last executing test programs: 8m52.867996174s ago: executing program 1 (id=1266): syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) syz_usb_connect(0x2, 0x24, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$I2C(0x0, 0x78b5, 0x80) ioctl$I2C_RDWR(r0, 0x707, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mount$bind(0x0, &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x141091, 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa000000000000015030000088d4e002d3501000000000095000000000000006916160000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a81426104000000000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546ccd3f1d5ab2af27546e7c070000000000000095cb202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec85eeeb83ccaec388158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d0800e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb400f692f374dfab73f90000000000000000000000004000bc00f679629709e7e78f4d08000000ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43000000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d0000000000000000b712c1e47be511fe32fbc90e2364a55e9bb609c64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd4722a11dc3c693962895496d4f6e9cc54db6c7205a6b068fff496d2da7d632bd1f61b007e1d913c3fd6edc9b9bfc8c6a14ff595eff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c835d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a0397c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed551c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff5af657a67463d7dbf85ae9321fad16ee751cd7dde94ec97549c2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18402cde8bf377b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059a6cffb92e2a0cfd81434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5c4d188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a5cbb8be3f7741b18007dff12eb95f9ddf30e066cc6bc256f0a12282224bb031bbee6d23cef7074f6d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873d0ecdf904c2bdbef81f246d26f4b40df949e12bdac18092f4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054e5deb27f7922fe6c14eba96c9af409da03290e4009f872d5aac263dbe239efb1e02dd4fc07f8c5b070e2ddeb4b5afa6df2e7e162962e334d85fa4373d5b569ac3353cc56008ddc8277fa9e8f6684513bfa827686b6fb71259743f55f46fa7e6379312e93213faf275f0441d46bc5690181244c44bea45854ed4ccd99f3fd328110ae22ef1504ec0566652d742ed8a7e202539c6531824f7399b486fbb906a91b77f2a6ba27bf97ebc7482cea32278a7acd9f2210e6ed2defcbd112f29a92401c5a37c58835f870b056186ef3971d3d9effa5661cabc2ff070000cfb030dd4ac0fe54db67510d3e9a5d36b900000074000000000000000000000000006e96ba8f5e7e89bef4226173e20ebb17b924e9e6d0ee163713b2bd56f58dec64df91417beaac4061e6216774e048276e110d25ae7feb600897c8364af49ce59027a6ee5d7c6e12c0f45c0f376d9da065ca0499e209655d2420fcfa10fccf2cbe7b60161cc6cbd874c928689acd9d4e00cefacc887b76767ca1279e34d20b276dff8318e0ec5ab2929e63ef6a32b1abc55859804e2ec19e5b96a2df9f488e7e25a839701e37cdd850c2f26685047f1d492571482f993bb96642a3f56a0ea24d765c6edf2352e00bc4ff4a723ee2d9307e6f25bd05f98583cc0868"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x3c) (fail_nth: 1) 8m49.764576009s ago: executing program 1 (id=1274): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0) pipe2$9p(0x0, 0x800) r5 = dup(0xffffffffffffffff) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000e40), 0x0, &(0x7f0000000e80)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r5}}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000480), r0) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r0, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000680)={0x124, r7, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x5}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x3}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x5}, {0x6, 0x11, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x401}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x8}, {0x6, 0x11, 0x5}}]}, 0x124}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20020800}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32=r6, @ANYBLOB], 0x44}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000800)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ibss_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @val={0x3, 0x1, 0x80}, @void, @void, @void, @val={0x72, 0x6}, @void}, 0x41) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r8, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)={0x50, r9, 0x1, 0x0, 0x25dfdbfb, {0x27}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xffffffffffffffe6, 0x51}}]}, 0x50}}, 0x0) 8m48.313563156s ago: executing program 1 (id=1281): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r1, &(0x7f0000000380)={0xa, 0x4e23, 0xfffffffc, @loopback}, 0x1c) listen(r1, 0x4) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x12}, 0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) pipe(&(0x7f0000000140)) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x7}, 0x8) sendmmsg$inet6(r0, &(0x7f0000000980)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c, 0x0}}], 0x1, 0x20000000) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000140)=ANY=[], 0x8397de475a1b5b02) 8m48.234599104s ago: executing program 1 (id=1282): mkdirat(0xffffffffffffff9c, &(0x7f00000010c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000180)='./file0/file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000300)={0x2, 0x93, {0xffffffffffffffff}, {0xee00}, 0x9, 0xfffffffffffffffe}) mount$binder(0x0, &(0x7f0000000140)='./file0/../file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="6d61783d30303030303030303030303030303030303030342c6d61783d30303030303030303030303030303030303030332c73746174733d676c6f62616c2c73746174733d676c6f62616c2c73746174733d676c6f62616c2c6d61783d30303030303030303030303030303030303030312c73746174733d676c6f62616c2c73746174733d676c6f62616c2c6d61783d30303030303030303030303030303030303030332c7375626a5f726f6c653d5e242924235e2e192d2c6673757569643d35396361003866622d323662372d66210f382d363935612d62383961626234342c657569643c", @ANYRESDEC=r0, @ANYBLOB="1e83757118df07fb8da8b005be7b08d6d1a2ce08570047bbdc5999e4fef332ef39abe9c2092d05a98a6e6ac33c069bf55b9009f176f3a5e3d11513a3740a59c61d2a0a88fad96bfab62eb9f1662c86addeafb18a744f8f8796eb7053a129", @ANYRESDEC=r1, @ANYBLOB=',smackfshat=\\-^,\x00']) mount$bind(&(0x7f0000000400)='./file0\x00', &(0x7f0000000040)='./file0/file0\x00', 0x0, 0x2f1095, 0x0) mount$9p_rdma(&(0x7f0000000340), &(0x7f0000000380)='./file0/file0\x00', &(0x7f00000003c0), 0x8908e8, &(0x7f0000000440)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x9}}, {@rq={'rq', 0x3d, 0x94f3}}, {@sq={'sq', 0x3d, 0x1}}, {@timeout={'timeout', 0x3d, 0xff}}, {@common=@version_u}, {@rq={'rq', 0x3d, 0x7ff}}, {@common=@noextend}, {@common=@uname={'uname', 0x3d, 'binder\x00'}}, {@sq={'sq', 0x3d, 0x9}}], [{@fsuuid={'fsuuid', 0x3d, {[0x36, 0x34, 0x30, 0x33, 0x38, 0x32, 0x62, 0x66], 0x2d, [0x31, 0x64, 0x65, 0x37], 0x2d, [0x37, 0x65, 0x35, 0x63], 0x2d, [0x33, 0x30, 0x34, 0x38], 0x2d, [0x65, 0x62, 0x66, 0x34, 0x30, 0x32, 0x30, 0x62]}}}]}}) umount2(&(0x7f0000000280)='./file0/file0\x00', 0x0) 8m48.086938537s ago: executing program 1 (id=1285): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000880)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@bridge_delneigh={0x28, 0x1e, 0x1, 0x0, 0x25dfdbff, {0x7, 0x0, 0x0, r1, 0x0, 0x4}, [@NDA_LLADDR={0x12, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}]}, 0x28}}, 0x4040080) 8m47.988193648s ago: executing program 1 (id=1287): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f00000005c0)='fd', 0x0, r2) read$msr(r1, &(0x7f0000000640)=""/249, 0xf9) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x2) fchdir(r4) recvmmsg(r4, &(0x7f0000003100)=[{{&(0x7f00000001c0), 0x80, &(0x7f0000000340)=[{&(0x7f0000000280)=""/155, 0x9b}], 0x1, &(0x7f0000000380)=""/251, 0xfb}, 0x9}, {{&(0x7f0000000480)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f00000021c0)=[{&(0x7f0000000e00)=""/4096, 0x1000}, {&(0x7f0000001e00)=""/48, 0x30}, {&(0x7f0000001e40)=""/105, 0x69}, {&(0x7f0000001ec0)=""/63, 0x3f}, {&(0x7f0000001f00)=""/76, 0x4c}, {&(0x7f0000001f80)=""/129, 0x81}, {&(0x7f0000002040)=""/83, 0x53}, {&(0x7f00000020c0)=""/249, 0xf9}], 0x8, &(0x7f0000002240)=""/68, 0x44}, 0xaae}, {{0x0, 0x0, &(0x7f0000002480)=[{&(0x7f00000022c0)=""/228, 0xe4}, {&(0x7f00000023c0)=""/158, 0x9e}], 0x2}, 0x5}, {{&(0x7f00000024c0)=@generic, 0x80, &(0x7f0000002580)=[{&(0x7f0000002540)=""/1, 0x1}], 0x1, &(0x7f00000025c0)=""/42, 0x2a}, 0x7}, {{&(0x7f0000002600)=@alg, 0x80, &(0x7f0000002c40)=[{&(0x7f0000002680)=""/241, 0xf1}, {&(0x7f0000002780)=""/246, 0xf6}, {&(0x7f0000002880)=""/68, 0x44}, {&(0x7f0000002900)=""/201, 0xc9}, {&(0x7f0000002a00)=""/148, 0x94}, {&(0x7f0000002ac0)=""/204, 0xcc}, {&(0x7f0000002bc0)=""/15, 0xf}, {&(0x7f0000002c00)=""/58, 0x3a}], 0x8}, 0x3}, {{&(0x7f0000002cc0)=@isdn, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002d40)=""/38, 0x26}, {&(0x7f0000002d80)=""/222, 0xde}], 0x2, &(0x7f0000002ec0)=""/139, 0x8b}, 0x100}, {{&(0x7f0000002f80)=@caif=@dbg, 0x80, &(0x7f0000003000), 0x0, &(0x7f0000003040)=""/173, 0xad}, 0x10}], 0x7, 0x40, &(0x7f00000032c0)) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000780)=ANY=[@ANYBLOB="48010000100001000000000000000000e00000020000000000000000000000000a010101000000000000000000000000000000004e2100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffdfff0000000000000000000000000000000033000000fe8000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000004000000010000000000000000000a000000000000000000000048000100736861323536000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000048460000000000000000000000000008001d00000000000800220003"], 0x148}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r5, 0xf504, 0x0) sendmsg$nl_xfrm(r6, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40011}, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) close(0xffffffffffffffff) r7 = getpgrp(0xffffffffffffffff) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x9) ioctl$KVM_SET_USER_MEMORY_REGION2(r8, 0x40a0ae49, &(0x7f0000000900)={0x10201, 0x2, 0x5000, 0x1000, &(0x7f0000ffe000/0x1000)=nil, 0x100000000, r2}) syz_pidfd_open(r7, 0x0) r9 = openat$dsp1(0xffffff9c, &(0x7f00000005c0), 0xa002, 0x0) r10 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') acct(&(0x7f0000000600)='./file0\x00') mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r9, @ANYBLOB=',wfdno=', @ANYRESHEX=r10]) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200), 0x4, r11}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000500)={0x200, 0x1, &(0x7f0000000180)=[r11], &(0x7f0000000200), &(0x7f0000000580)=[r12], &(0x7f0000000040)}) 8m47.801575609s ago: executing program 32 (id=1287): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f00000005c0)='fd', 0x0, r2) read$msr(r1, &(0x7f0000000640)=""/249, 0xf9) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x2) fchdir(r4) recvmmsg(r4, &(0x7f0000003100)=[{{&(0x7f00000001c0), 0x80, &(0x7f0000000340)=[{&(0x7f0000000280)=""/155, 0x9b}], 0x1, &(0x7f0000000380)=""/251, 0xfb}, 0x9}, {{&(0x7f0000000480)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f00000021c0)=[{&(0x7f0000000e00)=""/4096, 0x1000}, {&(0x7f0000001e00)=""/48, 0x30}, {&(0x7f0000001e40)=""/105, 0x69}, {&(0x7f0000001ec0)=""/63, 0x3f}, {&(0x7f0000001f00)=""/76, 0x4c}, {&(0x7f0000001f80)=""/129, 0x81}, {&(0x7f0000002040)=""/83, 0x53}, {&(0x7f00000020c0)=""/249, 0xf9}], 0x8, &(0x7f0000002240)=""/68, 0x44}, 0xaae}, {{0x0, 0x0, &(0x7f0000002480)=[{&(0x7f00000022c0)=""/228, 0xe4}, {&(0x7f00000023c0)=""/158, 0x9e}], 0x2}, 0x5}, {{&(0x7f00000024c0)=@generic, 0x80, &(0x7f0000002580)=[{&(0x7f0000002540)=""/1, 0x1}], 0x1, &(0x7f00000025c0)=""/42, 0x2a}, 0x7}, {{&(0x7f0000002600)=@alg, 0x80, &(0x7f0000002c40)=[{&(0x7f0000002680)=""/241, 0xf1}, {&(0x7f0000002780)=""/246, 0xf6}, {&(0x7f0000002880)=""/68, 0x44}, {&(0x7f0000002900)=""/201, 0xc9}, {&(0x7f0000002a00)=""/148, 0x94}, {&(0x7f0000002ac0)=""/204, 0xcc}, {&(0x7f0000002bc0)=""/15, 0xf}, {&(0x7f0000002c00)=""/58, 0x3a}], 0x8}, 0x3}, {{&(0x7f0000002cc0)=@isdn, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002d40)=""/38, 0x26}, {&(0x7f0000002d80)=""/222, 0xde}], 0x2, &(0x7f0000002ec0)=""/139, 0x8b}, 0x100}, {{&(0x7f0000002f80)=@caif=@dbg, 0x80, &(0x7f0000003000), 0x0, &(0x7f0000003040)=""/173, 0xad}, 0x10}], 0x7, 0x40, &(0x7f00000032c0)) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000780)=ANY=[@ANYBLOB="48010000100001000000000000000000e00000020000000000000000000000000a010101000000000000000000000000000000004e2100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffdfff0000000000000000000000000000000033000000fe8000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000004000000010000000000000000000a000000000000000000000048000100736861323536000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000048460000000000000000000000000008001d00000000000800220003"], 0x148}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r5, 0xf504, 0x0) sendmsg$nl_xfrm(r6, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40011}, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) close(0xffffffffffffffff) r7 = getpgrp(0xffffffffffffffff) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x9) ioctl$KVM_SET_USER_MEMORY_REGION2(r8, 0x40a0ae49, &(0x7f0000000900)={0x10201, 0x2, 0x5000, 0x1000, &(0x7f0000ffe000/0x1000)=nil, 0x100000000, r2}) syz_pidfd_open(r7, 0x0) r9 = openat$dsp1(0xffffff9c, &(0x7f00000005c0), 0xa002, 0x0) r10 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') acct(&(0x7f0000000600)='./file0\x00') mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r9, @ANYBLOB=',wfdno=', @ANYRESHEX=r10]) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200), 0x4, r11}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000500)={0x200, 0x1, &(0x7f0000000180)=[r11], &(0x7f0000000200), &(0x7f0000000580)=[r12], &(0x7f0000000040)}) 3m42.193612218s ago: executing program 0 (id=2815): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56441, 0x70b925, 0x80000, {0x0, 0x0, 0x0, r6, {}, {0x2, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x3, 0x9a1c}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000c061}, 0x200c000) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x400, 0x20000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4}, {0x0, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_NAT={0x8}, @TCA_CAKE_WASH={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x20008844) r8 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r8, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x401, 0x181, 0x2, 0xa, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x3, 0x723, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3fd, 0x4000009, 0x200, 0xe2df, 0x9, 0x1, 0x4, 0x40000, 0x7, 0xf58, 0x6]}) ioctl$COMEDI_INSN(r8, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x92, 0x0, 0x1, 0x80000000}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000900)={'bridge0\x00', @remote}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x1, 0x0, [{0x0, 0x2, 0x5000000}]}, @restrict={0x0, 0x0, 0x0, 0x6, 0x2}]}}, 0x0, 0x3e}, 0x20) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ_RESET(r11, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x28, 0x15, 0xa, 0x801, 0x0, 0x0, {0x0, 0x0, 0x2}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x40090}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYRESDEC=r7, @ANYRES32=r10, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', r6, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x404080, 0x0) ioctl$SIOCSIFHWADDR(r12, 0x89a1, &(0x7f0000000900)={'bridge0\x00', @broadcast}) 3m41.397070771s ago: executing program 0 (id=2818): r0 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$FICLONE(r0, 0x40049409, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) syz_usbip_server_init(0x0) add_key(&(0x7f0000000380)='rxrpc\x00', 0x0, &(0x7f00000003c0)="01000000020000a9584109b35ae059630b008145f94cd9776ef916feff", 0xa918, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'dummy0\x00', 0x0}) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000040)={0x4, 0x6, 0x3, 0x297, 0x9}, 0x14) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000002c0)={0x3, r1, 0x1}) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x7, &(0x7f00000009c0)=ANY=[@ANYBLOB="fd0a43f06ad62f956ed76a189057b2181200009d4d153717a1de1a28e29e7cbaee0052874b878fd7b667356ee1d2cf364613cafdd33e971f83e6233712854853bbd2462f5f7969fa76d0e550d94e6f3a3924e9521398eaa1df2f905c61004f411bde2576e19c7d0228", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000085100000060000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x8, 0xe9, &(0x7f0000000100)=""/233, 0x40f00, 0x3d, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000200)={0x6, 0x1}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0xc, 0x1, 0x80000000}, 0x10, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000980)=[{0x3, 0x5, 0x1, 0x7}, {0x3, 0x1, 0x7, 0x6}, {0x1, 0x3, 0xd, 0x2}, {0x2, 0x2, 0x1, 0x9}], 0x10, 0x4}, 0x94) r5 = openat$cgroup(0xffffffffffffffff, &(0x7f00000003c0)='syz0\x00', 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000500)={@cgroup=r1, 0x8, 0x1, 0x7, &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r7 = socket(0x1, 0x5, 0x0) r8 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000500)={0xe000200c}) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x19, 0x1b, &(0x7f0000000a80)=ANY=[@ANYBLOB="18000000000000000000000001000000b01bf0ff0000000018000000feffffff000000000008000018120000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b703000000000000850000000c000080b700000000000000b7080000000000007b8af8ff00000000b70800000000091ab270bafd9b6100007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000010007040000f0ffffffb7020000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b70500000800000085000000a50000001d3408000800000018260000", @ANYRES32=0x1, @ANYBLOB="1aa471e8e5acabd1ccbef039762b33000000784bf2ac2a10874140ac"], &(0x7f00000006c0)='syzkaller\x00', 0x1, 0x70, &(0x7f0000000700)=""/112, 0x40f00, 0x53, '\x00', r2, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x8, &(0x7f0000000780)={0x8, 0x4}, 0x8, 0x10, &(0x7f00000007c0)={0x3, 0x8, 0xffff, 0x8000}, 0x10, 0x0, 0xffffffffffffffff, 0x5, &(0x7f0000000800)=[0x1, 0x1, 0xffffffffffffffff, r0, 0xffffffffffffffff], &(0x7f0000000840)=[{0x0, 0x1, 0x0, 0x5}, {0x5, 0x2, 0xa, 0x4}, {0x3, 0x4, 0xa, 0x2}, {0x5, 0x5, 0xb, 0x7}, {0x3, 0x3, 0x5}], 0x10, 0x9}, 0x94) syz_emit_ethernet(0x7e, &(0x7f0000000000)={@broadcast, @empty, @void, {@ipv6={0x86dd, @gre_packet={0x9, 0x6, "140080", 0x48, 0x2f, 0x100, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x0, [0x8]}, {0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x800, [0x0]}, {0x0, 0x0, 0x0, 0x1}, {0x8, 0x88be, 0x104, {{0x6, 0x1, 0x2c, 0x0, 0x1, 0x3, 0x7, 0xfb}, 0x1, {0x7f}}}, {0x8, 0x22eb, 0x1, {{0x9, 0x2, 0x1, 0x3, 0x0, 0x2, 0x4, 0x9}, 0x2, {0x2, 0xc4, 0x0, 0x6, 0x0, 0x0, 0x1, 0x0, 0x1}}}, {0x8, 0x6558, 0x1}}}}}}}, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000540)={r4, r5, 0x32, 0x0, @val=@tcx={@void, @value=r9, @void, @void, r6}}, 0x1c) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYRES8=r2], 0x40}, 0x1, 0xba01, 0x0, 0x20008900}, 0x50) 3m40.769546436s ago: executing program 0 (id=2821): syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000005100)={&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff2000/0xe000)=nil, &(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f00000040c0)="8dda8b4cc44d1073e29f374b8418b2bf3bf216568034b734944500f8ebf4e54a7ebb6421afdd772aba9da3c54fe1fa9632ecb894076397253a0eb4e732b722c68fe0f48f28b6eaf14315ef5754292621c3f3c7c3d8b46156c014b4345844741da39caa3c1868489947cce1296be3845285b7f3ceba9439b4580d92c96e9515227a32af76ec7498d264e5b9918de9bd642617c9ecc18fa06472dca231816908280add650ded4145e084c61a68bc814411ff9d82d4a3ef373dc3742af14f232c8ee4d55027f7cce961f44c834b5a965894bc3690495c6ac0883e3ec5525152dc90fecb649d63a4b95615f3042ca637805be9919c23afd76c544ebb3c6fb078af3c15e4a5a6642e2e4c72e177752598285ca3770f3493c4d7a8373be9991a71da9631218a1e5834a00de03bdb5f15ba2197ae36d7b8fee85d626682330aaf3876d01622c50817f8631fa4257dbace786e2925b3d0758a601d31928d6a9656b931007619ad77bf16a6ebbefd973ded4ccf96a9c91007addc4a43215230930207d82500c1b71dbd0cc5892d54923f79a00651ef7a903817a1caebbc8bdb70a9d2eab5df5f088209d8bd8a531dcfc642495e5f4dc84cf7fac705453d7ec7388481d512fd", 0x1c1}, 0x68) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0xc0542, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) timerfd_create(0x0, 0x0) socket(0x23, 0x5, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x6, 0x5, 0xfffffffffffffffd, 0x8001, 0x0, 0x1000000ffe, 0x45}, 0x0, &(0x7f0000000080)={0x3ff, 0x7fffffffffffffff, 0xa4f, 0x9, 0x0, 0x10, 0x80000002}, 0x0, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000d80)) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) r1 = dup2(r0, r0) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000080)=0x1) 3m37.723346678s ago: executing program 0 (id=2831): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000002780), 0xffffffffffffffff) sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f0000002900)={0x0, 0x0, &(0x7f00000028c0)={&(0x7f00000027c0)={0x14, r2, 0xf1f, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4800}, 0x4080) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xa3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r3 = accept4$rose(0xffffffffffffffff, &(0x7f0000000200)=@short={0xb, @dev, @bcast, 0x1, @rose}, &(0x7f0000000240)=0x1c, 0x800) ioctl$sock_SIOCBRADDBR(r3, 0x89a0, &(0x7f00000002c0)='veth1_vlan\x00') mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x20100, 0x83) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$setregs(0xd, r5, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4204, r5, 0x2, &(0x7f0000000740)={0x0, 0xfffffffffffffe8c}) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r4, 0x40086602, &(0x7f0000000000)) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000140)="91f8a9849519def28691bbc4173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000", 0x41}, {&(0x7f0000000e80)="44900000000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fff9d3b1ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf4ca7f6adca92c73d97ce54164c1942b2568635bec8e020b41fb2f8000000000000000000000000000000001c8a9f7956583e26f6f0edc415851d0b8305fe66c2b7c114e3712d87744938848f24a13cb604000000000000000000000000000000c7aa5035897b20", 0x10a}, {&(0x7f00000003c0)="641a6a2b863c0dd898013a3f97a834ebb75a925ab48c844221841a232932fc2e37e327de21450df098c113e1", 0x2c}], 0x3}}, {{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000640)="42e013913edbeb683c44e18a52b5a2462064ddd92caaba941de80d06047dedb7eeeff3a27eacf4c416b6979d6c918608807c44d01535dbaab3b390086e4fd43c6b5931187023646d6beac2340fdc7a0d81214ac76a818f64d287311e8828dfd3e3dd67efdb129a6e52745d1540e570891f6bf411cc16a18c4d34e522a1f003498f1a03ea1f8828b6c902286c71a9bc21923972dacfa74fef6a0fd3267e599c1dd33dff5d7b28f134bda4a29962fd5daa4fc9c515a1c3ee25ace1a9948c24b277d0c9c46f948f8a3f98b1a18eff685b7296457ba31632fea4d8f8", 0xda}], 0x1}}], 0x2, 0x2090) r6 = socket$tipc(0x1e, 0x2, 0x0) r7 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r7, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r7, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f00000001c0)={0x42, 0x1}, 0x10) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 3m37.395898358s ago: executing program 0 (id=2833): r0 = openat$kvm(0xffffff9c, 0x0, 0x800, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x840, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$setsig(0xffffffffffffffff, 