last executing test programs:

49.439829303s ago: executing program 3 (id=238):
r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f00000000c0)={0x0, 0xb, 0xe0, 0x0, 0x2, 0x2, &(0x7f0000000000)='\r\n'}) (async)
r1 = socket$tipc(0x1e, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000140)={'team_slave_0\x00', &(0x7f0000000280)=@ethtool_rxfh={0x47, 0xac0, 0x2, 0x800, 0xa0, "001000", 0x2}})
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = socket(0x40000000015, 0x5, 0x0)
setsockopt$sock_int(r3, 0x1, 0x23, &(0x7f0000000000)=0x2, 0x4) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async)
mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x212589b, 0x0)
mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) (async)
pivot_root(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)='./file0\x00')
bind$inet(r3, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) (async)
recvmmsg(r3, &(0x7f00000040c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (async, rerun: 64)
sendto$inet(r3, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) (async, rerun: 64)
r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async)
r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
unshare(0x22020600) (async)
ioctl$sock_ifreq(r5, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='rose0\x00'})
connect$rose(r3, &(0x7f0000000080)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, 0x3, [@null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x40) (async)
ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000380)={0x3, 0x0, @ioapic={0x2, 0x2, 0x101, 0x5, 0x0, [{0xd, 0x9, 0x6, '\x00', 0x1}, {0x6, 0x2, 0x26, '\x00', 0xfc}, {0x2, 0xef, 0xd, '\x00', 0xee}, {0xfb, 0x7, 0xd}, {0x13, 0x9, 0x2, '\x00', 0x62}, {0x0, 0x3, 0x2, '\x00', 0xd3}, {0xf, 0x0, 0x8, '\x00', 0x4}, {0x9, 0xdb, 0x1}, {0x81, 0x23, 0x5, '\x00', 0x2}, {0xde, 0x20, 0x3}, {0x40, 0x4, 0xf8, '\x00', 0x1}, {0xf5, 0x5, 0x4, '\x00', 0xb5}, {0x7, 0x3, 0x2b, '\x00', 0x6}, {0x4, 0x0, 0x0, '\x00', 0xe9}, {0x10, 0x39, 0x40, '\x00', 0xcf}, {0x6c, 0x3f, 0x0, '\x00', 0x72}, {0x6e, 0x4, 0x4, '\x00', 0xe}, {0x7, 0x2, 0x8, '\x00', 0x7}, {0xf, 0x7, 0x5}, {0x1, 0x6, 0x9}, {0x4, 0x6, 0x1, '\x00', 0x49}, {0xee, 0x2, 0x91, '\x00', 0xba}, {0x2, 0x8, 0x2, '\x00', 0xc3}, {0x8, 0x9, 0x54, '\x00', 0x9}]}})
r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) (async)
personality(0x5400004) (async)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
r7 = socket$kcm(0x2d, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r7, 0x89e2, &(0x7f0000000340)={r7}) (async)
mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0xb, 0x202812, r6, 0x7dfff000)

49.313211588s ago: executing program 3 (id=240):
syz_usb_connect(0x2, 0x24, &(0x7f0000000700)={{0x12, 0x1, 0x310, 0x0, 0x28, 0x50, 0x10, 0x50d, 0x121, 0x939b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x9, 0x1, 0x20, 0xf8, [{{0x9, 0x4, 0x85, 0x75, 0x0, 0x2, 0x49, 0xd2, 0xc1}}]}}]}}, &(0x7f0000000400)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x110, 0x3, 0x3, 0xd, 0x8, 0xb9}, 0x31, &(0x7f00000001c0)={0x5, 0xf, 0x31, 0x3, [@ssp_cap={0xc, 0x10, 0xa, 0x40, 0x0, 0x9, 0xff0f, 0x9}, @ssp_cap={0xc, 0x10, 0xa, 0x4b, 0x0, 0x998, 0xf11, 0xf8}, @ss_container_id={0x14, 0x10, 0x4, 0xa, "a00c3947686ac35670be8708fb4eb5f3"}]}})
r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
write$FUSE_NOTIFY_POLL(r0, &(0x7f0000002300)={0x18, 0x5}, 0x18)
creat(0x0, 0x71)
sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000000201010100000000000000000200000004"], 0x44}}, 0x0)
r1 = socket$vsock_stream(0x28, 0x1, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0)
setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r1, 0x28, 0x0, &(0x7f0000001b80)=0x7ff, 0x8)
syz_open_procfs(0x0, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4)
sendmsg$netlink(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="05000000b507"], 0x1c}], 0x1}, 0x0)
mount(&(0x7f0000000100)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='udf\x00', 0x808000, 0x0)

47.62466513s ago: executing program 3 (id=249):
r0 = openat$sw_sync_info(0xffffff9c, &(0x7f0000000000), 0x40000, 0x0)
openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000200), 0x80b02, 0x0)
read$FUSE(r0, &(0x7f0000000040)={0x2020}, 0x2020) (fail_nth: 3)

46.995943869s ago: executing program 3 (id=252):
openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) (async)
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2901090, 0x0) (async)
mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2901090, 0x0)
chroot(&(0x7f0000000640)='./file0\x00')
socket$nl_rdma(0x10, 0x3, 0x14) (async)
r2 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="180000000914010010000000000000ef070001"], 0x18}}, 0x0)
mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0)
chdir(&(0x7f0000000280)='./file0\x00')
pivot_root(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0/../file0\x00')
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000500)='./bus\x00', &(0x7f0000000540)={0x286002, 0x108, 0x12}, 0x18)
openat(r4, &(0x7f0000000580)='./bus\x00', 0x440380, 0x4) (async)
openat(r4, &(0x7f0000000580)='./bus\x00', 0x440380, 0x4)
getsockopt$sock_int(r3, 0x1, 0x7, 0x0, &(0x7f0000000f40)) (async)
getsockopt$sock_int(r3, 0x1, 0x7, 0x0, &(0x7f0000000f40))
r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$IPVS_CMD_NEW_DEST(r3, &(0x7f00000004c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0xbc, r5, 0x4, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x401}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_DEST={0x60, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x6}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xc0b}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xff}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x10000}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote}]}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}]}, 0xbc}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000)
fstat(r1, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r6=>0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) (async)
mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]})
chdir(&(0x7f00000003c0)='./bus\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0)
setreuid(0x0, r6)
r7 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0)
syz_clone3(&(0x7f00000003c0)={0x385200080, 0x0, 0x0, 0x0, {0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, {r7}}, 0x58) (async)
syz_clone3(&(0x7f00000003c0)={0x385200080, 0x0, 0x0, 0x0, {0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, {r7}}, 0x58)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r7, 0xc0285700, &(0x7f0000000040)={0x5, "ed3ae2c7daf5b8f40cbe76a5b0e94ec458321e529b5879878c11aa2d354ef6d0"})
syz_clone(0x8008080, &(0x7f0000000080)="ba62340b481e2a8cde841e83290bc90246e0e2b67011e6e84d08011c1acbf0d63f324b7436a919dc6de8094cb18ad6ef116de871d9b4", 0x36, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)="dbbe9fa30ca40280cfa16a22692d4daed2abdd3f6cd2cd06ab447018982b4931e23b8c55af63ac774cc436efc1e1983498a77a6cab7887e10bfbb9e529e6535661c78f3236dfb85754863015cb") (async)
syz_clone(0x8008080, &(0x7f0000000080)="ba62340b481e2a8cde841e83290bc90246e0e2b67011e6e84d08011c1acbf0d63f324b7436a919dc6de8094cb18ad6ef116de871d9b4", 0x36, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)="dbbe9fa30ca40280cfa16a22692d4daed2abdd3f6cd2cd06ab447018982b4931e23b8c55af63ac774cc436efc1e1983498a77a6cab7887e10bfbb9e529e6535661c78f3236dfb85754863015cb")
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000)

46.462110027s ago: executing program 3 (id=254):
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='nilfs2\x00', 0x200808, 0x0)
r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x311580, 0x0)
statx(r0, &(0x7f0000000100)='./cgroup\x00', 0x100, 0x1, &(0x7f0000000140))

46.048047796s ago: executing program 3 (id=258):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0)
mmap(&(0x7f0000273000/0x3000)=nil, 0x3000, 0x300000b, 0x12, r0, 0x57092000)

45.386241497s ago: executing program 32 (id=258):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0)
mmap(&(0x7f0000273000/0x3000)=nil, 0x3000, 0x300000b, 0x12, r0, 0x57092000)

15.102771038s ago: executing program 0 (id=405):
r0 = socket$inet(0x2, 0x3, 0x8d)
setsockopt$inet_msfilter(r0, 0x0, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="8e"], 0x1) (async)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000000c0)={<r1=>0x0, @local, @local}, &(0x7f0000000140)=0xc) (async)
r2 = socket$inet6_udplite(0xa, 0x2, 0x88)
ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @multicast1}, 0x29, r1}) (async)
r3 = socket(0xf, 0x3, 0xffffffff) (async)
r4 = socket(0xa, 0x1, 0x0)
setsockopt$inet6_int(r4, 0x29, 0x0, &(0x7f0000000000)=0xfffffffe, 0x4) (async)
r5 = socket(0x10, 0x3, 0x0)
write(r5, &(0x7f0000000240)="aefc00001a0025f01d85bc04fef7681d020b49ff708800008003280008021d00ac0a1410bc71176a36ede498534108e58342fa94a235a2a441f9", 0xfcae)
ioctl(r4, 0x8916, &(0x7f0000000000)) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r4) (async)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r5)
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r3, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r6, 0x8, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}]]}, 0x24}, 0x1, 0x0, 0x0, 0x4000085}, 0x4008000) (async)
r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1)
ioctl$KVM_RUN(r7, 0xae80, 0x0) (async)
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r8)
socket(0x2b, 0x1, 0x1) (async)
listen(r8, 0x5)
setsockopt$inet6_tcp_int(r8, 0x6, 0x3, &(0x7f0000000080)=0x3, 0x4) (async)
ioctl(r4, 0x8936, &(0x7f0000000000)) (async)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xc6e20, 0x0) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r9=>0xffffffffffffffff}) (async)
r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r10, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) (async)
setsockopt$sock_int(r10, 0x1, 0x25, &(0x7f0000000300)=0x8, 0x4)
recvmmsg(r10, &(0x7f0000001840)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x900}, 0x1ff}], 0x1, 0x40002000, 0x0)
write$binfmt_misc(r10, &(0x7f0000000300), 0x6)
fstat(r9, &(0x7f0000000440))

14.855530772s ago: executing program 0 (id=407):
keyctl$read(0x3f, 0x0, 0x0, 0x0)
r0 = open$dir(&(0x7f0000000100)='./cgroup\x00', 0x40081, 0x0)
r1 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, r1)
pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x80)
keyctl$KEYCTL_WATCH_KEY(0x20, r1, r3, 0xd5)
r4 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x66, 0x0, 0x0, 0x0, 0x61, 0x57, 0x0, 0x34, 0x0, 0x0, 0x64, 0x35, 0x0, 0x39, 0x65]}, &(0x7f0000000180)={0x0, "de8d0d27ca969fa15f8b3b7bae39c1b3327d4332f8c149d2d65a347d67f6db7eb90dfdad3cdebaaf421412f812305c9da91699b5a02c1295596f0fd9ec78f2fd", 0x18}, 0x48, r1)
keyctl$KEYCTL_MOVE(0x1e, r4, r1, r2, 0x0)
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000280)={@id={0x2, 0x0, @b}, 0x40, r4, '\x00', @b})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
keyctl$search(0xa, 0x0, 0x0, 0x0, 0xfffffffffffffffc)
sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB="14070000000000000000005bcd30d9754ab4292bffffffffffffff7f0000d2a83513a772330202cb507373a300000000000a600000000647970400000000ff0000000200000034000480300001800e0001c16a77da16e31e8874650000001c000280100002800c00028008000180fffffffc0800014000000000090801ed7279763000000000090002de72797a32000000e21300000000000000000000000000000a00000000d1ba0475e447122f453d31da92da220b1085425ab47eae25bf856d7e65578f8f9d037ce342a3ca3d41d06589448f38120426165feda7a9ac7888aed82da3c2d7efeb8a13c3cc5e825fe76daf4b786f1405adc70dc2b54fcb30eac7682da27fb157b0e9c2e1a9b2f60569cab29ae8adc67ca08cd560101a9f67466f72720cfd299264fe123617ebd24284362275a8e9902a0e7e83be3368695262d114064a7f4acf39f9331598ea694380bab4422b750c4ce94387e85e45abd657b1ea0cf48f0950804385f675ce25963aa683f7b30e01542cbe1f2ca39d12ba55020494c2b77c087fda2207baf1fb8a09cef487efd7ac3b0317b2143dbac8e6ddb370ebb7611a4a83c68c85b41d31676dad0733135f9d95c66846857b8000000040dfb067ef1d9fd25897ea325a7eb403cc2d32b606b36cd28883b9e987a134785f000000000038000074ea9705e705f28c651e9000000000000000c9cb526a10a7836bd748b85074df144707a03eeb3fad3b97d80dcbf397c5563abacbb35405c1a5a2ec3221249cd8b68b2f615009f3f9454f49d9cf2ecf4fd7f8e95c5c4f093330d83eb684b2b9a03924898eff7af8a6d1d984d81c92beb7e6974ec279ad57abea6f39b186d15658792cfe8d11641964e04343e6366c8a46a72628b6585a16ee50b7ac29554a57f3d045703efb7bedf8aebbc5263db35354cd243c12afc8188577"], 0x88}}, 0x0)
mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='hfs\x00', 0x2208080, 0x0)

