last executing test programs: 3m9.882974733s ago: executing program 3 (id=734): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @broadcast}}}, 0x0, 0x0, 0xc, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4e1d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) mkdir(&(0x7f0000000200)='./file0\x00', 0x28e08a7aa33ba155) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, 0x0, 0x0) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, &(0x7f0000000040)=0xc) close(r3) 3m8.409681782s ago: executing program 3 (id=738): sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000480)=[0x0], 0x1}) r5 = socket(0x40000000015, 0x5, 0x0) connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r5, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) bind$inet(r5, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x40) ioctl$SIOCGETVIFCNT(r5, 0x89e0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r3, 0xc02064b9, &(0x7f0000000400)={&(0x7f0000000380)=[0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1, r4, 0xcccccccc}) ioctl$DRM_IOCTL_MODE_ATOMIC(r3, 0xc03864bc, &(0x7f0000000580)={0x200, 0x6, &(0x7f0000000240)=[r4, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x800, 0x1, 0xff, 0x10000, 0x0, 0xa6b, 0xe, 0x4], &(0x7f00000004c0)=[0x0, r6, 0x0], 0x0, 0x0, 0x6}) r7 = syz_genetlink_get_family_id$tipc(0x0, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000640)={0x30, r7, 0x100, 0x70bd28, 0x25dfdbff, {{}, {}, {0x14, 0x17, {0x1c, 0xfffffaf7, @l2={'ib', 0x3a, 'wg2\x00'}}}}, ["", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x44050}, 0x4000880) 3m7.123901648s ago: executing program 3 (id=743): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xa4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000800)="cc5a4dbac0affd0a979c63ea8352d608a51fc8625318716ddf62b7752be4540c4ac7d344c53a3ad28313abc2437b60b03c0e587cafcf9a435bf90c618351f70a828238fdf90bc5d36c7d614b82552649954e0185662defd28f78449f073bad544f586136c5076a6f0f1b6fc9adf80557eb44db1b41824e9ef104c95e999766bbf27d74ad5d8fa63210cde65d384dd3e87c1fedaec3144d1ee66a0eb0750363e346cb930dae6109df6b9955bf8af119b5c9a86622af4ff8b5949fb90f8edbde416d046d61512fe4c453bb601a780e1bbc00dbedc5e50d3cd9bc920810eaefd5f9a171e9d32ab46b42e3e78c60087318bab42e94653cbdd600fba37c5a31d095500e91d02256f101e82447e34733220cdaaabc947f5b815080b5214c94a06fe96450ea42f48006c032b24d9e8d722841b7c7244b1d2cc012fcda1f7472fdbabb673ef862e32b359fad715b3f5cef6ef951abab80a4a0f5f8574395c5820fa25d07a119e23b39a87cb3b763fbfb0493121eec3e05eacbe7835e79e74881d1179013622a2a6421d51c974e6abd48a9882c8fcadbcee369346a9ad948fd5dd8f87496a30a9d888cdbcee8f3592dd69165358c4cd474639fc13300317b7fed115fb9818b20d177a39157101dbd8e23bc9ed32efed96c410a103d35336fb4ee4000bfb3d32b0181ff3d726a7dc6432a336a42b50b2c6877cb63b410d746b35fc721e5992ba47c3a2bc2d3679abe0794d226b7b0c333c3000fee7adaafb6efd57382eb2a86d71acaae52a154477a5b66757a886f4ad5446607520c17fb81ede0473cd897a34c7c9f41b653d568e4e1c457b0fc90554ed6798d3b8f3fb82578", 0x25b}, {&(0x7f0000000300)="17e37d3e106d9beae191613d45501cb6a8d8eaeb96ee68b2d800ad34b8c528b97ead9f051e427e309b714d3d12d8d4010c04a27e6c586b3956f0dfc7086e9550bd651b9e019d7b671b231c7a8cbfd52bea572b327362fd4db8e4a162096a0464fd2529fc31f79947d137520a8823ae6f0c068c299db997db4d44cfd7657ea53a691a386f018286b4dbe415596964ab56a9c0d7280e592ad174e737a4e5e4cd5600", 0xa1}], 0x2}}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000640)="985e", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000002040)=[{&(0x7f0000001b00)="c779a881400f168b3cd3b9dcb8505d626656e6b4f5441fb27838fa6f26bfe21f20605b23fffe6978fe6148e25caa0c0f9b6e4434877b8978a5caa4c641dfe5b407dd88d709f6c3aaf2eb6d966f38806c79f63870496f06f64302d7f1292499f44695", 0x62}, {&(0x7f0000000540)="6f433f8987fc9e72c982b56a37a1c7b7ab31e2f6b098f57a62f9d8a98a9d4f71997d1cd449c76702", 0x28}, {&(0x7f00000005c0)="8e26189d110469a886116da338167241f58b9e3a3d25fef3424da95dfc37a21add3be660fabda17c87a232ecdbee49495e0b9249d65983123d5a84", 0x3b}, {&(0x7f0000001d00)="45a4cdaed78e8aae62776ab5e19dab8363b642daf5ce06da88ce31cbf434c7758737d1610707c1be62e5680748b3b645a25af50508b344b621146721fc4a9657fd77ad93f48d94a70de115016171efb302adb61ee81ba5e41965e62716beb2de6762170181690f54affcfe75a8ee1e4348200bb9a469bfd1e8fd0488b873af6f20dcddf377fc36d314eccd27e8bf", 0x8e}, {&(0x7f0000001dc0)="4423c554c1d89dfdb98e09e6c7cac32762158fa3479da58104548fdcc7ef57389b9f63250592f4cc92cc344e1b3cd46446f8d4481699666b5f9e6e2b8a82c435ed400d40d67f1e3cf3931905f34b74e7cadf145de53d91ecb305560836557a01a67cc87c52ae248f04c2ec28", 0x6c}, {&(0x7f0000001e80)="ec1d60ccbe85510cec58bd3786a575b46de8fd547ade80f426f7e4f4278fc924d53d9073acf8247cf722ba4e9c7bfb1ba70b921b3bd3b1e061033204d9629d417ea1d834bc2539294611e3b6e5abf5c3eb10dc92cbaae7e80dd65084164afde069218042d5d2d8e256856c0bd1e7568574b80c4d5e51bf8604a10fe5f3f69a0a794905f74f75f189780c86ace348c270b3a346061d7f669d723871fb66d409e497ac801c6c725d70fb90fb22896b2481ac520c5d10", 0xb5}], 0x6}}], 0x3, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="04", 0x1, 0x10008095, 0x0, 0x0) 3m6.379064071s ago: executing program 3 (id=745): r0 = socket(0x2, 0x2, 0x1) bind$unix(r0, &(0x7f0000000000)=@abs, 0x6e) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="201006000000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = add_key$keyring(&(0x7f0000000400), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, 0x0, 0x0) r3 = add_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000380)="d8", 0x1, r3) keyctl$search(0xa, r3, 0x0, &(0x7f0000000180)={'syz', 0x3}, r2) syz_usb_control_io$lan78xx(r1, &(0x7f0000000200)={0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="4023f9000000f90ecbac57cef3de272df1a1728078b30dd8fff93e3ec2641299d39e7923d5dd94995700ae4a3debbab9a9f6fdbae42e907d60d5d28b1157b483a83cab31642fec985e485e7b72be35bfeda15b7d816621b4fb2a8c675018c0db60473c7721820f8383b15779975b19529ef9c6a08701076ef6c5d7b046e22d97b84c1944a0b1b80a00b8858854e251a554d4b110c553729914cdab0ef6f6bf04dc60e2f4374e2a17ae45839afa159603dff6aa725137da8392ec957b4fdb3df903b2c26214eecd79de4729ca6ef51c7a06a12b46d082ff1df86a536c924607b011dec5d2af3842b3b581fde0ee081fd6fb0a192a92106ae7efb31176e6aeab"], &(0x7f0000000100)=ANY=[@ANYBLOB="0003041940"]}, &(0x7f00000004c0)={0x34, &(0x7f00000002c0)={0x0, 0x11, 0xf6, "f4f8c7197916c430e9a890a4c3ed121d1f3b9fd0674a406f391ca33153c0d6122ea766f9f4d0988b5cb5df8f31ed4ee386d0c82a9dac009912af033a10acbf724d0d9b28b311df3c0517e2704b5d5789a5c42b1b9af1cd02c59b7065e40e8c53378046c222bf4d2c1f1a8208328f72bcb886e12800bcc61d3b2baf883811fc30acd1a5de1ca702b97ac0a052f1d2d96ed22f8af85b762c6d6c44af741bc8b0f33daa709cc4f1d2020dd24020f679d20e3ddf6d8919e33e620cbf7ac4dd690099ef04f35193f9a7eb7455e126605e483fadbf11d93f82d655a47e9616c4f44240a883743518316106805a8f4e454a472e27ffa275021d"}, &(0x7f0000000240)={0x0, 0xa, 0x1, 0xa}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000400)={0xc0, 0xa1, 0x4, 0x5}, &(0x7f0000000440)={0x40, 0xa0, 0x4, 0xfff}, &(0x7f0000000480)={0xc0, 0xa2, 0x2f, "896ed45bce9a7e4d4b2ba61b63ab709572340b394aea2f9d7d094eb90694ec7deabc6b9f9b1fbc26e141b6933e1fa2"}}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x400) ioctl$DRM_IOCTL_WAIT_VBLANK(r4, 0xc018643a, &(0x7f0000000040)={0x1, 0x0, 0x2}) syz_usb_disconnect(r1) r5 = socket$tipc(0x1e, 0x4, 0x0) r6 = syz_open_dev$evdev(&(0x7f00000002c0), 0x2, 0x8000) ioctl$EVIOCGPHYS(r6, 0x80404507, &(0x7f0000000300)=""/115) bind$tipc(r5, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) r7 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r7, &(0x7f0000000240)={&(0x7f00000001c0)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1000a8d0}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_open_dev$video(&(0x7f0000000000), 0x7, 0x40440) r8 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r8, 0xc0285700, &(0x7f0000000100)={0x1, "fa02c800"}) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000280)={0x1, &(0x7f0000000380)=[{0x4, 0x7d, 0xfd, 0x7fffffff}]}) r10 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r10, 0xc0184800, &(0x7f0000000100)={0x4, r9}) ioctl$DMA_BUF_SET_NAME_A(r11, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x83, 0x2, 0x3, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x20003, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x6, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2, 0xfffffffc, 0x5, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0xfffff575, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x6, 0x47, 0x6, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0x2, 0x2, 0x400003, 0x20000008, 0x4, 0x6d01, 0x6, 0x7, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x200807ff, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x4, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x4184, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) 3m0.945152606s ago: executing program 3 (id=756): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x9, [@enum64={0x4, 0x2, 0x0, 0x13, 0x1, 0x1, [{0x7, 0x1, 0x7fffffff}, {0x1, 0x10002, 0x5}]}]}, {0x0, [0x61, 0x5f, 0x5f, 0x2e, 0x5f, 0x5f, 0x5f]}}, &(0x7f0000000f40)=""/4089, 0x45, 0xff9, 0x9}, 0x28) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000480)=[0x0], 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x40) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000640)={0x30, 0x0, 0x100, 0x70bd28, 0x25dfdbff, {{}, {}, {0x14, 0x17, {0x1c, 0xfffffaf7, @l2={'ib', 0x3a, 'wg2\x00'}}}}, ["", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x44050}, 0x4000880) 2m59.119552775s ago: executing program 3 (id=758): socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$unix(0x1, 0x2, 0x0) bind$unix(r4, &(0x7f0000000000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r4, 0x0, 0x0) 2m48.248196138s ago: executing program 2 (id=776): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x28e08a7aa33ba155) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, 0x0, 0x0) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f00000001c0)) 2m44.546360085s ago: executing program 2 (id=779): socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x10, 0x3, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x2, 0x1, 0x3, 0x2}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x5, 0x4, 0x6, 0x23, 0x0, 0x1, 0x3}, 0x50) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000200)={0x7}, 0x8) socket$nl_route(0x10, 0x3, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r0, @ANYBLOB="05"], 0x0) 2m43.751427922s ago: executing program 32 (id=758): socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$unix(0x1, 0x2, 0x0) bind$unix(r4, &(0x7f0000000000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r4, 0x0, 0x0) 2m42.980918853s ago: executing program 2 (id=783): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @broadcast}}}, 0x0, 0x0, 0xc, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4e1d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) mkdir(&(0x7f0000000200)='./file0\x00', 0x28e08a7aa33ba155) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, 0x0, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r5, 0xc0045006, &(0x7f0000000040)=0xc) close(r5) 2m41.317243187s ago: executing program 2 (id=784): sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000a40)={0x3c, 0x0, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_LEVEL={0x1c, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x1}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x971, 0x1c080, 0x0, 0x44a}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r1 = userfaultfd(0x80001) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000ff4000/0x8000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x8000, 0x3}) r2 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001680)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0xc, &(0x7f0000001700)={[{0x8, 0x4e00, "99797757a4f1a344"}]}) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2m27.086660576s ago: executing program 2 (id=789): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='freezer.self_freezing\x00', 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000003b810000850000007d000000850000005000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000100)='sys_exit\x00', r2, 0x0, 0xfffffffffffffffd}, 0x18) preadv2(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 2m27.08117187s ago: executing program 2 (id=792): munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB='\n\x00\x00\x00\v\x00\x00\x00B\x00\x00\x00>'], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000180)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r1, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0x200000000000009d, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES16=r2, @ANYRES16], &(0x7f0000000240)='GPL\x00', 0x4, 0x1005, &(0x7f00000014c0)=""/4101, 0x0, 0xc}, 0x94) madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x16) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.swap.current\x00', 0x26e1, 0x0) close(r5) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x5, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000000400000000000000000003850000002c000000850000002300000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x10, 0x1500}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sync() r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="4400000000010505000000000000000002000000300002802c000180060003"], 0x44}}, 0x0) r7 = fsopen(&(0x7f0000000280)='proc\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r7, 0x0, &(0x7f0000000000)='ro\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x0, 0x1) fsconfig$FSCONFIG_CMD_RECONFIGURE(r7, 0x7, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$unix(r9, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000340)={0x73622a85, 0x108a}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) recvmsg(r10, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000011c0)={r5, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000001240)="b9ff03076804268c989e14f088a8", 0x0, 0x4068, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r12 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r12, &(0x7f0000001780)={&(0x7f0000000400)={0xa, 0x4e21, 0x800009, @local, 0x1}, 0x1c, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC=r8, @ANYRESHEX=r4, @ANYRESDEC=r10, @ANYRES8=r7, @ANYRES8], 0x7}, 0x8010) syz_open_procfs(0x0, &(0x7f0000000000)='smaps_rollup\x00') 2m21.989362633s ago: executing program 33 (id=792): munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB='\n\x00\x00\x00\v\x00\x00\x00B\x00\x00\x00>'], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000180)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r1, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0x200000000000009d, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES16=r2, @ANYRES16], &(0x7f0000000240)='GPL\x00', 0x4, 0x1005, &(0x7f00000014c0)=""/4101, 0x0, 0xc}, 0x94) madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x16) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.swap.current\x00', 0x26e1, 0x0) close(r5) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x5, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000000400000000000000000003850000002c000000850000002300000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x10, 0x1500}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sync() r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="4400000000010505000000000000000002000000300002802c000180060003"], 0x44}}, 0x0) r7 = fsopen(&(0x7f0000000280)='proc\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r7, 0x0, &(0x7f0000000000)='ro\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x0, 0x1) fsconfig$FSCONFIG_CMD_RECONFIGURE(r7, 0x7, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$unix(r9, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000340)={0x73622a85, 0x108a}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) recvmsg(r10, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000011c0)={r5, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000001240)="b9ff03076804268c989e14f088a8", 0x0, 0x4068, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r12 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r12, &(0x7f0000001780)={&(0x7f0000000400)={0xa, 0x4e21, 0x800009, @local, 0x1}, 0x1c, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC=r8, @ANYRESHEX=r4, @ANYRESDEC=r10, @ANYRES8=r7, @ANYRES8], 0x7}, 0x8010) syz_open_procfs(0x0, &(0x7f0000000000)='smaps_rollup\x00') 21.05086838s ago: executing program 1 (id=1146): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)={0x0, 0x0}) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/mem_sleep', 0xa0502, 0x49) io_setup(0x1, &(0x7f00000016c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000140)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x8, r2, &(0x7f0000000180)="282fa8c2", 0x4, 0x80000005}]) sched_setscheduler(r1, 0x1, &(0x7f0000000080)=0x8) getsockopt$inet_buf(r0, 0x118, 0x1, 0x0, 0x0) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r5, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) bind$tipc(r5, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r6 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$PNPIPE_INITSTATE(r6, 0x113, 0x4, 0x0, &(0x7f0000000100)) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) r7 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r7, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) syz_usb_connect(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000077f1c910720c0c0059f6010203010902240001000000000904000002d31a3a00090501"], 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={0x0, r8, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) fsopen(0x0, 0x0) getpid() openat$cuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) 18.111576928s ago: executing program 1 (id=1156): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x28e08a7aa33ba155) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, 0x0, 0x0) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, &(0x7f0000000040)=0xc) close(r3) 15.716963743s ago: executing program 1 (id=1159): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) sendmmsg$inet6(r0, &(0x7f0000001880)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0xffff0001, @local, 0x3}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000040)="abef72634fb52384d5f4a306ac1d1389e652659a643b107740fa533b9322d2047be9a69fa4b43bae7ea4765647694c540737c0ca1b5fa0c28e83b033e24b93931324641e1e391956c09d19e11a188f59b9ce0a84e0", 0x55}], 0x1, &(0x7f0000000100)}}, {{&(0x7f0000000140)={0xa, 0x4e21, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}, 0x2000}, 0x1c, &(0x7f0000000280)=[{&(0x7f0000000180)="fe87c665587189aacde92b2b0cab7e9ffc71b038df1a786b7594010a7037ba5e9d413c1737939d63", 0x28}], 0x1, &(0x7f0000001a80)=ANY=[@ANYBLOB="200000000000000029000000370000000100000000000000040102000000000024000000000000002900000032000000fe880000000000000000000000000001", @ANYRES32, @ANYBLOB="00000000140000000000000029000000340000f3020000000000000014000000000000f4280000000b000000000000060000000024000000000000002900000032000000fe8800001b000000000000000000000101", @ANYRES32, @ANYBLOB="0000000070000000000000002900000004000000870a0000000000007126324a41765de60fb8ce9c8411c3a95dbd87401d49bbe213c13d2e2cdca334cb5da1f348d0cc36c910fe8000000000000000000000000000bb0502000707100000000202f001804044310c0300000000010000000000001400000000000000290000000800000000000000000000001400000000000000290000000b0000000000010100000000"], 0x140}}, {{&(0x7f0000000500)={0xa, 0x4e20, 0x9, @private0, 0x4}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000540)="da995a6f024cec7378cd45e2fb3491bce65e16", 0x13}], 0x1, &(0x7f00000005c0)=[@pktinfo={{0x24, 0x29, 0x32, {@remote}}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @dstopts={{0x60, 0x29, 0x37, {0x29, 0x8, '\x00', [@jumbo={0xc2, 0x4, 0x7fff}, @calipso={0x7, 0x30, {0x3, 0xa, 0xf2, 0x0, [0x7, 0x0, 0x0, 0x7fffffff80, 0x927]}}, @ra={0x5, 0x2, 0x2}, @jumbo={0xc2, 0x4, 0x3}]}}}, @rthdr_2292={{0x38, 0x29, 0x39, {0x0, 0x4, 0x0, 0x9, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private1]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x10}}, @hopopts={{0x20, 0x29, 0x36, {0x2b, 0x0, '\x00', [@ra={0x5, 0x2, 0x3}]}}}], 0x110}}, {{&(0x7f0000000700)={0xa, 0x4e24, 0xe0, @mcast1, 0xffffffff}, 0x1c, &(0x7f0000000a40)=[{&(0x7f0000000740)="317b3bd7cbe70fe2548c277511a9ffe5ad3b805919e40b2a3cbeed1dc98d33d49e1cdf5ec59d106c9cad26cb0d7d61e932569805cbff0a6d9fba4e08ee7cf0df093f3714884ba07a5f2b69f94b32d3319e298394c01458536a9d76d4e94ba3bc725d68662b12daff60a8be56fd4d0f5a24b0bcd09d27a1b1d81f2c68f917e935093d2d21b78d2a77a439eac3c681c6badbbf03b62f5f30bfdf2571c0c55bab25365d3ed7cc828babee3a1c4198af19897b4dd530934b02fe6ffacc9bb9e3cacd217850b616338900645a12", 0xcb}, {&(0x7f0000000840)="c93c5a6ff19aaa30b094d29d8f9ee63edfc30d4a88a7527ea3d5b13ed678400136cc051f1835a333d47f49fc46f241c8fdfb631c3870b766e3e946c44c99b495004b150af29583038e493962ba4c7d334296de4c8a2f2c0814e985a60dd98ba70a03e4943025009fb049700d45b657a54645fdf9b1662aed54a6608f4efc09e065d8a67c39b16e721e0c22626f48deaa8aa1c489694e3db3e213214b2dada25a7f1fe7cde4afa15ebe9e2ef5362f5f55511f661afb14850e5d20107750c37ad52c0280cf0c1c5aa10e5c7e882761e950bc3d496c3c3520ba781b05039513ded35bd129960d374b2c4f42ba0ae7b4a7c99b810e5d74ad02", 0xf7}, {&(0x7f0000000940)="fcf4", 0x2}, {&(0x7f0000000980)="9ad43893cf646353959da3b8a0ca9b8914c02eb086cd55ec7a81022998e21ef9a57cea9543bb171168446b4063ba10f2232971f17bee7701558d9b47035a67b9e76bbd504dc83d2356660e6d2921eafe06eb75c8ffd827f2b37a0c2eb9f39a26a18ecedb92886f256d5bdd6c4f611dd1432ac6c733f7b79bbd49b603501b92871f858902c092d4f1a41ad33cc5e6f5c1fcac9754e25305987d54739849d881f1dd8f38dc45e2823248dd1ed20f68f73ad62f1d3b", 0xb4}], 0x4, &(0x7f0000000b40)=[@hopopts_2292={{0x40, 0x29, 0x36, {0x88, 0x5, '\x00', [@ra={0x5, 0x2, 0x6}, @hao={0xc9, 0x10, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @hao={0xc9, 0x10, @local}]}}}, @hoplimit={{0x14, 0x29, 0x34, 0xc0e}}, @hopopts_2292={{0x28, 0x29, 0x36, {0x32, 0x1, '\x00', [@ra, @pad1, @padn={0x1, 0x2, [0x0, 0x0]}]}}}, @pktinfo={{0x24, 0x29, 0x32, {@mcast2}}}, @dstopts={{0x28, 0x29, 0x37, {0x5e, 0x2, '\x00', [@jumbo={0xc2, 0x4, 0x6}, @ra={0x5, 0x2, 0x7}, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}]}}}], 0xd0}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000c40)="a5bfc7ac82c30353fd96149f144b84b58d35a004de71ac56ca69801acce1c84345e4ba998357a3484caabe58dad905659c186439daedc9420c1c43c8a21e071030e5e0689aea6f3c92b34a435d5a851be9a63a30493bd48d6197885f9b8ac247c1a14777d70827c68ed5539656b434736e8567750f8a473263c4dfe9f39e45d913b16ced2c49fdfb3b68920a18e8f3063d7d28654ab36836dc8b295b891fa5435bb27c69510787073dd0f730", 0xac}, {&(0x7f0000000d00)="5e47e4d01b3eb02c8c302ee6287ad9dfa1789b13429d9808c459a521a8bf39", 0x1f}], 0x2, &(0x7f0000000e40)=[@hoplimit={{0x14, 0x29, 0x34, 0x10}}, @hopopts={{0x38, 0x29, 0x36, {0xff, 0x3, '\x00', [@pad1, @generic={0xda, 0x4, "054de2d9"}, @hao={0xc9, 0x10, @remote}]}}}, @hoplimit={{0x14, 0x29, 0x34, 0x4}}, @pktinfo={{0x24, 0x29, 0x32, {@private2}}}, @rthdr={{0xa8, 0x29, 0x39, {0x3a, 0x12, 0x0, 0x7, 0x0, [@mcast2, @private2, @empty, @private1, @private1, @private2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, @loopback]}}}, @hoplimit={{0x14, 0x29, 0x34, 0x1}}, @tclass={{0x14, 0x29, 0x43, 0xff1}}], 0x168}}, {{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000fc0)="3c983d068101ce5cfaa087a878213dad583a8cc7534d878d4a5e3f97de635008fddc3fc7bd8f4f636310ae6665558079d74c88faf3f3439c2fa0118ab22c41033ce30991174547d86d62734c77990a6435f5e5092733d6c610f0ba3c3c0eb80ca2a588458f548cdf99cb479d711402401bbf8531464a53151027794e8eb0f27efe31094db5f5d580502eb2cfc638f4af3fe5a70aafc3a23739ce0d3d3555f64b0837cdfb5c14e75664dae0142913c772ed37ca58571b6c4375a1983521fe81fa54780c3b4cea01f56b4c7b", 0xcb}, {&(0x7f00000010c0)="26e5bc1bca5afdc50dd3cfdeb3a0a3c7c15ddf1bb239e9c565bff241e27bc81bc248f9f181af430df82624674acfe07f17535823432e58372b7c30d4fa010eaadfcd8ddedfb5de892995ead0f41dfe2d55b01bde", 0x54}, {&(0x7f0000001140)="dd94b9f10f3d298b7da9291baf482cf3068c4a9ecba3b87f4d4887b65474ee44a75c7979bbca6d14d2d1855eef5f72e21ecd4e163d5aa3ac94b969ab19c50147d75f63f63fd7e3b615ed5a843db9cae3275c51393fedf05daa68d8caf5ec65e5677d18c81b9b6625ddb693cfacb3e79872f5b00c1a32b71da81283c7480f916767f1da769d8cbc74b1296c41518dd8620ffec624a167f261456f552df06b3e07ca99729366b76f89d01e3d43b0131092c0f85104d781974a66f71dd989cedae0fb9eb345b36b8ff1231db257bfef2d842cf79a426318", 0xd6}, {&(0x7f0000001240)="643a4ba5c6da19328503abbb74fccc25465abe8f91bc83f8d90e78bc8d6d5eb02017de4e584d20690b5d8b3399e2d9f77058ff1cec799d52c3b958a4353ae4c346b4ca63586cb5dd9940492b4ec84bb7bcc58fb4647145337698eb1b2ee98b9a9e0e1d9cf6e074b17bc7ef9de6d3c5e94111a338e0184fce65aac136d7b547061eea36c4057659338abf61e7a652", 0x8e}], 0x4, &(0x7f0000001340)}}, {{&(0x7f0000000100)={0xa, 0x4e20, 0x1, @mcast1, 0x80a}, 0x1c, &(0x7f0000001440)=[{&(0x7f00000013c0)="a951280d4778ad5136c53e2d02cb31d9c8ca2dbdcc12c9961c2ceeef97926c3fd80763858a14b322b1895bdfaa9a0db5451f7c4f1d6f4dfdc80668414880b7a647cf3f15360281937d9e8332d88252f1a1e5e86f25e925bb4b426b835b7523784149fd01517215", 0x67}], 0x1, &(0x7f0000001480)=[@rthdrdstopts={{0x48, 0x29, 0x37, {0x16, 0x5, '\x00', [@ra={0x5, 0x2, 0x8000}, @ra={0x5, 0x2, 0x2e3}, @pad1, @pad1, @hao={0xc9, 0x10, @dev={0xfe, 0x80, '\x00', 0x19}}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @jumbo]}}}, @rthdr_2292={{0x48, 