337baea3cfadc28319e3a24f635d8d5ee8500503fbf1aff0bc1e6f50227cd79bc9e6c2a5ab0f0b92a1e3c6f81e3578f7ce5071e0fc77cdf1d18fe77dbf4a6bfb2587f8e8e317f98ede1f8f32a64d736f9a5c451a01cacfcc0b9099c4808840c2948cd8998abb4badbe30d93a55cfc23df97998efa139ce8681be3b4032e536db63d9c3b7ca6904ae3f0abbd740385be14fe6764c74e19d8efa9e3580252cb25d0d3e2eae1b82f4187b92173189b5f2d4d536c126e453267a6c0410b872cf0f6e2e2b82a527667f598eb0c87bf1723a63a213e22e093abb757af27a53c0f6f3e29c32aeca4c619d5c8f49d41424ddae64ab67ae7286af0fd931e93d06f711b70cc3c6a58a392392bd4623d25144e840c1539a0b8b29ad19d7768c4d2764ca5f8ee72d96a3eb5358bfcad65dc575cfdcb52c662d33321a96ab197aa4d13d984a2a18f94345373fb5dfa031967614dbf070e24c9cf11a8fe8a128aced2d75e5203099db970933abab5ef8f84b1a56c1b2384e2d9413d41226dff043fcd3d8b7bd833aa02d6016e9f756adce96405cb530e7b5d62b483d6e4a5df06cd553581bee273483c243127106df7fabf5daa98007f5178254f8b5024f994c98770cb0267b6a3bdf819d2ac74dd2b38464a6542c28c8ef9220f2dbe947efcbdac9ce81748665957b2ff1b11f73e79154dfb1729f6d6011adb99e4b30f4ae6b1409bfbed29807ad5e02150f1af53e305049ac26c2b28c8ee1f6cc40ddc48ac831ef3ed2e157cb513de06e1fe69f1d66d1a0432f75eebedee30b0523d71e36bcd0f622d95772687b59fec199087dd09c7eb88329d6aad37f3c6d4289dcb799d9349b4b8b401723ec90e06caedd02f294cafc508b03440890aeef82fae39c677d58586d973e5d8c2f00c34f12efa4c8b3b73c1b0941bf8be3ac8119e7d4ebc8e6853c459ab8a0567fbebf1e6036ed187d7f9f7ba0cb8b887389adc41dd23d027009707662ea429c71f01bdfa3f0bffdda25d2dcdc725464e3d4cf32c6f95dcf90eec4978b9af79c92a359fb5bd08776fa77b20a06ed65c64c0bb7a4e34e9e6e85d6e4f4ee34fc7a9e404bd5213f49704082558375b1a76d4e6e84e678358561425108bc7b3630d0a801971e32c037434b80add0a10d5509ef436bf9a8cb5c0a0fe125614a23688ae18dad4766b1339d7080e51af087cc2dd029dc757098d1bfb9c975af94e0d37e9a24c6a6661c99fdcdbb95d023dc016abdf81c1a09b8b4897ed1f2512aea923b362752cad64393673dcb2dce3d63e379f25c340559a98abe43589879a3537bc88526f1c8499db48bfa8d0b51118b3992930cbfc99e48d815c56aad1560c0fc25540a82e17fb931360abb23d748152280ba1603fff1cac0a041c6f9ab949a059f050144e61cbe5ffb8e272f115cbc82bd62cdfb9759a63e77d3cfdb0a25e504aa5a1e4eda15fa2e1e1a7bb18e74e62a13fce33900d760d89608c79f05b9e11be34cdffbafbdc60838f5a6f76cd8a3ff1072d90462f77abff31e054f3f552772ea750f451d091cb2fd6eef92a800a7837a28ab1be8885b6f9eb18a3093fd989f697bd23edb8075c7120ff375ac72576d625080e107843aa7523fbcea78c18b9762a89e562bf098d61b5b2f2521d709a9611e312c7691f47a503823fdf715afcc6ed3e11dcd0dd77a272cfbdbc2405e26eaf4e2698b9501279dc095c8869128af162383795ea6a14b6cd0b1cb3828b4d98cc4439d8dc51c20ae9e5328bb05a59151818d6526df969384678dd202fd4415f94b861b2ccaf8873680ca6cb9d9fd12f26c11dc6bce36cebbf7734b7bc5a16d882407e26cac42fc9e178af21478c782ac0418c2ecf1876ea2cbeb946b881e460fb81c02c2a91b859927ba4e72f7d03091b3dcc460438ee1aa7ac00f561ccafdbef63ca4286ba78b38c443d470dcfd2211ca74703d27d1cba021071da6559505ddd7f0c8b71115d7196318bff0d2a3381573f79f23c7cb8de2d2dd8d9b86268586a614880ef74c92e5fc80906f453f949afecb888337d591fad11d4efe7ed1cdac88a0569e65ef9733f0a2ab70a323ccb10fbb98df982f0ee5596665ec52a2935d0e3f9d83175b2aca4ed312e622bae00fa4171e73c168735e79bc21561ef91f83adc582bec05a44d6dcfff78556690c9b104d5e64ba7f8481c38c1b7e35038fb60f2beb7ab4a64c9426a498ac3cc1c6c192b6e95215dd8907593b523a399b583cc21808b4b7c237a069c59728f58dad4b00fcf21f70f91713b056db9b3f8a9da36fbf641e1681f6c56a45da353b116547cd4506ca1289b595b475c2596707111f05037557adf077d467b01cc787717842add3a0767d195edcb05a7598a4d1b3baee786a969e87beabf8221ce2b2f9010a85eb31911baa39f1c59f289116d8b9cd360ab400eea764537511b13c871e4b497ec78be7043cf1a737764f2dc810862d41f0c32d0a3f713e9243df3777fa053bfb646b8e1bfd6675e96404e9ffcc2bfe30d09db0684bb8ab8267a34705eb57f374cb8280964a8171c2b8b237d38d44018d79c8e375e21d55178c12bc96e429b339887a821bf0132d55e1ecb161165e9b152034ae6e468c175a71e657dfdafce9ca273ed84b4b469f2e4bd8847d0b86e8d12c19bd18083f97ee1d00b588427d09b54c1b3254e53dfe48b5c19fd6a899994fafa1b31d1f17dd20a69a3b20e9b31527c7e076ef1c9333c00c1b94d5dd71305eb096498202a276870ecd7d68e5737787b2e8ae158022397bf77829adb0b807473a139d4896e30e35aa10059e38fa8431b647dbd2ba57855a82b816d19cec134a378e9cfceb4654bfe77721c10025fa24e1149ae89822441c2fdf655e0d70bb50836352cabed3630689c35a2984671ab9c963d5860a3689c8c1562228d397d0a3cb59e8602d7e72247e29656ba04e53cd2659511274d766cb8d78755f2a3127e2c70b91dd46ba520068d80f6c4115f2b223a3f606d194f5c37bd80550ff5e9aaf4ce5ff329012239f25c12efd79a697362f90d42cac99f323f99b45b918088c2590b6cfe8a1795492d1520e51ad7a2c403901c7809616710872d0c3d67926752d308ca84916bcfcf9573501227318822d40d00742992662cd629a0cf7f688d326fbd10f201c459c7f463cb34b12f8854c4df436170e3c97840803771caf57ff87b70de5cc4a8ecf45775a4f8849df99e6eabe0bb64bb7f6af35701bf384bb04728f87a31297341a662912925e5f0806a682148efd04b099022f1aea22e3419d157dca427cea5dbbab7a0ded30641d16a83fa26e1551d4a5e8639bf175e1dd80448043539083a379aa9ab4e07f54662c9c4e45178f43cca3c61552c7db984f56d35fd41c41cf8d176d76b2ddf0a8e2c36621cd7c49b411e4dc516da4bc418b2410ff1306c639f1a17f36a62229d2cb32049022d2cffbdecf467f82c314a0388f5c74d7600e1cad70e2fedab09ec362e09c5c18d7e38fb5eb48c1dba21ca96bf9ae470de81f7231048fde18225f64f04e1f322e25e45e0a8e4240d6035bd4ac4824edf111553edb5d3e1e432460cfc48fc7783dfcf26f7e4edb510c201d097a3e4a7d24400e68c24ef57ca2e90176fc32c76b2d9d2334c0a011de42c04306664f40ba1f6d25d002e6331234b9131d6783536d49acfcd47fb83e5380df7a2c87574e26ccaf595ba6849d6f855cf19bebf271592b2bfbc2d7bf998a0012edf01fc6b00f911fd662b6c33d896f7c5c32a2f91037255a16785945e8c3a8dba19889969ec01a3da9c836365305b6c944fa95484a6a50257b9da0bd3ef7bc055c6b0abe09003200298a5ddf381e8eff042aa2eaa2f07aee41a30260fcbb042baffd6e022d725b4b7805a3550109f0d92bb33092294f2b2a84a965550e1b23d13a57f125eed60206d75db2ad5fa44f37a0d600fc7136b581a76bafd3c01ed229ad8734e1b044107713bf6c779600622ea3358ba78f1a8476d934cb9fb19f799aef8a4a232e986a5da978d14fe64e918dd34b8ba29d44f0366b527786fe469941587b0cef4a515315e78b93b52f88a3191959b66e320c2272fb115255ca0d7b88e1bca06e71f90c3dc32fdd3dd8bc1c5e71f606b648c49e9e1486fbb8f24873826faddfc876ea79a2446423f4cfe6b0e94fceaf21c6412e2f9f8e7e2ea9fef73cbb227ad9d89dcde0b92f075b57f3d82b69c297a70c4e27c143e62e13e48ae65a874381763a870cbcbddeba6fe7bf9904c492c0d433fafea50f89ea8fa66ebead1ab6e751914c45e164865ae49bb44d5db40589f5c601b8c202a62cf91ce26753e7e9656d7158a6b39e44ec92d2aacf60fd0077d14dc92bf406c99aa54971b28ed81f3f39fe8d0293e90a494b6dd9b1c90fefc859655cce4eabb4071380cc41ed628f83b0909e56456536afa595316afa012cfad467884e558565ca6f162bb8c012939800eb664c30ebbd5057c26cf67cffedef77c9af863f7293dfef1c2b7c5f54d84547606831b47e177d3edb370196afc7312325b0877676b41c625850b62b05c715fd4892e0878b36130b8e3f5bf8d8a714fc32f3b9b9b380dea0d55806c62b798947b6ad5dfe240aa95bad5407329d2a4ca1ad6fd1233507149333809b4a9d5e295f944e38a86d45c04d856d280397afff31bbe161b18f153389ec47b999b8ceb38305f801d25c60856517abd16b8e9ac4185dec46e856a0b5d95dd6d67f6e5b12a543a91493f9aa2eabbf3a5aee4218a1687919b7974d5e6f576691aafc10f105a73f676395ac6e5166b7d003f2c3737c04e7461ffda1151a7fc4776b1881460eab2877ff6204e1ed607f785a5c05ae4b171b7fed2575a75d11f73bf7d6074a011e0023fd3fa843e3c63dadb95f9ae07ad29c509e9d06e59e6b7564786a01acb67b8488d66ef21a793bfafb69df84cc2557f97b15db98ed8bdd1909c83da5890596e53f218cd980ceb75ce1b678bc222fd21c453b72852fc3aba410d666e07cf2b38c2702158768fbd489e469db093c7fefa0c27dc826db746a3c8c99e3261279c7cf79d21ae096609b8db473136c5065cfd13db955b87a7479effdf668bf10110e9f6aa8f4b711109d98e6dbab022f2f4690424e241de429c50a6de76595296a42a4bf0b2c1d9842fb0ba3ef6ef1aaf6cbb8e839764bd9677e491f23fbdc28d0ed5d9e09be429da7ed1a93e85828f9175c74446bf62baf9726e23207226b34d839a42e13c63fbef2caeba904f7b5dfa3667ade62a8e3bf5764828f9b2bdf2ea11b70e2a603d3a69b33ace06e8986fc811e03d2de5bd4bc898f67a3cb8c75abf198e9455e3a0f86b81b94f0cf367b6ea410b97feae2d9411b410179903a4df9a989f25e9ed2b5a7763e11a01874039d88d9a3cb4435301f7f922f29c8729149f90e39d6f2998875728a3b0eaccb793385abbf3735f3948aae9cf5982c6d3f3bdd5061d611cdf7209392fbb1ce6e709dedfbdbb4442e243178f93b8ec384d8fabb69de31bf3232618f05945b162406708a3151222f42c54d982db53e0cb3baba85d6c13e7f1a2a8ab296a0313ed9a476605ef876f5c3f10346a33b9e6af598d865a04a5b46613d10494b1c9d51435bb551249f06595c96a525f8cb76d2ddde641f0745161f3496726e9f4b33886180e05718ee265fab07f8ffcf95a7a985f334e33db22d0907c1ffc12abe33e880ab6b1198f5fb3c9a21e58e021ca300f333ab16e7f47fad98ac28ebfbcbe405f0d8eaf08f286dd4035b1fb922f48d34914a628fa342efb64f9f1f943bc7772333887cd2e69a16f00c51c62afb8fd1f3ebecf61d166a769427aa0d36c0ccc7b461a8a1b10d241d8a32a46e010085bf3de570861546f7b03e2887ff3aa5692b2f8602912186de386e3bcc2597a18f6c2a9ff6215110a1fcbfe3b5e8a9e893750f3a7d1063004b3b2e6d109339c2a7aed0a972993d717f960fecaf9c1565d2823ead43ccf659da1f65b45892b562a55f32005e87d2f9678a01fd3bf596c0ef873fbb0754bfe87eb36f3e68925e97602881166b4f22e4b0cb40f3835011e8d6e22bedf1f96092c4e91f3b0ef46af602e7e80694719ad08bb0e6d59f29ab5da5832ddf55dc9ec64f68f22d33c7f81a9cd754e896dcbea71a5c0ab471d496b5a40281077f96374c2cd2475a0b2b82b0f8d84568df8a05cc2be840ff8319d1bfec5f086f4a9116c68645597d78b55e483a5cf1f25b423ba35bb2e03fea1aac22a0ae233182f96fb9023be57e47f79169df21adb0c00b9f6b6dd0d1f6a14eafc2b03c27a3c38bdd1057d7e0446e64759f80bfe23e765a70d4e66cf9159da4263574761d413760951935b3b4241e188550f4a61707a7ff26c48b8941a825d7a849cdcb834880d8b9241b96dcd73ad4235bfefc4aea659d2b7116eddd99c92b290ed89ef2359cdb9e2b6ba68f3206ca035d8731e7c4b667a9baee1b4a4c5b483f7793543b33cbf59629d6e51d7d7ab52266d478510c4374e3d3ec6ead98af9257434e2548e5d8ede59ccd7a0712bd61a43c5d4d98844c52d3f97925da0959dc5640f4e168e0c3f1130bc7587272e5011bfe62ed423c0a61790b3633ee059654b12a2c405dcaed5bd154113fc63b5f934d90bfd54f6d94029cb298c88b849ddc3358e0f255362da2e229725ddd33bcdc3a3f94a4181499d0924786fc0f8a41a525326735218ae0275794e260af9d83aea4bbe4a25b8dd74ca78cc973ec4c2358cdfe7c242c19a8c986050cf9b51dcdbd8937a5f85b8979e1f95b10cb7a92bfd4ccc6d0fe36b80ad89d76bc454aee3d02edd0ada94874deda4d1db16b933ece2c3fe5dfc5ef3b81acc173da43cf92ef00bad4d6d56489bb9eef0db3e8d24973118601ee04235850f35d52975b9d062afe29c77bdf4ba424fbd2a6681e7d8a72df5a7b1e893b9a8dbce598d28860e8fdb4c25928dce80d626ec1aeccae3e11ac805ec17180cca8189927c874385111cd9e6f4e018138e4a79c02fbb01bf4381ff648f19340ecbf03db5ec984e02296a0209d2c31266b34b0336f0e11b35d504d9e8c268ead0362a5b0a7289ce069784fafed6f9f69377ccd1bdab347c2a089b82fc1555a07e3ee873705b9c8bef22443b4b2ad2019e4fc153834e3e5eef0665c6d803963dd9c2f0546f25133011fe8f725744d86b33cad127bad73e3b55ae88253386246cafa7fd563e382c1659fa147537d348bf6cd973ab8715d0d1bebf57a975a88905a1df56274b30aa480b00d2da67d750e28fe98f57c64743064f56631540cf2666e04e87fc3173e5cf7407454763ce1bd064de2023767c3b41cd4cc312d3c65bd6410a3f2f898a883da2bb8d6cee72339c28d001cfc7d142711c100a424e1bd734a6701d28d38d075b73eb1a9b422a64f3bc52901d7d4c7ff6ef97c62f661820d9a173f35c34f266694363261698cef03d0e91dc42ecbdd5c7ae60fdcf0ca19afed2414d8ae7febe31e0df02d05b0713a996587f123f9ae8254338000770d939f8540129ef761a741c312bd3286ad14dd8be2360fa78e895d328b618e1c67db72a83e2cd46a009fe48342ee87371f1d14a248c1cc8cf0bcf6bda1c2fa1551e958b8006650b0bd8e56b239b9a2f3cf0070ebd397d76bdfd3d62f236fe1ea6d4e7334e0f96182f320b98b4322691f24baabaee2d3b2ccd0c899e0261e90946c1ca7ac41cf9ec3bb321783bfb3ccec02033b11fdcc32e2064c815623aeca5cd0d5376d2aedf37a5f047fc427fc0eddec5d8cbeee8bfda52390eee341a180f43f413f7ac652e5f770a7506057e731355f9a6ef597799df7720bd494b5d2c2b02b0e7fc078f1a6fbe73005bd8cb3ae3c4edb9ae8d1dba0eb9a2007e7462de675f753b2174869534fed8e9ea4eae3a09da34eca0ab9f0560e05736aaf13504bbead2bc1e0ee97e6a6c01b79b6bacb017b8bf744aa250b38af2d4862951d0b0e588c6924f880d008d246b96be8d1e577acb271f33da415ae85a4a36d47288617232d32de0d1ae8eed9cd02d4e6081a956627e3f1bfd1f3651f06d6d61473d58591816b75961ec837a65f923e39816d620dc8e80375337c781020b85e03792a4b2774926d59075040f5ecaadd4163414547d1df0e2606106a67fe9f69652a59400bc042cb81a76e4f14d380882f579627cdd5fc478d5cd89a4dbb24c4252c89146d9b0cfe7fa99a72269ff5d5f04d8c91a9e354d10cd095fe24101e51d6be20d89fe9b21601eab458d9bc0fe73698efd2192c368f87405a413817ecfd88214dea122fb0d8d139efb395246c0790e174c9d8adb10caafeb2b6a2742c966fc687cbdb853be478befda9b89b106660854a00ced9c7028a7071f40280d91daf78d26c854051f73340431d003ce66680045b1cc4480abec0331a807d631a4560478626fd41aa8c3fdcb66d75aefb6a29030b0c94be961dce67db553863464feffc8b72c3e7219003eb942d359e777a87bd2c2e1a27f58e30e0eecc10d9b2c9f0b1552ba2965503ef2f77a35d88b82abc97837874b67bf1ae656a3b2fed7d60be4de83a83da8d98994cfb9c458fd2b883d8e9751670c62eec4bec7c7873215bf99f17e9628f1ac1fbeac4004d288fe279d2bcfeb4ed7671048de8598c7a9ae328e829e4115a5ba155ea2641b1df684d457f527339ac8ea6705ac7e73590f900bd73a434e4d72d8175aca5beade289da131374c40aa72014c6446fd943e8a2f7ac9e7bb008128bde5af3d3c1e1811f7df88329700fd40a5cb12396412283978589d04019c9e019ebad5829b15098ecd0f03b5901b2f48644a13b15558abe018087240153990dd38e9e9e60ad9bf1df3f21d574383535ea5f44298a29c1e90bce931dd45f5b4d06029929dfc88923bea8c20b56bb43868804e5e28486aa345ecc9e821d24f9e02c120066ad008ab22bb6f22bbff6036bddf2dc05c50bbcfdedd621be2410f9b8de2f364c8cd259234072bf3ad45fcb418d40c81c553bfedc91f50cd322c8cf07a8f81862dd0d3d0d02ca4acf0fe7ca0da1d90e3e74740ce6a38d69de93c01e46aafe400accfe872b76f94e4a055e1849a82a520b9ac9cebc34609843fc04bdccbd220f7a9d499553cfd9809c6084ec3ea2132ea5350bd9ce7ea7af466d3bafb0aceb86a0e72b658e8b3866fe9a28c78afcb4da501ecc357d2f4c9787f72486eee8ff03aed4ddf09b247215c134c02d50106dff1082732e750f7eb804320978873d1daf87369a56b84f8bc2fe2a98a755fbd645b3ba4d2ba3691ef05832540cfe12c7e19c5ffa35a59e77cf999eb1d38ffdea79ebcbd573d1020bb37dae73ed250be1de70230aaa346865835ddc3e38ef371f102518adbc1bfd4124146686e610457c603fcfa2c4a6f74e8c904b977f4af9475d72adfceaba7db108330983b247a63b2609daba03df9f27665343ba40e475873a2c774561a8776088663377dd330ba415261bd7e25e9ebe435542a0e2243dc1bfe7d429b43036f8c1aa8081df47e007fd54f6f6eb420bc416f1c9a6d82e572d365e881ccc6e8f48ac1b338effe51c6251801ebcbecf5732601c4bf1dbb703af33738828b69392d10091813ce2b93e6b51d2d263f44de2f7f1d17441dd72d3ee4135d8591dfe4dc96c1317f488b141a92e6f750ad60874694a4959f5488342c3f306f1eab8472615abd0fd27cfa71e9c88ea9957c7431033e127a5d3a9c774500b6899f4e3b5f2fb7367ad200", 0x2000, &(0x7f0000004380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000004440)={0x90, 0x0, 0x2, {0x0, 0x1, 0x2, 0x5, 0x7, 0x7f, {0x1, 0x5, 0x100000000000, 0x6, 0x0, 0xf, 0xa734, 0x200, 0x7, 0xc890c63e415c0913, 0x101, r4, r5, 0x9, 0x10}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000004500), &(0x7f0000004540), &(0x7f0000004580)=0x0) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r9, 0x8008f512, &(0x7f00000045c0)) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000004a80)=@broute={'broute\x00', 0x20, 0x4, 0x4b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000045c0], 0x0, &(0x7f0000000040), &(0x7f0000004b00)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0100000005000000000000006005767863616e3100000000000000000000767863616e310000000000000000000076657468305f766972745f776966690069703665727370616e300000000000000000000000000000ff00ff00000012285d9a00ffffff000000007000000070000000b80000004552524f5200000000000000000000000000000000000000000000000000000020000000000000007f87249a6cc4ae01848be2f5e08c601586c63047d999227f0e702a87a943000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff020000001100000044000000809b626f6e645f736c6176655f31000000006261746164765f736c6176655f31000070696d3672656731000000000000000064766d72703000000000000000000000aaaaaaaaaaaaffff000000ff00000000000000ffffff00000000b000000010010000600100006f776e65720000000000000000000000000000000000000000000000000000001800000000000000", @ANYRES32=r1, @ANYRES32=0xee00, @ANYRES32=r5, @ANYRES32=r17, @ANYBLOB="040600000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000fdffffff000000004155444954000000000000000000000000000000000000000000000000000000080000000000000000000000000000004c45440000000000000000000000000000000000000000000000000000000000280000000000000073797a3000000000000000000000000000000000000000000000000101000000f9ffffffffffffff090000004800000022f06261746164765f736c6176655f30000065727370616e3000000000000000000067656e65766531000000000000000000776c616e300000000000000000000000ffffffffffffffff00ffffff00000000000000ffff00ffff000070000000a000000018010000434c4153534946590000000000000000000000000000000000000000000000000800000000000000ff9ab011000000004e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000002000009006700010000004e9a179eaa49494c5824618dc6abb76e734c15bc061f559cea2d1f1c4471c3f9b758b3407e1eb35c29e8ffcc6a130102c129ff573bac195f72041d35450ba65c0000000000000000000000000000000000000000000000000000000000000000000000000000000003000000fcffffff01000000030000002a000000430576657468315f746f5f627269646765007465616d5f736c6176655f30000000006873723000000000000000000000000070696d72656731000000000000000000ffffffffffff000000ff00ffc1e88fea80e1ffffffff00ff00007000000070000000c000000049444c4554494d455200000000000000000000000000000000000000000000002800000000000000f9ffffff73797a31000000000000000000000000000000000000000000000000050000000000000007cf4ed1484de1a6d0ad6e3f0f86bc502914c20ca1a3d48979d9f81bd5c884662596d4dbb5e636f1cab9d163a58061d4eede9320a7df08b66cbbe2dad5a831e98bcbf1ca014eb1a0e0af3e413cace1b8f04b26b27b903060637f"]}, 0x582) 1m8.457782545s ago: executing program 3 (id=2963): mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./proc\x00', 0x0) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet(0xa, 0x801, 0x4) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0x8) r2 = accept4(r1, 0x0, 0x0, 0x80000) getsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000740)={0x0, 0x6, 0x3, 0x80000000}, &(0x7f0000000780)=0x10) r3 = syz_open_dev$vim2m(&(0x7f00000007c0), 0x1f7ff6, 0x2) readv(r3, &(0x7f0000000800)=[{&(0x7f0000000840)=""/250, 0xfa}], 0x1) r4 = mq_open(&(0x7f0000000240)='batadv_slave_1\xbb', 0x8c2, 0x30, &(0x7f0000000480)={0x6, 0x8, 0x4, 0xc07}) mq_timedreceive(r4, &(0x7f00000009c0)=""/4105, 0x1009, 0x2, &(0x7f0000001a00)={0x77359400}) sendmsg$nl_xfrm(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYRESHEX=r2, @ANYBLOB="be6b6e000000000050001100ac1414aa000000000000000000000000ffffffff0000000000000000fc020000000000000000000000000001ff0200000000000000000000000000013c040000080000000a000a00280020", @ANYRESHEX=r3], 0xf4}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) socket(0x10, 0x803, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000300), 0xdeb, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000340)={0x1, @vbi={0x9, 0x3ff, 0x3, 0x50313459, [0xb, 0x5], [0xffffffff, 0x7f], 0x108}}) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f00000002c0)={'ip6tnl0\x00', 0x80}) mount$bind(&(0x7f0000000140)='.