14.658158149s ago: executing program 0 (id=408):
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
r0 = semget(0x1, 0x4, 0x0)
semctl$IPC_INFO(r0, 0x4, 0x3, &(0x7f0000000000)=""/80)
semop(r0, &(0x7f0000000080)=[{0x6, 0x8, 0x1000}, {0x0, 0xc, 0x2800}, {0x2, 0x4, 0x800}, {0x0, 0x1000, 0x800}, {0x3, 0x7, 0x1000}], 0x5)
semctl$GETPID(r0, 0x4, 0xb, &(0x7f00000000c0)=""/177)
lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0})
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@broadcast, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0, <r3=>0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast1}}, &(0x7f0000000340)=0xe8)
r4 = getgid()
semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000380)={{0x2, 0xee00, r1, r3, r4, 0x100, 0xc}, 0x6, 0x7, 0x0, 0x0, 0x0, 0x0, 0x80}) (async)
semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000380)={{0x2, 0xee00, r1, r3, r4, 0x100, 0xc}, 0x6, 0x7, 0x0, 0x0, 0x0, 0x0, 0x80})
semget(0x3, 0x1, 0x40) (async)
r5 = semget(0x3, 0x1, 0x40)
semctl$SETALL(r5, 0x0, 0x11, &(0x7f0000000400)=[0x7, 0xfff8, 0x2f, 0x4, 0x7a6a, 0x7, 0x2, 0x74, 0x4])
r6 = syz_init_net_socket$ax25(0x3, 0x2, 0xcd)
setsockopt$sock_int(r6, 0x1, 0x2e, &(0x7f0000000440), 0x4)
newfstatat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500), 0x100) (async)
newfstatat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, <r7=>0x0}, 0x100)
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000480)=@md0, r7, &(0x7f0000000580)='./file0\x00') (async)
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000480)=@md0, r7, &(0x7f0000000580)='./file0\x00')
semctl$GETZCNT(0x0, 0x0, 0xf, &(0x7f00000005c0)) (async)
semctl$GETZCNT(0x0, 0x0, 0xf, &(0x7f00000005c0))
rename(&(0x7f0000000600)='./file1\x00', &(0x7f0000000640)='./file0\x00')
semctl$GETVAL(r0, 0x0, 0xc, &(0x7f0000000680)=""/84) (async)
semctl$GETVAL(r0, 0x0, 0xc, &(0x7f0000000680)=""/84)
semctl$SEM_STAT(r5, 0x2, 0x12, &(0x7f0000000700)=""/249)
mount$9p_virtio(&(0x7f0000000800), &(0x7f0000000840)='./file0\x00', &(0x7f0000000880), 0x10000, &(0x7f00000008c0)={'trans=virtio,', {[{@debug={'debug', 0x3d, 0x7}}], [{@fsname={'fsname', 0x3d, '/dev/md0\x00'}}, {@uid_eq={'uid', 0x3d, r7}}, {@euid_eq={'euid', 0x3d, r7}}, {@rootcontext={'rootcontext', 0x3d, 'root'}}]}}) (async)
mount$9p_virtio(&(0x7f0000000800), &(0x7f0000000840)='./file0\x00', &(0x7f0000000880), 0x10000, &(0x7f00000008c0)={'trans=virtio,', {[{@debug={'debug', 0x3d, 0x7}}], [{@fsname={'fsname', 0x3d, '/dev/md0\x00'}}, {@uid_eq={'uid', 0x3d, r7}}, {@euid_eq={'euid', 0x3d, r7}}, {@rootcontext={'rootcontext', 0x3d, 'root'}}]}})
newfstatat(0xffffffffffffff9c, &(0x7f0000000940)='./file1\x00', &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}, 0x4400)
semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000a00)={{0x1, r7, r4, r3, r8, 0x10c, 0xfe}, 0x6, 0x7891, 0x0, 0x0, 0x0, 0x0, 0xc07c})
openat$cuse(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0) (async)
r9 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
read$FUSE(0xffffffffffffffff, &(0x7f0000000ac0)={0x2020, 0x0, <r10=>0x0}, 0x2020)
write$FUSE_INIT(r9, &(0x7f0000002b00)={0x50, 0xfffffffffffffffe, r10, {0x7, 0x2b, 0x0, 0x18, 0x2, 0x5, 0x3, 0x6, 0x0, 0x0, 0x40, 0x9fea}}, 0x50)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000002b80)={{0x1, 0x1, 0x18, r9, {r7, r1}}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000002b80)={{0x1, 0x1, 0x18, <r11=>r9, {r7, r1}}, './file0\x00'})
openat2(r11, &(0x7f0000002bc0)='./file1\x00', &(0x7f0000002c00)={0x284880, 0x88, 0x8}, 0x18)
socket$inet6_sctp(0xa, 0x5, 0x84) (async)
r12 = socket$inet6_sctp(0xa, 0x5, 0x84)
ioctl$sock_inet6_SIOCSIFDSTADDR(r12, 0x8918, &(0x7f0000002c40)={@remote, 0x6b, r2})
semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000002c80)=[0x4b, 0x81, 0x1000, 0x0])

14.47939904s ago: executing program 0 (id=410):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0)
ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000002c0)=0x20)
mmap$fb(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000004, 0x11, r4, 0x6f000)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000005f00)={'wlan1\x00', <r5=>0x0})
sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r5, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}, 0x1, 0x0, 0x0, 0x4048020}, 0x28000)
sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xc4, r1, 0x8, 0x70bd2c, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x3, 0x6d}}}}, [@NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0x0, 0x2}, {}, {0x0, 0x4}, {0xfe, 0x3}, {0x29, 0x5}, {0x1, 0x6}, {0x7}, {0x5, 0x5}, {0x9, 0x4}, {0x0, 0x5}, {0x0, 0x2}, {0x5, 0x5}, {0x6, 0x3}, {0x5, 0x1}, {0x6, 0x3}, {0x0, 0x3}, {}, {0x7f}, {0xa}], "5deb2cc153f1d9ba"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0x9}, {0x3}, {0x4, 0x2}, {0x1, 0x2}, {0x5, 0x5}, {0x7, 0x5}, {0x8, 0x7}], "f348e8a384e2064e"}}, @NL80211_ATTR_QOS_MAP={0x20, 0xc7, {[{0x3, 0x6}, {0x4}, {0x2, 0x7}, {0x9, 0x2}, {0x2, 0x6}, {0x1, 0x6}, {0x80, 0x3}, {0x6, 0x4}, {0x27, 0x3}, {0xa, 0x7}], "8b83bc49394e4787"}}, @NL80211_ATTR_QOS_MAP={0x2a, 0xc7, {[{0x0, 0x4}, {0x8, 0x3}, {0xe}, {0x7, 0x3}, {0xf9, 0x4}, {0x80}, {0x7e, 0x1}, {0x40, 0x1}, {0x0, 0x6}, {0xff, 0x1}, {0x24, 0x7}, {0x7f, 0x6}, {0xa, 0x2}, {0x1, 0x3}, {0x2, 0x5}], "4024b30ab7060734"}}]}, 0xc4}}, 0x4040094)
r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000003c0), 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r6, 0xc058534f, &(0x7f0000000400)={{0x0, 0x1}, 0x0, 0xfffffffe})
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', <r7=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000580)={0x124, r1, 0x5, 0x0, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @void}}, [@mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "2a5a87427758e4a42ba4b1b685051a974e4a76127d344131"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d0b63b4264a30e3467129bf24063f73885079fef188b07e4"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "ea30642a9de6740849e78806146eef934c42e4b8077eba2b"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "eeec6ed03a8fec6eb807ecb0940d1da4043559d316b0fe31"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "96fb59a368169a7413013cd718a56aabcac3c6ee8ab29ee5"}, @NL80211_ATTR_MNTR_FLAGS={0x2c, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "61e54113961e85cb8eed29d06105df2324f917566ea63af7"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "4933a3b5e4d28e74b1ccc911b50a0cb48d332ba7225e7869"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}]]}, 0x124}, 0x1, 0x0, 0x0, 0x4048080}, 0x4000800)
mkdir(&(0x7f0000000540)='./file0\x00', 0x108)
mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='romfs\x00', 0x0, 0x0)

14.33378557s ago: executing program 0 (id=412):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) (async)
r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000100), 0x20000, 0x0)
sendfile(r1, r1, 0x0, 0x7ffff000) (async)
r2 = socket$vsock_stream(0x28, 0x1, 0x0) (async)
r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1)
bind$nfc_llcp(r3, &(0x7f0000000240)={0x27, 0x0, 0x1000000, 0x7, 0x0, 0x6, "750538d1ee602ec4802a04ea7cdcd151bb2cd9893bc31f80718336d9bd3517076db9ad1f6a120d8be6d7f81cd81ec275000386e7d95f0669b740a5418d69d0", 0x27}, 0x60) (async)
ioperm(0x0, 0x6, 0x34ff)
mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000004) (async)
syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) (async)
r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
bind$bt_l2cap(r4, &(0x7f0000000000)={0x1f, 0x80, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x52}}, 0xe) (async)
setsockopt$bt_BT_DEFER_SETUP(r4, 0x112, 0x7, 0x0, 0x5f) (async)
bind$nfc_llcp(r3, &(0x7f0000000340)={0x27, 0x0, 0x0, 0x7, 0x2, 0x6, "750538d1ee602ec4802a04ea7cdcd151bb2cd9893bc31f80718336d9bd3517076db9ad1f6a120d8be6d7f81cd81ec275000386e7d95f0669b740a5418d69d0", 0x3d}, 0x60) (async)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000140)={@mcast1}, &(0x7f0000000180)=0x14) (async)
r5 = socket$l2tp6(0xa, 0x2, 0x73)
recvfrom$l2tp6(r5, 0x0, 0x0, 0x141, 0x0, 0x0) (async)
connect$vsock_stream(r2, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) (async)
setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r2, 0x28, 0x1, &(0x7f0000000040)=0x8000000000000001, 0x8)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
r7 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
getsockopt$llc_int(r7, 0x10c, 0x0, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async)
sendmsg$NFT_BATCH(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000000000000000200000028000480240001800b00010072656a656374000014000280050002000300000008000140000000020900010073797a310000af49843dfb93d4a300000900020073797a3200000000140000001100010000000000000000000000000a"], 0x7c}}, 0x0)
ioctl$BLKFINISHZONE(r1, 0x40101288, &(0x7f0000000080)={0x4, 0xffffffff}) (async)
r8 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_int(r8, 0x0, 0x13, 0x0, 0x0) (async)
mmap(&(0x7f0000ff9000/0x7000)=nil, 0x7000, 0x3000001, 0x1012, r0, 0x32b46000) (async)
memfd_create(0x0, 0x5)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000300), 0x8042, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r0, 0x8008662c, &(0x7f0000000040))

14.032041694s ago: executing program 0 (id=414):
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x121300, 0x0) (async)
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x121300, 0x0)
mmap(&(0x7f0000b5e000/0x1000)=nil, 0x1000, 0x3000001, 0x20011, r0, 0xf648e000) (async)
mmap(&(0x7f0000b5e000/0x1000)=nil, 0x1000, 0x3000001, 0x20011, r0, 0xf648e000)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)=<r2=>0x0)
timer_settime(r2, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async)
timer_settime(r2, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
syz_open_dev$ttys(0xc, 0x2, 0x0) (async)
r3 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$TIOCMGET(r3, 0x5415, 0x0)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x200000a, 0x5d031, 0xffffffffffffffff, 0x0)
r4 = userfaultfd(0x801)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4})
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000})
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x9, 0x88}, 0x0) (async)
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x9, 0x88}, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ioctl$BLKRRPART(r0, 0x125f, 0x0)

13.611940259s ago: executing program 33 (id=414):
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x121300, 0x0) (async)
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x121300, 0x0)
mmap(&(0x7f0000b5e000/0x1000)=nil, 0x1000, 0x3000001, 0x20011, r0, 0xf648e000) (async)
mmap(&(0x7f0000b5e000/0x1000)=nil, 0x1000, 0x3000001, 0x20011, r0, 0xf648e000)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)=<r2=>0x0)
timer_settime(r2, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async)
timer_settime(r2, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
syz_open_dev$ttys(0xc, 0x2, 0x0) (async)
r3 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$TIOCMGET(r3, 0x5415, 0x0)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x200000a, 0x5d031, 0xffffffffffffffff, 0x0)
r4 = userfaultfd(0x801)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4})
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000})
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x9, 0x88}, 0x0) (async)
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x9, 0x88}, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ioctl$BLKRRPART(r0, 0x125f, 0x0)