0xa, 0x1c) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000140)={0x40, r3, 0x1, 0x70bd27, 0x5, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r4, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x18, 0x1411, 0x20, 0x70bd2b, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x2}]}, 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a3000000000090003007379"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x24}, @NFTA_RANGE_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) ioctl$IOMMU_IOAS_IOVA_RANGES(0xffffffffffffffff, 0x3b84, &(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r7, {}, {}, {0x8, 0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x8881}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'lo\x00', 0x10}) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x5) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x33) r8 = socket$inet_udp(0x2, 0x2, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r9, &(0x7f0000000440), &(0x7f0000000040)=@udp=r8}, 0x20) ioctl$sock_SIOCINQ(r8, 0x541b, &(0x7f00000002c0)) 3m37.055458929s ago: executing program 0 (id=2836): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000040)=0xc) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000640)=0x20000) 3m36.73712367s ago: executing program 33 (id=2836): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000040)=0xc) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000640)=0x20000) 20.221542609s ago: executing program 3 (id=3630): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$kcm(0x11, 0x3, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x800, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1d19cb307b3472ab9cdb042d2", "643fcbb2c5a57df67d074af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r5, &(0x7f0000000940)=[{{0x0, 0x0, &(0x7f0000000540), 0x2}, 0x3}], 0x4000048, 0x0, 0x0) 17.570690961s ago: executing program 3 (id=3637): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000795d6c08450c3a616dc4010203010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 15.458395639s ago: executing program 3 (id=3650): openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/softnet_stat\x00') r1 = syz_open_procfs(0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000000), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 14.457110532s ago: executing program 3 (id=3654): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x40) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="2703020001f314000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f9015cc99e570000003c21c00b000000000000721a5dbb56a3d9e16e7c2179c9b5b24722944820e624fc5b17d0822ca4232c98a9936ba722475ca5", 0x72}, {&(0x7f0000001400)="7f4ba13c5a27118dc920175650f0c9ba1809dd13a6e2d5b38f40adfa278c09e0e3bd05add4d780cd753b50f06f3b51f43761c7783f38ceaefc2dad57889d8b3a2d21314410f64ec2fa92e3a14b0141b39c020021d1edd011fbccb808a317fff4cf49aab12da619d67102048ec43c76cdb9d395e8b7b6e589d788aeeecb5080fc3d5ec6ccd656e49c0a642671d3fc363b46240bbc46ad965399b71db3c8f2b269b20870a3d2a6a8de5213b0f9d41c510c827056b7284391da244ec7653648b670f9a3483b314d861992ed7fb369eda093e1643c300b94d996fc592adb22c379be070ce5cd806da85a492dd4199cceb4c5b750222485325cf1073bf87e93bdf7da8af8f5f626541afd142e24ee8f4be9f038453c0edf500deabfe4d1a7a9de51df012bc2f3b767b3c03be6ace8c37ad571323cd363116e01f98a8ff8148d3900a65b788e99ddf9d9a2383f1730c7868d2dd031034bce5a77bd1ef3385105968be7bd830bde788092f657be36f89ea55ced486e18982d01339ed04a934a43c7b3be5e6bd03cbe773a938f621809345ec07cfceb013e3d76d500d97c8bee6ff54980ac3d221fcb35724ba64adb29ae8db909e097d78ff9542196635a14266944b850c9d436e96cc806a88090cbfc9db7ce83231bc043ded67966cfd68b800f6030a85f6bb070a2a5b372be2dacea7884b42e76e164af04e47f90ce0694623dce23cd1471f1a6029f68331317073e1a2d8cfb16f821c867d35a609649cf36aa781fa0a381f934844366d4e3ab8dd239c6ec35c15f307a7ed07869aacec38d787fd9c08e9dda1a28bf1a15b004bb1d88aa429ee8e927f5a1e1445685d8923cad92c90c79726d5e73dfe741de35498842cf51a4f09b97b1c14d33213705b95e84a8853fab4e1ced6faecea9d9203b038594bceb202a9d47f862c4f1853db9a0a7bf98ed9d2e3012358b38d092bd1ed7efb1a9e582ac5ef30c9b476e185f537f40ae8189528b480436122a939967e8d862e01172245ebced9f5251dd302e7e974c1db40be1e9e79799c27384caf6485e7c469b77cd6b28f71e39f84d2adbe074dd2bed6636e6853655adc3d1a47eff697e8edba53e6b281aea94798d82da7d3e86d09d869e5e345316eeeced4e15fc39234a0b0104e0b205c95eda632d0e86b095b284f441a62cb0e7262bc1967ee75f5c2d459011b0c15f4c85b02150a8834eda7f84cc96dde04e4abbdf5985a9c7218797820251b5804cae80c9a726afddf36793ae52cfb38e4e19740d6e07e4ed7c01001ab87b7fb12d5b70a75938d234c83d863b1763aec37b41d204fc319c6e802734ed681ea179fe6cad4857c3ca0e236e7b9867688d8bd7749e919f2d4f57f2249c9ccaf76a23760569b0fbde2db12ca0169e74982c1f4f0494aae13f4838b3f50d9ab0f6e328250d6fc34c0156e4b754c5c648b4ef8af32c91859f9706048f029634cefd0d767e8b7743262cb8a468ad37dfa47a745495e3f03cfa1d4ed71af55453c0a25fa1122a9054bcc4d9960c9a54f36b6db55154ab7dd19890d9f8ff3549e0fbd5a655319566b7f9c72be0242e7ffb59020356c3ffb5b9c43858e69d7b677a9bc5b8a64721a51b75a254e07199a73726834bea05901455ad53b38116b953c970b2002d0d1f91deb73ccb7266fbb21aa8555599daed7585575ef3efbd737f2523018ba4645d862889d5c3d91b12f04166db8bffecde54ee278d0d5351f3bf1f8902ff3f4c24a8c0c8a4e6addc9baadc471813589324d3128a1b193137c15c01be9f367317b1c885301ff8e9df728efa37df27f65eb0464055091f2ed469fdab48f413e3978f73ff9dffeb85453e841f86594612ac91b50add8d14910748bfa903033662f3e735ce6d299ce52338a96035aa89f63bd59d151fb20c38125236cbc0d795ac6f8da4cafc74714ed62a23b017e15adcaade58385b78c6945fb30a2539c42b1e415879433b9fb6966c6d19ed19f9f90cbd360d936a8b9f8e03bca5a83c063651b4636a7783bbda6417c83e470a16dfb115344a527436242ace9341432b5816b5e6609d97d600e142ca3cf74cbc00e1d9ee203cdfad339ce460b294f3931c5bd8ae6da8fc14d66a01bae4a212ef3d914e58c13217c8ad91628636b56257c7ca41b404cc2d4b5d50e26ebefc74656c62b1b4e9b6c5b6cc8d79101460f719d95925630bf99e042018439c50026513d680ea573620132ded57dea9e2da4e16f17dbc171642b1e80a3f41311ee73441302285668792160db6614fdb30d25a5719d2ae03ab98ea167597c48dd8197e7faf6189d801134462027901506c5ff1ae2558d96722217f65131d2f429693ae9fae19c101319473608976d08cc1c0d98f789b0c364e8aca574321ab2857af1015f1588afd313503085db4d99961a9391db06c10477ceb44199f1648594e8f9b452fafdab49b1962d02ee77ebd31b7931174a729fa943cb18102130e7e08eaba77df066069c2c3564fc85881ba0dad12c4f06a9e6dea9fea53931ff85e38505eb7ad60a52e2a8a248b3f4d0d55eee31f75f110c70e3b12409a79a5a98b0156c6d2a5d94604b8fa202b12746a365c708c671316cc0ffff6e9b7139b337953be22672a4910e1eb28cccc023b77028e20a6d377a339372f0dc235069f41c2692b0a3a7e0f315f4aebeef435a46b2e8b8462739293f9184c01b1434e87bf3fd48be54bf437056a1d2cff0c7aa52578013f96b1d5100ca936ff029cfd6f9a093621f684196ed7e1d363a97c647c34fe5f2370e7ab9dc718a1fc317779ab8a04bc12c01b778d17eea0b546bce03475fc6373c860714df0322dde550186c553ebd61ed18c0b80655f0827a63d209117ca23b026c1ad30bac4d43a4611292c7049f855b829a3a17fd2b83c142078beed8ca07b7cb7cd624705ccc160246c81174a4d3a9f2057caffe84b1ac073375e065c1ff4e9e22e7d87b3adb40ff796132e4ed86e5fc9f9616f8e4116be96497621692fb516e9316cfd15ad01742a1de4aa35fe02861236295823edf4c48fc37faf55226044e393a3733d58e8ef0f0c7941bc30f09739f37dea2f395f2e9e9b2c31a11923a2d6c9b14f1bacce15094cbbd6445f3581c6d45b76943b4d0db8fd4d4acbdb91780f57c872827abd7a1f13290a0d17dda220493476c92ce65e33f07afcf763aec0e67450f547101f1a5ada0f760c8f12137679324e22c7a13fdf78575115acb0ae4a2818b7b3ead27eea5eccba6f7a34c61819382eebfad742a3c603c6d2f332726996b3e8fcbdfd56b436c1173b1b3bc1ab66a717e31f2f918f0bea3f4801e04c14c881c59324fd9bc38745dd0e47da6bc8e98fe74a760304d74f17cd3cfceb33503397cf592d2b6a51b641d559ba8d6dc449e19b289fd1a4b3772b3998181e787723fe3893362d8f3e346c0ab0abe933e9bdd9a82b377914018377af9d2cbc58ab4fc08cea2623174239cea585603b8acd20da923a44799b1745c3bd65640508f96a0d92a6a2fd8314573f10b4f6e6cbf61e8828bd6e69b1b0c47f5795917a5035b3424dc3cadd2aadbbafb9d18349fab41d79ba13660f2c9400ff87784b26c3e88785db8522c93d3d4f12608736a235c8b9fff98a17934fe36792cb1992ea1b72b5e151cfe82b4ebc4f510882e4b34ee9f6ada188b104ba36e8acbd7bafe39b32f957da45c2743017545fd61667d36d58952de0cdbacb3abc549e1001bf6d9b19f9a353bb84bd152e04c061c691b514d6f1b36a8895424ce210a4cd75d537443a2791dc68e9fff510358f7586d3b73ed04223e683adf6a1c79d3bc92aa595cc6167", 0xa91}], 0x2}, 0x0) 13.972064201s ago: executing program 3 (id=3656): syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000140), &(0x7f00000001c0)=0x60, 0x0) 13.648895487s ago: executing program 3 (id=3659): r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)="1400000016000b43d27a80648c2594f90924fc60", 0x14}], 0x1, 0x0, 0x0, 0x600}, 0x0) 7.257533944s ago: executing program 5 (id=3681): mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x100000e, 0x2010, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ptrace$setregset(0x4205, 0x0, 0x201, &(0x7f00000002c0)={&(0x7f0000000200)="1a167f09adc1173486476dd2b87047c889f0eccc6897ead2d1e5978ca143c89b57d3cca1e849be12491e5aae911cb21f3248772ee8c17d0fb48f5cd0d314fa990943c1c80ed2852aeda67f750d", 0x4d}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) ppoll(0x0, 0x0, 0x0, &(0x7f00000025c0)={[0xd]}, 0x8) write$binfmt_aout(r2, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000dc0)={0x0, 0x1, 0x3, 0x1, 0xfe, "0062ba92600000f73809630400"}) r3 = syz_open_pts(r2, 0x900) r4 = dup3(r3, r2, 0x80000) read(r4, &(0x7f00000000c0)=""/226, 0xe2) read$watch_queue(r4, &(0x7f0000000e00)=""/4095, 0xfff) r5 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x2, 0x4, 0x22, 0x1, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffb, 0x3], [0x0, 0x8, 0x100]}}]}}]}, 0x8c}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0xa, 0x8000, 0x0, 0x9, 0x1, 0xfffffe0000000002, 0xfa0f, 0xffffffff}, 0x0) r8 = socket$inet(0xa, 0x801, 0x84) connect$inet(r8, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r8, 0xfffffffd) r9 = accept4(r8, 0x0, 0x0, 0x0) recvmmsg(r9, &(0x7f0000001000), 0x581, 0x40000000, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r9, 0x84, 0xb, &(0x7f00000002c0)={0x3, 0x1, 0x2, 0xff, 0xa4, 0x0, 0x1, 0x0, 0x9, 0x8, 0x0, 0x4, 0x2, 0x20}, 0xe) 6.664720344s ago: executing program 2 (id=3683): r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000000ea0103000000090001"], 0x70}}, 0x20000800) (fail_nth: 6) 6.614718288s ago: executing program 6 (id=3684): r0 = inotify_init1(0x800) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(des3_ede-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000540)="ad56000081000008009a8100"/23, 0x17) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r1, &(0x7f0000000000)='\x00', 0x288000, &(0x7f0000000040)={@_ha_fsid={[0x2, 0x6]}, {0xfe00, 0x0, 0x40, 0x5}}, 0x4, &(0x7f00000000c0), 0x0}) r2 = io_uring_setup(0x1f6a, &(0x7f0000000340)={0x0, 0xcc11, 0x40, 0x1, 0x1a9}) io_uring_register$IORING_REGISTER_FILES2(r2, 0xd, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000400)=[{0x0}], 0xffffffffffffffff}, 0x20) r3 = openat$comedi(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$COMEDI_BUFINFO(r3, 0xc02c640e, &(0x7f00000001c0)={0x2, 0xfffffff9, 0xffffffff, 0x0, 0x3, 0x6, 0x6}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000180)) socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$sg(&(0x7f0000000440), 0x8, 0x408002) syz_open_dev$tty1(0xc, 0x4, 0x3) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) sendmsg$IPSET_CMD_DESTROY(r5, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x4c814) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="500000000a0601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) fcntl$setpipe(r2, 0x407, 0x8000000000000000) 6.199491243s ago: executing program 2 (id=3685): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f00000004c0)={0x3, 'rose0\x00', {0x2}, 0x8}) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NLBL_CALIPSO_C_REMOVE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40005}, 0x20000081) r2 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100), 0x40000000000000ce}) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) ioctl$VIDIOC_QBUF(r4, 0xc058ff0b, &(0x7f0000000200)=@multiplanar_userptr={0x8, 0x7, 0x4, 0x70000, 0xff, {0x77359400}, {0x4, 0x8, 0x3, 0x3, 0x3, 0x0, "8dcda3ce"}, 0x7fffffff, 0x2, {0x0}, 0x1}) r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r5, 0x40000) 6.11368851s ago: executing program 6 (id=3686): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYRES64=0x0, @ANYRES32], 0x0) syz_usb_connect$cdc_ecm(0x0, 0x104, &(0x7f0000000580)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xf2, 0x1, 0x1, 0x2, 0x80, 0x5, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x2, 0x6, 0x0, 0xf, {{0x8, 0x24, 0x6, 0x0, 0x0, "130869"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x5, 0x5, 0x200, 0x3a}, [@mdlm_detail={0x94, 0x24, 0x13, 0x1, "25b06d143186f3c6e2639c316157f34ebe0057917ea53e3620a25654f201c6f381cf599032ce25fb639c91507c7bfbe95784573a7300ce68d892c40c1c289d0aab9d964c935a497e913ee1900620333c52cde983d33a2baa44b9974851e7970f71a0f53b0d3db29c9fdf11af78c8ab5c8d5705f9cbaeea02204c40475648f6977fa512ea5fb341fb0d3a2916bbecfe4b"}, @mbim={0xc, 0x24, 0x1b, 0x55bb, 0xc781, 0x0, 0x8, 0x3e, 0x7f}, @network_terminal={0x7, 0x24, 0xa, 0x2, 0x6, 0x8, 0x55}, @network_terminal={0x7, 0x24, 0xa, 0xe, 0xb6, 0x6}, @ncm={0x6, 0x24, 0x1a, 0xfff2, 0x3d}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x400, 0x3, 0xfe, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x9, 0x3, 0x1}}}}}]}}]}}, &(0x7f0000000800)={0xa, &(0x7f00000006c0)={0xa, 0x6, 0x300, 0xa8, 0x81, 0x7, 0x10, 0x6}, 0x51, &(0x7f0000000740)={0x5, 0xf, 0x51, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x9, 0x3, 0xa, 0x7}, @ss_container_id={0x14, 0x10, 0x4, 0x9e, "26accbc5b61ea272a2f7bfd8d00dcab2"}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x5, 0x9, 0x9}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x5, 0x40, 0x4, 0xf7a}, @ssp_cap={0x20, 0x10, 0xa, 0x0, 0x5, 0x8001, 0x0, 0x80, [0xffc030, 0xff0000, 0x30, 0xff0000, 0x804000]}]}, 0x1, [{0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x2009}}]}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000009c0)={0x44, &(0x7f0000000700)=ANY=[@ANYBLOB="40000f000000012721dcfe14c639a500ba17162716"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0}) (async) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$cdc_ncm(0x1, 0x97, &(0x7f0000000040)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x85, 0x2, 0x1, 0x8, 0x20, 0x5, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x9, 0x24, 0x6, 0x0, 0x1, "cba979e9"}, {0x5, 0x24, 0x0, 0x272}, {0xd, 0x24, 0xf, 0x1, 0x8000, 0x3, 0x7, 0x3}, {0x6, 0x24, 0x1a, 0x100, 0x30}, [@dmm={0x7, 0x24, 0x14, 0xfff9, 0xff}, @mdlm={0x15, 0x24, 0x12, 0x5410}, @acm={0x4, 0x24, 0x2, 0x4}, @obex={0x5, 0x24, 0x15, 0xa}]}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x3, 0xf4, 0x35}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x210, 0x8, 0x9, 0x1}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x7, 0x2, 0x81}}}}}}}]}}, &(0x7f00000003c0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x3, 0x8, 0x1, 0x10, 0x6}, 0xd3, &(0x7f0000000140)=ANY=[@ANYBLOB="050fd300060c100af740010000000fff0110100a07010100000f0f0300800100000a1003000a0000068905141004de14cd1a7651f5ffe826e9e57935932fe93c1001cad33fdc1e3f61a45f5b03b212e8cce25dde35db679cdebc253ae4a459fc6ed05d24bac671258823856219b75bf88ae85df919aacf873a59c3581003abdbf758b8c8a0014d52682c2ff4281cba063a31f4339e8e300f1749aeb60bdf2f6a653ab67a67a6902727ac90d4e4f9522fd0c3193a9a582bb4212b6d2c2e30338b0cb32c66ca51a1f3238e41052dbd8211fb08da"], 0x5, [{0x4b, &(0x7f0000000480)=ANY=[@ANYBLOB="4b03ca87f4d935b719c713059d5da509aa7e5603f97695b9fa4b4965c147fad909c0f0de22f2f058595447e5fef3e5310cb5e460851bd4dc1f562386a24f082e07000000daa9368935969a8d13e2dcdb419b9ff9bb34fec6f93cb24be8225f1ed5bc40232d2b38850ad8831516e28792dc6ffe8c80bc3c2f813fb21aa1135f0b9b5f1c55cfa7d1fa07349f5155b7778287173333dcfe51f4775b50ab02f90993a469cbaa6fd8a9ec6d5a8fdf47d19ea8e9a51182a776c256a93d96b720efc9d4eab3653b4b146c10ddf10d3f1c18fe81c23807b1262941d7e6eb28e411ee5bf29eb2444277637f08901fd9a4ab8e25b9e244a5d21acfe0ece2cb"]}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x458}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x2801}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x401}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x813}}]}) (async) ioctl$EVIOCGMASK(r1, 0x5b14, 0x0) 5.782507576s ago: executing program 4 (id=3687): socket$kcm(0x10, 0x7, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000080)=@udp6}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800201000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffed3, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x10) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280), 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000150001030ec00000fcdbdf2505"], 0x14}}, 0x0) r4 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vxcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001800010000000000fedbdf251d01060008000900", @ANYRES32=r5, @ANYBLOB="f8000300", @ANYRES32=r5, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 5.734843253s ago: executing program 5 (id=3688): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, 0x0, 0x0, 0x2, 0x0) r5 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)="1400000016000b43d27a80648c2594f90924fc60", 0x14}], 0x1, 0x0, 0x0, 0x600}, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000340)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0xfe, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1], 0x0, [0x8, 0x4, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3], [0xfff, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0x3]}}]}}]}, 0x8c}}, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/85, &(0x7f0000000480)=""/74}) openat$selinux_status(0xffffffffffffff9c, &(0x7f00000006c0), 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x2, 0x5, 0x5e8, 0x0, 0x448, 0xffffffff, 0xf0, 0x220, 0x518, 0x518, 0xffffffff, 0x518, 0x518, 0x5, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@empty, @ipv6=@remote, @port=0x4e22, @gre_key=0xfffe}}}, {{@uncond, 0x0, 0xe8, 0x130, 0x0, {}, [@common=@unspec=@connlimit={{0x40}, {[0x0, 0x0, 0xffffff00]}}]}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x3, @ipv4=@local, @ipv4=@multicast2, @port=0x4e24, @gre_key=0x200}}}, {{@uncond, 0x0, 0x1e0, 0x228, 0x0, {}, [@common=@rt={{0x138}, {0x7f, [0x6, 0x8], 0x3, 0x8, 0x2, [@private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast1, @loopback, @empty, @dev={0xfe, 0x80, '\x00', 0x1a}, @dev={0xfe, 0x80, '\x00', 0x2f}, @dev={0xfe, 0x80, '\x00', 0x1c}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @local, @empty, @dev={0xfe, 0x80, '\x00', 0x12}, @ipv4={'\x00', '\xff\xff', @empty}, @mcast1], 0x7}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x4, @ipv6=@empty, @ipv4=@private=0xa010101, @icmp_id=0x68, @port=0x4e22}}}, {{@ipv6={@remote, @mcast1, [0xff0000ff, 0xff000000, 0xff000000], [0xffffffff], 'veth1_macvtap\x00', 'pim6reg\x00'}, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x9}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x648) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) 4.986685498s ago: executing program 4 (id=3689): r0 = openat$kvm(0xffffff9c, 0x0, 0x800, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x840, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$setsig(0xffffffffffffffff, 0xa, 0x1c) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000140)={0x40, r3, 0x1, 0x70bd27, 0x5, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r4, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x18, 0x1411, 0x20, 0x70bd2b, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x2}]}, 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x24}, @NFTA_RANGE_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) ioctl$IOMMU_IOAS_IOVA_RANGES(0xffffffffffffffff, 0x3b84, &(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r7, {}, {}, {0x8, 0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x8881}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x5) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x33) r8 = socket$inet_udp(0x2, 0x2, 0x0) r9 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r9, &(0x7f0000000440), &(0x7f0000000040)=@udp=r8}, 0x20) ioctl$sock_SIOCINQ(r8, 0x541b, &(0x7f00000002c0)) 4.803746003s ago: executing program 2 (id=3690): bind$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x10, 0x0, 0x1, 0xb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}}, 0x14) syz_usb_connect(0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_open_procfs(0x0, &(0x7f0000000380)='maps\x00') syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) pread64(r4, &(0x7f0000000600)=""/4091, 0xffb, 0x12c) 3.928078605s ago: executing program 5 (id=3691): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="640000000f14ffff29bd700000dcdf25080001000100000008000100020000000a00450069706f6962000000080003000200000008000100000000000845444631f55d485dcccdfed1faead5f55618e5342636f04c0001000200000008080300010000000800010002"], 0x64}, 0x1, 0x0, 0x0, 0x800}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x7) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="66b843008ee066bad004ec0f01c966ba4100b0a5eec42130c6a816eb71e235b8010000000f01d9660f38822042394a04b8010000000f01d9410f01df", 0x3c}], 0x1, 0x43, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) openat(r2, 0x0, 0x60042, 0x18f) prctl$PR_MCE_KILL(0x23, 0x9, 0x7fffffffeffe) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x401, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r7}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x20008004) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) setgroups(0x0, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000280), 0x2a29000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r9 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r9, &(0x7f0000019680)=""/102392, 0x18ff8) socket$kcm(0x10, 0x3, 0x10) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_usb_connect$uac2(0x2, 0xa1, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8f, 0x3, 0x1, 0x6, 0xc0, 0x1, {0x8, 0xb, 0x1, 0x2, 0x1, 0x3, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x6, 0x15, 0xed}, [@output_terminal={0xc, 0x24, 0x3, 0x1, 0x405, 0xfb, 0x5, 0x2, 0x5, 0x3}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0xe, 0x4, 0x1, {0x8, 0x25, 0x1, 0x1, 0x0, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x0, 0x9, 0x5, 0x40}, @as_header={0x10, 0x24, 0x1, 0x1, 0xe0, 0x3, 0x3, 0x4, 0x81, 0x8}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x5, 0xa9, 0x9, {0x8, 0x25, 0x1, 0x1, 0x0, 0x10, 0xf}}}}}}}}]}}, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) 3.019412485s ago: executing program 6 (id=3692): syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/ip6_tables_matches\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fcntl$notify(0xffffffffffffffff, 0x402, 0x3f) pipe(0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r3 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2.260277228s ago: executing program 4 (id=3693): r0 = dup(0xffffffffffffffff) accept4$nfc_llcp(r0, &(0x7f0000000140), &(0x7f00000001c0)=0x60, 0x0) 2.133439284s ago: executing program 6 (id=3694): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) dup3(r0, r1, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f00000002c0)={0x0, 0x900, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100fefffffffbdbdf2567000000080001000100000008000300", @ANYRES32=0x0, @ANYBLOB="0c00990001009f2e4c230000a34f13a86caa83d704caa461ff519fb1df3f4f309409e99711078163ba34c310ed10dde749610c7c23a578a2ad684d0d926c27336d6afe2598b37347bbadcf4ffa6574ae49e5"], 0x30}, 0x1, 0x0, 0x0, 0x600d005}, 0xc800) 2.04730035s ago: executing program 4 (id=3695): r0 = inotify_init1(0x800) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(des3_ede-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000540)="ad56000081000008009a8100"/23, 0x17) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r1, &(0x7f0000000000)='\x00', 0x288000, &(0x7f0000000040)={@_ha_fsid={[0x2, 0x6]}, {0xfe00, 0x0, 0x40, 0x5}}, 0x4, &(0x7f00000000c0), 0x0}) r2 = io_uring_setup(0x1f6a, &(0x7f0000000340)={0x0, 0xcc11, 0x40, 0x1, 0x1a9}) io_uring_register$IORING_REGISTER_FILES2(r2, 0xd, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000400)=[{0x0}], 0xffffffffffffffff}, 0x20) r3 = openat$comedi(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$COMEDI_BUFINFO(r3, 0xc02c640e, &(0x7f00000001c0)={0x2, 0xfffffff9, 0xffffffff, 0x0, 0x3, 0x6, 0x6}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000180)) socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$sg(&(0x7f0000000440), 0x8, 0x408002) syz_open_dev$tty1(0xc, 0x4, 0x3) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) sendmsg$IPSET_CMD_DESTROY(r5, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x4c814) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="500000000a0601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) fcntl$setpipe(r2, 0x407, 0x8000000000000000) 2.007779989s ago: executing program 6 (id=3696): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x8}, {0x7, 0x1}, {0x0, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x44060}, 0x98) 1.913956421s ago: executing program 4 (id=3697): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$ptys(0xc, 0x3, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)=0x3) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200), 0xa2442, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) write$dsp(r2, &(0x7f0000000280)='\x00', 0x1) ioctl$SNDRV_PCM_IOCTL_DELAY(r3, 0x80084121, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xf}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x14}]}, @NFT_MSG_NEWSETELEM={0x14, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha20\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) r5 = accept4(r4, 0x0, 0x0, 0x0) recvmmsg(r5, &(0x7f0000000cc0)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000540)=""/237, 0xed}], 0x1}, 0x18}], 0x1, 0x101, 0x0) sendmsg$nl_route_sched_retired(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000d00)=@newtfilter={0xf0, 0x2c, 0x400, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0x1}, {0xd, 0xe}, {0x1, 0x1}}, [@f_tcindex={{0xc}, {0xc0, 0x2, [@TCA_TCINDEX_HASH={0x8, 0x1, 0xef0b}, @TCA_TCINDEX_ACT={0xb4, 0x7, [@m_csum={0xb0, 0x2, 0x0, 0x0, {{0x9}, {0x4}, {0x81, 0x6, "b93d1adb4d1d97e61e60924d352e4f74c46a0586d2a0d5eeee4b9cbb396c83257f2089aea74fc2f53f6d6e77775d118d061283d20161a992a921d6849a891e69a91fe50c4dd03d77996dd93bbf7043b4a82892cb164367239cbf1ee7e672c20d38735bf648ac9766cdbf8fca04085a38e118dd8e449082f9431e9bd7c5"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}}]}, 0xf0}, 0x1, 0x0, 0x0, 0x80}, 0x4008000) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x7, 0x1, 0x201, 0x0, 0x0, {0xa, 0x0, 0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x814) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x407, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x7}, 0x50) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000180)={0x700, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="020d000014000000f0ffffff0000000005000600000000000a0080ff00000000fc0100000000000000ffffffff000000000000000000000005000500000000000a000000000000000000000000000000000000000000080000000000000000000800120002000200000000000000000030002b0002"], 0xa0}}, 0x0) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r7, &(0x7f0000000640)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x80, 0x1405, 0x1, 0x70bd28, 0x25dfdbfd, "", [{{0x8}, {0x8, 0x3, 0x1}}, {{0x8, 0x1, 0x2}, {0x8, 0x3, 0x4}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x2}, {0x8, 0x3, 0x2}}, {{0x8, 0x1, 0x2}, {0x8, 0x3, 0x4}}, {{0x8}, {0x8, 0x3, 0x2}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x4}}]}, 0x80}, 0x1, 0x0, 0x0, 0x2000c004}, 0x4000840) sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000000d0a010300000000000003ccf67500000900010073797a3100000000cbf9bb991d54a0ce254a129d90c659b180b303666dc8674d9f18bac509a4000000829800610d5709fbe15a5831f2e11fada53de3c1239086cd1993654a9503f8b6d2a14dd9ab11e8b8d8baaeffbe6c80d660edf2f6415859384054ee7c02db6d67acb448dfaf9c96f90296c2b29f00c77cb41aaf34c225763dc6e72a6d7a6180d91dbd"], 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) r8 = fsopen(&(0x7f00000004c0)='sockfs\x00', 0x1) getsockopt$netrom_NETROM_IDLE(r5, 0x103, 0x7, &(0x7f0000000680), &(0x7f00000006c0)=0x4) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) 1.693716967s ago: executing program 6 (id=3698): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000000c0)={'syz_tun\x00', &(0x7f0000000100)=@ethtool_pauseparam={0x1f, 0x10, 0x80000000, 0x5}}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'ip6gretap0\x00', 0x0}) r4 = socket(0x1d, 0x2, 0x6) bind$can_j1939(r4, &(0x7f0000000440)={0x1d, r3, 0x2, {0x0, 0xff, 0x4}, 0xfd}, 0x18) bind$bt_hci(r4, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000003, 0x13, r6, 0x0) r7 = syz_usb_connect$sierra_net(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x0, 0x2, 0x10, 0x4, 0x4, 0x9}, {0x9, 0x5, 0x6, 0x2, 0x200, 0x6, 0x6, 0x2}, {0x9, 0x5, 0xb, 0x3, 0x20, 0x8, 0xfa, 0x80}}}}}}]}}, 0x0) syz_usb_disconnect(r7) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r8, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="310300000000000000000900000008000300", @ANYRES32=r10, @ANYBLOB="080006003e"], 0x24}}, 0x4000) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x1100000000000000, 0x6, 0x109e93, 0xffffffffffffffff, 0x400000, 0xd, 0x0, 0x2, 0x7fffffffffffffff, 0x5, 0x401, 0x6, 0x5, 0x20000001, 0xfffffffffffffffc], 0xd5d5c004, 0x1354}) fsopen(&(0x7f00000003c0)='tracefs\x00', 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r12, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r12, &(0x7f0000000380)={0x1d, r13, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) r14 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r14, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r15, {0x8}, {0x7, 0x1}, {0x0, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x44060}, 0x98) 1.676098515s ago: executing program 2 (id=3699): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0xfffffffffffffe3e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x800014, 0x0, 0x2, 0x8a, 0x8, 0xb319, 0x3}, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@bridge_newneigh={0x30, 0x1c, 0x1, 0x70bd29, 0x25dfdbfe, {0x7, 0x0, 0x0, r4, 0x80, 0x0, 0xa}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}, @NDA_VLAN={0x6, 0x5, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xcac2d78a}}, 0x0, 0x0, 0x44, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x303}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", '\x00', "00001000"}, 0x38) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a85323, &(0x7f0000000440)={{0x9, 0xfd}, 'port0\x00', 0x10, 0x11069, 0x3, 0x8000, 0x55814893, 0x80, 0x7fffffff, 0x0, 0x1, 0x3}) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) ioctl$int_in(r2, 0x5421, &(0x7f0000000140)=0x1) writev(r2, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) close(r2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mbind(&(0x7f00001ae000/0x4000)=nil, 0x4000, 0x4002, &(0x7f0000000200)=0x2001000000000004, 0x9, 0x3) accept4$tipc(0xffffffffffffffff, &(0x7f0000000180)=@id, &(0x7f0000000240)=0x10, 0x8f2eaf272c693c3b) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) rseq(0x0, 0x0, 0x0, 0x0) mlockall(0x7) open(&(0x7f0000000000)='./bus\x00', 0x1a1043, 0xc5) 1.110164737s ago: executing program 4 (id=3700): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, 0x0, 0x0, 0x2, 0x0) r5 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)="1400000016000b43d27a80648c2594f90924fc60", 0x14}], 0x1, 0x0, 0x0, 0x600}, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000340)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0xfe, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1], 0x0, [0x8, 0x4, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3], [0xfff, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0x3]}}]}}]}, 0x8c}}, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/85, &(0x7f0000000480)=""/74}) openat$selinux_status(0xffffffffffffff9c, &(0x7f00000006c0), 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x2, 0x5, 0x5e8, 0x0, 0x448, 0xffffffff, 0xf0, 0x220, 0x518, 0x518, 0xffffffff, 0x518, 0x518, 0x5, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@empty, @ipv6=@remote, @port=0x4e22, @gre_key=0xfffe}}}, {{@uncond, 0x0, 0xe8, 0x130, 0x0, {}, [@common=@unspec=@connlimit={{0x40}, {[0x0, 0x0, 0xffffff00]}}]}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x3, @ipv4=@local, @ipv4=@multicast2, @port=0x4e24, @gre_key=0x200}}}, {{@uncond, 0x0, 0x1e0, 0x228, 0x0, {}, [@common=@rt={{0x138}, {0x7f, [0x6, 0x8], 0x3, 0x8, 0x2, [@private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast1, @loopback, @empty, @dev={0xfe, 0x80, '\x00', 0x1a}, @dev={0xfe, 0x80, '\x00', 0x2f}, @dev={0xfe, 0x80, '\x00', 0x1c}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @local, @empty, @dev={0xfe, 0x80, '\x00', 0x12}, @ipv4={'\x00', '\xff\xff', @empty}, @mcast1], 0x7}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x4, @ipv6=@empty, @ipv4=@private=0xa010101, @icmp_id=0x68, @port=0x4e22}}}, {{@ipv6={@remote, @mcast1, [0xff0000ff, 0xff000000, 0xff000000], [0xffffffff], 'veth1_macvtap\x00', 'pim6reg\x00'}, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x9}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x648) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) 724.211755ms ago: executing program 5 (id=3701): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001a80)=ANY=[@ANYBLOB="01000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f00000005c0)="f2b314c96d50", 0x6}], 0x1}}], 0x1, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x100000, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f0000000300), 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffd}}, @dstopts_2292={{0x88, 0x29, 0x4, {0x4, 0xd, '\x00', [@generic={0x80, 0xb, "09e12e5f0b6bdcf72f2ec7"}, @calipso={0x7, 0x40, {0x1, 0xe, 0x7a, 0x8001, [0x5, 0x9, 0x4, 0x6, 0x4, 0x400, 0xb]}}, @ra={0x5, 0x2, 0xa7e}, @pad1, @ra={0x5, 0x2, 0xbf4}, @hao={0xc9, 0x10, @private2}]}}}, @hopopts={{0x118, 0x29, 0x36, {0x5e, 0x1f, '\x00', [@generic={0xff, 0x12, "50d650847249ad288702ebd0d654b985e890"}, @pad1, @pad1, @calipso={0x7, 0x38, {0x3, 0xc, 0x0, 0xfff, [0x4, 0x966, 0x7, 0xfffffffffffffff7, 0x1, 0x1]}}, @generic={0x8, 0x81, "c8a110995d439fbfac9716a99c357bcb2d59a850490739734f6b321d19b3754df39cc2dc26cf263cbebbddb9a7f17b6771f74c46623f9e38bd23e6f0a2fd3a9a017f66738394aca44d1a9f0b35d9df0a964360ab0900a5e6fcac1cd41c91c97f6826ff706c41edc4e00205bbb53218ed58a1122d993b55a1b9a870a17e7869e3fc"}, @calipso={0x7, 0x18, {0x3, 0x4, 0x3, 0x7, [0x0, 0xffffffffffffff04]}}, @generic={0x1, 0x8, "2bdb86d1ce6a20c2"}]}}}, @rthdrdstopts={{0x18, 0x29, 0x37, {0x73}}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @rthdr={{0x18}}], 0x218}}], 0x1, 0x810) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 398.680027ms ago: executing program 5 (id=3702): syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000003c0), 0x80000, 0x0) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x4, 0x39, 0x11, 0xd, 0x4, 0xe80, 0x5, 0x40, 0x1}}) ioctl$RTC_UIE_OFF(r0, 0x7004) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}}, 0x0) syz_emit_ethernet(0x11, &(0x7f0000000340)=ANY=[@ANYBLOB="e0000000008b4fb486d5c29908"], 0x0) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000140)={0x2f, 0x2f, 0x0, 0x9, 0x6, 0x5, 0x2, 0xf1, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[], 0x70}}, 0x20000800) 214.875546ms ago: executing program 5 (id=3703): socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x8b}, 0x0) getpid() ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0x6}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x141091, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') inotify_init() linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) renameat2(0xffffffffffffff9c, &(0x7f0000000000)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = open$dir(&(0x7f0000000180)='./file1\x00', 0x4000, 0x1) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r4, 0x40106614, &(0x7f0000000240)) sendmsg$NFNL_MSG_ACCT_NEW(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, 0x0, 0x7, 0x101, 0x0, 0x0, {}, [@NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c0}, 0x40004) 101.851361ms ago: executing program 2 (id=3704): r0 = dup(0xffffffffffffffff) accept4$nfc_llcp(r0, &(0x7f0000000140), &(0x7f00000001c0)=0x60, 0x0) 0s ago: executing program 2 (id=3705): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f00000004c0)={0x3, 'rose0\x00', {0x2}, 0x8}) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100), 0x40000000000000ce}) r3 = syz_pidfd_open(0x0, 0x0) ioctl$VIDIOC_QBUF(r3, 0xc058ff0b, &(0x7f0000000200)=@multiplanar_userptr={0x8, 0x7, 0x4, 0x70000, 0xff, {0x77359400}, {0x4, 0x8, 0x3, 0x3, 0x3, 0x0, "8dcda3ce"}, 0x7fffffff, 0x2, {0x0}, 0x1}) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r4, 0x40000) ioctl$SIOCX25SFACILITIES(r4, 0x89e3, &(0x7f00000000c0)={0x7a, 0x0, 0x7, 0x9, 0xfffffff5, 0x81}) kernel console output (not intermixed with test programs): [ 737.570210][T17278] CPU: 0 UID: 0 PID: 17278 Comm: syz.5.3170 Tainted: G L syzkaller #0 PREEMPT(full) [ 737.570239][T17278] Tainted: [L]=SOFTLOCKUP [ 737.570245][T17278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 737.570261][T17278] Call Trace: [ 737.570268][T17278] [ 737.570275][T17278] dump_stack_lvl+0x100/0x190 [ 737.570307][T17278] should_fail_ex.cold+0x5/0xa [ 737.570330][T17278] ? tomoyo_encode2+0xfb/0x3c0 [ 737.570349][T17278] should_failslab+0xc2/0x120 [ 737.570367][T17278] __kmalloc_noprof+0xe0/0x850 [ 737.570397][T17278] tomoyo_encode2+0xfb/0x3c0 [ 737.570422][T17278] tomoyo_encode+0x29/0x50 [ 737.570440][T17278] tomoyo_mount_acl+0x388/0x8b0 [ 737.570457][T17278] ? is_bpf_text_address+0x8a/0x1a0 [ 737.570483][T17278] ? bpf_ksym_find+0x128/0x1c0 [ 737.570504][T17278] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 737.570521][T17278] ? kernel_text_address+0x8d/0x100 [ 737.570543][T17278] ? unwind_get_return_address+0x59/0xa0 [ 737.570592][T17278] ? tomoyo_domain+0xb2/0x150 [ 737.570615][T17278] ? tomoyo_profile+0x47/0x60 [ 737.570641][T17278] tomoyo_mount_permission+0x214/0x460 [ 737.570661][T17278] ? tomoyo_mount_permission+0x1f6/0x460 [ 737.570682][T17278] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 737.570717][T17278] security_sb_mount+0xdd/0x270 [ 737.570748][T17278] path_mount+0x158/0x23d0 [ 737.570776][T17278] ? __pfx_path_mount+0x10/0x10 [ 737.570796][T17278] ? lockdep_hardirqs_on+0x78/0x100 [ 737.570825][T17278] ? putname+0xb1/0x110 [ 737.570844][T17278] ? kmem_cache_free+0x124/0x6a0 [ 737.570876][T17278] ? __x64_sys_mount+0x293/0x310 [ 737.570897][T17278] __x64_sys_mount+0x293/0x310 [ 737.570920][T17278] ? __pfx___x64_sys_mount+0x10/0x10 [ 737.570950][T17278] do_syscall_64+0x10b/0xf80 [ 737.570975][T17278] ? clear_bhb_loop+0x40/0x90 [ 737.570997][T17278] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.571014][T17278] RIP: 0033:0x7f459a59c819 [ 737.571029][T17278] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 737.571045][T17278] RSP: 002b:00007f459b405028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 737.571063][T17278] RAX: ffffffffffffffda RBX: 00007f459a815fa0 RCX: 00007f459a59c819 [ 737.571074][T17278] RDX: 0000200000000000 RSI: 0000200000000080 RDI: 00002000000000c0 [ 737.571086][T17278] RBP: 00007f459b405090 R08: 0000000000000000 R09: 0000000000000000 [ 737.571096][T17278] R10: 0000000000a00410 R11: 0000000000000246 R12: 0000000000000002 [ 737.571105][T17278] R13: 00007f459a816038 R14: 00007f459a815fa0 R15: 00007ffd06bb7cf8 [ 737.571130][T17278] [ 739.039089][ T1204] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 739.039113][ T1204] usb 7-1: can't read configurations, error -71 [ 739.064013][T17284] lo speed is unknown, defaulting to 1000 [ 741.180461][ T24] usb 5-1: USB disconnect, device number 42 [ 741.294110][T13029] udevd[13029]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 741.441739][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 742.287655][T17320] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3180'. [ 742.550875][ T24] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 743.020638][ T24] usb 7-1: Using ep0 maxpacket: 32 [ 743.033423][ T24] usb 7-1: config 4 has an invalid interface number: 196 but max is 0 [ 743.048667][ T24] usb 7-1: config 4 has no interface number 0 [ 743.057228][ T24] usb 7-1: config 4 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 743.057459][ T5814] Bluetooth: hci4: SCO packet for unknown connection handle 200 [ 743.067566][ T24] usb 7-1: config 4 interface 196 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 743.087255][ T24] usb 7-1: config 4 interface 196 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 743.097937][ T24] usb 7-1: config 4 interface 196 has no altsetting 0 [ 743.250034][ T24] usb 7-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 743.334667][ T24] usb 7-1: New USB device strings: Mfr=1, Product=3, SerialNumber=3 [ 743.349318][ T24] usb 7-1: Product: syz [ 743.356290][T17340] Cannot find del_set index 3 as target [ 743.361898][ T24] usb 7-1: Manufacturer: syz [ 743.368437][ T24] usb 7-1: SerialNumber: syz [ 743.390706][T17318] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 743.642519][ T24] ipheth 7-1:4.196: ipheth_get_macaddr: usb_control_msg: -71 [ 743.654379][ T24] ipheth 7-1:4.196: probe with driver ipheth failed with error -71 [ 743.726049][T17347] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3187'. [ 744.121047][T17337] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 744.183127][ T24] usb 7-1: USB disconnect, device number 20 [ 744.674055][T17358] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3192'. [ 745.196042][T17372] overlayfs: failed to resolve './file0': -2 [ 746.083386][T17380] netlink: 220 bytes leftover after parsing attributes in process `syz.2.3197'. [ 747.360234][ T10] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 747.710241][ T10] usb 7-1: config 0 has no interfaces? [ 747.723016][ T10] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 747.738115][ T29] audit: type=1400 audit(1776198559.661:3482): avc: denied { write } for pid=17414 comm="syz.5.3208" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 747.762089][ T10] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 747.781546][ T10] usb 7-1: Product: syz [ 747.791651][ T10] usb 7-1: Manufacturer: syz [ 747.802092][ T29] audit: type=1400 audit(1776198559.671:3483): avc: denied { getopt } for pid=17414 comm="syz.5.3208" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 747.828706][ T10] usb 7-1: config 0 descriptor?? [ 747.848721][ T24] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 747.887080][ T29] audit: type=1400 audit(1776198559.671:3484): avc: denied { setopt } for pid=17414 comm="syz.5.3208" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 748.018088][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 748.043946][ T24] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 748.057273][T17398] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 748.095259][ T24] usb 5-1: config 179 has no interface number 0 [ 748.106825][T17398] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 748.144759][ T24] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 748.167618][T17398] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 748.197738][ T24] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 748.228633][T17398] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 748.295056][ T24] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 748.361430][ T791] usb 7-1: USB disconnect, device number 21 [ 748.385256][ T24] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 748.442549][ T24] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 748.531969][ T24] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 748.601437][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 748.660867][T17408] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 749.191228][T17408] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 749.296468][T17408] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 749.673375][T17451] overlayfs: failed lookup in lower (newroot/184, name='bus', err=-40): overlapping layers [ 750.280787][ T10] usb 5-1: USB disconnect, device number 43 [ 750.280809][ C1] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 750.295844][ C1] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 750.840529][T17471] No such timeout policy "syz1" [ 750.846370][T17471] No control pipe specified [ 750.851582][T17471] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3215'. [ 751.013504][T17477] veth0_macvtap: left promiscuous mode [ 751.306657][ T1204] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 751.628056][ T1204] usb 3-1: device descriptor read/64, error -71 [ 751.888946][ T1204] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 752.095827][ T1204] usb 3-1: device descriptor read/64, error -71 [ 752.389109][ T1204] usb usb3-port1: attempt power cycle [ 753.045769][ T1204] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 753.295879][ T1204] usb 3-1: device descriptor read/8, error -71 [ 753.605307][ T1204] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 753.724799][ T1204] usb 3-1: device descriptor read/8, error -71 [ 753.775436][ T9] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 754.241459][ T1204] usb usb3-port1: unable to enumerate USB device [ 754.375652][ T9] usb 7-1: Using ep0 maxpacket: 8 [ 754.392940][ T9] usb 7-1: unable to get BOS descriptor or descriptor too short [ 754.474109][ T9] usb 7-1: config 0 has an invalid interface number: 88 but max is 0 [ 754.519136][ T9] usb 7-1: config 0 has no interface number 0 [ 754.534890][ T9] usb 7-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 754.556295][ T9] usb 7-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid wMaxPacketSize 0 [ 754.624331][ T9] usb 7-1: config 0 interface 88 has no altsetting 0 [ 754.784049][ T29] audit: type=1400 audit(1776198566.644:3485): avc: denied { mounton } for pid=17517 comm="syz.2.3226" path="/577/file0" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 754.817801][ T9] usb 7-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 754.834860][ T9] usb 7-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 754.842934][T17523] FAULT_INJECTION: forcing a failure. [ 754.842934][T17523] name failslab, interval 1, probability 0, space 0, times 0 [ 754.842970][T17523] CPU: 1 UID: 0 PID: 17523 Comm: syz.4.3228 Tainted: G L syzkaller #0 PREEMPT(full) [ 754.842995][T17523] Tainted: [L]=SOFTLOCKUP [ 754.843000][T17523] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 754.843009][T17523] Call Trace: [ 754.843015][T17523] [ 754.843021][T17523] dump_stack_lvl+0x100/0x190 [ 754.843050][T17523] should_fail_ex.cold+0x5/0xa [ 754.843072][T17523] should_failslab+0xc2/0x120 [ 754.843089][T17523] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 754.843113][T17523] ? __alloc_skb+0x140/0x710 [ 754.843137][T17523] __alloc_skb+0x140/0x710 [ 754.843155][T17523] ? __alloc_skb+0x5b7/0x710 [ 754.843173][T17523] ? __pfx___alloc_skb+0x10/0x10 [ 754.843198][T17523] netlink_ack+0x117/0xb80 [ 754.843220][T17523] ? avc_has_perm_noaudit+0x145/0x3b0 [ 754.843247][T17523] netlink_rcv_skb+0x333/0x420 [ 754.843270][T17523] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 754.843290][T17523] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 754.843323][T17523] ? ns_capable+0xd2/0xf0 [ 754.843345][T17523] nfnetlink_rcv+0x1b3/0x440 [ 754.843363][T17523] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 754.843380][T17523] ? netlink_deliver_tap+0x1ae/0xcc0 [ 754.843406][T17523] netlink_unicast+0x5aa/0x870 [ 754.843431][T17523] ? __pfx_netlink_unicast+0x10/0x10 [ 754.843462][T17523] netlink_sendmsg+0x8b0/0xda0 [ 754.843488][T17523] ? __pfx_netlink_sendmsg+0x10/0x10 [ 754.843510][T17523] ? __might_fault+0x10/0x140 [ 754.843539][T17523] ____sys_sendmsg+0x9e1/0xb70 [ 754.843553][T17523] ? __pfx_netlink_sendmsg+0x10/0x10 [ 754.843577][T17523] ? __pfx_____sys_sendmsg+0x10/0x10 [ 754.843596][T17523] ? __pfx__kstrtoull+0x10/0x10 [ 754.843616][T17523] ___sys_sendmsg+0x190/0x1e0 [ 754.843634][T17523] ? __pfx____sys_sendmsg+0x10/0x10 [ 754.843660][T17523] ? find_held_lock+0x2b/0x80 [ 754.843693][T17523] __sys_sendmmsg+0x205/0x430 [ 754.843716][T17523] ? __pfx___sys_sendmmsg+0x10/0x10 [ 754.843743][T17523] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 754.843776][T17523] ? fput+0x79/0x100 [ 754.843794][T17523] ? ksys_write+0x1ac/0x250 [ 754.843808][T17523] ? __pfx_ksys_write+0x10/0x10 [ 754.843827][T17523] __x64_sys_sendmmsg+0x9c/0x100 [ 754.843847][T17523] ? lockdep_hardirqs_on+0x78/0x100 [ 754.843869][T17523] do_syscall_64+0x10b/0xf80 [ 754.843890][T17523] ? clear_bhb_loop+0x40/0x90 [ 754.843908][T17523] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 754.843924][T17523] RIP: 0033:0x7f53f899c819 [ 754.843937][T17523] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 754.843952][T17523] RSP: 002b:00007f53f9898028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 754.843972][T17523] RAX: ffffffffffffffda RBX: 00007f53f8c15fa0 RCX: 00007f53f899c819 [ 754.843982][T17523] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000004 [ 754.843992][T17523] RBP: 00007f53f9898090 R08: 0000000000000000 R09: 0000000000000000 [ 754.844001][T17523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 754.844010][T17523] R13: 00007f53f8c16038 R14: 00007f53f8c15fa0 R15: 00007ffd29d58ce8 [ 754.844031][T17523] [ 755.454250][ T9] usb 7-1: Product: syz [ 755.458456][ T9] usb 7-1: SerialNumber: syz [ 755.483902][ T9] usb 7-1: config 0 descriptor?? [ 755.554312][T17538] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 755.563088][T17538] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 755.574824][T17535] nbd4: detected capacity change from 0 to 63 [ 755.588350][T17536] block nbd4: NBD_DISCONNECT [ 755.598732][T17536] block nbd4: Disconnected due to user request. [ 755.606991][T17536] block nbd4: shutting down sockets [ 755.635891][ C0] blk_print_req_error: 138 callbacks suppressed [ 755.635904][ C0] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 755.651183][ C0] buffer_io_error: 138 callbacks suppressed [ 755.651193][ C0] Buffer I/O error on dev nbd4, logical block 0, async page read [ 755.688105][ C0] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 755.697213][ C0] Buffer I/O error on dev nbd4, logical block 1, async page read [ 755.713022][ C0] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 755.722105][ C0] Buffer I/O error on dev nbd4, logical block 2, async page read [ 755.729860][ C0] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 755.738888][ C0] Buffer I/O error on dev nbd4, logical block 3, async page read [ 755.757045][T13028] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 755.768242][ T9] input: syz as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.88/input/input35 [ 755.779780][T13028] Buffer I/O error on dev nbd4, logical block 0, async page read [ 755.788241][T13028] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 755.799704][T13028] Buffer I/O error on dev nbd4, logical block 1, async page read [ 755.817364][ T9] usb 7-1: USB disconnect, device number 22 [ 755.831055][T13028] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 755.850570][T13028] Buffer I/O error on dev nbd4, logical block 2, async page read [ 755.861034][T13028] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 755.871933][T13028] Buffer I/O error on dev nbd4, logical block 3, async page read [ 755.894039][T13028] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 755.922946][T13028] Buffer I/O error on dev nbd4, logical block 0, async page read [ 755.966238][T13028] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 755.994002][T13028] Buffer I/O error on dev nbd4, logical block 1, async page read [ 756.027196][T13028] ldm_validate_partition_table(): Disk read failed. [ 756.045580][T13028] Dev nbd4: unable to read RDB block 0 [ 756.052688][T13028] nbd4: unable to read partition table [ 756.103651][T13028] ldm_validate_partition_table(): Disk read failed. [ 756.135711][T13028] Dev nbd4: unable to read RDB block 0 [ 756.161750][T13028] nbd4: unable to read partition table [ 756.174085][ T5814] Bluetooth: hci5: unexpected event for opcode 0x040e [ 756.761619][T17555] tipc: Enabled bearer , priority 0 [ 756.771241][T17555] tipc: Resetting bearer [ 756.782141][T17554] tipc: Disabling bearer [ 756.913746][ T24] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 757.356002][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 757.377616][ T24] usb 5-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 757.389487][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 757.526155][ T24] usb 5-1: Product: syz [ 757.536186][ T24] usb 5-1: Manufacturer: syz [ 757.548408][ T24] usb 5-1: SerialNumber: syz [ 757.570124][ T24] usb 5-1: config 0 descriptor?? [ 757.587439][ T24] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 758.143340][ T9] usb 3-1: new high-speed USB device number 125 using dummy_hcd [ 758.322872][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 758.331008][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 758.341253][ T9] usb 3-1: config 8 has no interfaces? [ 758.349923][ T9] usb 3-1: New USB device found, idVendor=1b3d, idProduct=01c1, bcdDevice=b4.21 [ 758.360162][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 758.375090][ T9] usb 3-1: Product: syz [ 758.500280][ T9] usb 3-1: Manufacturer: syz [ 758.505071][ T9] usb 3-1: SerialNumber: syz [ 758.762485][T17584] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 758.785055][ T29] audit: type=1400 audit(1776198570.726:3486): avc: denied { read append } for pid=17583 comm="syz.5.3245" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 758.830669][ T29] audit: type=1400 audit(1776198570.766:3487): avc: denied { open } for pid=17583 comm="syz.5.3245" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 758.895044][ T29] audit: type=1400 audit(1776198570.826:3488): avc: denied { map } for pid=17583 comm="syz.5.3245" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 759.001620][T17575] futex_wake_op: syz.2.3241 tries to shift op by 144; fix this program [ 759.017646][ T9] usb 3-1: USB disconnect, device number 125 [ 759.034423][ T29] audit: type=1400 audit(1776198570.826:3489): avc: denied { write } for pid=17583 comm="syz.5.3245" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 759.086829][T17587] Invalid source name [ 759.520766][T17553] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3235'. [ 759.852304][ T24] gspca_ov534_9: reg_r err -110 [ 760.221870][ T24] gspca_ov534_9: Unknown sensor 0000 [ 760.221938][ T24] ov534_9 5-1:0.0: probe with driver ov534_9 failed with error -22 [ 760.348618][ T10] usb 5-1: USB disconnect, device number 44 [ 760.661670][ T1600] usb 3-1: new high-speed USB device number 126 using dummy_hcd [ 760.811575][ T1600] usb 3-1: Using ep0 maxpacket: 16 [ 760.819060][ T1600] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 760.828559][ T1600] usb 3-1: can't read configurations, error -61 [ 760.988944][ T1600] usb 3-1: new high-speed USB device number 127 using dummy_hcd [ 761.022037][T17611] gretap0: refused to change device tx_queue_len [ 761.029877][T17611] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 761.066228][T17614] all: renamed from bridge_slave_1 (while UP) [ 761.172034][ T1600] usb 3-1: Using ep0 maxpacket: 16 [ 761.175128][T17620] FAULT_INJECTION: forcing a failure. [ 761.175128][T17620] name failslab, interval 1, probability 0, space 0, times 0 [ 761.190280][T17620] CPU: 1 UID: 0 PID: 17620 Comm: syz.4.3258 Tainted: G L syzkaller #0 PREEMPT(full) [ 761.190307][T17620] Tainted: [L]=SOFTLOCKUP [ 761.190314][T17620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 761.190324][T17620] Call Trace: [ 761.190331][T17620] [ 761.190337][T17620] dump_stack_lvl+0x100/0x190 [ 761.190365][T17620] should_fail_ex.cold+0x5/0xa [ 761.190381][T17620] should_failslab+0xc2/0x120 [ 761.190394][T17620] kmem_cache_alloc_lru_noprof+0x80/0x6e0 [ 761.190411][T17620] ? sock_alloc_inode+0x26/0x290 [ 761.190431][T17620] ? __pfx_sock_alloc_inode+0x10/0x10 [ 761.190449][T17620] sock_alloc_inode+0x26/0x290 [ 761.190466][T17620] ? __pfx_sock_alloc_inode+0x10/0x10 [ 761.190483][T17620] alloc_inode+0x68/0x250 [ 761.190501][T17620] sock_alloc+0x44/0x280 [ 761.190518][T17620] do_accept+0xf9/0x530 [ 761.190531][T17620] ? do_raw_spin_lock+0x128/0x260 [ 761.190545][T17620] ? __pfx_do_accept+0x10/0x10 [ 761.190566][T17620] __sys_accept4+0x108/0x200 [ 761.190579][T17620] ? __pfx___sys_accept4+0x10/0x10 [ 761.190593][T17620] ? __pfx_ksys_write+0x10/0x10 [ 761.190606][T17620] __x64_sys_accept4+0x96/0x100 [ 761.190618][T17620] ? lockdep_hardirqs_on+0x78/0x100 [ 761.190636][T17620] do_syscall_64+0x10b/0xf80 [ 761.190652][T17620] ? clear_bhb_loop+0x40/0x90 [ 761.190666][T17620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.190678][T17620] RIP: 0033:0x7f53f899c819 [ 761.190687][T17620] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 761.190698][T17620] RSP: 002b:00007f53f9898028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 761.190710][T17620] RAX: ffffffffffffffda RBX: 00007f53f8c15fa0 RCX: 00007f53f899c819 [ 761.190717][T17620] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 761.190723][T17620] RBP: 00007f53f9898090 R08: 0000000000000000 R09: 0000000000000000 [ 761.190729][T17620] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 761.190735][T17620] R13: 00007f53f8c16038 R14: 00007f53f8c15fa0 R15: 00007ffd29d58ce8 [ 761.190753][T17620] [ 761.512688][ T1600] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 761.616275][ T1600] usb 3-1: can't read configurations, error -61 [ 761.663252][ T1600] usb usb3-port1: attempt power cycle [ 761.719851][ T29] audit: type=1400 audit(1776198573.658:3490): avc: denied { getopt } for pid=17623 comm="syz.5.3260" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 761.766697][ T29] audit: type=1400 audit(1776198573.708:3491): avc: denied { block_suspend } for pid=17623 comm="syz.5.3260" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 762.042035][ T1600] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 762.123538][T17629] netlink: 'syz.6.3262': attribute type 10 has an invalid length. [ 762.152408][ T1600] usb 3-1: Using ep0 maxpacket: 16 [ 762.153648][T17629] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3262'. [ 762.173050][ T1600] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 762.180707][ T1600] usb 3-1: can't read configurations, error -61 [ 762.263658][T17639] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3265'. [ 762.313626][ T1600] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 762.336526][ T29] audit: type=1400 audit(1776198574.268:3492): avc: denied { checkpoint_restore } for pid=17640 comm="syz.5.3266" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 762.499083][ T1600] usb 3-1: Using ep0 maxpacket: 16 [ 763.066067][ T1600] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 763.068633][T17650] netlink: 'syz.4.3268': attribute type 11 has an invalid length. [ 763.073983][ T1600] usb 3-1: can't read configurations, error -61 [ 763.088237][ T1600] usb usb3-port1: unable to enumerate USB device [ 763.112287][T17650] comedi comedi4: bad chanlist[1]=0x0000000c chan=12 range length=2 [ 763.130092][T17633] SELinux: failed to load policy [ 763.386899][T17653] ieee802154 phy0 wpan0: encryption failed: -22 [ 764.160031][ T1204] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 764.300092][ T24] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 764.320000][ T1204] usb 5-1: Using ep0 maxpacket: 16 [ 764.339686][ T1204] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 764.355303][ T1204] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 764.377176][ T1204] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 764.388089][ T1204] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.396211][ T1204] usb 5-1: Product: syz [ 764.402874][ T1204] usb 5-1: Manufacturer: syz [ 764.407512][ T1204] usb 5-1: SerialNumber: syz [ 764.444985][ T1204] usb 5-1: config 0 descriptor?? [ 764.499823][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 764.506807][ T1204] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 764.519349][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 764.538736][ T1204] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 764.558472][ T24] usb 4-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 764.577836][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.599683][ T24] usb 4-1: Product: syz [ 764.604255][ T24] usb 4-1: Manufacturer: syz [ 764.619246][T17680] FAULT_INJECTION: forcing a failure. [ 764.619246][T17680] name failslab, interval 1, probability 0, space 0, times 0 [ 764.634267][ T24] usb 4-1: SerialNumber: syz [ 764.639145][T17683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 764.659877][T17683] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 764.670020][ T24] usb 4-1: config 0 descriptor?? [ 764.682648][T17680] CPU: 1 UID: 0 PID: 17680 Comm: syz.6.3277 Tainted: G L syzkaller #0 PREEMPT(full) [ 764.682677][T17680] Tainted: [L]=SOFTLOCKUP [ 764.682683][T17680] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 764.682693][T17680] Call Trace: [ 764.682700][T17680] [ 764.682710][T17680] dump_stack_lvl+0x100/0x190 [ 764.682744][T17680] should_fail_ex.cold+0x5/0xa [ 764.682771][T17680] should_failslab+0xc2/0x120 [ 764.682790][T17680] __kvmalloc_node_noprof+0xfa/0xa00 [ 764.682817][T17680] ? proc_sys_call_handler+0x2c7/0x5a0 [ 764.682846][T17680] proc_sys_call_handler+0x2c7/0x5a0 [ 764.682869][T17680] ? __pfx_proc_sys_call_handler+0x10/0x10 [ 764.682899][T17680] vfs_write+0x6ac/0x1070 [ 764.682917][T17680] ? __pfx_proc_sys_write+0x10/0x10 [ 764.682941][T17680] ? __pfx_vfs_write+0x10/0x10 [ 764.682974][T17680] ksys_write+0x12a/0x250 [ 764.682992][T17680] ? __pfx_ksys_write+0x10/0x10 [ 764.683017][T17680] do_syscall_64+0x10b/0xf80 [ 764.683042][T17680] ? clear_bhb_loop+0x40/0x90 [ 764.683064][T17680] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 764.683083][T17680] RIP: 0033:0x7fbc1739c819 [ 764.683098][T17680] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 764.683121][T17680] RSP: 002b:00007fbc18235028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 764.683138][T17680] RAX: ffffffffffffffda RBX: 00007fbc17615fa0 RCX: 00007fbc1739c819 [ 764.683150][T17680] RDX: 0000000000000012 RSI: 0000200000000040 RDI: 0000000000000005 [ 764.683161][T17680] RBP: 00007fbc18235090 R08: 0000000000000000 R09: 0000000000000000 [ 764.683171][T17680] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 764.683182][T17680] R13: 00007fbc17616038 R14: 00007fbc17615fa0 R15: 00007fff08ff7b18 [ 764.683206][T17680] [ 764.685421][ T24] usb 4-1: bad CDC descriptors [ 764.739339][T17684] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=23 sclass=netlink_route_socket pid=17684 comm=syz.6.3277 [ 764.749355][ T24] usb 4-1: unsupported MDLM descriptors [ 764.895041][T17684] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=51 sclass=netlink_route_socket pid=17684 comm=syz.6.3277 [ 764.928598][T17684] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=43 sclass=netlink_route_socket pid=17684 comm=syz.6.3277 [ 764.932121][ T24] usb 4-1: USB disconnect, device number 73 [ 764.956834][T17684] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64 sclass=netlink_route_socket pid=17684 comm=syz.6.3277 [ 764.980360][T17689] fuse: Bad value for 'fd' [ 765.172493][ T1204] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 765.178932][ T1204] em28xx 5-1:0.0: Config register raw data: 0x56 [ 765.385976][ T1204] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 765.395319][ T1204] em28xx 5-1:0.0: No AC97 audio processor [ 766.775061][ T1600] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 767.063957][ T1204] usb 5-1: USB disconnect, device number 45 [ 767.081841][ T1204] em28xx 5-1:0.0: Disconnecting em28xx [ 767.120427][ T1204] em28xx 5-1:0.0: Freeing device [ 767.270148][ T1600] usb 7-1: Using ep0 maxpacket: 16 [ 767.606532][T17732] trusted_key: encrypted_key: master key parameter '$efault' is invalid [ 767.743478][T17728] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3289'. [ 768.269337][ T1600] usb 7-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice=2a.35 [ 768.299231][ T1600] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 768.307755][ T1600] usb 7-1: Product: syz [ 768.384028][ T1600] usb 7-1: Manufacturer: syz [ 768.479343][ T1600] usb 7-1: SerialNumber: syz [ 768.910862][ T1600] usb 7-1: config 0 descriptor?? [ 769.535003][ T1600] usb 7-1: can't set config #0, error -71 [ 769.575995][ T1600] usb 7-1: USB disconnect, device number 23 [ 769.637864][T17747] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3297'. [ 769.713350][T17750] FAULT_INJECTION: forcing a failure. [ 769.713350][T17750] name failslab, interval 1, probability 0, space 0, times 0 [ 769.727352][T17750] CPU: 1 UID: 0 PID: 17750 Comm: syz.4.3298 Tainted: G L syzkaller #0 PREEMPT(full) [ 769.727381][T17750] Tainted: [L]=SOFTLOCKUP [ 769.727388][T17750] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 769.727398][T17750] Call Trace: [ 769.727404][T17750] [ 769.727411][T17750] dump_stack_lvl+0x100/0x190 [ 769.727446][T17750] should_fail_ex.cold+0x5/0xa [ 769.727472][T17750] ? tomoyo_realpath_from_path+0xb6/0x690 [ 769.727495][T17750] should_failslab+0xc2/0x120 [ 769.727514][T17750] __kmalloc_noprof+0xe0/0x850 [ 769.727548][T17750] tomoyo_realpath_from_path+0xb6/0x690 [ 769.727575][T17750] tomoyo_path_number_perm+0x23c/0x580 [ 769.727593][T17750] ? tomoyo_path_number_perm+0x22e/0x580 [ 769.727613][T17750] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 769.727657][T17750] ? find_held_lock+0x2b/0x80 [ 769.727681][T17750] ? __fget_files+0x215/0x3d0 [ 769.727700][T17750] ? hook_file_ioctl_common+0x149/0x410 [ 769.727722][T17750] ? __fget_files+0x215/0x3d0 [ 769.727746][T17750] ? __fget_files+0x21f/0x3d0 [ 769.727770][T17750] security_file_ioctl+0xd3/0x230 [ 769.727798][T17750] __x64_sys_ioctl+0xb7/0x210 [ 769.727828][T17750] do_syscall_64+0x10b/0xf80 [ 769.727854][T17750] ? clear_bhb_loop+0x40/0x90 [ 769.727877][T17750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.727896][T17750] RIP: 0033:0x7f53f899c819 [ 769.727911][T17750] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 769.727928][T17750] RSP: 002b:00007f53f9898028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 769.727946][T17750] RAX: ffffffffffffffda RBX: 00007f53f8c15fa0 RCX: 00007f53f899c819 [ 769.727958][T17750] RDX: 0000200000000040 RSI: 00000000800442d3 RDI: 0000000000000004 [ 769.727969][T17750] RBP: 00007f53f9898090 R08: 0000000000000000 R09: 0000000000000000 [ 769.727979][T17750] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 769.727989][T17750] R13: 00007f53f8c16038 R14: 00007f53f8c15fa0 R15: 00007ffd29d58ce8 [ 769.728014][T17750] [ 769.728021][T17750] ERROR: Out of memory at tomoyo_realpath_from_path. [ 770.018193][ T5814] Bluetooth: hci4: unexpected event for opcode 0x200f [ 770.198161][T17755] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 770.228122][T17755] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 770.579436][T17759] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3299'. [ 771.515941][ T29] audit: type=1400 audit(1776198583.453:3493): avc: denied { shutdown } for pid=17767 comm="syz.6.3302" lport=9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 771.986820][ T29] audit: type=1400 audit(1776198583.453:3494): avc: denied { write } for pid=17767 comm="syz.6.3302" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 773.013976][T17799] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3309'. [ 773.182610][T17801] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 773.191822][T17801] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 774.103949][T17803] fuse: Unknown parameter 'f;0x0000000000000006' [ 774.816824][T17823] FAULT_INJECTION: forcing a failure. [ 774.816824][T17823] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 774.850862][T17823] CPU: 0 UID: 0 PID: 17823 Comm: syz.4.3316 Tainted: G L syzkaller #0 PREEMPT(full) [ 774.850892][T17823] Tainted: [L]=SOFTLOCKUP [ 774.850898][T17823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 774.850909][T17823] Call Trace: [ 774.850915][T17823] [ 774.850923][T17823] dump_stack_lvl+0x100/0x190 [ 774.850957][T17823] should_fail_ex.cold+0x5/0xa [ 774.850987][T17823] _copy_from_user+0x2e/0xd0 [ 774.851011][T17823] move_addr_to_kernel+0x65/0x170 [ 774.851030][T17823] __sys_connect+0xb5/0x170 [ 774.851049][T17823] ? __pfx___sys_connect+0x10/0x10 [ 774.851068][T17823] ? __fget_files+0x21f/0x3d0 [ 774.851094][T17823] ? __pfx_ksys_write+0x10/0x10 [ 774.851116][T17823] __x64_sys_connect+0x72/0xb0 [ 774.851135][T17823] ? lockdep_hardirqs_on+0x78/0x100 [ 774.851162][T17823] do_syscall_64+0x10b/0xf80 [ 774.851187][T17823] ? clear_bhb_loop+0x40/0x90 [ 774.851210][T17823] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 774.851229][T17823] RIP: 0033:0x7f53f899c819 [ 774.851244][T17823] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 774.851261][T17823] RSP: 002b:00007f53f9898028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 774.851279][T17823] RAX: ffffffffffffffda RBX: 00007f53f8c15fa0 RCX: 00007f53f899c819 [ 774.851291][T17823] RDX: 000000000000001c RSI: 0000200000000000 RDI: 0000000000000005 [ 774.851301][T17823] RBP: 00007f53f9898090 R08: 0000000000000000 R09: 0000000000000000 [ 774.851311][T17823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 774.851321][T17823] R13: 00007f53f8c16038 R14: 00007f53f8c15fa0 R15: 00007ffd29d58ce8 [ 774.851346][T17823] [ 775.154668][T17827] hpfs: Bad magic ... probably not HPFS [ 776.510715][ T29] audit: type=1400 audit(1776198588.455:3495): avc: denied { read } for pid=17838 comm="syz.5.3320" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 776.541711][T17847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 776.554074][T17847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 776.597129][T17847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 776.627289][T17847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 777.692432][T17871] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3330'. [ 778.144218][ T29] audit: type=1400 audit(1776198590.096:3496): avc: denied { getopt } for pid=17874 comm="syz.6.3332" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 