\x00', &(0x7f0000000180)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) socket(0xa, 0x3, 0xff) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540), 0x0, 0x0, 0x0, 0x40448c5}, 0x240048c0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x1000, 0xfffffff9) write$P9_RSETATTR(0xffffffffffffffff, &(0x7f0000000440)={0x7, 0x1b, 0x1}, 0x7) r7 = landlock_create_ruleset(&(0x7f0000000080)={0x4080}, 0x30, 0x0) landlock_restrict_self(r7, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r8, &(0x7f00000004c0)=[{{0x0, 0x0, 0x0}, 0xa1}], 0x1, 0x0, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x1) umount2(&(0x7f00000001c0)='./file0\x00', 0xc) 1m7.920918919s ago: executing program 3 (id=2964): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='my_configfs\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='my_configfs/nullb\x00', 0x10000, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0xc0, 0x19, 0x1, 0x3, 0x0, {{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x1}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x5ee76b3ce2b5fd35}, [@XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x1}]}, 0xc0}}, 0x40800) 1m7.42241799s ago: executing program 3 (id=2965): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000880)={0x64, r1, 0x1, 0x70bd2c, 0x25dfdbfb, {0x35}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}]}, 0x64}, 0x1, 0x0, 0x4000}, 0x0) 1m6.94598981s ago: executing program 35 (id=2965): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000880)={0x64, r1, 0x1, 0x70bd2c, 0x25dfdbfb, {0x35}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}]}, 0x64}, 0x1, 0x0, 0x4000}, 0x0) 9.980248047s ago: executing program 6 (id=3325): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001140)={0x34, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) (async) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000940)={0x34, &(0x7f0000000680)={0x0, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1c0) (async) setxattr$security_ima(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180), &(0x7f00000001c0)=@ng={0x4, 0x17}, 0x2, 0x1) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000880)={0x34, &(0x7f00000006c0)={0x40, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000100)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000700)={0x40, 0x18, 0x46}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 6.667930342s ago: executing program 6 (id=3336): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000340)={0x0, 0x13, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000400000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a010200000000000000000100fffe0900010073797a30000000000900030073797a3213000000dc000000060a010400000000000000000100000508000b4000000000b4000480200001800d00010073796e70726f7879000000000c000280060001400000000034000180080001006c6f670028000280080006400000000d110002402b24292d2d2a5d24402c2d400000000006000440000700003c0001800900010068617368000000002c0002800800074000000000080003400000001608000140000000120800024000000000080004400000000020000180080001006e61740014000280080003400000000008000540000000000900010073797a30"], 0x150}}, 0x0) 6.193767398s ago: executing program 6 (id=3339): r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$MEMERASE64(0xffffffffffffffff, 0x40104d14, &(0x7f00000001c0)={0x5}) (async) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x50, &(0x7f0000000200)={0x0, 0x0}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) (async) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0xfd}, 0x0) (async, rerun: 32) r2 = getpid() (rerun: 32) sched_setscheduler(r2, 0x5, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f00000001c0), 0x651, 0x0) (async) recvmmsg(r3, &(0x7f0000000200), 0x10106, 0x2, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x6) (async) ppoll(&(0x7f0000000280)=[{0xffffffffffffffff, 0x980}, {}], 0x2, 0x0, 0x0, 0x0) (async) mount(0x0, &(0x7f00000002c0)='./pipefs\x00', &(0x7f0000000300)='rpc_pipefs\x00', 0x0, 0x0) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./pipefs/gssd/clntXX/gssd\x00', 0x2, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./mnt\x00', 0x1ff) (async, rerun: 32) mount$nfs4(&(0x7f0000000840)='12\x00D\xb0\x1dk\x17\x16\xfb\xff\xff\xff_\x15\x93\xc8C\xff9=\xb52\x89\x87\xa4\xffN\x15\xf9\xc0\xd8(\x0e5QX\xd6Z\xd4\x8b\x05\xb4\x06}h\x9f\xd6\xdd\xb5I\x82L2l<\xcf\x12\xad\xd8\xa3\xda(p\xf5\xedme\x9f\xf1\xa5\x89B\xbd~\xc7\xc6\x15\xbc\xb9\xf7#\xbe)bu\xd8\x83[\xa0\xa8h\xebT\xbf\xb4w\xaa\xb6\xa6,\x85N\x81\xbb\x06\xb3\x83', &(0x7f00000004c0)='./mnt\x00', &(0x7f0000000500), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='sec=krb5,addr=127.0.0.1,timeo=1']) (async, rerun: 32) nanosleep(&(0x7f0000000580)={0x0, 0x2faf080}, 0x0) (async) r6 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./pipefs/nfs/clnt0/gssd\x00', 0x2, 0x0) read(r6, 0x0, 0x0) write(r6, &(0x7f0000000600)="000000000000000001000000000000002400000001000000ffffff7f00000000000000001100"/52, 0x34) (async) r7 = syz_open_dev$cec(&(0x7f0000000700), 0x0, 0x1000) ioctl$CEC_ADAP_S_LOG_ADDRS(r7, 0xc05c6104, &(0x7f0000000740)={"000004c2", 0x6, 0x9, 0x9, 0x7, 0x80000000, "83a9b5cbd31510e3db55f2e701f9ba", "6709d63f", "d2621971", "6088a19e", ["ba8cfbc34f89d0b1b5c9b0f3", "6332fd79e9a00555dd45ae95", "e4d0d0fb73fbe0a50aa1a709", "e39f08a51e7e66553269bfc6"]}) (async, rerun: 32) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r5, 0xc0884113, &(0x7f0000000640)={0xfffffffd, 0xb, 0xa4b3, 0x3ff, 0x109000000, 0x48, 0xffffffffffffc474, 0x9, 0x12, 0x7, 0xfffffff8, 0x3}) (rerun: 32) syz_open_dev$loop(0x0, 0x5, 0x101000) pipe2$9p(0x0, 0x880) (async) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000008c0)=ANY=[@ANYBLOB="1c0000005200010030bd7000ffdbdf251c0000000800010043de3b25cd7ebbec1e0342bc2aaaf7291997300f59867c98b6d79ed586733440977daf0efba22c2bd790cf02b1ef3451f57fe3ee5e876d61a7759c3a8977badbf7f878580555598e2157756a6f3b90dc", @ANYRES32, @ANYBLOB="054594a414a9c4f3efac52eec1d4f5309e43a91ef60bf74b1e54dc66db018e993dbb2184b9391e562d"], 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0x20008811) 5.520261652s ago: executing program 2 (id=3344): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x4c, 0x2, 0x6, 0x605, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x4c}}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="4c000000090605060000f9efffff00000200000005000100070000000900020073797a3000000000240007800c00018008000140ac1414bb0c000280080001400000800008000a40"], 0x4c}}, 0x0) 5.363539803s ago: executing program 2 (id=3346): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000500)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)={0x30, r1, 0x1, 0x70bd25, 0x1, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x7}, @NL80211_ATTR_MAC={0xa}]}, 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x40000) r3 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$apparmor_exec(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="737461636b2026ae86ad47aa0d9495e6d80f7bde2d18ffb36cf152aed2d408fb58e305fc8e2f2f"], 0x564) r4 = socket$netlink(0x10, 0x3, 0x14) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, &(0x7f0000000180)=0x9, 0x4) bind$netlink(r4, &(0x7f00000001c0)={0x10, 0x0, 0x1}, 0xc) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/pppol2tp\x00', 0x80, 0x0) mq_open(&(0x7f0000000200)=').{\x00', 0x40, 0x50, &(0x7f0000000240)={0x80000001, 0x7fffffffffffffff, 0x7, 0x8}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000300)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000400)={0x20071026}, &(0x7f0000000440)={0x200000, 0x200000}) r6 = socket$inet(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(r6, 0x0, 0x43, 0x0, &(0x7f0000000480)) r7 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x842, 0x0) name_to_handle_at(r7, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000380)=@orangefs_parent={0x28, 0x2, {{"78b592471ef23ef5a91f357a4936dd77"}, {"27be11c1cb9a44b4d6efbd55df5f55b5", 0x7}}}, &(0x7f00000003c0), 0x1000) 5.071167205s ago: executing program 2 (id=3348): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12012000f1048108cd060202d4920001000109021b1901000000f30904150001da40df000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, &(0x7f0000000040)={0x0, 0x3a, 0x38, {0x38, 0x2, "44ba25509e3f24a53eb49d602ee8faff25a2b868ec8ca4f10695ccb1ddcc1c171f1abfd5890edfd5cb17f6410439c0a6ee3c88275936"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2009}}, &(0x7f00000000c0)={0x0, 0x22, 0xd, {[@global=@item_4={0x3, 0x1, 0x1, "47f61d9d"}, @main=@item_012={0x1, 0x0, 0x18, "c8"}, @local=@item_4={0x3, 0x2, 0x3, "3821a4e2"}, @main]}}, &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x5, 0x2, 0x1, {0x22, 0x245}}}}, &(0x7f0000000340)={0x2c, &(0x7f0000000180)={0x20, 0x31, 0x5f, "4ab1c4ecd35ba9eed284961afe046282e93e9b5afa944f3012171394dd85039ad69394f8ded306f353be359f0ca70fe0a191c26b03cbe0a4bd54cb1e4b6f018ea7af41e028bb0d4e8c0594ae4f67a141f1d5797a3dc0463c39d4219556c006"}, &(0x7f0000000200)={0x0, 0xa, 0x1, 0xe}, &(0x7f0000000240)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000280)={0x20, 0x1, 0x3b, "c2ee0af826f18fce9a24fdd5ba112a23a855ed786bb424363bb9395b194cee043af90979df2e2054fa9b88933c43ecee49cddcbae5e8427a8fd3ab"}, &(0x7f0000000300)={0x20, 0x3, 0x1, 0x7}}) syz_usb_control_io$uac1(r0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_udp_int(r1, 0x11, 0x64, 0x0, &(0x7f00000025c0)) socket$igmp(0x2, 0x3, 0x2) 4.75541013s ago: executing program 6 (id=3351): openat(0xffffffffffffff9c, &(0x7f0000000200)='./dir0\x00', 0x42, 0x8) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000040)={{0xfffe, 0x5, 0x0, 0x25}, 'syz0\x00', 0x43}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x12) ioctl$UI_SET_SNDBIT(r0, 0x4004556a, 0x7) ioctl$UI_DEV_CREATE(r0, 0x5501) mount(&(0x7f0000000240)=@loop={'/dev/loop', 0x0}, &(0x7f0000000280)='./dir0\x00', &(0x7f00000002c0)='omfs\x00', 0x2008089, 0x0) 4.361775908s ago: executing program 6 (id=3354): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='smaps\x00') r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) setns(0xc9, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000400)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r2, 0x400454cd, 0x10f) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30a) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000280)={0x0, 0x2, 0x2000, 0x2000, &(0x7f0000010000/0x2000)=nil}) ioctl(r3, 0x4048aec9, &(0x7f00000002c0)="010000000000000003") exit(0x100000000000035) lseek(r0, 0x289e0cb5, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000040)={0x6, 0xfffd, 0x1, 0xe, 0x0, 0x400}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'pim6reg\x00', 0x6bf1c2d5adba8c32}) r5 = socket(0xa, 0x3, 0x3a) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f0000000440)={0xa, 0x4e22, 0x10000009, @loopback, 0x7}, 0x1c) connect$inet6(r6, &(0x7f0000000480)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) write(r6, &(0x7f00000004c0)="c64d028c42", 0x5) sendmmsg$inet6(r6, &(0x7f0000000500)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000005c0)='$', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000640)="a3", 0x1}], 0x1}}], 0x2, 0x4040881) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x23, &(0x7f0000000680)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f00000006c0)=""/4096, 0x1000, 0x0, 0x0}, &(0x7f00000016c0)=0x40) setsockopt$MRT6_ADD_MIF(r5, 0x29, 0xca, &(0x7f00000001c0)={0x1, 0x1, 0x40}, 0xc) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, 0x0, 0x810) socket$inet6_tcp(0xa, 0x1, 0x0) bind$bt_hci(r7, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="032dde00006fd82ff3815f6377e69fa1423c4df7ce40e788d1367cedf3b8b1a97422e678ff5cf9bb3287f144d94c7d6d0917f3d7cf16bf13d9c54afc70151bb463b860817906066649ccc66b15724dc3d0e3e0f604c558888ef0fa89b7f5494ea1c8a7037275d576a7a6762eafe6a07949871628166dfa0dd757ff8c981a57faf65b8791b1b761ead35a33c543da54164437e30a0d366a5756d4c087ddce037ac56fc6af427c6621a714b49622c9b2ab704aa169b5ea6f52164237f527b35818a910f2bf8295434b56e02e6ec30c05c29ac9e97c44ee45fc34aa79ad23d1e3a120f35dfb679b0be8fb9d5543725295c953676cba"], 0x4) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x4982, 0x0) ioctl$KVM_GET_MSRS_sys(r8, 0xc008ae88, &(0x7f0000000140)={0x1, 0x0, [{0xaec, 0x0, 0x5}]}) 3.345990954s ago: executing program 7 (id=3355): setns(0xc9, 0x0) r0 = socket(0x80000000000000a, 0x2, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffff9c, 0x0, 0x201, 0x5) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000380)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0xfffd, 0x2000000, @loopback}}}, 0x108) 2.96005705s ago: executing program 7 (id=3357): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x8000000002, &(0x7f00000004c0)={0xffffffffffffffff}, 0x106, 0xe34529baf32093ec}}, 0x20) writev(r0, &(0x7f0000000400)=[{&(0x7f0000000000)="47263f045a5d2ed3cbfdcf214c7d8774418999ac4079afa1a7c5907e36d9c07a462b46ad3a277437eb0ed8ffc72192e8a8699e598e13b55d221ff000f1bd4c38a5d234b14e5ee5a9b77eb504f58473649df3f93419128a99760966ee47d012d52906e955905f6075a779b8e20af11b567fa2d2f43c55f2d131bea9bf85e1c66d7ad499a497ba1d350a2729105303c416f40531938eec797ee962fe83f2c7b0238cf3765c9b98c82908fbf8bad476a2e98449e1732046f050defa5bc115e823bfa15e2c4d96eb7ff7261540ade360ee850c2afefa7b625aa97e", 0xd9}, {&(0x7f00000001c0)="a4612a6ab5b12ddd169635ca7ef66e258e780d885f8118c0b1bf199ac68c8e858507cea862ce63e4535f47c08d4a3a85d0041cc4880b681f91f36b0bc4bf1a0107c1d9c9209458509e2e95b9edc2f7b276e2c6bc3787af700ef52cd3b4b5", 0x5e}, {&(0x7f0000000240)="658a8aacc394deaf26b441799fbab9666ec21694543eac68d0e851e7d36a71c3a5a4a61e948f16496bb8d4d149c4e290e81c3d5fa33294c3eb9a6984704313a8c24f043b093bc880225d638f17eb3a1a4bb3f4dad9191c3294b46ea655f9877b10037d77106fca304f644945fc640a6b3bfd1e9ed276db387e620f1eab593796b80f97f7b0af564ef2fd17255b9fe6ddf3c2637bb362d1e3f46881", 0x9b}, {&(0x7f0000000300)="bf86f6c9c1a449b0bf6fcaa2815cf8d84b89b81f80cbb216c19a6d0918d5eb09dfc30444648cfbee50c01b388cff3b4329a536bfb6d43c38b54ec801346f5f815588c991718930fce2bb90e9d217517c57b9e61d6a32d4aff1815bdb786bc986f8ab3cd77ed56c35fff3843e1c26ff042a152410f2fb68f103a0a9fc7ca53f7d2c093847093cd458980996a3b34fb6f4b7ef4a1ae630b740cf90f90d5f9a61c7fabb51636268a5506cbc382385785d6f0b343aabf76eda63cadb368080837f18dcf8678458c60e8a677a173e6cec5c59ee", 0xd1}], 0x4) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000440)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffd}, {0xa, 0x4e22, 0x5, @loopback, 0x800000}, r1, 0x7}}, 0x48) symlink(&(0x7f0000000c00)='.\x00', &(0x7f0000000c40)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000c80)='./file1\x00', 0x0) mkdir(&(0x7f0000000cc0)='./bus\x00', 0xc1) mount$overlay(0x0, &(0x7f0000000d00)='./bus\x00', &(0x7f0000000d40), 0x0, &(0x7f0000000d80)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000dc0)='./bus\x00') listxattr(&(0x7f0000000e00)='./file0\x00', &(0x7f0000000e40)=""/147, 0x93) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f00000005c0)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x4e24, 0x6, @empty, 0x9fd3}, r1}}, 0x38) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000600)={r0, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x800, &(0x7f0000000500)={@align=0x6, {0xd, 0x5, 0x1, 0x1}}, 0x7, &(0x7f0000000540)={@_ha_fsid}, &(0x7f0000000580)=0x80000000}) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bind$bt_l2cap(r3, &(0x7f0000000bc0)={0x1f, 0xf04a, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xa, 0x2}, 0xe) getsockname$packet(r3, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000007c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000840)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000880)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f00000008c0)={0x0, 0x42cc, 0x10, 0x1, 0x7f}, &(0x7f0000000940)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x1000002, 0x1ef}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e9, 0x20, 0x4003bfff, 0x2b9, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x520, 0x800, 0x1, 0x230}}], 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000640)={0x1, @in={{0x2, 0x4e23, @broadcast}}, 0x0, 0xd, 0xcab, 0x4, 0x0, 0xc, 0x6}, &(0x7f0000000700)=0x9c) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000740)={r7, 0x7}, 0xc) 2.288094243s ago: executing program 6 (id=3359): syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYRES64, @ANYRESDEC=0x0], 0x0) 2.222191582s ago: executing program 7 (id=3360): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="5c01000010000100feffffff00010000fe880000000000000000000000000001fc010000000000000000000000000001000107144e230005000000003a000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c00000020010000000000000000000000000002000800000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000070000000000000002000000fcffffff000000002abd70000035"], 0x15c}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000640)=@newsa={0xf0, 0x1a, 0x1, 0xfffffffe, 0x100, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@remote, 0x1, 0x717, 0x4e23, 0x5, 0xa, 0x0, 0x20, 0x3a}, {@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4d4, 0x6c}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, {0xfe, 0x1000000000000192, 0x8000000009ba3, 0xfffc, 0x8251c, 0x5, 0xfffffffffffffffc, 0x4}, {0xffffffffffffffff, 0x8000000000000001, 0x1f, 0xfffffffffffffffe}, {0x20040, 0x3f9}, 0x7e, 0x3505, 0x2, 0x1, 0x0, 0x20}}, 0xf0}}, 0x844) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0xc, 0x0, 0x4ac20625, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x8, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x40}) ioctl$KVM_RUN(r2, 0xae80, 0xf00000000000000) 1.498047035s ago: executing program 2 (id=3362): r0 = fsopen(&(0x7f00000000c0)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source', &(0x7f0000000140)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x100000000000000, 0x0, 0x0) 1.413581743s ago: executing program 7 (id=3363): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r0, &(0x7f00000020c0)={0x2020}, 0x2020) (async) read$FUSE(r0, &(0x7f00000020c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_IOCTL(r0, &(0x7f0000004100)={0x20, 0x0, r1, {0x3, 0x4, 0x3, 0x10}}, 0x20) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) (async) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f00000003c0)={0x6, 0x118, 0xfa00, {{0x9, 0x8, "6be475dc246509a4b20c875bf1a289d1a0a2dad36287056053b61cf6316d36ff98077ba69ef3174e3de8b836227cb52d5140c45a114628ec4633ac0fc1ff3445364d356108949874a132a90f6e9d8423cf73caf9039b509b3bd5bbc9e8e843a5118442c52aabe7120e57aa86a260c72b727073a62f53809d99f7ecf71c56e6bb5db338667c42941c9391e288c1802f300e8da376e0699d6dba8c8b6c5649b1517c2d2640bf84e05acd64562bca281ae54052e20c70cd3300cdf51a3a94fc0c50fe64f4244208ae8495e8c2917452583639c1d1f6aa22ea551fac524a26581146b2ea759e4dd2fdb84f0b07a627d50d435ccfcbc0b0577ce9ba17c793c564bc8c", 0x0, 0x7, 0x8, 0x5, 0x2, 0x3, 0x8}}}, 0x120) (async) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f00000003c0)={0x6, 0x118, 0xfa00, {{0x9, 0x8, "6be475dc246509a4b20c875bf1a289d1a0a2dad36287056053b61cf6316d36ff98077ba69ef3174e3de8b836227cb52d5140c45a114628ec4633ac0fc1ff3445364d356108949874a132a90f6e9d8423cf73caf9039b509b3bd5bbc9e8e843a5118442c52aabe7120e57aa86a260c72b727073a62f53809d99f7ecf71c56e6bb5db338667c42941c9391e288c1802f300e8da376e0699d6dba8c8b6c5649b1517c2d2640bf84e05acd64562bca281ae54052e20c70cd3300cdf51a3a94fc0c50fe64f4244208ae8495e8c2917452583639c1d1f6aa22ea551fac524a26581146b2ea759e4dd2fdb84f0b07a627d50d435ccfcbc0b0577ce9ba17c793c564bc8c", 0x0, 0x7, 0x8, 0x5, 0x2, 0x3, 0x8}}}, 0x120) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) socket$tipc(0x1e, 0x2, 0x0) (async) socket$tipc(0x1e, 0x2, 0x0) syz_usb_connect(0x5, 0x27, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000b75c7f40470501026411010203010902120001000000000904"], 0x0) (async) syz_usb_connect(0x5, 0x27, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000b75c7f40470501026411010203010902120001000000000904"], 0x0) r7 = syz_open_dev$I2C(&(0x7f00000002c0), 0x1, 0x2003) ioctl$I2C_RDWR(r7, 0x707, &(0x7f0000000300)={&(0x7f0000000500)=[{0x4, 0x10, 0x2000, &(0x7f0000000540)="8a"}], 0x1}) syz_ublk_add_dev(0xffffffffffffffff, r4, r5, r6, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x124}}}, &(0x7f0000000280)) (async) syz_ublk_add_dev(0xffffffffffffffff, r4, r5, r6, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x124}}}, &(0x7f0000000280)=0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) syz_ublk_setup_queues(r3, r9, &(0x7f0000000200)={0x0, 0x1463, 0x100, 0x2, 0xc3}, &(0x7f0000000d40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4485, 0x10, 0x2, 0x318, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x2, 0x1, 0x2000008}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4aaa, 0x10, 0x0, 0x902c4, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa5fb, 0x2000, 0x2, 0x40021a, 0x0, r3}}], 0x17, &(0x7f0000001540)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x72ccfb459c83c565, {0x6}, 0x0, r8, '\x00', {0x7, 0x48b, 0x0, 0x0}}, 0x0) 1.224628268s ago: executing program 2 (id=3365): syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)=ANY=[@ANYBLOB="40060c00000055aa48c071c10fc3c0c7886f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0x4) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x4, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c7", 0x0, 0x89}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x7, 0xd, 0x1, '\x00', 0x7}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 835.292ms ago: executing program 4 (id=3367): r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x14, 0x14, 0x301, 0x0, 0x0, {0x1e}}, 0x14}}, 0x0) prlimit64(0x0, 0x7, &(0x7f00000000c0)={0x3, 0xff}, 0x0) inotify_init1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) read$FUSE(0xffffffffffffffff, &(0x7f00000006c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) waitid(0x0, r3, 0x0, 0x61000006, 0x0) rt_tgsigqueueinfo(r2, r3, 0x23, &(0x7f0000002700)={0x1b, 0x7ff, 0x80000000}) sendmmsg(r1, &(0x7f0000000640)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000040c0)=[{0x18, 0x1, 0x1, "850e1b934f45"}], 0x18}}], 0x2, 0x20000080) 732.425201ms ago: executing program 4 (id=3368): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./security\x00', &(0x7f0000000200)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./security/apparmor/.load\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)="04080076657273696f6e00020500000004080070726f66696c6500070502002f0006", 0x22) (fail_nth: 12) 620.695043ms ago: executing program 7 (id=3369): mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) setuid(0xee00) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="d8000000100081044e81f782db44b904021d08000b000000e8fe55a1180015000600142603600e1209000d00e8", 0x2d}], 0x1}, 0x20010) write$cgroup_subtree(r0, &(0x7f0000000340)=ANY=[], 0xfe33) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0x4, 0x0, 0x8000}]}, 0x10) close_range(r2, r2, 0x2) syz_open_dev$usbmon(&(0x7f0000000040), 0x6, 0x40180) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r3 = openat$binfmt_register(0xffffff9c, &(0x7f00000003c0), 0x1, 0x0) write$binfmt_register(r3, &(0x7f0000000400)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0xa8, 0x3a, '#:', 0x3a, '\r\x90\xc5Y:LD\xc3\x8a\x83p\x97(\f-\x95(\xa3\x112\xb5\t\xa1\xc0CR\x87{w\xaa\x02D\xd7\xcb\xb45L', 0x3a, './file0'}, 0x4e) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) process_vm_readv(r4, &(0x7f0000000280)=[{&(0x7f0000000140)=""/255, 0xff}], 0x1, &(0x7f0000000240)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x0) 619.547664ms ago: executing program 4 (id=3370): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd02, &(0x7f0000000b00)="04000000000000000000000038010000000032000000000000000000000000000000000000000000000000000000000474f9a3") 596.495441ms ago: executing program 4 (id=3371): r0 = syz_open_dev$video(&(0x7f0000000080), 0xfffefffffffffffd, 0x0) ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f00000000c0)={0xa, 0x101, 0x6, {0x3, 0x1000, 0xfc, 0x1a8}}) 494.119637ms ago: executing program 7 (id=3372): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)=',nc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0\x00') r1 = accept(r0, 0x0, 0x0) sendto$inet(r1, &(0x7f0000002000)="000000a0fe534d4240000100000000000000010001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041000100000300000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000200000000000601c06062b0601050502a0123010a00e300c060a", 0x98, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000080)="0000f647efbce196697c8fb47bc9e635", 0x10, 0x0, 