7.272379358s ago: executing program 4 (id=433):
socket$inet_sctp(0x2, 0x5, 0x84)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb80393884d01a507, 0x4008032, 0xffffffffffffffff, 0x0)
madvise(&(0x7f00007c1000/0x2000)=nil, 0x2000, 0x15)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15)
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0)
r1 = socket$nl_sock_diag(0x10, 0x3, 0x4)
r2 = syz_clone(0x8004000, &(0x7f0000001180)="06a0188adef703d40289c6bc4788ed9cb78e2ed1f4ed81825ba05aa924295beecef8186556e931e7d16577b219a4ab12d2a78c785550a21ad201ca9cbfefe4fe4980e68743732118c1218dc4c48b82d00b8065870f0119165066dd04220e62ca0f71d9cb6aa8a3de902932afc8ca2754efb46ae6dce763cc3ca4f3b4ae7ae2a4bb3aa796fb04d7f5fb724d6c8fce1f4b8c23d414b769158a9e2ebbe5eb4f0a6cde4ff02b1a096eba688cad5edddbd97a5bb86c1dcccf230fcab639344eacc9dfb1db5269910395d04bf40668dc8f1be5389541bdd18e9d73f509d2836c81d03f365116e684b0fed3bdcd1d7fc457bde10cf5a956283b8976d2daa70439f1dc8a3a31a082b6c7da9c5a0e56c42d40c3746b5bdbb6010f48c442517a669a9e8c86973383c7e8df293b5e75137dd054ce9e2037ae3c555ef20738983a67cfb4fb151c37e6dc9aad97ae5d4036f8608cd22ccf2a5c1a575dbf39b08386d0b9c435d075d7340053e51191aebdb2481a3b49425945607c35f5efb6823f3434b187aec5d8c0096fb8eda7b6601661ed0ddf04a87c3fe0a7a343ddbf2db466e2734d4f65488669480184142c00a9f0ad0188537e60110793f48a04d3e7848d74bffb40f70b8f748abe76c3c2f1a52bd47f829d2c472993f1bfafe5b44b7aaacb9e0a087de9dcd8d75d0e56ad7feb3d2babdacbf3f139f02c573396607c31ce7f0e575a03b476313932b630363c7f9be8d0410102eeaac3478e52098a4423e9baf548aa2faa34e81a9a87e480fa89e6e64e08fde581e2610675dcf2f7ab645ec5019d35161e9a3dca184b94f81bf098048e4c29425fdafe232218947f7cfcfb80143d8ed8cce7b43a115a31c1c37640cd59a760ec5ea4a928edd4676c310967d6717629183b72aab76666ddc01bf9f14dd85c99816d64395fc05a0779b72ab220dcf1dd4d2962c7241bc55c9fe1ba782a6df61e5be6ad0d794a1a9a6492ddad12bb645363f039dd713c986894fd1933553fe64f2fac757551712142ff67e559da4f61275866eebf8ef697a5e02799e73a99bd5694a1bef18f417298f4db3bd0287bb646aa43e1650a35c5eeffec2990ac5be8d1b5bc2094fd0856c5faec75b4ea949920b3dd4013544b2322547f4a8bc64a102ee3c5ebf2baa837fbd98acd0c52681f47343698c8e5b773b0afc5c8e4221dbf7f420bc8f06505a1c266d3c3f4d2f56bd66474005cb4eafdb4ef8dd2c028c1d8b2fa34a79eb5495a1f73123dddda6be52df720e16b91081610c6e14486382b3f144a4feaae0015596e16595561c101d471b5b95341d40c580965baee2213acae1dad77857c1e81dafe0d23678a32eea3c693331bad605e5cab49224426c84e05a6aca850b612672b4eead4324de4dceeab27f0b5e52e3f18d7a215c8d266b9530aa398479663d2d456d2958d7b5a88e9239e1a0a07f213559e999dcbe8d2b0ce35a7bb4b755a943a99d683799e4fa79be0dd4431ab5273cb19b79f184a336c31c668dc7132d30430d86ecf2a1629d0528d18bf9dc34fc8fee47bc5c7f8b82d3313396e26c420194dd42ce19448f27977c233b83c01231c35d8fee66fabc514f76dc50e3748eb06f388f912778db5716b085c2e1dc2383d2edb1afdf9242be369cbafda81e8e06efb0ebb2a400a88d5605633e48cb4c64baa518a06f25af00d2b17d18fb77664eca1d78561b66f37513a87ea952cc08e78b29cc1846335e3da4f902438dc439b35c5c9dc52891b983e781de21f53071c7945ec69e4c5802641756f188c2a14a58846928fcdc8e9af5897a133065f6bb1282f73388c0eb8e951a6440a4c2883510daeba31774bdea436043125e098bdb2f2fdcf96efb6cede35f7cb8c53ba821c74b6cb819df8f29995938a2c569c00286aaa100007b664afe726e62ed6b12c05c261f2c0b696ef746e73de561ad331fae6084cc1567140a3db4b2c7f544d3a0979e22fc5749a59405f35ab4b05228c930f284807439e3ed7c59f4fcd4820d76a6f390865e7094b8c4a2a9e0147a267a0541eaad4840f63284754a261fbd4f2b9680d11244dfbc4505ce3908bd1ec6b6061a091655821de300f0334bb9233e10ae99726afff613ea1c90846b006a36e4cb2468cab21d9c147d853c26ccccd541d76e85b46bf468782fab22b286ccefe21fd91ab4d7df0db955e764419b9837eed8c273c96a01741a78c183a7825f988e1adb8f8dd769e142da9ddb1da7696ab24de40e8a3c83d9babcce11fbb4138e8c1354c58e0496f5faced9f372274edffd2fcc17ca68e8311ec980ac50139dda3405b61fb908b9e68a042a31a99a1902ec63480ded03af5c0e73ebb2871b0ff9faed5929acfddbecec571259d88bc37f591c3e89617325ac80f2a53b80f6a0c70a06953b4cd2ce0c279c05d630c280bc381ee284b8b68cc02dd9f0a885b9dfcf70eef400cf793f9c0d847caa89ec31ad87254e999a4dce5d7509c186063d8546b1e38c4b223a8238d210b94b72032ef84dc47c101b6eb2c6197a72e86a6f980949fc8c77362381a3694ad1183bbdfe332ebc3d4170c03ed272cd0e560d9457911f69f29e8c0fad5fb1bf61c3c72546995bea777954b66913653a5c6bfd02e7eb3256acaaacd694964dc203cfaace656dd7008c8db26a9331fb7438ed33e82df9f280170fa09b4466c6293dd15112abd2fb0ef159272dc6a439fa474c9fb325e4220c30317ce8609d4f5df0a477b2b331c1464a01337c8d0586459fc52f324bc5f603bd4e89ece9609af3611818ec0971132025b136a641b5430ec9eb47ee05906a9893ae9a2fda86fdd28cc89dca8d80670f11f068092ed39200df315aec14fade79b9cf1dd421bbd9df0ebe5a984b0bfda584029992df4b0d84ba995ffc39a8fd8fbf29586c54e54a8eb4a8f827bec3afcadd9ecc15dfd6a93783d9d55a84b44938c55396f2ee21d373005a1f30d2683fb8ec6d8e8223876c4233dcd4316c2b647043322b72428d90ea668338b9d829c290ec5116a13f0cb5e8f4c64667ae478db02b315591684c87d2d88a78dc100cc2b4f3e079a20f5eef87bcd553a0bb39edd69e7f20810f098ec7c554f3f91de832061aca7e00c22b4a0d7fec689b413f55260bd815da7277d4504911fc6e1248f5c22b87b7621df83a2bafb13bb6c63d76c94fdec9f09ccbc97d40738560e0e1f3a2a680b2498bd90ae99513d39dc4886db038beee33e61b2ab46aa7bd2e5b7e171cf31b323380b2ae8f0a8fa4fb5f451282e0c0e557aef6d7036afb6bd0b871c7d01467efd52c72bf4b374a62d7f72fb2a3db9d180ba1ed5b25d20dc606f80bd987d26f916550532b94f906879487845bcbf40ea810caf598258db5eff329a9ffe0805ea0de486c0803d2d0e2c0c312164f1812849844a84787012084449acd03cb019c018463eb198628e62ed06d3f76c5538ff016f1b11e515b840aaa4a0714654ff33599a47443db23b257dbe4504edeb0c79102970fed5dcd1aaacdf9284fd1a3ce32a90c6dec1d4d7cfa1a6804c91cc1cc12fbd8d42167fcf0d3d789b14c782266fc90a4c6c600c9d026bb4502fe33e4136912e6cb370b8e0cc696df95cea7c17c2b6b497c50ca8989e9f8f45171c46b7d082ba41ba60f97236bbe7c727548442777271ce205a0eea2d96171131a5b8ebe87ba6c2a554c13c514f0585e3ec49433a646df43fe3a573cf9daf1d6759346e043c3112a323a4353aed2a07539efce9da1876bd87a52beedb229ac2739af09d8cb05c382faccbcdaf8a18472dcf3edd428647efddfcb60d68b0908e405c91ea88effa6475e19e03826f148ace86332d212139e6e03523e2fb566c5ae7757a76b658827355eaa5e5c7c3ff5a6e12b3fc778d00f4cf8e2241372591586d86b13095f9ae59430c497b6490a273ac9ccfd3b7e225ac86bde4d50a18f016787eaf752e80baa239e8b65bdd94493871908fe52142b4e30c8a6f7e6a807c624cbda7fd7569de31dcc99ec75f7fc41fa13ad5c12ef1613de4755c0c2da31fbe34bb5171e1813f2e66f46147403ca4364c5b0ec30f813937713ea5ff762d978b61e777372779c520a0858e2046b555918f378be8913c475cfb93cb9f84efe27c3081aa0b3f5408e42dbd55e1ace6a9b63f74e06f9bde78882de22072fa2ffc14716b890f5efda41ca13b1d936ed8314e26bd828a01def42d1dc572077dcae85a468dc61eae2dd09368391082e22ef00b58f07b65849bde42f49318b412d4f521be5f94db46fbd8856d40a12a8681d161941ea07148dc3760f2a69aac696b6499e001d4ced426fe37919b75247faeb8615dcd7de2cfc9c7fee0ec23dcd89bd94e265c9d09f64ab3b3b8e95b192b4a13005f67f98a27062fbcf3b0a16d68060010b06e5796f1eb7fa45464456949a53e3386b6e2c13aecceab8e729164b2f58dd31a8a9c44553eedeca72a1e7268e327f476ddff3aeedb108b2d481e2cc0d6fa6cadd5ef5b6b4b7e02bcf405025b6cb709d0b4c4227eb023283e3ca88278c4f7da5cf85fc9eb42a11ddcee1f71c100b4e000baaec373cbf2e40046afec311ef599a75b2c86c733f19750c2faacf4a8d23bf84376a13724ea58399428eba47cf063a6488e0715e0d30eeec060c83e2b1b23f1fc3dd7618deab682244e09db171012be250829604340ad4290a91d1b7df5321f142ff5ef0e0dde6cb57d717bec08a0d7d843343a523d1de985d1eb9fd8f54761d9581497f73e8241db2b933fbca2808610978e84d65f73c93d2c06fe0b7aadad7f410e791797056238394f813abcb7b1352c1142f58e079345ce6ff8fc2dfe64a96fbd870921fa7616a889f3e44673b11ddb74a3cc0dec55cb107dac84f59ca782971d4dcc896277180133a57a2aebc52225a6a3bddf8a1da083e8bf1dfb44366abb6f4a2479125b82ed959f598b16c778f2d53d39ec93698e67f5a186af84d03244bec30e8fec2b1b627f9cd62502bda24eb5f63f0918168e76d4d24e3330d886b829e68e6901f00f325af73b3f8d8e7a0c9cd506aa8cf19fb7bce10c6537cf40b0090755705e73b59727e804d73bc0e632dd23c0a276177d375fa06cf86090523dc8cf189431b1013ae4bf94f9b3a7f6b49f106f7cabc2e205b215101d369f2782e06bbc37521964e9957162a45aae814e1635774e29a0d85db9fd3a9b1a842f17fbda09f36ff3b721a60ad24a535b02b365073bbddae4d230d4d306e4a5daaba8027ad389009df6387884ad95a50afe198809cc71ddc6bd824bd8e4aeb1a2a7e3609271696efdaf0535de4cf115ced2af11ae3810203c7af45579c64d01f4c6b2e1b14dc519dc88bb28cb9cf35c5ac08eaf0941114ce0311ebdeb53e0f5b781c4cc6619684754bf11ee99ca298f283850a36b87ab46f00f80f35aab1b3f483c3e7f68c8eaaad3a08ce9dad7a50d93fcc7773df8edc0206d628cd0ba3fcf7f37876a020e19db0b3f69dbdc90d09ea91f5953a8a32683f111c9790fdbb8ebb0e5cd162cfa25fecf11ece1c92523db5ca750e324ab6a79e3c38105126795c46fdd773d254256bbde1e49d8a506da72f2c863514d1727dcf4c5a3c17eff19ac2db4164a5c45befeb50f656f9075876bb6723a2cd9da46523dc9fc3784fe5a42244c0c929fa0d2d315000c0385959b60e6ceb925552179fcb3cb1efd310c4b55bf3e8f371bcf328737e503e73abf3aff1fcf3b56adbf3a1ae4ec0568adc1399adff1dddb7c93a38965e164c337163fa518dc27688a45a485e8d8a8d00b940e5ffae4a79bc7e59907c8dda51f4ce6", 0x1000, &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000002180)="b83a127bb9545b54383a962e6f895c763fd7ba8a86cce419dc83edfe62f5bdfd72cded7da90b27306a81143b290fc1a825624840e112a41793246cc0b44e684665bc82a31cd687179e87cdcdee2e5cf21c0cb15738940add2f7bea6909e9a355aaa1bb9bfec7b96d38157de9449e676bc53090326ae249d8dd2fa9625678b3c1a2e25326b9d9f181e1bbc27a80aeac26923852a5e9102d5fb7275e6e9a285809c47362410aeeca73ab72b90a3d21af208ffdca932f48906cb4d57128cf7c60a65872a49672d8aa165968b9d6ee1e6515abc7d2b62937c0d7101d65891542664399f979e6a8ee706946e72c3da7e6c7e14dfb3dbadaf3b3a134ed0d861dfca9dc31a9f556d3d806d682bd331fe69ae8b6aa6a1bc4c87e6d37dcf36362ca63e6b636cd87c4cc9718c54afa40d85242eb747e379a539711537cef7b70ad06539ee9e07605b4c78d5894271317c76cd08eb083a43cea6b07805ab82b70a7a5943befefe483ee4f26552a4a9107ba2449b9228d320cbeaa18a3c4ada1f15a7a143c108a1f8439d691663be9a7a8b93e0e6363a76ff87f21dfd8c092cd9d8b9fa38a08cee21c7651538a1022382c71d52fecc8e73cb1878460a9a891f54b5f111893a2e9f24f18ab572585325896f028e9288d5a6ebd01dc30d75f26bfd74a4c758a1b87e5f3ab90708afea10d54e98870858b90a68c19877ac1866a53ebb2d24346aeb0062192db53ef676c53eb3f926852681bc1e1102505603dbb86a56dde219a0885e5c0c98303995223e25c102304fec6a814a904576f207ea7aebe78ee92e80351a69f24993b973c54974c7c4114b298ce8811cd9a61952172cd3364ad2eb346eb951ff63ec65cb9954e59e030010a7bc7a96f0abb343f31ae379069afe2462bef7ab0b5c9d1480d46c2dd1b693bbc6272d35f664b7ba8f95f56675d08a755c92029131556a9f677475f9b8bbafc96a7157f3a540b5b30b98b0da2365b7885976aa2d8af4f3ecee1be0fdf8ffd788459d27925b9faf52f03b4dcbbed69dbabca70ad9577dacdb2b81be83a58f8f89c1d54d98bdcbcbdcf4125007cef11e1794afef2e8960751ee6df9235d28d38164d5ab7a9a51da6cc0a43cde7bbbbbf20eaadbbf5854e8cf1bbaa5755d938c443645cf589bea0143daaa6f886c7153894797bf21fa51f3c8d96765d3eb655eb67335ff8e6079174ddccc29611e6979ebf1e442c3dee4a6a03717dea6ec1aff96e55db10759e875acfe39adf8b1244317b841494f6d3ba1d4f9892cee10e2ac9b57c56289ce48c71d4d3889b76fe46e08259dd8788826f3a410cf0d771dd42d9657d86d5c147e1dd603aea2b806401ff6eb858b996e897b60867b4a92c7c77f149a12c9766083c8f2027b83af695aa33a890f7857b2fc4a613119aa5d95f9fccd3f533a682db756b38e4486b873dafb83016aff7050dc3046cdf27a5271511ffea96087af7a6cf7b0fa7f6344836e4166234dc8fb9246a800f1f2fcd3cea3a5e380681999c03485c02f42797dbfa909165fbd2bc3042c5a8b417bb8c472f4e2d815d83d4c3b82ccb44e43ba5086bda9a564243c20213ccd07b5491f15a1b0d1cc540ca523d404ea06def39e8313cb3b9a9e6b4371d1ddeb0eff211c0908d42841dd6055f253c5aac252a038ea67ff75959ea86b02ae68835f59a2cfd534b1f820a0f326e946228889c5829d40dccb03e1dd436e8d5253457a9098fcfc9837422971b22ffaa329beba9234b2dafc77a9c53f8a8d7a2b2a5510ff493d61cbd296609cfbe3d7bdfe77f35b906f12ba9da051965f7d4d7e83604c2ad6a321432dd6912a16ea3ac55b3860ff59001d88cccaa49513035f5fc9aac592b88e42d380e6c5c0f6c6eeb58d3bd803a6cfb7c0387e51aef016af109b0237784a2ab4d5b7a2a533b497b6a0c0e92acd677b34b383d65b2313ca26e343d3ba2248671779593f0e7a109ed772fba88dabf1279bd05ca3df772fcbfd77bcd406c08468fb179f0f71e06ec3de5bd220c6b86faa897a5b5e70d99c825043478d8429b7742450c6b5e8ca9d37cc7cc5b5602b8304ed3ead9cea05e3b705ceecc3bfa1a428895adc61e83f8e4ac775c70043b43d90ae21db4ffa6bbb019c3645feb744be23c3bda912008aa2145bc2f348a3498800ad4539dabbfe74746bfeb1a387c368088de7e834f82903bb91cc9c5a63facd8eaa626224c217b5af58c440bcbfdb4aebc8e507e164b75e8964e327bbad411568f79c77ba6fd5384d79eaffee6df2ad0364b1bc05bea4e8594366664e917bfe029d8ed03ba30f3325e893d007b71c48b9ed85d2817fbcaac24493daf3ce39858cea86bac0625b430c311d1afc9a7fa8c4f63e7640234891c88c32fc7c03483a0127a520b66f2f0b31c70ab65e624170331d7e5d34734817e9bdd210fcdcc8e408fae2fa6b1a0d07be580849cc6aa94a98a59e0f7af0f6aa078b09b8f3a2b33f283c549676005482001ba561d6ff65d04699824a1d2c5ac0ad5562e10750577da98bc2323eb1a9f6a4c2c34652a145185e355e3d5a7baf245eba8e863a690a60a8e558eac9123b97910ee41116eafcf7ca26e2a48c967446b0538282fb4ff38e25e83f8ecc20ee44d8b48e3838bbf77e7633ca32d7576bb8100a7862f349fd61c0be02510d9b1d2236d8c6c7b278671e2046cb646265baf96dea43cb3007101d6641ba4f771792c00a220e3d9f8686c8c8606b6d8080592231c1be59f2ff404f60852ebdc7ee145e40d9273533f54e72eed7df47c5ea23c6c2d288f4e02bc9bda4e7a054b85787133dcc00a6ca1e242ffc81532108e62babde3054b1d6785cd1e6690141eff220c2a87e48ddbfb4261b3a3fdc6308566f17615ceec5278e6e1059c1f4e1bbf6c9dd11f19def653107cba1f951771b094ee1c2208778a67d2549069ce3fb285f5f67292ca75246db0d33e903c1bad309a0865f06d6e454cb278ca5ec01319ff85176e3e6988039400e1751e291528f57c3029f9ba7d7db8144f82cbc6ca5eed6cbe0240ebc1ce9b6b206efa7a6374a379fd9b30274202bad46f5c882a9f0267a1b6a52312b008a0c51fce54b489bb42f751b24ed49caebe09ceec065d726dd56b8a69c1cc1adc6e4ad44b41142347b6cd76da1a73f75c6aff451107da81aebd41d48ae55a28facfd7483ab2aba22d375014a58d0a6f47404a4b01a823c1384642937dcfc4b504b562121c724df42653883e94edb7bc5e107ef2843df5f92d33762a1df6b124c2869ffa12dd71e2955040db29ae40199cc2e1510c683f3bd9228100d39cb6954e350c8bdeea4ac5dec1e0a66f233e59bf4f91a366f3e9a38bb278ba1a20468ace4b99b6d2528371e5dfab8fecc45c89fd191bdb7a21315cf03394d68c562e1fa79219aa22d8bf9c7219efa299bb295f685f4175aeb4792704986ce31e898138b0a27a4111cab2735869bc0ccbdd5b4274f7e9a76e425d915bca3734ed0b3268186e25f13218a97af7d490ec8b1157eb4f7c4466e02b6634fcf998e0e45686ef2ee2ecd1497dce10b80a5cd8b33f221d396bd1adac46579323965350b6c660e467afbcc6c1085f0bd93dd865af89b563d508ca581a6f6e2a6317a96c3c27510afbb307addff2227247cf6fe24736760f278f226a389cd2bd780dc184a7e9b8acbb7f05d119119a4fba3bdd4ef3d8e7d40cc4021ae27f0e69c4f0de1b3e53b11a54f1a1555754ba2a28e2a3fecfd90ca8f3b52c9f52f1a09f21526d7caef69352dd1d85d5eb0f48b31d8521a0f884cdb88779e6ba03f10862226800524564205dcd29327005ead016579ea0c2e37be7d675631b34afd1edcc62dd712a4b35555ed675e95eb597677696c7fa613e9788a0203cbda8ccf8e308685492932d76d31686ba9cb3515a9eead876f724111ba889a9f3424969741cc08859b0f20bd5ef3abdfe7b9ff250d012e61af8159f9b531f92716ea8cd1e8abcd134c842377b9481d22fdd05993e82a5d1208e8386b01ead75eaf818b5ba83d12f89a3fad7916f60cefec75d2ce43f0ff4c8226701a258fffcf5ca17894cd2d285fccf4b1ec88dec896ee61e9d306324cd4d2f62f8e6100f2ac3e435835d4de75daf0cb1e5810dcf2f83af4f6cc4d435ef722d971aef102015ce6e923e1a3b11d59e95f53dbf2a0bfd8405c5945eb6d734031e7f8573cdef9d5edc9963ef9e5bc8d058baf329f6b6121f29fd972343c3ac1e6d5dfe97bf4267e241538ff6f457aa2b9e76b76cb7203239d6d0717c95551257f73c5e46c64b65c8204b77da819373355a05ada244593c144464041bf7652a44667ccf57186432a7a5e9e24ff23bdd1d5fe520c1f37b7dc87290b176997291721153538f56d40e2696bd210f638faf6a1172da0daf4d9062cc419673cb3bdb8c62573a09aea8cc90ac73a3748762a64828e92d7296b0afb9cc8b2fd848bc106e627ec4d43c62e553c6f07dfb5ad63c66b96b9a59f11bb23271c437b5cf85b6cd9153f85b90255e41fde7ec4f824c33b0f6d580d38bdbaf2b9f87a3d869f55da2ed99de258336dfffaee834a2c88bd8022e4cc3368e12d14eb433ee2e19c74e7ccf2893ffd2fa6b4eae7cef37c27526198b0c5481fa9c5ffdc83c52d8aa01ecdbcc970b75253eaa28e3ead189eeb7cd22ba3c908ea483749838263647e0d93214084d819588c9cc5758e435e1e86a42ab6ea1a224b5feda1c066b8149c69903d77e9e8ca97213a82b713f99a47f01c724053eca3695dd9e9ad9f817bfea3c06969e228e82974930e2ac35c5a34453859c8e6e3d29446c9748309ec483876d7dae6dc874808229221e528999ba9529e0d8a099ea69561e92c259502f00912c06caea302bb8f776f6ba5b377ebb96ff1f5ab878e557cc5f2415af1acc2b5f77145617f877d9d388c1694328c486aaffe22cfdfc626c021c95c60e4c18a7d785c907651722d345b8e6c57437812c0567664b3ea4b991cef28e1a9e1b41c36db1e743a0a5eb74b2005ace8ff6569dfa7fa082c10a46358122b2afee8839985112cadb924fb05e6e31e251319c15c4a3b9b99adf0b67885baae8e644e01789b58478b0095d4951672de12b6f865275a170b4a25e25fb33c9b45d8f0be2ac2f099159ce50638590820b95bed641c299535d7160ac4bd4d2ebc36d7546a051bd187e97fc095dc5458d77044d3212eec6bf647add938e8a77fc0ff194bf1400332d269c022c0419414d6435398f8a6f82903096183dc44dcaf687d9c30be1ab49e7727b81b1e272940098ffc089429f438df5cf4d3f457b0e8a73329df473011d32bb6e549bc2c0aecef7606cb68c37738e03fc72730f6123ef07eb5889abfd40b1bc25079f270049b71d447bf27a5ac41fa162de1921797740613bfa5633cec08348229e2c9f2fd96c61126188232af2143914e92865863e713f7096851fba3f8be22678b3630b3a72b6e987633427e9fedb9df3bc6def33fdc72ba967c25efc879e4c713959ab206273dd4169dd6c9ad6c6b4140af0e22a13f6a3dde50c99b372857189ae3dd15d9ca81ab6697c824a176b1a069dbb727b3467931aa8c35ca55fb33bf96c10280c9ba42b62d448b88f34f44aa130f63abf1edbff1f21973a49ce96d7344acc46e504277a7608c194ff9d7d0ef9ffef1bc6f097e1206f5dd616b0fba42d05b3c60d37bc9185278e2d963723940eee862c26bd61c9b9bce59cd8af94ded6b29eb8689ae5c2368ff857843fd106ed70848ecc98eb32e396ce95aa4b34078ad690fb4d0011da7f131aca79b07565208a9ef")
timer_create(0x7, &(0x7f0000000200)={0x0, 0x31, 0x4, @tid=r2}, &(0x7f0000000240))
r3 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4)
r4 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa004}, 0x4)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'wg0\x00', <r5=>0x0})
sendto$packet(r3, &(0x7f0000000180)="0b03feffe2ff021202004788aa96a13bb1000011000088ca1a00", 0x1fffc, 0x0, &(0x7f0000000140)={0x11, 0x0, r5}, 0x14)
sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x54, 0x12, 0x1, 0x4, 0x0, {0x1d, 0x0, 0x0, 0x0, {0x0, 0x4e23, [0x0, 0xffffffff, 0x7ff], [0x0, 0xffffffff, 0x0, 0x9], 0x0, [0x1, 0x3]}}, [@INET_DIAG_REQ_BYTECODE={0x8, 0x3, "06010000"}]}, 0x54}, 0x1, 0x0, 0x0, 0x49850}, 0x20004010)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
prlimit64(0x0, 0x8, &(0x7f0000000140)={0x6, 0x8b}, 0x0)
setuid(0xee00)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_DESTROY(r6, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x3, 0x6, 0x3, 0x0, 0x0, {0xa, 0x0, 0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x11}, 0x80)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000)