779.588300][T14680] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 779.600780][T14680] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 779.608782][T14680] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 779.616605][T14680] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 779.631241][T14680] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 779.686184][T17900] lo speed is unknown, defaulting to 1000 [ 779.924261][T17909] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 780.349767][T17900] chnl_net:caif_netlink_parms(): no params data found [ 780.688094][T17922] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 780.731322][T17923] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 780.844816][T17900] bridge0: port 1(bridge_slave_0) entered blocking state [ 781.052145][T17900] bridge0: port 1(bridge_slave_0) entered disabled state [ 781.060885][T17900] bridge_slave_0: entered allmulticast mode [ 781.109971][T17900] bridge_slave_0: entered promiscuous mode [ 781.234926][T17900] bridge0: port 2(bridge_slave_1) entered blocking state [ 781.318612][T17900] bridge0: port 2(bridge_slave_1) entered disabled state [ 781.351495][T17900] bridge_slave_1: entered allmulticast mode [ 781.361543][T17900] bridge_slave_1: entered promiscuous mode [ 781.450397][T17948] loop5: detected capacity change from 0 to 7 [ 781.459041][T17948] Dev loop5: unable to read RDB block 7 [ 781.464760][T17948] loop5: AHDI p1 [ 781.468410][T17948] loop5: partition table partially beyond EOD, truncated [ 781.476538][T17948] netlink: 'syz.5.3347': attribute type 10 has an invalid length. [ 781.484668][T17948] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3347'. [ 781.554560][T17948] batadv0: entered promiscuous mode [ 781.559768][T17948] batadv0: entered allmulticast mode [ 781.567243][T17948] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 781.606955][T17900] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 781.626732][T17900] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 781.723461][ T5814] Bluetooth: hci1: command tx timeout [ 781.775737][ T29] audit: type=1400 audit(1776198593.728:3497): avc: denied { set_context_mgr } for pid=17957 comm="syz.3.3350" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 781.820407][T17900] team0: Port device team_slave_0 added [ 781.841631][T17900] team0: Port device team_slave_1 added [ 782.091777][ T10] usb 4-1: new full-speed USB device number 74 using dummy_hcd [ 782.128648][T17900] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 782.164748][T17900] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 782.719303][ T10] usb 4-1: config 0 has an invalid interface number: 3 but max is 2 [ 782.731755][T17900] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 782.747661][ T10] usb 4-1: config 0 has an invalid interface number: 176 but max is 2 [ 782.778526][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 782.797184][ T10] usb 4-1: config 0 has 2 interfaces, different from the descriptor's value: 3 [ 782.817009][T17900] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 782.831019][ T10] usb 4-1: config 0 has no interface number 0 [ 782.845573][T17900] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 782.880539][ T10] usb 4-1: config 0 has no interface number 1 [ 782.910543][ T10] usb 4-1: New USB device found, idVendor=05c6, idProduct=9211, bcdDevice=29.ac [ 782.919605][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 782.970700][T17900] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 782.983601][ T10] usb 4-1: config 0 descriptor?? [ 783.009969][ T10] usb 4-1: unknown number of interfaces: 2 [ 783.108624][T17900] hsr_slave_0: entered promiscuous mode [ 783.119859][T17900] hsr_slave_1: entered promiscuous mode [ 783.141766][T17900] debugfs: 'hsr0' already exists in 'hsr' [ 783.168205][T17900] Cannot create hsr debugfs directory [ 783.261005][T17960] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 783.268105][ T10] IPVS: starting estimator thread 0... [ 783.370456][T17975] IPVS: using max 46 ests per chain, 110400 per kthread [ 784.025561][ T5814] Bluetooth: hci1: command tx timeout [ 784.029711][ T10] usb 4-1: USB disconnect, device number 74 [ 784.114925][ T9884] bond1 (unregistering): (slave ip6gretap1): Releasing active interface [ 784.380122][ T9884] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 784.402139][ T9884] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 784.422683][ T9884] bond0 (unregistering): Released all slaves [ 784.442919][ T9884] bond1 (unregistering): Released all slaves [ 784.465142][ T9884] bond2 (unregistering): Released all slaves [ 784.496527][T17979] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3356'. [ 784.632848][ T9884] : left promiscuous mode [ 785.406594][ T9884] tipc: Left network mode [ 786.039909][ T5814] Bluetooth: hci1: command tx timeout [ 787.213420][ T9884] hsr_slave_0: left promiscuous mode [ 787.228689][ T9884] hsr_slave_1: left promiscuous mode [ 787.245612][ T9884] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 788.119399][ T5814] Bluetooth: hci1: command tx timeout [ 788.231530][T17900] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 788.270276][T17900] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 788.302936][T17900] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 788.330736][T17900] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 788.438885][ T1600] usb 5-1: new low-speed USB device number 46 using dummy_hcd [ 788.533489][ T9884] IPVS: stop unused estimator thread 0... [ 788.545103][ T1204] kernel write not supported for file task/353/net/softnet_stat (pid: 1204 comm: kworker/1:3) [ 788.751397][ T1600] usb 5-1: string descriptor 0 read error: -22 [ 788.757433][T17900] 8021q: adding VLAN 0 to HW filter on device bond0 [ 788.873399][ T1600] usb 5-1: New USB device found, idVendor=04b4, idProduct=8613, bcdDevice=95.8f [ 788.890560][T17900] 8021q: adding VLAN 0 to HW filter on device team0 [ 788.907364][ T1600] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 788.921213][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 788.928317][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 788.958083][ T1600] usb 5-1: config 0 descriptor?? [ 788.965420][ T9881] bridge0: port 2(bridge_slave_1) entered blocking state [ 788.972564][ T9881] bridge0: port 2(bridge_slave_1) entered forwarding state [ 788.995543][ T1600] usbtest 5-1:0.0: FX2 device [ 789.012037][ T1600] usbtest 5-1:0.0: low-speed {control intr-in intr-out} tests (+alt) [ 789.199195][ T1204] usb 5-1: USB disconnect, device number 46 [ 789.335856][T17900] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 789.486367][T17900] veth0_vlan: entered promiscuous mode [ 789.519332][T17900] veth1_vlan: entered promiscuous mode [ 789.713169][T17900] veth0_macvtap: entered promiscuous mode [ 789.730424][T17900] veth1_macvtap: entered promiscuous mode [ 789.851539][T17900] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 789.923866][T17900] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 790.061752][ T9884] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.134531][ T9884] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.167267][ T9884] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.228385][ T9884] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.438325][T18103] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 790.447915][T18101] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 790.463426][T18101] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 790.789887][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 790.806037][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 790.874020][ T9884] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 790.881949][ T9884] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 790.948414][ T29] audit: type=1400 audit(1776198602.902:3498): avc: denied { mounton } for pid=17900 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 791.371803][T18118] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3377'. [ 791.844014][T18134] 9p: Bad value for 'wfdno' [ 792.016078][ T1600] usb 3-1: new low-speed USB device number 4 using dummy_hcd [ 792.032795][ T29] audit: type=1400 audit(1776198603.983:3499): avc: denied { execute } for pid=18125 comm="syz.5.3380" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 792.136408][T18139] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 792.149911][T18139] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 792.187618][ T1600] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 8, setting to 0 [ 792.208476][ T1600] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 0 [ 792.229615][T18143] overlay: Unknown parameter 'hash' [ 792.236863][T18143] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=33313 sclass=netlink_route_socket pid=18143 comm=syz.4.3385 [ 793.210623][T18157] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3390'. [ 793.243621][T18157] netlink: 'syz.3.3390': attribute type 12 has an invalid length. [ 793.592401][ T791] usb 5-1: new full-speed USB device number 47 using dummy_hcd [ 793.800461][ T791] usb 5-1: config index 0 descriptor too short (expected 28277, got 36) [ 793.809575][ T791] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 793.824262][ T791] usb 5-1: config 0 has no interfaces? [ 793.839644][ T791] usb 5-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 793.861305][ T791] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 793.894544][ T791] usb 5-1: config 0 descriptor?? [ 794.420615][ T5880] usb 5-1: USB disconnect, device number 47 [ 794.789708][ T1600] usb 3-1: New USB device found, idVendor=0499, idProduct=104f, bcdDevice= 0.40 [ 794.805995][ T1600] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 794.837604][ T1600] usb 3-1: Product: à ‚îŸÛ泺삡㴈äµæƒ«ížšé§ì¯‚䯻눮Æဋ뭽똎䵧î•ë ™ãµ©ë¥¶ì°½ç¥–픆絨콓봽ꤔá¥ê¤œëª¤à¼’èƒã·¿ãŒ¾ã·»áƒ˜ë¯˜æ´¯å«½ç¤°è³à©·ä…½ï¿Šï¨”æ«á›ºã™ŸãŒ¥á¯Œë£©á®ï­ƒë™•Ò„ì‰â¸¢Ê²è¨—涇í车ǯë°î«ˆæ€¼ç‘¶ê¼ºç˜Œä ƒç”¨ì²žê»ªã‚£è”‰ê‚°ì¸€æ¨‹â¶…賒設꺉ม窗﬙雘缙혎ꪨ笕뾹î±ê¡–邠϶ë›ï‚”å™ˆåŠ–è…¦î§¾é€¢îš•è°²ä§œè‰¨æ–¡å¼ [ 794.904591][ T1600] usb 3-1: Manufacturer: П [ 794.932974][ T1600] usb 3-1: can't set config #1, error -71 [ 795.006830][ T1600] usb 3-1: USB disconnect, device number 4 [ 797.212664][T18210] ALSA: seq fatal error: cannot create timer (-22) [ 798.236088][T18227] binder: 18219:18227 ioctl c0306201 200000000040 returned -14 [ 799.219408][ T29] audit: type=1400 audit(1776198611.176:3500): avc: denied { getopt } for pid=18224 comm="syz.2.3413" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 799.303702][T18236] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3415'. [ 799.505211][T18198] FAULT_INJECTION: forcing a failure. [ 799.505211][T18198] name failslab, interval 1, probability 0, space 0, times 0 [ 799.697434][T18245] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3416'. [ 799.721084][T18198] CPU: 0 UID: 0 PID: 18198 Comm: syz.5.3404 Tainted: G L syzkaller #0 PREEMPT(full) [ 799.721112][T18198] Tainted: [L]=SOFTLOCKUP [ 799.721117][T18198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 799.721127][T18198] Call Trace: [ 799.721132][T18198] [ 799.721139][T18198] dump_stack_lvl+0x100/0x190 [ 799.721171][T18198] should_fail_ex.cold+0x5/0xa [ 799.721195][T18198] should_failslab+0xc2/0x120 [ 799.721213][T18198] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 799.721236][T18198] ? taskstats_exit+0x650/0xbd0 [ 799.721263][T18198] taskstats_exit+0x650/0xbd0 [ 799.721285][T18198] ? __pfx_acct_update_integrals+0x10/0x10 [ 799.721309][T18198] ? __pfx_taskstats_exit+0x10/0x10 [ 799.721333][T18198] ? rcu_read_lock_any_held+0x6a/0xa0 [ 799.721355][T18198] ? exit_signals+0x395/0xaf0 [ 799.721379][T18198] do_exit+0x659/0x2b60 [ 799.721407][T18198] ? __pfx_do_exit+0x10/0x10 [ 799.721432][T18198] ? do_raw_spin_lock+0x128/0x260 [ 799.721450][T18198] ? find_held_lock+0x2b/0x80 [ 799.721469][T18198] ? get_signal+0x7e0/0x21e0 [ 799.721492][T18198] do_group_exit+0xd5/0x2a0 [ 799.721519][T18198] get_signal+0x1ec7/0x21e0 [ 799.721540][T18198] ? fuse_lseek+0x24f/0x530 [ 799.721562][T18198] ? __pfx_get_signal+0x10/0x10 [ 799.721582][T18198] ? find_held_lock+0x2b/0x80 [ 799.721603][T18198] ? ksys_lseek+0x122/0x1b0 [ 799.721625][T18198] ? ksys_lseek+0x122/0x1b0 [ 799.721651][T18198] arch_do_signal_or_restart+0x91/0x7a0 [ 799.721674][T18198] ? __mutex_unlock_slowpath+0x15c/0x790 [ 799.721701][T18198] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 799.721724][T18198] ? fuse_file_llseek+0x8d/0x130 [ 799.721744][T18198] ? up_write+0x290/0x4f0 [ 799.721768][T18198] exit_to_user_mode_loop+0x86/0x4a0 [ 799.721795][T18198] do_syscall_64+0x706/0xf80 [ 799.721817][T18198] ? clear_bhb_loop+0x40/0x90 [ 799.721838][T18198] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 799.721855][T18198] RIP: 0033:0x7f459a59c819 [ 799.721869][T18198] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 799.721884][T18198] RSP: 002b:00007f459b405028 EFLAGS: 00000246 ORIG_RAX: 0000000000000008 [ 799.721902][T18198] RAX: fffffffffffffffc RBX: 00007f459a815fa0 RCX: 00007f459a59c819 [ 799.721913][T18198] RDX: 0000000000000004 RSI: 00000040000000f4 RDI: 0000000000000005 [ 799.721924][T18198] RBP: 00007f459b405090 R08: 0000000000000000 R09: 0000000000000000 [ 799.721934][T18198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 799.721943][T18198] R13: 00007f459a816038 R14: 00007f459a815fa0 R15: 00007ffd06bb7cf8 [ 799.721959][T18198] [ 800.087283][T18246] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=18246 comm=syz.4.3416 [ 800.494953][T18246] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 800.681037][T18258] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 800.691619][T18258] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 802.826061][T18275] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3423'. [ 802.852224][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 802.921298][T18275] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3423'. [ 803.060563][T18275] netlink: 'syz.3.3423': attribute type 5 has an invalid length. [ 803.696754][T18285] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3424'. [ 803.940643][T18289] TC_ACT_REPEAT abuse ? [ 804.036916][T18295] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3428'. [ 804.172201][ T29] audit: type=1400 audit(1776198616.139:3501): avc: denied { mount } for pid=18300 comm="syz.6.3430" name="/" dev="hugetlbfs" ino=67332 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 804.255004][T18308] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3429'. [ 804.278044][ T29] audit: type=1400 audit(1776198616.239:3502): avc: denied { unmount } for pid=16012 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 805.624039][T18323] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 805.634990][T18323] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 806.307960][T18340] FAULT_INJECTION: forcing a failure. [ 806.307960][T18340] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 806.323043][ T10] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 806.334658][T18340] CPU: 0 UID: 0 PID: 18340 Comm: syz.2.3440 Tainted: G L syzkaller #0 PREEMPT(full) [ 806.334691][T18340] Tainted: [L]=SOFTLOCKUP [ 806.334697][T18340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 806.334707][T18340] Call Trace: [ 806.334713][T18340] [ 806.334720][T18340] dump_stack_lvl+0x100/0x190 [ 806.334752][T18340] should_fail_ex.cold+0x5/0xa [ 806.334776][T18340] _copy_from_user+0x2e/0xd0 [ 806.334810][T18340] wext_handle_ioctl+0xc9/0x1b0 [ 806.334839][T18340] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 806.334870][T18340] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 806.334898][T18340] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 806.334925][T18340] sock_ioctl+0x2d4/0x6b0 [ 806.334945][T18340] ? __pfx_sock_ioctl+0x10/0x10 [ 806.334962][T18340] ? hook_file_ioctl_common+0x149/0x410 [ 806.334993][T18340] ? selinux_file_ioctl+0x13b/0x290 [ 806.335013][T18340] ? selinux_file_ioctl+0xb6/0x290 [ 806.335034][T18340] ? __pfx_sock_ioctl+0x10/0x10 [ 806.335054][T18340] __x64_sys_ioctl+0x18e/0x210 [ 806.335083][T18340] do_syscall_64+0x10b/0xf80 [ 806.335109][T18340] ? clear_bhb_loop+0x40/0x90 [ 806.335131][T18340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 806.335149][T18340] RIP: 0033:0x7f908ab9c819 [ 806.335165][T18340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 806.335182][T18340] RSP: 002b:00007f908ba25028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 806.335200][T18340] RAX: ffffffffffffffda RBX: 00007f908ae15fa0 RCX: 00007f908ab9c819 [ 806.335212][T18340] RDX: 00002000000000c0 RSI: 0000000000008b30 RDI: 0000000000000004 [ 806.335222][T18340] RBP: 00007f908ba25090 R08: 0000000000000000 R09: 0000000000000000 [ 806.335233][T18340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 806.335243][T18340] R13: 00007f908ae16038 R14: 00007f908ae15fa0 R15: 00007fffea8216a8 [ 806.335268][T18340] [ 806.679179][ T5880] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 806.740679][ T29] audit: type=1400 audit(1776198618.670:3503): avc: denied { setattr } for pid=18341 comm="syz.2.3441" name="" dev="pipefs" ino=67950 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 806.828623][ T5880] usb 5-1: device descriptor read/64, error -71 [ 806.834927][ T10] usb 7-1: Using ep0 maxpacket: 8 [ 806.842628][ T10] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 806.852562][ T10] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 806.867493][ T10] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 806.884497][ T10] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 806.900074][ T10] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 806.915043][ T10] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 806.930232][ T10] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 806.947502][ T10] usb 7-1: config 168 interface 0 has no altsetting 0 [ 806.958025][ T10] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 806.968515][ T10] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 806.983023][ T10] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 807.000970][ T10] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 807.015149][ T10] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 807.026973][ T10] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 807.038765][ T10] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 807.053134][ T10] usb 7-1: config 168 interface 0 has no altsetting 0 [ 807.060973][ T10] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 807.068839][ T10] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 807.080059][ T5880] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 807.088548][ T10] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 807.100054][ T10] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 807.111981][ T10] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 807.123837][ T10] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 807.135861][ T10] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 807.154746][ T10] usb 7-1: config 168 interface 0 has no altsetting 0 [ 807.165000][ T10] usb 7-1: string descriptor 0 read error: -22 [ 807.171241][ T10] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 807.180300][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 807.194480][ T10] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 807.218396][ T5880] usb 5-1: device descriptor read/64, error -71 [ 807.329947][ T5880] usb usb5-port1: attempt power cycle [ 807.354569][T18348] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3442'. [ 807.564118][ T10] usb 7-1: USB disconnect, device number 24 [ 807.670099][ T5880] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 807.770902][ T5880] usb 5-1: device descriptor read/8, error -71 [ 807.902761][ T29] audit: type=1400 audit(1776198619.861:3504): avc: denied { accept } for pid=18325 comm="syz.6.3435" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 807.923495][ T5814] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 807.965346][T18359] @ÿ: renamed from veth0_vlan (while UP) [ 808.087962][ T5880] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 808.108507][ T5880] usb 5-1: device descriptor read/8, error -71 [ 808.233776][ T5880] usb usb5-port1: unable to enumerate USB device [ 808.296930][T18366] netlink: 'syz.2.3446': attribute type 39 has an invalid length. [ 809.370826][T18375] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 809.401773][T18375] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 809.568722][T18392] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3453'. [ 809.797449][ T29] audit: type=1326 audit(1776198621.752:3505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18399 comm="syz.5.3456" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f459a59c819 code=0x7ffc0000 [ 809.865411][ T29] audit: type=1326 audit(1776198621.752:3506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18399 comm="syz.5.3456" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f459a59c819 code=0x7ffc0000 [ 809.926056][ T29] audit: type=1326 audit(1776198621.792:3507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18399 comm="syz.5.3456" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f459a59c819 code=0x7ffc0000 [ 809.985450][T18408] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3457'. [ 810.003826][ T29] audit: type=1326 audit(1776198621.962:3508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18399 comm="syz.5.3456" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f459a59c819 code=0x7ffc0000 [ 810.033373][ T29] audit: type=1326 audit(1776198621.962:3509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18399 comm="syz.5.3456" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f459a59c819 code=0x7ffc0000 [ 810.060369][ T5880] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 810.060832][ T29] audit: type=1326 audit(1776198621.992:3510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18399 comm="syz.5.3456" exe="/root/syz-executor" sig=0 arch=c000003e syscall=299 compat=0 ip=0x7f459a59c819 code=0x7ffc0000 [ 810.123214][ T29] audit: type=1326 audit(1776198621.992:3511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18399 comm="syz.5.3456" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f459a59c819 code=0x7ffc0000 [ 810.195140][ T29] audit: type=1326 audit(1776198621.992:3512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18399 comm="syz.5.3456" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f459a59c819 code=0x7ffc0000 [ 810.233088][ T29] audit: type=1326 audit(1776198621.992:3513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18399 comm="syz.5.3456" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f459a59c819 code=0x7ffc0000 [ 810.259512][ T29] audit: type=1326 audit(1776198621.992:3514): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18399 comm="syz.5.3456" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f459a59c819 code=0x7ffc0000 [ 810.287064][ T5880] usb 7-1: Using ep0 maxpacket: 16 [ 810.294236][ T5880] usb 7-1: unable to get BOS descriptor or descriptor too short [ 810.401480][ T5880] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 810.418932][ T5880] usb 7-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 810.853664][ T5880] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 810.874146][ T5880] usb 7-1: Product: syz [ 810.884713][ T5880] usb 7-1: Manufacturer: syz [ 810.896528][ T5880] usb 7-1: SerialNumber: syz [ 811.135085][ T5880] usb 7-1: Audio class v2/v3 interfaces