0x0, 0x0) 355.832228ms ago: executing program 4 (id=3373): r0 = syz_open_dev$video(&(0x7f0000000080), 0xfffefffffffffffd, 0x0) ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f00000000c0)={0xa, 0x101, 0x6, {0x3, 0x1000, 0xfc, 0x1a8}}) (fail_nth: 3) 233.683259ms ago: executing program 2 (id=3374): keyctl$join(0x1, &(0x7f0000000040)={'syz', 0x1}) keyctl$clear(0x3, 0xfffffffffffffffd) (async) keyctl$clear(0x3, 0xfffffffffffffffd) request_key(&(0x7f0000000100)='keyring\x00', &(0x7f0000000240)={'syz', 0x1}, 0x0, 0xfffffffffffffffe) prctl$PR_SET_MM(0xd, 0x0, &(0x7f0000004000/0x3000)=nil) move_pages(0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b26, &(0x7f0000000000)={'wlan1\x00', @random="19ff00ff0300"}) (async) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b26, &(0x7f0000000000)={'wlan1\x00', @random="19ff00ff0300"}) sched_setscheduler(0x0, 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='file0\x00', 0x42, 0x1ff) ftruncate(r0, 0xf4240) mkdir(&(0x7f0000000180)='./config\x00', 0x1ff) (async) mkdir(&(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(0x0, 0x1ff) (async) mkdir(0x0, 0x1ff) mkdir(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/mass_storage.0/lun.0/file\x00', 0x2, 0x0) write(r1, &(0x7f00000003c0)='file0', 0x5) read$FUSE(r1, 0x0, 0x0) (async) read$FUSE(r1, 0x0, 0x0) memfd_create(0x0, 0x1) (async) memfd_create(0x0, 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) mount$cgroup2(0x0, &(0x7f00000000c0)='./config/usb_gadget/g1/functions/mass_storage.0/lun.0/file\x00', &(0x7f0000000140), 0x2, 0x0) (async) mount$cgroup2(0x0, &(0x7f00000000c0)='./config/usb_gadget/g1/functions/mass_storage.0/lun.0/file\x00', &(0x7f0000000140), 0x2, 0x0) socket(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'bridge0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000004bc0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000431}, 0x4040084) 0s ago: executing program 4 (id=3375): socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000340), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="050000000109"], 0x80}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYRES16=r0], 0x48}}, 0x40800) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/ieee80211/phy0/aql_enable\x00', 0x2, 0x0) link(&(0x7f0000000180)='./debug/ieee80211/phy0/aql_enable\x00', &(0x7f00000001c0)='./debug/ieee80211/phy0/aql_enable\x00') openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x40000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/net/syzkaller0/gro_flush_timeout\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='2', 0x1) ioctl$IOMMU_TEST_OP_MD_CHECK_REFS(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x4, 0x0, 0x0, 0x0, &(0x7f0000000180), 0x91}) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000000040), &(0x7f0000000080)='./debug/ieee80211/phy0/aql_enable\x00', 0x22, 0x1) kernel console output (not intermixed with test programs): ket: 16 [ 582.406094][ T1562] usb 5-1: New USB device found: idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 582.414454][ T1562] usb 5-1: config 0 has an invalid interface number: 35 but max is 0 [ 582.414539][ T1562] usb 5-1: config 0 has no interface number 0 [ 582.414632][ T1562] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0xE has an invalid bInterval 0, changing to 7 [ 582.414695][ T1562] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 582.435657][ T1562] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 582.435730][ T1562] usb 5-1: Product: syz [ 582.435768][ T1562] usb 5-1: Manufacturer: syz [ 582.435800][ T1562] usb 5-1: SerialNumber: syz [ 582.477167][ T1562] usb 5-1: config 0 descriptor?? [ 582.531293][ T1562] cypress_m8 5-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 582.549471][ T1562] nokiaca42v2 ttyUSB0: probe with driver nokiaca42v2 failed with error -22 [ 582.727388][T14548] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 582.735252][T14548] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 582.778454][T14548] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 582.780061][T14562] usb usb5: usbfs: interface 0 claimed by hub while 'syz.6.2947' sets config #0 [ 582.780796][T14548] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 582.808467][ T1562] usb 5-1: USB disconnect, device number 42 [ 582.825619][ T1562] cypress_m8 5-1:0.35: device disconnected [ 583.042567][T14570] netlink: 'syz.2.2949': attribute type 4 has an invalid length. [ 583.721688][ T5618] Bluetooth: hci2: command 0x0c1a tx timeout [ 583.801868][ T5618] Bluetooth: hci0: command 0x0405 tx timeout [ 584.334368][T14594] 9p: Could not find request transport: xen [ 584.351789][ T5694] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 584.474331][T14594] 9p: Could not find request transport: xen [ 584.482732][ T5694] usb 7-1: device descriptor read/64, error -71 [ 584.630526][T14594] 9p: Could not find request transport: xen [ 584.723722][ T5694] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 584.772920][T14594] 9p: Could not find request transport: xen [ 584.852543][ T5694] usb 7-1: device descriptor read/64, error -71 [ 584.939103][T14609] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2957'. [ 584.967546][ T5694] usb usb7-port1: attempt power cycle [ 585.007352][T14594] 9p: Could not find request transport: xen [ 585.301893][ T5694] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 585.332947][ T5694] usb 7-1: device descriptor read/8, error -71 [ 585.512828][ T5766] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 585.571715][ T5694] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 585.592543][ T5694] usb 7-1: device descriptor read/8, error -71 [ 585.612795][ T10] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 585.663477][ T5766] usb 5-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 585.664681][ T5766] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 585.664744][ T5766] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 585.664772][ T5766] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 585.667207][ T5766] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 585.667233][ T5766] usb 5-1: Product: syz [ 585.667251][ T5766] usb 5-1: Manufacturer: syz [ 585.674826][T14616] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 585.681368][ T5766] garmin_gps 5-1:1.0: Garmin GPS usb/tty converter detected [ 585.703715][ T5694] usb usb7-port1: unable to enumerate USB device [ 585.715957][ T5766] usb 5-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 585.832065][ T10] usb 3-1: device descriptor read/64, error -71 [ 585.929988][T14615] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2959'. [ 585.930014][T14615] netlink: 22 bytes leftover after parsing attributes in process `syz.4.2959'. [ 585.983844][T14615] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2959'. [ 585.983870][T14615] netlink: 22 bytes leftover after parsing attributes in process `syz.4.2959'. [ 585.983887][T14615] A link change request failed with some changes committed already. Interface ifb1 may have been left with an inconsistent configuration, please check. [ 586.082393][ T10] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 586.189555][ T5766] usb 5-1: USB disconnect, device number 43 [ 586.215631][ T10] usb 3-1: device descriptor read/64, error -71 [ 586.245554][ T5766] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 586.247476][ T5766] garmin_gps 5-1:1.0: device disconnected [ 586.335243][ T10] usb usb3-port1: attempt power cycle [ 586.681923][ T10] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 586.705734][ T10] usb 3-1: device descriptor read/8, error -71 [ 586.823953][T14316] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.942741][ T10] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 586.972917][ T10] usb 3-1: device descriptor read/8, error -71 [ 587.082025][ T10] usb usb3-port1: unable to enumerate USB device [ 587.147142][T14316] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.197900][T14032] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 587.223125][T14032] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 587.224403][T14032] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 587.228430][T14032] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 587.229181][T14032] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 587.455534][T14316] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.628276][T14316] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.103384][T14316] bridge_slave_1: left allmulticast mode [ 588.103426][T14316] bridge_slave_1: left promiscuous mode [ 588.103641][T14316] bridge0: port 2(bridge_slave_1) entered disabled state [ 588.110245][T14316] bridge_slave_0: left allmulticast mode [ 588.110270][T14316] bridge_slave_0: left promiscuous mode [ 588.110506][T14316] bridge0: port 1(bridge_slave_0) entered disabled state [ 588.262372][ T2239] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 588.432372][ T2239] usb 5-1: New USB device found: idVendor=0489, idProduct=e057, bcdDevice=0.00 [ 588.435186][ T2239] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 588.435214][ T2239] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 588.435265][ T2239] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 588.440841][ T2239] usb 5-1: config 0 descriptor?? [ 588.670503][T14677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 588.684372][T14677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 588.687160][ T2239] Bluetooth: Can't get state to change to load ram patch err [ 588.687190][ T2239] Bluetooth: Loading patch file failed [ 588.687218][ T2239] ath3k 5-1:0.0: probe with driver ath3k failed with error -71 [ 588.689971][ T2239] usb 5-1: USB disconnect, device number 44 [ 588.847423][T14693] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2974'. [ 588.915035][T14316] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 588.942885][T14316] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 588.948387][T14316] bond0 (unregistering): Released all slaves [ 589.088075][T14647] rxe_eth0 speed is unknown, defaulting to 1000 [ 589.089091][T14316] ovs_dp0: left promiscuous mode [ 589.256063][T14316] IPVS: stopping master sync thread 12159 ... [ 589.322529][ T5618] Bluetooth: hci1: command tx timeout [ 589.480121][T14705] x_tables: duplicate underflow at hook 1 [ 589.903536][ T5718] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 590.069392][T14721] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2980'. [ 590.084904][T14721] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2980'. [ 590.101402][ T5718] usb 7-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 590.115147][ T5718] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 590.119279][ T5718] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 590.119305][ T5718] usb 7-1: Product: syz [ 590.119322][ T5718] usb 7-1: Manufacturer: syz [ 590.195778][ T5718] garmin_gps 7-1:1.0: Garmin GPS usb/tty converter detected [ 590.196966][ T5718] garmin_gps ttyUSB0: failed to submit interrupt urb: -22 [ 590.197484][ T5718] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -22 [ 590.457728][ T5718] usb 7-1: USB disconnect, device number 14 [ 590.509436][ T5718] garmin_gps 7-1:1.0: device disconnected [ 590.745280][ T2239] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 590.891782][ T2239] usb 5-1: device descriptor read/64, error -71 [ 590.900154][T14316] hsr_slave_0: left promiscuous mode [ 590.930100][T14316] hsr_slave_1: left promiscuous mode [ 590.931071][T14316] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 590.931093][T14316] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 590.962554][T14316] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 590.962575][T14316] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 591.006978][T14316] veth1_macvtap: left promiscuous mode [ 591.007013][T14316] veth0_macvtap: left promiscuous mode [ 591.007132][T14316] veth1_vlan: left promiscuous mode [ 591.007201][T14316] veth0_vlan: left promiscuous mode [ 591.132767][ T2239] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 591.234468][T14745] genirq: Flags mismatch irq 2. 00200000 (pcl812) vs. 00200000 (das16m1) [ 591.261691][ T2239] usb 5-1: device descriptor read/64, error -71 [ 591.372423][ T2239] usb usb5-port1: attempt power cycle [ 591.402061][ T5618] Bluetooth: hci1: command tx timeout [ 591.544873][T14752] RDS: rds_bind could not find a transport for fc01::, load rds_tcp or rds_rdma? [ 591.711862][ T2239] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 591.745390][ T2239] usb 5-1: device descriptor read/8, error -71 [ 591.968497][T14316] team0 (unregistering): Port device team_slave_1 removed [ 591.990898][T14316] team0 (unregistering): Port device team_slave_0 removed [ 591.999241][ T2239] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 592.022528][ T2239] usb 5-1: device descriptor read/8, error -71 [ 592.075506][T14762] genirq: Flags mismatch irq 2. 00200000 (pcl812) vs. 00200000 (das16m1) [ 592.133680][ T2239] usb usb5-port1: unable to enumerate USB device [ 592.665731][T14647] bridge0: port 1(bridge_slave_0) entered blocking state [ 592.665906][T14647] bridge0: port 1(bridge_slave_0) entered disabled state [ 592.666029][T14647] bridge_slave_0: entered allmulticast mode [ 592.667850][T14647] bridge_slave_0: entered promiscuous mode [ 592.699407][T14647] bridge0: port 2(bridge_slave_1) entered blocking state [ 592.699533][T14647] bridge0: port 2(bridge_slave_1) entered disabled state [ 592.701237][T14647] bridge_slave_1: entered allmulticast mode [ 592.726320][T14647] bridge_slave_1: entered promiscuous mode [ 592.793059][T14647] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 592.801122][T14647] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 592.874010][T14316] IPVS: stop unused estimator thread 0... [ 592.923744][T14647] team0: Port device team_slave_0 added [ 592.929018][T14647] team0: Port device team_slave_1 added [ 593.006278][T14647] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 593.006297][T14647] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 593.006328][T14647] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 593.009880][T14647] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 593.009895][T14647] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 593.009922][T14647] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 593.024562][ T5766] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 593.161374][T14647] hsr_slave_0: entered promiscuous mode [ 593.170369][T14647] hsr_slave_1: entered promiscuous mode [ 593.177384][ T5766] usb 7-1: Using ep0 maxpacket: 16 [ 593.187944][ T5766] usb 7-1: unable to get BOS descriptor or descriptor too short [ 593.187990][ T5766] usb 7-1: New USB device found: idVendor=045e, idProduct=0468, bcdDevice=b2.9c [ 593.188924][ T5766] usb 7-1: config 3 has an invalid interface number: 74 but max is 0 [ 593.188947][ T5766] usb 7-1: config 3 has no interface number 0 [ 593.188997][ T5766] usb 7-1: config 3 interface 74 altsetting 1 endpoint 0x5 has invalid maxpacket 512, setting to 64 [ 593.189022][ T5766] usb 7-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xC3, changing to 0x83 [ 593.189047][ T5766] usb 7-1: config 3 interface 74 altsetting 1 has a duplicate endpoint with address 0x5, skipping [ 593.189069][ T5766] usb 7-1: config 3 interface 74 altsetting 1 bulk endpoint 0xD has invalid maxpacket 8 [ 593.189091][ T5766] usb 7-1: config 3 interface 74 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 593.189112][ T5766] usb 7-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xB1, changing to 0x81 [ 593.189135][ T5766] usb 7-1: config 3 interface 74 altsetting 1 endpoint 0x81 has invalid maxpacket 9507, setting to 1024 [ 593.189177][ T5766] usb 7-1: config 3 interface 74 altsetting 1 bulk endpoint 0x81 has invalid maxpacket 1024 [ 593.189200][ T5766] usb 7-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0x49, changing to 0x9 [ 593.189225][ T5766] usb 7-1: config 3 interface 74 altsetting 1 endpoint 0x9 has invalid maxpacket 17751, setting to 1024 [ 593.189250][ T5766] usb 7-1: config 3 interface 74 altsetting 1 bulk endpoint 0x9 has invalid maxpacket 1024 [ 593.189272][ T5766] usb 7-1: config 3 interface 74 altsetting 1 has 9 endpoint descriptors, different from the interface descriptor's value: 7 [ 593.189298][ T5766] usb 7-1: config 3 interface 74 has no altsetting 0 [ 593.241507][ T5766] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 593.241573][ T5766] usb 7-1: Product: syz [ 593.246608][ T5766] usb 7-1: Manufacturer: syz [ 593.246671][ T5766] usb 7-1: SerialNumber: syz [ 593.338815][T14773] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 593.340033][T14773] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 593.353488][T14773] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 593.481737][ T5618] Bluetooth: hci1: command tx timeout [ 593.580245][ T5766] ipaq 7-1:3.74: PocketPC PDA converter detected [ 593.580515][ T5766] usb 7-1: active config #3 != 1 ?? [ 593.628484][ T5766] usb 7-1: USB disconnect, device number 15 [ 593.728479][T14786] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 593.739851][T14786] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 593.912194][T14786] overlayfs: inode number too big (/, ino=4611686018427387905, xinobits=3) [ 594.044786][ T33] audit: type=1800 audit(2000000069.440:66): pid=14647 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor" name="del_device" dev="sysfs" ino=24631 res=0 errno=-13 [ 594.046224][ T33] audit: type=1800 audit(2000000069.440:67): pid=14647 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor" name="new_device" dev="sysfs" ino=24630 res=0 errno=-13 [ 594.233268][T14647] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 594.249713][T14647] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 594.250698][T14647] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 594.258785][ T5718] usb 5-1: new full-speed USB device number 49 using dummy_hcd [ 594.279750][T14647] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 594.280596][T14647] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 594.304386][T14647] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 594.305239][T14647] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 594.329062][T14647] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 594.422585][ T5718] usb 5-1: New USB device found: idVendor=04b4, idProduct=07b1, bcdDevice=0.00 [ 594.423541][ T5718] usb 5-1: config 0 has an invalid descriptor of length 11, skipping remainder of the config [ 594.423597][ T5718] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 594.423636][ T5718] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 594.427331][ T5718] usb 5-1: config 0 descriptor?? [ 594.482093][ T5718] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 594.678273][T14647] 8021q: adding VLAN 0 to HW filter on device bond0 [ 594.814280][T14647] 8021q: adding VLAN 0 to HW filter on device team0 [ 594.837187][T14316] bridge0: port 1(bridge_slave_0) entered blocking state [ 594.837293][T14316] bridge0: port 1(bridge_slave_0) entered forwarding state [ 594.868907][T14824] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 594.881128][ T6042] bridge0: port 2(bridge_slave_1) entered blocking state [ 594.881231][ T6042] bridge0: port 2(bridge_slave_1) entered forwarding state [ 594.941522][T14828] CIFS: Attempting to mount //127.0.0.1/share [ 594.954722][T14828] CIFS: VFS: Error connecting to socket. Aborting operation. [ 594.954767][T14828] CIFS: VFS: cifs_mount failed w/return code = -111 [ 595.561682][ T5618] Bluetooth: hci1: command tx timeout [ 595.668421][T14848] FAULT_INJECTION: forcing a failure. [ 595.668421][T14848] name failslab, interval 1, probability 0, space 10, times 0 [ 595.668463][T14848] CPU: 1 UID: 0 PID: 14848 Comm: syz.2.3003 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 595.668498][T14848] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 595.668508][T14848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 595.668523][T14848] Call Trace: [ 595.668533][T14848] [ 595.668543][T14848] dump_stack_lvl+0xe8/0x150 [ 595.668580][T14848] should_fail_ex+0x3eb/0x540 [ 595.668617][T14848] should_failslab+0xa8/0x100 [ 595.668644][T14848] __kvmalloc_node_noprof+0x171/0x820 [ 595.668683][T14848] ? __rhashtable_init_noprof+0x5fa/0xbd0 [ 595.668710][T14848] ? __rhashtable_init_noprof+0x5fa/0xbd0 [ 595.668746][T14848] __rhashtable_init_noprof+0x5fa/0xbd0 [ 595.668781][T14848] ipc_init_ids+0x82/0x1f0 [ 595.668811][T14848] msg_init_ns+0x121/0x180 [ 595.668839][T14848] copy_ipcs+0x49b/0x6c0 [ 595.668871][T14848] create_new_namespaces+0x210/0x6b0 [ 595.668903][T14848] ? security_capable+0x7e/0x2c0 [ 595.668941][T14848] unshare_nsproxy_namespaces+0x144/0x190 [ 595.668973][T14848] ksys_unshare+0x532/0x890 [ 595.669004][T14848] ? __pfx_ksys_unshare+0x10/0x10 [ 595.669034][T14848] ? rcu_is_watching+0x16/0xb0 [ 595.669073][T14848] __x64_sys_unshare+0x38/0x50 [ 595.669101][T14848] do_syscall_64+0x166/0x520 [ 595.669129][T14848] ? trace_irq_disable+0x3b/0x140 [ 595.669152][T14848] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.669176][T14848] ? clear_bhb_loop+0x70/0xc0 [ 595.669203][T14848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.669226][T14848] RIP: 0033:0x7fbdf939e559 [ 