5.843698638s ago: executing program 4 (id=437):
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x18, 0x1411, 0x1, 0x70bd2d, 0x0, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x13}]}, 0x18}, 0x1, 0x0, 0x0, 0x40880}, 0x24040800)
syz_usb_connect(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100153a42908f00a71729188110203010902240001060000000904020002ff"], 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
ioctl$sock_bt_bnep_BNEPCONNADD(r2, 0x400442c8, &(0x7f0000000280)=ANY=[@ANYRES32=r1, @ANYBLOB="000000000000de94adbabfa036cda1868cf62eb8bd5a035ad4629a80dd57676ed70b3343433e73d48e55dfe6b8ad7acf91096828ea0725e8f5145858d9101babf41cd5fd8eb64c3bae74343e8fa9a2157abd56c30d67b657124e359c2c7f104dde8331ef0336df0334abfb64dbcb699e5545db7305d78187cc76ca1f0bad71ebf090b0a0ccc56710e49f8095b8eeeb5b8c8de2497b94019bc6b50800eb9c6cd8717156ca0bc27f6d912ae18d26ebf20300000000000000d64220699aa2e8ed3162ef5b0d7cc298858f00"/224])
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x35}, {0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = accept4$rose(0xffffffffffffffff, &(0x7f0000000040)=@short={0xb, @remote, @default, 0x1, @default}, &(0x7f0000000100)=0x1c, 0x80000)
accept4$rose(r3, 0x0, &(0x7f0000000180), 0x0)
r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0)
r5 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt(r5, 0x84, 0x82, &(0x7f0000000280)="1a00000002000000", 0x8)
r6 = userfaultfd(0x80001)
sched_rr_get_interval(0x0, &(0x7f0000000000))
r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000009, 0x13, r7, 0x0)
readv(r6, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="043406aa"], 0x9)
mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1)
mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='huge=always,mode=000'])
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r4, 0x2000)