0x29, 0x39, {0x44, 0x6, 0x0, 0x1, 0x0, [@dev={0xfe, 0x80, '\x00', 0x10}, @loopback, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @tclass={{0x14, 0x29, 0x43, 0x400}}, @hopopts={{0xa8, 0x29, 0x36, {0x8, 0x11, '\x00', [@enc_lim={0x4, 0x1, 0xb}, @hao={0xc9, 0x10, @loopback}, @enc_lim={0x4, 0x1, 0x9d}, @enc_lim={0x4, 0x1, 0xd}, @padn={0x1, 0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @generic={0xa, 0x41, "3488b4a17d698247ba2064ec3ee3d64c20e9fa2e61a06e24133e0a91b8603eae990e25a22341a2158fdeb887420acb937a43883f28d77f5c9c83703c507f011807"}, @pad1, @hao={0xc9, 0x10, @remote}, @calipso={0x7, 0x8, {0x2, 0x0, 0x7, 0x8}}, @pad1]}}}, @rthdrdstopts={{0x18}}], 0x168}}, {{&(0x7f0000001600)={0xa, 0x4e24, 0xf, @dev={0xfe, 0x80, '\x00', 0x25}, 0x101}, 0x1c, &(0x7f0000001800)=[{&(0x7f0000001640)="2e42de5406e78ff809625bb37b66198b644ae6db5d9f9ed6f21bdc8aac79b8a1706601838951b1e2828ea7cec560c74dac0f62dfda02359d55191370568dbae157e66c262bceffb0b0791c90c7558dbdc9a4", 0x52}, {&(0x7f00000016c0)="b5827e2863f9537bedb4824579464a723d75fbd29931c595dc70739979dcbfd809ba9de0fbef3a432579a5fb9df2eba5d71627c654d9cdebdd5c53f48ff90a8768fe4d8d98976cd355be730adbd9b7c1d264c11dff8741e9fd7f1c35f14157fd6873cf635918", 0x66}, {&(0x7f0000001740)="fca3be060f42ecadce48a10f7dd1a27aa7b161a36fe271301db32b816c83064103c986f807ec6177865f2ccdca5cc0ebfc2a3b8ad048d93a119129db4fd7d99410db67790d922a0c4ad8c4143cb51e3c0d4367e26490dd61c739931717a1d2f7b636fab148afe1c6e0e756aac2235aeb8fefa4f2fa7e210d848964d57f49b4add0ec37d2caae2145859113789154b9538e0c536ce58a", 0x96}], 0x3, &(0x7f0000001840)=[@pktinfo={{0x24, 0x29, 0x32, {@empty}}}], 0x28}}], 0x8, 0x4000080) 15.359247389s ago: executing program 1 (id=1162): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x7c7, 0x3, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x86, 0x4, 0x0, @loopback, @local}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f3, &(0x7f0000000080)={'syztnl0\x00', &(0x7f0000000000)={'erspan0\x00', 0x0, 0x80, 0x20, 0x4000000, 0x2, {{0x5, 0x4, 0x0, 0x16, 0x14, 0x0, 0x0, 0x3, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x32}, @multicast2}}}}) 15.184720552s ago: executing program 1 (id=1163): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000000)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x101a00) ioctl$SNDRV_TIMER_IOCTL_TRIGGER(r2, 0x54a6) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000780)={0x1, 0x1, &(0x7f0000000380)=""/240, &(0x7f0000000900)=""/103, &(0x7f0000000800)=""/90}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) write$tun(0xffffffffffffffff, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000002c0)={0x1, r1}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000980)=0x1) read$FUSE(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x101842, 0x0) 14.788373583s ago: executing program 1 (id=1164): r0 = syz_open_dev$ndb(&(0x7f0000000240), 0x0, 0x680) ioctl$NBD_SET_BLKSIZE(r0, 0xab01, 0x5) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000400)={0x3}, 0x10) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffcffffff, 0x20031, 0xffffffffffffffff, 0xbe9f5000) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x2e8}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x18100}) r3 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x60b5, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x0, [{{0x9, 0x4, 0x0, 0xfc, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0xffff, 0x6, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0xb, 0x0, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f0000000040)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="754d8b65902b791ac8f99d90f1ec63f24129e65de8961f2f9b15e7e2ef7985f49d4188dde851675a0ce44c658f1856890d7f25d4eb436ce3781b8a2583cfb7d7d7720489b284adb5d0dc890c0383b00e4dd9c9a54159b5431f6ff82991dd967e5e9bf835d17b525936b8958ad7ea7406bfc095cbb22ad737102053ef64f28dc4cb0000000000000c6be2b5874433837c7e7306681edaae208bd3d07c2df454a299f8c39e6c6f546ed00eaa12aa3eee2adff1be8ad16331796b8add13a362ff8b1c7f640f7e597bf3f552093d51a7a97008a35cb6b6f56c22d8f435d55535f53ae9"], 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="180000001600fffffffffefffbff00000a"], 0x18}}, 0x24008818) 7.377560388s ago: executing program 4 (id=1181): openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0x107200, 0x0) (fail_nth: 2) 6.824845078s ago: executing program 0 (id=1185): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x8c66) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000180)={0xfffffffffffffffc, 0x0, 0x1, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000240)={0x27800000000, 0x0, 0x2, r2, 0x1}) (fail_nth: 2) 6.744886166s ago: executing program 4 (id=1186): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) quotactl_fd$Q_SETINFO(r1, 0xffffffff80000601, 0xee01, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000000)={0x4000000, 0x7f, 0x6}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x5}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_emit_ethernet(0x66, &(0x7f0000001800)={@random="9d3e485beb27", @random="78a4e8c9ab61", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x30, 0x3a, 0x0, @private1, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0xadd, {0x0, 0x6, "6b329f", 0x0, 0x3a, 0x0, @empty, @local}}}}}}}, 0x0) syz_emit_ethernet(0x1256, &(0x7f0000000a00)=ANY=[], 0x0) 6.683541396s ago: executing program 4 (id=1187): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000d40)={&(0x7f0000000b00)=ANY=[], 0x0, 0x26}, 0x28) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = fsopen(&(0x7f0000000000)='rpc_pipefs\x00', 0x0) listen(0xffffffffffffffff, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) openat$vcs(0xffffffffffffff9c, &(0x7f0000000a40), 0x2, 0x0) open_by_handle_at(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="20000000f10000000100000000ed3fcd2f0000000000000005010000f800ffff3d040000eb000000"], 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd70102030109024d00010000000009040000050095c20009050000000000000007058433ee78968a3c0e39b438cdce2e341d8f23df087943623ff5922f4d52c7eb22f8c1044b1950d1a3324eaaa3f7e474d60aeb3aaa74f5e58eab51142e86411baf2026104af43ee6678e9c4fb91aaf02afc5dce65dfb67e7449a7dcfa8cce075eec03d8c73fb928b458d4d5e6ee9e80f298d2b1a519a2df2fcebedd399bdaf0920460adb6f852d99d77854591cb020e43ae3ee32c186af40d29ece82765128178f8b15d24c5becd271b3d76e3b2a86b9bc89e5aa8d695e636d6f6cad1d8fb7de6ec3c3df3ef5832f2caa4834b31eb50d332a1a52c00d4140a17f3c334797c2b79571e630ba024a4c3190b9fd4b020000000000000073f45c35f003281314abf1fd354af1677898a6", @ANYBLOB="f4c67063914edd938985192f5c3b1d5c95db80432ab4c3ebe512c8013f247c4a909f7df613a6ea6dfee573ad94bcb85970347e83593b967d6e05f76ed3a2"], 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYRESOCT=r0], 0x30}, 0x1, 0x0, 0x0, 0x24048055}, 0x4000800) r4 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r4, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x3f, 0x2, 0x10, {0x2, 0x4e22, @empty}}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000ac0)="ee", 0xfffffe5e}], 0x1, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b57000000860f5878c37ffe36e1165814d435be5b317c6c8189587d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988ab013f40afe403041323110f62055394412158e7a3adb148d641aa40d4ab077fe34232aa8b31851466d0998a61d7da0c86d70000001010"], 0x10b8}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18020000000000000000000000000001850000002c0000009500"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCSIFBR(r5, 0x890c, &(0x7f0000000000)=@generic={0x0, 0x2}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) 6.324155416s ago: executing program 6 (id=1188): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xa4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000800)="cc5a4dbac0affd0a979c63ea8352d608a51fc8625318716ddf62b7752be4540c4ac7d344c53a3ad28313abc2437b60b03c0e587cafcf9a435bf90c618351f70a828238fdf90bc5d36c7d614b82552649954e0185662defd28f78449f073bad544f586136c5076a6f0f1b6fc9adf80557eb44db1b41824e9ef104c95e999766bbf27d74ad5d8fa63210cde65d384dd3e87c1fedaec3144d1ee66a0eb0750363e346cb930dae6109df6b9955bf8af119b5c9a86622af4ff8b5949fb90f8edbde416d046d61512fe4c453bb601a780e1bbc00dbedc5e50d3cd9bc920810eaefd5f9a171e9d32ab46b42e3e78c60087318bab42e94653cbdd600fba37c5a31d095500e91d02256f101e82447e34733220cdaaabc947f5b815080b5214c94a06fe96450ea42f48006c032b24d9e8d722841b7c7244b1d2cc012fcda1f7472fdbabb673ef862e32b359fad715b3f5cef6ef951abab80a4a0f5f8574395c5820fa25d07a119e23b39a87cb3b763fbfb0493121eec3e05eacbe7835e79e74881d1179013622a2a6421d51c974e6abd48a9882c8fcadbcee369346a9ad948fd5dd8f87496a30a9d888cdbcee8f3592dd69165358c4cd474639fc13300317b7fed115fb9818b20d177a39157101dbd8e23bc9ed32efed96c410a103d35336fb4ee4000bfb3d32b0181ff3d726a7dc6432a336a42b50b2c6877cb63b410d746b35fc721e5992ba47c3a2bc2d3679abe0794d226b7b0c333c3000fee7adaafb6efd57382eb2a86d71acaae52a154477a5b66757a886f4ad5446607520c17fb81ede0473cd897a34c7c9f41b653d568e4e1c457b0fc90554ed6798d3b8f3fb82578", 0x25b}, {&(0x7f0000000300)="17e37d3e106d9beae191613d45501cb6a8d8eaeb96ee68b2d800ad34b8c528b97ead9f051e427e309b714d3d12d8d4010c04a27e6c586b3956f0dfc7086e9550bd651b9e019d7b671b231c7a8cbfd52bea572b327362fd4db8e4a162096a0464fd2529fc31f79947d137520a8823ae6f0c068c299db997db4d44cfd7657ea53a691a386f018286b4dbe415596964ab56a9c0d7280e592ad174e737a4e5e4cd5600", 0xa1}], 0x2}}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000640)="985e", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000002040)=[{&(0x7f0000001b00)="c779a881400f168b3cd3b9dcb8505d626656e6b4f5441fb27838fa6f26bfe21f20605b23fffe6978fe6148e25caa0c0f9b6e4434877b8978a5caa4c641dfe5b407dd88d709f6c3aaf2eb6d966f38806c79f63870496f06f64302d7f1292499f44695", 0x62}, {&(0x7f0000000540)="6f433f8987fc9e72c982b56a37a1c7b7ab31e2f6b098f57a62f9d8a98a9d4f71997d1cd449c76702", 0x28}, {&(0x7f00000005c0)="8e26189d110469a886116da338167241f58b9e3a3d25fef3424da95dfc37", 0x1e}, {&(0x7f0000001d00)="45a4cdaed78e8aae62776ab5e19dab8363b642daf5ce06da88ce31cbf434c7758737d1610707c1be62e5680748b3b645a25af50508b344b621146721fc4a9657fd77ad93f48d94a70de115016171efb302adb61ee81ba5e41965e62716beb2de6762170181690f54affcfe75a8ee1e4348200bb9a469bfd1e8fd0488b873af6f20dcddf377fc36d314eccd27e8bf", 0x8e}, {&(0x7f0000001dc0)="4423c554c1d89dfdb98e09e6c7cac32762158fa3479da58104548fdcc7ef57389b9f63250592f4cc92cc344e1b3cd46446f8d4481699666b5f9e6e2b8a82c435ed400d40d67f1e3cf3931905f34b74e7cadf145de53d91ecb305560836557a01a67cc87c52ae248f04c2ec28cdcb21d816fccdef1d80efc00616ef86a1ec5a51789f2473ef6bbda9461f1ccac52d6fd8", 0x90}, {&(0x7f0000001e80)="ec1d60ccbe85510cec58bd3786a575b46de8fd547ade80f426f7e4f4278fc924d53d9073acf8247cf722ba4e9c7bfb1ba70b921b3bd3b1e061033204d9629d417ea1d834bc2539294611e3b6e5abf5c3eb10dc92cbaae7e80dd65084164afde069218042d5d2d8e256856c0bd1e7568574b80c4d5e51bf8604a10fe5f3f69a0a794905f74f75f189780c86ace348c270b3a346061d7f669d723871fb66d409e497ac801c6c725d70fb90fb22896b2481ac520c5d10", 0xb5}], 0x6}}], 0x3, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="04", 0x1, 0x10008095, 0x0, 0x0) 6.226986832s ago: executing program 6 (id=1189): openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa9c1, 0x6) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, &(0x7f0000000100)) 6.063479781s ago: executing program 6 (id=1190): r0 = getpid() r1 = socket$nl_route(0x10, 0x3, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x4000) setresuid(0x0, 0x0, 0x0) sendmsg$netlink(r1, &(0x7f0000000b80)={&(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000a40)=[{&(0x7f0000000400)={0x248, 0x3a, 0x300, 0x70bd2d, 0x25dfdbfb, "", [@nested={0x7c, 0x50, 0x0, 0x1, [@nested={0x4, 0x29}, @generic="902aec7adebf32310b5eae2987fe67285b98abb4911669a18c2adc5fe55e86bb371cf1c4f0bbdc84666dda1198c0b89ec9f5e2e88781acadc674ca1e877b30534eff67a8c7aaedf08801a0379716282e7e0f8dc38720a71478bc3466bcd9e0eedacae8ad86de482bc59dd6ca066309d287f2c5d0"]}, @typed={0x14, 0x58, 0x0, 0x0, @ipv6=@private0}, @generic="fae88202b50b127415dd53299e88b16ef6bbc77dee66fb7c379142e7d0c0b4154727fcf4c261ac14ace34caddbd568238bb45e37a19ff4c3", @typed={0x14, 0xd1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}, @nested={0x18, 0x113, 0x0, 0x1, [@typed={0x4, 0x146}, @nested={0x4, 0x10e}, @typed={0x8, 0xc5, 0x0, 0x0, @uid}, @nested={0x4, 0xb1}]}, @nested={0x141, 0x2c, 0x0, 0x1, [@nested={0x4, 0xeb}, @typed={0x4, 0x1}, @generic="a14ef6071ed93d52122b0d59172c5d8c8437ffe12bbb6891cae9877a8c14ece8aa5326c2412cd66775028ac3210f39e83bbcd34047ea8a1d951215a66cd24d851070389abefa8cd2e9e5e3dafbd9f66453c0d936958273885c2b8c8c74", @generic="208bb45721b13366b9f175896294447c6dbfd983b814764841b8b58fe0faa2bb51a50fdda86162cd35a01329af2a250bcf03b95f33f08c5506b103bfcf89fc6b6a5e6ddde42501e32216d37d80b4325d4d398eb3242056dd512ea6186345bac94817a11c5f5aece16faf05cf66e34d56b5d0428d9c1e67e00c10934983502a326721c35e4b4bb70da610db11f3a35a83a886f641ebf2196862afc1be6fc116b474bc655582a93f23355afc87c708965b01de6e5bdbbefc6f84f4f6734debaf175bb68d297410a7fec7d73d6ae420fd4c48dfd1b58a327769"]}]}, 0x248}, {&(0x7f0000000680)={0x17c, 0x3c, 0x200, 0x70bd29, 0x25dfdbff, "", [@typed={0x8, 0x13d, 0x0, 0x0, @uid}, @nested={0x15c, 0x72, 0x0, 0x1, [@nested={0x4, 0x77}, @typed={0x8, 0x91, 0x0, 0x0, @fd}, @nested={0x4, 0x42}, @generic="6c9c180ee3d390c8873f88f8f7368d25690338f6542ba654bbfec000535ae67c7e4d193e3890dcd2d5df555f2f216f8fe3f13062f430ed10e657615adcdfc288b8dfaccd3706337c924b020c052843c6a30da016f20397edf169b624f217ccdb", @nested={0x4, 0x11d}, @nested={0x4, 0x64}, @generic="ae61267522a37d5fc446e0c3e92e30e9ae7aaef8b0ec5804fa927dfd915df083423ae54381752ed848536f137056773b4944cfb740b35151271afa2f3ab806e6794fb00940834a3feb224870940ceacbb8dfe5bb5ae6cc1d56e32f7f27fbcc20876531bbbc14d2e91fc9959fd05778c331e4289cda5bfa1a739e85a9ab808211bf2c98ab84b2a28c002971f1b05be06f26af988996c1d832c43c570c6e1a15927cd07cf70a4dc9411a1902f0d7", @typed={0x8, 0x30, 0x0, 0x0, @uid=0xffffffffffffffff}, @generic="7e02ef41541b2a51b6f49f32626a446a3a1e6c6af0a09e3b58185d7e17bd4539634376bbd98d36", @generic="93a8ccdb"]}, @typed={0x8, 0xac, 0x0, 0x0, @ipv4=@multicast1}]}, 0x17c}, {&(0x7f0000000040)={0x3c, 0x1b, 0x10, 0x70bd2d, 0x25dfdbff, "", [@typed={0x8, 0x0, 0x0, 0x0, @pid=0xffffffffffffffff}, @generic="97411014f7b5b947398393b70e5447943095bf17233309f6a5", @typed={0x8, 0xfb, 0x0, 0x0, @pid}]}, 0x3c}, {&(0x7f0000000800)={0xd4, 0x28, 0x2, 0x70bd25, 0x25dfdbff, "", [@generic="3109792a5dc542129118adb64a69243ad571cd9f6e011b5b671692c41e37f859a9", @nested={0x4, 0xbf}, @typed={0x8, 0xd4, 0x0, 0x0, @ipv4=@loopback}, @generic="f9c277d0bbceb8fa36c81915bbdd080cffaa69dd30973d3550f69a2bb2960ccafc385c597c504c8241dfc72189706a55c66f1b20f786a9be564dd36c37369858bf5c2ae017e151d423abd17ec9310a1dbeb453c0c5e6b4768b3e8dae1654d6199fa50a80203f4a465dc85e8901a17f287b3e3a8bfd71c18dc05d1836f6682e15f6054af8995eea", @typed={0x8, 0x22, 0x0, 0x0, @fd}, @nested={0x8, 0x14a, 0x0, 0x1, [@nested={0x4, 0x8e}]}]}, 0xd4}, {&(0x7f0000000900)={0x140, 0x24, 0x20, 0x70bd27, 0x25dfdbfc, "", [@nested={0x6c, 0xf8, 0x0, 0x1, [@typed={0x4, 0x114}, @typed={0x8, 0x126, 0x0, 0x0, @fd}, @generic="b20ec4", @nested={0x4, 0x84}, @typed={0x8, 0xd4, 0x0, 0x0, @ipv4=@private=0xa010102}, @generic="6dabe909eab689bf6799b544bc7a26498f4527ad8ed46b7f1677252003aa3c5657a4082ef6a1e63b37cf6cab13312ce0d85e2a1ad828b3f703c1427e6de4367c4d61501c0e59815d8b2579a6b2"]}, @typed={0x8, 0x30, 0x0, 0x0, @u32=0x101}, @generic="7d3309b2fc08a90dd0cc5f99ca042a2f2e1eb019992c09b28bf8ba6289caed3e7d45dca5843b6f65cf3728f16f6775a90ad36eb6224c3729dc7f0bb65578b57e7a9741d9e444e94ecb5083546bb7147278dd25dfc875ac8efe6c091ff787d3e37c2dd566f5f19368f7a74c8cf205bcc7fe0dc38c4f51bdb63aae9c761449d63580e5825aee77e21a80d13ee5239639e69c9808ff6100dd60a8edf21b38a45323ae5bb414c83ca7", @generic="f19dde85", @typed={0x8, 0x5, 0x0, 0x0, @pid=r0}, @typed={0x8, 0x118, 0x0, 0x0, @ipv4=@multicast1}]}, 0x140}], 0x5, &(0x7f0000000b40)=[@cred={{0x1c, 0x1, 0x2, {r0}}}], 0x20, 0x20000044}, 0x40d4) 5.972357736s ago: executing program 0 (id=1191): sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000b80)={&(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000a40)=[{&(0x7f0000000400)={0x248, 0x3a, 0x300, 0x70bd2d, 0x25dfdbfb, "", [@nested={0x7c, 0x50, 0x0, 0x1, [@nested={0x4, 0x29}, @generic="902aec7adebf32310b5eae2987fe67285b98abb4911669a18c2adc5fe55e86bb371cf1c4f0bbdc84666dda1198c0b89ec9f5e2e88781acadc674ca1e877b30534eff67a8c7aaedf08801a0379716282e7e0f8dc38720a71478bc3466bcd9e0eedacae8ad86de482bc59dd6ca066309d287f2c5d0"]}, @typed={0x14, 0x58, 0x0, 0x0, @ipv6=@private0}, @generic="fae88202b50b127415dd53299e88b16ef6bbc77dee66fb7c379142e7d0c0b4154727fcf4c261ac14ace34caddbd568238bb45e37a19ff4c3", @typed={0x14, 0xd1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}, @nested={0x18, 0x113, 0x0, 0x1, [@typed={0x4, 0x146}, @nested={0x4, 0x10e}, @typed={0x8, 0xc5, 0x0, 0x0, @uid}, @nested={0x4, 0xb1}]}, @nested={0x141, 0x2c, 0x0, 0x1, [@nested={0x4, 0xeb}, @typed={0x4, 0x1}, @generic="a14ef6071ed93d52122b0d59172c5d8c8437ffe12bbb6891cae9877a8c14ece8aa5326c2412cd66775028ac3210f39e83bbcd34047ea8a1d951215a66cd24d851070389abefa8cd2e9e5e3dafbd9f66453c0d936958273885c2b8c8c74", @generic="208bb45721b13366b9f175896294447c6dbfd983b814764841b8b58fe0faa2bb51a50fdda86162cd35a01329af2a250bcf03b95f33f08c5506b103bfcf89fc6b6a5e6ddde42501e32216d37d80b4325d4d398eb3242056dd512ea6186345bac94817a11c5f5aece16faf05cf66e34d56b5d0428d9c1e67e00c10934983502a326721c35e4b4bb70da610db11f3a35a83a886f641ebf2196862afc1be6fc116b474bc655582a93f23355afc87c708965b01de6e5bdbbefc6f84f4f6734debaf175bb68d297410a7fec7d73d6ae420fd4c48dfd1b58a327769"]}]}, 0x248}, {&(0x7f0000000680)={0x17c, 0x3c, 0x200, 0x70bd29, 0x25dfdbff, "", [@typed={0x8, 0x13d, 0x0, 0x0, @uid}, @nested={0x15c, 0x72, 0x0, 0x1, [@nested={0x4, 0x77}, @typed={0x8, 0x91, 0x0, 0x0, @fd}, @nested={0x4, 0x42}, @generic="6c9c180ee3d390c8873f88f8f7368d25690338f6542ba654bbfec000535ae67c7e4d193e3890dcd2d5df555f2f216f8fe3f13062f430ed10e657615adcdfc288b8dfaccd3706337c924b020c052843c6a30da016f20397edf169b624f217ccdb", @nested={0x4, 0x11d}, @nested={0x4, 0x64}, @generic="ae61267522a37d5fc446e0c3e92e30e9ae7aaef8b0ec5804fa927dfd915df083423ae54381752ed848536f137056773b4944cfb740b35151271afa2f3ab806e6794fb00940834a3feb224870940ceacbb8dfe5bb5ae6cc1d56e32f7f27fbcc20876531bbbc14d2e91fc9959fd05778c331e4289cda5bfa1a739e85a9ab808211bf2c98ab84b2a28c002971f1b05be06f26af988996c1d832c43c570c6e1a15927cd07cf70a4dc9411a1902f0d7", @typed={0x8, 0x30, 0x0, 0x0, @uid=0xffffffffffffffff}, @generic="7e02ef41541b2a51b6f49f32626a446a3a1e6c6af0a09e3b58185d7e17bd4539634376bbd98d36", @generic="93a8ccdb"]}, @typed={0x8, 0xac, 0x0, 0x0, @ipv4=@multicast1}]}, 0x17c}, {&(0x7f0000000040)={0x3c, 0x1b, 0x10, 0x70bd2d, 0x25dfdbff, "", [@typed={0x8, 0x0, 0x0, 0x0, @pid=0xffffffffffffffff}, @generic="97411014f7b5b947398393b70e5447943095bf17233309f6a5", @typed={0x8, 0xfb, 0x0, 0x0, @pid}]}, 0x3c}, {&(0x7f0000000800)={0xd4, 0x28, 0x2, 0x70bd25, 0x25dfdbff, "", [@generic="3109792a5dc542129118adb64a69243ad571cd9f6e011b5b671692c41e37f859a9", @nested={0x4, 0xbf}, @typed={0x8, 0xd4, 0x0, 0x0, @ipv4=@loopback}, @generic="f9c277d0bbceb8fa36c81915bbdd080cffaa69dd30973d3550f69a2bb2960ccafc385c597c504c8241dfc72189706a55c66f1b20f786a9be564dd36c37369858bf5c2ae017e151d423abd17ec9310a1dbeb453c0c5e6b4768b3e8dae1654d6199fa50a80203f4a465dc85e8901a17f287b3e3a8bfd71c18dc05d1836f6682e15f6054af8995eea", @typed={0x8, 0x22, 0x0, 0x0, @fd}, @nested={0x8, 0x14a, 0x0, 0x1, [@nested={0x4, 0x8e}]}]}, 0xd4}, {&(0x7f0000000900)={0x140, 0x24, 0x20, 0x70bd27, 0x25dfdbfc, "", [@nested={0x6c, 0xf8, 0x0, 0x1, [@typed={0x4, 0x114}, @typed={0x8, 0x126, 0x0, 0x0, @fd}, @generic="b20ec4", @nested={0x4, 0x84}, @typed={0x8, 0xd4, 0x0, 0x0, @ipv4=@private=0xa010102}, @generic="6dabe909eab689bf6799b544bc7a26498f4527ad8ed46b7f1677252003aa3c5657a4082ef6a1e63b37cf6cab13312ce0d85e2a1ad828b3f703c1427e6de4367c4d61501c0e59815d8b2579a6b2"]}, @typed={0x8, 0x30, 0x0, 0x0, @u32=0x101}, @generic="7d3309b2fc08a90dd0cc5f99ca042a2f2e1eb019992c09b28bf8ba6289caed3e7d45dca5843b6f65cf3728f16f6775a90ad36eb6224c3729dc7f0bb65578b57e7a9741d9e444e94ecb5083546bb7147278dd25dfc875ac8efe6c091ff787d3e37c2dd566f5f19368f7a74c8cf205bcc7fe0dc38c4f51bdb63aae9c761449d63580e5825aee77e21a80d13ee5239639e69c9808ff6100dd60a8edf21b38a45323ae5bb414c83ca7", @generic="f19dde85", @typed={0x8, 0x5, 0x0, 0x0, @pid=r0}, @typed={0x8, 0x118, 0x0, 0x0, @ipv4=@multicast1}]}, 0x140}], 0x5, &(0x7f0000000b40)=[@cred={{0x1c, 0x1, 0x2, {r0}}}], 0x20, 0x20000044}, 0x40d4) 5.940373556s ago: executing program 6 (id=1192): open(&(0x7f00000005c0)='./file0\x00', 0x2a4c0, 0x13) creat(&(0x7f0000000080)='./file0\x00', 0x1ac) memfd_create(&(0x7f0000000400)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\x90\xf5\xbb\x1c\xac\xc7\xad\xdc\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bC\xd8\x1c\xe8\x9bYSp\xa5\xfd\ny\xdfS\xdbU\xf80\xa88\tl\xb5b\x83\x97+o:\xfc\x83\x18\xe46\x8a\x029\x19\x8fjC\xce\xa7S\x81\xd5\xda\x84\xdf\xe3A_\x05XCk\x1d\x1cC\x97r\x93\xd6t\x81b\xc7x\xab\xa2\xf0\av\x88\x01\x92\xeaF\xa9!\xfc\x1c\xbf7q\xcf\xed&\x96\xa6\x1c_\xff\xb4\x00X\x1b\xedw\xc1', 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$packet(0x11, 0x3, 0x300) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000010900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000800800054000000021840000000c0a01030000000000000000070000000900020073797a31000000000900010073797a30000000005800038054000080810003400000000248000b80340001800a0001006c696d697400000024000280081a"], 0x108}}, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs2/custom1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f00000006c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000640)={@fda={0x66646185, 0x3, 0x0, 0x14}, @flat=@weak_handle={0x77682a85, 0x1000, 0x3}, @fda={0x66646185, 0x5, 0x2, 0x2}}, &(0x7f00000003c0)={0x0, 0x20, 0x38}}}], 0x3, 0x2000000, &(0x7f0000000780)="137a01"}) socket$packet(0x11, 0x3, 0x300) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) recvmmsg(r2, 0x0, 0x0, 0x10000, &(0x7f0000001000)={0x77359400}) bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0x1a, 0x4, 0x101, 0x1, 0xe, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xa44f}, 0x50) getpid() mkdirat(0xffffffffffffff9c, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0xd, 0xc, &(0x7f00000007c0)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d00000018010000206d6c2500000000007c5a6ed49cf407328de225bfc554322bf865ee6eac0ff1bb0d2bc808708ce1bf574d52c5a27105a95a3542f3f17ea6dcbe027bc36f6d8d0500cc52cca4c0541076608eeddd82a9be6a3ae82732426a56c0ea77ba3deb9f50654d581c5745a55d1e00000000000000000000dde2ae65b4ec7371cebfa4a9f7193e72d6ec337d0febf44e0f267fca0d5f20ca6d48d594d5c5434140144356819764456e73119e8688d3d51488c2caea17339a2acdeb440f119cafa2725e75ee2658e261a070b025872e2ce271d0f459f1a9774b3dcf9354eb2fb4821de27af14f4a6f728a573181a174b12e7a6722f220ac47f1f98f7ddd1295a18c39c3589bb9e3c3c54a37ef961e81f4071f55fb89571caa8cf14174ae78a0b589ce132cf4c044e9"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200)=0x1, 0x12) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0e0000000400000a169500"/20, @ANYRES32, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x50) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0\x00', 0x0) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000100)=0x1, 0x12) mount$fuse(0x0, &(0x7f0000000a40)='./file0\x00', 0x0, 0x2140085, 0x0) 5.881859539s ago: executing program 0 (id=1193): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000006c0)='/sys/kernel/rcu_stall_count', 0x0, 0x86) read$usbfs(r0, &(0x7f00000001c0)=""/93, 0x5d) (fail_nth: 2) 5.646277299s ago: executing program 0 (id=1194): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={0x0, r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @broadcast}}}, 0x0, 0x0, 0xc, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4e1d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) mkdir(&(0x7f0000000200)='./file0\x00', 0x28e08a7aa33ba155) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, 0x0, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f00000001c0)) 4.322965099s ago: executing program 0 (id=1195): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec85"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @broadcast}}}, 0x0, 0x0, 0xc, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4e1d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) mkdir(&(0x7f0000000200)='./file0\x00', 0x28e08a7aa33ba155) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, 0x0, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f00000001c0)) 4.049915532s ago: executing program 6 (id=1196): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x8000200, 0x7f, 0x4, 0x0, 0x0, 0x3}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r4, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000200)="39000000140081ae00002c000500015601618575e285af0180000000171300883795c04a31ba377a1b2cc32b38d3740000ffffffffffffffff", 0x39}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) 2.973703563s ago: executing program 0 (id=1197): r0 = socket(0x2, 0x2, 0x1) bind$unix(r0, &(0x7f0000000000)=@abs, 0x6e) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="201006000000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = add_key$keyring(&(0x7f0000000400), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, 0x0, 0x0) r3 = add_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000380)="d8", 0x1, r3) keyctl$search(0xa, r3, 0x0, &(0x7f0000000180)={'syz', 0x3}, r2) syz_usb_control_io$lan78xx(r1, &(0x7f0000000200)={0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="4023f9000000f90ecbac57cef3de272df1a1728078b30dd8fff93e3ec2641299d39e7923d5dd94995700ae4a3debbab9a9f6fdbae42e907d60d5d28b1157b483a83cab31642fec985e485e7b72be35bfeda15b7d816621b4fb2a8c675018c0db60473c7721820f8383b15779975b19529ef9c6a08701076ef6c5d7b046e22d97b84c1944a0b1b80a00b8858854e251a554d4b110c553729914cdab0ef6f6bf04dc60e2f4374e2a17ae45839afa159603dff6aa725137da8392ec957b4fdb3df903b2c26214eecd79de4729ca6ef51c7a06a12b46d082ff1df86a536c924607b011dec5d2af3842b3b581fde0ee081fd6fb0a192a92106ae7efb31176e6aeab"], &(0x7f0000000100)=ANY=[@ANYBLOB="0003041940"]}, &(0x7f00000004c0)={0x34, &(0x7f00000002c0)={0x0, 0x11, 0xf7, "f4f8c7197916c430e9a890a4c3ed121d1f3b9fd0674a406f391ca33153c0d6122ea766f9f4d0988b5cb5df8f31ed4ee386d0c82a9dac009912af033a10acbf724d0d9b28b311df3c0517e2704b5d5789a5c42b1b9af1cd02c59b7065e40e8c53378046c222bf4d2c1f1a8208328f72bcb886e12800bcc61d3b2baf883811fc30acd1a5de1ca702b97ac0a052f1d2d96ed22f8af85b762c6d6c44af741bc8b0f33daa709cc4f1d2020dd24020f679d20e3ddf6d8919e33e620cbf7ac4dd690099ef04f35193f9a7eb7455e126605e483fadbf11d93f82d655a47e9616c4f44240a883743518316106805a8f4e454a472e27ffa275021d8f"}, &(0x7f0000000240)={0x0, 0xa, 0x1, 0xa}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000400)={0xc0, 0xa1, 0x4, 0x5}, &(0x7f0000000440)={0x40, 0xa0, 0x4, 0xfff}, &(0x7f0000000480)={0xc0, 0xa2, 0x2f, "896ed45bce9a7e4d4b2ba61b63ab709572340b394aea2f9d7d094eb90694ec7deabc6b9f9b1fbc26e141b6933e1fa2"}}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x400) ioctl$DRM_IOCTL_WAIT_VBLANK(r4, 0xc018643a, &(0x7f0000000040)={0x1, 0x0, 0x2}) syz_usb_disconnect(r1) r5 = socket$tipc(0x1e, 0x4, 0x0) r6 = syz_open_dev$evdev(&(0x7f00000002c0), 0x2, 0x8000) ioctl$EVIOCGPHYS(r6, 0x80404507, &(0x7f0000000300)=""/115) bind$tipc(r5, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) r7 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r7, &(0x7f0000000240)={&(0x7f00000001c0)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1000a8d0}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_open_dev$video(&(0x7f0000000000), 0x7, 0x40440) r8 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r8, 0xc0285700, &(0x7f0000000100)={0x1, "fa02c800"}) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) r10 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r10, 0xc0184800, &(0x7f0000000100)={0x4, r9}) ioctl$DMA_BUF_SET_NAME_A(r11, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x83, 0x2, 0x3, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x20003, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x6, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2, 0xfffffffc, 0x5, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0xfffff575, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x6, 0x47, 0x6, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0x2, 0x2, 0x400003, 0x20000008, 0x4, 0x6d01, 0x6, 0x7, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x200807ff, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x4, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x4184, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) 2.901271908s ago: executing program 4 (id=1198): r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) syz_usb_connect(0x2, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0xa7, 0x7, 0x16, 0x40, 0x6a2, 0x3, 0x3cf2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7, 0x7, 0xa0, 0x6, [{{0x9, 0x4, 0xb4, 0x4, 0x0, 0xcd, 0x7f, 0xe4, 0x7}}]}}]}}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x3c01}}, {0x9e, &(0x7f0000000200)=ANY=[@ANYBLOB="9e038a117e7ff567b2e2a86790d141324eb731bf72744ce27b30d2c6980e614bfab4bfb23d002c12d43e1a3b67907e75cdd526f04fe6592ed096aff9012ae91513582dd203138b3fd9056421693a3bfafc15e36323a60c34cbb802704655b97f40b7f6a14c4ba96e73683ce708a816c91f4f0cebc5f24fe676d522f56629c573e7563555babb113f6293e55ad3b6f3512b9fe74fcc62531cf58deed9", @ANYRESOCT=r0]}]}) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, 0x0) close(r0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='finish_task_reaping\x00', 0xffffffffffffffff, 0x0, 0x5}, 0x18) 2.598855753s ago: executing program 5 (id=1201): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="202700002c0007012bbd7000ffdbdf25047c0000280301802103dd802001e9"], 0x2720}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) 2.557257051s ago: executing program 5 (id=1202): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec85000000750000000400000007000000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @broadcast}}}, 0x0, 0x0, 0xc, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4e1d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) mkdir(&(0x7f0000000200)='./file0\x00', 0x28e08a7aa33ba155) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, 0x0, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r5, 0xc0045006, &(0x7f0000000040)=0xc) close(r5) 1.397314353s ago: executing program 5 (id=1203): mkdir(&(0x7f00000001c0)='./file0\x00', 0x58) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="202700002c0007012bbd7000ffdbdf25047c0000280301802103dd802001e9"], 0x2720}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r1 = syz_clone(0x400100, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x1, r1, 0x0, 0x40000004, 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r0) syz_clone3(&(0x7f0000000440)={0x2200, &(0x7f0000000200)=0xffffffffffffffff, &(0x7f0000000240), &(0x7f0000000280), {0x20}, &(0x7f00000002c0)=""/60, 0x3c, &(0x7f0000000300)=""/220, &(0x7f0000000400)=[r1, r1], 0x2}, 0x58) pidfd_send_signal(r3, 0x15, &(0x7f0000000500)={0x6, 0xa8, 0x400}, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r2, 0x400, 0x70bd25, 0x25dfdbfb, {{}, {}, {0x14, 0x19, {0x3, 0x5, 0x3, 0x4}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x51}, 0x4880) 1.072186939s ago: executing program 5 (id=1204): socket$pptp(0x18, 0x1, 0x2) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000ac0)={0x84, &(0x7f00000005c0)={0x20, 0x8, 0x1d, "5c5df6b7c3baad189a01b33b13538623a03dbd693b1614b77c0a505937"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r3 = socket(0x2, 0x2, 0x1) bind$unix(r3, 0x0, 0x0) fsopen(&(0x7f0000000280)='cifs\x00', 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) (fail_nth: 2) 470.707192ms ago: executing program 6 (id=1205): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000480)=[0x0], 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x40) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000640)={0x30, 0x0, 0x100, 0x70bd28, 0x25dfdbff, {{}, {}, {0x14, 0x17, {0x1c, 0xfffffaf7, @l2={'ib', 0x3a, 'wg2\x00'}}}}, ["", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x44050}, 0x4000880) 265.88453ms ago: executing program 4 (id=1206): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000028c0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9"], &(0x7f0000000340)='syzkaller\x00'}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x4, 0x40, 0x40, 0x41}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000180), 0x1003, r0}, 0x38) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000b80)={r0, &(0x7f00000005c0), &(0x7f0000000b40)=""/31}, 0x20) r1 = memfd_create(&(0x7f00000005c0)='\x103q}2[\xe0\x9a\xee\xaf\x03\x97\x9et\v\"|Ma\x86\xe7\xc0\x14\x9f\xb9h\xb1\x96\xe7=I\x860S6\xb5\xa8\xc2\x95Je%\xfeG\'\b\x00\x00\x00\x00\x00\x00\x00\x1c\xa6\xab\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94k\xcd\t\x00\x90k\xd6\x05\xb6&\xd0\x9daA\xc5\x9c_\xd4\x18,\f\xd4s\xb2\x99/\xc0\x9a\xf2Oc\xc0c\x03gB!\xb0\xb8n\x01\x9bT\x95\x10\x86\xe8$\x7f\r[\xf9\x0e1v\xb1\n\x88\v\x95uy\xb5:`\x8b\nC\x18A;\xaa%\xaf\xc7\xa3\xac\xa2D\xb5\xe2\xe1\xdc(\xfd\x05\x9fB\x84O\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\xa0\x17\xe3\xac\xe9\xc9\xa7\x8a\x1b\x03\"&\xac\xcap>\xccZ\x01\xbc\x18\xc1\xb9\xe9\v\x8b\x9c\xb4Q\xd4\x96EV<>\x99\xca\xb3\xe0\xc4tL\xed\xf5W\xbd#\xcf\x8a\x84\xed\x9f/\xd4\xbb\xea;-Dp\xf8\xd0F\x90\xf8\x92Ip6\xf4\x16\xe8\x14\xe0\x92!\x92-F\xe2\x14D\x91\xa8b\x04\xdd\x1d\a\xdc\xe0\x18\x85{\x80Q\xf6k\x96\xfaQ\x9fW\vO\xf0\xe4O\\\xceS\xe2\x05\x049d\x06#\x88\xc3\xdf\x85O\x1c\xc3\xad?r\xd7\x0e\x00\xd7\x83\xb0\x88\x9c\xf6Y-F\x98\xdd\x9c~\xfd\x95\xc3\xb6lC\xaa\"Y\xa2K\xecz\x84:*\xf5Y\xd1\x9b1\xbd\x9b\x15\xd4\xec\x02o\x01&\xaa\x90w\xc4\xc7\x8en\xb5\x1ag\xab&?\xbe\xcb\xe8v\xa8\xe0\xa4\x81sW\xacf\x149\xd2}\xef\x03Ga\x9a$4\x8c\xa5!p\x83\x05\x96%\x02%\xabj\n\b\xc8NC\x91}&y\xd3\xe1\xeep\'\xc5\xab\x19GsX5\x8c\n\x9fh\xee;4\xb1%V\xe0\xa9\x8e\xf30:\xd8\x18N~G\x139\xcaf2\x02F1\xc6\x82\x00E\xae\x9d\x17\x871N:\xb4\xea \x8e\xdelP\x83\x1f\'\xe2\xd6\xc0\xc3\xfc\xc9677u\xf3RUP@o>\xee\xb8\xa3\t\x02\xb7\\,\xebK\xed\x1b\xc9e\xb3\x16\xce\x9bI\xdb\xfa\x82\x85\t\x9bg\xd0s\xe2\f{\x8cp~;\xf8\x96\xf2\x91\x06\x89\xa6D\xce\xac\x03\xc1\x83\xd1\xe6 |\xa75\xd7\x80t\xfc\xf8\xd2\x12N\x1cB7^\xfd4\xae\xb0VFw\b!\xae\x1baTv\xc0z\x19\xc5\xc8w\xba\x97N\x9a`\x8f\xfc\x9ee\xf9\x00\x1cQA\x14]\r\xd4\"\xc2\x12GD\xdb{\x88\xaa\x81\xc8\xa2\xdeI\xa2\xbel\x0e\xec\x17fNI\x05\xff\x8d\xf4_\x1a\vqA\xb7\x0ed<\x98\xee\xb8\x19\xec\x9f\xee\xe1_\xacG\x8b\xa3\xc3\x13\x80\x0f\xf4I\xdeAwG\xbdkno\xa2\b\x126\x97\x9b\xf9|P\xd94\v\x15\xcb\xc0\x9d\x11\xf3\x18\xae!2\x1b\x12\xa9\xc8~\xb7S\x94\xb5\xc7;\xa90D>s\xe9\xa4N\xf8\xdb\xab\xa0\x94~\xa1]b\xa4\xe5\xe2e\x1c\x8b\xd2\xc7Md\x93\x02\xd8\xb0,\xeb\x03\xaa\v\xed\x9bR\x8a\x80\xc2\x1f\x17ej\x973wv\x83a\xe06\x96\xde\xbc%Uh;H\xf8S\xf1\xa1g\x02\xc4\xc3\xa4\xa8\x96\t\xfex\xa2?\xcb\\Y\x1e\xfe\xca\xa0i\x80O\x11\xac\xb7$\xdb\xbc\xb0\xcb\xacqU\xb5*\x00\x00\x00\x00\x00\x00\x00\f\xda\xf8oV\x89\xd3\x1f\x99+\xe5T\x8eM4\x1c\xc6\x7f\xd4\xf2\xcc\xd3\x94\xca\xd4\x00\x00\x00\x00\x00\x00\x00\x00\x00~A9\xf6IBu2L\x9e\xa2\xd0\x92\xd1\xbc\xb8\tJ\xa1\aN\x87\x95\xbb\xa9s\xab\x90\x06\xc6!p\x9e?~\xf9\xe6\xae*\v\xa3\xd9gxKN\'z]*\x93\xf7\b\x91\xd0\xff\xd9\xc6a\xb5q\x9c\xa1Go\xd58\x93\xe0,\x9f\xe4\xa9\xd9A\x9e\x95e\x98\xd0V\x9d\xed\x97\xf1\xc5\xce\xf5\x90!d\x9a\xd8\x10\xbbx\r8\xff\x8bNUK\xebA\xe5\x92f\xc4\xd1\xa8\x15\xbf\xb5iW\xdb.kbf*\x89\xf0\xecq m-~\xbbf?\xec=\xd2\xe2\x1e\x8d/o\xcd\xc8x\xdb\xe6\xd0W\xca\xc5kz\x8e9\xfa\x86\x0f\x96p', 0x3) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0x5, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000050000000000000023004000611108000000000085000000a300000095"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf}, 0x94) ioctl$FS_IOC_RESVSP(r1, 0x40305828, 0x0) fcntl$addseals(r1, 0x409, 0xb) 16.868093ms ago: executing program 5 (id=1207): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000002980)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000005c0)=ANY=[@ANYBLOB="48000000180001002cbd7000ffdbdf251d010300150002000200008003030000700a3ca859c20e31050000000c000b00000000600300004008000e00", @ANYRES32=0x0, @ANYBLOB="0800050004"], 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 1.134648ms ago: executing program 5 (id=1208): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c0000000300000001"], 0x19) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, &(0x7f0000000000)=""/48}, 0x20) 0s ago: executing program 4 (id=1209): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x2, 0x1, 0xc8}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) (fail_nth: 2) kernel console output (not intermixed with test programs): oc+0x199/0x4a0 [ 435.543970][ T8955] __genradix_ptr_alloc+0x199/0x4a0 [ 435.543999][ T8955] proc_map_files_readdir+0x4e1/0x980 [ 435.544034][ T8955] ? __pfx_proc_map_files_readdir+0x10/0x10 [ 435.544066][ T8955] ? iterate_dir+0x29e/0x580 [ 435.544100][ T8955] ? iterate_dir+0x29e/0x580 [ 435.544119][ T8955] ? down_read_killable+0x152/0x220 [ 435.544141][ T8955] ? __pfx_down_read_killable+0x10/0x10 [ 435.544175][ T8955] iterate_dir+0x3a5/0x580 [ 435.544202][ T8955] __se_sys_getdents64+0xe4/0x260 [ 435.544228][ T8955] ? __pfx___se_sys_getdents64+0x10/0x10 [ 435.544248][ T8955] ? ksys_write+0x230/0x260 [ 435.544267][ T8955] ? __pfx_filldir64+0x10/0x10 [ 435.544291][ T8955] ? __pfx_ksys_write+0x10/0x10 [ 435.544317][ T8955] ? do_syscall_64+0xbe/0xf80 [ 435.544341][ T8955] do_syscall_64+0xfa/0xf80 [ 435.544361][ T8955] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.544379][ T8955] ? clear_bhb_loop+0x60/0xb0 [ 435.544401][ T8955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.544418][ T8955] RIP: 0033:0x7f201830f749 [ 435.544435][ T8955] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 435.544450][ T8955] RSP: 002b:00007f201652c038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 435.544470][ T8955] RAX: ffffffffffffffda RBX: 00007f2018566180 RCX: 00007f201830f749 [ 435.544484][ T8955] RDX: 0000000000001002 RSI: 0000200000002f40 RDI: 0000000000000006 [ 435.544496][ T8955] RBP: 00007f201652c090 R08: 0000000000000000 R09: 0000000000000000 [ 435.544507][ T8955] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 435.544517][ T8955] R13: 00007f2018566218 R14: 00007f2018566180 R15: 00007ffd0e0acd58 [ 435.544548][ T8955] [ 435.703169][ T8959] FAULT_INJECTION: forcing a failure. [ 435.703169][ T8959] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 435.703229][ T8959] CPU: 1 UID: 0 PID: 8959 Comm: syz.6.876 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 435.703253][ T8959] Tainted: [L]=SOFTLOCKUP [ 435.703259][ T8959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 435.703269][ T8959] Call Trace: [ 435.703277][ T8959] [ 435.703285][ T8959] dump_stack_lvl+0x189/0x250 [ 435.703309][ T8959] ? rcu_is_watching+0x15/0xb0 [ 435.703329][ T8959] ? __pfx_dump_stack_lvl+0x10/0x10 [ 435.703349][ T8959] ? __pfx__printk+0x10/0x10 [ 435.703381][ T8959] should_fail_ex+0x46c/0x600 [ 435.703410][ T8959] _copy_from_user+0x2d/0xb0 [ 435.703431][ T8959] sctp_getsockopt_connectx3+0x148/0x450 [ 435.703456][ T8959] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 435.703481][ T8959] ? __pfx_sctp_getsockopt_connectx3+0x10/0x10 [ 435.703510][ T8959] ? rt_spin_unlock+0x161/0x200 [ 435.703533][ T8959] ? lock_sock_nested+0x5f/0x130 [ 435.703553][ T8959] ? lock_sock_nested+0xdd/0x130 [ 435.703574][ T8959] sctp_getsockopt+0x98a/0xb60 [ 435.703601][ T8959] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 435.703622][ T8959] do_sock_getsockopt+0x2b4/0x3d0 [ 435.703649][ T8959] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 435.703671][ T8959] ? do_syscall_64+0x80/0xf80 [ 435.703689][ T8959] ? __fget_files+0x2a/0x420 [ 435.703706][ T8959] ? __fget_files+0x3a6/0x420 [ 435.703721][ T8959] ? __fget_files+0x2a/0x420 [ 435.703745][ T8959] __x64_sys_getsockopt+0x1ab/0x250 [ 435.703767][ T8959] ? do_syscall_64+0x80/0xf80 [ 435.703794][ T8959] ? do_syscall_64+0x80/0xf80 [ 435.703817][ T8959] do_syscall_64+0xfa/0xf80 [ 435.703849][ T8959] ? rcu_is_watching+0x15/0xb0 [ 435.703864][ T8959] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.703882][ T8959] ? clear_bhb_loop+0x60/0xb0 [ 435.703902][ T8959] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.703918][ T8959] RIP: 0033:0x7f34bd61f749 [ 435.703935][ T8959] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 435.703949][ T8959] RSP: 002b:00007f34bb844038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 435.703968][ T8959] RAX: ffffffffffffffda RBX: 00007f34bd876180 RCX: 00007f34bd61f749 [ 435.703981][ T8959] RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000005 [ 435.703993][ T8959] RBP: 00007f34bb844090 R08: 0000200000000100 R09: 0000000000000000 [ 435.704004][ T8959] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 435.704016][ T8959] R13: 00007f34bd876218 R14: 00007f34bd876180 R15: 00007fffab412618 [ 435.704046][ T8959] [ 436.198939][ T31] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 437.470317][ T31] usb 5-1: device descriptor read/all, error -71 [ 439.675536][ T8977] delete_channel: no stack [ 440.058390][ T10] usb 2-1: new full-speed USB device number 42 using dummy_hcd [ 440.118336][ T8277] block nbd1: Possible stuck request ffff888024d47000: control (read@0,1024B). Runtime 180 seconds [ 440.118381][ T8277] block nbd1: Possible stuck request ffff888024d471c0: control (read@1024,1024B). Runtime 180 seconds [ 440.118407][ T8277] block nbd1: Possible stuck request ffff888024d47380: control (read@2048,1024B). Runtime 180 seconds [ 440.118432][ T8277] block nbd1: Possible stuck request ffff888024d47540: control (read@3072,1024B). Runtime 180 seconds [ 440.255289][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.255356][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.298410][ T10] usb 2-1: config 0 has an invalid interface number: 128 but max is 0 [ 440.298438][ T10] usb 2-1: config 0 has no interface number 0 [ 440.298470][ T10] usb 2-1: config 0 interface 128 has no altsetting 0 [ 440.340612][ T10] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=95.91 [ 440.340640][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.340660][ T10] usb 2-1: Product: syz [ 440.340673][ T10] usb 2-1: Manufacturer: syz [ 440.340685][ T10] usb 2-1: SerialNumber: syz [ 440.403578][ T10] usb 2-1: config 0 descriptor?? [ 440.428531][ T10] radio-si470x 2-1:0.128: could not find interrupt in endpoint [ 440.428617][ T10] radio-si470x 2-1:0.128: probe with driver radio-si470x failed with error -5 [ 440.429132][ T10] usbhid 2-1:0.128: couldn't find an input interrupt endpoint [ 440.538750][ T8988] netlink: 'syz.6.886': attribute type 13 has an invalid length. [ 440.538772][ T8988] netlink: 'syz.6.886': attribute type 17 has an invalid length. [ 440.609069][ T10] usb 2-1: USB disconnect, device number 42 [ 441.448475][ T8988] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 441.580204][ T8998] team_slave_0: entered promiscuous mode [ 441.580254][ T8998] team_slave_1: entered promiscuous mode [ 441.659392][ T8997] team_slave_0: left promiscuous mode [ 441.659484][ T8997] team_slave_1: left promiscuous mode [ 441.704374][ T31] kernel read not supported for file /105/sessionid (pid: 31 comm: kworker/1:0) [ 441.897940][ T9016] FAULT_INJECTION: forcing a failure. [ 441.897940][ T9016] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 441.897974][ T9016] CPU: 0 UID: 0 PID: 9016 Comm: syz.0.896 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 441.897999][ T9016] Tainted: [L]=SOFTLOCKUP [ 441.898006][ T9016] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 441.898017][ T9016] Call Trace: [ 441.898024][ T9016] [ 441.898032][ T9016] dump_stack_lvl+0x189/0x250 [ 441.898059][ T9016] ? __pfx____ratelimit+0x10/0x10 [ 441.898079][ T9016] ? __pfx_dump_stack_lvl+0x10/0x10 [ 441.898100][ T9016] ? __pfx__printk+0x10/0x10 [ 441.898118][ T9016] ? __might_fault+0xb0/0x130 [ 441.898152][ T9016] should_fail_ex+0x46c/0x600 [ 441.898181][ T9016] _copy_from_user+0x2d/0xb0 [ 441.898202][ T9016] __sys_bpf+0x1e3/0x860 [ 441.898226][ T9016] ? __pfx___sys_bpf+0x10/0x10 [ 441.898239][ T9016] ? rt_mutex_slowunlock+0x1be/0x2e0 [ 441.898277][ T9016] ? ksys_write+0x230/0x260 [ 441.898301][ T9016] ? __pfx_ksys_write+0x10/0x10 [ 441.898329][ T9016] __x64_sys_bpf+0x7c/0x90 [ 441.898355][ T9016] do_syscall_64+0xfa/0xf80 [ 441.898376][ T9016] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.898394][ T9016] ? clear_bhb_loop+0x60/0xb0 [ 441.898415][ T9016] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.898432][ T9016] RIP: 0033:0x7f8c16cef749 [ 441.898449][ T9016] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 441.898464][ T9016] RSP: 002b:00007f8c14f56038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 441.898484][ T9016] RAX: ffffffffffffffda RBX: 00007f8c16f45fa0 RCX: 00007f8c16cef749 [ 441.898497][ T9016] RDX: 0000000000000020 RSI: 0000200000000040 RDI: 0000000000000009 [ 441.898509][ T9016] RBP: 00007f8c14f56090 R08: 0000000000000000 R09: 0000000000000000 [ 441.898520][ T9016] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 441.898531][ T9016] R13: 00007f8c16f46038 R14: 00007f8c16f45fa0 R15: 00007ffda592cd38 [ 441.898562][ T9016] [ 443.149794][ T5898] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 443.208514][ T9035] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 443.213340][ T6185] IPVS: starting estimator thread 0... [ 443.298816][ T9038] IPVS: using max 9 ests per chain, 21600 per kthread [ 443.315890][ T5898] usb 6-1: config 0 has an invalid interface number: 128 but max is 0 [ 443.315918][ T5898] usb 6-1: config 0 has no interface number 0 [ 443.315949][ T5898] usb 6-1: config 0 interface 128 has no altsetting 0 [ 443.323069][ T5898] usb 6-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=95.91 [ 443.323095][ T5898] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.323114][ T5898] usb 6-1: Product: syz [ 443.323127][ T5898] usb 6-1: Manufacturer: syz [ 443.323139][ T5898] usb 6-1: SerialNumber: syz [ 443.380426][ T5898] usb 6-1: config 0 descriptor?? [ 443.387362][ T5898] radio-si470x 6-1:0.128: could not find interrupt in endpoint [ 443.387445][ T5898] radio-si470x 6-1:0.128: probe with driver radio-si470x failed with error -5 [ 443.387921][ T5898] usbhid 6-1:0.128: couldn't find an input interrupt endpoint [ 443.602374][ T5898] usb 6-1: USB disconnect, device number 4 [ 443.688600][ T9044] team_slave_0: entered promiscuous mode [ 443.688649][ T9044] team_slave_1: entered promiscuous mode [ 443.689796][ T9043] team_slave_0: left promiscuous mode [ 443.689856][ T9043] team_slave_1: left promiscuous mode [ 445.139355][ T9063] input: syz1 as /devices/virtual/input/input58 [ 445.435839][ T9034] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 446.758414][ T31] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 446.909526][ T31] usb 6-1: Using ep0 maxpacket: 8 [ 446.911823][ T31] usb 6-1: config 162 has an invalid interface number: 79 but max is 1 [ 446.911850][ T31] usb 6-1: config 162 has an invalid interface number: 183 but max is 1 [ 446.911869][ T31] usb 6-1: config 162 has no interface number 0 [ 446.911884][ T31] usb 6-1: config 162 has no interface number 1 [ 446.911950][ T31] usb 6-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 446.911989][ T31] usb 6-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 446.912012][ T31] usb 6-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 446.912035][ T31] usb 6-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024 [ 446.912060][ T31] usb 6-1: config 162 interface 183 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024 [ 446.912083][ T31] usb 6-1: config 162 interface 183 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 446.912107][ T31] usb 6-1: config 162 interface 79 has no altsetting 0 [ 446.912123][ T31] usb 6-1: config 162 interface 183 has no altsetting 0 [ 446.914520][ T31] usb 6-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 446.914544][ T31] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 446.914562][ T31] usb 6-1: Product: syz [ 446.914575][ T31] usb 6-1: Manufacturer: syz [ 446.914588][ T31] usb 6-1: SerialNumber: syz [ 447.213168][ T7916] Process accounting resumed [ 447.353232][ T31] pl2303 6-1:162.79: required endpoints missing [ 447.380536][ T31] pl2303 6-1:162.183: pl2303 converter detected [ 447.381474][ T31] pl2303 6-1:162.183: pl2303_vendor_read - failed to read [8484]: -71 [ 447.381863][ T31] pl2303 6-1:162.183: pl2303_vendor_write - failed to write [0404]: -71 [ 447.382243][ T31] pl2303 6-1:162.183: pl2303_vendor_read - failed to read [8484]: -71 [ 447.382636][ T31] pl2303 6-1:162.183: pl2303_vendor_read - failed to read [8383]: -71 [ 447.383020][ T31] pl2303 6-1:162.183: pl2303_vendor_read - failed to read [8484]: -71 [ 447.383410][ T31] pl2303 6-1:162.183: pl2303_vendor_write - failed to write [0404]: -71 [ 447.389377][ T31] pl2303 6-1:162.183: pl2303_vendor_read - failed to read [8484]: -71 [ 447.398708][ T5898] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 447.655615][ T31] pl2303 6-1:162.183: pl2303_vendor_read - failed to read [8383]: -71 [ 447.656054][ T31] pl2303 6-1:162.183: pl2303_vendor_write - failed to write [0000]: -71 [ 447.698426][ T31] pl2303 6-1:162.183: pl2303_vendor_write - failed to write [0001]: -71 [ 447.727116][ T31] pl2303 6-1:162.183: pl2303_vendor_write - failed to write [0002]: -71 [ 447.766179][ T31] usb 6-1: pl2303 converter now attached to ttyUSB0 [ 447.814155][ T9096] delete_channel: no stack [ 448.467711][ T5898] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 448.467740][ T5898] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 448.494201][ T31] usb 6-1: USB disconnect, device number 5 [ 448.505292][ T825] usb 2-1: new full-speed USB device number 43 using dummy_hcd [ 448.554347][ T31] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 448.555390][ T31] pl2303 6-1:162.183: device disconnected [ 448.557829][ T5898] usb 1-1: config 0 descriptor?? [ 448.651736][ T825] usb 2-1: config 0 has an invalid interface number: 128 but max is 0 [ 448.651764][ T825] usb 2-1: config 0 has no interface number 0 [ 448.651795][ T825] usb 2-1: config 0 interface 128 has no altsetting 0 [ 448.655372][ T825] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=95.91 [ 448.655401][ T825] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.655474][ T825] usb 2-1: Product: syz [ 448.655485][ T825] usb 2-1: Manufacturer: syz [ 448.655496][ T825] usb 2-1: SerialNumber: syz [ 448.934250][ T5898] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 448.945262][ T825] usb 2-1: config 0 descriptor?? [ 449.503091][ T825] radio-si470x 2-1:0.128: could not find interrupt in endpoint [ 449.503709][ T825] radio-si470x 2-1:0.128: probe with driver radio-si470x failed with error -5 [ 449.507586][ T825] usbhid 2-1:0.128: couldn't find an input interrupt endpoint [ 449.509872][ T8689] block nbd0: Possible stuck request ffff888024d17000: control (read@0,1024B). Runtime 330 seconds [ 449.509913][ T8689] block nbd0: Possible stuck request ffff888024d171c0: control (read@1024,1024B). Runtime 330 seconds [ 449.509991][ T8689] block nbd0: Possible stuck request ffff888024d17380: control (read@2048,1024B). Runtime 330 seconds [ 449.510019][ T8689] block nbd0: Possible stuck request ffff888024d17540: control (read@3072,1024B). Runtime 330 seconds [ 449.510162][ T59] block nbd2: Possible stuck request ffff888024d70000: control (read@0,1024B). Runtime 180 seconds [ 449.510195][ T59] block nbd2: Possible stuck request ffff888024d701c0: control (read@1024,1024B). Runtime 180 seconds [ 449.510221][ T59] block nbd2: Possible stuck request ffff888024d70380: control (read@2048,1024B). Runtime 180 seconds [ 449.510248][ T59] block nbd2: Possible stuck request ffff888024d70540: control (read@3072,1024B). Runtime 180 seconds [ 449.536073][ T825] usb 2-1: USB disconnect, device number 43 [ 449.748538][ T5898] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 2 [ 449.748563][ T5898] [drm] Initialized udl on minor 2 [ 449.789039][ T5898] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 449.789545][ T5898] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 449.831085][ T6133] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 449.861003][ T5898] usb 1-1: USB disconnect, device number 42 [ 449.862714][ T6133] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 452.011488][ T9103] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 453.031342][ T7916] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 453.118385][ T8277] block nbd3: Possible stuck request ffff888024dd7000: control (read@0,1024B). Runtime 180 seconds [ 453.118420][ T8277] block nbd3: Possible stuck request ffff888024dd71c0: control (read@1024,1024B). Runtime 180 seconds [ 453.118435][ T8277] block nbd3: Possible stuck request ffff888024dd7380: control (read@2048,1024B). Runtime 180 seconds [ 453.118450][ T8277] block nbd3: Possible stuck request ffff888024dd7540: control (read@3072,1024B). Runtime 180 seconds [ 453.550927][ T7916] usb 1-1: config 3 has an invalid interface number: 54 but max is 0 [ 453.550973][ T7916] usb 1-1: config 3 has no interface number 0 [ 453.551021][ T7916] usb 1-1: config 3 interface 54 altsetting 0 endpoint 0x2 has an invalid bInterval 64, changing to 10 [ 453.551045][ T7916] usb 1-1: config 3 interface 54 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 453.551064][ T7916] usb 1-1: config 3 interface 54 altsetting 0 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 453.551101][ T7916] usb 1-1: New USB device found, idVendor=05ac, idProduct=0215, bcdDevice= c.ac [ 453.551166][ T7916] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 453.601317][ T7916] appletouch 1-1:3.54: Could not find int-in endpoint [ 453.601354][ T7916] appletouch 1-1:3.54: probe with driver appletouch failed with error -5 [ 453.606794][ T7916] usbhid 1-1:3.54: couldn't find an input interrupt endpoint [ 453.820991][ T9121] netlink: 'syz.0.927': attribute type 1 has an invalid length. [ 453.961825][ T9121] 8021q: adding VLAN 0 to HW filter on device bond1 [ 453.968407][ T825] usb 1-1: USB disconnect, device number 43 [ 454.160949][ T9139] netlink: 64 bytes leftover after parsing attributes in process `syz.6.923'. [ 454.278406][ T5985] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 454.442438][ T5985] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 454.442463][ T5985] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 454.443734][ T5985] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 454.443759][ T5985] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 454.443777][ T5985] usb 2-1: SerialNumber: syz [ 454.725612][ T5985] usb 2-1: 0:2 : does not exist [ 454.756864][ T5985] usb 2-1: 5:0: failed to get current value for ch 1 (-22) [ 454.758434][ T7916] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 454.791949][ T5985] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 454.816694][ T5985] usb 2-1: 5:0: cannot get min/max values for control 2 (id 5) [ 454.852244][ T5985] usb 2-1: USB disconnect, device number 44 [ 454.910397][ T7916] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 454.910451][ T7916] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 454.910464][ T7916] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.950642][ T7916] usb 6-1: config 0 descriptor?? [ 454.967963][ T5859] udevd[5859]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 454.988785][ T7916] pwc: Askey VC010 type 2 USB webcam detected. [ 455.505406][ T7916] pwc: recv_control_msg error -32 req 02 val 2b00 [ 455.511370][ T7916] pwc: recv_control_msg error -32 req 02 val 2700 [ 455.535418][ T9168] FAULT_INJECTION: forcing a failure. [ 455.535418][ T9168] name failslab, interval 1, probability 0, space 0, times 0 [ 455.535669][ T9168] CPU: 1 UID: 0 PID: 9168 Comm: syz.1.940 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 455.535696][ T9168] Tainted: [L]=SOFTLOCKUP [ 455.535703][ T9168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 455.535714][ T9168] Call Trace: [ 455.535722][ T9168] [ 455.535730][ T9168] dump_stack_lvl+0x189/0x250 [ 455.535757][ T9168] ? __pfx____ratelimit+0x10/0x10 [ 455.535780][ T9168] ? __pfx_dump_stack_lvl+0x10/0x10 [ 455.535801][ T9168] ? __pfx__printk+0x10/0x10 [ 455.535824][ T9168] ? __pfx___might_resched+0x10/0x10 [ 455.535847][ T9168] should_fail_ex+0x46c/0x600 [ 455.535876][ T9168] should_failslab+0xa8/0x100 [ 455.535902][ T9168] __kmalloc_noprof+0xe0/0x7e0 [ 455.535924][ T9168] ? kfree+0x4d/0x900 [ 455.535940][ T9168] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 455.535966][ T9168] tomoyo_realpath_from_path+0xe3/0x5d0 [ 455.535987][ T9168] ? tomoyo_domain+0xd9/0x130 [ 455.536012][ T9168] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 455.536036][ T9168] tomoyo_path_number_perm+0x1e8/0x5a0 [ 455.536068][ T9168] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 455.536096][ T9168] ? htab_map_hash+0x1ea/0x340 [ 455.536145][ T9168] ? __fget_files+0x2a/0x420 [ 455.536167][ T9168] ? __fget_files+0x3a6/0x420 [ 455.536183][ T9168] ? __fget_files+0x2a/0x420 [ 455.536205][ T9168] security_file_ioctl+0xcb/0x2d0 [ 455.536231][ T9168] __se_sys_ioctl+0x47/0x170 [ 455.536256][ T9168] do_syscall_64+0xfa/0xf80 [ 455.536277][ T9168] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.536294][ T9168] ? clear_bhb_loop+0x60/0xb0 [ 455.536315][ T9168] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.536332][ T9168] RIP: 0033:0x7fa4e186f749 [ 455.536347][ T9168] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 455.536361][ T9168] RSP: 002b:00007fa4dfaad038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 455.536381][ T9168] RAX: ffffffffffffffda RBX: 00007fa4e1ac6090 RCX: 00007fa4e186f749 [ 455.536394][ T9168] RDX: 0000200000005fc0 RSI: 000000000000890c RDI: 0000000000000003 [ 455.536405][ T9168] RBP: 00007fa4dfaad090 R08: 0000000000000000 R09: 0000000000000000 [ 455.536417][ T9168] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 455.536427][ T9168] R13: 00007fa4e1ac6128 R14: 00007fa4e1ac6090 R15: 00007fffb08c7888 [ 455.536458][ T9168] [ 455.567937][ T9168] ERROR: Out of memory at tomoyo_realpath_from_path. [ 455.996845][ T9169] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 456.000975][ T9169] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 456.348477][ T825] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 456.500849][ T825] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 456.500874][ T825] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 456.502402][ T825] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 456.502427][ T825] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 456.502445][ T825] usb 2-1: SerialNumber: syz [ 456.734323][ T9175] loop2: detected capacity change from 0 to 7 [ 456.796655][ T825] usb 2-1: 0:2 : does not exist [ 456.797072][ T825] usb 2-1: unit 5: unexpected type 0x09 [ 456.854415][ T825] usb 2-1: USB disconnect, device number 45 [ 456.918195][ T7636] Dev loop2: unable to read RDB block 7 [ 456.920255][ T7636] loop2: unable to read partition table [ 456.924399][ T7636] loop2: partition table beyond EOD, truncated [ 456.974912][ T5859] udevd[5859]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 457.196124][ T9175] Dev loop2: unable to read RDB block 7 [ 457.196261][ T9175] loop2: unable to read partition table [ 457.197694][ T9175] loop2: partition table beyond EOD, truncated [ 457.197735][ T9175] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 457.740708][ T7916] pwc: recv_control_msg error -71 req 04 val 1000 [ 457.748727][ T7916] pwc: recv_control_msg error -71 req 04 val 1300 [ 457.758485][ T7916] pwc: recv_control_msg error -71 req 04 val 1400 [ 457.758988][ T7916] pwc: recv_control_msg error -71 req 02 val 2000 [ 457.759556][ T7916] pwc: recv_control_msg error -71 req 02 val 2100 [ 457.760340][ T7916] pwc: recv_control_msg error -71 req 04 val 1500 [ 457.760792][ T7916] pwc: recv_control_msg error -71 req 02 val 2500 [ 457.761226][ T7916] pwc: recv_control_msg error -71 req 02 val 2400 [ 457.767464][ T7916] pwc: recv_control_msg error -71 req 02 val 2600 [ 457.767965][ T7916] pwc: recv_control_msg error -71 req 02 val 2900 [ 457.768691][ T7916] pwc: recv_control_msg error -71 req 02 val 2800 [ 457.769344][ T7916] pwc: recv_control_msg error -71 req 04 val 1100 [ 457.769774][ T7916] pwc: recv_control_msg error -71 req 04 val 1200 [ 457.853333][ T7916] pwc: Registered as video103. [ 457.870294][ T7916] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input59 [ 458.011414][ T7916] usb 6-1: USB disconnect, device number 6 [ 458.952415][ T9192] ubi31: attaching mtd0 [ 459.040238][ T9192] ubi31: scanning is finished [ 459.040286][ T9192] ubi31: empty MTD device detected [ 459.875752][ T9198] syz.0.948 (9198): drop_caches: 4 [ 459.893578][ T9192] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 460.058361][ T5985] usb 5-1: new full-speed USB device number 30 using dummy_hcd [ 461.260265][ T5985] usb 5-1: config 0 has an invalid interface number: 128 but max is 0 [ 461.260292][ T5985] usb 5-1: config 0 has no interface number 0 [ 461.260323][ T5985] usb 5-1: config 0 interface 128 has no altsetting 0 [ 461.262777][ T5985] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=95.91 [ 461.262802][ T5985] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.262819][ T5985] usb 5-1: Product: syz [ 461.262830][ T5985] usb 5-1: Manufacturer: syz [ 461.262843][ T5985] usb 5-1: SerialNumber: syz [ 461.268163][ T5985] usb 5-1: config 0 descriptor?? [ 461.352429][ T5985] radio-si470x 5-1:0.128: could not find interrupt in endpoint [ 461.352519][ T5985] radio-si470x 5-1:0.128: probe with driver radio-si470x failed with error -5 [ 461.353031][ T5985] usbhid 5-1:0.128: couldn't find an input interrupt endpoint [ 461.572879][ T5985] usb 5-1: USB disconnect, device number 30 [ 463.045479][ T37] kauditd_printk_skb: 694 callbacks suppressed [ 463.045497][ T37] audit: type=1326 audit(1765017428.189:706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9225 comm="syz.4.958" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b1741f749 code=0x7ffc0000 [ 463.046141][ T37] audit: type=1326 audit(1765017428.189:707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9225 comm="syz.4.958" exe="/root/syz-executor" sig=0 arch=c000003e syscall=264 compat=0 ip=0x7f0b1741f749 code=0x7ffc0000 [ 463.117922][ T37] audit: type=1326 audit(1765017428.189:708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9225 comm="syz.4.958" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b1741f749 code=0x7ffc0000 [ 463.118528][ T37] audit: type=1326 audit(1765017428.259:709): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9225 comm="syz.4.958" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f0b1741df90 code=0x7ffc0000 [ 463.118788][ T37] audit: type=1326 audit(1765017428.269:710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9225 comm="syz.4.958" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b1741f749 code=0x7ffc0000 [ 463.128516][ T37] audit: type=1326 audit(1765017428.269:711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9225 comm="syz.4.958" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b1741f749 code=0x7ffc0000 [ 463.128834][ T37] audit: type=1326 audit(1765017428.279:712): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9225 comm="syz.4.958" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f0b1741df90 code=0x7ffc0000 [ 463.158423][ T37] audit: type=1326 audit(1765017428.279:713): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9225 comm="syz.4.958" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b1741f749 code=0x7ffc0000 [ 463.162347][ T37] audit: type=1326 audit(1765017428.309:714): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9225 comm="syz.4.958" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b1741f749 code=0x7ffc0000 [ 463.198339][ T37] audit: type=1326 audit(1765017428.329:715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9225 comm="syz.4.958" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0b1741f749 code=0x7ffc0000 [ 463.633746][ T6185] Process accounting resumed [ 465.133520][ T9224] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 465.251065][ T9245] ======================================================= [ 465.251065][ T9245] WARNING: The mand mount option has been deprecated and [ 465.251065][ T9245] and is ignored by this kernel. Remove the mand [ 465.251065][ T9245] option from the mount to silence this warning. [ 465.251065][ T9245] ======================================================= [ 465.251218][ T9245] new mount options do not match the existing superblock, will be ignored [ 466.360920][ T9246] IPVS: Error connecting to the multicast addr [ 466.421663][ T9250] netlink: 36 bytes leftover after parsing attributes in process `syz.0.966'. [ 466.758363][ T6185] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 466.910757][ T6185] usb 6-1: config 0 has an invalid interface number: 128 but max is 0 [ 466.910784][ T6185] usb 6-1: config 0 has no interface number 0 [ 466.910815][ T6185] usb 6-1: config 0 interface 128 has no altsetting 0 [ 466.914385][ T6185] usb 6-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=95.91 [ 466.914412][ T6185] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.914431][ T6185] usb 6-1: Product: syz [ 466.914444][ T6185] usb 6-1: Manufacturer: syz [ 466.914457][ T6185] usb 6-1: SerialNumber: syz [ 466.975856][ T6185] usb 6-1: config 0 descriptor?? [ 466.995017][ T6185] radio-si470x 6-1:0.128: could not find interrupt in endpoint [ 466.995096][ T6185] radio-si470x 6-1:0.128: probe with driver radio-si470x failed with error -5 [ 466.995565][ T6185] usbhid 6-1:0.128: couldn't find an input interrupt endpoint [ 467.030149][ T5985] Process accounting resumed [ 467.182454][ T6185] usb 6-1: USB disconnect, device number 7 [ 467.678447][ T6185] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 467.728581][ T5985] Process accounting resumed [ 467.802752][ T9274] loop6: detected capacity change from 0 to 524279808 [ 467.805086][ T9281] FAULT_INJECTION: forcing a failure. [ 467.805086][ T9281] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 467.805119][ T9281] CPU: 0 UID: 0 PID: 9281 Comm: syz.4.976 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 467.805144][ T9281] Tainted: [L]=SOFTLOCKUP [ 467.805150][ T9281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 467.805161][ T9281] Call Trace: [ 467.805168][ T9281] [ 467.805176][ T9281] dump_stack_lvl+0x189/0x250 [ 467.805202][ T9281] ? __pfx____ratelimit+0x10/0x10 [ 467.805222][ T9281] ? __pfx_dump_stack_lvl+0x10/0x10 [ 467.805243][ T9281] ? __pfx__printk+0x10/0x10 [ 467.805261][ T9281] ? __might_fault+0xb0/0x130 [ 467.805292][ T9281] should_fail_ex+0x46c/0x600 [ 467.805322][ T9281] _copy_to_iter+0x1de/0x1790 [ 467.805346][ T9281] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 467.805374][ T9281] ? __pfx__copy_to_iter+0x10/0x10 [ 467.805402][ T9281] ? rtlock_slowlock_locked+0xd8/0x4010 [ 467.805424][ T9281] __skb_datagram_iter+0x41a/0x990 [ 467.805443][ T9281] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 467.805466][ T9281] skb_copy_datagram_iter+0xb5/0x210 [ 467.805486][ T9281] tcp_recvmsg_locked+0xec6/0x35f0 [ 467.805522][ T9281] ? rtlock_slowlock_locked+0xd8/0x4010 [ 467.805565][ T9281] ? __pfx_tcp_recvmsg_locked+0x10/0x10 [ 467.805588][ T9281] ? __local_bh_enable+0x28c/0x410 [ 467.805605][ T9281] ? reacquire_held_locks+0x121/0x1c0 [ 467.805629][ T9281] ? __pfx___local_bh_enable+0x10/0x10 [ 467.805653][ T9281] ? __local_bh_enable_ip+0x1c0/0x2e0 [ 467.805671][ T9281] ? lockdep_hardirqs_on+0x98/0x140 [ 467.805694][ T9281] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 467.805716][ T9281] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 467.805741][ T9281] ? rt_spin_unlock+0x161/0x200 [ 467.805763][ T9281] ? lock_sock_nested+0x5f/0x130 [ 467.805782][ T9281] ? lock_sock_nested+0xdd/0x130 [ 467.805802][ T9281] tcp_recvmsg+0xec/0x560 [ 467.805822][ T9281] ? kstrtoull+0x12f/0x1d0 [ 467.805855][ T9281] ? __lock_acquire+0x6b6/0x2cf0 [ 467.805876][ T9281] ? __pfx_tcp_recvmsg+0x10/0x10 [ 467.805907][ T9281] ? sock_rps_record_flow+0x19/0x410 [ 467.805933][ T9281] inet_recvmsg+0x147/0x250 [ 467.805959][ T9281] ? __pfx_inet_recvmsg+0x10/0x10 [ 467.805983][ T9281] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 467.806004][ T9281] ? security_socket_recvmsg+0x7e/0x2e0 [ 467.806029][ T9281] sock_recvmsg+0x1a8/0x270 [ 467.806054][ T9281] __sys_recvfrom+0x206/0x350 [ 467.806078][ T9281] ? __pfx___sys_recvfrom+0x10/0x10 [ 467.806126][ T9281] ? ksys_write+0x230/0x260 [ 467.806150][ T9281] ? __pfx_ksys_write+0x10/0x10 [ 467.806174][ T9281] __x64_sys_recvfrom+0xde/0x100 [ 467.806199][ T9281] do_syscall_64+0xfa/0xf80 [ 467.806219][ T9281] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.806236][ T9281] ? clear_bhb_loop+0x60/0xb0 [ 467.806257][ T9281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.806274][ T9281] RIP: 0033:0x7f0b1741f749 [ 467.806289][ T9281] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 467.806305][ T9281] RSP: 002b:00007f0b1565d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002d [ 467.806324][ T9281] RAX: ffffffffffffffda RBX: 00007f0b17676090 RCX: 00007f0b1741f749 [ 467.806338][ T9281] RDX: fffffffffffffd0b RSI: 0000200000000080 RDI: 0000000000000003 [ 467.806350][ T9281] RBP: 00007f0b1565d090 R08: 0000000000000000 R09: fffffffffffffd25 [ 467.806363][ T9281] R10: 0000000000000700 R11: 0000000000000246 R12: 0000000000000001 [ 467.806373][ T9281] R13: 00007f0b17676128 R14: 00007f0b17676090 R15: 00007ffeac5baf48 [ 467.806405][ T9281] [ 467.855616][ T6185] usb 1-1: Using ep0 maxpacket: 16 [ 467.864651][ T9280] 9pnet: Limiting 'msize' to 1048576 as this is the maximum supported by transport fd [ 467.889055][ T6185] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 467.889086][ T6185] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 467.956402][ T9274] loop6: detected capacity change from 524279808 to 1 [ 467.986155][ T9283] netlink: 36 bytes leftover after parsing attributes in process `syz.5.979'. [ 467.988571][ T6185] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 467.988598][ T6185] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.988617][ T6185] usb 1-1: Product: syz [ 467.988630][ T6185] usb 1-1: Manufacturer: syz [ 467.988643][ T6185] usb 1-1: SerialNumber: syz [ 468.030368][ T9274] Dev loop6: unable to read RDB block 1 [ 468.030432][ T9274] loop6: unable to read partition table [ 468.030649][ T9274] loop6: partition table beyond EOD, truncated [ 468.032897][ T9274] loop_reread_partitions: partition scan of loop6 (u0v ) failed (rc=-5) [ 468.807687][ T6185] usb 1-1: config 0 descriptor?? [ 469.159342][ T9286] delete_channel: no stack [ 469.220085][ T5985] Process accounting resumed [ 469.520641][ T6185] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 469.520675][ T6185] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 470.752153][ T6185] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 470.758406][ T6185] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 470.761728][ T6185] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 470.761749][ T6185] em28xx 1-1:0.0: No AC97 audio processor [ 471.094019][ T8277] block nbd1: Possible stuck request ffff888024d47000: control (read@0,1024B). Runtime 210 seconds [ 471.094064][ T8277] block nbd1: Possible stuck request ffff888024d471c0: control (read@1024,1024B). Runtime 210 seconds [ 471.094090][ T8277] block nbd1: Possible stuck request ffff888024d47380: control (read@2048,1024B). Runtime 210 seconds [ 471.094115][ T8277] block nbd1: Possible stuck request ffff888024d47540: control (read@3072,1024B). Runtime 210 seconds [ 471.137667][ T5985] Process accounting resumed [ 471.721296][ T6185] usb 1-1: USB disconnect, device number 44 [ 471.769987][ T6185] em28xx 1-1:0.0: Disconnecting em28xx [ 471.825403][ T6185] em28xx 1-1:0.0: Freeing device [ 472.178390][ T8366] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 472.184317][ T9321] netlink: 36 bytes leftover after parsing attributes in process `syz.1.990'. [ 472.458344][ T8366] usb 6-1: Using ep0 maxpacket: 16 [ 472.549397][ T9331] delete_channel: no stack [ 472.631424][ T8366] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 472.631482][ T8366] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 472.631503][ T8366] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 472.635586][ T8366] usb 6-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice=f6.59 [ 472.635615][ T8366] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.635634][ T8366] usb 6-1: Product: syz [ 472.635646][ T8366] usb 6-1: Manufacturer: syz [ 472.635659][ T8366] usb 6-1: SerialNumber: syz [ 472.878093][ T8366] usb 6-1: config 0 descriptor?? [ 472.926307][ T8366] peak_usb 6-1:0.0 can0: sending cmd f=0x6 n=0x1 failure: -8 [ 472.926333][ T8366] peak_usb 6-1:0.0: unable to read PCAN-USB serial number (err -8) [ 473.506952][ T9338] input: syz1 as /devices/virtual/input/input60 [ 474.472582][ T825] Process accounting resumed [ 475.500220][ T8366] peak_usb 6-1:0.0: probe with driver peak_usb failed with error -8 [ 475.582564][ T8366] usb 6-1: USB disconnect, device number 8 [ 477.002334][ T9359] veth1_macvtap: left promiscuous mode [ 477.113445][ T6027] Process accounting resumed [ 477.448711][ T8366] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 478.789169][ T5985] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 478.868334][ T8366] usb 6-1: Using ep0 maxpacket: 16 [ 478.871330][ T8366] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 478.871387][ T8366] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 478.871407][ T8366] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 478.875614][ T8366] usb 6-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice=f6.59 [ 478.875640][ T8366] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.875659][ T8366] usb 6-1: Product: syz [ 478.875672][ T8366] usb 6-1: Manufacturer: syz [ 478.875685][ T8366] usb 6-1: SerialNumber: syz [ 478.941040][ T5985] usb 5-1: config 0 has an invalid descriptor of length 138, skipping remainder of the config [ 478.941092][ T5985] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 478.941112][ T5985] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 150, changing to 11 [ 478.941134][ T5985] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 24814, setting to 1024 [ 478.941156][ T5985] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 478.943625][ T5985] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 478.943650][ T5985] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.943666][ T5985] usb 5-1: Product: syz [ 478.943677][ T5985] usb 5-1: Manufacturer: syz [ 478.943690][ T5985] usb 5-1: SerialNumber: syz [ 479.040258][ T8366] usb 6-1: config 0 descriptor?? [ 479.051595][ T5985] usb 5-1: config 0 descriptor?? [ 479.071922][ T5985] garmin_gps 5-1:0.0: Garmin GPS usb/tty converter detected [ 479.103365][ T5985] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -8 [ 479.108402][ T5985] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -8 [ 479.144720][ T8366] peak_usb 6-1:0.0 can0: sending cmd f=0x6 n=0x1 failure: -8 [ 479.144749][ T8366] peak_usb 6-1:0.0: unable to read PCAN-USB serial number (err -8) [ 479.318924][ T8366] peak_usb 6-1:0.0: probe with driver peak_usb failed with error -8 [ 479.329106][ T7916] usb 5-1: USB disconnect, device number 31 [ 479.332349][ T7916] garmin_gps 5-1:0.0: device disconnected [ 479.370932][ T8366] usb 6-1: USB disconnect, device number 9 [ 479.418513][ T6185] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 479.571254][ T6185] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 479.571279][ T6185] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 479.573536][ T6185] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 479.573561][ T6185] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 479.573577][ T6185] usb 7-1: SerialNumber: syz [ 479.820599][ T6185] usb 7-1: 0:2 : does not exist [ 479.840299][ T6185] usb 7-1: 5:0: failed to get current value for ch 1 (-22) [ 479.872323][ T6185] usb 7-1: 5:0: failed to get current value for ch 0 (-22) [ 479.912246][ T6185] usb 7-1: 5:0: cannot get min/max values for control 2 (id 5) [ 479.968386][ T59] block nbd0: Possible stuck request ffff888024d17000: control (read@0,1024B). Runtime 360 seconds [ 479.968438][ T59] block nbd0: Possible stuck request ffff888024d171c0: control (read@1024,1024B). Runtime 360 seconds [ 479.968465][ T59] block nbd0: Possible stuck request ffff888024d17380: control (read@2048,1024B). Runtime 360 seconds [ 479.968490][ T59] block nbd0: Possible stuck request ffff888024d17540: control (read@3072,1024B). Runtime 360 seconds [ 479.968590][ T8689] block nbd2: Possible stuck request ffff888024d70000: control (read@0,1024B). Runtime 210 seconds [ 479.968624][ T8689] block nbd2: Possible stuck request ffff888024d701c0: control (read@1024,1024B). Runtime 210 seconds [ 479.968650][ T8689] block nbd2: Possible stuck request ffff888024d70380: control (read@2048,1024B). Runtime 210 seconds [ 479.968677][ T8689] block nbd2: Possible stuck request ffff888024d70540: control (read@3072,1024B). Runtime 210 seconds [ 480.095495][ T6185] usb 7-1: USB disconnect, device number 6 [ 480.226349][ T5472] veth1_macvtap: entered promiscuous mode [ 480.573874][ T5859] udevd[5859]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 480.822945][ T6185] Process accounting resumed [ 481.488460][ T10] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 481.642414][ T10] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 481.642440][ T10] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 481.644832][ T10] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 481.644858][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 481.644875][ T10] usb 7-1: SerialNumber: syz [ 482.621635][ T6027] Process accounting resumed [ 482.712795][ T10] usb 7-1: 0:2 : does not exist [ 482.749396][ T10] usb 7-1: USB disconnect, device number 7 [ 482.887781][ T5859] udevd[5859]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 483.865494][ T8277] block nbd3: Possible stuck request ffff888024dd7000: control (read@0,1024B). Runtime 210 seconds [ 483.865538][ T8277] block nbd3: Possible stuck request ffff888024dd71c0: control (read@1024,1024B). Runtime 210 seconds [ 483.865566][ T8277] block nbd3: Possible stuck request ffff888024dd7380: control (read@2048,1024B). Runtime 210 seconds [ 483.865592][ T8277] block nbd3: Possible stuck request ffff888024dd7540: control (read@3072,1024B). Runtime 210 seconds [ 483.928502][ T6027] usb 1-1: new full-speed USB device number 45 using dummy_hcd [ 483.939220][ T7916] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 484.080904][ T6027] usb 1-1: config 0 has an invalid interface number: 128 but max is 0 [ 484.080934][ T6027] usb 1-1: config 0 has no interface number 0 [ 484.080964][ T6027] usb 1-1: config 0 interface 128 has no altsetting 0 [ 484.086917][ T6027] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=95.91 [ 484.086946][ T6027] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.086964][ T6027] usb 1-1: Product: syz [ 484.086976][ T6027] usb 1-1: Manufacturer: syz [ 484.086999][ T6027] usb 1-1: SerialNumber: syz [ 484.091252][ T7916] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 484.091281][ T7916] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 484.122478][ T6027] usb 1-1: config 0 descriptor?? [ 484.151055][ T7916] usb 2-1: config 0 descriptor?? [ 484.156574][ T6027] radio-si470x 1-1:0.128: could not find interrupt in endpoint [ 484.156651][ T6027] radio-si470x 1-1:0.128: probe with driver radio-si470x failed with error -5 [ 484.157114][ T6027] usbhid 1-1:0.128: couldn't find an input interrupt endpoint [ 484.328544][ T6132] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 484.371796][ T6027] usb 1-1: USB disconnect, device number 45 [ 484.397948][ T7916] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 484.647071][ T9457] input: syz1 as /devices/virtual/input/input61 [ 485.674819][ T6132] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 485.674849][ T6132] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.785373][ T7916] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 2 [ 485.785397][ T7916] [drm] Initialized udl on minor 2 [ 485.855986][ T6132] usb 5-1: config 0 descriptor?? [ 485.961903][ T7916] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 485.962421][ T7916] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 486.000851][ T43] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 486.012128][ T43] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 486.033956][ T7916] usb 2-1: USB disconnect, device number 46 [ 486.048898][ T43] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 486.061023][ T6132] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 486.286944][ T6132] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 3 [ 486.286969][ T6132] [drm] Initialized udl on minor 3 [ 487.150812][ T6132] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 487.151316][ T6132] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 487.162883][ T7972] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 487.165680][ T7972] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 487.165913][ T7972] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 487.367573][ T10] Process accounting resumed [ 487.425346][ T9479] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1028'. [ 487.442233][ T6132] usb 5-1: USB disconnect, device number 32 [ 489.819117][ T9497] FAULT_INJECTION: forcing a failure. [ 489.819117][ T9497] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 489.819154][ T9497] CPU: 0 UID: 0 PID: 9497 Comm: syz.1.1035 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 489.819179][ T9497] Tainted: [L]=SOFTLOCKUP [ 489.819185][ T9497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 489.819196][ T9497] Call Trace: [ 489.819204][ T9497] [ 489.819212][ T9497] dump_stack_lvl+0x189/0x250 [ 489.819241][ T9497] ? __pfx____ratelimit+0x10/0x10 [ 489.819261][ T9497] ? __pfx_dump_stack_lvl+0x10/0x10 [ 489.819283][ T9497] ? __pfx__printk+0x10/0x10 [ 489.819313][ T9497] should_fail_ex+0x46c/0x600 [ 489.819343][ T9497] _copy_from_user+0x2d/0xb0 [ 489.819363][ T9497] __copy_msghdr+0x3c5/0x5b0 [ 489.819392][ T9497] ___sys_sendmsg+0x1a5/0x2a0 [ 489.819418][ T9497] ? __pfx____sys_sendmsg+0x10/0x10 [ 489.819477][ T9497] ? __fget_files+0x2a/0x420 [ 489.819494][ T9497] ? __fget_files+0x3a6/0x420 [ 489.819521][ T9497] __x64_sys_sendmsg+0x1a1/0x260 [ 489.819545][ T9497] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 489.819572][ T9497] ? __pfx_ksys_write+0x10/0x10 [ 489.819598][ T9497] ? do_syscall_64+0xbe/0xf80 [ 489.819622][ T9497] do_syscall_64+0xfa/0xf80 [ 489.819641][ T9497] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.819659][ T9497] ? clear_bhb_loop+0x60/0xb0 [ 489.819680][ T9497] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.819696][ T9497] RIP: 0033:0x7fa4e186f749 [ 489.819711][ T9497] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 489.819725][ T9497] RSP: 002b:00007fa4dface038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 489.819744][ T9497] RAX: ffffffffffffffda RBX: 00007fa4e1ac5fa0 RCX: 00007fa4e186f749 [ 489.819756][ T9497] RDX: 0000000000000000 RSI: 0000200000001180 RDI: 0000000000000003 [ 489.819768][ T9497] RBP: 00007fa4dface090 R08: 0000000000000000 R09: 0000000000000000 [ 489.819787][ T9497] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 489.819799][ T9497] R13: 00007fa4e1ac6038 R14: 00007fa4e1ac5fa0 R15: 00007fffb08c7888 [ 489.819829][ T9497] [ 490.023051][ T9502] input: syz1 as /devices/virtual/input/input62 [ 491.192668][ T9508] delete_channel: no stack [ 491.344397][ T6265] Process accounting resumed [ 491.576079][ T9519] input: syz1 as /devices/virtual/input/input63 [ 493.714965][ T9509] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 495.384087][ T9549] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.384619][ T9549] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.598351][ T805] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 495.808412][ T805] usb 5-1: Using ep0 maxpacket: 32 [ 495.818145][ T805] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 495.818204][ T805] usb 5-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 495.818597][ T805] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.864757][ T805] usb 5-1: config 0 descriptor?? [ 495.963107][ T805] dvb-usb: found a 'TeVii S662' in warm state. [ 495.964323][ T805] dw2102: su3000_power_ctrl: 1, initialized 0 [ 496.013228][ T805] dvb-usb: bulk message failed: -22 (2/0) [ 496.816239][ T805] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 496.852010][ T805] dvbdev: DVB: registering new adapter (TeVii S662) [ 496.852068][ T805] usb 5-1: media controller created [ 496.852762][ T805] dvb-usb: bulk message failed: -22 (6/0) [ 496.852774][ T805] dw2102: i2c transfer failed. [ 496.852788][ T805] dvb-usb: bulk message failed: -22 (6/0) [ 496.852802][ T805] dw2102: i2c transfer failed. [ 496.852812][ T805] dvb-usb: bulk message failed: -22 (6/0) [ 496.852818][ T805] dw2102: i2c transfer failed. [ 496.852826][ T805] dvb-usb: bulk message failed: -22 (6/0) [ 496.852833][ T805] dw2102: i2c transfer failed. [ 496.852841][ T805] dvb-usb: bulk message failed: -22 (6/0) [ 496.852848][ T805] dw2102: i2c transfer failed. [ 496.852856][ T805] dvb-usb: bulk message failed: -22 (6/0) [ 496.852863][ T805] dw2102: i2c transfer failed. [ 496.852867][ T805] dvb-usb: MAC address: 02:02:02:02:02:02 [ 497.110869][ T9562] input: syz1 as /devices/virtual/input/input64 [ 497.900812][ T9558] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1050'. [ 497.934923][ T7972] Process accounting resumed [ 497.969212][ T805] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 498.221836][ T805] dvb-usb: bulk message failed: -22 (3/0) [ 498.221860][ T805] dw2102: command 0x0e transfer failed. [ 498.221870][ T805] dvb-usb: bulk message failed: -22 (3/0) [ 498.221882][ T805] dw2102: command 0x0e transfer failed. [ 498.576721][ T805] dvb-usb: bulk message failed: -22 (3/0) [ 498.576748][ T805] dw2102: command 0x0e transfer failed. [ 498.576757][ T805] dvb-usb: bulk message failed: -22 (3/0) [ 498.576770][ T805] dw2102: command 0x0e transfer failed. [ 498.576778][ T805] dvb-usb: bulk message failed: -22 (1/0) [ 498.576791][ T805] dw2102: command 0x51 transfer failed. [ 498.576799][ T805] dvb-usb: bulk message failed: -22 (5/0) [ 498.576811][ T805] dw2102: i2c probe for address 0x68 failed. [ 498.576822][ T805] dvb-usb: bulk message failed: -22 (5/0) [ 498.576833][ T805] dw2102: i2c probe for address 0x69 failed. [ 498.576842][ T805] dvb-usb: bulk message failed: -22 (5/0) [ 498.576851][ T805] dw2102: i2c probe for address 0x6a failed. [ 498.576860][ T805] dw2102: probing for demodulator failed. Is the external power switched on? [ 498.576869][ T805] dvb-usb: no frontend was attached by 'TeVii S662' [ 499.950313][ T805] rc_core: IR keymap rc-tt-1500 not found [ 499.950333][ T805] Registered IR keymap rc-empty [ 499.982440][ T805] rc rc0: TeVii S662 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 499.986370][ T805] input: TeVii S662 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input65 [ 500.041218][ T805] dvb-usb: schedule remote query interval to 250 msecs. [ 500.041244][ T805] dw2102: su3000_power_ctrl: 0, initialized 1 [ 500.041257][ T805] dvb-usb: TeVii S662 successfully initialized and connected. [ 500.855696][ T805] usb 5-1: USB disconnect, device number 33 [ 501.422243][ T805] dvb-usb: TeVii S662 successfully deinitialized and disconnected. [ 501.693437][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.693545][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.728362][ T8277] block nbd1: Possible stuck request ffff888024d47000: control (read@0,1024B). Runtime 240 seconds [ 501.728409][ T8277] block nbd1: Possible stuck request ffff888024d471c0: control (read@1024,1024B). Runtime 240 seconds [ 501.728435][ T8277] block nbd1: Possible stuck request ffff888024d47380: control (read@2048,1024B). Runtime 240 seconds [ 501.728460][ T8277] block nbd1: Possible stuck request ffff888024d47540: control (read@3072,1024B). Runtime 240 seconds [ 502.207122][ T9632] delete_channel: no stack [ 503.266725][ T9639] FAULT_INJECTION: forcing a failure. [ 503.266725][ T9639] name failslab, interval 1, probability 0, space 0, times 0 [ 503.266757][ T9639] CPU: 0 UID: 0 PID: 9639 Comm: syz.5.1070 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 503.266781][ T9639] Tainted: [L]=SOFTLOCKUP [ 503.266788][ T9639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 503.266798][ T9639] Call Trace: [ 503.266805][ T9639] [ 503.266813][ T9639] dump_stack_lvl+0x189/0x250 [ 503.266838][ T9639] ? __pfx____ratelimit+0x10/0x10 [ 503.266858][ T9639] ? __pfx_dump_stack_lvl+0x10/0x10 [ 503.266878][ T9639] ? __pfx__printk+0x10/0x10 [ 503.266901][ T9639] ? __pfx___might_resched+0x10/0x10 [ 503.266917][ T9639] ? fs_reclaim_acquire+0x7d/0x100 [ 503.266946][ T9639] should_fail_ex+0x46c/0x600 [ 503.266975][ T9639] should_failslab+0xa8/0x100 [ 503.267001][ T9639] __kmalloc_noprof+0xe0/0x7e0 [ 503.267024][ T9639] ? tomoyo_encode+0x28b/0x550 [ 503.267048][ T9639] tomoyo_encode+0x28b/0x550 [ 503.267072][ T9639] tomoyo_realpath_from_path+0x58d/0x5d0 [ 503.267094][ T9639] ? tomoyo_domain+0xd9/0x130 [ 503.267119][ T9639] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 503.267143][ T9639] tomoyo_path_number_perm+0x1e8/0x5a0 [ 503.267168][ T9639] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 503.267205][ T9639] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 503.267226][ T9639] ? lockdep_hardirqs_on+0x98/0x140 [ 503.267274][ T9639] ? __fget_files+0x2a/0x420 [ 503.267297][ T9639] ? __fget_files+0x3a6/0x420 [ 503.267313][ T9639] ? __fget_files+0x2a/0x420 [ 503.267334][ T9639] security_file_ioctl+0xcb/0x2d0 [ 503.267361][ T9639] __se_sys_ioctl+0x47/0x170 [ 503.267385][ T9639] do_syscall_64+0xfa/0xf80 [ 503.267405][ T9639] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.267423][ T9639] ? clear_bhb_loop+0x60/0xb0 [ 503.267442][ T9639] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.267459][ T9639] RIP: 0033:0x7f201830f749 [ 503.267476][ T9639] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 503.267491][ T9639] RSP: 002b:00007f201656e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 503.267511][ T9639] RAX: ffffffffffffffda RBX: 00007f2018565fa0 RCX: 00007f201830f749 [ 503.267524][ T9639] RDX: 0000200000000080 RSI: 00000000400448e7 RDI: 0000000000000004 [ 503.267535][ T9639] RBP: 00007f201656e090 R08: 0000000000000000 R09: 0000000000000000 [ 503.267547][ T9639] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 503.267558][ T9639] R13: 00007f2018566038 R14: 00007f2018565fa0 R15: 00007ffd0e0acd58 [ 503.267589][ T9639] [ 503.267607][ T9639] ERROR: Out of memory at tomoyo_realpath_from_path. [ 509.207112][ T5985] Process accounting resumed [ 509.501957][ T9680] input: syz1 as /devices/virtual/input/input66 [ 510.442293][ T8689] block nbd0: Possible stuck request ffff888024d17000: control (read@0,1024B). Runtime 390 seconds [ 510.442339][ T8689] block nbd0: Possible stuck request ffff888024d171c0: control (read@1024,1024B). Runtime 390 seconds [ 510.442366][ T8689] block nbd0: Possible stuck request ffff888024d17380: control (read@2048,1024B). Runtime 390 seconds [ 510.442407][ T8689] block nbd0: Possible stuck request ffff888024d17540: control (read@3072,1024B). Runtime 390 seconds [ 510.443838][ T59] block nbd2: Possible stuck request ffff888024d70000: control (read@0,1024B). Runtime 240 seconds [ 510.443880][ T59] block nbd2: Possible stuck request ffff888024d701c0: control (read@1024,1024B). Runtime 240 seconds [ 510.443907][ T59] block nbd2: Possible stuck request ffff888024d70380: control (read@2048,1024B). Runtime 240 seconds [ 510.443934][ T59] block nbd2: Possible stuck request ffff888024d70540: control (read@3072,1024B). Runtime 240 seconds [ 510.830542][ T9702] FAULT_INJECTION: forcing a failure. [ 510.830542][ T9702] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 510.830576][ T9702] CPU: 1 UID: 0 PID: 9702 Comm: syz.0.1089 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 510.830600][ T9702] Tainted: [L]=SOFTLOCKUP [ 510.830607][ T9702] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 510.830618][ T9702] Call Trace: [ 510.830625][ T9702] [ 510.830633][ T9702] dump_stack_lvl+0x189/0x250 [ 510.830660][ T9702] ? __pfx____ratelimit+0x10/0x10 [ 510.830679][ T9702] ? __pfx_dump_stack_lvl+0x10/0x10 [ 510.830700][ T9702] ? __pfx__printk+0x10/0x10 [ 510.830732][ T9702] should_fail_ex+0x46c/0x600 [ 510.830762][ T9702] _copy_to_user+0x31/0xb0 [ 510.830784][ T9702] simple_read_from_buffer+0xe1/0x170 [ 510.830814][ T9702] proc_fail_nth_read+0x1b6/0x220 [ 510.830840][ T9702] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 510.830865][ T9702] ? rw_verify_area+0x2ac/0x4e0 [ 510.830886][ T9702] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 510.830910][ T9702] vfs_read+0x206/0xa30 [ 510.830939][ T9702] ? __pfx_vfs_read+0x10/0x10 [ 510.830958][ T9702] ? try_to_take_rt_mutex+0x7fd/0xac0 [ 510.830991][ T9702] ? mutex_lock_nested+0x154/0x1d0 [ 510.831013][ T9702] ? fdget_pos+0x253/0x320 [ 510.831039][ T9702] ksys_read+0x14b/0x260 [ 510.831062][ T9702] ? __pfx_ksys_read+0x10/0x10 [ 510.831087][ T9702] ? do_syscall_64+0xbe/0xf80 [ 510.831110][ T9702] do_syscall_64+0xfa/0xf80 [ 510.831130][ T9702] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.831148][ T9702] ? clear_bhb_loop+0x60/0xb0 [ 510.831169][ T9702] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.831186][ T9702] RIP: 0033:0x7f8c16cee15c [ 510.831202][ T9702] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 510.831217][ T9702] RSP: 002b:00007f8c14f56030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 510.831238][ T9702] RAX: ffffffffffffffda RBX: 00007f8c16f45fa0 RCX: 00007f8c16cee15c [ 510.831251][ T9702] RDX: 000000000000000f RSI: 00007f8c14f560a0 RDI: 0000000000000004 [ 510.831262][ T9702] RBP: 00007f8c14f56090 R08: 0000000000000000 R09: 0000000000000000 [ 510.831273][ T9702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 510.831284][ T9702] R13: 00007f8c16f46038 R14: 00007f8c16f45fa0 R15: 00007ffda592cd38 [ 510.831315][ T9702] [ 513.131983][ T5916] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 513.236251][ T6614] Process accounting resumed [ 513.265178][ T9720] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1091'. [ 513.265221][ T9720] openvswitch: netlink: Missing key (keys=200040, expected=2000) [ 513.267279][ T9720] fuse: Bad value for 'user_id' [ 513.267296][ T9720] fuse: Bad value for 'user_id' [ 513.304542][ T5916] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 513.304569][ T5916] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 513.413750][ T5916] usb 2-1: config 0 descriptor?? [ 513.648559][ T5916] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 513.944078][ T9728] input: syz1 as /devices/virtual/input/input67 [ 514.702353][ T61] Bluetooth: hci5: command 0x0406 tx timeout [ 514.741095][ T8277] block nbd3: Possible stuck request ffff888024dd7000: control (read@0,1024B). Runtime 240 seconds [ 514.743383][ T8277] block nbd3: Possible stuck request ffff888024dd71c0: control (read@1024,1024B). Runtime 240 seconds [ 514.743418][ T8277] block nbd3: Possible stuck request ffff888024dd7380: control (read@2048,1024B). Runtime 240 seconds [ 514.743441][ T8277] block nbd3: Possible stuck request ffff888024dd7540: control (read@3072,1024B). Runtime 240 seconds [ 514.860051][ T5916] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 2 [ 514.860077][ T5916] [drm] Initialized udl on minor 2 [ 515.034448][ T5916] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 515.034912][ T5916] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 515.036003][ T6012] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 515.068792][ T6012] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 515.068991][ T6012] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 515.123536][ T5916] usb 2-1: USB disconnect, device number 47 [ 515.243555][ T9735] FAULT_INJECTION: forcing a failure. [ 515.243555][ T9735] name failslab, interval 1, probability 0, space 0, times 0 [ 515.243591][ T9735] CPU: 0 UID: 0 PID: 9735 Comm: syz.6.1096 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 515.243615][ T9735] Tainted: [L]=SOFTLOCKUP [ 515.243622][ T9735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 515.243632][ T9735] Call Trace: [ 515.243639][ T9735] [ 515.243647][ T9735] dump_stack_lvl+0x189/0x250 [ 515.243671][ T9735] ? __pfx____ratelimit+0x10/0x10 [ 515.243691][ T9735] ? __pfx_dump_stack_lvl+0x10/0x10 [ 515.243711][ T9735] ? __pfx__printk+0x10/0x10 [ 515.243734][ T9735] ? __pfx___might_resched+0x10/0x10 [ 515.243756][ T9735] should_fail_ex+0x46c/0x600 [ 515.243783][ T9735] ? __alloc_skb+0x255/0x430 [ 515.243804][ T9735] should_failslab+0xa8/0x100 [ 515.243829][ T9735] ? __alloc_skb+0x255/0x430 [ 515.243847][ T9735] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 515.243877][ T9735] __alloc_skb+0x255/0x430 [ 515.243900][ T9735] ? __pfx___alloc_skb+0x10/0x10 [ 515.243923][ T9735] ? netlink_autobind+0xdb/0x300 [ 515.243939][ T9735] ? netlink_autobind+0x2c2/0x300 [ 515.243959][ T9735] netlink_sendmsg+0x5c6/0xb30 [ 515.243983][ T9735] ? __pfx_netlink_sendmsg+0x10/0x10 [ 515.244005][ T9735] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 515.244025][ T9735] ? __pfx_netlink_sendmsg+0x10/0x10 [ 515.244042][ T9735] __sock_sendmsg+0x21c/0x270 [ 515.244064][ T9735] ____sys_sendmsg+0x508/0x810 [ 515.244101][ T9735] ? __pfx_____sys_sendmsg+0x10/0x10 [ 515.244131][ T9735] ? import_iovec+0x74/0xa0 [ 515.244154][ T9735] ___sys_sendmsg+0x21f/0x2a0 [ 515.244179][ T9735] ? __pfx____sys_sendmsg+0x10/0x10 [ 515.244234][ T9735] ? __fget_files+0x2a/0x420 [ 515.244255][ T9735] ? __fget_files+0x3a6/0x420 [ 515.244281][ T9735] __x64_sys_sendmsg+0x1a1/0x260 [ 515.244307][ T9735] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 515.244338][ T9735] ? __pfx_ksys_write+0x10/0x10 [ 515.244363][ T9735] ? do_syscall_64+0xbe/0xf80 [ 515.244387][ T9735] do_syscall_64+0xfa/0xf80 [ 515.244406][ T9735] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.244423][ T9735] ? clear_bhb_loop+0x60/0xb0 [ 515.244443][ T9735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.244459][ T9735] RIP: 0033:0x7f34bd61f749 [ 515.244476][ T9735] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 515.244491][ T9735] RSP: 002b:00007f34bb886038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 515.244510][ T9735] RAX: ffffffffffffffda RBX: 00007f34bd875fa0 RCX: 00007f34bd61f749 [ 515.244523][ T9735] RDX: 0000000000004000 RSI: 0000200000000200 RDI: 0000000000000004 [ 515.244535][ T9735] RBP: 00007f34bb886090 R08: 0000000000000000 R09: 0000000000000000 [ 515.244546][ T9735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 515.244557][ T9735] R13: 00007f34bd876038 R14: 00007f34bd875fa0 R15: 00007fffab412618 [ 515.244590][ T9735] [ 515.656549][ T9747] FAULT_INJECTION: forcing a failure. [ 515.656549][ T9747] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 515.656587][ T9747] CPU: 0 UID: 0 PID: 9747 Comm: syz.6.1098 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 515.656611][ T9747] Tainted: [L]=SOFTLOCKUP [ 515.656617][ T9747] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 515.656628][ T9747] Call Trace: [ 515.656635][ T9747] [ 515.656642][ T9747] dump_stack_lvl+0x189/0x250 [ 515.656668][ T9747] ? __pfx____ratelimit+0x10/0x10 [ 515.656687][ T9747] ? __pfx_dump_stack_lvl+0x10/0x10 [ 515.656709][ T9747] ? __pfx__printk+0x10/0x10 [ 515.656726][ T9747] ? __might_fault+0xb0/0x130 [ 515.656761][ T9747] should_fail_ex+0x46c/0x600 [ 515.656791][ T9747] _copy_from_user+0x2d/0xb0 [ 515.656811][ T9747] ipv6_flowlabel_opt+0x11d/0x2270 [ 515.656843][ T9747] ? __local_bh_enable+0x27b/0x410 [ 515.656864][ T9747] ? __pfx_ipv6_flowlabel_opt+0x10/0x10 [ 515.656886][ T9747] ? __local_bh_enable+0x28c/0x410 [ 515.656904][ T9747] ? reacquire_held_locks+0x121/0x1c0 [ 515.656929][ T9747] ? __pfx___local_bh_enable+0x10/0x10 [ 515.656956][ T9747] ? __local_bh_enable_ip+0x1c0/0x2e0 [ 515.656975][ T9747] ? lockdep_hardirqs_on+0x98/0x140 [ 515.657005][ T9747] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 515.657031][ T9747] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 515.657056][ T9747] ? rt_spin_unlock+0x161/0x200 [ 515.657079][ T9747] ? lock_sock_nested+0x5f/0x130 [ 515.657099][ T9747] ? lock_sock_nested+0xdd/0x130 [ 515.657120][ T9747] do_ipv6_setsockopt+0xdb0/0x2eb0 [ 515.657149][ T9747] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 515.657185][ T9747] ? __lock_acquire+0x6b6/0x2cf0 [ 515.657213][ T9747] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 515.657233][ T9747] ? lockdep_hardirqs_on+0x98/0x140 [ 515.657252][ T9747] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 515.657272][ T9747] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 515.657313][ T9747] ? __fget_files+0x2a/0x420 [ 515.657336][ T9747] ipv6_setsockopt+0x59/0x170 [ 515.657355][ T9747] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 515.657377][ T9747] do_sock_setsockopt+0x17c/0x1b0 [ 515.657406][ T9747] __x64_sys_setsockopt+0x145/0x1b0 [ 515.657434][ T9747] do_syscall_64+0xfa/0xf80 [ 515.657453][ T9747] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.657471][ T9747] ? clear_bhb_loop+0x60/0xb0 [ 515.657492][ T9747] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.657509][ T9747] RIP: 0033:0x7f34bd61f749 [ 515.657525][ T9747] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 515.657540][ T9747] RSP: 002b:00007f34bb886038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 515.657559][ T9747] RAX: ffffffffffffffda RBX: 00007f34bd875fa0 RCX: 00007f34bd61f749 [ 515.657573][ T9747] RDX: 0000000000000020 RSI: 0000000000000029 RDI: 0000000000000003 [ 515.657585][ T9747] RBP: 00007f34bb886090 R08: 0000000000000020 R09: 0000000000000000 [ 515.657596][ T9747] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000001 [ 515.657607][ T9747] R13: 00007f34bd876038 R14: 00007f34bd875fa0 R15: 00007fffab412618 [ 515.657639][ T9747] [ 516.330650][ T9756] FAULT_INJECTION: forcing a failure. [ 516.330650][ T9756] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 516.330709][ T9756] CPU: 0 UID: 0 PID: 9756 Comm: syz.0.1099 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 516.330735][ T9756] Tainted: [L]=SOFTLOCKUP [ 516.330742][ T9756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 516.330753][ T9756] Call Trace: [ 516.330760][ T9756] [ 516.330768][ T9756] dump_stack_lvl+0x189/0x250 [ 516.330795][ T9756] ? __pfx____ratelimit+0x10/0x10 [ 516.330816][ T9756] ? __pfx_dump_stack_lvl+0x10/0x10 [ 516.330837][ T9756] ? __pfx__printk+0x10/0x10 [ 516.330868][ T9756] should_fail_ex+0x46c/0x600 [ 516.330898][ T9756] _copy_from_user+0x2d/0xb0 [ 516.330924][ T9756] __sys_bpf+0x1e3/0x860 [ 516.330946][ T9756] ? __pfx___sys_bpf+0x10/0x10 [ 516.330962][ T9756] ? rt_mutex_slowunlock+0x1be/0x2e0 [ 516.331007][ T9756] ? rcu_is_watching+0x15/0xb0 [ 516.331030][ T9756] __x64_sys_bpf+0x7c/0x90 [ 516.331049][ T9756] do_syscall_64+0xfa/0xf80 [ 516.331069][ T9756] ? rcu_is_watching+0x15/0xb0 [ 516.331084][ T9756] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.331101][ T9756] ? clear_bhb_loop+0x60/0xb0 [ 516.331121][ T9756] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.331138][ T9756] RIP: 0033:0x7f8c16cef749 [ 516.331154][ T9756] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 516.331169][ T9756] RSP: 002b:00007f8c14f14038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 516.331189][ T9756] RAX: ffffffffffffffda RBX: 00007f8c16f46180 RCX: 00007f8c16cef749 [ 516.331202][ T9756] RDX: 0000000000000094 RSI: 0000200000000840 RDI: 0000000000000005 [ 516.331214][ T9756] RBP: 00007f8c14f14090 R08: 0000000000000000 R09: 0000000000000000 [ 516.331225][ T9756] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 516.331236][ T9756] R13: 00007f8c16f46218 R14: 00007f8c16f46180 R15: 00007ffda592cd38 [ 516.331266][ T9756] [ 517.561336][ T825] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 517.690875][ T825] usb 7-1: device descriptor read/64, error -71 [ 518.870079][ T9774] input: syz1 as /devices/virtual/input/input68 [ 519.653358][ T825] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 519.894610][ T9780] netlink: 'syz.4.1109': attribute type 4 has an invalid length. [ 519.894634][ T9780] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1109'. [ 519.919462][ T9780] .`: renamed from bond0 (while UP) [ 519.951677][ T825] usb 7-1: device descriptor read/64, error -71 [ 520.058884][ T825] usb usb7-port1: attempt power cycle [ 520.081108][ T9787] FAULT_INJECTION: forcing a failure. [ 520.081108][ T9787] name failslab, interval 1, probability 0, space 0, times 0 [ 520.081132][ T9787] CPU: 1 UID: 0 PID: 9787 Comm: syz.1.1110 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 520.081147][ T9787] Tainted: [L]=SOFTLOCKUP [ 520.081151][ T9787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 520.081157][ T9787] Call Trace: [ 520.081161][ T9787] [ 520.081166][ T9787] dump_stack_lvl+0x189/0x250 [ 520.081184][ T9787] ? __pfx____ratelimit+0x10/0x10 [ 520.081195][ T9787] ? __pfx_dump_stack_lvl+0x10/0x10 [ 520.081208][ T9787] ? __pfx__printk+0x10/0x10 [ 520.081221][ T9787] ? __pfx___might_resched+0x10/0x10 [ 520.081232][ T9787] ? fs_reclaim_acquire+0x7d/0x100 [ 520.081250][ T9787] should_fail_ex+0x46c/0x600 [ 520.081267][ T9787] should_failslab+0xa8/0x100 [ 520.081284][ T9787] __kmalloc_noprof+0xe0/0x7e0 [ 520.081298][ T9787] ? tomoyo_encode+0x28b/0x550 [ 520.081313][ T9787] tomoyo_encode+0x28b/0x550 [ 520.081326][ T9787] tomoyo_realpath_from_path+0x58d/0x5d0 [ 520.081343][ T9787] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 520.081358][ T9787] tomoyo_path_number_perm+0x1e8/0x5a0 [ 520.081374][ T9787] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 520.081390][ T9787] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 520.081402][ T9787] ? lockdep_hardirqs_on+0x98/0x140 [ 520.081429][ T9787] ? __fget_files+0x2a/0x420 [ 520.081441][ T9787] ? __fget_files+0x3a6/0x420 [ 520.081450][ T9787] ? __fget_files+0x2a/0x420 [ 520.081462][ T9787] security_file_ioctl+0xcb/0x2d0 [ 520.081479][ T9787] __se_sys_ioctl+0x47/0x170 [ 520.081493][ T9787] do_syscall_64+0xfa/0xf80 [ 520.081505][ T9787] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.081514][ T9787] ? clear_bhb_loop+0x60/0xb0 [ 520.081527][ T9787] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.081536][ T9787] RIP: 0033:0x7fa4e186f749 [ 520.081554][ T9787] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 520.081563][ T9787] RSP: 002b:00007fa4dface038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 520.081574][ T9787] RAX: ffffffffffffffda RBX: 00007fa4e1ac5fa0 RCX: 00007fa4e186f749 [ 520.081582][ T9787] RDX: 0000200000000100 RSI: 00000000c008561b RDI: 0000000000000003 [ 520.081589][ T9787] RBP: 00007fa4dface090 R08: 0000000000000000 R09: 0000000000000000 [ 520.081595][ T9787] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 520.081601][ T9787] R13: 00007fa4e1ac6038 R14: 00007fa4e1ac5fa0 R15: 00007fffb08c7888 [ 520.081617][ T9787] [ 520.081628][ T9787] ERROR: Out of memory at tomoyo_realpath_from_path. [ 524.139825][ T9821] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1119'. [ 524.564976][ T5927] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 525.566188][ T5927] usb 1-1: config 0 has an invalid descriptor of length 138, skipping remainder of the config [ 525.566249][ T5927] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 525.566270][ T5927] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 150, changing to 11 [ 525.566292][ T5927] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 24814, setting to 1024 [ 525.566316][ T5927] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 525.570431][ T5927] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 525.570459][ T5927] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.570487][ T5927] usb 1-1: Product: syz [ 525.570499][ T5927] usb 1-1: Manufacturer: syz [ 525.570512][ T5927] usb 1-1: SerialNumber: syz [ 525.833100][ T5927] usb 1-1: config 0 descriptor?? [ 525.881666][ T5927] garmin_gps 1-1:0.0: Garmin GPS usb/tty converter detected [ 525.883659][ T5927] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -8 [ 525.893073][ T5927] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -8 [ 526.178457][ T5916] usb 1-1: USB disconnect, device number 46 [ 526.201140][ T5916] garmin_gps 1-1:0.0: device disconnected [ 526.458364][ T5964] usb 5-1: new full-speed USB device number 34 using dummy_hcd [ 526.535325][ T5927] usb 2-1: new full-speed USB device number 48 using dummy_hcd [ 526.621053][ T5964] usb 5-1: config 0 has an invalid interface number: 128 but max is 0 [ 526.621080][ T5964] usb 5-1: config 0 has no interface number 0 [ 526.621112][ T5964] usb 5-1: config 0 interface 128 has no altsetting 0 [ 526.624801][ T5964] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=95.91 [ 526.624829][ T5964] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.624847][ T5964] usb 5-1: Product: syz [ 526.624860][ T5964] usb 5-1: Manufacturer: syz [ 526.624873][ T5964] usb 5-1: SerialNumber: syz [ 526.690027][ T5964] usb 5-1: config 0 descriptor?? [ 526.695689][ T5964] radio-si470x 5-1:0.128: could not find interrupt in endpoint [ 526.695767][ T5964] radio-si470x 5-1:0.128: probe with driver radio-si470x failed with error -5 [ 526.696417][ T5964] usbhid 5-1:0.128: couldn't find an input interrupt endpoint [ 526.697770][ T5927] usb 2-1: config 16 has an invalid interface number: 168 but max is 0 [ 526.697793][ T5927] usb 2-1: config 16 has no interface number 0 [ 526.697837][ T5927] usb 2-1: config 16 interface 168 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 526.697861][ T5927] usb 2-1: config 16 interface 168 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 526.697909][ T5927] usb 2-1: New USB device found, idVendor=0586, idProduct=0102, bcdDevice=14.0a [ 526.697929][ T5927] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.722787][ T9846] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 526.736024][ T5927] HFC-S_USB 2-1:16.168: probe with driver HFC-S_USB failed with error -5 [ 526.909562][ T5964] usb 5-1: USB disconnect, device number 34 [ 526.952540][ T5927] usb 2-1: USB disconnect, device number 48 [ 528.855501][ T9863] devpts: Unknown parameter 'usqnota' [ 530.118549][ T5927] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 530.317256][ T5927] usb 6-1: config 0 has an invalid descriptor of length 138, skipping remainder of the config [ 530.317312][ T5927] usb 6-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 530.317331][ T5927] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 150, changing to 11 [ 530.317355][ T5927] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 24814, setting to 1024 [ 530.317378][ T5927] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 530.329107][ T5927] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 530.329134][ T5927] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 530.329150][ T5927] usb 6-1: Product: syz [ 530.329160][ T5927] usb 6-1: Manufacturer: syz [ 530.329172][ T5927] usb 6-1: SerialNumber: syz [ 530.450805][ T5927] usb 6-1: config 0 descriptor?? [ 530.455332][ T5927] garmin_gps 6-1:0.0: Garmin GPS usb/tty converter detected [ 530.457320][ T5927] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -8 [ 530.497836][ T5927] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -8 [ 530.717167][ T5985] usb 6-1: USB disconnect, device number 10 [ 530.733629][ T5985] garmin_gps 6-1:0.0: device disconnected [ 530.970061][ T5819] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 531.118399][ T5819] usb 5-1: Using ep0 maxpacket: 16 [ 531.120828][ T5819] usb 5-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0 [ 531.120855][ T5819] usb 5-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 0 [ 531.120877][ T5819] usb 5-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 531.120902][ T5819] usb 5-1: config 1 interface 0 has no altsetting 0 [ 531.123744][ T5819] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 531.123768][ T5819] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.123786][ T5819] usb 5-1: Product: syz [ 531.123799][ T5819] usb 5-1: Manufacturer: syz [ 531.123812][ T5819] usb 5-1: SerialNumber: syz [ 531.677070][ T5819] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 35 if 0 alt 255 proto 1 vid 0x0525 pid 0xA4A8 [ 531.808406][ T8277] block nbd1: Possible stuck request ffff888024d47000: control (read@0,1024B). Runtime 270 seconds [ 531.808459][ T8277] block nbd1: Possible stuck request ffff888024d471c0: control (read@1024,1024B). Runtime 270 seconds [ 531.808486][ T8277] block nbd1: Possible stuck request ffff888024d47380: control (read@2048,1024B). Runtime 270 seconds [ 531.808564][ T8277] block nbd1: Possible stuck request ffff888024d47540: control (read@3072,1024B). Runtime 270 seconds [ 532.018997][ T9898] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1143'. [ 532.019027][ T9898] openvswitch: netlink: Missing key (keys=200040, expected=2000) [ 532.048444][ T5985] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 532.234558][ T5985] usb 1-1: Using ep0 maxpacket: 16 [ 532.238948][ T5985] usb 1-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0 [ 532.238975][ T5985] usb 1-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 0 [ 532.238997][ T5985] usb 1-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 532.239021][ T5985] usb 1-1: config 1 interface 0 has no altsetting 0 [ 532.241893][ T5985] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 532.241919][ T5985] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 532.241945][ T5985] usb 1-1: Product: syz [ 532.241959][ T5985] usb 1-1: Manufacturer: syz [ 532.241970][ T5985] usb 1-1: SerialNumber: syz [ 532.671717][ T5985] usblp 1-1:1.0: usblp1: USB Unidirectional printer dev 47 if 0 alt 255 proto 1 vid 0x0525 pid 0xA4A8 [ 533.818774][ T9896] mmap: syz.0.1142 (9896) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 533.882472][ T5985] usb 1-1: USB disconnect, device number 47 [ 533.894865][ T5985] usblp1: removed [ 534.008560][ T10] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 534.158486][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 534.163903][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 534.163958][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 534.163978][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 534.168026][ T10] usb 2-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice=f6.59 [ 534.168053][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.168070][ T10] usb 2-1: Product: syz [ 534.168083][ T10] usb 2-1: Manufacturer: syz [ 534.168095][ T10] usb 2-1: SerialNumber: syz [ 534.178956][ T10] usb 2-1: config 0 descriptor?? [ 534.294163][ T10] peak_usb 2-1:0.0 can0: sending cmd f=0x6 n=0x1 failure: -8 [ 534.294203][ T10] peak_usb 2-1:0.0: unable to read PCAN-USB serial number (err -8) [ 534.693212][ T5985] Process accounting resumed [ 534.800495][ T10] peak_usb 2-1:0.0: probe with driver peak_usb failed with error -8 [ 534.859399][ T10] usb 2-1: USB disconnect, device number 49 [ 535.188572][ T9931] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1154'. [ 535.188605][ T9931] openvswitch: netlink: Missing key (keys=200040, expected=2000) [ 537.395969][ T9948] FAULT_INJECTION: forcing a failure. [ 537.395969][ T9948] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 537.395999][ T9948] CPU: 0 UID: 0 PID: 9948 Comm: syz.6.1150 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 537.396019][ T9948] Tainted: [L]=SOFTLOCKUP [ 537.396023][ T9948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 537.396032][ T9948] Call Trace: [ 537.396039][ T9948] [ 537.396045][ T9948] dump_stack_lvl+0x189/0x250 [ 537.396069][ T9948] ? __pfx____ratelimit+0x10/0x10 [ 537.396086][ T9948] ? __pfx_dump_stack_lvl+0x10/0x10 [ 537.396115][ T9948] ? __pfx__printk+0x10/0x10 [ 537.396142][ T9948] should_fail_ex+0x46c/0x600 [ 537.396170][ T9948] _copy_to_user+0x31/0xb0 [ 537.396192][ T9948] simple_read_from_buffer+0xe1/0x170 [ 537.396222][ T9948] proc_fail_nth_read+0x1b6/0x220 [ 537.396247][ T9948] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 537.396270][ T9948] ? rw_verify_area+0x2ac/0x4e0 [ 537.396290][ T9948] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 537.396313][ T9948] vfs_read+0x206/0xa30 [ 537.396339][ T9948] ? __pfx_vfs_read+0x10/0x10 [ 537.396356][ T9948] ? try_to_take_rt_mutex+0x7fd/0xac0 [ 537.396389][ T9948] ? mutex_lock_nested+0x154/0x1d0 [ 537.396411][ T9948] ? fdget_pos+0x253/0x320 [ 537.396436][ T9948] ksys_read+0x14b/0x260 [ 537.396459][ T9948] ? __pfx_ksys_read+0x10/0x10 [ 537.396482][ T9948] ? do_syscall_64+0xbe/0xf80 [ 537.396503][ T9948] do_syscall_64+0xfa/0xf80 [ 537.396523][ T9948] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.396541][ T9948] ? clear_bhb_loop+0x60/0xb0 [ 537.396562][ T9948] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.396578][ T9948] RIP: 0033:0x7f34bd61e15c [ 537.396595][ T9948] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 537.396611][ T9948] RSP: 002b:00007f34bb886030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 537.396630][ T9948] RAX: ffffffffffffffda RBX: 00007f34bd875fa0 RCX: 00007f34bd61e15c [ 537.396643][ T9948] RDX: 000000000000000f RSI: 00007f34bb8860a0 RDI: 0000000000000004 [ 537.396653][ T9948] RBP: 00007f34bb886090 R08: 0000000000000000 R09: 0000000000000000 [ 537.396664][ T9948] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 537.396675][ T9948] R13: 00007f34bd876038 R14: 00007f34bd875fa0 R15: 00007fffab412618 [ 537.396706][ T9948] [ 537.456382][ T9949] FAULT_INJECTION: forcing a failure. [ 537.456382][ T9949] name failslab, interval 1, probability 0, space 0, times 0 [ 537.456416][ T9949] CPU: 0 UID: 0 PID: 9949 Comm: syz.0.1158 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 537.456441][ T9949] Tainted: [L]=SOFTLOCKUP [ 537.456447][ T9949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 537.456457][ T9949] Call Trace: [ 537.456464][ T9949] [ 537.456472][ T9949] dump_stack_lvl+0x189/0x250 [ 537.456497][ T9949] ? __pfx____ratelimit+0x10/0x10 [ 537.456516][ T9949] ? __pfx_dump_stack_lvl+0x10/0x10 [ 537.456536][ T9949] ? __pfx__printk+0x10/0x10 [ 537.456558][ T9949] ? __pfx___might_resched+0x10/0x10 [ 537.456581][ T9949] should_fail_ex+0x46c/0x600 [ 537.456612][ T9949] ? __alloc_skb+0x255/0x430 [ 537.456632][ T9949] should_failslab+0xa8/0x100 [ 537.456657][ T9949] ? __alloc_skb+0x255/0x430 [ 537.456675][ T9949] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 537.456705][ T9949] __alloc_skb+0x255/0x430 [ 537.456729][ T9949] ? __pfx___alloc_skb+0x10/0x10 [ 537.456752][ T9949] ? netlink_autobind+0xdb/0x300 [ 537.456767][ T9949] ? netlink_autobind+0x2c2/0x300 [ 537.456788][ T9949] netlink_sendmsg+0x5c6/0xb30 [ 537.456814][ T9949] ? __pfx_netlink_sendmsg+0x10/0x10 [ 537.456838][ T9949] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 537.456858][ T9949] ? __pfx_netlink_sendmsg+0x10/0x10 [ 537.456875][ T9949] __sock_sendmsg+0x21c/0x270 [ 537.456898][ T9949] ____sys_sendmsg+0x508/0x810 [ 537.456926][ T9949] ? __pfx_____sys_sendmsg+0x10/0x10 [ 537.456958][ T9949] ? import_iovec+0x74/0xa0 [ 537.456980][ T9949] ___sys_sendmsg+0x21f/0x2a0 [ 537.457005][ T9949] ? __pfx____sys_sendmsg+0x10/0x10 [ 537.457060][ T9949] ? __fget_files+0x2a/0x420 [ 537.457075][ T9949] ? __fget_files+0x3a6/0x420 [ 537.457107][ T9949] __x64_sys_sendmsg+0x1a1/0x260 [ 537.457133][ T9949] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 537.457164][ T9949] ? __pfx_ksys_write+0x10/0x10 [ 537.457188][ T9949] ? do_syscall_64+0xbe/0xf80 [ 537.457209][ T9949] do_syscall_64+0xfa/0xf80 [ 537.457227][ T9949] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.457244][ T9949] ? clear_bhb_loop+0x60/0xb0 [ 537.457264][ T9949] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.457281][ T9949] RIP: 0033:0x7f8c16cef749 [ 537.457296][ T9949] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 537.457312][ T9949] RSP: 002b:00007f8c14f56038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 537.457331][ T9949] RAX: ffffffffffffffda RBX: 00007f8c16f45fa0 RCX: 00007f8c16cef749 [ 537.457344][ T9949] RDX: 0000000024008818 RSI: 00002000000002c0 RDI: 0000000000000003 [ 537.457355][ T9949] RBP: 00007f8c14f56090 R08: 0000000000000000 R09: 0000000000000000 [ 537.457366][ T9949] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 537.457376][ T9949] R13: 00007f8c16f46038 R14: 00007f8c16f45fa0 R15: 00007ffda592cd38 [ 537.457405][ T9949] [ 537.648358][ T5819] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 537.808517][ T5819] usb 6-1: config 0 has an invalid descriptor of length 138, skipping remainder of the config [ 537.808572][ T5819] usb 6-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 537.808593][ T5819] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 150, changing to 11 [ 537.808617][ T5819] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 24814, setting to 1024 [ 537.808640][ T5819] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 537.811081][ T5819] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 537.811106][ T5819] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.811124][ T5819] usb 6-1: Product: syz [ 537.811137][ T5819] usb 6-1: Manufacturer: syz [ 537.811150][ T5819] usb 6-1: SerialNumber: syz [ 537.821215][ T5819] usb 6-1: config 0 descriptor?? [ 537.844837][ T5819] garmin_gps 6-1:0.0: Garmin GPS usb/tty converter detected [ 537.870171][ T5819] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -8 [ 537.878171][ T5819] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -8 [ 538.088865][ T6614] usb 6-1: USB disconnect, device number 11 [ 538.100108][ T6614] garmin_gps 6-1:0.0: device disconnected [ 538.530104][ T5819] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 538.668374][ T5819] usb 7-1: device descriptor read/64, error -71 [ 538.689576][ T6614] usb 5-1: USB disconnect, device number 35 [ 538.707384][ T6614] usblp0: removed [ 538.928372][ T5819] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 539.088485][ T5819] usb 7-1: device descriptor read/64, error -71 [ 539.118458][ T5964] usb 2-1: new low-speed USB device number 50 using dummy_hcd [ 539.200937][ T5819] usb usb7-port1: attempt power cycle [ 539.281265][ T5964] usb 2-1: config 0 interface 0 altsetting 252 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 539.281301][ T5964] usb 2-1: config 0 interface 0 has no altsetting 0 [ 539.281326][ T5964] usb 2-1: New USB device found, idVendor=17ef, idProduct=60b5, bcdDevice= 0.00 [ 539.281338][ T5964] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 539.292781][ T5964] usb 2-1: config 0 descriptor?? [ 539.430888][ T9972] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 539.559123][ T5819] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 539.639616][ T5814] Bluetooth: hci2: command 0x0406 tx timeout [ 539.969557][ T5819] usb 7-1: device descriptor read/8, error -71 [ 540.480271][ T5819] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 540.499091][ T5819] usb 7-1: device descriptor read/8, error -71 [ 540.609009][ T5819] usb usb7-port1: unable to enumerate USB device [ 540.724629][ T9981] FAULT_INJECTION: forcing a failure. [ 540.724629][ T9981] name failslab, interval 1, probability 0, space 0, times 0 [ 540.724665][ T9981] CPU: 0 UID: 0 PID: 9981 Comm: syz.4.1167 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 540.724690][ T9981] Tainted: [L]=SOFTLOCKUP [ 540.724697][ T9981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 540.724708][ T9981] Call Trace: [ 540.724716][ T9981] [ 540.724724][ T9981] dump_stack_lvl+0x189/0x250 [ 540.724754][ T9981] ? __pfx____ratelimit+0x10/0x10 [ 540.724773][ T9981] ? __pfx_dump_stack_lvl+0x10/0x10 [ 540.724794][ T9981] ? __pfx__printk+0x10/0x10 [ 540.724818][ T9981] ? __pfx___might_resched+0x10/0x10 [ 540.724845][ T9981] ? fs_reclaim_acquire+0x7d/0x100 [ 540.724871][ T9981] should_fail_ex+0x46c/0x600 [ 540.724899][ T9981] should_failslab+0xa8/0x100 [ 540.724925][ T9981] __kmalloc_noprof+0xe0/0x7e0 [ 540.724948][ T9981] ? sock_kmalloc+0xd6/0x160 [ 540.724970][ T9981] sock_kmalloc+0xd6/0x160 [ 540.724989][ T9981] hash_sendmsg+0x666/0x11d0 [ 540.725031][ T9981] ? __pfx_hash_sendmsg+0x10/0x10 [ 540.725052][ T9981] __sock_sendmsg+0x21c/0x270 [ 540.725075][ T9981] ____sys_sendmsg+0x508/0x810 [ 540.725104][ T9981] ? __pfx_____sys_sendmsg+0x10/0x10 [ 540.725134][ T9981] ? import_iovec+0x74/0xa0 [ 540.725157][ T9981] ___sys_sendmsg+0x21f/0x2a0 [ 540.725181][ T9981] ? __pfx____sys_sendmsg+0x10/0x10 [ 540.725236][ T9981] ? __fget_files+0x2a/0x420 [ 540.725252][ T9981] ? __fget_files+0x3a6/0x420 [ 540.725279][ T9981] __x64_sys_sendmsg+0x1a1/0x260 [ 540.725305][ T9981] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 540.725337][ T9981] ? __pfx_ksys_write+0x10/0x10 [ 540.725363][ T9981] ? do_syscall_64+0xbe/0xf80 [ 540.725385][ T9981] do_syscall_64+0xfa/0xf80 [ 540.725403][ T9981] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.725418][ T9981] ? clear_bhb_loop+0x60/0xb0 [ 540.725438][ T9981] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.725456][ T9981] RIP: 0033:0x7f0b1741f749 [ 540.725471][ T9981] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 540.725487][ T9981] RSP: 002b:00007f0b1567e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 540.725506][ T9981] RAX: ffffffffffffffda RBX: 00007f0b17675fa0 RCX: 00007f0b1741f749 [ 540.725519][ T9981] RDX: 0000000000040000 RSI: 0000200000004480 RDI: 0000000000000004 [ 540.725531][ T9981] RBP: 00007f0b1567e090 R08: 0000000000000000 R09: 0000000000000000 [ 540.725542][ T9981] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 540.725552][ T9981] R13: 