595.669248][T14848] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 595.669269][T14848] RSP: 002b:00007fbdfa320028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 595.669293][T14848] RAX: ffffffffffffffda RBX: 00007fbdf9625fa0 RCX: 00007fbdf939e559 [ 595.669318][T14848] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002c020400 [ 595.669333][T14848] RBP: 00007fbdf94358b0 R08: 0000000000000000 R09: 0000000000000000 [ 595.669347][T14848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 595.669362][T14848] R13: 00007fbdf9626038 R14: 00007fbdf9625fa0 R15: 00007ffeab957f88 [ 595.669399][T14848] [ 595.965837][T14848] ALSA: seq fatal error: cannot create timer (-22) [ 595.966354][T14848] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3003'. [ 596.180860][T14856] FAULT_INJECTION: forcing a failure. [ 596.180860][T14856] name fail_futex, interval 1, probability 0, space 0, times 0 [ 596.180898][T14856] CPU: 1 UID: 0 PID: 14856 Comm: syz.2.3005 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 596.180930][T14856] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 596.180940][T14856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 596.180953][T14856] Call Trace: [ 596.180962][T14856] [ 596.180972][T14856] dump_stack_lvl+0xe8/0x150 [ 596.181006][T14856] should_fail_ex+0x3eb/0x540 [ 596.181041][T14856] get_futex_key+0x1ab/0x1410 [ 596.181068][T14856] ? __pfx_futex_wake_mark+0x10/0x10 [ 596.181111][T14856] ? __pfx_get_futex_key+0x10/0x10 [ 596.181137][T14856] ? __lock_acquire+0x747/0x2de0 [ 596.181167][T14856] futex_wake+0x119/0x5f0 [ 596.181199][T14856] ? __lock_acquire+0x747/0x2de0 [ 596.181226][T14856] ? __pfx_futex_wake+0x10/0x10 [ 596.181274][T14856] ? do_accept+0x5eb/0x730 [ 596.181306][T14856] do_futex+0x458/0x4e0 [ 596.181341][T14856] ? __pfx_do_futex+0x10/0x10 [ 596.181379][T14856] __se_sys_futex+0x3a8/0x450 [ 596.181417][T14856] ? __pfx___se_sys_futex+0x10/0x10 [ 596.181456][T14856] ? __x64_sys_futex+0x21/0xf0 [ 596.181489][T14856] do_syscall_64+0x166/0x520 [ 596.181516][T14856] ? trace_irq_disable+0x3b/0x140 [ 596.181540][T14856] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.181563][T14856] ? clear_bhb_loop+0x70/0xc0 [ 596.181594][T14856] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.181617][T14856] RIP: 0033:0x7fbdf939e559 [ 596.181637][T14856] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 596.181657][T14856] RSP: 002b:00007fbdfa3200e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 596.181681][T14856] RAX: ffffffffffffffda RBX: 00007fbdf9625fa8 RCX: 00007fbdf939e559 [ 596.181697][T14856] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fbdf9625fac [ 596.181712][T14856] RBP: 00007fbdf9625fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 596.181728][T14856] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 596.181742][T14856] R13: 00007fbdf9626038 R14: 00007ffeab957ea0 R15: 00007ffeab957f88 [ 596.181777][T14856] [ 596.354581][ T5766] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 596.430583][T14647] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 596.502944][ T5766] usb 7-1: Using ep0 maxpacket: 32 [ 596.503666][ T5766] usb 7-1: New USB device found: idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 596.506311][ T5766] usb 7-1: config 0 has an invalid interface number: 12 but max is 0 [ 596.506338][ T5766] usb 7-1: config 0 has no interface number 0 [ 596.506384][ T5766] usb 7-1: config 0 interface 12 has no altsetting 0 [ 596.510137][ T5766] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 596.510161][ T5766] usb 7-1: Product: syz [ 596.510176][ T5766] usb 7-1: Manufacturer: syz [ 596.510192][ T5766] usb 7-1: SerialNumber: syz [ 596.561928][ T5766] usb 7-1: config 0 descriptor?? [ 596.699921][T14864] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3006'. [ 597.039739][ T5615] usb 5-1: USB disconnect, device number 49 [ 597.157940][T14647] veth0_vlan: entered promiscuous mode [ 597.175588][T14647] veth1_vlan: entered promiscuous mode [ 597.243231][ T1562] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 597.245911][T14647] veth0_macvtap: entered promiscuous mode [ 597.267476][T14647] veth1_macvtap: entered promiscuous mode [ 597.316426][T14647] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 597.348853][T14647] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 597.391799][ T1562] usb 3-1: Using ep0 maxpacket: 32 [ 597.392543][ T1562] usb 3-1: New USB device found: idVendor=05ac, idProduct=0254, bcdDevice=56.17 [ 597.393678][ T1562] usb 3-1: config 10 has an invalid interface number: 157 but max is 0 [ 597.393713][ T1562] usb 3-1: config 10 has an invalid descriptor of length 0, skipping remainder of the config [ 597.393732][ T1562] usb 3-1: config 10 has no interface number 0 [ 597.393769][ T1562] usb 3-1: config 10 interface 157 altsetting 107 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 597.393796][ T1562] usb 3-1: config 10 interface 157 has no altsetting 0 [ 597.424957][ T6042] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.460215][ T1562] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 597.460329][ T1562] usb 3-1: Product: syz [ 597.460379][ T1562] usb 3-1: Manufacturer: syz [ 597.460420][ T1562] usb 3-1: SerialNumber: syz [ 597.488210][T13032] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.488484][T13032] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.497142][T13032] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.619482][T14853] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 597.620055][T14853] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 597.684788][T14853] netlink: 'syz.6.3004': attribute type 6 has an invalid length. [ 597.684810][T14853] netlink: 'syz.6.3004': attribute type 6 has an invalid length. [ 597.719624][T14853] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 597.720426][T14853] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 597.738703][T14323] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.738817][T14323] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.758737][T14884] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 597.759360][T14884] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 597.805708][T14883] netlink: 'syz.6.3004': attribute type 6 has an invalid length. [ 597.805760][T14883] netlink: 'syz.6.3004': attribute type 6 has an invalid length. [ 597.810882][T14318] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.810902][T14318] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.889094][ T1562] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:10.157/input/input82 [ 597.912451][ T4962] bcm5974 3-1:10.157: could not read from device [ 597.930392][ T4962] bcm5974 3-1:10.157: could not read from device [ 597.939189][ T4962] bcm5974 3-1:10.157: could not read from device [ 597.965910][ T4962] bcm5974 3-1:10.157: could not read from device [ 597.966522][ T1562] usb 3-1: USB disconnect, device number 29 [ 598.991723][ T2239] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 599.125840][ T5766] f81534 7-1:0.12: f81534_set_register: reg: 1002 data: 2f failed: -71 [ 599.125900][ T5766] f81534 7-1:0.12: f81534_find_config_idx: read failed: -71 [ 599.125918][ T5766] f81534 7-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 599.126000][ T5766] f81534 7-1:0.12: probe with driver f81534 failed with error -71 [ 599.143918][ T5766] usb 7-1: USB disconnect, device number 16 [ 599.199999][ T2239] usb 8-1: New USB device found: idVendor=04e6, idProduct=000c, bcdDevice=1.00 [ 599.212378][ T2239] usb 8-1: config 127 has an invalid interface number: 107 but max is 0 [ 599.212406][ T2239] usb 8-1: config 127 has no interface number 0 [ 599.212448][ T2239] usb 8-1: config 127 interface 107 altsetting 0 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 599.212476][ T2239] usb 8-1: config 127 interface 107 altsetting 0 endpoint 0xC has invalid maxpacket 1023, setting to 64 [ 599.217683][ T2239] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 599.217710][ T2239] usb 8-1: Product: syz [ 599.217740][ T2239] usb 8-1: Manufacturer: syz [ 599.217756][ T2239] usb 8-1: SerialNumber: syz [ 599.239541][T14909] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 599.239819][T14909] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 599.308151][T14913] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3018'. [ 599.386881][T14916] FAULT_INJECTION: forcing a failure. [ 599.386881][T14916] name failslab, interval 1, probability 0, space 10, times 0 [ 599.386920][T14916] CPU: 1 UID: 0 PID: 14916 Comm: syz.6.3017 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 599.386955][T14916] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 599.386965][T14916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 599.386980][T14916] Call Trace: [ 599.386990][T14916] [ 599.387000][T14916] dump_stack_lvl+0xe8/0x150 [ 599.387037][T14916] should_fail_ex+0x3eb/0x540 [ 599.387073][T14916] should_failslab+0xa8/0x100 [ 599.387101][T14916] __kmalloc_noprof+0xf9/0x710 [ 599.387134][T14916] ? __register_sysctl_table+0x6f/0x1370 [ 599.387160][T14916] ? __register_sysctl_table+0x6f/0x1370 [ 599.387194][T14916] __register_sysctl_table+0x6f/0x1370 [ 599.387224][T14916] ? __asan_memcpy+0x40/0x70 [ 599.387261][T14916] setup_ipc_sysctls+0x247/0x2e0 [ 599.387307][T14916] copy_ipcs+0x48f/0x6c0 [ 599.387363][T14916] create_new_namespaces+0x210/0x6b0 [ 599.387394][T14916] ? security_capable+0x7e/0x2c0 [ 599.387435][T14916] unshare_nsproxy_namespaces+0x144/0x190 [ 599.387468][T14916] ksys_unshare+0x532/0x890 [ 599.387510][T14916] ? __pfx_ksys_unshare+0x10/0x10 [ 599.387542][T14916] ? rcu_is_watching+0x16/0xb0 [ 599.387583][T14916] __x64_sys_unshare+0x38/0x50 [ 599.387612][T14916] do_syscall_64+0x166/0x520 [ 599.387641][T14916] ? trace_irq_disable+0x3b/0x140 [ 599.387665][T14916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.387690][T14916] ? clear_bhb_loop+0x70/0xc0 [ 599.387719][T14916] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.387743][T14916] RIP: 0033:0x7fcf2099e559 [ 599.387765][T14916] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 599.387786][T14916] RSP: 002b:00007fcf218fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 599.387811][T14916] RAX: ffffffffffffffda RBX: 00007fcf20c25fa0 RCX: 00007fcf2099e559 [ 599.387828][T14916] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002c020400 [ 599.387843][T14916] RBP: 00007fcf20a358b0 R08: 0000000000000000 R09: 0000000000000000 [ 599.387858][T14916] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 599.387873][T14916] R13: 00007fcf20c26038 R14: 00007fcf20c25fa0 R15: 00007fffb2fc22f8 [ 599.387909][T14916] [ 599.539680][T14909] bond0: (slave erspan0): Opening slave failed [ 599.601108][ T2239] usb-storage 8-1:127.107: USB Mass Storage device detected [ 599.659476][ T2239] usb-storage 8-1:127.107: Quirks match for vid 04e6 pid 000c: 4 [ 599.669523][ T2239] scsi host1: usb-storage 8-1:127.107 [ 599.682825][ T2239] usb 8-1: USB disconnect, device number 2 [ 599.817789][T14916] ALSA: seq fatal error: cannot create timer (-22) [ 599.819897][T14916] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3017'. [ 600.571691][ T5718] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 600.723105][ T5718] usb 8-1: Using ep0 maxpacket: 16 [ 600.723834][ T5718] usb 8-1: New USB device found: idVendor=0499, idProduct=1059, bcdDevice=0.40 [ 600.724915][ T5718] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x5 has an invalid bInterval 142, changing to 11 [ 600.724948][ T5718] usb 8-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 600.728188][ T5718] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 600.728213][ T5718] usb 8-1: Product: syz [ 600.728229][ T5718] usb 8-1: Manufacturer: syz [ 600.728245][ T5718] usb 8-1: SerialNumber: syz [ 600.735211][ T5766] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 600.883457][ T5766] usb 3-1: New USB device found: idVendor=046d, idProduct=c52b, bcdDevice=24.00 [ 600.886688][ T5766] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 600.886715][ T5766] usb 3-1: Product: syz [ 600.886732][ T5766] usb 3-1: Manufacturer: syz [ 601.135402][T14964] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 601.135961][T14964] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 601.248790][ T5766] logitech-djreceiver 0003:046D:C52B.001D: hiddev0,hidraw0: USB HID v1.11 Device [syz syz] on usb-dummy_hcd.2-1/input0 [ 601.248889][ T5766] logitech-djreceiver 0003:046D:C52B.001D: logi_dj_recv_send_report: unable to find dj report [ 601.248947][ T5766] logitech-djreceiver 0003:046D:C52B.001D: logi_dj_recv_switch_to_dj_mode error:-19 [ 601.342162][ C1] logitech-djreceiver 0003:046D:C52B.001D: Short DJ report bad size (2) [ 601.892432][ T5702] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 602.041838][ T5702] usb 7-1: Using ep0 maxpacket: 16 [ 602.045073][ T5702] usb 7-1: New USB device found: idVendor=05ac, idProduct=0240, bcdDevice=cd.74 [ 602.046254][ T5702] usb 7-1: config 249 has an invalid interface number: 55 but max is 0 [ 602.046278][ T5702] usb 7-1: config 249 has no interface number 0 [ 602.046306][ T5702] usb 7-1: config 249 interface 55 has no altsetting 0 [ 602.050632][ T5702] usb 7-1: New USB device strings: Mfr=205, Product=145, SerialNumber=3 [ 602.050657][ T5702] usb 7-1: Product: syz [ 602.050671][ T5702] usb 7-1: Manufacturer: syz [ 602.050684][ T5702] usb 7-1: SerialNumber: syz [ 602.477548][ T5702] usb 7-1: USB disconnect, device number 17 [ 602.992323][ T5694] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 603.121894][ T5694] usb 5-1: device descriptor read/64, error -71 [ 603.365469][ T5694] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 603.408653][ T5718] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 603.493580][ T5694] usb 5-1: device descriptor read/64, error -71 [ 603.535748][ T5718] usb 8-1: USB disconnect, device number 3 [ 603.605282][ T5694] usb usb5-port1: attempt power cycle [ 603.635381][T14872] usb 3-1: USB disconnect, device number 30 [ 603.934175][T15012] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 603.941734][ T5694] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 603.967976][ T5694] usb 5-1: device descriptor read/8, error -71 [ 604.012801][T15014] netlink: 'syz.7.3060': attribute type 1 has an invalid length. [ 604.022083][T14872] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 604.181715][T14872] usb 3-1: Using ep0 maxpacket: 32 [ 604.182749][T14872] usb 3-1: New USB device found: idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 604.190910][T14872] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.190934][T14872] usb 3-1: Product: syz [ 604.190948][T14872] usb 3-1: Manufacturer: syz [ 604.190962][T14872] usb 3-1: SerialNumber: syz [ 604.203776][ T5694] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 604.209267][T14872] usb 3-1: config 0 descriptor?? [ 604.225325][ T5694] usb 5-1: device descriptor read/8, error -71 [ 604.227674][T14872] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 604.228810][T14872] dvb-usb: bulk message failed: -22 (4/0) [ 604.228827][T14872] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 604.229459][T14872] dvb-usb: bulk message failed: -22 (5/0) [ 604.229498][T14872] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 604.263133][T14872] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 604.280108][T14872] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 604.280413][T14872] usb 3-1: media controller created [ 604.322715][ T33] audit: type=1800 audit(2000000079.720:68): pid=15023 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=appraise_data cause=missing-hash comm="syz.7.3063" name="/lib/firmware/regulatory.db" dev="sda1" ino=448 res=0 errno=-61 [ 604.322951][T15023] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -13 [ 604.322993][T15023] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -13 [ 604.323027][T15023] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 604.334424][ T5694] usb usb5-port1: unable to enumerate USB device [ 604.405177][T14872] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 604.463096][T14872] usb 3-1: selecting invalid altsetting 3 [ 604.463120][T14872] ttusb2: set interface to alts=3 failed [ 604.486272][ T33] audit: type=1800 audit(2000000079.880:69): pid=15006 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3056" name="resources" dev="sysfs" ino=4711 res=0 errno=-22 [ 604.555124][T14872] DVB: Unable to find symbol tda10086_attach() [ 604.555145][T14872] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 604.556742][T14872] dvb-usb: bulk message failed: -22 (4/0) [ 604.556765][T14872] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 604.556906][T14872] dvb-usb: bulk message failed: -22 (5/0) [ 604.556925][T14872] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 604.557003][T14872] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 604.625234][T15027] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 604.627924][T15027] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 604.670713][T15027] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 604.684928][T15027] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 605.451705][ T5718] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 605.623925][ T5718] usb 7-1: New USB device found: idVendor=04e8, idProduct=6889, bcdDevice=1.00 [ 605.628737][ T5718] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 605.628766][ T5718] usb 7-1: Product: syz [ 605.628784][ T5718] usb 7-1: Manufacturer: syz [ 605.628800][ T5718] usb 7-1: SerialNumber: syz [ 605.671724][ T5702] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 605.848642][ T5702] usb 8-1: unable to get BOS descriptor or descriptor too short [ 605.848694][ T5702] usb 8-1: New USB device found: idVendor=133e, idProduct=0815, bcdDevice=0.40 [ 605.868198][ T5702] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 605.868314][ T5702] usb 8-1: Product: syz [ 605.868349][ T5702] usb 8-1: Manufacturer: syz [ 605.868394][ T5702] usb 8-1: SerialNumber: syz [ 605.897607][ T5718] kalmia 7-1:1.0 (unnamed net_device) (uninitialized): Did not send all of init packet. Bytes sent: 0 [ 605.921076][T15029] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 605.928916][T15029] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 605.972768][ T5718] kalmia 7-1:1.0 (unnamed net_device) (uninitialized): Error receiving init result. Status -71 [ 605.973767][ T5718] kalmia 7-1:1.0: probe with driver kalmia failed with error -71 [ 606.013239][ T5718] usb 7-1: USB disconnect, device number 18 [ 606.124216][ T5702] snd-usb-audio 8-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 606.131233][T15036] ptrace attach of "ci-upstream-rust-kasan-gce/syz-executor exec"[11328] was attempted by ""[15036] [ 606.145947][ T5702] usb 8-1: USB disconnect, device number 4 [ 606.206685][T15036] kAFS: No cell specified [ 606.486419][T15040] FAULT_INJECTION: forcing a failure. [ 606.486419][T15040] name failslab, interval 1, probability 0, space 10, times 0 [ 606.486456][T15040] CPU: 0 UID: 0 PID: 15040 Comm: syz.4.3069 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 606.486489][T15040] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 606.486498][T15040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 606.486512][T15040] Call Trace: [ 606.486521][T15040] [ 606.486530][T15040] dump_stack_lvl+0xe8/0x150 [ 606.486565][T15040] should_fail_ex+0x3eb/0x540 [ 606.486604][T15040] should_failslab+0xa8/0x100 [ 606.486630][T15040] kmem_cache_alloc_lru_noprof+0xa2/0x5f0 [ 606.486663][T15040] ? __d_alloc+0x37/0x7f0 [ 606.486694][T15040] ? __d_alloc+0x37/0x7f0 [ 606.486734][T15040] __d_alloc+0x37/0x7f0 [ 606.486773][T15040] __d_alloc_parallel+0xde/0x1700 [ 606.486805][T15040] ? lock_acquire+0x115/0x350 [ 606.486840][T15040] ? __pfx___d_alloc_parallel+0x10/0x10 [ 606.486863][T15040] ? lock_acquire+0x115/0x350 [ 606.486903][T15040] __lookup_slow+0x82/0x2f0 [ 606.486940][T15040] lookup_slow+0x59/0x80 [ 606.486979][T15040] link_path_walk+0x12b4/0x1910 [ 606.487032][T15040] path_openat+0x1b7/0x20f0 [ 606.487076][T15040] do_file_open+0x23e/0x4a0 [ 606.487105][T15040] ? __pfx_do_file_open+0x10/0x10 [ 606.487139][T15040] ? __pfx_proc_put_link+0x10/0x10 [ 606.487169][T15040] ? __pfx_kfree_link+0x10/0x10 [ 606.487206][T15040] ? _raw_spin_unlock+0x28/0x50 [ 606.487229][T15040] ? alloc_fd+0x6af/0x760 [ 606.487272][T15040] do_sys_openat2+0x115/0x200 [ 606.487304][T15040] ? __pfx_do_sys_openat2+0x10/0x10 [ 606.487334][T15040] ? ksys_write+0x242/0x270 [ 606.487369][T15040] ? __pfx_ksys_write+0x10/0x10 [ 606.487408][T15040] __x64_sys_openat+0x138/0x170 [ 606.487443][T15040] do_syscall_64+0x166/0x520 [ 606.487469][T15040] ? trace_irq_disable+0x3b/0x140 [ 606.487492][T15040] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.487516][T15040] ? clear_bhb_loop+0x70/0xc0 [ 606.487543][T15040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.487566][T15040] RIP: 0033:0x7fcf1639e559 [ 606.487586][T15040] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 606.487605][T15040] RSP: 002b:00007fcf1733c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 606.487629][T15040] RAX: ffffffffffffffda RBX: 00007fcf16625fa0 RCX: 00007fcf1639e559 [ 606.487646][T15040] RDX: 0000000000000001 RSI: 0000200000000480 RDI: ffffffffffffff9c [ 606.487662][T15040] RBP: 