need an interface association [ 811.150928][ T5880] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 811.301378][T18419] SELinux: security_context_str_to_sid (0xffffffffffffffff) failed with errno=-22 [ 811.317686][T18420] lo speed is unknown, defaulting to 1000 [ 811.323644][T18420] lo speed is unknown, defaulting to 1000 [ 811.357905][T18420] lo speed is unknown, defaulting to 1000 [ 811.400480][T18420] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 811.553874][T18420] lo speed is unknown, defaulting to 1000 [ 811.570082][T18420] lo speed is unknown, defaulting to 1000 [ 811.587414][T18420] lo speed is unknown, defaulting to 1000 [ 811.616694][T18420] lo speed is unknown, defaulting to 1000 [ 811.629553][T18420] lo speed is unknown, defaulting to 1000 [ 811.656160][ T5880] usb 7-1: 2:1 : can't get Cluster Descriptor [ 812.234053][ T5880] usb 7-1: USB disconnect, device number 25 [ 812.260427][T13024] udevd[13024]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 812.576795][ T9] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 813.120221][ T9] usb 5-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 813.130078][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 813.138376][ T9] usb 5-1: Product: syz [ 813.142610][ T9] usb 5-1: Manufacturer: syz [ 813.148707][ T9] usb 5-1: SerialNumber: syz [ 813.155811][ T9] usb 5-1: config 0 descriptor?? [ 813.165750][ T9] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 813.523630][ T5880] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 813.979061][ T9] gspca_sq905c: sq905c_read: usb_control_msg failed (-110) [ 813.998893][ T9] sq905c 5-1:0.0: Reading version command failed [ 814.011608][ T9] sq905c 5-1:0.0: probe with driver sq905c failed with error -110 [ 814.076206][ T5880] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 814.088753][ T5880] usb 4-1: config 1 has an invalid descriptor of length 62, skipping remainder of the config [ 814.118714][ T5880] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 814.150776][ T5880] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 814.192743][ T5880] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 814.216425][ T5880] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 814.239742][ T5880] usb 4-1: Product: syz [ 814.243944][ T5880] usb 4-1: Manufacturer: syz [ 814.257058][ T5880] cdc_wdm 4-1:1.0: skipping garbage [ 814.265776][ T5880] cdc_wdm 4-1:1.0: skipping garbage [ 814.272260][ T5880] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 814.812456][T18451] syzkaller0: entered promiscuous mode [ 814.824325][T18451] syzkaller0: entered allmulticast mode [ 815.827150][ T5880] usb 5-1: USB disconnect, device number 52 [ 816.139825][T18467] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3475'. [ 816.173513][ T5880] usb 4-1: USB disconnect, device number 75 [ 816.492445][ T29] kauditd_printk_skb: 33 callbacks suppressed [ 816.492462][ T29] audit: type=1326 audit(1776198628.455:3548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18479 comm="syz.3.3479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecae19c819 code=0x7ffc0000 [ 816.500009][T18477] bridge0: entered promiscuous mode [ 816.559425][T18477] macsec1: entered promiscuous mode [ 816.624460][ T29] audit: type=1326 audit(1776198628.505:3549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18479 comm="syz.3.3479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecae19c819 code=0x7ffc0000 [ 816.751174][ T29] audit: type=1326 audit(1776198628.535:3550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18479 comm="syz.3.3479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fecae19c819 code=0x7ffc0000 [ 817.016772][ T29] audit: type=1326 audit(1776198628.565:3551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18479 comm="syz.3.3479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecae19c819 code=0x7ffc0000 [ 817.118237][ T29] audit: type=1326 audit(1776198628.565:3552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18479 comm="syz.3.3479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecae19c819 code=0x7ffc0000 [ 817.227122][ T29] audit: type=1326 audit(1776198628.565:3553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18479 comm="syz.3.3479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fecae19c819 code=0x7ffc0000 [ 817.743494][ T29] audit: type=1326 audit(1776198628.565:3554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18479 comm="syz.3.3479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecae19c819 code=0x7ffc0000 [ 817.804437][ T29] audit: type=1326 audit(1776198628.565:3555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18479 comm="syz.3.3479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecae19c819 code=0x7ffc0000 [ 817.851794][ T29] audit: type=1326 audit(1776198628.565:3556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18479 comm="syz.3.3479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fecae19c819 code=0x7ffc0000 [ 817.902314][ T29] audit: type=1326 audit(1776198628.565:3557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18479 comm="syz.3.3479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecae19c819 code=0x7ffc0000 [ 818.124001][T18506] FAULT_INJECTION: forcing a failure. [ 818.124001][T18506] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 818.152869][T18506] CPU: 0 UID: 0 PID: 18506 Comm: syz.2.3485 Tainted: G L syzkaller #0 PREEMPT(full) [ 818.152898][T18506] Tainted: [L]=SOFTLOCKUP [ 818.152904][T18506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 818.152915][T18506] Call Trace: [ 818.152922][T18506] [ 818.152930][T18506] dump_stack_lvl+0x100/0x190 [ 818.152964][T18506] should_fail_ex.cold+0x5/0xa [ 818.152990][T18506] _copy_from_user+0x2e/0xd0 [ 818.153017][T18506] kstrtouint_from_user+0xd6/0x1d0 [ 818.153038][T18506] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 818.153056][T18506] ? __lock_acquire+0x4a5/0x2630 [ 818.153078][T18506] ? lock_acquire+0x1cf/0x380 [ 818.153102][T18506] proc_fail_nth_write+0x83/0x220 [ 818.153130][T18506] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 818.153165][T18506] vfs_write+0x2aa/0x1070 [ 818.153184][T18506] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 818.153214][T18506] ? __pfx_vfs_write+0x10/0x10 [ 818.153231][T18506] ? __fget_files+0x215/0x3d0 [ 818.153257][T18506] ? __fget_files+0x21f/0x3d0 [ 818.153284][T18506] ksys_write+0x12a/0x250 [ 818.153301][T18506] ? __pfx_ksys_write+0x10/0x10 [ 818.153326][T18506] do_syscall_64+0x10b/0xf80 [ 818.153352][T18506] ? clear_bhb_loop+0x40/0x90 [ 818.153374][T18506] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.153392][T18506] RIP: 0033:0x7f908ab5d04e [ 818.153408][T18506] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 818.153425][T18506] RSP: 002b:00007f908ba24fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 818.153443][T18506] RAX: ffffffffffffffda RBX: 00007f908ba256c0 RCX: 00007f908ab5d04e [ 818.153454][T18506] RDX: 0000000000000001 RSI: 00007f908ba250a0 RDI: 0000000000000004 [ 818.153465][T18506] RBP: 00007f908ba25090 R08: 0000000000000000 R09: 0000000000000000 [ 818.153475][T18506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 818.153485][T18506] R13: 00007f908ae16038 R14: 00007f908ae15fa0 R15: 00007fffea8216a8 [ 818.153511][T18506] [ 818.772587][ T791] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 818.892555][ T5880] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 818.923950][ T791] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 818.934619][ T791] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 818.954361][ T791] usb 7-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 818.963743][ T791] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 818.971730][ T791] usb 7-1: Product: syz [ 818.992496][ T791] usb 7-1: Manufacturer: syz [ 818.997106][ T791] usb 7-1: SerialNumber: syz [ 819.062686][ T5880] usb 3-1: Using ep0 maxpacket: 8 [ 819.074424][ T5880] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 819.081978][ T5880] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 819.114213][ T5880] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 819.136526][ T5880] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 819.151555][ T5880] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 819.163154][ T5880] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 819.175906][ T5880] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 819.176037][T18514] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3489'. [ 819.189762][ T5880] usb 3-1: config 168 interface 0 has no altsetting 0 [ 819.214448][ T5880] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 819.222126][ T5880] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 819.254520][T18512] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3488'. [ 819.260132][ T5880] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 819.264562][ T791] usb 7-1: 0:1 : does not exist [ 819.275004][ T5880] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 819.289849][ T791] usb 7-1: unit 4 not found! [ 819.297510][ T5880] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 819.309558][ T5880] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 819.322022][ T5880] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 819.342224][ T5880] usb 3-1: config 168 interface 0 has no altsetting 0 [ 819.351194][ T5880] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 819.373715][ T5880] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 819.389024][ T5880] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 819.401610][ T5880] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 819.404906][ T791] usb 7-1: USB disconnect, device number 26 [ 819.429198][ T5880] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 819.500774][T18518] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3490'. [ 819.509937][T18518] openvswitch: netlink: Flow actions attr not present in new flow. [ 819.573793][ T5880] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 819.764531][ T5880] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 819.810265][ T5880] usb 3-1: config 168 interface 0 has no altsetting 0 [ 819.969628][T13024] udevd[13024]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 819.997300][ T5880] usb 3-1: string descriptor 0 read error: -22 [ 820.003751][ T5880] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 820.023230][ T5880] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 820.156993][ T5880] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 820.514204][ T5880] usb 3-1: USB disconnect, device number 5 [ 821.173146][T18529] FAULT_INJECTION: forcing a failure. [ 821.173146][T18529] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 821.198096][T18529] CPU: 0 UID: 0 PID: 18529 Comm: syz.4.3493 Tainted: G L syzkaller #0 PREEMPT(full) [ 821.198119][T18529] Tainted: [L]=SOFTLOCKUP [ 821.198123][T18529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 821.198129][T18529] Call Trace: [ 821.198134][T18529] [ 821.198138][T18529] dump_stack_lvl+0x100/0x190 [ 821.198161][T18529] should_fail_ex.cold+0x5/0xa [ 821.198178][T18529] _copy_to_user+0x32/0xd0 [ 821.198196][T18529] simple_read_from_buffer+0xcb/0x170 [ 821.198210][T18529] proc_fail_nth_read+0x1af/0x230 [ 821.198229][T18529] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 821.198248][T18529] ? rw_verify_area+0xce/0x6d0 [ 821.198264][T18529] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 821.198282][T18529] vfs_read+0x1e4/0xb30 [ 821.198295][T18529] ? __pfx_vfs_read+0x10/0x10 [ 821.198305][T18529] ? __fget_files+0x215/0x3d0 [ 821.198321][T18529] ? __fget_files+0x21f/0x3d0 [ 821.198337][T18529] ksys_read+0x12a/0x250 [ 821.198347][T18529] ? __pfx_ksys_read+0x10/0x10 [ 821.198361][T18529] do_syscall_64+0x10b/0xf80 [ 821.198379][T18529] ? clear_bhb_loop+0x40/0x90 [ 821.198392][T18529] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 821.198404][T18529] RIP: 0033:0x7f53f895d04e [ 821.198413][T18529] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 821.198424][T18529] RSP: 002b:00007f53f9897fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 821.198435][T18529] RAX: ffffffffffffffda RBX: 00007f53f98986c0 RCX: 00007f53f895d04e [ 821.198442][T18529] RDX: 000000000000000f RSI: 00007f53f98980a0 RDI: 0000000000000005 [ 821.198449][T18529] RBP: 00007f53f9898090 R08: 0000000000000000 R09: 0000000000000000 [ 821.198456][T18529] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 821.198468][T18529] R13: 00007f53f8c16038 R14: 00007f53f8c15fa0 R15: 00007ffd29d58ce8 [ 821.198482][T18529] [ 821.779577][T18537] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3496'. [ 821.912365][ T29] kauditd_printk_skb: 10 callbacks suppressed [ 821.912379][ T29] audit: type=1326 audit(1776198633.878:3568): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18542 comm="syz.2.3498" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f908ab9c819 code=0x7ffc0000 [ 822.064146][ T29] audit: type=1326 audit(1776198633.878:3569): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18542 comm="syz.2.3498" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f908ab9c819 code=0x7ffc0000 [ 822.242300][ T29] audit: type=1326 audit(1776198633.918:3570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18542 comm="syz.2.3498" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f908ab9c819 code=0x7ffc0000 [ 823.206768][ T29] audit: type=1326 audit(1776198635.178:3571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18542 comm="syz.2.3498" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f908ab9c819 code=0x7ffc0000 [ 823.230761][ T29] audit: type=1326 audit(1776198635.178:3572): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18542 comm="syz.2.3498" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f908ab9c819 code=0x7ffc0000 [ 823.341895][T18554] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3500'. [ 823.515001][T18562] FAULT_INJECTION: forcing a failure. [ 823.515001][T18562] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 823.568505][T18562] CPU: 1 UID: 0 PID: 18562 Comm: syz.3.3502 Tainted: G L syzkaller #0 PREEMPT(full) [ 823.568534][T18562] Tainted: [L]=SOFTLOCKUP [ 823.568541][T18562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 823.568551][T18562] Call Trace: [ 823.568557][T18562] [ 823.568564][T18562] dump_stack_lvl+0x100/0x190 [ 823.568599][T18562] should_fail_ex.cold+0x5/0xa [ 823.568625][T18562] _copy_from_user+0x2e/0xd0 [ 823.568651][T18562] do_ipv6_setsockopt+0x74d/0x4510 [ 823.568674][T18562] ? print_kernel_ident+0x10/0x40 [ 823.568698][T18562] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 823.568720][T18562] ? avc_has_perm_noaudit+0x145/0x3b0 [ 823.568749][T18562] ? avc_has_perm+0x135/0x1e0 [ 823.568772][T18562] ? __pfx_avc_has_perm+0x10/0x10 [ 823.568805][T18562] ? sock_has_perm+0x258/0x2f0 [ 823.568832][T18562] ? __pfx_sock_has_perm+0x10/0x10 [ 823.568858][T18562] ? selinux_netlbl_socket_setsockopt+0x134/0x470 [ 823.568880][T18562] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 823.568909][T18562] ? ipv6_setsockopt+0xcb/0x170 [ 823.568924][T18562] ipv6_setsockopt+0xcb/0x170 [ 823.568943][T18562] tcp_setsockopt+0xa7/0x100 [ 823.568965][T18562] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 823.568994][T18562] do_sock_setsockopt+0xf3/0x1d0 [ 823.569027][T18562] __sys_setsockopt+0x195/0x220 [ 823.569054][T18562] __x64_sys_setsockopt+0xbd/0x160 [ 823.569076][T18562] ? do_syscall_64+0x90/0xf80 [ 823.569101][T18562] ? lockdep_hardirqs_on+0x78/0x100 [ 823.569125][T18562] do_syscall_64+0x10b/0xf80 [ 823.569148][T18562] ? clear_bhb_loop+0x40/0x90 [ 823.569169][T18562] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 823.569187][T18562] RIP: 0033:0x7fecae19c819 [ 823.569202][T18562] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 823.569218][T18562] RSP: 002b:00007fecaf10e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 823.569234][T18562] RAX: ffffffffffffffda RBX: 00007fecae415fa0 RCX: 00007fecae19c819 [ 823.569245][T18562] RDX: 0000000000000042 RSI: 0000000000000029 RDI: 0000000000000003 [ 823.569255][T18562] RBP: 00007fecaf10e090 R08: 0000000000000004 R09: 0000000000000000 [ 823.569266][T18562] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 823.569276][T18562] R13: 00007fecae416038 R14: 00007fecae415fa0 R15: 00007ffc2cf50da8 [ 823.569301][T18562] [ 823.824625][ T9] libceph: connect (1)[c::]:6789 error -101 [ 824.016434][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 824.201344][T18561] ceph: No mds server is up or the cluster is laggy [ 824.270098][T18576] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 824.592049][T18586] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3508'. [ 824.601027][T18586] openvswitch: netlink: Key 4 has unexpected len 2 expected 12 [ 824.616074][ T791] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 825.005103][T18583] xt_TCPMSS: Only works on TCP SYN packets [ 825.059470][ T791] usb 4-1: Using ep0 maxpacket: 32 [ 825.086182][ T791] usb 4-1: unable to get BOS descriptor or descriptor too short [ 825.107853][ T791] usb 4-1: config 120 has an invalid interface number: 86 but max is 0 [ 825.163941][ T791] usb 4-1: config 120 has an invalid descriptor of length 0, skipping remainder of the config [ 825.266331][ T791] usb 4-1: config 120 has no interface number 0 [ 825.284296][ T791] usb 4-1: New USB device found, idVendor=12d1, idProduct=9c20, bcdDevice=e5.af [ 825.293825][ T791] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 825.389483][ T791] usb 4-1: Product: syz [ 825.394323][ T791] usb 4-1: Manufacturer: syz [ 825.404433][ T791] usb 4-1: SerialNumber: syz [ 825.572229][T18592] batadv0: left promiscuous mode [ 825.666761][ T5887] lo speed is unknown, defaulting to 1000 [ 825.742173][ T791] huawei_cdc_ncm 4-1:120.86: skipping garbage [ 825.827172][ T791] huawei_cdc_ncm 4-1:120.86: CDC Union missing and no IAD found [ 825.841834][T18591] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 825.863971][ T791] huawei_cdc_ncm 4-1:120.86: bind() failure [ 825.906965][ T791] usb 4-1: USB disconnect, device number 76 [ 826.420206][T18602] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 826.438254][T18602] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 826.509649][T18604] trusted_key: encrypted_key: keylen parameter is missing [ 826.621257][ T29] audit: type=1326 audit(1776198638.590:3573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18605 comm="syz.6.3514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1739c819 code=0x7ffc0000 [ 826.757748][ T29] audit: type=1326 audit(1776198638.590:3574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18605 comm="syz.6.3514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1739c819 code=0x7ffc0000 [ 826.834279][ T29] audit: type=1326 audit(1776198638.590:3575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18605 comm="syz.6.3514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fbc1739c819 code=0x7ffc0000 [ 826.937965][ T29] audit: type=1326 audit(1776198638.690:3576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18605 comm="syz.6.3514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1739c819 code=0x7ffc0000 [ 827.120555][ T29] audit: type=1326 audit(1776198638.690:3577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18605 comm="syz.6.3514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1739c819 code=0x7ffc0000 [ 827.275198][ T29] audit: type=1326 audit(1776198638.720:3578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18605 comm="syz.6.3514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fbc1739c819 code=0x7ffc0000 [ 827.312215][ T9] usb 4-1: new low-speed USB device number 77 using dummy_hcd [ 827.340002][T18621] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3516'. [ 827.468232][ T29] audit: type=1326 audit(1776198638.720:3579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18605 comm="syz.6.3514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1739c819 code=0x7ffc0000 [ 827.517576][ T29] audit: type=1326 audit(1776198638.720:3580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18605 comm="syz.6.3514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1739c819 code=0x7ffc0000 [ 827.946625][ T29] audit: type=1326 audit(1776198638.720:3581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18605 comm="syz.6.3514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fbc1739c819 code=0x7ffc0000 [ 827.970928][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 827.981148][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 827.990074][ T29] audit: type=1326 audit(1776198638.720:3582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18605 comm="syz.6.3514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1739c819 code=0x7ffc0000 [ 828.013812][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 828.042653][ T9] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 828.069578][ T29] audit: type=1326 audit(1776198638.720:3583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18605 comm="syz.6.3514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1739c819 code=0x7ffc0000 [ 828.097902][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 828.122738][ T9] hub 4-1:1.0: bad descriptor, ignoring hub [ 828.145743][ T9] hub 4-1:1.0: probe with driver hub failed with error -5 [ 828.162501][ T29] audit: type=1326 audit(1776198638.720:3584): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18605 comm="syz.6.3514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7fbc1739c819 code=0x7ffc0000 [ 828.192589][ T9] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 828.239270][ T29] audit: type=1326 audit(1776198638.720:3585): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18605 comm="syz.6.3514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1739c819 code=0x7ffc0000 [ 828.312900][T18635] lo speed is unknown, defaulting to 1000 [ 828.330106][T18635] lo speed is unknown, defaulting to 1000 [ 828.367864][T18620] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 828.424811][T18620] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 828.587817][ T24] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 828.758028][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 828.794330][ T24] usb 3-1: config 0 has no interfaces? [ 828.801977][ T24] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 828.826932][ T24] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 828.842496][ T24] usb 3-1: Manufacturer: syz [ 828.861578][ T24] usb 3-1: config 0 descriptor?? [ 828.901767][T18641] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3520'. [ 829.054986][ T9] usb 4-1: USB disconnect, device number 77 [ 829.239348][ T24] usb 3-1: USB disconnect, device number 6 [ 829.875475][ T24] kernel write not supported for file task/478/net/softnet_stat (pid: 24 comm: kworker/1:0) [ 831.015228][T18681] netlink: 'syz.5.3534': attribute type 4 has an invalid length. [ 831.145450][ T5880] usb 3-1: new low-speed USB device number 7 using dummy_hcd [ 831.545065][ T5880] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 831.555326][ T5880] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 831.564346][ T5880] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 831.582745][ T5880] usb 3-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 831.593274][ T5880] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 831.613049][ T5880] hub 3-1:1.0: bad descriptor, ignoring hub [ 831.625935][ T5880] hub 3-1:1.0: probe with driver hub failed with error -5 [ 831.670841][ T5880] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 831.820101][T18673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 831.870237][T18673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 831.913469][T18673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 832.239082][T18673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 832.306092][T18673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 832.314628][T18673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 832.675872][ T791] kernel write not supported for file task/1384/net/softnet_stat (pid: 791 comm: kworker/1:2) [ 832.799379][ T5880] usb 3-1: USB disconnect, device number 7 [ 834.025007][ T5880] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 834.190926][ T5880] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 834.190955][ T5880] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 834.190978][ T5880] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 834.190997][ T5880] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 834.224454][ T5880] usb 4-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 834.224482][ T5880] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 834.224501][ T5880] usb 4-1: Product: syz [ 834.224522][ T5880] usb 4-1: Manufacturer: syz [ 834.224536][ T5880] usb 4-1: SerialNumber: syz [ 834.227274][ T5880] usb 4-1: config 0 descriptor?? [ 834.229462][ T5880] ums-isd200 4-1:0.0: USB Mass Storage device detected [ 834.677760][ T10] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 834.910718][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 834.929187][ T10] usb 5-1: config 6 has an invalid interface number: 2 but max is 0 [ 834.944107][ T10] usb 5-1: config 6 has no interface number 0 [ 834.950817][ T10] usb 5-1: config 6 interface 2 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 834.964360][ T10] usb 5-1: config 6 interface 2 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 834.982379][ T10] usb 5-1: config 6 interface 2 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 835.011199][ T10] usb 5-1: config 6 interface 2 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 835.096013][ T10] usb 5-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 835.114483][ T10] usb 5-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 835.138365][ T10] usb 5-1: Product: syz [ 835.148040][ T10] usb 5-1: Manufacturer: syz [ 835.152793][ T10] usb 5-1: SerialNumber: syz [ 835.183163][T18727] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 835.266083][ T10] hso 5-1:6.2: Failed to find BULK IN ep [ 835.655748][ T10] usb 5-1: USB disconnect, device number 53 [ 836.640009][T18737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 836.663497][T18737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 837.273735][T18741] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3549'. [ 839.966733][T18767] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3558'. [ 840.267644][T18772] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3559'. [ 840.367788][T18776] netlink: 'syz.2.3551': attribute type 4 has an invalid length. [ 840.389133][T18776] netlink: 17 bytes leftover after parsing attributes in process `syz.2.3551'. [ 840.681676][ T791] usb 7-1: new full-speed USB device number 27 using dummy_hcd [ 840.790291][ T24] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 840.884514][ T791] usb 7-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 840.906918][ T791] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 840.918008][ T791] usb 7-1: Product: syz [ 840.924184][ T791] usb 7-1: Manufacturer: syz [ 840.929865][ T791] usb 7-1: SerialNumber: syz [ 840.942392][ T5880] scsi host1: usb-storage 4-1:0.0 [ 840.951488][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 840.954525][ T5880] usb 4-1: USB disconnect, device number 78 [ 840.998653][ T24] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 841.008049][ T24] usb 3-1: config 0 has no interface number 0 [ 841.020270][ T24] usb 3-1: config 0 interface 184 has no altsetting 0 [ 841.039681][ T24] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 841.051093][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 841.060400][ T24] usb 3-1: Product: syz [ 841.064862][ T24] usb 3-1: Manufacturer: syz [ 841.069515][ T24] usb 3-1: SerialNumber: syz [ 841.088966][ T24] usb 3-1: config 0 descriptor?? [ 841.179131][ T791] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 27 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 841.195139][ T791] usb 7-1: USB disconnect, device number 27 [ 841.247802][ T791] usblp0: removed [ 841.774499][ T24] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 841.899774][T18800] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3566'. [ 842.300811][ T24] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 842.343292][T18806] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3567'. [ 842.465499][T18808] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 842.476125][T18808] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 843.137489][T18824] FAULT_INJECTION: forcing a failure. [ 843.137489][T18824] name failslab, interval 1, probability 0, space 0, times 0 [ 843.153456][T18824] CPU: 1 UID: 0 PID: 18824 Comm: syz.5.3573 Tainted: G L syzkaller #0 PREEMPT(full) [ 843.153490][T18824] Tainted: [L]=SOFTLOCKUP [ 843.153497][T18824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 843.153508][T18824] Call Trace: [ 843.153515][T18824] [ 843.153523][T18824] dump_stack_lvl+0x100/0x190 [ 843.153559][T18824] should_fail_ex.cold+0x5/0xa [ 843.153585][T18824] should_failslab+0xc2/0x120 [ 843.153605][T18824] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 843.153633][T18824] ? __alloc_skb+0x140/0x710 [ 843.153660][T18824] __alloc_skb+0x140/0x710 [ 843.153681][T18824] ? __alloc_skb+0x5b7/0x710 [ 843.153703][T18824] ? __pfx___alloc_skb+0x10/0x10 [ 843.153727][T18824] ? find_held_lock+0x2b/0x80 [ 843.153755][T18824] sock_wmalloc+0xd4/0x120 [ 843.153778][T18824] packet_sendmsg_spkt+0x491/0x1560 [ 843.153804][T18824] ? __pfx_tomoyo_socket_sendmsg_permission+0x10/0x10 [ 843.153833][T18824] ? __pfx_packet_sendmsg_spkt+0x10/0x10 [ 843.153863][T18824] __sys_sendto+0x468/0x4b0 [ 843.153885][T18824] ? __pfx_packet_sendmsg_spkt+0x10/0x10 [ 843.153907][T18824] ? __pfx___sys_sendto+0x10/0x10 [ 843.153949][T18824] ? ksys_write+0x1ac/0x250 [ 843.153968][T18824] ? __pfx_ksys_write+0x10/0x10 [ 843.153988][T18824] __x64_sys_sendto+0xe0/0x1c0 [ 843.154009][T18824] ? do_syscall_64+0x90/0xf80 [ 843.154035][T18824] ? lockdep_hardirqs_on+0x78/0x100 [ 843.154061][T18824] do_syscall_64+0x10b/0xf80 [ 843.154085][T18824] ? clear_bhb_loop+0x40/0x90 [ 843.154108][T18824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.154127][T18824] RIP: 0033:0x7f459a59c819 [ 843.154143][T18824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 843.154160][T18824] RSP: 002b:00007f459b405028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 843.154178][T18824] RAX: ffffffffffffffda RBX: 00007f459a815fa0 RCX: 00007f459a59c819 [ 843.154188][T18824] RDX: 0000000000000020 RSI: 0000000000000000 RDI: 0000000000000003 [ 843.154199][T18824] RBP: 00007f459b405090 R08: 00002000000004c0 R09: 0000000000000080 [ 843.154209][T18824] R10: 00000000000060ec R11: 0000000000000246 R12: 0000000000000001 [ 843.154219][T18824] R13: 00007f459a816038 R14: 00007f459a815fa0 R15: 00007ffd06bb7cf8 [ 843.154243][T18824] [ 843.992646][T18830] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 844.022585][T18830] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 844.259945][ T791] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 844.335179][T18830] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3576'. [ 844.442795][ T791] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 844.530139][ T791] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 844.539233][ T791] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 844.554128][ T791] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 844.563873][ T791] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 844.577957][ T791] usb 4-1: Product: syz [ 844.583196][ T791] usb 4-1: Manufacturer: syz [ 844.587902][ T791] usb 4-1: SerialNumber: syz [ 844.597520][ T791] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 844.604456][ T791] cdc_ncm 4-1:1.0: bind() failure [ 845.004788][T18851] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3580'. [ 845.114151][T18852] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 845.899811][T18854] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3581'. [ 846.552438][T18859] netlink: 120 bytes leftover after parsing attributes in process `syz.2.3582'. [ 848.334234][ T24] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -110 [ 848.346296][ T791] usb 4-1: USB disconnect, device number 79 [ 848.360672][ T24] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to write PMT_CTL: -110 [ 848.403321][ T24] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -110 [ 848.433385][ T24] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -110 [ 848.531493][T18874] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3586'. [ 848.540645][T18874] netlink: 164 bytes leftover after parsing attributes in process `syz.5.3586'. [ 849.781996][T18891] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3592'. [ 852.452391][T18933] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3607'. [ 852.521478][ T29] kauditd_printk_skb: 27 callbacks suppressed [ 852.521493][ T29] audit: type=1804 audit(1776198664.503:3613): pid=18937 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.3.3605" name="/newroot/592/file0" dev="tmpfs" ino=3148 res=1 errno=0 [ 852.553136][ T29] audit: type=1400 audit(1776198664.533:3614): avc: denied { wake_alarm } for pid=18934 comm="syz.4.3608" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 852.586496][T18937] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -2360, delta: 1 [ 852.654323][T18937] ref_ctr increment failed for inode: 0xc4c offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff888038ba6e40 [ 852.724087][T18943] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -2360, delta: -1 [ 852.768238][T18943] ref_ctr decrement failed for inode: 0xc4c offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff888038ba6e40 [ 852.801867][T18943] uprobe: syz.3.3605:18943 failed to unregister, leaking uprobe [ 852.805096][T18951] 9p: Bad value for 'wfdno' [ 853.507340][ T5872] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 853.736282][ T5872] usb 5-1: Using ep0 maxpacket: 32 [ 853.910456][ T5872] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 853.955779][ T5872] usb 5-1: config 0 has no interface number 0 [ 853.970712][ T5872] usb 5-1: config 0 interface 184 has no altsetting 0 [ 853.995256][ T5872] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 854.015757][ T5872] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 854.031607][T18975] lo speed is unknown, defaulting to 1000 [ 854.037895][ T5872] usb 5-1: Product: syz [ 854.046442][ T5872] usb 5-1: Manufacturer: syz [ 854.051921][T18975] lo speed is unknown, defaulting to 1000 [ 854.058269][ T29] audit: type=1326 audit(1776198666.044:3615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18974 comm="syz.6.3622" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbc1739c819 code=0x0 [ 854.109284][ T5872] usb 5-1: SerialNumber: syz [ 854.128316][ T5872] usb 5-1: config 0 descriptor?? [ 854.346229][ T29] audit: type=1400 audit(1776198666.334:3616): avc: denied { write } for pid=18984 comm="syz.2.3623" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 854.606230][T18989] 9p: Bad value for 'wfdno' [ 854.626319][ T5872] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000040: -71 [ 854.681311][ T5872] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 854.967073][ T5872] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 855.026022][ T5872] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 855.063453][ T5872] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 855.290300][T19006] netlink: 'syz.2.3628': attribute type 15 has an invalid length. [ 855.298256][T19006] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3628'. [ 855.441727][ T5872] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 855.502834][ T5872] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -71 [ 855.524574][ T5872] usb 5-1: USB disconnect, device number 54 [ 855.835329][ T5872] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 855.854503][T19012] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3631'. [ 856.026501][ T5872] usb 5-1: Using ep0 maxpacket: 16 [ 856.052957][ T5872] usb 5-1: config 1 has an invalid interface number: 105 but max is 0 [ 856.062237][ T5872] usb 5-1: config 1 has no interface number 0 [ 856.068388][ T5872] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 856.099145][ T5872] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 856.109513][ T5872] usb 5-1: config 1 interface 105 has no altsetting 0 [ 856.172357][ T5872] usb 5-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 856.182259][ T5872] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 856.193786][ T5872] usb 5-1: Product: syz [ 856.198805][ T5872] usb 5-1: Manufacturer: syz [ 856.204634][ T5872] usb 5-1: SerialNumber: syz [ 856.249263][T18998] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 856.271444][T18998] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 856.752990][T18998] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 856.867984][T18998] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 857.112254][ T5872] aqc111 5-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x20) reg index 0x0000: 0 [ 857.183007][ T5872] aqc111 5-1:1.105: probe with driver aqc111 failed with error -61 [ 858.219657][T19030] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 858.254168][T19030] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 858.393160][ T5872] usb 5-1: USB disconnect, device number 55 [ 858.473770][T19034] 9p: Bad value for 'wfdno' [ 858.742596][ T5880] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 858.831510][ T5814] Bluetooth: hci5: unexpected event for opcode 0x040e [ 858.884647][T19046] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 858.896597][T19046] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 858.904440][ T5880] usb 4-1: Using ep0 maxpacket: 8 [ 858.916615][ T5880] usb 4-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 858.991117][ T5880] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 859.014638][ T5880] usb 4-1: Product: syz [ 859.018794][ T5880] usb 4-1: Manufacturer: syz [ 859.043370][ T5880] usb 4-1: SerialNumber: syz [ 859.063039][ T5880] usb 4-1: config 0 descriptor?? [ 859.076843][ T5880] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 859.279290][T19062] veth1_macvtap: left promiscuous mode [ 859.732599][ T5880] usb 4-1: USB disconnect, device number 80 [ 859.920194][ T29] audit: type=1400 audit(1776198671.907:3617): avc: denied { setattr } for pid=19072 comm="syz.5.3648" name="NETLINK" dev="sockfs" ino=71829 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 860.666526][T19089] 9p: Bad value for 'rfdno' [ 861.561537][ T5474] veth1_macvtap: entered promiscuous mode [ 862.524966][ T9] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 862.685285][ T9] usb 5-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 862.718493][ T9] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 862.759654][ T9] usb 5-1: Product: syz [ 862.780598][ T9] usb 5-1: SerialNumber: syz [ 863.197241][ T9] usb 5-1: config 0 descriptor?? [ 863.352324][T14680] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 863.367496][T14680] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 863.379361][T14680] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 863.400290][T14680] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 863.416498][T14680] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 863.495419][ T9] hso 5-1:0.0: Can't find BULK IN endpoint [ 863.567437][T19142] lo speed is unknown, defaulting to 1000 [ 863.880287][T19142] lo speed is unknown, defaulting to 1000 [ 863.966063][T19146] netlink: 'syz.6.3664': attribute type 1 has an invalid length. [ 864.012455][ T5880] usb 5-1: USB disconnect, device number 56 [ 864.055225][T19149] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3664'. [ 864.077301][T19146] 8021q: adding VLAN 0 to HW filter on device bond1 [ 864.246996][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 864.490459][T19146] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3664'. [ 864.922257][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 865.560556][T14680] Bluetooth: hci3: command tx timeout [ 865.798032][T19172] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3668'. [ 865.838584][T19179] netlink: 24 bytes leftover after parsing attributes in process `syz.6.3668'. [ 865.929121][T14680] Bluetooth: hci5: unexpected event for opcode 0x040e [ 865.950414][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 866.108736][T19184] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3674'. [ 866.213015][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 866.610299][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 866.682493][T19142] chnl_net:caif_netlink_parms(): no params data found [ 867.007126][T19142] bridge0: port 1(bridge_slave_0) entered blocking state [ 867.016284][T19142] bridge0: port 1(bridge_slave_0) entered disabled state [ 867.028549][T19142] bridge_slave_0: entered allmulticast mode [ 867.035342][T19142] bridge_slave_0: entered promiscuous mode [ 867.050803][ T24] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 867.110905][T19142] bridge0: port 2(bridge_slave_1) entered blocking state [ 867.143123][T19142] bridge0: port 2(bridge_slave_1) entered disabled state [ 867.165914][T19142] bridge_slave_1: entered allmulticast mode [ 867.187304][T19142] bridge_slave_1: entered promiscuous mode [ 867.210273][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 867.233608][ T24] usb 5-1: config 0 has an invalid interface number: 146 but max is 0 [ 867.258706][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 867.275954][ T24] usb 5-1: config 0 has no interface number 0 [ 867.293478][ T24] usb 5-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0x1C, changing to 0xC [ 867.316295][T19142] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 867.326242][ T24] usb 5-1: config 0 interface 146 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 867.343288][T19142] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 867.353717][ T24] usb 5-1: config 0 interface 146 altsetting 0 bulk endpoint 0xC has invalid maxpacket 0 [ 867.367718][ T24] usb 5-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 867.398829][ T24] usb 5-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 867.432881][ T24] usb 5-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 867.451764][ T24] usb 5-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 867.464780][ T24] usb 5-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 867.510578][ T24] usb 5-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 867.520723][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 867.546761][ T24] usb 5-1: Product: syz [ 867.552309][T19210] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3678'. [ 867.573612][ T24] usb 5-1: Manufacturer: syz [ 867.593963][ T24] usb 5-1: SerialNumber: syz [ 867.618297][T14680] Bluetooth: hci3: command tx timeout [ 867.642611][ T24] usb 5-1: config 0 descriptor?? [ 867.663045][T19198] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 867.670288][ T13] gretap0 (unregistering): left promiscuous mode [ 867.679472][ T24] microtek usb (rev 0.4.3): can only deal with bulk endpoints; endpoint 130 is not bulk. [ 867.704848][ T24] microtek usb (rev 0.4.3): couldn't find two input bulk endpoints. Bailing out. [ 867.751491][ T13] bond0 (unregistering): left promiscuous mode [ 867.766224][ T13] bond_slave_0: left promiscuous mode [ 867.779833][ T13] bond_slave_1: left promiscuous mode [ 867.814029][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 867.836750][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 867.850685][ T13] bond0 (unregistering): Released all slaves [ 867.874646][ T13] bond1 (unregistering): Released all slaves [ 867.974545][T19142] team0: Port device team_slave_0 added [ 867.986616][T19142] team0: Port device team_slave_1 added [ 868.562198][ T13] tipc: Left network mode [ 868.571007][T19142] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 868.590549][T19142] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 868.787730][T19142] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 868.812876][T19142] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 869.045511][ T29] audit: type=1400 audit(1776198681.031:3618): avc: denied { unmount } for pid=17900 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 869.067728][T19142] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 869.167367][T19142] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 869.279277][T19236] netlink: 80 bytes leftover after parsing attributes in process `syz.2.3683'. [ 869.294514][T19236] FAULT_INJECTION: forcing a failure. [ 869.294514][T19236] name failslab, interval 1, probability 0, space 0, times 0 [ 869.308676][T19236] CPU: 1 UID: 0 PID: 19236 Comm: syz.2.3683 Tainted: G L syzkaller #0 PREEMPT(full) [ 869.308703][T19236] Tainted: [L]=SOFTLOCKUP [ 869.308710][T19236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 869.308720][T19236] Call Trace: [ 869.308727][T19236] [ 869.308733][T19236] dump_stack_lvl+0x100/0x190 [ 869.308763][T19236] should_fail_ex.cold+0x5/0xa [ 869.308786][T19236] should_failslab+0xc2/0x120 [ 869.308803][T19236] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 869.308826][T19236] ? __alloc_skb+0x140/0x710 [ 869.308850][T19236] __alloc_skb+0x140/0x710 [ 869.308867][T19236] ? __alloc_skb+0x5b7/0x710 [ 869.308885][T19236] ? __pfx___alloc_skb+0x10/0x10 [ 869.308906][T19236] ? genl_rcv_msg+0x4be/0x800 [ 869.308930][T19236] netlink_ack+0x117/0xb80 [ 869.308962][T19236] netlink_rcv_skb+0x333/0x420 [ 869.308994][T19236] ? __pfx_genl_rcv_msg+0x10/0x10 [ 869.309013][T19236] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 869.309048][T19236] ? netlink_deliver_tap+0x1ae/0xcc0 [ 869.309076][T19236] genl_rcv+0x28/0x40 [ 869.309091][T19236] netlink_unicast+0x5aa/0x870 [ 869.309121][T19236] ? __pfx_netlink_unicast+0x10/0x10 [ 869.309156][T19236] netlink_sendmsg+0x8b0/0xda0 [ 869.309185][T19236] ? __pfx_netlink_sendmsg+0x10/0x10 [ 869.309210][T19236] ? __might_fault+0x10/0x140 [ 869.309242][T19236] ____sys_sendmsg+0x9e1/0xb70 [ 869.309258][T19236] ? __pfx_netlink_sendmsg+0x10/0x10 [ 869.309286][T19236] ? __pfx_____sys_sendmsg+0x10/0x10 [ 869.309314][T19236] ___sys_sendmsg+0x190/0x1e0 [ 869.309335][T19236] ? __pfx____sys_sendmsg+0x10/0x10 [ 869.309384][T19236] __sys_sendmsg+0x170/0x220 [ 869.309409][T19236] ? __pfx___sys_sendmsg+0x10/0x10 [ 869.309450][T19236] do_syscall_64+0x10b/0xf80 [ 869.309476][T19236] ? clear_bhb_loop+0x40/0x90 [ 869.309499][T19236] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 869.309517][T19236] RIP: 0033:0x7f908ab9c819 [ 869.309532][T19236] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 869.309549][T19236] RSP: 002b:00007f908ba25028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 869.309567][T19236] RAX: ffffffffffffffda RBX: 00007f908ae15fa0 RCX: 00007f908ab9c819 [ 