4.923904175s ago: executing program 2 (id=440):
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$NL80211_CMD_ABORT_SCAN(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x20, r0, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x9, 0x35}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x2400c0c5}, 0x8004) (async)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async)
r1 = syz_open_dev$vcsu(&(0x7f0000000340), 0x6, 0x101000) (async)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f00000003c0), 0xffffffffffffffff)
r3 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', <r4=>0x0})
connect$can_j1939(r3, &(0x7f0000000140)={0x1d, r4, 0x0, {0x2, 0xff, 0x4}, 0x2}, 0x18)
sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, r2, 0x400, 0x70bd28, 0x25dfdbff, {}, [@GTPA_FLOW={0x6, 0x6, 0x1}, @GTPA_LINK={0x8, 0x1, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008440) (async)
r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL802154_CMD_SET_LBT_MODE(r6, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, 0x0, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x2000c004) (async)
r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x7, &(0x7f0000000000)=[{0xb83, 0xad, 0x7d}, {0x1000, 0x2, 0x0, 0x5}, {0xad3, 0x7, 0x81, 0x1000}, {0x5, 0x4, 0x1}, {0x1, 0x9, 0x0, 0x5}, {0x2ab, 0x80, 0xb2, 0x7}, {0x2, 0xa, 0x4, 0x2}]})
ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) (async)
sendfile(r7, r5, 0x0, 0xeffffffc)

4.824616526s ago: executing program 2 (id=441):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x4c, 0x0, 0x2, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@CTA_EXPECT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x14, 0x4, @remote}}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2000c004}, 0x40)
r1 = syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000000)={0x2, @pix={0x0, 0x0, 0x59455247}})
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
ioprio_set$pid(0x1, 0x0, 0x0)
r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0)
pipe(&(0x7f0000000080)={<r3=>0xffffffffffffffff})
close(0x4)
pipe(&(0x7f0000000000)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="74000000000101040000000000000000020000002400018014000180080001000000000008000200ac14143d0c0002800500010000000000240002800c00028005000100000000001400018008000100e0000002f95fcc246fa79e90080007400000000010000680080002"], 0x74}}, 0x0)
sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000003e0007010000000000000000017c00000400fc800c00018006000600655800000800028004"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc010)
tee(r3, r4, 0x8f5, 0x100000000000000)
write(0xffffffffffffffff, 0x0, 0x0)
sendfile(r2, r2, 0x0, 0x7ffff000)

3.966792285s ago: executing program 4 (id=444):
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0)
write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast2}}}, 0x48)
set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5)
r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd})
mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r1, 0x100000000)
r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
ioctl$sock_netrom_SIOCDELRT(r2, 0x541b, &(0x7f0000000080)={0x1, @bcast, @bpq0, 0x2, 'syz1\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x5, 0x7, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]})
r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0)
syz_usb_connect(0x3, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002a69bbc104f959941760f010203010902240001040000000904330202020c07"], 0x0)
r4 = socket$kcm(0x10, 0x2, 0x0)
r5 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_STATUS(r5, 0x84, 0xe, &(0x7f0000000080)={0x0, 0xf, 0x5, 0xc2ed, 0xfff9, 0x9, 0x7, 0xf51d, {0x0, @in6={{0xa, 0x4e20, 0x5, @empty, 0x9}}, 0x83, 0x8001, 0x2890, 0x2, 0xda5}}, &(0x7f0000000140)=0xb0)
sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e00000011008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e00280010000000028000001294", 0x2e}], 0x1}, 0x0)
r6 = socket$inet_sctp(0x2, 0x5, 0x84)
setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f00000000c0)={0x84, @multicast2, 0x15, 0x3, 'fo\x00', 0x30, 0x4, 0x66}, 0x2c)
setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000000280)={{0x84, @empty, 0x4e20, 0x3, 'lblc\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e26, 0x10000, 0xc24, 0x9, 0x8}}, 0x44)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r3, 0x5708e000)
openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) (async)
write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast2}}}, 0x48) (async)
set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) (async)
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async)
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd}) (async)
mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r1, 0x100000000) (async)
syz_init_net_socket$netrom(0x6, 0x5, 0x0) (async)
ioctl$sock_netrom_SIOCDELRT(r2, 0x541b, &(0x7f0000000080)={0x1, @bcast, @bpq0, 0x2, 'syz1\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x5, 0x7, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) (async)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) (async)
syz_usb_connect(0x3, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002a69bbc104f959941760f010203010902240001040000000904330202020c07"], 0x0) (async)
socket$kcm(0x10, 0x2, 0x0) (async)
socket$inet6_sctp(0xa, 0x5, 0x84) (async)
getsockopt$inet_sctp6_SCTP_STATUS(r5, 0x84, 0xe, &(0x7f0000000080)={0x0, 0xf, 0x5, 0xc2ed, 0xfff9, 0x9, 0x7, 0xf51d, {0x0, @in6={{0xa, 0x4e20, 0x5, @empty, 0x9}}, 0x83, 0x8001, 0x2890, 0x2, 0xda5}}, &(0x7f0000000140)=0xb0) (async)
sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e00000011008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e00280010000000028000001294", 0x2e}], 0x1}, 0x0) (async)
socket$inet_sctp(0x2, 0x5, 0x84) (async)
setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f00000000c0)={0x84, @multicast2, 0x15, 0x3, 'fo\x00', 0x30, 0x4, 0x66}, 0x2c) (async)
setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000000280)={{0x84, @empty, 0x4e20, 0x3, 'lblc\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e26, 0x10000, 0xc24, 0x9, 0x8}}, 0x44) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r3, 0x5708e000) (async)

3.64666279s ago: executing program 1 (id=445):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40002, 0x0)
ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0xe)
creat(&(0x7f0000001380)='./file0\x00', 0x0)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ntfs3\x00', 0x8000, 0x0)

3.565666782s ago: executing program 5 (id=415):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0x6c3ca000)
openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
mlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000f6ce20000000060a09040000000000000000020000000900010073797a3000000000140000001100010000000000000000000000000ac5c1b444d1a551c387b184ffac9747650b37eeed5d46fe036dca2c9411c509c353f3f4d51a7cf813e10528a92bc57db06a3e37e0464ffd28ea07414773a803b74cec6665d97ddd0d639de1a3508578e04b5657fc1b984257dc1edd258fad1de3ecddeb956b4826ec9c39902900aeee15bb870dee49f71265f386d5f9836a13c2931625cf50138d3894835e478e494082811521c77e79277f7ba4ee465be9d689be0c939f425e5f51c7745d7ce36bd0627bcdf77a7129"], 0x48}}, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
mmap(&(0x7f00004d9000/0x2000)=nil, 0x2000, 0x3000000, 0x4000010, 0xffffffffffffffff, 0xfffff000)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="280000030900020073797a32f63a00e1f3952e000800"/40], 0x28}}, 0x800)

3.491928139s ago: executing program 2 (id=446):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
recvfrom(r0, 0x0, 0x0, 0x40012142, 0x0, 0x0)
mount(&(0x7f0000000080)=@sg0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='tracefs\x00', 0x20040c, 0x0)

3.359651256s ago: executing program 1 (id=447):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
ioprio_set$pid(0x1, 0x0, 0x0)
landlock_create_ruleset(0x0, 0x0, 0x0)
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0)
sendfile(r0, r0, 0x0, 0x7ffff000)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async)
ioprio_set$pid(0x1, 0x0, 0x0) (async)
landlock_create_ruleset(0x0, 0x0, 0x0) (async)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async)
sendfile(r0, r0, 0x0, 0x7ffff000) (async)

3.061703308s ago: executing program 2 (id=448):
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000240))
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r5 = dup3(r4, r3, 0x80000)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000680)="eadf13a2a6f3f9fb1c236b514c7edf136e9d8728a5201822fa06acbeedc23bb02ff774631d8e1e1951e261ec7957f3b89e9cf8a65a88060bb261f0b964d3531f5cf8936b8bedd81b5966231039d5f722"})
fcntl$lock(r1, 0x7, &(0x7f0000000000)={0x0, 0x3, 0x1b9, 0x7fffffff})
close_range(r4, r3, 0x0)
r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x481, 0x0)
ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r6, 0x80083314, 0x0)
fcntl$lock(r5, 0x7, &(0x7f0000000200)={0x0, 0x0, 0xfffffffffffffffd, 0x1fd})
sendmsg$NL80211_CMD_RADAR_DETECT(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="00001fff", @ANYRES16=r0, @ANYBLOB="10002bbd7000fb0100255e0000000c009900000000006900000008002601070200003508009f000300ef250000050039010f0000000800270001000000050019010c00000008002700020000000800a000aa"], 0x58}, 0x1, 0x0, 0x0, 0x4004000}, 0x20000001)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x101802, 0x0)
r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x78701, 0x0)
ioctl$SNDCTL_SEQ_SYNC(r7, 0x5101)
r8 = socket$inet_udplite(0x2, 0x2, 0x88)
openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff)
r9 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0)
ioctl$sock_netdev_private(r8, 0x89fa, &(0x7f0000000280)="6dec9a758e648b1ed12a6f04570afbc500c020a37ea7c470dc75d9165b3eec5c06afbe8c69cafb787fe9bfb25c579684e62b1af1c4dd83ded0a77132fd9c58f00da9b8fc2eb3e3ce00911c5c5ee6e6a600cb09cbb3d1ea6d7dbac1af10c392c4d5a9fd69")
fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
r10 = fsmount(r9, 0x0, 0x0)
openat$cgroup_pressure(r10, &(0x7f0000000040)='cpu.pressure\x00', 0x2, 0x0)
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040))
close_range(r11, 0xffffffffffffffff, 0x0)
write$binfmt_script(r10, &(0x7f0000000580)={'#! ', './file0', [{}, {0x20, '|'}, {}, {0x20, 'nl80211\x00'}, {0x20, ']]#^:'}, {0x20, 'cgroup.kill\x00'}, {0x20, ':](:#()[z'}, {0x20, 'cgroup.kill\x00'}, {0x20, 'cpu.pressure\x00'}], 0xa, "37bbdcae25debf24bcbe94b84bcb46f7b852592048a03aca4bde892be14face6782440bd1d45f2f89f0bf89df43f722cc169997cb6c964de335fdb86f75351947c40fa997edf37a35771c0452bc5f658b0cec5d536e5f98b5f69ba7ea7667da8dd7192252d328e4e85b2a45c6b841380a4d0447c2415812add4b4906d8bcea8d606fa3c7ae4c8447b238a367c70553ae1dff667ee55bc00d33"}, 0xe9)

2.844016173s ago: executing program 1 (id=449):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x9c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x74, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x3c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_XOR={0x4}, @NFTA_BITWISE_MASK={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x8, 0x1, "6eee7e00"}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x110}}, 0x0)
mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='squashfs\x00', 0x200002, 0x0)

2.661999393s ago: executing program 1 (id=450):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x448281, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x40010, r0, 0x93774000)

2.512323294s ago: executing program 4 (id=451):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0)
r1 = socket$alg(0x26, 0x5, 0x0)
r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)={0x114, 0x1f, 0x1, 0x0, 0x80000, "", [@nested={0x102, 0x0, 0x0, 0x1, [@typed={0x14, 0xd5, 0x0, 0x0, @ipv6=@loopback}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@dev={0xfe, 0x80, '\x00', 0x2}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b504681000000000000009ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817"]}]}, 0x114}], 0x1, 0x0, 0x0, 0x20000004}, 0x140000c4)
r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
sendmsg$NL80211_CMD_REGISTER_BEACONS(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x28, r4, 0x7, 0x0, 0x25dfdbfd, {{0x8}, {@void, @val={0x8}, @val={0xc, 0x99, {0x4, 0x2}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x0)
bind$alg(r1, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(ecb-aes-aesni)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000040)="11da3cf44b1a8c3d8a39ccbd630e8ef9170ccf07ef1800322de53ae3b183ee66", 0x20)
r5 = accept4(r1, 0x0, 0x0, 0x80000)
recvmsg$can_j1939(r5, &(0x7f0000004180)={0x0, 0x0, &(0x7f0000004040)=[{&(0x7f0000003bc0)=""/128, 0x80}], 0x1}, 0x10000)
sendmmsg$alg(r5, &(0x7f00000005c0)=[{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)="10", 0x1}], 0x1, &(0x7f0000000240)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4}], 0x1, 0x4000000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf411119ed8bebbb9, 0x20011, r0, 0x52fbf000)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
r6 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
connect$netrom(r6, &(0x7f0000000300)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETCHAIN(r7, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x14884}, 0x240040d0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$GTP_CMD_NEWPDP(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000001200000000000000047770100", @ANYRES32=0x0, @ANYBLOB="0800020001000000"], 0x24}}, 0x0)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)