00007fcf1733c090 R08: 0000000000000000 R09: 0000000000000000 [ 606.487676][T15040] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 606.487690][T15040] R13: 00007fcf16626038 R14: 00007fcf16625fa0 R15: 00007ffc24e03c58 [ 606.487726][T15040] [ 607.049800][T15044] libceph: resolve '.RHe'ˠ/1C~1WexEAeSb{~R' (ret=-3): failed [ 607.117586][T15050] FAULT_INJECTION: forcing a failure. [ 607.117586][T15050] name failslab, interval 1, probability 0, space 10, times 0 [ 607.117627][T15050] CPU: 0 UID: 0 PID: 15050 Comm: syz.4.3073 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 607.117662][T15050] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 607.117672][T15050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 607.117686][T15050] Call Trace: [ 607.117696][T15050] [ 607.117706][T15050] dump_stack_lvl+0xe8/0x150 [ 607.117743][T15050] should_fail_ex+0x3eb/0x540 [ 607.117780][T15050] should_failslab+0xa8/0x100 [ 607.117806][T15050] __kmalloc_cache_noprof+0x9e/0x600 [ 607.117840][T15050] ? syslog_print+0x103/0x610 [ 607.117881][T15050] ? syslog_print+0x103/0x610 [ 607.117913][T15050] syslog_print+0x103/0x610 [ 607.117939][T15050] ? hook_capable+0x1c3/0x5e0 [ 607.117973][T15050] ? __pfx_syslog_print+0x10/0x10 [ 607.118000][T15050] ? futex_wait+0x2a2/0x390 [ 607.118021][T15050] ? __pfx_hook_capable+0x10/0x10 [ 607.118054][T15050] ? __pfx_futex_wait+0x10/0x10 [ 607.118087][T15050] ? apparmor_capable+0x126/0x170 [ 607.118115][T15050] ? bpf_lsm_capable+0x9/0x20 [ 607.118139][T15050] ? security_capable+0x7e/0x2c0 [ 607.118175][T15050] do_syslog+0x583/0x7d0 [ 607.118204][T15050] ? __pfx_do_syslog+0x10/0x10 [ 607.118235][T15050] ? __se_sys_futex+0x3a8/0x450 [ 607.118283][T15050] ? rcu_is_watching+0x16/0xb0 [ 607.118333][T15050] __x64_sys_syslog+0x7c/0x90 [ 607.118360][T15050] do_syscall_64+0x166/0x520 [ 607.118387][T15050] ? trace_irq_disable+0x3b/0x140 [ 607.118411][T15050] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.118434][T15050] ? clear_bhb_loop+0x70/0xc0 [ 607.118460][T15050] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.118482][T15050] RIP: 0033:0x7fcf1639e559 [ 607.118502][T15050] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 607.118523][T15050] RSP: 002b:00007fcf1733c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000067 [ 607.118547][T15050] RAX: ffffffffffffffda RBX: 00007fcf16625fa0 RCX: 00007fcf1639e559 [ 607.118564][T15050] RDX: 0000000000000092 RSI: 00002000000003c0 RDI: 0000000000000002 [ 607.118578][T15050] RBP: 00007fcf164358b0 R08: 0000000000000000 R09: 0000000000000000 [ 607.118593][T15050] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 607.118606][T15050] R13: 00007fcf16626038 R14: 00007fcf16625fa0 R15: 00007ffc24e03c58 [ 607.118641][T15050] [ 607.235134][ T5615] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 607.375331][T14872] usb 7-1: new full-speed USB device number 19 using dummy_hcd [ 607.456226][ T5615] usb 8-1: New USB device found: idVendor=04e8, idProduct=6889, bcdDevice=1.00 [ 607.461483][ T5615] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 607.461508][ T5615] usb 8-1: Product: syz [ 607.461523][ T5615] usb 8-1: Manufacturer: syz [ 607.461538][ T5615] usb 8-1: SerialNumber: syz [ 607.572433][T14872] usb 7-1: New USB device found: idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 607.575045][T14872] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 607.580223][T14872] usb 7-1: config 0 descriptor?? [ 607.615441][T14872] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 607.717505][ T5615] kalmia 8-1:1.0 (unnamed net_device) (uninitialized): Did not send all of init packet. Bytes sent: 0 [ 607.731210][T15046] comedi comedi1: pc212e: a I/O base address must be specified [ 607.738205][T15046] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 607.743631][T15046] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 607.788566][ T5615] kalmia 8-1:1.0 (unnamed net_device) (uninitialized): Error receiving init result. Status -71 [ 607.788865][ T5615] kalmia 8-1:1.0: probe with driver kalmia failed with error -71 [ 607.821403][T14872] gp8psk: usb in 128 operation failed. [ 607.832079][ T5615] usb 8-1: USB disconnect, device number 5 [ 608.028688][T14872] gp8psk: usb in 146 operation failed. [ 608.028707][T14872] gp8psk: failed to get FW version [ 608.029055][T14872] gp8psk: usb in 149 operation failed. [ 608.029067][T14872] gp8psk: failed to get FPGA version [ 608.030338][T14872] gp8psk: usb in 138 operation failed. [ 608.030360][T14872] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 608.030404][T14872] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 608.085991][T14872] usb 7-1: USB disconnect, device number 19 [ 608.121189][T15061] input: syz1 as /devices/virtual/input/input83 [ 608.443534][T15066] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3080'. [ 608.443570][T15066] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 608.592354][T14872] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 608.741790][T14872] usb 5-1: Using ep0 maxpacket: 32 [ 608.742331][T14872] usb 5-1: New USB device found: idVendor=044e, idProduct=1215, bcdDevice=0.40 [ 608.743368][T14872] usb 5-1: config 1 interface 0 altsetting 31 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 608.743399][T14872] usb 5-1: config 1 interface 0 has no altsetting 0 [ 608.748793][T14872] usb 5-1: string descriptor 0 read error: -22 [ 608.748912][T14872] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.852605][ T5702] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 609.003866][ T5702] usb 8-1: New USB device found: idVendor=05dc, idProduct=0001, bcdDevice=0.00 [ 609.011268][ T5702] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.011297][ T5702] usb 8-1: Product: syz [ 609.011313][ T5702] usb 8-1: Manufacturer: syz [ 609.011328][ T5702] usb 8-1: SerialNumber: syz [ 609.046341][T15077] FAULT_INJECTION: forcing a failure. [ 609.046341][T15077] name failslab, interval 1, probability 0, space 10, times 0 [ 609.046373][T15077] CPU: 1 UID: 0 PID: 15077 Comm: syz.6.3082 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 609.046401][T15077] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 609.046409][T15077] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 609.046420][T15077] Call Trace: [ 609.046428][T15077] [ 609.046437][T15077] dump_stack_lvl+0xe8/0x150 [ 609.046471][T15077] should_fail_ex+0x3eb/0x540 [ 609.046501][T15077] should_failslab+0xa8/0x100 [ 609.046522][T15077] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 609.046551][T15077] kmem_cache_alloc_noprof+0x9c/0x600 [ 609.046576][T15077] ? cifs_silly_fullpath+0x380/0x460 [ 609.046596][T15077] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 609.046621][T15077] ? kmem_cache_alloc_noprof+0x151/0x600 [ 609.046646][T15077] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 609.046679][T15077] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 609.046722][T15077] mmu_topup_memory_caches+0x21/0x1a0 [ 609.046774][T15077] kvm_mmu_load+0x9d/0x21e0 [ 609.046815][T15077] ? kvm_msr_allowed+0x9a/0x490 [ 609.046848][T15077] ? kvm_msr_allowed+0x9a/0x490 [ 609.046882][T15077] ? kvm_msr_allowed+0x9a/0x490 [ 609.046914][T15077] ? kvm_msr_allowed+0x3f4/0x490 [ 609.046946][T15077] ? kvm_msr_allowed+0x9a/0x490 [ 609.046980][T15077] ? kvm_apic_has_interrupt+0x740/0x770 [ 609.047022][T15077] vcpu_run+0x4f5b/0x7a90 [ 609.047091][T15077] ? __pfx___loaded_vmcs_clear+0x10/0x10 [ 609.047135][T15077] ? __pfx___smp_call_function_single+0x10/0x10 [ 609.047202][T15077] ? __pfx_vcpu_run+0x10/0x10 [ 609.047235][T15077] ? lock_acquire+0x115/0x350 [ 609.047267][T15077] ? vmx_unhandleable_emulation_required+0x77/0x230 [ 609.047307][T15077] kvm_arch_vcpu_ioctl_run+0xe83/0x18b0 [ 609.047344][T15077] ? kvm_arch_vcpu_ioctl_run+0x1f5/0x18b0 [ 609.047379][T15077] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 609.047421][T15077] kvm_vcpu_ioctl+0xa61/0xfd0 [ 609.047463][T15077] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 609.047519][T15077] ? __fget_files+0x2a/0x420 [ 609.047555][T15077] ? __fget_files+0x2a/0x420 [ 609.047588][T15077] ? __fget_files+0x2a/0x420 [ 609.047625][T15077] ? bpf_lsm_file_ioctl+0x9/0x20 [ 609.047649][T15077] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 609.047684][T15077] __se_sys_ioctl+0xfc/0x170 [ 609.047712][T15077] do_syscall_64+0x166/0x520 [ 609.047739][T15077] ? trace_irq_disable+0x3b/0x140 [ 609.047763][T15077] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.047787][T15077] ? clear_bhb_loop+0x70/0xc0 [ 609.047815][T15077] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.047837][T15077] RIP: 0033:0x7fcf2099e559 [ 609.047858][T15077] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 609.047878][T15077] RSP: 002b:00007fcf218dd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 609.047903][T15077] RAX: ffffffffffffffda RBX: 00007fcf20c26090 RCX: 00007fcf2099e559 [ 609.047919][T15077] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 609.047934][T15077] RBP: 00007fcf218dd090 R08: 0000000000000000 R09: 0000000000000000 [ 609.047949][T15077] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 609.047962][T15077] R13: 00007fcf20c26128 R14: 00007fcf20c26090 R15: 00007fffb2fc22f8 [ 609.048011][T15077] [ 609.048337][ T5702] ums-jumpshot 8-1:1.0: USB Mass Storage device detected [ 609.139751][ T5702] ums-jumpshot 8-1:1.0: Quirks match for vid 05dc pid 0001: 2 [ 609.412772][ T5702] usb 8-1: USB disconnect, device number 6 [ 609.636517][T14872] usbhid 5-1:1.0: can't add hid device: -71 [ 609.636635][T14872] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 609.656033][T14872] usb 5-1: USB disconnect, device number 54 [ 609.978836][T15087] netlink: 80 bytes leftover after parsing attributes in process `syz.6.3085'. [ 610.010863][T14872] usb 3-1: USB disconnect, device number 31 [ 610.095135][T14872] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 610.279611][T15100] input: syz1 as /devices/virtual/input/input84 [ 610.280410][T15103] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3090'. [ 610.316657][ T33] audit: type=1800 audit(2000000085.710:70): pid=15097 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3091" name="array_state" dev="sysfs" ino=171180 res=0 errno=-22 [ 610.363317][T15105] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3092'. [ 610.404976][ T5694] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 610.531752][ T5694] usb 7-1: device descriptor read/64, error -71 [ 610.758054][T15116] netlink: 'syz.7.3098': attribute type 27 has an invalid length. [ 610.772345][ T5694] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 610.793340][T15116] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 610.901907][ T5694] usb 7-1: device descriptor read/64, error -71 [ 611.012150][ T5694] usb usb7-port1: attempt power cycle [ 611.140694][T15130] netlink: 4388 bytes leftover after parsing attributes in process `syz.2.3101'. [ 611.140725][T15130] netlink: 4388 bytes leftover after parsing attributes in process `syz.2.3101'. [ 611.351732][ T5694] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 611.372469][ T5694] usb 7-1: device descriptor read/8, error -71 [ 611.412981][ T5618] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 611.415733][ T5618] Bluetooth: hci0: command 0x0405 tx timeout [ 611.613865][ T5694] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 611.636216][ T5694] usb 7-1: device descriptor read/8, error -71 [ 611.698863][T15145] netlink: 40 bytes leftover after parsing attributes in process `syz.7.3102'. [ 611.743724][ T5694] usb usb7-port1: unable to enumerate USB device [ 611.844150][T15149] ima: Unable to open file: /ppra (-2) [ 611.849314][T15147] ima: policy update failed [ 611.850190][ T33] audit: type=1802 audit(2000000087.240:71): pid=15147 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.4.3103" res=0 errno=-22 [ 611.907540][ T33] audit: type=1804 audit(2000000087.300:72): pid=15152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.7.3105" name="kvm" dev="tmpfs" ino=139 res=1 errno=0 [ 612.410723][T14032] Bluetooth: hci2: connection err: -111 [ 612.411244][T15161] netlink: 'syz.2.3109': attribute type 11 has an invalid length. [ 613.307172][T15171] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3112'. [ 613.598031][T15179] netlink: 'syz.2.3116': attribute type 4 has an invalid length. [ 613.598055][T15179] netlink: 'syz.2.3116': attribute type 5 has an invalid length. [ 613.598070][T15179] netlink: 3657 bytes leftover after parsing attributes in process `syz.2.3116'. [ 613.713946][T15190] netlink: 128 bytes leftover after parsing attributes in process `syz.7.3119'. [ 613.718592][T15190] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 613.732733][T15180] rxe_eth0 speed is unknown, defaulting to 1000 [ 614.281821][ T5718] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 614.367003][T15209] sg_write: data in/out 414172/80 bytes for SCSI command 0x0-- guessing data in; [ 614.367003][T15209] program syz.6.3126 not setting count and/or reply_len properly [ 614.443678][ T5718] usb 3-1: Using ep0 maxpacket: 8 [ 614.447996][ T5718] usb 3-1: unable to get BOS descriptor or descriptor too short [ 614.448042][ T5718] usb 3-1: New USB device found: idVendor=046d, idProduct=0990, bcdDevice=5a.94 [ 614.449031][ T5718] usb 3-1: config 15 has an invalid interface number: 194 but max is 0 [ 614.449055][ T5718] usb 3-1: config 15 has no interface number 0 [ 614.449083][ T5718] usb 3-1: config 15 interface 194 has no altsetting 0 [ 614.451060][ T5718] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.451085][ T5718] usb 3-1: Product: syz [ 614.451109][ T5718] usb 3-1: Manufacturer: syz [ 614.451125][ T5718] usb 3-1: SerialNumber: syz [ 614.651703][ T5766] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 614.873677][ T5766] usb 7-1: Using ep0 maxpacket: 32 [ 614.877121][ T5766] usb 7-1: unable to get BOS descriptor or descriptor too short [ 614.877166][ T5766] usb 7-1: New USB device found: idVendor=1235, idProduct=8004, bcdDevice=0.40 [ 614.878902][ T5766] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 32 [ 614.910348][ T5766] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.910374][ T5766] usb 7-1: Product: syz [ 614.910389][ T5766] usb 7-1: Manufacturer: syz [ 614.910404][ T5766] usb 7-1: SerialNumber: syz [ 614.953093][T15209] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 614.976582][T15211] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3127'. [ 614.978452][ T33] audit: type=1800 audit(2000000090.370:73): pid=15211 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.3127" name=08 dev="tmpfs" ino=190 res=0 errno=-22 [ 615.234400][ T5766] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 615.307064][T15217] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3129'. [ 615.307105][T15217] netlink: 336 bytes leftover after parsing attributes in process `syz.4.3129'. [ 615.307147][T15217] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3129'. [ 615.385545][ T5766] usb 7-1: USB disconnect, device number 24 [ 615.869853][ T33] audit: type=1800 audit(2000000091.260:74): pid=15232 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3135" name="bonding_masters" dev="sysfs" ino=262900 res=0 errno=-22 [ 615.870583][T15232] bonding: d is being created... [ 615.892842][ T5615] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 615.927234][T15232] FAULT_INJECTION: forcing a failure. [ 615.927234][T15232] name failslab, interval 1, probability 0, space 10, times 0 [ 615.927274][T15232] CPU: 1 UID: 0 PID: 15232 Comm: syz.6.3135 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 615.927308][T15232] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 615.927319][T15232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 615.927333][T15232] Call Trace: [ 615.927342][T15232] [ 615.927353][T15232] dump_stack_lvl+0xe8/0x150 [ 615.927390][T15232] should_fail_ex+0x3eb/0x540 [ 615.927447][T15232] should_failslab+0xa8/0x100 [ 615.927472][T15232] ? __kernfs_new_node+0xe6/0x980 [ 615.927500][T15232] kmem_cache_alloc_noprof+0x9c/0x600 [ 615.927540][T15232] ? __kernfs_new_node+0xe6/0x980 [ 615.927576][T15232] __kernfs_new_node+0xe6/0x980 [ 615.927603][T15232] ? kernfs_root+0x1c/0x230 [ 615.927638][T15232] ? __pfx___kernfs_new_node+0x10/0x10 [ 615.927664][T15232] ? lock_acquire+0x115/0x350 [ 615.927688][T15232] ? kernfs_root+0x1c/0x230 [ 615.927723][T15232] ? kernfs_root+0x1c/0x230 [ 615.927747][T15232] ? kernfs_root+0x1c/0x230 [ 615.927782][T15232] ? kernfs_root+0x1c/0x230 [ 615.927813][T15232] kernfs_new_node+0xeb/0x140 [ 615.927844][T15232] __kernfs_create_file+0x4b/0x2e0 [ 615.927880][T15232] sysfs_add_file_mode_ns+0x237/0x300 [ 615.927924][T15232] internal_create_group+0x679/0x1180 [ 615.927963][T15232] ? kobject_init_and_add+0x12b/0x1a0 [ 615.928006][T15232] ? register_netdevice+0x17be/0x2280 [ 615.928038][T15232] ? bond_create+0xa9/0x110 [ 615.928071][T15232] ? __pfx_internal_create_group+0x10/0x10 [ 615.928103][T15232] ? kobject_uevent_env+0x375/0x9e0 [ 615.928148][T15232] sysfs_create_groups+0x59/0x120 [ 615.928177][T15232] netdev_queue_update_kobjects+0x2a0/0x6b0 [ 615.928216][T15232] netdev_register_kobject+0x277/0x350 [ 615.928248][T15232] register_netdevice+0x17be/0x2280 [ 615.928280][T15232] ? alloc_netdev_mqs+0xd5b/0x1240 [ 615.928334][T15232] ? __pfx_register_netdevice+0x10/0x10 [ 615.928388][T15232] ? alloc_netdev_mqs+0xe77/0x1240 [ 615.928431][T15232] bond_create+0xa9/0x110 [ 615.928465][T15232] bonding_store_bonds+0x202/0x390 [ 615.928503][T15232] ? __pfx_bonding_store_bonds+0x10/0x10 [ 615.928536][T15232] ? __pfx_sysfs_unbreak_active_protection+0x10/0x10 [ 615.928574][T15232] ? sysfs_file_kobj+0x1e4/0x230 [ 615.928610][T15232] ? sysfs_kf_write+0x166/0x260 [ 615.928631][T15232] ? class_attr_store+0x50/0xb0 [ 615.928667][T15232] ? __pfx_sysfs_kf_write+0x10/0x10 [ 615.928701][T15232] kernfs_fop_write_iter+0x3a4/0x540 [ 615.928740][T15232] vfs_write+0x612/0xba0 [ 615.928785][T15232] ? __pfx_vfs_write+0x10/0x10 [ 615.928825][T15232] ? __fget_files+0x3a2/0x420 [ 615.928857][T15232] ? __fget_files+0x2a/0x420 [ 615.928894][T15232] ? fdget+0x1ac/0x250 [ 615.928934][T15232] ksys_write+0x150/0x270 [ 615.928980][T15232] ? __pfx_ksys_write+0x10/0x10 [ 615.929030][T15232] do_syscall_64+0x166/0x520 [ 615.929059][T15232] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 615.929083][T15232] ? clear_bhb_loop+0x70/0xc0 [ 615.929112][T15232] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 615.929135][T15232] RIP: 0033:0x7fcf2099e559 [ 615.929156][T15232] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 615.929177][T15232] RSP: 002b:00007fcf218fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 615.929202][T15232] RAX: ffffffffffffffda RBX: 00007fcf20c25fa0 RCX: 00007fcf2099e559 [ 615.929218][T15232] RDX: 0000000000000002 RSI: 0000200000000a00 RDI: 0000000000000006 [ 615.929234][T15232] RBP: 00007fcf20a358b0 R08: 0000000000000000 R09: 0000000000000000 [ 615.929249][T15232] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 615.929263][T15232] R13: 00007fcf20c26038 R14: 00007fcf20c25fa0 R15: 00007fffb2fc22f8 [ 615.929301][T15232] [ 616.127433][ T5615] usb 5-1: New USB device found: idVendor=046d, idProduct=c222, bcdDevice=0.00 [ 616.169241][ T5615] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 616.169288][ T5615] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 616.388268][T15232] d (unregistered): Released all slaves [ 616.413569][T15232] bonding: d creation failed [ 616.587940][ T5718] usb 3-1: unknown interface protocol 0xae, assuming v1 [ 616.587968][ T5718] usb 3-1: cannot find UAC_HEADER [ 616.852659][ T5615] lg-g15 0003:046D:C222.001E: hidraw0: USB HID v1.11 Device [HID 046d:c222] on usb-dummy_hcd.4-1/input0 [ 616.897261][ T5718] snd-usb-audio 3-1:15.194: probe with driver snd-usb-audio failed with error -22 [ 616.916810][ T5718] usb 3-1: USB disconnect, device number 32 [ 617.026099][T15247] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3137'. [ 617.089203][ T5615] lg-g15 0003:046D:C222.001E: Error getting LED brightness: -71 [ 617.146374][ T5615] lg-g15 0003:046D:C222.001E: probe with driver lg-g15 failed with error -71 [ 617.177317][ T5615] usb 5-1: USB disconnect, device number 55 [ 617.485168][T15253] trusted_key: encrypted_key: insufficient parameters specified [ 617.490444][ T33] audit: type=1800 audit(2000000092.880:75): pid=15253 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3140" name="scan" dev="sysfs" ino=21735 res=0 errno=-13 [ 617.771705][ T5615] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 617.864035][ T5702] hid-generic 0000:0000:0000.001F: unknown main item tag 0x0 [ 617.875854][ T5702] hid-generic 0000:0000:0000.001F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 618.817334][ T5615] usb 7-1: device descriptor read/64, error -71 [ 619.175940][ T5615] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 619.311011][T15276] CIFS: Attempting to mount //127.0.0.1/share [ 619.311508][T15276] CIFS: VFS: Error connecting to socket. Aborting operation. [ 619.311549][T15276] CIFS: VFS: cifs_mount failed w/return code = -101 [ 619.326431][ T5615] usb 7-1: device descriptor read/64, error -71 [ 619.432245][ T5615] usb usb7-port1: attempt power cycle [ 619.488411][T15280] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3151'. [ 