869.309579][T19236] RDX: 0000000020000800 RSI: 00002000000001c0 RDI: 0000000000000004 [ 869.309589][T19236] RBP: 00007f908ba25090 R08: 0000000000000000 R09: 0000000000000000 [ 869.309599][T19236] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 869.309609][T19236] R13: 00007f908ae16038 R14: 00007f908ae15fa0 R15: 00007fffea8216a8 [ 869.309633][T19236] [ 869.603359][ T29] audit: type=1400 audit(1776198681.592:3619): avc: denied { read } for pid=19219 comm="syz.5.3681" lport=34988 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 869.677307][T14680] Bluetooth: hci3: command tx timeout [ 869.698254][T19142] hsr_slave_0: entered promiscuous mode [ 869.705059][T19142] hsr_slave_1: entered promiscuous mode [ 869.712941][T19142] debugfs: 'hsr0' already exists in 'hsr' [ 869.718896][T19142] Cannot create hsr debugfs directory [ 870.093413][ T5859] usb 5-1: USB disconnect, device number 57 [ 870.116941][ T24] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 870.828372][T19251] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3687'. [ 870.896546][ T24] usb 7-1: device descriptor read/64, error -71 [ 871.159906][ T24] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 871.693920][ T24] usb 7-1: device descriptor read/64, error -71 [ 871.769647][T14680] Bluetooth: hci3: command tx timeout [ 871.816587][ T24] usb usb7-port1: attempt power cycle [ 872.122029][T19277] ipvlan0: entered allmulticast mode [ 872.140181][T19277] batadv_slave_1: entered allmulticast mode [ 872.165907][ T24] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 872.165945][T19277] batman_adv: batadv0: Adding interface: ipvlan0 [ 872.180119][T19282] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3689'. [ 872.187386][T19277] batman_adv: batadv0: The MTU of interface ipvlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 872.214706][T19277] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 872.225608][T19277] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 872.236081][T19277] batman_adv: batadv0: Interface activated: ipvlan0 [ 872.275573][ T24] usb 7-1: device descriptor read/8, error -71 [ 872.424577][ T13] hsr_slave_0: left promiscuous mode [ 872.435594][ T13] hsr_slave_1: left promiscuous mode [ 872.455500][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 872.522383][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 872.551923][T19277] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 872.569795][T19277] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 872.575684][ T24] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 872.595494][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 872.625731][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 872.633354][ T24] usb 7-1: device descriptor read/8, error -71 [ 872.664769][ T13] veth1: left allmulticast mode [ 872.671069][ T13] veth1: left promiscuous mode [ 872.677398][ T13] veth1_macvtap: left promiscuous mode [ 872.682877][ T13] veth0_macvtap: left promiscuous mode [ 872.688689][ T13] veth1_vlan: left promiscuous mode [ 872.694879][ T13] @ÿ: left promiscuous mode [ 872.771730][ T24] usb usb7-port1: unable to enumerate USB device [ 873.828743][T19142] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 873.872195][T19142] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 873.925990][ T13] IPVS: stop unused estimator thread 0... [ 873.931858][T19142] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 873.971408][T19312] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3696'. [ 873.982967][T19142] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 874.115107][T19320] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3697'. [ 874.160491][ T29] audit: type=1400 audit(1776198686.134:3620): avc: denied { getopt } for pid=19313 comm="syz.4.3697" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 874.206205][T19142] 8021q: adding VLAN 0 to HW filter on device bond0 [ 874.223324][T19142] 8021q: adding VLAN 0 to HW filter on device team0 [ 874.237425][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 874.244540][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 874.297165][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 874.304317][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 874.564690][T17040] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 874.726261][T17040] usb 7-1: config 1 has an invalid interface number: 7 but max is 0 [ 874.772823][T17040] usb 7-1: config 1 has no interface number 0 [ 874.783807][T19142] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 874.801986][T17040] usb 7-1: config 1 interface 7 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 874.850929][T17040] usb 7-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 874.956947][T17040] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.972420][T19142] veth0_vlan: entered promiscuous mode [ 874.990555][T17040] usb 7-1: Product: syz [ 875.017482][T19142] veth1_vlan: entered promiscuous mode [ 875.030327][T17040] usb 7-1: Manufacturer: syz [ 875.055918][T17040] usb 7-1: SerialNumber: syz [ 875.081796][T19330] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 875.112724][T19142] veth0_macvtap: entered promiscuous mode [ 875.130277][T17040] usb 7-1: Expected 3 endpoints, found: 2 [ 875.172623][T19142] veth1_macvtap: entered promiscuous mode [ 875.269718][T19142] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 875.326379][T19142] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 875.370257][ T3951] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 875.401775][ T5859] usb 7-1: USB disconnect, device number 32 [ 875.411315][ T3951] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 875.432393][ T3951] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 875.458833][ T3951] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 875.567050][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 875.586202][T19364] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 875.599460][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 875.663879][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 875.695823][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 875.845322][T19330] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3698'. [ 876.177712][T19376] overlayfs: failed lookup in lower (newroot/455, name='file1', err=-40): overlapping layers [ 876.394796][ T30] INFO: task kworker/1:6:5932 blocked for more than 143 seconds. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 876.815969][ T29] audit: type=1400 audit(1776198688.805:3621): avc: denied { write } for pid=5792 comm="syz-executor" path="pipe:[4638]" dev="pipefs" ino=4638 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 876.864209][ T30] Tainted: G L syzkaller #0 [ 876.870735][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 877.175519][ T30] task:kworker/1:6 state:D stack:19368 pid:5932 tgid:5932 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 877.187775][ T30] Workqueue: usb_hub_wq hub_event [ 877.203317][ T30] Call Trace: [ 877.207786][ T30] [ 877.210746][ T30] __schedule+0xfee/0x6120 [ 877.242043][ T30] ? __lock_acquire+0x4a5/0x2630 [ 877.264456][ T30] ? __pfx___schedule+0x10/0x10 [ 877.304045][ T30] ? find_held_lock+0x2b/0x80 [ 877.313407][ T30] ? schedule+0x2bf/0x390 [ 877.321017][ T30] schedule+0xdd/0x390 [ 877.325380][ T30] schedule_timeout+0x1b2/0x280 [ 877.330255][ T30] ? __pfx_schedule_timeout+0x10/0x10 [ 877.393236][ T30] ? mark_held_locks+0x40/0x70 [ 877.398040][ T30] __wait_for_common+0x2e7/0x4c0 [ 877.417043][ T30] ? __pfx_schedule_timeout+0x10/0x10 [ 877.422454][ T30] ? __pfx___wait_for_common+0x10/0x10 [ 877.445321][ T30] ? __pfx_device_del+0x10/0x10 [ 877.450219][ T30] ? kobject_put+0xb9/0x640 [ 877.454988][ T30] i2c_del_adapter+0x62d/0x820 [ 877.459796][ T30] ? lockdep_hardirqs_on+0x78/0x100 [ 877.465301][ T30] ? __pfx_i2c_del_adapter+0x10/0x10 [ 877.470592][ T30] ? dvb_usbv2_exit.isra.0+0x3e1/0xb40 [ 877.479926][ T30] ? kfree+0x1f6/0x6b0 [ 877.484105][ T30] ? media_device_unregister+0x446/0x610 [ 877.489749][ T30] dvb_usbv2_exit.isra.0+0x47f/0xb40 [ 877.495075][ T30] dvb_usbv2_probe+0x669/0x970 [ 877.499848][ T30] ? __pfx_dvb_usbv2_probe+0x10/0x10 [ 877.505168][ T30] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 877.511002][ T30] ? lockdep_hardirqs_on+0x78/0x100 [ 877.516315][ T30] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 877.526255][ T30] ? __pm_runtime_set_status+0x13c/0x970 [ 877.531913][ T30] usb_probe_interface+0x303/0x8f0 [ 877.537921][ T30] ? __pfx_usb_probe_interface+0x10/0x10 [ 877.543786][ T30] really_probe+0x241/0xa60 [ 877.548301][ T30] __driver_probe_device+0x1de/0x400 [ 877.553870][ T30] driver_probe_device+0x4c/0x1b0 [ 877.558909][ T30] __device_attach_driver+0x1df/0x340 [ 877.564600][ T30] ? __pfx___device_attach_driver+0x10/0x10 [ 877.570505][ T30] bus_for_each_drv+0x159/0x1e0 [ 877.575656][ T30] ? __pfx_bus_for_each_drv+0x10/0x10 [ 877.581788][ T30] ? lockdep_hardirqs_on+0x78/0x100 [ 877.589995][ T30] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 877.596114][ T30] __device_attach+0x1e4/0x4d0 [ 877.600888][ T30] ? __pfx___device_attach+0x10/0x10 [ 877.606264][ T30] ? do_raw_spin_unlock+0x145/0x1e0 [ 877.611495][ T30] device_initial_probe+0xaf/0xd0 [ 877.616560][ T30] bus_probe_device+0x64/0x160 [ 877.621328][ T30] device_add+0x11d9/0x1950 [ 877.625943][ T30] ? __pfx_device_add+0x10/0x10 [ 877.630826][ T30] ? kfree+0x1f6/0x6b0 [ 877.635576][ T30] usb_set_configuration+0xd97/0x1c60 [ 877.640978][ T30] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 877.650315][ T30] usb_generic_driver_probe+0xa1/0xe0 [ 877.655745][ T30] usb_probe_device+0xef/0x400 [ 877.660534][ T30] ? __pfx_usb_probe_device+0x10/0x10 [ 877.666091][ T30] really_probe+0x241/0xa60 [ 877.670606][ T30] __driver_probe_device+0x1de/0x400 [ 877.676454][ T30] ? usb_driver_applicable+0x1c7/0x220 [ 877.681931][ T30] driver_probe_device+0x4c/0x1b0 [ 877.687922][ T30] __device_attach_driver+0x1df/0x340 [ 877.693355][ T30] ? __pfx___device_attach_driver+0x10/0x10 [ 877.699245][ T30] bus_for_each_drv+0x159/0x1e0 [ 877.705029][ T30] ? __pfx_bus_for_each_drv+0x10/0x10 [ 877.710426][ T30] ? lockdep_hardirqs_on+0x78/0x100 [ 877.715848][ T30] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 877.721663][ T30] __device_attach+0x1e4/0x4d0 [ 877.726533][ T30] ? __pfx___device_attach+0x10/0x10 [ 877.731829][ T30] ? do_raw_spin_unlock+0x145/0x1e0 [ 877.738433][ T30] device_initial_probe+0xaf/0xd0 [ 877.745211][ T30] bus_probe_device+0x64/0x160 [ 877.749995][ T30] device_add+0x11d9/0x1950 [ 877.756032][ T30] ? __pfx_device_add+0x10/0x10 [ 877.760916][ T30] ? usb_detect_static_quirks+0x335/0x3e0 [ 877.766674][ T30] ? kfree+0x1f6/0x6b0 [ 877.770754][ T30] usb_new_device.cold+0x685/0x115c [ 877.776030][ T30] ? do_raw_spin_lock+0x128/0x260 [ 877.781057][ T30] ? __pfx_usb_new_device+0x10/0x10 [ 877.787242][ T30] ? mark_held_locks+0x40/0x70 [ 877.792534][ T30] hub_event+0x314d/0x4af0 [ 877.797024][ T30] ? __pfx_hub_event+0x10/0x10 [ 877.801797][ T30] ? lock_acquire+0x5e/0x380 [ 877.806419][ T30] ? rcu_is_watching+0x12/0xc0 [ 877.811382][ T30] process_one_work+0xa23/0x19a0 [ 877.816375][ T30] ? __pfx_process_one_work+0x10/0x10 [ 877.821755][ T30] ? __pfx_hub_event+0x10/0x10 [ 877.826570][ T30] worker_thread+0x5ef/0xe50 [ 877.831169][ T30] ? __pfx_worker_thread+0x10/0x10 [ 877.839413][ T30] ? kthread+0x13a/0x450 [ 877.844565][ T30] ? __pfx_worker_thread+0x10/0x10 [ 877.849684][ T30] kthread+0x370/0x450 [ 877.853873][ T30] ? __pfx_kthread+0x10/0x10 [ 877.858467][ T30] ret_from_fork+0x72b/0xd50 [ 877.864411][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 877.869534][ T30] ? __switch_to+0x7b4/0x1120 [ 877.874258][ T30] ? __pfx_kthread+0x10/0x10 [ 877.878874][ T30] ret_from_fork_asm+0x1a/0x30 [ 877.887817][ T30] [ 877.890904][ T30] [ 877.890904][ T30] Showing all locks held in the system: [ 877.933199][ T30] 1 lock held by ksoftirqd/1/23: [ 877.938159][ T30] 1 lock held by khungtaskd/30: [ 878.032921][ T30] #0: ffffffff8e7e6b20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 878.042840][ T30] 3 locks held by kworker/1:2/791: [ 878.073183][ T30] #0: ffff88813fe67148 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 [ 878.112857][ T30] #1: ffffc900037a7d08 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 [ 878.122554][ T30] #2: ffffffff8e7f2678 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 [ 878.192832][ T30] 3 locks held by kworker/1:3/1204: [ 878.198861][ T30] #0: ffff88813fe67148 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 [ 878.252130][ T30] #1: ffffc900053bfd08 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 [ 878.302391][ T30] #2: ffff888079e1b240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1b8/0x63b0 [ 878.323496][ T30] 2 locks held by getty/5567: [ 878.328199][ T30] #0: ffff8880391410a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 878.362729][ T30] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 [ 878.392722][ T30] 5 locks held by kworker/1:6/5932: [ 878.397942][ T30] #0: ffff8880232ba148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 [ 878.432826][ T30] #1: ffffc90004717d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 [ 878.446291][ T30] #2: ffff88802ad491e0 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 [ 878.455986][ T30] #3: ffff8880585a81e0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 [ 878.466189][ T30] #4: ffff888036bf41a8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 [ 878.475478][ T30] 1 lock held by syz.5.3067/16973: [ 878.480572][ T30] #0: ffffffff8e7f2678 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 878.490756][ T30] 1 lock held by syz.4.3324/17858: [ 878.495935][ T30] #0: ffffffff906190e8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 878.505228][ T30] 3 locks held by syz.2.3561/18822: [ 878.510413][ T30] #0: ffff88802bf28ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 878.520040][ T30] #1: ffff88802bf280c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x35c/0x1240 [ 878.529801][ T30] #2: ffffffff908b25c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x280 [ 878.539910][ T30] 4 locks held by syz-executor/19142: [ 878.545374][ T30] #0: ffff888064b44ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 878.555084][ T30] #1: ffff888064b440c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x35c/0x1240 [ 878.564943][ T30] #2: ffffffff908b25c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x280 [ 878.575029][ T30] #3: ffff888058444300 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x95/0x710 [ 878.585533][ T30] [ 878.587859][ T30] ============================================= [ 878.587859][ T30] [ 878.628859][ T30] NMI backtrace for cpu 0 [ 878.628880][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 878.628904][ T30] Tainted: [L]=SOFTLOCKUP [ 878.628910][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 878.628920][ T30] Call Trace: [ 878.628926][ T30] [ 878.628933][ T30] dump_stack_lvl+0x100/0x190 [ 878.628966][ T30] nmi_cpu_backtrace.cold+0x12d/0x151 [ 878.628987][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 878.629011][ T30] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 878.629036][ T30] sys_info+0x141/0x190 [ 878.629053][ T30] watchdog+0xd25/0x1050 [ 878.629085][ T30] ? __pfx_watchdog+0x10/0x10 [ 878.629109][ T30] ? __kthread_parkme+0x18c/0x230 [ 878.629138][ T30] ? kthread+0x13a/0x450 [ 878.629154][ T30] ? __pfx_watchdog+0x10/0x10 [ 878.629177][ T30] kthread+0x370/0x450 [ 878.629193][ T30] ? __pfx_kthread+0x10/0x10 [ 878.629212][ T30] ret_from_fork+0x72b/0xd50 [ 878.629233][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 878.629254][ T30] ? __switch_to+0x7b4/0x1120 [ 878.629277][ T30] ? __pfx_kthread+0x10/0x10 [ 878.629296][ T30] ret_from_fork_asm+0x1a/0x30 [ 878.629330][ T30] [ 878.629337][ T30] Sending NMI from CPU 0 to CPUs 1: [ 878.756275][ C1] NMI backtrace for cpu 1 [ 878.756292][ C1] CPU: 1 UID: 0 PID: 16973 Comm: syz.5.3067 Tainted: G L syzkaller #0 PREEMPT(full) [ 878.756312][ C1] Tainted: [L]=SOFTLOCKUP [ 878.756317][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 878.756325][ C1] RIP: 0010:rcu_is_watching+0xd/0xc0 [ 878.756347][ C1] Code: 81 e8 27 1c 88 00 e9 49 ff ff ff 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 53 65 ff 05 13 16 22 12 8e 3b a5 09 48 c7 c3 e8 8c 10 94 89 c5 83 f8 07 0f 87 82 00 00 [ 878.756360][ C1] RSP: 0018:ffffc90004996d80 EFLAGS: 00000282 [ 878.756372][ C1] RAX: 0000000000000001 RBX: ffffc90004997908 RCX: ffffffff9189ec01 [ 878.756381][ C1] RDX: ffffc90004997910 RSI: ffffc900049978d8 RDI: ffffc90004996e18 [ 878.756390][ C1] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000007 [ 878.756398][ C1] R10: 0000000000000200 R11: 0000000000019062 R12: ffffc90004996e58 [ 878.756407][ C1] R13: ffffc90004996e08 R14: ffffc90004997908 R15: ffffc90004996e3c [ 878.756416][ C1] FS: 0000000000000000(0000) GS:ffff88812442b000(0000) knlGS:0000000000000000 [ 878.756431][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 878.756440][ C1] CR2: 0000557cd1b76300 CR3: 000000000e598000 CR4: 00000000003526f0 [ 878.756449][ C1] Call Trace: [ 878.756454][ C1] [ 878.756460][ C1] unwind_next_frame+0x745/0x1ea0 [ 878.756479][ C1] ? shrink_dentry_list+0x180/0x5e0 [ 878.756499][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 878.756518][ C1] arch_stack_walk+0x94/0xf0 [ 878.756537][ C1] ? shrink_dcache_tree+0x100/0x570 [ 878.756558][ C1] stack_trace_save+0x8e/0xc0 [ 878.756574][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 878.756592][ C1] ? __lock_acquire+0x4a5/0x2630 [ 878.756604][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 878.756622][ C1] ? lockdep_hardirqs_on+0x78/0x100 [ 878.756641][ C1] save_stack+0x162/0x1e0 [ 878.756660][ C1] ? __pfx_save_stack+0x10/0x10 [ 878.756679][ C1] ? free_unref_folios+0xaea/0x1790 [ 878.756697][ C1] ? folios_put_refs+0x53c/0x840 [ 878.756715][ C1] ? shmem_undo_range+0x5e5/0x1570 [ 878.756733][ C1] ? shmem_evict_inode+0x3f3/0xc40 [ 878.756751][ C1] ? evict+0x3c2/0xad0 [ 878.756766][ C1] ? iput.part.0+0x605/0xf50 [ 878.756783][ C1] ? iput+0x35/0x40 [ 878.756798][ C1] ? dentry_unlink_inode+0x2a1/0x490 [ 878.756813][ C1] ? __dentry_kill+0x1d0/0x600 [ 878.756829][ C1] ? shrink_dentry_list+0x180/0x5e0 [ 878.756848][ C1] ? page_ext_put+0x3e/0xd0 [ 878.756869][ C1] __reset_page_owner+0x84/0x190 [ 878.756883][ C1] free_unref_folios+0xaea/0x1790 [ 878.756902][ C1] ? mark_held_locks+0x40/0x70 [ 878.756914][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 878.756933][ C1] folios_put_refs+0x53c/0x840 [ 878.756952][ C1] ? __pfx_folios_put_refs+0x10/0x10 [ 878.756972][ C1] ? folio_batch_remove_exceptionals+0x115/0x1a0 [ 878.756988][ C1] shmem_undo_range+0x5e5/0x1570 [ 878.757011][ C1] ? __pfx_shmem_undo_range+0x10/0x10 [ 878.757038][ C1] ? __lock_acquire+0x4a5/0x2630 [ 878.757061][ C1] shmem_evict_inode+0x3f3/0xc40 [ 878.757081][ C1] ? inode_wait_for_writeback+0x171/0x390 [ 878.757094][ C1] ? bpf_ksym_find+0x128/0x1c0 [ 878.757108][ C1] ? __pfx_shmem_evict_inode+0x10/0x10 [ 878.757127][ C1] ? __pfx_inode_wait_for_writeback+0x10/0x10 [ 878.757142][ C1] ? find_held_lock+0x2b/0x80 [ 878.757158][ C1] ? evict+0x37e/0xad0 [ 878.757174][ C1] ? evict+0x37e/0xad0 [ 878.757191][ C1] ? __pfx_shmem_evict_inode+0x10/0x10 [ 878.757210][ C1] evict+0x3c2/0xad0 [ 878.757228][ C1] ? __pfx_evict+0x10/0x10 [ 878.757245][ C1] ? iput.part.0+0x5fd/0xf50 [ 878.757270][ C1] iput.part.0+0x605/0xf50 [ 878.757286][ C1] ? __pfx_inode_just_drop+0x10/0x10 [ 878.757301][ C1] iput+0x35/0x40 [ 878.757317][ C1] dentry_unlink_inode+0x2a1/0x490 [ 878.757334][ C1] __dentry_kill+0x1d0/0x600 [ 878.757351][ C1] ? shrink_dentry_list+0x10e/0x5e0 [ 878.757369][ C1] shrink_dentry_list+0x180/0x5e0 [ 878.757388][ C1] ? shrink_dcache_tree+0x98/0x570 [ 878.757406][ C1] ? __pfx_select_collect_umount+0x10/0x10 [ 878.757424][ C1] shrink_dcache_tree+0x100/0x570 [ 878.757442][ C1] ? __pfx_select_collect_umount+0x10/0x10 [ 878.757460][ C1] ? __pfx_shrink_dcache_tree+0x10/0x10 [ 878.757482][ C1] shrink_dcache_for_umount+0xa7/0x400 [ 878.757503][ C1] generic_shutdown_super+0x7e/0x360 [ 878.757523][ C1] kill_anon_super+0x3a/0x60 [ 878.757541][ C1] deactivate_locked_super+0xc1/0x1b0 [ 878.757560][ C1] deactivate_super+0xe7/0x110 [ 878.757579][ C1] cleanup_mnt+0x21f/0x450 [ 878.757594][ C1] task_work_run+0x150/0x240 [ 878.757608][ C1] ? __pfx_task_work_run+0x10/0x10 [ 878.757626][ C1] do_exit+0x8b8/0x2b60 [ 878.757646][ C1] ? __pfx_do_exit+0x10/0x10 [ 878.757664][ C1] ? cgroup_update_frozen_flag+0x107/0x210 [ 878.757680][ C1] ? find_held_lock+0x2b/0x80 [ 878.757696][ C1] ? get_signal+0x184f/0x21e0 [ 878.757713][ C1] do_group_exit+0xd5/0x2a0 [ 878.757733][ C1] get_signal+0x1ec7/0x21e0 [ 878.757749][ C1] ? __asan_memset+0x23/0x50 [ 878.757770][ C1] ? __pfx_get_signal+0x10/0x10 [ 878.757786][ C1] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 878.757802][ C1] arch_do_signal_or_restart+0x91/0x7a0 [ 878.757820][ C1] ? __pfx_get_timespec64+0x10/0x10 [ 878.757838][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 878.757858][ C1] ? __x64_sys_clock_nanosleep+0x347/0x480 [ 878.757879][ C1] exit_to_user_mode_loop+0x86/0x4a0 [ 878.757893][ C1] do_syscall_64+0x706/0xf80 [ 878.757911][ C1] ? clear_bhb_loop+0x40/0x90 [ 878.757926][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 878.757940][ C1] RIP: 0033:0x7f459a55d04e [ 878.757951][ C1] Code: Unable to access opcode bytes at 0x7f459a55d024. [ 878.757957][ C1] RSP: 002b:00007f459b404f58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 878.757970][ C1] RAX: fffffffffffffdfc RBX: 00007f459b4056c0 RCX: 00007f459a55d04e [ 878.757979][ C1] RDX: 00007f459b404fb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 878.757987][ C1] RBP: 00007f459a632c91 R08: 0000000000000000 R09: 0000000000000000 [ 878.757995][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 878.758003][ C1] R13: 00007f459a816038 R14: 00007f459a815fa0 R15: 00007ffd06bb7cf8 [ 878.758017][ C1] [ 879.377305][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 879.384161][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 879.394838][ T30] Tainted: [L]=SOFTLOCKUP [ 879.399155][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 879.409204][ T30] Call Trace: [ 879.412495][ T30] [ 879.415412][ T30] dump_stack_lvl+0x100/0x190 [ 879.420087][ T30] vpanic+0x552/0x970 [ 879.424051][ T30] ? __pfx_vpanic+0x10/0x10 [ 879.428535][ T30] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 879.434677][ T30] panic+0xd1/0xe0 [ 879.438385][ T30] ? __pfx_panic+0x10/0x10 [ 879.442783][ T30] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 879.448934][ T30] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 879.455071][ T30] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 879.461208][ T30] ? watchdog.cold+0x198/0x1ca [ 879.465954][ T30] ? watchdog+0xd35/0x1050 [ 879.470362][ T30] watchdog.cold+0x1a9/0x1ca [ 879.474937][ T30] ? __pfx_watchdog+0x10/0x10 [ 879.479599][ T30] ? __kthread_parkme+0x18c/0x230 [ 879.484613][ T30] ? kthread+0x13a/0x450 [ 879.488837][ T30] ? __pfx_watchdog+0x10/0x10 [ 879.493497][ T30] kthread+0x370/0x450 [ 879.497549][ T30] ? __pfx_kthread+0x10/0x10 [ 879.502122][ T30] ret_from_fork+0x72b/0xd50 [ 879.506702][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 879.511797][ T30] ? __switch_to+0x7b4/0x1120 [ 879.516461][ T30] ? __pfx_kthread+0x10/0x10 [ 879.521032][ T30] ret_from_fork_asm+0x1a/0x30 [ 879.525790][ T30] [ 879.529098][ T30] Kernel Offset: disabled [ 879.533398][ T30] Rebooting in 86400 seconds..