2.368221663s ago: executing program 2 (id=452):
mount$9p_fd(0x0, 0x0, 0x0, 0x80, &(0x7f00000000c0)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@afid={'afid', 0x3d, 0x9}}]}})
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$GIO_UNISCRNMAP(r0, 0x4b47, &(0x7f00000000c0)=""/110)

2.361907985s ago: executing program 1 (id=453):
mount(&(0x7f0000000000)=@sr0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='msdos\x00', 0x22, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000140)={{{@in6=@ipv4={""/10, ""/2, @empty}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r0=>0x0}}, {{@in=@private}, 0x0, @in=@initdev}}, &(0x7f0000000240)=0xe8)
r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r2, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6)
setsockopt$bt_BT_SNDMTU(r2, 0x112, 0xc, 0x0, 0x4c)
poll(&(0x7f0000000100)=[{r1}], 0x1, 0x9d)
ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f0000000640))
r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0)
capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000280))
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
r4 = syz_open_dev$sg(&(0x7f00000003c0), 0x7, 0x100401)
ioctl$SCSI_IOCTL_PROBE_HOST(r4, 0x5385, &(0x7f0000000580)={0x4d, ""/77})
munmap(&(0x7f0000002000/0x1000)=nil, 0x1000)
getrandom(&(0x7f0000000440)=""/286, 0x11e, 0x0)
r5 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00')
r6 = openat$binfmt(0xffffffffffffff9c, r5, 0x42, 0x1ff)
close(r6)
execveat$binfmt(0xffffffffffffff9c, r5, 0x0, &(0x7f0000000880)={[], 0xf000}, 0x0)
r7 = socket$xdp(0x2c, 0x3, 0x0)
r8 = socket$inet6(0xa, 0x3, 0x5)
setsockopt$inet6_int(r8, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4)
sendmmsg(r8, &(0x7f0000000200)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x0, @remote}, 0x80, 0x0}, 0x5b4}], 0x1, 0x0)
syz_usb_connect$cdc_ecm(0x0, 0x63, &(0x7f0000000200)=ANY=[@ANYBLOB="12010002020000102505a1a4400000000101090251000101010000090400000302020000052406000005240000000d240f01000000000100000000052401"], 0x0)
ioctl$sock_SIOCOUTQ(r8, 0x5411, &(0x7f0000000340))
bind$xdp(r7, 0x0, 0x0)
ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000180)={0x4})
newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, <r9=>0x0}, 0x6000)
setresuid(0xee01, r9, r9)
mount$overlay(0x0, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000680)={[{@index_off}, {@verity_on}, {@metacopy_off}, {@workdir={'workdir', 0x3d, './cgroup'}}, {@index_on}], [{@euid_gt={'euid>', r0}}, {@fowner_lt={'fowner<', r9}}, {@fsname={'fsname', 0x3d, '^'}}, {@smackfsroot={'smackfsroot', 0x3d, 'n>\r\xad\x04\xa7xm\xb7\x14\xfd\x12'}}]})

2.243720203s ago: executing program 5 (id=454):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$sock_int(r0, 0x1, 0x3e, 0x0, 0x0)
pread64(r0, &(0x7f0000000000), 0x0, 0x1)
ioprio_set$pid(0x1, 0x0, 0x0)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async)
r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0)
sendfile(r1, r1, 0x0, 0x7ffff000)

2.168016986s ago: executing program 2 (id=455):
r0 = syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x441002)
r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x210100, 0x0)
r2 = add_key(&(0x7f00000001c0)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0x1, 0xfffffffffffffffe)
keyctl$revoke(0x3, r2)
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd, 0x0, <r3=>0x0})
mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x100000000)
ioctl$SIOCAX25ADDFWD(0xffffffffffffffff, 0x89ea, 0x0)
r4 = syz_open_dev$cec(&(0x7f0000000040), 0x0, 0x0)
r5 = socket$kcm(0x10, 0x2, 0x4)
socket$kcm(0x2, 0x3, 0x2)
sendmsg$kcm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001540)=[{&(0x7f00000000c0)="48000000140081fb7059ae08060c040002ff0f03f1cd823010a7ce9000000000000ec000006fabca3b4e7d06a6bd7c00000000030000068a562ad6e74703c48f93bc2a0200000046", 0x48}], 0x1}, 0x4000000)
ioctl$CEC_ADAP_S_LOG_ADDRS(r4, 0xc05c6104, &(0x7f00000000c0)={"ffc5ccdf", 0x4, 0x6, 0x3, 0x2a2b, 0x0, "186074c00ba7b194ad89da7900", "00000100", "03000500", "b0940700", ["c720f8fffffffff8619e3500", "00000000000000ac00830800", "067100", "00113a071fa0fcd9c500"]})
ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r3})
getpid()
mkdir(&(0x7f0000000680)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x51)
r6 = socket(0xa, 0x3, 0x3a)
timer_create(0x0, &(0x7f0000000080)={0x0, 0x11}, &(0x7f0000000000))
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r7 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000100))
ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5})
ioctl$UFFDIO_CONTINUE(r7, 0xc020aa08, &(0x7f00000000c0)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
ioctl$SIOCSIFMTU(r6, 0x89e1, 0x0)
munmap(&(0x7f0000001000/0x3000)=nil, 0x3000)
r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x109000, 0x90)
getdents64(r8, &(0x7f0000000f80)=""/4096, 0xfffffffffffffe0c)
syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000400)=@fd={0xffff, 0x5, 0x4, 0x70000, 0x800, {}, {0x5, 0x0, 0xb4, 0xfd, 0x8, 0xff, '-:~;'}, 0x7fff, 0x4, {}, 0xec6, 0x0, r1})
socket$inet_udplite(0x2, 0x2, 0x88)

1.392535334s ago: executing program 4 (id=456):
r0 = socket$pppoe(0x18, 0x1, 0x0)
ioctl$PPPOEIOCSFWD(r0, 0x4008b100, 0x0)
creat(&(0x7f0000001380)='./file0\x00', 0x0)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ntfs3\x00', 0x8000, 0x0)

1.197052058s ago: executing program 5 (id=457):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x200000, 0x0)
r1 = socket$inet(0xa, 0x8080b, 0x89)
connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
listen(r1, 0x8)
r2 = accept4(r1, 0x0, 0x0, 0x0)
rename(&(0x7f0000000100)='./file0\x00', &(0x7f0000000240)='./file1\x00')
unshare(0x22020400)
r3 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000180)={'bond_slave_1\x00', &(0x7f0000000080)=@ethtool_ringparam={0x1}})
sendto$inet(r2, &(0x7f00000000c0)="cc", 0x1, 0x0, 0x0, 0x0) (async)
sendto$inet(r2, &(0x7f00000000c0)="cc", 0x1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000000)={0x2, 0x0, 0x2, 0x4}, 0x10)
socket$packet(0x11, 0x2, 0x300)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000005c0)=ANY=[@ANYRES32=0x0, @ANYRES32], 0xfc}}, 0x24040001) (async)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000005c0)=ANY=[@ANYRES32=0x0, @ANYRES32], 0xfc}}, 0x24040001)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, 0x0, 0x300)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x10) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x10)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='cpuacct.usage_sys\x00', 0x275a, 0x0) (async)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='cpuacct.usage_sys\x00', 0x275a, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0)
mkdir(&(0x7f0000000080)='./bus\x00', 0x84)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f00000004c0)={[{@lowerdir={'lowerdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file1'}}], [{@appraise_type}]})
chdir(0x0) (async)
chdir(0x0)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) (async)
r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
write$binfmt_script(r5, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r5, 0x0)
sendmsg$key(r4, 0x0, 0x240448c1)
ioctl$FS_IOC_SETFLAGS(r5, 0xc0189436, 0x0) (async)
ioctl$FS_IOC_SETFLAGS(r5, 0xc0189436, 0x0)
sendto$inet6(r2, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) (async)
sendto$inet6(r2, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000005c0)={0x0, 0x2, 0x7a}, 0x8)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, 0x0, 0x0) (async)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)

764.009537ms ago: executing program 4 (id=458):
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newsa={0x13c, 0x10, 0x413, 0x3, 0x25dfdbfb, {{@in=@multicast2, @in6=@private1, 0x0, 0x0, 0x4e24, 0x0, 0xa, 0x0, 0x20, 0x0, 0x0, 0xee00}, {@in=@dev={0xac, 0x14, 0x14, 0x10}, 0x10, 0x32}, @in=@dev, {0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x20000000008}, {0x0, 0x8, 0xcc}, {0xf6}, 0x0, 0x0, 0xa, 0x1, 0x1}, [@algo_aead={0x4c, 0x12, {{'aegis128l\x00'}, 0x0, 0x40}}]}, 0x13c}}, 0x4000)
r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000280)={0x10007, 0x2, 0x0, "8eb8a828e53b07f1dd00d87a41bfeae7800400b159fb933948000026098d68d9"})
syz_usb_connect(0x0, 0x5f, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, 0x0, 0x8, 0x70bd28, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000)
mkdir(&(0x7f0000000180)='./file0\x00', 0x0)
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
r2 = open$dir(&(0x7f00000002c0)='./file0/file0/..\x00', 0x40000, 0xd8)
setresuid(0x0, 0x0, 0x0)
mkdirat(r2, &(0x7f0000000340)='./file0/file0\x00', 0x0)
rmdir(&(0x7f00000000c0)='./file0/file0/..\x00')
r3 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00', <r4=>0x0})
bind$can_j1939(r3, &(0x7f0000000380)={0x1d, r4, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18)
sendmmsg$sock(r3, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="1f", 0x206c}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0)
r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x64342, 0x0)
sendfile(r5, r5, 0x0, 0x7ffff000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, 0xffffffffffffffff, 0x2000)