619.488438][T15280] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3151'. [ 619.781979][ T5615] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 619.802409][ T5615] usb 7-1: device descriptor read/8, error -71 [ 619.887728][T15290] netlink: 148 bytes leftover after parsing attributes in process `syz.4.3154'. [ 619.983388][T15290] netlink: 148 bytes leftover after parsing attributes in process `syz.4.3154'. [ 620.042708][ T5615] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 620.062465][ T5615] usb 7-1: device descriptor read/8, error -71 [ 620.172271][ T5615] usb usb7-port1: unable to enumerate USB device [ 620.492376][T15307] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3160'. [ 620.492403][T15307] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3160'. [ 620.570967][T15310] FAULT_INJECTION: forcing a failure. [ 620.570967][T15310] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 620.570999][T15310] CPU: 0 UID: 0 PID: 15310 Comm: syz.2.3162 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 620.571029][T15310] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 620.571037][T15310] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 620.571048][T15310] Call Trace: [ 620.571057][T15310] [ 620.571065][T15310] dump_stack_lvl+0xe8/0x150 [ 620.571096][T15310] should_fail_ex+0x3eb/0x540 [ 620.571127][T15310] _copy_from_user+0x2d/0xb0 [ 620.571154][T15310] ___sys_sendmsg+0x1c6/0x360 [ 620.571179][T15310] ? __lock_acquire+0x747/0x2de0 [ 620.571204][T15310] ? __pfx____sys_sendmsg+0x10/0x10 [ 620.571263][T15310] ? __fget_files+0x3a2/0x420 [ 620.571290][T15310] ? __fget_files+0x2a/0x420 [ 620.571327][T15310] __x64_sys_sendmsg+0x1b1/0x290 [ 620.571356][T15310] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 620.571400][T15310] do_syscall_64+0x166/0x520 [ 620.571423][T15310] ? trace_irq_disable+0x3b/0x140 [ 620.571466][T15310] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.571487][T15310] ? clear_bhb_loop+0x70/0xc0 [ 620.571521][T15310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.571542][T15310] RIP: 0033:0x7fbdf939e559 [ 620.571562][T15310] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 620.571581][T15310] RSP: 002b:00007fbdfa320028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 620.571603][T15310] RAX: ffffffffffffffda RBX: 00007fbdf9625fa0 RCX: 00007fbdf939e559 [ 620.571618][T15310] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000004 [ 620.571630][T15310] RBP: 00007fbdfa320090 R08: 0000000000000000 R09: 0000000000000000 [ 620.571643][T15310] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 620.571655][T15310] R13: 00007fbdf9626038 R14: 00007fbdf9625fa0 R15: 00007ffeab957f88 [ 620.571686][T15310] [ 620.974357][T15318] syzkaller0: entered promiscuous mode [ 620.974384][T15318] syzkaller0: entered allmulticast mode [ 621.002873][T14320] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.005463][T14315] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.005510][T14315] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.005550][T14315] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.330515][T15330] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3171'. [ 621.330545][T15330] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3171'. [ 621.500294][T15333] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3172'. [ 621.619537][T15344] sda1: Can't mount, would change RO state [ 621.639293][T15343] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3175'. [ 621.919919][T15353] FAULT_INJECTION: forcing a failure. [ 621.919919][T15353] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 621.919954][T15353] CPU: 0 UID: 0 PID: 15353 Comm: syz.2.3179 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 621.919984][T15353] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 621.919994][T15353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 621.920006][T15353] Call Trace: [ 621.920015][T15353] [ 621.920024][T15353] dump_stack_lvl+0xe8/0x150 [ 621.920057][T15353] should_fail_ex+0x3eb/0x540 [ 621.920107][T15353] _copy_from_iter+0x1d3/0x18b0 [ 621.920134][T15353] ? __might_fault+0xaf/0x130 [ 621.920168][T15353] ? skb_set_owner_w+0x263/0x3d0 [ 621.920202][T15353] ? sock_alloc_send_pskb+0xc87/0xd90 [ 621.920232][T15353] ? __pfx__copy_from_iter+0x10/0x10 [ 621.920266][T15353] ? __pfx__copy_from_iter+0x10/0x10 [ 621.920301][T15353] copy_page_from_iter+0x219/0x2d0 [ 621.920334][T15353] skb_copy_datagram_from_iter+0x2f4/0x720 [ 621.920379][T15353] packet_sendmsg+0x37c7/0x51b0 [ 621.920427][T15353] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 621.920464][T15353] ? cpu_latency_qos_add_request+0x286/0x300 [ 621.920510][T15353] ? __lock_acquire+0x747/0x2de0 [ 621.920537][T15353] ? kstrtouint+0x6e/0xe0 [ 621.920567][T15353] ? __pfx_packet_sendmsg+0x10/0x10 [ 621.920594][T15353] ? aa_sk_perm+0x6ff/0x8f0 [ 621.920629][T15353] ? lockdep_softirqs_on+0xc2/0x190 [ 621.920663][T15353] ? __pfx_aa_sk_perm+0x10/0x10 [ 621.920695][T15353] ? aa_sock_msg_perm+0x144/0x210 [ 621.920732][T15353] ? apparmor_socket_sendmsg+0x98/0x360 [ 621.920763][T15353] ? __pfx_packet_sendmsg+0x10/0x10 [ 621.920790][T15353] sock_sendmsg_nosec+0x14e/0x190 [ 621.920827][T15353] __sys_sendto+0x408/0x5a0 [ 621.920853][T15353] ? ksys_write+0x1e6/0x270 [ 621.920889][T15353] ? __pfx___sys_sendto+0x10/0x10 [ 621.920913][T15353] ? __mutex_unlock_slowpath+0x731/0x900 [ 621.920955][T15353] ? fdget+0x1ac/0x250 [ 621.921000][T15353] ? __pfx_ksys_write+0x10/0x10 [ 621.921039][T15353] __x64_sys_sendto+0xde/0x100 [ 621.921069][T15353] do_syscall_64+0x166/0x520 [ 621.921094][T15353] ? trace_irq_disable+0x3b/0x140 [ 621.921128][T15353] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 621.921150][T15353] ? clear_bhb_loop+0x70/0xc0 [ 621.921175][T15353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 621.921195][T15353] RIP: 0033:0x7fbdf939e559 [ 621.921213][T15353] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 621.921231][T15353] RSP: 002b:00007fbdfa320028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 621.921271][T15353] RAX: ffffffffffffffda RBX: 00007fbdf9625fa0 RCX: 00007fbdf939e559 [ 621.921287][T15353] RDX: 00000000000100a6 RSI: 0000200000002700 RDI: 0000000000000003 [ 621.921302][T15353] RBP: 00007fbdfa320090 R08: 0000200000002740 R09: 0000000000000050 [ 621.921330][T15353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 621.921343][T15353] R13: 00007fbdf9626038 R14: 00007fbdf9625fa0 R15: 00007ffeab957f88 [ 621.921376][T15353] [ 622.611732][ T5615] usb 7-1: new full-speed USB device number 29 using dummy_hcd [ 622.680790][T15369] FAULT_INJECTION: forcing a failure. [ 622.680790][T15369] name failslab, interval 1, probability 0, space 10, times 0 [ 622.680837][T15369] CPU: 0 UID: 0 PID: 15369 Comm: syz.2.3184 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 622.680879][T15369] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 622.680889][T15369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 622.680903][T15369] Call Trace: [ 622.680911][T15369] [ 622.680921][T15369] dump_stack_lvl+0xe8/0x150 [ 622.680959][T15369] should_fail_ex+0x3eb/0x540 [ 622.681000][T15369] should_failslab+0xa8/0x100 [ 622.681026][T15369] ? __kernfs_new_node+0xe6/0x980 [ 622.681070][T15369] kmem_cache_alloc_noprof+0x9c/0x600 [ 622.681100][T15369] ? kstrdup+0x81/0x100 [ 622.681129][T15369] ? __kernfs_new_node+0xe6/0x980 [ 622.681167][T15369] __kernfs_new_node+0xe6/0x980 [ 622.681205][T15369] ? __pfx___kernfs_new_node+0x10/0x10 [ 622.681232][T15369] ? kernfs_root+0x1c/0x230 [ 622.681263][T15369] ? kernfs_root+0x1c/0x230 [ 622.681287][T15369] ? kernfs_root+0x1c/0x230 [ 622.681309][T15369] ? kernfs_root+0x1c/0x230 [ 622.681339][T15369] kernfs_create_dir_ns+0xf7/0x220 [ 622.681373][T15369] sysfs_create_dir_ns+0x12f/0x2a0 [ 622.681397][T15369] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 622.681418][T15369] ? do_raw_spin_unlock+0xf5/0x200 [ 622.681447][T15369] kobject_add_internal+0x622/0xcd0 [ 622.681481][T15369] kobject_init_and_add+0x12b/0x1a0 [ 622.681512][T15369] ? __pfx_kobject_init_and_add+0x10/0x10 [ 622.681540][T15369] ? __kmalloc_cache_noprof+0x31c/0x600 [ 622.681567][T15369] ? __kmalloc_cache_noprof+0x148/0x600 [ 622.681599][T15369] ? __raw_spin_lock_init+0x45/0x100 [ 622.681626][T15369] swnode_register+0x3ba/0x590 [ 622.681650][T15369] fwnode_create_software_node+0x194/0x1f0 [ 622.681675][T15369] device_create_managed_software_node+0xce/0x1f0 [ 622.681702][T15369] iommufd_test+0x38a0/0x6360 [ 622.681734][T15369] ? __lock_acquire+0x747/0x2de0 [ 622.681753][T15369] ? __pfx_iommufd_test+0x10/0x10 [ 622.681786][T15369] ? tomoyo_path_number_perm+0x219/0x5f0 [ 622.681822][T15369] ? tomoyo_path_number_perm+0x219/0x5f0 [ 622.681850][T15369] ? lock_acquire+0x115/0x350 [ 622.681881][T15369] ? __might_fault+0xaf/0x130 [ 622.681910][T15369] iommufd_fops_ioctl+0x465/0x600 [ 622.681943][T15369] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 622.681974][T15369] ? __fget_files+0x2a/0x420 [ 622.682036][T15369] ? bpf_lsm_file_ioctl+0x9/0x20 [ 622.682058][T15369] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 622.682086][T15369] __se_sys_ioctl+0xfc/0x170 [ 622.682110][T15369] do_syscall_64+0x166/0x520 [ 622.682134][T15369] ? trace_irq_disable+0x3b/0x140 [ 622.682155][T15369] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 622.682175][T15369] ? clear_bhb_loop+0x70/0xc0 [ 622.682198][T15369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 622.682218][T15369] RIP: 0033:0x7fbdf939e559 [ 622.682237][T15369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 622.682255][T15369] RSP: 002b:00007fbdfa320028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 622.682276][T15369] RAX: ffffffffffffffda RBX: 00007fbdf9625fa0 RCX: 00007fbdf939e559 [ 622.682291][T15369] RDX: 00002000000015c0 RSI: 0000000000003ba0 RDI: 0000000000000005 [ 622.682324][T15369] RBP: 00007fbdf94358b0 R08: 0000000000000000 R09: 0000000000000000 [ 622.682338][T15369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 622.682351][T15369] R13: 00007fbdf9626038 R14: 00007fbdf9625fa0 R15: 00007ffeab957f88 [ 622.682380][T15369] [ 622.706005][T15369] kobject: kobject_add_internal failed for node1 (error: -12 parent: software_nodes) [ 622.706273][T15369] iommufd_mock iommufd_mock0: add pasid-num-bits property failed, rc: -12 [ 622.815633][ T5615] usb 7-1: New USB device found: idVendor=a168, idProduct=0610, bcdDevice=62.ac [ 623.000451][ T5615] usb 7-1: config 34 has an invalid interface number: 153 but max is 0 [ 623.000493][ T5615] usb 7-1: config 34 has no interface number 0 [ 623.000523][ T5615] usb 7-1: config 34 interface 153 has no altsetting 0 [ 623.091623][ T5615] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 623.091651][ T5615] usb 7-1: Product: syz [ 623.091666][ T5615] usb 7-1: Manufacturer: syz [ 623.091681][ T5615] usb 7-1: SerialNumber: syz [ 623.268635][T15377] fuse: Unknown parameter '0xffffffffffffffff00000000000000000000' [ 623.271019][T15377] CIFS: Unable to determine destination address [ 623.347973][ T33] audit: type=1804 audit(2000000098.740:76): pid=15377 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.7.3186" name="file0" dev="tmpfs" ino=301 res=1 errno=0 [ 623.392671][T15381] fuse: Unknown parameter '0xffffffffffffffff00000000000000000000' [ 623.393185][ T33] audit: type=1804 audit(2000000098.790:77): pid=15377 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.7.3186" name="file0" dev="tmpfs" ino=301 res=1 errno=0 [ 623.419673][ T33] audit: type=1804 audit(2000000098.810:78): pid=15385 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.7.3186" name="file0" dev="tmpfs" ino=301 res=1 errno=0 [ 623.575541][ T5615] gspca_main: gspca_sn9c20x-2.14.0 probing a168:0610 [ 623.580435][ T33] audit: type=1400 audit(2000000098.970:79): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=26AE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F pid=15387 comm="syz.2.3187" [ 623.609786][ T5615] gspca_sn9c20x: Write register 1000 failed -71 [ 623.609807][ T5615] gspca_sn9c20x: Device initialization failed [ 623.609884][ T5615] gspca_sn9c20x 7-1:34.153: probe with driver gspca_sn9c20x failed with error -71 [ 623.641771][ T5615] usb 7-1: USB disconnect, device number 29 [ 624.676262][T15430] __nla_validate_parse: 6 callbacks suppressed [ 624.676282][T15430] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3197'. [ 625.024475][T15443] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3203'. [ 625.024503][T15443] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3203'. [ 625.246811][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 625.246877][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.309941][T15452] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3206'. [ 625.761739][ T10] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 625.855315][ T33] audit: type=1800 audit(2000000101.250:80): pid=15463 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3211" name="scheduler" dev="sysfs" ino=21253 res=0 errno=-22 [ 625.931748][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 625.933509][ T10] usb 7-1: New USB device found: idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 625.934471][ T10] usb 7-1: config 32 has an invalid interface number: 85 but max is 0 [ 625.934495][ T10] usb 7-1: config 32 has no interface number 0 [ 625.934542][ T10] usb 7-1: config 32 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 625.934573][ T10] usb 7-1: config 32 interface 85 has no altsetting 0 [ 625.936691][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.936715][ T10] usb 7-1: Product: syz [ 625.936731][ T10] usb 7-1: Manufacturer: syz [ 625.936752][ T10] usb 7-1: SerialNumber: syz [ 626.244124][T15469] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3213'. [ 626.244178][T15469] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3213'. [ 626.591849][ T5694] usb 5-1: new full-speed USB device number 56 using dummy_hcd [ 626.744437][ T5694] usb 5-1: unable to get BOS descriptor or descriptor too short [ 626.745229][ T5694] usb 5-1: not running at top speed; connect to a high speed hub [ 626.745264][ T5694] usb 5-1: New USB device found: idVendor=0e41, idProduct=4241, bcdDevice=0.40 [ 626.750414][ T5694] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 626.750441][ T5694] usb 5-1: Product: К [ 626.750457][ T5694] usb 5-1: Manufacturer: 㐁 [ 626.750481][ T5694] usb 5-1: SerialNumber: ⶝들⯊ᬬﳉ熆뢾뾗梻莯忷셷끪漑鮩迃猠䲯唕ꍱ校ṋꞞ儗䍃줺벵 [ 627.074585][T15490] skbuff: bad partial csum: csum=65535/2 headroom=178 headlen=65543 [ 627.076681][T15471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 627.077387][T15471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 627.112463][T15471] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3214'. [ 627.131996][ T5694] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 627.201221][ T5694] usb 5-1: USB disconnect, device number 56 [ 627.419604][ T33] audit: type=1400 audit(2000000102.810:81): apparmor="STATUS" info="failed to unpack profile capabilities" error=-71 profile="unconfined" name="/" pid=15494 comm="syz.2.3220" name="/" offset=59 [ 627.794919][T15503] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3222'. [ 627.794949][T15503] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3222'. [ 627.957497][T15510] XFS (mtdblock0): Invalid superblock magic number [ 628.332689][ T5615] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 628.483113][ T5615] usb 5-1: New USB device found: idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 628.484689][ T5615] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 628.490578][ T5615] usb 5-1: config 0 descriptor?? [ 628.532053][ T5615] cp210x 5-1:0.0: cp210x converter detected [ 628.624764][ T10] appletouch 7-1:32.85: Failed to read mode from device. [ 628.624945][ T10] appletouch 7-1:32.85: probe with driver appletouch failed with error -5 [ 628.631369][T15530] usb usb8: usbfs: process 15530 (syz.2.3229) did not claim interface 0 before use [ 628.673902][ T33] audit: type=1800 audit(2000000104.070:82): pid=15530 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3229" name="add_remote_port" dev="sysfs" ino=21908 res=0 errno=-13 [ 628.685946][ T10] usb 7-1: USB disconnect, device number 30 [ 628.964845][ T5615] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 629.057702][T15539] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3232'. [ 629.090382][ T5615] cp210x 5-1:0.0: failed to get vendor val 0x3711 size 2: -32 [ 629.090409][ T5615] cp210x 5-1:0.0: GPIO initialisation failed: -32 [ 629.113180][ T5615] usb 5-1: cp210x converter now attached to ttyUSB0 [ 629.115829][ T5615] usb 5-1: USB disconnect, device number 57 [ 629.120201][ T5615] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 629.120877][ T5615] cp210x 5-1:0.0: device disconnected [ 629.731676][ T5615] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 629.785506][T15568] __nla_validate_parse: 1 callbacks suppressed [ 629.785542][T15568] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3241'. [ 629.785562][T15568] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3241'. [ 629.892764][ T5615] usb 7-1: Using ep0 maxpacket: 16 [ 629.893571][ T5615] usb 7-1: New USB device found: idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 629.916456][ T5615] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 629.916483][ T5615] usb 7-1: Product: syz [ 629.916499][ T5615] usb 7-1: Manufacturer: syz [ 629.916515][ T5615] usb 7-1: SerialNumber: syz [ 629.943132][ T5615] usb 7-1: config 0 descriptor?? [ 629.948981][ T5615] ssu100 7-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 630.222435][ T5702] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 630.282067][ T10] usb 5-1: new full-speed USB device number 58 using dummy_hcd [ 630.352218][ T5702] usb 3-1: device descriptor read/64, error -71 [ 630.414027][ T10] usb 5-1: device descriptor read/64, error -71 [ 630.591742][ T5702] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 630.652063][ T10] usb 5-1: new full-speed USB device number 59 using dummy_hcd [ 630.733572][ T5702] usb 3-1: device descriptor read/64, error -71 [ 630.756170][ T5615] ssu100 7-1:0.0: probe with driver ssu100 failed with error -71 [ 630.773660][ T5615] usb 7-1: USB disconnect, device number 31 [ 630.791777][ T10] usb 5-1: device descriptor read/64, error -71 [ 630.845709][ T5702] usb usb3-port1: attempt power cycle [ 630.902118][ T10] usb usb5-port1: attempt power cycle [ 631.182073][ T5702] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 631.183140][T15586] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3248'. [ 631.220849][ T5702] usb 3-1: device descriptor read/8, error -71 [ 631.252587][ T10] usb 5-1: new full-speed USB device number 60 using dummy_hcd [ 631.273833][ T10] usb 5-1: device descriptor read/8, error -71 [ 631.451704][ T5702] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 631.473907][ T5702] usb 3-1: device descriptor read/8, error -71 [ 631.513531][ T10] usb 5-1: new full-speed USB device number 61 using dummy_hcd [ 631.517868][T15594] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3251'. [ 631.517893][T15594] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3251'. [ 631.545559][ T10] usb 5-1: device descriptor read/8, error -71 [ 631.582479][ T5702] usb usb3-port1: unable to enumerate USB device [ 631.594964][T15590] FAULT_INJECTION: forcing a failure. [ 631.594964][T15590] name failslab, interval 1, probability 0, space 10, times 0 [ 631.595068][T15590] CPU: 0 UID: 0 PID: 15590 Comm: syz.6.3250 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 631.595151][T15590] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 631.595179][T15590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 631.595212][T15590] Call Trace: [ 631.595234][T15590] [ 631.595264][T15590] dump_stack_lvl+0xe8/0x150 [ 631.595358][T15590] should_fail_ex+0x3eb/0x540 [ 631.595446][T15590] should_failslab+0xa8/0x100 [ 631.595524][T15590] __kmalloc_noprof+0xf9/0x710 [ 631.595606][T15590] ? io_cache_alloc_new+0x40/0x100 [ 631.595690][T15590] ? io_cache_alloc_new+0x40/0x100 [ 631.595778][T15590] io_cache_alloc_new+0x40/0x100 [ 631.595861][T15590] io_uring_cmd_prep+0x39a/0x600 [ 631.595946][T15590] io_submit_sqes+0xbde/0x2310 [ 631.596135][T15590] __se_sys_io_uring_enter+0x35b/0x1bb0 [ 631.596283][T15590] ? ktime_get+0x1f5/0x220 [ 631.596350][T15590] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 631.596425][T15590] ? clockevents_program_event+0x491/0x630 [ 631.596517][T15590] ? __pfx_clockevents_program_event+0x10/0x10 [ 631.596639][T15590] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 631.596732][T15590] do_syscall_64+0x166/0x520 [ 631.596808][T15590] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 631.596876][T15590] ? clear_bhb_loop+0x70/0xc0 [ 631.596943][T15590] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 631.596992][T15590] RIP: 0033:0x7fcf2099e559 [ 631.597062][T15590] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 631.597107][T15590] RSP: 002b:00007fcf218fdf38 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 631.597203][T15590] RAX: ffffffffffffffda RBX: 0000200000000300 RCX: 00007fcf2099e559 [ 631.597246][T15590] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000006 [ 631.597286][T15590] RBP: 00000000000001c7 R08: 0000000000000000 R09: 0000000000000008 [ 631.597328][T15590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 