00007f0b17676038 R14: 00007f0b17675fa0 R15: 00007ffeac5baf48 [ 540.725581][ T9981] [ 540.768608][ T59] block nbd0: Possible stuck request ffff888024d17000: control (read@0,1024B). Runtime 420 seconds [ 540.768707][ T59] block nbd0: Possible stuck request ffff888024d171c0: control (read@1024,1024B). Runtime 420 seconds [ 540.768744][ T59] block nbd0: Possible stuck request ffff888024d17380: control (read@2048,1024B). Runtime 420 seconds [ 540.768772][ T59] block nbd0: Possible stuck request ffff888024d17540: control (read@3072,1024B). Runtime 420 seconds [ 540.768927][ T8689] block nbd2: Possible stuck request ffff888024d70000: control (read@0,1024B). Runtime 270 seconds [ 540.769012][ T8689] block nbd2: Possible stuck request ffff888024d701c0: control (read@1024,1024B). Runtime 270 seconds [ 540.769040][ T8689] block nbd2: Possible stuck request ffff888024d70380: control (read@2048,1024B). Runtime 270 seconds [ 540.769067][ T8689] block nbd2: Possible stuck request ffff888024d70540: control (read@3072,1024B). Runtime 270 seconds [ 542.615771][ T9994] FAULT_INJECTION: forcing a failure. [ 542.615771][ T9994] name failslab, interval 1, probability 0, space 0, times 0 [ 542.615805][ T9994] CPU: 1 UID: 0 PID: 9994 Comm: syz.0.1172 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 542.615840][ T9994] Tainted: [L]=SOFTLOCKUP [ 542.615846][ T9994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 542.615857][ T9994] Call Trace: [ 542.615865][ T9994] [ 542.615873][ T9994] dump_stack_lvl+0x189/0x250 [ 542.615898][ T9994] ? __pfx____ratelimit+0x10/0x10 [ 542.615923][ T9994] ? __pfx_dump_stack_lvl+0x10/0x10 [ 542.615945][ T9994] ? __pfx__printk+0x10/0x10 [ 542.615967][ T9994] ? __pfx___might_resched+0x10/0x10 [ 542.615990][ T9994] should_fail_ex+0x46c/0x600 [ 542.616018][ T9994] should_failslab+0xa8/0x100 [ 542.616045][ T9994] __kmalloc_noprof+0xe0/0x7e0 [ 542.616068][ T9994] ? do_sys_poll+0x2a7/0xed0 [ 542.616090][ T9994] do_sys_poll+0x2a7/0xed0 [ 542.616116][ T9994] ? __lock_acquire+0x6b6/0x2cf0 [ 542.616140][ T9994] ? __pfx_do_sys_poll+0x10/0x10 [ 542.616226][ T9994] ? do_raw_spin_lock+0x121/0x290 [ 542.616274][ T9994] ? set_user_sigmask+0xc1/0x250 [ 542.616294][ T9994] ? __pfx_set_user_sigmask+0x10/0x10 [ 542.616323][ T9994] __se_sys_ppoll+0x1ff/0x260 [ 542.616349][ T9994] ? __pfx___se_sys_ppoll+0x10/0x10 [ 542.616371][ T9994] ? __pfx_ksys_write+0x10/0x10 [ 542.616396][ T9994] ? do_syscall_64+0xbe/0xf80 [ 542.616414][ T9994] ? __x64_sys_ppoll+0x20/0xc0 [ 542.616438][ T9994] do_syscall_64+0xfa/0xf80 [ 542.616458][ T9994] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.616475][ T9994] ? clear_bhb_loop+0x60/0xb0 [ 542.616496][ T9994] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.616512][ T9994] RIP: 0033:0x7f8c16cef749 [ 542.616529][ T9994] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 542.616544][ T9994] RSP: 002b:00007f8c14f35038 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 542.616564][ T9994] RAX: ffffffffffffffda RBX: 00007f8c16f46090 RCX: 00007f8c16cef749 [ 542.616576][ T9994] RDX: 0000000000000000 RSI: 20000000000000dc RDI: 00002000000000c0 [ 542.616588][ T9994] RBP: 00007f8c14f35090 R08: 0000000000000000 R09: 0000000000000000 [ 542.616606][ T9994] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 542.616616][ T9994] R13: 00007f8c16f46128 R14: 00007f8c16f46090 R15: 00007ffda592cd38 [ 542.616645][ T9994] [ 542.876110][ T7972] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 542.984521][ T9988] FAULT_INJECTION: forcing a failure. [ 542.984521][ T9988] name failslab, interval 1, probability 0, space 0, times 0 [ 542.984556][ T9988] CPU: 1 UID: 0 PID: 9988 Comm: syz.5.1170 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 542.984580][ T9988] Tainted: [L]=SOFTLOCKUP [ 542.984587][ T9988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 542.984598][ T9988] Call Trace: [ 542.984605][ T9988] [ 542.984613][ T9988] dump_stack_lvl+0x189/0x250 [ 542.984639][ T9988] ? __pfx____ratelimit+0x10/0x10 [ 542.984659][ T9988] ? __pfx_dump_stack_lvl+0x10/0x10 [ 542.984680][ T9988] ? __pfx__printk+0x10/0x10 [ 542.984704][ T9988] ? __pfx___might_resched+0x10/0x10 [ 542.984726][ T9988] should_fail_ex+0x46c/0x600 [ 542.984756][ T9988] should_failslab+0xa8/0x100 [ 542.984782][ T9988] __kmalloc_noprof+0xe0/0x7e0 [ 542.984804][ T9988] ? kfree+0x4d/0x900 [ 542.984821][ T9988] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 542.984851][ T9988] tomoyo_realpath_from_path+0xe3/0x5d0 [ 542.984873][ T9988] ? tomoyo_domain+0xd9/0x130 [ 542.984898][ T9988] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 542.984922][ T9988] tomoyo_path_number_perm+0x1e8/0x5a0 [ 542.984948][ T9988] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 542.984977][ T9988] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 542.984997][ T9988] ? lockdep_hardirqs_on+0x98/0x140 [ 542.985047][ T9988] ? __fget_files+0x2a/0x420 [ 542.985069][ T9988] ? __fget_files+0x3a6/0x420 [ 542.985085][ T9988] ? __fget_files+0x2a/0x420 [ 542.985106][ T9988] security_file_ioctl+0xcb/0x2d0 [ 542.985133][ T9988] __se_sys_ioctl+0x47/0x170 [ 542.985158][ T9988] do_syscall_64+0xfa/0xf80 [ 542.985178][ T9988] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.985196][ T9988] ? clear_bhb_loop+0x60/0xb0 [ 542.985216][ T9988] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.985233][ T9988] RIP: 0033:0x7f201830f749 [ 542.985249][ T9988] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 542.985264][ T9988] RSP: 002b:00007f201656e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 542.985284][ T9988] RAX: ffffffffffffffda RBX: 00007f2018565fa0 RCX: 00007f201830f749 [ 542.985304][ T9988] RDX: 0000200000000140 RSI: 00000000c0606610 RDI: 0000000000000004 [ 542.985316][ T9988] RBP: 00007f201656e090 R08: 0000000000000000 R09: 0000000000000000 [ 542.985327][ T9988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 542.985339][ T9988] R13: 00007f2018566038 R14: 00007f2018565fa0 R15: 00007ffd0e0acd58 [ 542.985370][ T9988] [ 542.987408][ T9988] ERROR: Out of memory at tomoyo_realpath_from_path. [ 543.078334][ T7972] usb 5-1: Using ep0 maxpacket: 16 [ 543.086581][ T7972] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 543.086657][ T7972] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 543.086677][ T7972] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 543.103576][ T7972] usb 5-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice=f6.59 [ 543.103603][ T7972] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.103622][ T7972] usb 5-1: Product: syz [ 543.103635][ T7972] usb 5-1: Manufacturer: syz [ 543.103648][ T7972] usb 5-1: SerialNumber: syz [ 543.123788][ T7972] usb 5-1: config 0 descriptor?? [ 543.254373][ T7972] peak_usb 5-1:0.0 can0: sending cmd f=0x6 n=0x1 failure: -8 [ 543.254400][ T7972] peak_usb 5-1:0.0: unable to read PCAN-USB serial number (err -8) [ 543.478835][ T7972] peak_usb 5-1:0.0: probe with driver peak_usb failed with error -8 [ 543.503505][ T7972] usb 5-1: USB disconnect, device number 36 [ 543.508550][ T7916] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 543.769556][ T37] kauditd_printk_skb: 31 callbacks suppressed [ 543.769573][ T37] audit: type=1326 audit(1765017508.919:747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10002 comm="syz.6.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f34bd61f749 code=0x7ffc0000 [ 543.769928][ T37] audit: type=1326 audit(1765017508.919:748): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10002 comm="syz.6.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f34bd61f749 code=0x7ffc0000 [ 543.773730][ T37] audit: type=1326 audit(1765017508.919:749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10002 comm="syz.6.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f34bd61f749 code=0x7ffc0000 [ 543.773904][ T37] audit: type=1326 audit(1765017508.919:750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10002 comm="syz.6.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f34bd61f749 code=0x7ffc0000 [ 543.774119][ T37] audit: type=1326 audit(1765017508.919:751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10002 comm="syz.6.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=34 compat=0 ip=0x7f34bd61f749 code=0x7ffc0000 [ 543.782986][ T7916] usb 6-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 543.783014][ T7916] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.799979][ T7916] usb 6-1: config 0 descriptor?? [ 543.970964][ T37] audit: type=1326 audit(1765017509.119:752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10002 comm="syz.6.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f34bd61f749 code=0x7ffc0000 [ 543.971434][ T37] audit: type=1326 audit(1765017509.119:753): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10002 comm="syz.6.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f34bd61f783 code=0x7ffc0000 [ 543.972123][ T37] audit: type=1326 audit(1765017509.119:754): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10002 comm="syz.6.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f34bd61f807 code=0x7ffc0000 [ 543.973469][ T37] audit: type=1326 audit(1765017509.119:755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10002 comm="syz.6.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f34bd5d6bdd code=0x7ffc0000 [ 543.973928][ T37] audit: type=1326 audit(1765017509.119:756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10002 comm="syz.6.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7f34bd653e89 code=0x7ffc0000 [ 544.066275][ T7916] udl 6-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 544.306431][ T7916] [drm] Initialized udl 0.0.1 for 6-1:0.0 on minor 2 [ 544.306457][ T7916] [drm] Initialized udl on minor 2 [ 544.468392][ T825] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 544.491096][ T7916] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 544.491555][ T7916] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 544.492623][ T7972] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 544.494126][ T7972] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 544.494359][ T7972] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 544.515326][ T7916] usb 6-1: USB disconnect, device number 12 [ 544.618325][ T825] usb 7-1: Using ep0 maxpacket: 32 [ 544.629587][ T825] usb 7-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 544.643080][ T825] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 544.755453][ T825] usb 7-1: config 0 descriptor?? [ 544.896083][ T825] gspca_main: xirlink-cit-2.14.0 probing 0545:8080 [ 545.266530][ T825] input: xirlink-cit as /devices/platform/dummy_hcd.6/usb7/7-1/input/input69 [ 545.783957][ T5964] usbhid 2-1:0.0: can't add hid device: -32 [ 545.786321][ T5964] usbhid 2-1:0.0: probe with driver usbhid failed with error -32 [ 545.825176][ T8277] block nbd3: Possible stuck request ffff888024dd7000: control (read@0,1024B). Runtime 270 seconds [ 545.825217][ T8277] block nbd3: Possible stuck request ffff888024dd71c0: control (read@1024,1024B). Runtime 270 seconds [ 545.825243][ T8277] block nbd3: Possible stuck request ffff888024dd7380: control (read@2048,1024B). Runtime 270 seconds [ 545.825270][ T8277] block nbd3: Possible stuck request ffff888024dd7540: control (read@3072,1024B). Runtime 270 seconds [ 546.179324][T10023] FAULT_INJECTION: forcing a failure. [ 546.179324][T10023] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 546.179358][T10023] CPU: 0 UID: 0 PID: 10023 Comm: syz.4.1181 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 546.179384][T10023] Tainted: [L]=SOFTLOCKUP [ 546.179390][T10023] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 546.179401][T10023] Call Trace: [ 546.179408][T10023] [ 546.179416][T10023] dump_stack_lvl+0x189/0x250 [ 546.179441][T10023] ? __pfx____ratelimit+0x10/0x10 [ 546.179461][T10023] ? __pfx_dump_stack_lvl+0x10/0x10 [ 546.179482][T10023] ? __pfx__printk+0x10/0x10 [ 546.179512][T10023] should_fail_ex+0x46c/0x600 [ 546.179540][T10023] strncpy_from_user+0x36/0x2c0 [ 546.179567][T10023] getname_flags+0xf3/0x540 [ 546.179589][T10023] do_sys_openat2+0xbc/0x200 [ 546.179610][T10023] ? __pfx_do_sys_openat2+0x10/0x10 [ 546.179632][T10023] ? ksys_write+0x230/0x260 [ 546.179654][T10023] ? __pfx_ksys_write+0x10/0x10 [ 546.179677][T10023] __x64_sys_openat+0x138/0x170 [ 546.179701][T10023] do_syscall_64+0xfa/0xf80 [ 546.179721][T10023] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.179738][T10023] ? clear_bhb_loop+0x60/0xb0 [ 546.179758][T10023] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.179774][T10023] RIP: 0033:0x7f0b1741f749 [ 546.179791][T10023] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 546.179804][T10023] RSP: 002b:00007f0b1567e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 546.179824][T10023] RAX: ffffffffffffffda RBX: 00007f0b17675fa0 RCX: 00007f0b1741f749 [ 546.179837][T10023] RDX: 0000000000107200 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 546.179849][T10023] RBP: 00007f0b1567e090 R08: 0000000000000000 R09: 0000000000000000 [ 546.179860][T10023] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 546.179870][T10023] R13: 00007f0b17676038 R14: 00007f0b17675fa0 R15: 00007ffeac5baf48 [ 546.179901][T10023] [ 546.336732][T10027] FAULT_INJECTION: forcing a failure. [ 546.336732][T10027] name failslab, interval 1, probability 0, space 0, times 0 [ 546.336767][T10027] CPU: 1 UID: 0 PID: 10027 Comm: syz.5.1183 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 546.336792][T10027] Tainted: [L]=SOFTLOCKUP [ 546.336798][T10027] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 546.336808][T10027] Call Trace: [ 546.336816][T10027] [ 546.336823][T10027] dump_stack_lvl+0x189/0x250 [ 546.336850][T10027] ? __pfx____ratelimit+0x10/0x10 [ 546.336869][T10027] ? __pfx_dump_stack_lvl+0x10/0x10 [ 546.336890][T10027] ? __pfx__printk+0x10/0x10 [ 546.336912][T10027] ? __pfx___might_resched+0x10/0x10 [ 546.336952][T10027] should_fail_ex+0x46c/0x600 [ 546.336986][T10027] ? __alloc_skb+0x255/0x430 [ 546.337006][T10027] should_failslab+0xa8/0x100 [ 546.337031][T10027] ? __alloc_skb+0x255/0x430 [ 546.337049][T10027] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 546.337079][T10027] __alloc_skb+0x255/0x430 [ 546.337102][T10027] ? __pfx___alloc_skb+0x10/0x10 [ 546.337124][T10027] ? netlink_autobind+0xdb/0x300 [ 546.337140][T10027] ? netlink_autobind+0x2c2/0x300 [ 546.337161][T10027] netlink_sendmsg+0x5c6/0xb30 [ 546.337187][T10027] ? __pfx_netlink_sendmsg+0x10/0x10 [ 546.337214][T10027] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 546.337234][T10027] ? __pfx_netlink_sendmsg+0x10/0x10 [ 546.337250][T10027] __sock_sendmsg+0x21c/0x270 [ 546.337274][T10027] ____sys_sendmsg+0x508/0x810 [ 546.337303][T10027] ? __pfx_____sys_sendmsg+0x10/0x10 [ 546.337333][T10027] ? import_iovec+0x74/0xa0 [ 546.337356][T10027] ___sys_sendmsg+0x21f/0x2a0 [ 546.337381][T10027] ? __pfx____sys_sendmsg+0x10/0x10 [ 546.337436][T10027] ? __fget_files+0x2a/0x420 [ 546.337452][T10027] ? __fget_files+0x3a6/0x420 [ 546.337479][T10027] __x64_sys_sendmsg+0x1a1/0x260 [ 546.337504][T10027] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 546.337535][T10027] ? __pfx_ksys_write+0x10/0x10 [ 546.337560][T10027] ? do_syscall_64+0xbe/0xf80 [ 546.337584][T10027] do_syscall_64+0xfa/0xf80 [ 546.337603][T10027] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.337619][T10027] ? clear_bhb_loop+0x60/0xb0 [ 546.337639][T10027] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.337655][T10027] RIP: 0033:0x7f201830f749 [ 546.337671][T10027] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 546.337685][T10027] RSP: 002b:00007f201656e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 546.337705][T10027] RAX: ffffffffffffffda RBX: 00007f2018565fa0 RCX: 00007f201830f749 [ 546.337718][T10027] RDX: 0000000000042880 RSI: 0000200000000280 RDI: 0000000000000003 [ 546.337729][T10027] RBP: 00007f201656e090 R08: 0000000000000000 R09: 0000000000000000 [ 546.337739][T10027] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 546.337750][T10027] R13: 00007f2018566038 R14: 00007f2018565fa0 R15: 00007ffd0e0acd58 [ 546.337779][T10027] [ 546.729099][ T7972] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 546.823437][T10033] FAULT_INJECTION: forcing a failure. [ 546.823437][T10033] name failslab, interval 1, probability 0, space 0, times 0 [ 546.823472][T10033] CPU: 1 UID: 0 PID: 10033 Comm: syz.0.1185 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 546.823496][T10033] Tainted: [L]=SOFTLOCKUP [ 546.823503][T10033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 546.823513][T10033] Call Trace: [ 546.823520][T10033] [ 546.823528][T10033] dump_stack_lvl+0x189/0x250 [ 546.823553][T10033] ? __pfx____ratelimit+0x10/0x10 [ 546.823574][T10033] ? __pfx_dump_stack_lvl+0x10/0x10 [ 546.823594][T10033] ? __pfx__printk+0x10/0x10 [ 546.823618][T10033] ? __pfx___might_resched+0x10/0x10 [ 546.823636][T10033] ? fs_reclaim_acquire+0x7d/0x100 [ 546.823662][T10033] should_fail_ex+0x46c/0x600 [ 546.823692][T10033] should_failslab+0xa8/0x100 [ 546.823718][T10033] __kmalloc_noprof+0xe0/0x7e0 [ 546.823740][T10033] ? tomoyo_encode+0x28b/0x550 [ 546.823764][T10033] tomoyo_encode+0x28b/0x550 [ 546.823788][T10033] tomoyo_realpath_from_path+0x58d/0x5d0 [ 546.823810][T10033] ? tomoyo_domain+0xd9/0x130 [ 546.823834][T10033] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 546.823858][T10033] tomoyo_path_number_perm+0x1e8/0x5a0 [ 546.823884][T10033] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 546.823910][T10033] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 546.823931][T10033] ? lockdep_hardirqs_on+0x98/0x140 [ 546.823975][T10033] ? __fget_files+0x2a/0x420 [ 546.824005][T10033] ? __fget_files+0x3a6/0x420 [ 546.824021][T10033] ? __fget_files+0x2a/0x420 [ 546.824042][T10033] security_file_ioctl+0xcb/0x2d0 [ 546.824067][T10033] __se_sys_ioctl+0x47/0x170 [ 546.824091][T10033] do_syscall_64+0xfa/0xf80 [ 546.824110][T10033] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.824125][T10033] ? clear_bhb_loop+0x60/0xb0 [ 546.824145][T10033] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.824160][T10033] RIP: 0033:0x7f8c16cef749 [ 546.824175][T10033] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 546.824190][T10033] RSP: 002b:00007f8c14f56038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 546.824211][T10033] RAX: ffffffffffffffda RBX: 00007f8c16f45fa0 RCX: 00007f8c16cef749 [ 546.824223][T10033] RDX: 0000200000000240 RSI: 000000004040ae79 RDI: 0000000000000004 [ 546.824234][T10033] RBP: 00007f8c14f56090 R08: 0000000000000000 R09: 0000000000000000 [ 546.824244][T10033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 546.824253][T10033] R13: 00007f8c16f46038 R14: 00007f8c16f45fa0 R15: 00007ffda592cd38 [ 546.824284][T10033] [ 546.824303][T10033] ERROR: Out of memory at tomoyo_realpath_from_path. [ 546.896539][ T7972] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 546.896568][ T7972] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 546.896590][ T7972] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 546.896609][ T7972] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 546.896646][ T7972] usb 6-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 546.896665][ T7972] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 546.924831][ T7972] usb 6-1: config 0 descriptor?? [ 547.053159][ T6614] usb 7-1: USB disconnect, device number 15 [ 547.481006][ T7972] hdpvr 6-1:0.0: unexpected answer of status request, len -32 [ 547.481030][ T7972] hdpvr 6-1:0.0: device init failed [ 547.481086][ T7972] hdpvr 6-1:0.0: probe with driver hdpvr failed with error -12 [ 547.598353][ T5964] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 547.626832][T10049] netlink: 80 bytes leftover after parsing attributes in process `syz.6.1192'. [ 547.626858][T10049] netlink: 80 bytes leftover after parsing attributes in process `syz.6.1192'. [ 547.653425][T10051] FAULT_INJECTION: forcing a failure. [ 547.653425][T10051] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 547.653454][T10051] CPU: 1 UID: 0 PID: 10051 Comm: syz.0.1193 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 547.653469][T10051] Tainted: [L]=SOFTLOCKUP [ 547.653472][T10051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 547.653479][T10051] Call Trace: [ 547.653484][T10051] [ 547.653489][T10051] dump_stack_lvl+0x189/0x250 [ 547.653506][T10051] ? __pfx____ratelimit+0x10/0x10 [ 547.653519][T10051] ? __pfx_dump_stack_lvl+0x10/0x10 [ 547.653532][T10051] ? __pfx__printk+0x10/0x10 [ 547.653542][T10051] ? __might_fault+0xb0/0x130 [ 547.653562][T10051] should_fail_ex+0x46c/0x600 [ 547.653580][T10051] _copy_to_iter+0x1de/0x1790 [ 547.653596][T10051] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 547.653609][T10051] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 547.653621][T10051] ? __pfx_sysfs_emit+0x10/0x10 [ 547.653638][T10051] ? __pfx__copy_to_iter+0x10/0x10 [ 547.653651][T10051] ? rt_mutex_slowunlock+0x1be/0x2e0 [ 547.653665][T10051] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 547.653687][T10051] seq_read_iter+0xbf6/0xe20 [ 547.653712][T10051] vfs_read+0x563/0xa30 [ 547.653730][T10051] ? __pfx_vfs_read+0x10/0x10 [ 547.653741][T10051] ? try_to_take_rt_mutex+0x7fd/0xac0 [ 547.653760][T10051] ? mutex_lock_nested+0x154/0x1d0 [ 547.653774][T10051] ? fdget_pos+0x253/0x320 [ 547.653789][T10051] ksys_read+0x14b/0x260 [ 547.653803][T10051] ? __pfx_ksys_read+0x10/0x10 [ 547.653818][T10051] ? do_syscall_64+0xbe/0xf80 [ 547.653832][T10051] do_syscall_64+0xfa/0xf80 [ 547.653844][T10051] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.653854][T10051] ? clear_bhb_loop+0x60/0xb0 [ 547.653867][T10051] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.653876][T10051] RIP: 0033:0x7f8c16cef749 [ 547.653886][T10051] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 547.653895][T10051] RSP: 002b:00007f8c14f56038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 547.653913][T10051] RAX: ffffffffffffffda RBX: 00007f8c16f45fa0 RCX: 00007f8c16cef749 [ 547.653921][T10051] RDX: 000000000000005d RSI: 00002000000001c0 RDI: 0000000000000003 [ 547.653927][T10051] RBP: 00007f8c14f56090 R08: 0000000000000000 R09: 0000000000000000 [ 547.653934][T10051] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 547.653939][T10051] R13: 00007f8c16f46038 R14: 00007f8c16f45fa0 R15: 00007ffda592cd38 [ 547.653956][T10051] [ 547.722271][ T7972] usb 6-1: USB disconnect, device number 13 [ 547.940788][ T5964] usb 5-1: config 0 has an invalid descriptor of length 138, skipping remainder of the config [ 547.940862][ T5964] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 547.940883][ T5964] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 150, changing to 11 [ 547.940907][ T5964] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 24814, setting to 1024 [ 547.940931][ T5964] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 547.943850][ T5964] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 547.943877][ T5964] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.943895][ T5964] usb 5-1: Product: syz [ 547.943908][ T5964] usb 5-1: Manufacturer: syz [ 547.943920][ T5964] usb 5-1: SerialNumber: syz [ 548.060927][ T5964] usb 5-1: config 0 descriptor?? [ 548.064861][ T5964] garmin_gps 5-1:0.0: Garmin GPS usb/tty converter detected [ 548.119195][ T5964] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -8 [ 548.119516][ T5964] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -8 [ 549.228602][ T9] usb 5-1: USB disconnect, device number 37 [ 549.236798][ T9] garmin_gps 5-1:0.0: device disconnected [ 550.848440][T10060] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 550.923679][T10076] netlink: 'syz.5.1201': attribute type 1 has an invalid length. [ 550.923696][T10076] netlink: 9188 bytes leftover after parsing attributes in process `syz.5.1201'. [ 550.998432][ T6212] usb 5-1: new full-speed USB device number 38 using dummy_hcd [ 551.062280][T10060] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 551.062311][T10060] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 551.068046][T10060] usb 1-1: config 0 descriptor?? [ 551.241702][ T6212] usb 5-1: unable to get BOS descriptor or descriptor too short [ 551.242330][ T6212] usb 5-1: not running at top speed; connect to a high speed hub [ 551.243875][ T6212] usb 5-1: config 7 has an invalid interface number: 180 but max is 0 [ 551.243899][ T6212] usb 5-1: config 7 has no interface number 0 [ 551.243929][ T6212] usb 5-1: config 7 interface 180 has no altsetting 0 [ 551.246480][ T6212] usb 5-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=3c.f2 [ 551.246497][ T6212] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.246506][ T6212] usb 5-1: Product: syz [ 551.246552][ T6212] usb 5-1: Manufacturer: ᆊ罾柵枨톐㉁띎뼱瑲ほ웒ຘ䭡듺늿=ሬ㻔㬚遧畾헍⹙雐羚⨁ᗩ堓툭ጃ㾋יⅤ㩩層ᗼ揣꘣㐌룋瀂商羹띀ꇶ䭌溩桳ꠈ줖伟핶⥦珅囧唵뮺㼑鍢嫥뛓凳鼫俧拌᱓践〰 [ 551.246565][ T6212] usb 5-1: SerialNumber: syz [ 552.114647][T10060] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 552.143466][T10083] netlink: 'syz.5.1203': attribute type 1 has an invalid length. [ 552.143489][T10083] netlink: 9188 bytes leftover after parsing attributes in process `syz.5.1203'. [ 552.353183][ T6212] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 