759.37199ms ago: executing program 5 (id=459):
r0 = socket$nl_route(0x10, 0x3, 0x0)
poll(&(0x7f0000001e40)=[{r0, 0x7183}, {r0, 0x1008}], 0x2, 0xfffffffc)
r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0)
mmap(&(0x7f000078a000/0x11000)=nil, 0x11000, 0x5a051feb1f984a15, 0x50, r1, 0x7dfff000)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = getpid()
sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000044000701fcffffff00000000017c000008000200", @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000)
writev(r2, &(0x7f0000002240)=[{&(0x7f0000000080)="8d0734d878f27e827cb94acca8d360ce4c24f7b44390bda812d00abd85803ec1c15f8ec925a81cdafbe498689ff0fef2ba70fc575badc12989e8bf548b170d65728f176ca5452d389294491771ff34cba3b444d959c26ab40dd616130553dda8af7970dd001f05d80766bd3549711afd8aa240fb0844239aef6a0331bd", 0x7d}, {&(0x7f0000000100)="fcf812e7c25d73123b355429829cd05049fcae1ed75b3ce23cf152c60da3dd6954062af188df2a98e21dd56b6502060eff66e0789ae678c79fbc63919d5c060e4e53b0d9d24b3cbb8472c81d46fae5485b1a17332d65d747550d996a7e2ea89b308761cebfa20f871276fa5b502a39b71092d37a6bbc8f93c2eb2a524221ef3a7288510fa74f8249cf65015f1815f591a399fa974363939fa704772411b1a9d69b37d48d3c7366156b6c333420e92cf0414ae6acd9d0ca545b29de0e64a61a0d5efe99e753883fb001e2c20965fe6d37ef5312a711f66e0df3da5a2d0c6ca7bd3fb498375b44eeeb216bb58a86f8f6d28fcc9381ff6eeac39b947a16d467a661d7ca41857021ed5dc8e3274597471cf1108551ba13c7cf90165112f7332a4b45b8715293f48f60797a2af45909bd96ac5a2315d3071c2509e91c56f0befac5502c3809f677530abe057f67a3999af4a99a5891a53a8fad931dcceac6a4db45f07e26d17a3ec447e33cf574da9b36e3d75393a156511262f0e2ffb4e9baf3f17c94758d435d0856c6c4a52c72b057e5486a6fbb4dbf3831235b5351d83a0080199c315d16faab2f0ddb4c17e55ea52ff974fa880194b086239f4eddd64b35d7ea0025cf39a72340bc23754270716012f3ede9d28d10790cb22399cb8a37ab7bfb3f242b8a9a9078eac73ea702016c3bf3e23769dbc818ed00bb2c293b0ac5b9b7321e95b8291c49e6a734fd1906d25a61d2d4219d32324a77468737b35ca5ac8f8028f2f70041ff6225606983f768f5eff9fd4aab555f436d50913ef9ace7654626cb0016f20df42d70a652a062d9f84ff36d33123a9beefa2809b124eeb72bf1a2ad405303ada1e9c872f66d63752c8fed2d44a8d57aa684d48ebc827e78a038dd7e852a357caa450eb76a1aebc001f1e375ed2729d5cff5822837caceb765339c1a488e99fbf3b695247097d21f48dc34b4648a7cd1f3841a74b6961306416081d6c947a4a438999999aa2d0084ece77dd4a03bf636b702a74ec88491609b847c3ff97add93c3dc1724f8e3a02c3d1e9539bc6eee2d2f1fee3e63b9b4ab42d62ab6c4a54e2f2d586dee60492437b6fb0119ca6f88f470a40f854262c020e0b95f6bbc742671e34c5908919db1cadc9be293cf04ed6e4ef33d7f8d75f09e2634a49135a6f0434a64d8061bc5f2a3baf512ba4c0084ddd18fc2eabc2707083bcf1a35f2a43328f8b6dd504e486c0aa83c76f468531bd23eb83adb6a2997afbae5003fc0393735f421afc8e7c63f1425fa5bf3518d465b85936164a72915b0112d29ed6c647b3493d475e9ccd065c360008c2dc0831e478f118380ea15731710c702052ea34fc3b42f7a8e4f51cdf7dd95f4222c1b5906941a984e826420f201815c0b17fd434cfc7ba7d4c079db76a905f4388db8b20fb61f2f68fd33e32146d950f250b61a1e3b0a6b0523c15ee3a4b7d1b3b85955d452cca74bc5ac7ffb21b720d1527192c8b1941a51f6b3c2d214cea231f9cdee322306e52492c8492cc51cc00d1e6a9465581531e4818ee22b91096c0d6cfebedd4405910241258aac5aed13a872761ccdc379c3bf04c2fa62690da33bd224d77e9f3e3e1403aaee189a296469eb68951a346318a35f61928c9eb3e24bea16987aa245b2eec294ada45a4cc65c09449b3b88f539b4040a020d00049b5dffa7ff692ebcdd260eba8790b402aecc81c331c030588379ee4e8b9fa7fef447ad031ef54888bd3710cdca6d2fbb13794d6297044ca2d103696e2521e3e4f74a3340d313427ea3de9e8e3041a946203cc726b4a5c64c43a000d0532cfd7b8db57ccc870da2567f229c37c7a043258d9bfa5cfd8d6eec655178c5306be39f8bc10d48a749cb59e3e2d687145e57900d9cabd660b20e3a2bde0833f5864b5a567c7c0d97c3854754949d353a2402bcbf30b3bb2dec35b2f4f24c665c41a75c06de17fb6b8d72d3ff0621c4e2db1bc8785fb0f896bacaf947d0b2b474cab47cbd346dd8d7e40d72e2a61950ffb8c1434517f1da59e3df7b4bcdb3b437679a6d06125d8e216cca4be0f5db0c123ddc1a398d0232d0f8200b0c2c6f7bc52fcc2bf716209c966f796b33eda385fd4584a73db481e5381217f751a5fd50e2f0678bae650694be1c98ad07792c7e1e374f0dd163aeae7566e8b7686fae035290423674e0bfe56d44b649cd2eb673e763f30080bc58cb903c3d1de4cf74692ea5353748bab6546392a7063be8b699b731ed3faba3bf5095a4c4722da45cb1fdbd644bc99a555de616d23ea32812eb543c609b4ca632962bd2cef14d7856fc19dedcd470788a089080b8ddfeb99ecb617ef8c82d5850a9c41c228d25f5b9e496f7a9befa712c9f2bb9c1b01ed999fbe13ae7748adb9e013d30fa3f566335fb7b91c12e51b216afb89ee9717d8df33e609254ad157989795ce5e68e0ae4b8d56f7c4a80560cb2d9b170375f2010d65d935f593194e27fb5b7cbd2910f924e35129bf967f228ca1960db57cae6133aaaf53d3d2ee8b7a9a1cf4712d1610b832e8b1f3bea6ad00bae18a322c6de762a35940693f003f5a3f0a69e9c39c3bb7c41138f61e8482ebf76c1d8c5fb54f59d3fd65e6148b1961c4d58af347909a456dcbb9b16e489dee49264d7226851cc338cf2a704848790c10903ac6216dfa3f8651852b7ee50c972baa4ce284d13e9af1e9d5d046a6f6ad48796fe6d1e2f767fcf37441e84893aa1f8f38f760570fb7cce42ed87b65aa6488d523af4ec8f260d8f822d943df106e935c5c3774ed4f4996f207e4e815e046d439bee51dd63caf3507f08ee5b8c2d74f407ceb8e5942ca89bb18b44c3e0070448937b697e2fd2c54a2848dc166502ba569ac53db43728e24eeed4df3f7fe30324fd4056a39899c872128faa44414545cb0e9a92f2c73d18966b673975786c03dba639ae2ff24df1ef6560318a062391395f1f09cf276641798798369f9cc914f789d9d016a051467f303eea0fadb82ada6af15d3cf3362275140ba8e847388d59f84c8f8ad800cf851d35dd786447752f4db9f62f449516e0c90c5238aaa99503f7e1eb0d1d8852dec4d2954d2425bf38193e05a807e61037012484c927498b379cb802a4a9ccac7a8ca6395151af042fa324789815a11261cbe2c9e1e3239d140893b4c5c62af1b24efc52bef9e90dfdc354cb4f97019555ce78d01cb3dcd73811295cdddb4e103e925a493f350da63001552c8858c9cda7840fbd66f20304f887940493186c235ee0b00230f19593bbc3e6b1d4308bd82904673dc0bdcabfa1b0f4299dd680138712b6e890812a45b44bde99ce40c8ab854ebf92c66d86d9490431b01862759c541581ff28c767e374d2e0a4b62adbfc3bbc6d6cd2c7575afa217cc3bf487764ae9450f613b852e6a5fc1b126d010236638bb125e06e08381ccdeaf3b9ebc1d72a6f2af49b67691f57dbbcdd4003bac7283c251b46e4417318e84eb80e4d5dc2ccd217080ea70bdbf00fbf205470dd589f21902bc1e112b907db053a583b0e072bb483d11aab56de42e230e1c7ae76498e105366c229ce70a4fb3073fac616d1cd9aecfc5a5755d4cac8872eccd9571d532c1a11a4e57e9af96af641bcae655850d4194dae6ddc39c9bbfee2d988b1dc43dd2f3161345ed92fa914c3149e24db5831f2c2c9ee32bfc77069dabdc97e1bc412577ac8978672d930b45cc9a00513d4ce2ad6f7c827dd730e41e6e84145c48a28f5c07e0ccb8ce0b429843c50f24d0fcb67b2ad180c236895b46e8bfd600dd016cdc56e7fbc2e8ddfaa4b05bbf3f19bc4bd3c2c040041973bd7b91a202c3b5ec2a6ca91647b61a831abd37e91493af7662634c9ff0f1cdd09458bab4470d3d7d77b0050463464d43c9e49f8543f6275d4ff098f08564107c1d1357fee52efd03707bc7bc34059d524ce3efe5001540d60a5a08ae8e8068ae200d97be1d64dd2f11eb624a3e28c7082ca2cd89886d2a9fa656b6354eaad3d1de38e575dc0c723339efa31d20bf0415d6fc3a90479642a4030ee2a4a425c9c8375645a16347aaad0020f76a6c56bd0f0cc47b50cdabdad1f5c96afd63db6742f5d3cb5926eac98e48b91c9fbcc1f640712d5fe5564a4a53b2b25b1149f864fc665feb5c8281c527708277077d8aed35dbe51450b10e81f87fe5d4799c571796c79798bce6779405b5683a9b2de4946c9ecef1c90bc8051e0c1ce91f847ef3489d562fd598e85f665d3f9fc2059093d59cc05d322a91e6727cd8eb8a32dda60f04f0c4bfb8aa3ee27fae0779740730ff1b48a2041c57c5efb2ca223e5e3983592010e41b9172a91337bec85cc5b01eed99a0f26d9a4a320eafa2c5d2f7fd29b30a31e9cb5f125f33925264c750ef18843583bca6565ec7ba704b8a687b04dd3723f37721f4d07747da6f217f9bbe657cdf7702b71e7011497cd5c66cc7a9033581f99200d292eeac731007c2d7036206b7119eb1beabf81b23139ffa53596db62eaec5daf31a881d46c8c5a10edce30648a7a9ddaa3804e443ad216a2369f1f3d387c1bc326d5fa7601c7f5cd0c9fa22ec8421a90e13b476b314e4bd08f515788b0d430625447a946a040db5c8427a45e0e11b2f0a79e505e1780110843c29ff2c85702332f7a3435ec3c0e75d1baba0b3b55c83fec2667ab6326e577d9d8aee6abcfaa4c7c243e05c5bd069e478bc9e1657fa08bf30f91b76844eb94e8390a3464455496ac7b7a9bea4b739293530f3a7a9c73dc1867faf342b52fa3b715b35a79d8291d5435238363807ce6e18672a2b13e8873745a681a1e31da00ff46c858a7725102bfbaf3334df1004959eb13fd84f832a6dfd2285032945567daae5403fac877ace30ef21fad620b0a9677f44b2693f0d7145be9b1c297d79c6c8a52a5c9e590d2544e515054b178db0d078fec84ed88f581d3f4570db19d338480cfff6a7ed4893d7a20d2fcfa4918f0f4596a5eae299506f982d46b52557ae3d4ee0a5dc3d9db0df915588688f8eab7171f5d430d62121b4f01329333d6d4e74b263385c72330b92c81be2e0cd9c3c020a29ad6c75f67cdcd0400d357b64e8e7b159f4463d92f10ea7564b16465459e2693d73a3768feb513a2482aa3efa06df4435f47c597fd80068ef5d4b94d6f16c60767e49919ef99b3314f2586655f7f171973b1f2f79f9d058ee307a3fd3602ee206368ce4bf5a5dfa5ed60ab217f1bf51bb61c21ad23ccd30c4d777e0a635863f1ad3fc42edc985fb5f6d753eabc5869e9338399b33dde88d98fa3da909383c4584a15f45678d368e51fadba7df36b405faf85a4fab1236b9b25588ade0d69a4ec40195699bf48be2c510cfc9f7eafcb574456bc5e5a3e87ceef61c662424913387884fa9d7d5c5b3e4f2b9c2a2f89d75458d95ed188e816c602f98801e2748979ef759f58046b0098b30c7add691417a9526f0729b3ae7614a540afb43b7533da23b0f65380cd60488de4c26ca8073d185b2e3c6b9778e9488e853919c05a27007fb40f058324e8b1f11bb9302648c4adb2368fe69514d8b9f70d2b25aceb49f97ff3517eeaaf2fbdf628f338e56f0c2384a9bd65f8701f7b9039d33eb4d32b3095528ffdc68ac7c64f02a622c1790bbd6a8568e18312bce21976533acc43cb0c9a710b0c279846a3f7c17edb90d94b1dffbd67f61533c79b3210ae03d6de7e3ee4a7b74ada844cbbcdbaadf1b9bbbea8e60890027dcd3bdddab4180735f5a3177dd7469372b6273990863862cecd9cb9015d15ccf1cbaeac9200a377", 0x1000}, {&(0x7f0000000000)="c3d9456254525cdc6dd3b497bb85624389e36e4a29957f8cd3", 0x19}, {&(0x7f0000001100)="92cd5d6e820701999d30ad314a80f79529980f633d37e68ad26179e3b9ce15ddac24c0279b5c69914f87e7791cdcc25b0d000b815b8546d73fbeb0a5a6dffef57cf147ea5f837a95f7b36318d88d4fc47ab42800e8", 0x55}, {&(0x7f0000001180)="818ed524936e5a8e38d60b02e35dbc11bb1a0b1268a6332873aba9178a775be98d7dcc19bc9a094f1638888073a2049e587b37440c079fdcb3b9e45d3ebd8d68aaaa2c262aaa9bbeb5dd7ff9af86ce085c9bf5d8b4fbdd322d1fccfa355b0555db17ad9199324cc4114a1dad6be7aa376d9bdc8331b52d9fd5609fdfd69a178b8471fb8fb7dc6b17cbe69326e6cff5b38ea05ab0cd5a4c7e96e37896c8497d401478bef702c55e92a4252a4e84a23a08097153acdde0914dd44199b4b2d8c35ff4dbb77b20ac4659d873ac48dbc23284072ebcb732e46a3f0c36fb157f74ba3b1a379dad7c1564c43d828a8471d0259edcabbf4859b259db5e9108f03dcf8aa449a62977be193c03ffefe702239934364c4eee1db17831c7373f14235e129a28a9340354a1eddf4de8ced3aa963f87616db1667d0bd8533a765efc3532aa32ea346c53f03b1933c5899e03dddc310f0b535ad9ea1c539dd3a424eaa37e58433301cdba7168eecf1be7004afc9088ea031b66de74e09cd96e858a56db18f0508cba8057be9ca808676c192bab7a48a523b21cb89e86785b46a8a532b025a336ecc9c167f5e3de0850557562b77a7000c81a98c47ac5bc73504c60e4d3358c333d85d7ad308692f89883cae5b0328a1f56d2aa03f00ca7e4a928a60f654a39d8fe75d3dd68493387e278434fbeeec4d70f8e76130b8130ad204aa0c61368df1b4e345c3793de0608eca8bbff8af83e6827d4f7d774f7b5ae659b0e53253a0a230697c531a8ecc755deebf767af7fc8a3e9af90ae1f306348ed4df4502e2fdd17c71f1e570c5d09cdd02bbe495cb8ad40299e97842b7d8adead79b19feb1abefe909a287f6d5877e1d5aaaf27cd013b69ff4d0cdf22179c1643c79018d573eb717880e77f9a0feaecefa70d0ac97d1d8fa808f1c563c53c85bc2150766a6908b150cedf43e34822371024289fe136f4ac9387bf991cf1c010366f217097127fc5dce0c72a5ead1280849a690e4fbbe0c3a1d8615adee5b331cef823a9bb4a4915a3c8cd3abacd78bfb08fbbccf53540ec669fcf83aac296b21ec5f1d918086c05eb884c6e16d0dfc3514575ef4ab5a3e725c0870815736f54dd2e4270b263bb9d5c038c73f8213d0e87d847572fe86c8f2b35537c648c56076214e70ce6243a03bd204d3d2b359528866fd779c1ff557cf373df67b0bfb7e42b6134af862b43518ad0c80f4244b98edd9d61b4c3844ef54adf884631e58a3e1815bed386df9b63133350618110f7e9ff119a3aae14fa4ddf29e7658a726324634ea3433d74b007c3145be1007df8010e5a242d529c781304aaa8c96036e5f5db350ecb1e397a27ad604130020ac0dcf737ba1e001ffd82e042be3c0afb8681060ef04427400b6c7d21301ff787ee1b9de724ce2404f06dc8c0816bc13329bf6756c16cf2986b2cb62807c56689cbe6079428a8538808351f834cc734d2433010b2294824d7e9e06dfc6db88ea76c08d7a713f2a33c82126f07067d80a005e7372de8ada168c16b04fe12bcc69814397fa564a6fbabfb4a91333458bf5be2b5722636ebe2a11aa4b04faa7245b7c8a38ce760bfa7c5936b2581a83d07f8f31f2aecf187efcda8558c10113132f83b682a107c6e534e828413a3e17091e559e437f362c86a8c2cc26cfe80f3c3943f3350219800fcebb4daa65a99875e8b5ba67bc0fa1048119a08ae2d291522d718bb9f8a5cdccc59a37974ba4064489e2003a4884f9091ec917503c8c2584bf5e776281419bac244d0b4746fe694e5330cab3cee5d8e372cb5403ca70364b3e36a39e38ff5a2a3e645ffb375c123b7279901562904c0bbd24de515e7adab744653c7ca7ac17904049a8ab8ce574c9e42d93a01fb51cf3ded5126db3d41c14bf85fb676f2f9dde2e155280ad482bd7f5c4b32fe707f7dae67b0e6d2dea24a289f1f34fae71580a085893f643858c0e5b50ba5d2ce5813226362f06eb2f5a05e45077bf87243206f5b5cd48ae08c75bd89ff9d7d111d63938e5140a460e10ca6270ddf540f6d23c7c0091f354b6530b27a786b9484d01e2b403c3eaa6e6adccc17193943dd74bd959606e4e737745bfbac1531d15e5ee2bb67bdb7adc51bc1753f881f153ec3fea48c39719fea2e4dcbae194bc5cc57572f724c93c8d050e711de351b06611baf2ab040b9eae471639b99d8456ef15b14dc1d0df260f5a5c32e78049138104704dfb9552e28d323b8a6fbc759d6bbbfe8ba0f7118ace9ee4ed48d5e772125ca75d32d5a1ae65ca802f474b7c70d375fec764e0d0b50119ae9464a4352c62619d205b79cd06a1fa5d61d6ccf30e724303a578a66f63cd2f1e76851bde34de5c1fb4fa576d2f7752f7541642c3ea8e01fe58931c661d39d9d530ed1c27f43e1b8180f8ed8e373d9b8a16888dc7f058afa50c5e264ba6fe0bdaae87b1e0552f54378e3bfab62c052ab71d4c03744253464638a3deb93f4f868a65336143f424dcdb1313eebd15a8f35aca6ce23bf1377072e8ad14ea66f1fddf1e10be2696d5dcc5442e34cf2ee6258af736d84b1db007164c1c4b8eee714fa943ab45578d0cbcd276e809781aca15aed624f7ca91988a0d9f1712f58f7ea2c6ead8e71ef6ef076812c8ac3e687927dd382e1389a657fb302a2886d97c1eac15ce65fae9a5703da02d2bb4ec18112355111e04c997ccbe7d4a5539cb1b718ca191c713499aaa89d343ef2141ec4931e8f2a428cbedf9eb4ffe8a1cb510f39377b6da01ba231a2bd02c6df59d136565a1caf5904c1efc25f667fc075abc11623e14088bdd6671b0b9bd54e22c8f2c8a0a35ff420f0d3aa0866db46af1a14b5f309b6db3b2fb66955d4bfe7127673816e253053d492515fb16040837e90323c9cdbd4b4ad78cf819bcfee93f083f2d450906c597676ed3d7cf7947f22f761583e24c78ca7c88e4fbd06fac7a99f255b70f54150e526d72fae898f2c374546c763cf2dea6f91e7dc8645662ae3ce432538f71dc7d937bcc548a5f4791d8cb7d87a8fb2b7fc3efc812fdeb2e242587c334e5cf6bfa51d8cb217b720dfaeaeb626d663c9167184aac3cfc68efb82c485dad07015e4ca0a5569905744b00ac008b3e2f31c88b9ade4a914882c43bbb2aeb83c2cef256828da908e3350d4eaa9e3d13fa067f3accbe80895651d1c90e0ca66ec414d0fb8a4fb985562253b445e9be3af09f41dd86ed695a6580b5119a790442b346ee21ae30fd64ede058549e51311d47df7f2d218730977c1ef1866f269eadd0464b034b303c9d160b2524e6063af7f390b8b5ec86c31b660b63fe1e3490cc913e4fed1ccfcf2b34844e65a9d988d02c32b56902874a4e0e0c87afd92d47c740a9d51aa8309ef0a1016b4d152ee21171902ff304694881a8b89416b0cee0f88edfd3668d73e6ee5f0a26ad02a6d76c889114b3775e85ada8537b8615a4f101438b345bf8b0c4b9dc138be537aafb1497efe86d439fbcbebbde208979253858764d454231e2d98abb6119ada7d9c7014228b9dbfc02bb49361ef9f956cbc18225181b38d2896cfdd3bb9bace48f8948009b281a9624d98cd9454395a09f2ba73d94b81dbb70c8b948efad7a329e1c7bf99d589854b86ccd815be5e577f3b6d2e84d6fbb3c2dad26ff78165c428088dcb1d8d21879bcf0e64a7afd41b40280453df2d2c7b3273759791a6665af6983c1680ef1f2d873552c7722f565cce1f07b3321700e8e18725052063470b2fcf705748be4bc97904a5bff9a40738c3273fb2837379761e84107fae0aac38cc642c334f7aa4fef727fc74dfb84b0af686dd6b09d9f7720fa497e469b26ffda822b3df412322d7a768939103ec1b8d979fe7a96645d8bd90fe4371df3700944e6bcd14391cd1921f9f5c765d9853f357b1ebcd0be130ba4c73436bb4419d4d4c92927cec67f23838ec66966c363b7f5322c90595ed7d8cfeccdef011445ffa62bdd5ad8f61042ec0602113c1d2b58952e11df4afbe3db15fdc150029eaa8083a507b0e957883c79bcb70378d1312458e8ef5ce192d45c68234247189e3f433b624d80d48fd059a52c819cda2e3c00dea3bc470846209033c5d8430ccf8793b70e0f384aa25ea185beaffe7f439ca3a751aac75bcf9f2ffcc43d606714bf2689c73a779bd0ed141e24f3b7036eeec8f82d92e40184d4b70fbeadb44b9c613e9a28388a1975f691fe6b48577ace4af01d22497bd7d92cea5e19773a3a8b8bd6e7bb8b701ac66761f521819cefb21a20c835df3bb116f85a8d18d854c19c7697d61cd7974de5719a6a3a64dc9a36ca3f89d5ca7cb2f32277e45838927ce2a89b52f056b47031cc2b687cab79cd319dbf24de8443a81e384235b580bd8245bad3326c2f6407f4d7efddd146f76f0c88014c45273cc8f4905ab5d6aa9abf048e25a3d230ffe809ad6a8131b01b8c6c33efd257097b258c9d9bca7dd5ca7c77987e9eeb2fb5d460ee7548a09369aee2a4ff877dd0e785ba6d8acf32e5af66859fef24302e6ca02de808ecedba77db545673391a0c686a6ea8a04b558e7cc179c48e228bff0af2f387bd2a64db14e740f23e108a936bbb998474ba60cbaa6daf4f0dfd0427ce07bc95c48a986566c48b0f08195bb6a3a7425dc94a46298c7d9a75a6f71b0914335b56e7cd0cd02650465d25f043e39834dd5c9294b3a8bb77b12694b1b503ce9ee520acfe6d8148c14eab7215516afd28ddcda52b5cb3c97d3d3ae2a5e1bfd7d565376a4c3b8ce6871784f04e411900222b008ca71208023b88d16cca756cf603482823d98c40015e12cc7357d0628a4ecfe26d574f10b13fd26bda1bafb1e27145df8991cc9f01d7a7d03dacb0ca6aa1b83bf47309f0a608497328949f2eca4f0de6d73786366e80a7b9e8c8138d1fff848a503c2f34c3161a9781e5869ae0e83ac84ddccce2589b0d7aa331dec307511383bb8302b7e7d46ed4b93c2fc2ee1e0a3b0a336a5f3aee0a52e65fa7db838d96dc8298b808cc7b83b188cf43c3428494567bfe4dfd3cfb5c536dc49a0f0a99081266966ac12bb2b174e75e38de0d1e2b7f4afddd1b2389c2b143b6fb20db97cbdf7eb66597cbd44d15933d90c175b3803fb2c6bce9a37b876e0318752d60eeddbfb48314805e730daf5b0d15e856e593b57ab71bfea23905b86b4294f21fe935c00c8c021eccf3f6be2f63be84d2cc0aeb4aea02c8dde2cd9190a89ff35a00b988054f128a1147927b0299cc24d26f79a819d5ba016fa2904acf7dcbdbf7ceef58acbde210e5730edd5dcb09037529acef1b81ec4ab13f59fa79e8fef1c06d85c682cba2876ed0338c199e519497683f98cc6c267c56da896e6c271d0758987b950a3d2919c5b08de977268e048bb175afc970533fd410d1f6ea92dbbc3db12d44a1c17cbaceb6bfea75e9b3a4f1fe10c54cdb717fa86ca4ff9571f1a4899692a039bbb97778c2c8d0be47eec938882d905a171bcc5c56d3552eeef44478c8115989f8f049573de12e651e118950cc45c57cc1634ad094d023afaef0be1d3442264a2e6fd766535faa6a104653910509d2be7a0d5ae00baf68c380deabbda089a006979dcc361b2db037726867c8bf3813d440cc091128cc92c953a2dc46fd6ff65f2bddbc4cf8840d1544eab1df3ff7033228fdf36ef84f82252e2d8342350c0a466aa2ad7a939b2406299ad163064d0f685f5aa46f06a06128da68cc365fa4340bd65ccc84904db1f30b55d756568f52dc8063979a7d7a76b18aa39e04004bc5dbe8a51655feb863dc613dc", 0x1000}, {&(0x7f0000002180)="97b116eb3d555cc21632c54acbaf61571dc485f83595407416e2bc544dfb293d19ce3941ae4658315bf2056236256cf64b029021fe847d0085c2472b246d91d2e9d47d7f63d34b3815ef2ff2d1c2268debc6be7828efd9219c781e87d0dcc48b38d142739835139149361654121eb5cd488891401d93f3d2132a66442546f3de04c76c3713147c", 0x87}], 0x6)