631.597363][T15590] R13: 0000000000000008 R14: 0000000000000f39 R15: 0000000000000000 [ 631.597449][T15590] [ 631.668499][ T10] usb usb5-port1: unable to enumerate USB device [ 632.741403][T15617] netlink: 'syz.6.3258': attribute type 4 has an invalid length. [ 632.741429][T15617] netlink: 5620 bytes leftover after parsing attributes in process `syz.6.3258'. [ 633.278225][ T33] audit: type=1400 audit(2000000108.670:83): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=26AE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F pid=15627 comm="syz.4.3265" [ 633.497653][T15630] zonefs (md0) ERROR: Not a zoned block device [ 633.718882][T15636] fuse: Unknown parameter 'fE' [ 633.767764][T15638] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3264'. [ 633.800722][T15643] bridge0: entered allmulticast mode [ 634.041688][T14032] Bluetooth: hci1: command tx timeout [ 634.134294][T15648] overlayfs: failed to resolve './file0': -2 [ 634.396118][T15652] netlink: 'syz.4.3272': attribute type 27 has an invalid length. [ 634.396152][T15652] lo: entered promiscuous mode [ 634.398219][T15652] bond0: entered promiscuous mode [ 634.401372][T15652] dummy0: entered promiscuous mode [ 634.404952][T15652] eql: entered promiscuous mode [ 634.405914][T15652] ifb0: entered promiscuous mode [ 634.407263][T15652] ifb1: entered promiscuous mode [ 634.408690][T15652] virtio_net virtio1 eth0: entered promiscuous mode [ 634.409830][T15652] mac80211_hwsim hwsim0 wlan0: entered promiscuous mode [ 634.410268][T15652] mac80211_hwsim hwsim1 wlan1: entered promiscuous mode [ 634.410708][T15652] hwsim0: entered promiscuous mode [ 634.411901][T15652] ieee802154 phy0 wpan0: entered promiscuous mode [ 634.412807][T15652] ieee802154 phy1 wpan1: entered promiscuous mode [ 634.413633][T15652] teql0: entered promiscuous mode [ 634.415027][T15652] tunl0: entered promiscuous mode [ 634.415946][T15652] gre0: entered promiscuous mode [ 634.417356][T15652] gretap0: entered promiscuous mode [ 634.417418][T15652] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 634.662228][ T33] audit: type=1400 audit(2000000110.060:84): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=26AE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F pid=15658 comm="syz.4.3274" [ 635.057890][T15674] netlink: 'syz.7.3280': attribute type 21 has an invalid length. [ 635.057916][T15674] netlink: 128 bytes leftover after parsing attributes in process `syz.7.3280'. [ 635.057996][T15674] netlink: 'syz.7.3280': attribute type 4 has an invalid length. [ 635.058011][T15674] netlink: 'syz.7.3280': attribute type 5 has an invalid length. [ 635.058024][T15674] netlink: 3 bytes leftover after parsing attributes in process `syz.7.3280'. [ 635.152301][ T10] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 635.291822][ T10] usb 3-1: device descriptor read/64, error -71 [ 635.321350][T15678] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 635.454657][ T33] audit: type=1400 audit(2000000110.850:85): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=26AE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F pid=15681 comm="syz.4.3284" [ 635.552229][ T10] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 635.691671][ T10] usb 3-1: device descriptor read/64, error -71 [ 635.815966][ T10] usb usb3-port1: attempt power cycle [ 635.858474][T15692] FAULT_INJECTION: forcing a failure. [ 635.858474][T15692] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 635.858512][T15692] CPU: 0 UID: 0 PID: 15692 Comm: syz.4.3288 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 635.858561][T15692] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 635.858571][T15692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 635.858585][T15692] Call Trace: [ 635.858594][T15692] [ 635.858603][T15692] dump_stack_lvl+0xe8/0x150 [ 635.858638][T15692] should_fail_ex+0x3eb/0x540 [ 635.858685][T15692] _copy_to_user+0x31/0xb0 [ 635.858718][T15692] kvm_dev_ioctl_get_cpuid+0x63e/0x7d0 [ 635.858755][T15692] ? __pfx_kvm_dev_ioctl_get_cpuid+0x10/0x10 [ 635.858786][T15692] ? __might_fault+0xaf/0x130 [ 635.858818][T15692] kvm_arch_dev_ioctl+0x34e/0x660 [ 635.858841][T15692] ? __pfx_kvm_arch_dev_ioctl+0x10/0x10 [ 635.858877][T15692] ? kasan_quarantine_put+0xbb/0x1f0 [ 635.858924][T15692] kvm_dev_ioctl+0x539/0x1700 [ 635.858955][T15692] ? __fget_files+0x2a/0x420 [ 635.858988][T15692] ? __fget_files+0x2a/0x420 [ 635.859017][T15692] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 635.859051][T15692] ? bpf_lsm_file_ioctl+0x9/0x20 [ 635.859072][T15692] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 635.859102][T15692] __se_sys_ioctl+0xfc/0x170 [ 635.859134][T15692] do_syscall_64+0x166/0x520 [ 635.859160][T15692] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.859181][T15692] ? clear_bhb_loop+0x70/0xc0 [ 635.859207][T15692] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.859228][T15692] RIP: 0033:0x7fcf1639e1eb [ 635.859248][T15692] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 635.859266][T15692] RSP: 002b:00007fcf1733a450 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 635.859288][T15692] RAX: ffffffffffffffda RBX: 0000200000fd7000 RCX: 00007fcf1639e1eb [ 635.859303][T15692] RDX: 00007fcf1733abd0 RSI: 00000000c008ae05 RDI: 0000000000000007 [ 635.859317][T15692] RBP: 0000200000fd8000 R08: 0000000000000007 R09: 0000000000000000 [ 635.859331][T15692] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000fd8800 [ 635.859345][T15692] R13: 00007fcf1733abd0 R14: 000000000000006b R15: 00000000000000c0 [ 635.859376][T15692] [ 636.164001][ T10] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 636.195641][ T10] usb 3-1: device descriptor read/8, error -71 [ 636.248910][T15691] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 636.330623][T15691] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 636.403667][T15691] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 636.452360][ T10] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 636.482464][ T10] usb 3-1: device descriptor read/8, error -71 [ 636.498388][T15691] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 636.592270][ T10] usb usb3-port1: unable to enumerate USB device [ 636.625293][T14316] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.682406][T14332] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.685489][T14332] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.691841][T14316] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 637.023138][T15706] jffs2: notice: (15706) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 637.042521][ T33] audit: type=1804 audit(2000000112.430:86): pid=15706 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.6.3292" name="/newroot/159/mnt/fillfile" dev="jffs2" ino=2 res=1 errno=0 [ 637.140472][ T33] audit: type=1800 audit(2000000112.530:87): pid=15706 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3292" name="dbroot" dev="configfs" ino=80140 res=0 errno=-22 [ 637.391201][ T33] audit: type=1400 audit(2000000112.780:88): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=26AE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F pid=15712 comm="syz.6.3294" [ 637.419273][T15713] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3293'. [ 637.653742][T15718] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3295'. [ 637.720803][T15718] kvm: requested 2514 ns i8254 timer period limited to 200000 ns [ 637.843665][T15718] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 637.871712][ T5694] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 638.022438][ T5694] usb 7-1: New USB device found: idVendor=06cd, idProduct=0107, bcdDevice=1.00 [ 638.023621][ T5694] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 638.031374][ T5694] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 638.031399][ T5694] usb 7-1: Product: syz [ 638.031414][ T5694] usb 7-1: Manufacturer: syz [ 638.031430][ T5694] usb 7-1: SerialNumber: syz [ 638.099999][ T5694] keyspan 7-1:1.0: Keyspan 1 port adapter converter detected [ 638.100243][ T5694] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 84 [ 638.123663][ T5694] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 81 [ 638.123749][ T5694] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 82 [ 638.123828][ T5694] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 1 [ 638.123904][ T5694] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 2 [ 638.123987][ T5694] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 83 [ 638.124061][ T5694] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 3 [ 638.126525][ T5694] usb 7-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 638.300131][T15717] zero sized request [ 638.415908][ T5694] usb 7-1: USB disconnect, device number 32 [ 638.432691][ T5694] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 638.434598][ T5694] keyspan 7-1:1.0: device disconnected [ 639.644250][ T5702] usb 7-1: new full-speed USB device number 33 using dummy_hcd [ 639.745438][ T33] audit: type=1400 audit(2000000115.140:89): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=26AE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F pid=15744 comm="syz.4.3304" [ 639.811832][ T5702] usb 7-1: not running at top speed; connect to a high speed hub [ 639.811867][ T5702] usb 7-1: New USB device found: idVendor=112a, idProduct=0001, bcdDevice=18.70 [ 639.816006][ T5702] usb 7-1: config 5 has an invalid interface number: 182 but max is 0 [ 639.816032][ T5702] usb 7-1: config 5 has no interface number 0 [ 639.816061][ T5702] usb 7-1: config 5 interface 182 has no altsetting 0 [ 639.865817][ T5702] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 639.865843][ T5702] usb 7-1: Product: syz [ 639.865859][ T5702] usb 7-1: Manufacturer: syz [ 639.865875][ T5702] usb 7-1: SerialNumber: syz [ 640.041827][ T10] usb 3-1: new full-speed USB device number 41 using dummy_hcd [ 640.133538][T15752] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 640.134043][T15752] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 640.218250][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 640.220452][ T10] usb 3-1: not running at top speed; connect to a high speed hub [ 640.220507][ T10] usb 3-1: New USB device found: idVendor=8086, idProduct=0ad2, bcdDevice=0.00 [ 640.223020][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 640.223135][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 640.223301][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 640.230558][T14872] usb 5-1: new full-speed USB device number 62 using dummy_hcd [ 640.244878][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 640.244979][ T10] usb 3-1: Product: syz [ 640.245014][ T10] usb 3-1: Manufacturer: syz [ 640.326403][ T5702] redrat3 7-1:5.182: Couldn't find all endpoints [ 640.329800][ T10] uvcvideo 3-1:1.0: Found UVC 1.00 device syz (8086:0ad2) [ 640.354189][ T5702] usb 7-1: USB disconnect, device number 33 [ 640.434590][T14872] usb 5-1: unable to get BOS descriptor or descriptor too short [ 640.435078][T14872] usb 5-1: not running at top speed; connect to a high speed hub [ 640.435108][T14872] usb 5-1: New USB device found: idVendor=041e, idProduct=3040, bcdDevice=0.40 [ 640.436080][T14872] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1024, setting to 1023 [ 640.436586][T14872] usb 5-1: language id specifier not provided by device, defaulting to English [ 640.440540][T14872] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 640.440566][T14872] usb 5-1: Manufacturer: 妵銍烶ⷊ鼕↫㧸疌Ῐ֙ⳉ妮ᅜ۝憾ₒ [ 640.440585][T14872] usb 5-1: SerialNumber: syz [ 640.575868][T15747] netlink: 17279 bytes leftover after parsing attributes in process `syz.2.3305'. [ 640.681041][ T10] uvcvideo 3-1:1.0: Failed to query (GET_INFO) UVC control 6 on unit 3: -71 (exp. 1). [ 640.681558][ T10] uvcvideo 3-1:1.0: Failed to query (GET_INFO) UVC control 9 on unit 3: -71 (exp. 1). [ 640.694186][ T10] uvcvideo 3-1:1.0: Failed to query (GET_INFO) UVC control 10 on unit 3: -71 (exp. 1). [ 640.697474][ T10] uvcvideo 3-1:1.0: Failed to query (GET_INFO) UVC control 4 on unit 3: -71 (exp. 1). [ 640.707171][ T10] uvcvideo 3-1:1.0: Failed to query (GET_INFO) UVC control 5 on unit 3: -71 (exp. 1). [ 640.708318][ T10] uvcvideo 3-1:1.0: Failed to query (GET_CUR) UVC control 5 on unit 3: -71 (exp. 1). [ 640.727410][ T10] uvcvideo 3-1:1.0: Failed to query (GET_INFO) UVC control 16 on unit 3: -71 (exp. 1). [ 640.731904][ T10] uvcvideo 3-1:1.0: Failed to query (GET_INFO) UVC control 11 on unit 3: -71 (exp. 1). [ 640.737401][ T10] uvcvideo 3-1:1.0: Failed to query (GET_INFO) UVC control 13 on unit 3: -71 (exp. 1). [ 640.747752][ T10] uvcvideo 3-1:1.0: Failed to query (GET_INFO) UVC control 15 on unit 3: -71 (exp. 1). [ 640.747892][ T10] uvcvideo 3-1:1.0: No streaming interface found for terminal 32770. [ 640.748057][ T10] uvcvideo 3-1:1.0: Failed to create links for entity 3 [ 640.748095][ T10] uvcvideo 3-1:1.0: Failed to register entities (-22). [ 640.810755][ T10] usb 3-1: USB disconnect, device number 41 [ 640.825947][T14872] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 640.827695][T14872] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 640.931413][T14872] usb 5-1: USB disconnect, device number 62 [ 641.169405][T15765] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3309'. [ 641.677801][ T33] audit: type=1400 audit(2000000117.070:90): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=26AE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F pid=15772 comm="syz.6.3314" [ 641.901898][ T10] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 642.064421][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 642.066689][ T10] usb 5-1: New USB device found: idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 642.069254][ T10] usb 5-1: config 32 has an invalid interface number: 85 but max is 0 [ 642.069281][ T10] usb 5-1: config 32 has no interface number 0 [ 642.069321][ T10] usb 5-1: config 32 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 642.069349][ T10] usb 5-1: config 32 interface 85 has no altsetting 0 [ 642.083100][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 642.083163][ T10] usb 5-1: Product: syz [ 642.083218][ T10] usb 5-1: Manufacturer: syz [ 642.083264][ T10] usb 5-1: SerialNumber: syz [ 642.271774][T14872] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 642.422678][T14872] usb 7-1: New USB device found: idVendor=18d1, idProduct=1eaf, bcdDevice=0.00 [ 642.427271][T14872] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 642.452501][T14872] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 642.452531][T14872] usb 7-1: Product: syz [ 642.452548][T14872] usb 7-1: Manufacturer: syz [ 642.452565][T14872] usb 7-1: SerialNumber: syz [ 642.723919][T14872] usb 7-1: Limiting number of CPorts to U8_MAX [ 642.754944][T14872] usb 7-1: Not enough endpoints found in device, aborting! [ 642.933435][T14872] usb 7-1: USB disconnect, device number 34 [ 643.138991][T15796] warn_alloc: 1 callbacks suppressed [ 643.139012][T15796] syz.2.3323: vmalloc error: size 68719476738, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 643.139121][T15796] CPU: 1 UID: 0 PID: 15796 Comm: syz.2.3323 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 643.139171][T15796] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 643.139181][T15796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 643.139196][T15796] Call Trace: [ 643.139205][T15796] [ 643.139215][T15796] dump_stack_lvl+0xe8/0x150 [ 643.139262][T15796] warn_alloc+0x24d/0x270 [ 643.139301][T15796] ? __pfx_warn_alloc+0x10/0x10 [ 643.139352][T15796] __vmalloc_node_range_noprof+0x12c/0x16f0 [ 643.139382][T15796] ? __pfx___mutex_trylock_common+0x10/0x10 [ 643.139412][T15796] ? rcu_is_watching+0x16/0xb0 [ 643.139450][T15796] ? trace_contention_end+0x3d/0x140 [ 643.139479][T15796] ? __mutex_lock+0x305/0x15a0 [ 643.139513][T15796] ? tomoyo_path_number_perm+0x219/0x5f0 [ 643.139544][T15796] ? tomoyo_path_number_perm+0x219/0x5f0 [ 643.139569][T15796] ? dvb_dvr_do_ioctl+0x76/0x220 [ 643.139608][T15796] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 643.139644][T15796] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 643.139676][T15796] vmalloc_noprof+0xb2/0xe0 [ 643.139703][T15796] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 643.139736][T15796] dvb_dvr_do_ioctl+0x12b/0x220 [ 643.139772][T15796] dvb_usercopy+0x199/0x2e0 [ 643.139798][T15796] ? __pfx_dvb_dvr_do_ioctl+0x10/0x10 [ 643.139829][T15796] ? __pfx_dvb_usercopy+0x10/0x10 [ 643.139868][T15796] ? __fget_files+0x2a/0x420 [ 643.139904][T15796] ? __pfx_dvb_dvr_ioctl+0x10/0x10 [ 643.139935][T15796] dvb_dvr_ioctl+0x29/0x40 [ 643.139966][T15796] __se_sys_ioctl+0xfc/0x170 [ 643.139992][T15796] do_syscall_64+0x166/0x520 [ 643.140017][T15796] ? trace_irq_disable+0x3b/0x140 [ 643.140040][T15796] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 643.140062][T15796] ? clear_bhb_loop+0x70/0xc0 [ 643.140089][T15796] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 643.140109][T15796] RIP: 0033:0x7fbdf939e559 [ 643.140130][T15796] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 643.140149][T15796] RSP: 002b:00007fbdfa320028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 643.140171][T15796] RAX: ffffffffffffffda RBX: 00007fbdf9625fa0 RCX: 00007fbdf939e559 [ 643.140187][T15796] RDX: 0000001000000002 RSI: 0000000000006f2d RDI: 0000000000000004 [ 643.140201][T15796] RBP: 00007fbdf94358b0 R08: 0000000000000000 R09: 0000000000000000 [ 643.140214][T15796] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 643.140227][T15796] R13: 00007fbdf9626038 R14: 00007fbdf9625fa0 R15: 00007ffeab957f88 [ 643.140261][T15796] [ 643.434155][T15796] Mem-Info: [ 643.434172][T15796] active_anon:20584 inactive_anon:70524 isolated_anon:0 [ 643.434172][T15796] active_file:17535 inactive_file:40098 isolated_file:0 [ 643.434172][T15796] unevictable:0 dirty:124 writeback:0 [ 643.434172][T15796] slab_reclaimable:21990 slab_unreclaimable:94947 [ 643.434172][T15796] mapped:41903 shmem:84058 pagetables:1467 [ 643.434172][T15796] sec_pagetables:0 bounce:0 [ 643.434172][T15796] kernel_misc_reclaimable:0 [ 643.434172][T15796] free:1159095 free_pcp:17029 free_cma:0 [ 643.434231][T15796] Node 0 active_anon:82336kB inactive_anon:282096kB active_file:70080kB inactive_file:160196kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:167564kB dirty:492kB writeback:0kB shmem:336232kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:6144kB kernel_stack:13144kB pagetables:5472kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 643.434313][T15796] Node 1 active_anon:0kB inactive_anon:0kB active_file:60kB inactive_file:196kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:48kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:396kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 643.434370][T15796] Node 0 DMA free:15352kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 643.434454][T15796] lowmem_reserve[]: 0 2462 2463 2463 2463 [ 643.434494][T15796] Node 0 DMA32 free:695212kB boost:0kB min:33920kB low:42400kB high:50880kB reserved_highatomic:0kB free_highatomic:0kB active_anon:82336kB inactive_anon:282096kB active_file:70080kB inactive_file:160196kB unevictable:0kB writepending:492kB zspages:328kB present:3129332kB managed:2521368kB mlocked:0kB bounce:0kB free_pcp:44904kB local_pcp:26220kB free_cma:0kB [ 643.434557][T15796] lowmem_reserve[]: 0 0 1 1 1 [ 643.434613][T15796] Node 0 Normal free:0kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1388kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 643.434672][T15796] lowmem_reserve[]: 0 0 0 0 0 [ 643.434706][T15796] Node 1 Normal free:3925816kB boost:0kB min:55960kB low:69948kB high:83936kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:60kB inactive_file:196kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:23208kB local_pcp:4776kB free_cma:0kB [ 643.434798][T15796] lowmem_reserve[]: 0 0 0 0 0 [ 643.434831][T15796] Node 0 DMA: 0*4kB 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15352kB [ 643.435051][T15796] Node 0 DMA32: 37*4kB (UME) 1*8kB (E) 24*16kB (UME) 474*32kB (UME) 218*64kB (UME) 119*128kB (UME) 62*256kB (UME) 9*512kB (UE) 1*1024kB (U) 3*2048kB (UME) 152*4096kB (UM) = 695132kB [ 643.435256][T15796] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 643.435382][T15796] Node 1 Normal: 6*4kB (UM) 4*8kB (UM) 6*16kB (UM) 5*32kB (UM) 4*64kB (U) 6*128kB (UM) 0*256kB 3*512kB (UM) 3*1024kB (UM) 2*2048kB (M) 956*4096kB (UM) = 3925816kB [ 643.435566][T15796] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 643.435583][T15796] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 643.435599][T15796] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 643.435616][T15796] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 643.435633][T15796] 141689 total pagecache pages [ 643.435663][T15796] 2 pages in swap cache [ 643.435671][T15796] Free swap = 124904kB [ 643.435679][T15796] Total swap = 124996kB [ 643.435688][T15796] 2097051 pages RAM [ 643.435695][T15796] 0 pages HighMem/MovableOnly [ 643.435704][T15796] 434746 pages reserved [ 643.435711][T15796] 0 pages cma reserved [ 644.254073][ T33] audit: type=1804 audit(2000000119.650:91): pid=15805 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.7.3327" name="file0" dev="tmpfs" ino=529 res=1 errno=0 [ 644.285020][T14318] IPVS: starting estimator thread 0... [ 