552.365838][ T6212] gspca_topro: reg_w err -71 [ 552.375255][T10060] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 2 [ 552.375279][T10060] [drm] Initialized udl on minor 2 [ 552.390349][ T6212] gspca_topro: Sensor soi763a [ 552.467321][ T6212] usb 5-1: USB disconnect, device number 38 [ 552.818533][T10091] FAULT_INJECTION: forcing a failure. [ 552.818533][T10091] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 552.818568][T10091] CPU: 0 UID: 0 PID: 10091 Comm: syz.5.1204 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 552.818593][T10091] Tainted: [L]=SOFTLOCKUP [ 552.818599][T10091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 552.818619][T10091] Call Trace: [ 552.818627][T10091] [ 552.818635][T10091] dump_stack_lvl+0x189/0x250 [ 552.818662][T10091] ? __pfx____ratelimit+0x10/0x10 [ 552.818682][T10091] ? __pfx_dump_stack_lvl+0x10/0x10 [ 552.818704][T10091] ? __pfx__printk+0x10/0x10 [ 552.818738][T10091] should_fail_ex+0x46c/0x600 [ 552.818768][T10091] _copy_to_user+0x31/0xb0 [ 552.818790][T10091] simple_read_from_buffer+0xe1/0x170 [ 552.818822][T10091] proc_fail_nth_read+0x1b6/0x220 [ 552.818848][T10091] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 552.818874][T10091] ? rw_verify_area+0x2ac/0x4e0 [ 552.818895][T10091] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 552.818918][T10091] vfs_read+0x206/0xa30 [ 552.818949][T10091] ? __pfx_vfs_read+0x10/0x10 [ 552.818967][T10091] ? try_to_take_rt_mutex+0x7fd/0xac0 [ 552.819000][T10091] ? mutex_lock_nested+0x154/0x1d0 [ 552.819021][T10091] ? fdget_pos+0x253/0x320 [ 552.819048][T10091] ksys_read+0x14b/0x260 [ 552.819072][T10091] ? __pfx_ksys_read+0x10/0x10 [ 552.819098][T10091] ? do_syscall_64+0xbe/0xf80 [ 552.819121][T10091] do_syscall_64+0xfa/0xf80 [ 552.819141][T10091] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.819159][T10091] ? clear_bhb_loop+0x60/0xb0 [ 552.819180][T10091] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.819201][T10091] RIP: 0033:0x7f201830e15c [ 552.819217][T10091] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 552.819232][T10091] RSP: 002b:00007f201652c030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 552.819251][T10091] RAX: ffffffffffffffda RBX: 00007f2018566180 RCX: 00007f201830e15c [ 552.819265][T10091] RDX: 000000000000000f RSI: 00007f201652c0a0 RDI: 0000000000000008 [ 552.819277][T10091] RBP: 00007f201652c090 R08: 0000000000000000 R09: 0000000000000000 [ 552.819288][T10091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 552.819299][T10091] R13: 00007f2018566218 R14: 00007f2018566180 R15: 00007ffd0e0acd58 [ 552.819331][T10091] [ 553.094456][T10060] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 553.095661][T10060] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 553.115480][ T6212] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 553.116672][ T6212] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 553.116915][ T6212] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 553.166822][T10060] usb 1-1: USB disconnect, device number 48 [ 554.908290][ T38] INFO: task kworker/u8:3:49 blocked for more than 146 seconds. [ 554.908313][ T38] Tainted: G L syzkaller #0 [ 554.908323][ T38] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 554.908346][ T38] task:kworker/u8:3 state:D stack:18424 pid:49 tgid:49 ppid:2 task_flags:0x4208160 flags:0x00080000 [ 554.908397][ T38] Workqueue: netns cleanup_net [ 554.908424][ T38] Call Trace: [ 554.908431][ T38] [ 554.908443][ T38] __schedule+0x1480/0x50a0 [ 554.908488][ T38] ? rt_spin_lock+0x1c1/0x3e0 [ 554.908514][ T38] ? __pfx___schedule+0x10/0x10 [ 554.908546][ T38] ? schedule+0x91/0x360 [ 554.908568][ T38] schedule+0x165/0x360 [ 554.908589][ T38] rxrpc_destroy_all_calls+0x564/0x660 [ 554.908616][ T38] ? __pfx_rxrpc_destroy_all_calls+0x10/0x10 [ 554.908638][ T38] ? __pfx_var_wake_function+0x10/0x10 [ 554.908661][ T38] ? __cancel_work_sync+0x5c/0x110 [ 554.908691][ T38] rxrpc_exit_net+0x6f/0xc0 [ 554.908711][ T38] ops_undo_list+0x49a/0x990 [ 554.908741][ T38] ? __pfx_ops_undo_list+0x10/0x10 [ 554.908760][ T38] ? rt_spin_unlock+0x150/0x200 [ 554.908788][ T38] ? rt_spin_unlock+0x161/0x200 [ 554.908814][ T38] cleanup_net+0x4de/0x7b0 [ 554.908837][ T38] ? __pfx_cleanup_net+0x10/0x10 [ 554.908861][ T38] ? _raw_spin_unlock_irq+0x23/0x50 [ 554.908880][ T38] ? process_scheduled_works+0x9ef/0x1770 [ 554.908899][ T38] ? process_scheduled_works+0x9ef/0x1770 [ 554.908920][ T38] process_scheduled_works+0xad1/0x1770 [ 554.908968][ T38] ? __pfx_process_scheduled_works+0x10/0x10 [ 554.909005][ T38] worker_thread+0x8a0/0xda0 [ 554.909051][ T38] kthread+0x711/0x8a0 [ 554.909076][ T38] ? __pfx_worker_thread+0x10/0x10 [ 554.909096][ T38] ? __pfx_kthread+0x10/0x10 [ 554.909114][ T38] ? rt_spin_unlock+0x150/0x200 [ 554.909142][ T38] ? rt_spin_unlock+0x161/0x200 [ 554.909164][ T38] ? __pfx_kthread+0x10/0x10 [ 554.909187][ T38] ret_from_fork+0x599/0xb30 [ 554.909209][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 554.909238][ T38] ? __switch_to_asm+0x39/0x70 [ 554.909259][ T38] ? __switch_to_asm+0x33/0x70 [ 554.909280][ T38] ? __pfx_kthread+0x10/0x10 [ 554.909303][ T38] ret_from_fork_asm+0x1a/0x30 [ 554.909343][ T38] [ 554.909531][ T38] INFO: task syz.2.792:8510 blocked for more than 146 seconds. [ 554.909547][ T38] Tainted: G L syzkaller #0 SYZFAIL: failed to send rpc fd=3 want=1784 sent=0 n=-1 (errno 32: Broken pipe) [ 554.909556][ T38] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 554.909565][ T38] task:syz.2.792 state:D stack:26464 pid:8510 tgid:8507 ppid:5818 task_flags:0x400140 flags:0x00080002 [ 554.909610][ T38] Call Trace: [ 554.909616][ T38] [ 554.909628][ T38] __schedule+0x1480/0x50a0 [ 554.909654][ T38] ? __lock_acquire+0x6b6/0x2cf0 [ 554.909681][ T38] ? sched_clock_cpu+0x74/0x430 [ 554.909704][ T38] ? __pfx_sched_clock_cpu+0x10/0x10 [ 554.909724][ T38] ? __pfx___schedule+0x10/0x10 [ 554.909763][ T38] rt_mutex_schedule+0x77/0xf0 [ 554.909781][ T38] rt_mutex_slowlock_block+0x5ba/0x6d0 [ 554.909818][ T38] ? rt_mutex_slowlock_block+0x351/0x6d0 [ 554.909845][ T38] rt_mutex_slowlock+0x2a8/0x6b0 [ 554.909871][ T38] ? rt_mutex_slowlock+0x1c9/0x6b0 [ 554.909895][ T38] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 554.909926][ T38] ? sync_bdevs+0x27e/0x470 [ 554.909965][ T38] ? sync_bdevs+0x27e/0x470 [ 554.909984][ T38] mutex_lock_nested+0x16a/0x1d0 [ 554.910013][ T38] sync_bdevs+0x27e/0x470 [ 554.910041][ T38] ksys_sync+0xb9/0x150 [ 554.910062][ T38] ? __pfx_ksys_sync+0x10/0x10 [ 554.910080][ T38] ? __secure_computing+0xe2/0x2a0 [ 554.910108][ T38] __ia32_sys_sync+0xe/0x20 [ 554.910126][ T38] do_syscall_64+0xfa/0xf80 [ 554.910145][ T38] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.910162][ T38] ? clear_bhb_loop+0x60/0xb0 [ 554.910183][ T38] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.910199][ T38] RIP: 0033:0x7eff28a1f749 [ 554.910214][ T38] RSP: 002b:00007eff26c86038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 554.910234][ T38] RAX: ffffffffffffffda RBX: 00007eff28c75fa0 RCX: 00007eff28a1f749 [ 554.910247][ T38] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 554.910258][ T38] RBP: 00007eff28c75fa0 R08: 0000000000000000 R09: 0000000000000000 [ 554.910269][ T38] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 554.910279][ T38] R13: 00007eff28c76038 R14: 00007eff28c75fa0 R15: 00007fffcb894168 [ 554.910307][ T38] [ 554.910342][ T38] [ 554.910342][ T38] Showing all locks held in the system: [ 554.910360][ T38] 1 lock held by khungtaskd/38: [ 554.910369][ T38] #0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 554.910422][ T38] 3 locks held by kworker/u8:3/49: [ 554.910431][ T38] #0: ffff888019ad4938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 554.910470][ T38] #1: ffffc90000bb7b80 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 554.910509][ T38] #2: ffffffff8e88a860 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x7b0 [ 554.910571][ T38] 2 locks held by udevd/5177: [ 554.910581][ T38] 2 locks held by getty/5569: [ 554.910590][ T38] #0: ffff88814dced0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 554.910631][ T38] #1: ffffc90003e7e2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1400 [ 554.910669][ T38] 9 locks held by syz-executor/5796: [ 554.910684][ T38] 1 lock held by udevd/5882: [ 554.910692][ T38] #0: ffff888024a8a4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xcc0 [ 554.910739][ T38] 1 lock held by udevd/5972: [ 554.910748][ T38] #0: ffff888024cd54c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xcc0 [ 554.910792][ T38] 1 lock held by udevd/5974: [ 554.910802][ T38] #0: ffff888024bbe4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xcc0 [ 554.910847][ T38] 3 locks held by kworker/0:10/6133: [ 554.910858][ T38] 1 lock held by udevd/7443: [ 554.910867][ T38] #0: ffff888024ce54c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xcc0 [ 554.910909][ T38] 1 lock held by syz.2.792/8510: [ 554.910918][ T38] #0: ffff888024ce54c8 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x27e/0x470 [ 554.910961][ T38] 1 lock held by syz-executor/8690: [ 554.910974][ T38] 1 lock held by syz.1.1164/9970: [ 554.910985][ T38] #0: ffff888024a8a4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xcc0 [ 554.911028][ T38] 3 locks held by kworker/0:16/10060: [ 554.911038][ T38] 2 locks held by syz-executor/10098: [ 554.911048][ T38] 3 locks held by syz-executor/10099: [ 554.911057][ T38] [ 554.911061][ T38] ============================================= [ 554.911061][ T38] [ 554.911076][ T38] NMI backtrace for cpu 0 [ 554.911091][ T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 554.911113][ T38] Tainted: [L]=SOFTLOCKUP [ 554.911119][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 554.911129][ T38] Call Trace: [ 554.911136][ T38] [ 554.911143][ T38] dump_stack_lvl+0x189/0x250 [ 554.911165][ T38] ? __pfx_dump_stack_lvl+0x10/0x10 [ 554.911184][ T38] ? __pfx__printk+0x10/0x10 [ 554.911211][ T38] nmi_cpu_backtrace+0x39e/0x3d0 [ 554.911234][ T38] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 554.911255][ T38] ? __pfx__printk+0x10/0x10 [ 554.911275][ T38] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 554.911293][ T38] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 554.911317][ T38] watchdog+0xf3c/0xf80 [ 554.911339][ T38] ? watchdog+0x1e2/0xf80 [ 554.911369][ T38] kthread+0x711/0x8a0 [ 554.911391][ T38] ? __pfx_watchdog+0x10/0x10 [ 554.911408][ T38] ? __pfx_kthread+0x10/0x10 [ 554.911424][ T38] ? rt_spin_unlock+0x150/0x200 [ 554.911445][ T38] ? rt_spin_unlock+0x161/0x200 [ 554.911461][ T38] ? __pfx_kthread+0x10/0x10 [ 554.911479][ T38] ret_from_fork+0x599/0xb30 [ 554.911495][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 554.911516][ T38] ? __switch_to_asm+0x39/0x70 [ 554.911533][ T38] ? __switch_to_asm+0x33/0x70 [ 554.911548][ T38] ? __pfx_kthread+0x10/0x10 [ 554.911566][ T38] ret_from_fork_asm+0x1a/0x30 [ 554.911595][ T38] [ 554.911603][ T38] Sending NMI from CPU 0 to CPUs 1: [ 554.911632][ C1] NMI backtrace for cpu 1 [ 554.911648][ C1] CPU: 1 UID: 0 PID: 5796 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 554.911672][ C1] Tainted: [L]=SOFTLOCKUP [ 554.911678][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 554.911688][ C1] RIP: 0010:__lock_acquire+0x197c/0x2cf0 [ 554.911713][ C1] Code: 13 25 ff 0f 00 00 39 05 9e 87 17 11 73 06 89 05 96 87 17 11 48 8b 02 48 89 df 4c 39 e8 0f 84 2c fe ff ff 4c 89 60 30 48 8b 00 <4c> 39 e8 75 f4 48 89 df e9 18 fe ff ff 48 89 fb 48 c7 c7 10 e4 47 [ 554.911728][ C1] RSP: 0018:ffffc90004e47798 EFLAGS: 00000002 [ 554.911742][ C1] RAX: ffffffff9555a2d8 RBX: 0000000000000101 RCX: 0000000000000004 [ 554.911754][ C1] RDX: ffffffff9538f758 RSI: ffff888033860c80 RDI: 0000000000000101 [ 554.911767][ C1] RBP: d7e73522be426141 R08: ffffc90004e47760 R09: 0000000000000020 [ 554.911779][ C1] R10: dffffc0000000000 R11: ffffffff819d54f0 R12: ffffffff9538fc28 [ 554.911792][ C1] R13: ffffffff925676b8 R14: ffff888033860000 R15: 0000000000000003 [ 554.911805][ C1] FS: 000055557c32e500(0000) GS:ffff888126e52000(0000) knlGS:0000000000000000 [ 554.911820][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 554.911831][ C1] CR2: 00007f0a3d7930fa CR3: 00000000337ea000 CR4: 00000000003526f0 [ 554.911846][ C1] Call Trace: [ 554.911853][ C1] [ 554.911862][ C1] ? __lock_acquire+0x6b6/0x2cf0 [ 554.911888][ C1] ? update_load_avg+0x219/0x1870 [ 554.911909][ C1] lock_acquire+0x117/0x340 [ 554.911928][ C1] ? update_load_avg+0x219/0x1870 [ 554.911951][ C1] ? __update_load_avg_se+0x751/0xbc0 [ 554.911974][ C1] _raw_spin_lock+0x2e/0x40 [ 554.911991][ C1] ? update_load_avg+0x219/0x1870 [ 554.912012][ C1] update_load_avg+0x219/0x1870 [ 554.912037][ C1] enqueue_task_fair+0x2cc/0x2780 [ 554.912063][ C1] enqueue_task+0xb3/0x4c0 [ 554.912089][ C1] ttwu_do_activate+0x1dc/0x860 [ 554.912120][ C1] try_to_wake_up+0x721/0x12b0 [ 554.912144][ C1] signal_wake_up_state+0xb5/0x120 [ 554.912167][ C1] complete_signal+0xa23/0xbc0 [ 554.912186][ C1] __send_signal_locked+0xbb3/0xec0 [ 554.912208][ C1] ? send_signal_locked+0x1b5/0x8e0 [ 554.912231][ C1] ? group_send_sig_info+0x3d/0x250 [ 554.912252][ C1] group_send_sig_info+0x1f4/0x250 [ 554.912275][ C1] ? kill_pid_info_type+0x33/0x1f0 [ 554.912298][ C1] kill_pid_info_type+0xf8/0x1f0 [ 554.912319][ C1] ? kill_proc_info+0x21/0x180 [ 554.912335][ C1] kill_proc_info+0xd9/0x180 [ 554.912359][ C1] __se_sys_kill+0xc4/0x450 [ 554.912380][ C1] ? __pfx___se_sys_kill+0x10/0x10 [ 554.912403][ C1] ? do_syscall_64+0xbe/0xf80 [ 554.912423][ C1] do_syscall_64+0xfa/0xf80 [ 554.912441][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.912458][ C1] ? clear_bhb_loop+0x60/0xb0 [ 554.912476][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.912492][ C1] RIP: 0033:0x7f0a3f8aba37 [ 554.912505][ C1] Code: 48 83 c4 08 c3 66 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff 64 89 02 b8 ff ff ff ff eb e4 0f 1f 80 00 00 00 00 b8 3e 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 554.912520][ C1] RSP: 002b:00007ffee1b08c98 EFLAGS: 00000206 ORIG_RAX: 000000000000003e [ 554.912536][ C1] RAX: ffffffffffffffda RBX: 00007ffee1b091e0 RCX: 00007f0a3f8aba37 [ 554.912548][ C1] RDX: 0000000000000003 RSI: 0000000000000009 RDI: 00000000000016aa [ 554.912558][ C1] RBP: 000055557c347240 R08: 000055557c3474d0 R09: 000055557c3474f8 [ 554.912571][ C1] R10: 538f731c16db219f R11: 0000000000000206 R12: 00007ffee1b08cac [ 554.912583][ C1] R13: 000055557c349ec8 R14: 000055557c3474d8 R15: 00007ffee1b08d40 [ 554.912603][ C1] [ 554.990590][T10102] FAULT_INJECTION: forcing a failure. [ 554.990590][T10102] name failslab, interval 1, probability 0, space 0, times 0 [ 554.990624][T10102] CPU: 1 UID: 0 PID: 10102 Comm: syz.4.1209 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 554.990649][T10102] Tainted: [L]=SOFTLOCKUP [ 554.990656][T10102] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 554.990666][T10102] Call Trace: [ 554.990673][T10102] [ 554.990681][T10102] dump_stack_lvl+0x189/0x250 [ 554.990706][T10102] ? __pfx____ratelimit+0x10/0x10 [ 554.990726][T10102] ? __pfx_dump_stack_lvl+0x10/0x10 [ 554.990746][T10102] ? __pfx__printk+0x10/0x10 [ 554.990767][T10102] ? __pfx___might_resched+0x10/0x10 [ 554.990784][T10102] ? fs_reclaim_acquire+0x7d/0x100 [ 554.990808][T10102] should_fail_ex+0x46c/0x600 [ 554.990834][T10102] should_failslab+0xa8/0x100 [ 554.990856][T10102] __kmalloc_cache_node_noprof+0x8b/0x700 [ 554.990879][T10102] ? __get_vm_area_node+0x172/0x350 [ 554.990904][T10102] __get_vm_area_node+0x172/0x350 [ 554.990926][T10102] __vmalloc_node_range_noprof+0x371/0x16a0 [ 554.990947][T10102] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 554.990987][T10102] ? unwind_get_return_address+0x4d/0x90 [ 554.991008][T10102] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 554.991032][T10102] ? __lock_acquire+0x6b6/0x2cf0 [ 554.991058][T10102] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 554.991071][T10102] __vmalloc_noprof+0xd2/0x120 [ 554.991091][T10102] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 554.991112][T10102] bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 554.991134][T10102] bpf_prog_alloc+0x3c/0x1a0 [ 554.991164][T10102] bpf_prog_load+0x735/0x1a10 [ 554.991195][T10102] ? __pfx_bpf_prog_load+0x10/0x10 [ 554.991234][T10102] ? bpf_lsm_bpf+0x9/0x20 [ 554.991248][T10102] ? security_bpf+0x7e/0x300 [ 554.991268][T10102] __sys_bpf+0x507/0x860 [ 554.991289][T10102] ? __pfx___sys_bpf+0x10/0x10 [ 554.991304][T10102] ? rt_mutex_slowunlock+0x1be/0x2e0 [ 554.991341][T10102] ? ksys_write+0x230/0x260 [ 554.991365][T10102] ? __pfx_ksys_write+0x10/0x10 [ 554.991395][T10102] __x64_sys_bpf+0x7c/0x90 [ 554.991412][T10102] do_syscall_64+0xfa/0xf80 [ 554.991432][T10102] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.991449][T10102] ? clear_bhb_loop+0x60/0xb0 [ 554.991468][T10102] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.991485][T10102] RIP: 0033:0x7f0b1741f749 [ 554.991501][T10102] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 554.991515][T10102] RSP: 002b:00007f0b1567e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 554.991534][T10102] RAX: ffffffffffffffda RBX: 00007f0b17675fa0 RCX: 00007f0b1741f749 [ 554.991547][T10102] RDX: 0000000000000080 RSI: 0000200000000140 RDI: 0000000000000005 [ 554.991558][T10102] RBP: 00007f0b1567e090 R08: 0000000000000000 R09: 0000000000000000 [ 554.991568][T10102] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 554.991579][T10102] R13: 00007f0b17676038 R14: 00007f0b17675fa0 R15: 00007ffeac5baf48 [ 554.991609][T10102] [ 555.009220][T10102] syz.4.1209: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 555.012333][T10102] CPU: 1 UID: 0 PID: 10102 Comm: syz.4.1209 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 555.012359][T10102] Tainted: [L]=SOFTLOCKUP [ 555.012365][T10102] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 555.012375][T10102] Call Trace: [ 555.012382][T10102] [ 555.012389][T10102] dump_stack_lvl+0x189/0x250 [ 555.012414][T10102] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 555.012439][T10102] ? __pfx_dump_stack_lvl+0x10/0x10 [ 555.012459][T10102] ? __pfx__printk+0x10/0x10 [ 555.012476][T10102] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 555.012498][T10102] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 555.012527][T10102] warn_alloc+0x22e/0x3b0 [ 555.012553][T10102] ? should_fail_ex+0x344/0x600 [ 555.012582][T10102] ? __pfx_warn_alloc+0x10/0x10 [ 555.012603][T10102] ? __kmalloc_cache_node_noprof+0x2aa/0x700 [ 555.012627][T10102] ? __get_vm_area_node+0x172/0x350 [ 555.012653][T10102] ? __get_vm_area_node+0x2e2/0x350 [ 555.012678][T10102] __vmalloc_node_range_noprof+0x396/0x16a0 [ 555.012725][T10102] ? unwind_get_return_address+0x4d/0x90 [ 555.012749][T10102] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 555.012773][T10102] ? __lock_acquire+0x6b6/0x2cf0 [ 555.012802][T10102] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 555.012820][T10102] __vmalloc_noprof+0xd2/0x120 [ 555.012840][T10102] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 555.012862][T10102] bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 555.012883][T10102] bpf_prog_alloc+0x3c/0x1a0 [ 555.012903][T10102] bpf_prog_load+0x735/0x1a10 [ 555.012933][T10102] ? __pfx_bpf_prog_load+0x10/0x10 [ 555.012973][T10102] ? bpf_lsm_bpf+0x9/0x20 [ 555.012987][T10102] ? security_bpf+0x7e/0x300 [ 555.013005][T10102] __sys_bpf+0x507/0x860 [ 555.013025][T10102] ? __pfx___sys_bpf+0x10/0x10 [ 555.013040][T10102] ? rt_mutex_slowunlock+0x1be/0x2e0 [ 555.013079][T10102] ? ksys_write+0x230/0x260 [ 555.013102][T10102] ? __pfx_ksys_write+0x10/0x10 [ 555.013128][T10102] __x64_sys_bpf+0x7c/0x90 [ 555.013152][T10102] do_syscall_64+0xfa/0xf80 [ 555.013172][T10102] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.013189][T10102] ? clear_bhb_loop+0x60/0xb0 [ 555.013209][T10102] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.013225][T10102] RIP: 0033:0x7f0b1741f749 [ 555.013242][T10102] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 555.013257][T10102] RSP: 002b:00007f0b1567e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 555.013274][T10102] RAX: ffffffffffffffda RBX: 00007f0b17675fa0 RCX: 00007f0b1741f749 [ 555.013287][T10102] RDX: 0000000000000080 RSI: 0000200000000140 RDI: 0000000000000005 [ 555.013299][T10102] RBP: 00007f0b1567e090 R08: 0000000000000000 R09: 0000000000000000 [ 555.013309][T10102] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 555.013320][T10102] R13: 00007f0b17676038 R14: 00007f0b17675fa0 R15: 00007ffeac5baf48 [ 555.013349][T10102] [ 555.024930][T10102] Mem-Info: [ 555.024949][T10102] active_anon:277 inactive_anon:27650 isolated_anon:0 [ 555.024949][T10102] active_file:27641 inactive_file:38043 isolated_file:0 [ 555.024949][T10102] unevictable:768 dirty:279 writeback:0 [ 555.024949][T10102] slab_reclaimable:12420 slab_unreclaimable:120527 [ 555.024949][T10102] mapped:38394 shmem:21827 pagetables:1719 [ 555.024949][T10102] sec_pagetables:0 bounce:0 [ 555.024949][T10102] kernel_misc_reclaimable:0 [ 555.024949][T10102] free:1254047 free_pcp:5866 free_cma:0 [ 555.024996][T10102] Node 0 active_anon:1108kB inactive_anon:110600kB active_file:110320kB inactive_file:152172kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:153532kB dirty:1116kB writeback:0kB shmem:85772kB kernel_stack:14872kB pagetables:6748kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 555.025038][T10102] Node 1 active_anon:0kB inactive_anon:0kB active_file:244kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:44kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:64kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 555.025077][T10102] Node 0 DMA free:15348kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 555.025133][T10102] lowmem_reserve[]: 0 2514 2516 2516 2516 [ 555.025170][T10102] Node 0 DMA32 free:1093772kB boost:0kB min:3944kB low:6492kB high:9040kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1108kB inactive_anon:110600kB active_file:110320kB inactive_file:152172kB unevictable:1536kB writepending:1116kB zspages:0kB present:3129332kB managed:2575220kB mlocked:0kB bounce:0kB free_pcp:22912kB local_pcp:8828kB free_cma:0kB [ 555.025224][T10102] lowmem_reserve[]: 0 0 1 1 1 [ 555.025253][T10102] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 555.025302][T10102] lowmem_reserve[]: 0 0 0 0 0 [ 555.025331][T10102] Node 1 Normal free:3907068kB boost:0kB min:6360kB low:10468kB high:14576kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:244kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:548kB local_pcp:0kB free_cma:0kB [ 555.025383][T10102] lowmem_reserve[]: 0 0 0 0 0 [ 555.025411][T10102] Node 0 DMA: 1*4kB (U) 0*8kB 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15348kB [ 555.025538][T10102] Node 0 DMA32: 875*4kB (UME) 776*8kB (UE) 770*16kB (UME) 111*32kB (UME) 53*64kB (UME) 35*128kB (UM) 42*256kB (UM) 78*512kB (UME) 16*1024kB (ME) 15*2048kB (UME) 235*4096kB (UM) = 1093804kB [ 555.025675][T10102] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 555.025760][T10102] Node 1 Normal: 211*4kB (UME) 50*8kB (UME) 34*16kB (UE) 232*32kB (UE) 94*64kB (UME) 31*128kB (UME) 15*256kB (UME) 4*512kB (UM) 3*1024kB (UM) 2*2048kB (UE) 946*4096kB (M) = 3907068kB [ 555.025994][T10102] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 555.026010][T10102] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 555.026024][T10102] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 555.026038][T10102] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 555.026052][T10102] 87507 total pagecache pages [ 555.026063][T10102] 0 pages in swap cache [ 555.026069][T10102] Free swap = 124996kB [ 555.026078][T10102] Total swap = 124996kB [ 555.026086][T10102] 2097051 pages RAM [ 555.026092][T10102] 0 pages HighMem/MovableOnly [ 555.026098][T10102] 421220 pages reserved [ 555.026104][T10102] 0 pages cma reserved [ 560.699850][ T5177] udevd[5177]: worker [5974] /devices/virtual/block/nbd0 timeout; kill it [ 560.705658][ T5177] udevd[5177]: seq 11264 '/devices/virtual/block/nbd0' killed [ 560.705728][ T5177] udevd[5177]: worker [5882] /devices/virtual/block/nbd1 timeout; kill it [ 560.705821][ T5177] udevd[5177]: seq 13024 '/devices/virtual/block/nbd1' killed [ 560.705867][ T5177] udevd[5177]: worker [5972] /devices/virtual/block/nbd2 timeout; kill it [ 560.705995][ T5177] udevd[5177]: seq 13124 '/devices/virtual/block/nbd2' killed [ 560.706038][ T5177] udevd[5177]: worker [7443] /devices/virtual/block/nbd3 timeout; kill it [ 560.706117][ T5177] udevd[5177]: seq 13232 '/devices/virtual/block/nbd3' killed [ 561.888498][ T8277] block nbd1: Possible stuck request ffff888024d47000: control (read@0,1024B). Runtime 300 seconds [ 561.888540][ T8277] block nbd1: Possible stuck request ffff888024d471c0: control (read@1024,1024B). Runtime 300 seconds [ 561.888556][ T8277] block nbd1: Possible stuck request ffff888024d47380: control (read@2048,1024B). Runtime 300 seconds [ 561.888571][ T8277] block nbd1: Possible stuck request ffff888024d47540: control (read@3072,1024B). Runtime 300 seconds [ 563.137135][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.137220][ T1320] ieee802154 phy1 wpan1: encryption failed: -22