644.288809][T15805] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3327'. [ 644.341730][ T5615] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 644.374606][T15809] IPVS: Error connecting to the multicast addr [ 644.392502][T15808] IPVS: using max 28 ests per chain, 67200 per kthread [ 644.491687][ T5694] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 644.493287][ T5615] usb 7-1: New USB device found: idVendor=0424, idProduct=7850, bcdDevice=0.00 [ 644.498490][ T5615] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 644.498516][ T5615] usb 7-1: Product: syz [ 644.498533][ T5615] usb 7-1: Manufacturer: syz [ 644.498549][ T5615] usb 7-1: SerialNumber: syz [ 644.643978][ T5694] usb 3-1: New USB device found: idVendor=8087, idProduct=0025, bcdDevice=0.01 [ 644.647709][ T5694] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 644.647738][ T5694] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 644.647760][ T5694] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 644.647821][ T5694] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 644.702136][T15807] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 644.728173][ T10] appletouch 5-1:32.85: Failed to read mode from device. [ 644.728370][ T10] appletouch 5-1:32.85: probe with driver appletouch failed with error -5 [ 644.792526][ T5615] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 644.792605][ T5615] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 644.830447][ T10] usb 5-1: USB disconnect, device number 63 [ 644.931675][ T5694] usb 3-1: USB disconnect, device number 42 [ 644.937398][T14032] Bluetooth: hci3: Reading Intel version command failed (-71) [ 645.981285][T15823] netlink: 'syz.7.3330': attribute type 2 has an invalid length. [ 646.188621][ T33] audit: type=1800 audit(2000000121.580:92): pid=15828 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3333" name="bus" dev="tmpfs" ino=1299 res=0 errno=-22 [ 646.192322][ T33] audit: type=1800 audit(2000000121.590:93): pid=15825 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3333" name="bus" dev="tmpfs" ino=1299 res=0 errno=-22 [ 646.192862][ T33] audit: type=1800 audit(2000000121.590:94): pid=15825 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3333" name="bus" dev="tmpfs" ino=1299 res=0 errno=-22 [ 647.171808][ T5615] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 647.171869][ T5615] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 647.212501][ T5615] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 647.251260][ T5615] lan78xx 7-1:1.0: probe with driver lan78xx failed with error -71 [ 647.278807][ T5615] usb 7-1: USB disconnect, device number 35 [ 647.364302][ T33] audit: type=1400 audit(2000000122.760:95): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=26AE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F pid=15834 comm="syz.2.3335" [ 647.999091][T15850] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3341'. [ 648.108009][T15848] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3340'. [ 648.632455][ T33] audit: type=1400 audit(2000000124.030:96): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=26AE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F pid=15862 comm="syz.2.3346" [ 649.171901][ T10] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 649.314316][T15877] input: syz0 as /devices/virtual/input/input89 [ 649.355422][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 649.358101][ T10] usb 3-1: New USB device found: idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 649.361964][ T10] usb 3-1: config index 0 descriptor too short (expected 6427, got 27) [ 649.362057][ T10] usb 3-1: config 0 has an invalid interface number: 21 but max is 0 [ 649.362124][ T10] usb 3-1: config 0 has no interface number 0 [ 649.362229][ T10] usb 3-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 649.362300][ T10] usb 3-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 649.362380][ T10] usb 3-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 649.375198][ T10] usb 3-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 649.375256][ T10] usb 3-1: Product: syz [ 649.409898][ T10] usb 3-1: config 0 descriptor?? [ 649.414640][T15868] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 649.841407][T14032] Bluetooth: hci0: SCO packet for unknown connection handle 3629 [ 650.070176][ T10] input: syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.21/input/input90 [ 650.550676][ C1] vcan0: j1939_tp_rxtimer: 0xffff888056fe4800: rx timeout, send abort [ 650.551025][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888056fe4800: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 650.561399][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880212b8400: rx timeout, send abort [ 650.561547][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880212b8800: rx timeout, send abort [ 650.576395][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff8880212b8400: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session. [ 650.576654][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff8880212b8800: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session. [ 650.848434][T14316] rpcbind: server 127.0.0.1 not responding, timed out [ 651.085643][T15889] overlayfs: failed to clone upperpath [ 651.699259][T15900] FAULT_INJECTION: forcing a failure. [ 651.699259][T15900] name failslab, interval 1, probability 0, space 10, times 0 [ 651.699297][T15900] CPU: 1 UID: 0 PID: 15900 Comm: syz.4.3358 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 651.699330][T15900] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 651.699339][T15900] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 651.699352][T15900] Call Trace: [ 651.699362][T15900] [ 651.699371][T15900] dump_stack_lvl+0xe8/0x150 [ 651.699408][T15900] should_fail_ex+0x3eb/0x540 [ 651.699441][T15900] ? __alloc_skb+0x1db/0x7a0 [ 651.699467][T15900] should_failslab+0xa8/0x100 [ 651.699491][T15900] ? __alloc_skb+0x1db/0x7a0 [ 651.699515][T15900] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 651.699546][T15900] ? __alloc_skb+0x18d/0x7a0 [ 651.699571][T15900] ? __alloc_skb+0x1db/0x7a0 [ 651.699604][T15900] __alloc_skb+0x1db/0x7a0 [ 651.699635][T15900] _sctp_make_chunk+0x59/0x290 [ 651.699686][T15900] sctp_make_datafrag_empty+0x12a/0x240 [ 651.699714][T15900] ? __kasan_kmalloc+0x93/0xb0 [ 651.699750][T15900] ? __pfx_sctp_make_datafrag_empty+0x10/0x10 [ 651.699777][T15900] ? sctp_datamsg_from_user+0x88/0xef0 [ 651.699800][T15900] ? sctp_datamsg_from_user+0x88/0xef0 [ 651.699824][T15900] ? sctp_auth_send_cid+0x69/0x250 [ 651.699853][T15900] sctp_datamsg_from_user+0x735/0xef0 [ 651.699897][T15900] sctp_sendmsg_to_asoc+0x10ad/0x1a20 [ 651.699944][T15900] ? __lock_sock+0x258/0x2c0 [ 651.699967][T15900] ? __pfx___lock_sock+0x10/0x10 [ 651.699984][T15900] ? do_raw_spin_lock+0x12b/0x2f0 [ 651.700014][T15900] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 651.700049][T15900] ? sctp_sendmsg+0xbb8/0x2d00 [ 651.700098][T15900] ? sctp_sendmsg_check_sflags+0x18a/0x330 [ 651.700137][T15900] sctp_sendmsg+0x1bb5/0x2d00 [ 651.700191][T15900] ? ktime_get+0x45/0x220 [ 651.700213][T15900] ? __pfx_sctp_sendmsg+0x10/0x10 [ 651.700245][T15900] ? ktime_get+0x45/0x220 [ 651.700268][T15900] ? seqcount_lockdep_reader_access+0xd4/0x100 [ 651.700294][T15900] ? ktime_get+0x1f5/0x220 [ 651.700331][T15900] ? aa_sock_msg_perm+0xf5/0x210 [ 651.700373][T15900] ? sock_rps_record_flow+0x19/0x350 [ 651.700400][T15900] ? inet_sendmsg+0x298/0x320 [ 651.700422][T15900] ? apparmor_socket_sendmsg+0x98/0x360 [ 651.700450][T15900] ? __pfx_inet_sendmsg+0x10/0x10 [ 651.700473][T15900] sock_sendmsg_nosec+0x10f/0x190 [ 651.700508][T15900] ____sys_sendmsg+0x54e/0x850 [ 651.700542][T15900] ? __pfx_____sys_sendmsg+0x10/0x10 [ 651.700578][T15900] ? import_iovec+0x73/0xa0 [ 651.700610][T15900] ___sys_sendmsg+0x2a5/0x360 [ 651.700635][T15900] ? __lock_acquire+0x747/0x2de0 [ 651.700660][T15900] ? __pfx____sys_sendmsg+0x10/0x10 [ 651.700725][T15900] ? __fget_files+0x3a2/0x420 [ 651.700754][T15900] ? __fget_files+0x2a/0x420 [ 651.700792][T15900] __sys_sendmmsg+0x273/0x4d0 [ 651.700825][T15900] ? __pfx___sys_sendmmsg+0x10/0x10 [ 651.700861][T15900] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 651.700903][T15900] ? ksys_write+0x242/0x270 [ 651.700937][T15900] ? __pfx_ksys_write+0x10/0x10 [ 651.700975][T15900] __x64_sys_sendmmsg+0xa0/0xc0 [ 651.701005][T15900] do_syscall_64+0x166/0x520 [ 651.701029][T15900] ? trace_irq_disable+0x3b/0x140 [ 651.701051][T15900] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.701073][T15900] ? clear_bhb_loop+0x70/0xc0 [ 651.701099][T15900] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.701120][T15900] RIP: 0033:0x7fcf1639e559 [ 651.701140][T15900] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 651.701158][T15900] RSP: 002b:00007fcf1731b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 651.701189][T15900] RAX: ffffffffffffffda RBX: 00007fcf16626090 RCX: 00007fcf1639e559 [ 651.701205][T15900] RDX: 0000000000000002 RSI: 00002000000001c0 RDI: 0000000000000003 [ 651.701218][T15900] RBP: 00007fcf1731b090 R08: 0000000000000000 R09: 0000000000000000 [ 651.701232][T15900] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 651.701244][T15900] R13: 00007fcf16626128 R14: 00007fcf16626090 R15: 00007ffc24e03c58 [ 651.701278][T15900] [ 652.024722][ T5702] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 652.164096][ T5702] usb 7-1: device descriptor read/64, error -71 [ 652.349871][ T10] usb 3-1: USB disconnect, device number 43 [ 652.349983][ C0] keyspan_remote 3-1:0.21: keyspan_irq_recv - usb_submit_urb failed with result: -19 [ 652.426324][ T5702] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 652.547673][T15905] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3361'. [ 652.561850][ T5702] usb 7-1: device descriptor read/64, error -71 [ 652.676005][ T5702] usb usb7-port1: attempt power cycle [ 653.021873][ T5702] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 653.045041][ T5702] usb 7-1: device descriptor read/8, error -71 [ 653.180076][T15923] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 653.180101][T15923] audit: out of memory in audit_log_start [ 653.291754][ T5702] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 653.316641][ T5702] usb 7-1: device descriptor read/8, error -71 [ 653.415455][T15932] CIFS: Attempting to mount //127.0.0.1/share [ 653.416322][T15932] CIFS: VFS: Error connecting to socket. Aborting operation. [ 653.416371][T15932] CIFS: VFS: cifs_mount failed w/return code = -101 [ 653.437413][ T5702] usb usb7-port1: unable to enumerate USB device [ 653.655170][T15935] FAULT_INJECTION: forcing a failure. [ 653.655170][T15935] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 653.655202][T15935] CPU: 0 UID: 0 PID: 15935 Comm: syz.4.3373 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 653.655230][T15935] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 653.655239][T15935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 653.655251][T15935] Call Trace: [ 653.655259][T15935] [ 653.655267][T15935] dump_stack_lvl+0xe8/0x150 [ 653.655298][T15935] should_fail_ex+0x3eb/0x540 [ 653.655328][T15935] _copy_from_user+0x2d/0xb0 [ 653.655356][T15935] video_usercopy+0x359/0x1430 [ 653.655409][T15935] ? __pfx___video_do_ioctl+0x10/0x10 [ 653.655441][T15935] ? __pfx_video_usercopy+0x10/0x10 [ 653.655495][T15935] ? __fget_files+0x2a/0x420 [ 653.655525][T15935] ? __fget_files+0x2a/0x420 [ 653.655556][T15935] v4l2_ioctl+0x18d/0x1e0 [ 653.655585][T15935] ? __pfx_v4l2_ioctl+0x10/0x10 [ 653.655613][T15935] __se_sys_ioctl+0xfc/0x170 [ 653.655638][T15935] do_syscall_64+0x166/0x520 [ 653.655662][T15935] ? trace_irq_disable+0x3b/0x140 [ 653.655685][T15935] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.655706][T15935] ? clear_bhb_loop+0x70/0xc0 [ 653.655732][T15935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.655752][T15935] RIP: 0033:0x7fcf1639e559 [ 653.655771][T15935] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 653.655790][T15935] RSP: 002b:00007fcf1733c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 653.655813][T15935] RAX: ffffffffffffffda RBX: 00007fcf16625fa0 RCX: 00007fcf1639e559 [ 653.655828][T15935] RDX: 00002000000000c0 RSI: 00000000c040565f RDI: 0000000000000003 [ 653.655842][T15935] RBP: 00007fcf1733c090 R08: 0000000000000000 R09: 0000000000000000 [ 653.655854][T15935] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 653.655867][T15935] R13: 00007fcf16626038 R14: 00007fcf16625fa0 R15: 00007ffc24e03c58 [ 653.655898][T15935] [ 653.930228][T15938] LUN: removable file: (no medium) [ 653.950687][ T33] audit: type=1800 audit(2000000129.340:97): pid=15937 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3374" name="file" dev="configfs" ino=80831 res=0 errno=-22 [ 653.979155][T15937] [ 653.981620][T15937] ====================================================== [ 653.988660][T15937] WARNING: possible circular locking dependency detected [ 653.995712][T15937] syzkaller #0 Tainted: G L Y [ 654.001794][T15937] ------------------------------------------------------ [ 654.008829][T15937] syz.2.3374/15937 is trying to acquire lock: [ 654.014911][T15937] ffff88805709aed0 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x7d0/0x1c10 [ 654.025556][T15937] [ 654.025556][T15937] but task is already holding lock: [ 654.032932][T15937] ffff88802ce54920 (&common->filesem){++++}-{4:4}, at: fsg_store_file+0x163/0x400 [ 654.042176][T15937] [ 654.042176][T15937] which lock already depends on the new lock. [ 654.042176][T15937] [ 654.052593][T15937] [ 654.052593][T15937] the existing dependency chain (in reverse order) is: [ 654.061642][T15937] [ 654.061642][T15937] -> #2 (&common->filesem){++++}-{4:4}: [ 654.069400][T15937] down_read+0x45/0x320 [ 654.074101][T15937] fsg_show_file+0x2d/0x140 [ 654.079158][T15937] configfs_read_iter+0x2b7/0x620 [ 654.084739][T15937] __kernel_read+0x4ca/0x960 [ 654.089904][T15937] integrity_kernel_read+0x89/0xd0 [ 654.095582][T15937] ima_calc_file_hash+0x451/0x890 [ 654.101168][T15937] ima_collect_measurement+0x51b/0xa00 [ 654.107185][T15937] process_measurement+0x1272/0x1c10 [ 654.113060][T15937] ima_file_check+0xdc/0x130 [ 654.118208][T15937] security_file_post_open+0xb3/0x260 [ 654.124137][T15937] path_openat+0x1748/0x20f0 [ 654.129287][T15937] do_file_open+0x23e/0x4a0 [ 654.134352][T15937] do_sys_openat2+0x115/0x200 [ 654.139592][T15937] __x64_sys_openat+0x138/0x170 [ 654.145006][T15937] do_syscall_64+0x166/0x520 [ 654.150158][T15937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.156597][T15937] [ 654.156597][T15937] -> #1 (&p->frag_sem){.+.+}-{4:4}: [ 654.164098][T15937] down_read+0x45/0x320 [ 654.168804][T15937] __configfs_open_file+0xd8/0x7d0 [ 654.174465][T15937] do_dentry_open+0x80e/0x1360 [ 654.179781][T15937] vfs_open+0x43/0x350 [ 654.184399][T15937] dentry_open+0x61/0xa0 [ 654.189203][T15937] ima_calc_file_hash+0x15f/0x890 [ 654.194788][T15937] ima_collect_measurement+0x51b/0xa00 [ 654.200797][T15937] process_measurement+0x1272/0x1c10 [ 654.206622][T15937] ima_file_check+0xdc/0x130 [ 654.211758][T15937] security_file_post_open+0xb3/0x260 [ 654.217688][T15937] path_openat+0x1748/0x20f0 [ 654.222829][T15937] do_file_open+0x23e/0x4a0 [ 654.227882][T15937] do_sys_openat2+0x115/0x200 [ 654.233114][T15937] __x64_sys_openat+0x138/0x170 [ 654.238519][T15937] do_syscall_64+0x166/0x520 [ 654.243657][T15937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.250139][T15937] [ 654.250139][T15937] -> #0 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 654.258762][T15937] __lock_acquire+0x164c/0x2de0 [ 654.264175][T15937] lock_acquire+0x115/0x350 [ 654.269221][T15937] __mutex_lock+0x197/0x15a0 [ 654.274355][T15937] process_measurement+0x7d0/0x1c10 [ 654.280128][T15937] ima_file_check+0xdc/0x130 [ 654.285269][T15937] security_file_post_open+0xb3/0x260 [ 654.291188][T15937] path_openat+0x1748/0x20f0 [ 654.296364][T15937] do_file_open+0x23e/0x4a0 [ 654.301422][T15937] filp_open+0x16d/0x1d0 [ 654.306227][T15937] fsg_lun_open+0x6c/0xdf0 [ 654.311194][T15937] fsg_store_file+0x19e/0x400 [ 654.316421][T15937] configfs_write_iter+0x337/0x430 [ 654.322082][T15937] vfs_write+0x612/0xba0 [ 654.326879][T15937] ksys_write+0x150/0x270 [ 654.331755][T15937] do_syscall_64+0x166/0x520 [ 654.336884][T15937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.343321][T15937] [ 654.343321][T15937] other info that might help us debug this: [ 654.343321][T15937] [ 654.353565][T15937] Chain exists of: [ 654.353565][T15937] &ima_iint_mutex_key[depth] --> &p->frag_sem --> &common->filesem [ 654.353565][T15937] [ 654.367454][T15937] Possible unsafe locking scenario: [ 654.367454][T15937] [ 654.374918][T15937] CPU0 CPU1 [ 654.380300][T15937] ---- ---- [ 654.385711][T15937] lock(&common->filesem); [ 654.390248][T15937] lock(&p->frag_sem); [ 654.396944][T15937] lock(&common->filesem); [ 654.403995][T15937] lock(&ima_iint_mutex_key[depth]); [ 654.409408][T15937] [ 654.409408][T15937] *** DEADLOCK *** [ 654.409408][T15937] [ 654.417589][T15937] locks held by syz.2.3374/15937: 5, last CPU#0: [ 654.423932][T15937] #0: ffff888031a73cf0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 654.433035][T15937] #1: ffff88801efea460 (sb_writers#15){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 654.442045][T15937] #2: ffff888033db4080 (&buffer->mutex){+.+.}-{4:4}, at: configfs_write_iter+0x7e/0x430 [ 654.451920][T15937] #3: ffff888033503270 (&p->frag_sem){.+.+}-{4:4}, at: configfs_write_iter+0x238/0x430 [ 654.461713][T15937] #4: ffff88802ce54920 (&common->filesem){++++}-{4:4}, at: fsg_store_file+0x163/0x400 [ 654.471438][T15937] [ 654.471438][T15937] stack backtrace: [ 654.477348][T15937] CPU: 0 UID: 0 PID: 15937 Comm: syz.2.3374 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 654.488391][T15937] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 654.494236][T15937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 654.504306][T15937] Call Trace: [ 654.507606][T15937] [ 654.510562][T15937] dump_stack_lvl+0xe8/0x150 [ 654.515190][T15937] print_circular_bug+0x2e2/0x300 [ 654.520264][T15937] check_noncircular+0x12f/0x150 [ 654.525245][T15937] __lock_acquire+0x164c/0x2de0 [ 654.530130][T15937] ? ktime_get+0x45/0x220 [ 654.534495][T15937] ? seqcount_lockdep_reader_access+0xd4/0x100 [ 654.540715][T15937] ? ktime_get+0x1f5/0x220 [ 654.545158][T15937] ? lapic_next_event+0x11/0x20 [ 654.550027][T15937] ? clockevents_program_event+0x491/0x630 [ 654.555902][T15937] ? __pfx_clockevents_program_event+0x10/0x10 [ 654.562102][T15937] lock_acquire+0x115/0x350 [ 654.566625][T15937] ? process_measurement+0x7d0/0x1c10 [ 654.572030][T15937] __mutex_lock+0x197/0x15a0 [ 654.576648][T15937] ? process_measurement+0x7d0/0x1c10 [ 654.582046][T15937] ? process_measurement+0x7d0/0x1c10 [ 654.587440][T15937] ? __pfx___mutex_lock+0x10/0x10 [ 654.592502][T15937] ? ima_inode_get+0xcb/0x4d0 [ 654.597233][T15937] process_measurement+0x7d0/0x1c10 [ 654.602461][T15937] ? kasan_quarantine_put+0xbb/0x1f0 [ 654.607780][T15937] ? __pfx_process_measurement+0x10/0x10 [ 654.613452][T15937] ? tomoyo_check_open_permission+0x38e/0x470 [ 654.619576][T15937] ? apparmor_file_open+0x523/0x6c0 [ 654.624830][T15937] ima_file_check+0xdc/0x130 [ 654.629450][T15937] ? do_dentry_open+0xcf9/0x1360 [ 654.634530][T15937] ? __pfx_ima_file_check+0x10/0x10 [ 654.639805][T15937] security_file_post_open+0xb3/0x260 [ 654.645227][T15937] path_openat+0x1748/0x20f0 [ 654.649846][T15937] do_file_open+0x23e/0x4a0 [ 654.654377][T15937] ? __pfx_do_file_open+0x10/0x10 [ 654.659506][T15937] ? do_getname_kernel+0x54/0x230 [ 654.664559][T15937] ? do_getname_kernel+0x97/0x230 [ 654.669612][T15937] ? __asan_memcpy+0x40/0x70 [ 654.674237][T15937] filp_open+0x16d/0x1d0 [ 654.678513][T15937] ? __pfx_filp_open+0x10/0x10 [ 654.683313][T15937] ? lock_acquire+0x232/0x350 [ 654.688031][T15937] fsg_lun_open+0x6c/0xdf0 [ 654.692493][T15937] fsg_store_file+0x19e/0x400 [ 654.697211][T15937] ? __pfx_fsg_lun_opts_file_store+0x10/0x10 [ 654.703259][T15937] configfs_write_iter+0x337/0x430 [ 654.708414][T15937] vfs_write+0x612/0xba0 [ 654.712721][T15937] ? __pfx_vfs_write+0x10/0x10 [ 654.717527][T15937] ? __fget_files+0x3a2/0x420 [ 654.722236][T15937] ? __fget_files+0x2a/0x420 [ 654.726864][T15937] ? fdget+0x1ac/0x250 [ 654.730974][T15937] ksys_write+0x150/0x270 [ 654.735344][T15937] ? __pfx_ksys_write+0x10/0x10 [ 654.740262][T15937] do_syscall_64+0x166/0x520 [ 654.744886][T15937] ? trace_irq_disable+0x3b/0x140 [ 654.749937][T15937] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.756027][T15937] ? clear_bhb_loop+0x70/0xc0 [ 654.760740][T15937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.766661][T15937] RIP: 0033:0x7fbdf939e559 [ 654.771104][T15937] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 654.790737][T15937] RSP: 002b:00007fbdfa320028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 654.799185][T15937] RAX: ffffffffffffffda RBX: 00007fbdf9625fa0 RCX: 00007fbdf939e559 [ 654.807192][T15937] RDX: 0000000000000005 RSI: 00002000000003c0 RDI: 0000000000000004 [ 654.815191][T15937] RBP: 00007fbdf94358b0 R08: 0000000000000000 R09: 0000000000000000 [ 654.823190][T15937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 654.831199][T15937] R13: 00007fbdf9626038 R14: 00007fbdf9625fa0 R15: 00007ffeab957f88 [ 654.839213][T15937]