561.068556ms ago: executing program 5 (id=460):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff)
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score_adj\x00')
writev(r2, &(0x7f0000000800)=[{&(0x7f0000000280)='2', 0x1}], 0x1)
ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan0\x00', <r3=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010026bd7000fedb71d0d768dcc5031bb7940b92f7e7df250c00000008000300b72d402c13dc2043fcf7e63a2a0e3998ce0c8c5011da3425484bb709d81809c5b6490cdcbb7448cc4a8edaafb98f7eefd00a4aad18761fe145d81b8f2d8c8830e2c8e680ab97c07b6897ae1e29e16558a96f74fbb4a653e16d10d0099157bb2870d54a9dd655112b94258899401ea39a76a427", @ANYRES32=r3, @ANYBLOB="0800010002000000"], 0x24}, 0x1, 0x0, 0x0, 0x200008c0}, 0x4000000)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$sock_SIOCGIFBR(r4, 0x8940, &(0x7f0000000040)=@add_del={0x2, &(0x7f0000000000)='ip6erspan0\x00'})
ioctl$sock_SIOCGIFBR(r5, 0x8941, &(0x7f0000000080)=@add_del={0x3, &(0x7f0000000100)='ip6erspan0\x00', 0x2a0ffffffff})
ioctl$sock_SIOCGIFBR(r4, 0x8940, 0x0)
creat(&(0x7f0000000080)='./file0\x00', 0xac)
mount(&(0x7f0000000180)=@rnullb, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='jfs\x00', 0x8010, 0x0)

375.991465ms ago: executing program 1 (id=461):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0)
ioctl$TCSETA(0xffffffffffffffff, 0x5406, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff})
sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x60, r2, 0x1, 0xfffffffe, 0x2, {}, [@NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0xb7, 0x1, r3}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xfb2e77a8993c1937}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x4044804}, 0x20000000)
ioctl$PIO_UNISCRNMAP(0xffffffffffffffff, 0x4b6a, 0x0)
r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0)
write$binfmt_script(r4, &(0x7f00000001c0)={'#! ', './file0', [{0x20, '#! '}, {0x20, '/dev/rnullb0\x00'}], 0xa, "9c7bf7fb21a577c786f606611e13"}, 0x2b)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c)
write$binfmt_script(r5, &(0x7f0000000200), 0xfffffd9d)
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSETMODE(r6, 0x4b63, 0x4)
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0x6c3ca000)
openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)

0s ago: executing program 5 (id=462):
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0)
ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f00000002c0)={0x3f})
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
write$uinput_user_dev(r0, &(0x7f0000001740)={'syz1\x00', {0x0, 0x0, 0xff08}, 0x0, [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x713, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x7fffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6a, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0xfffffffe, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x2]}, 0x45c)
ioctl$UI_DEV_CREATE(r0, 0x5501)
mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='squashfs\x00', 0x208002, 0x0)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) (async)
ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) (async)
ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f00000002c0)={0x3f}) (async)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) (async)
write$uinput_user_dev(r0, &(0x7f0000001740)={'syz1\x00', {0x0, 0x0, 0xff08}, 0x0, [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x713, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x7fffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6a, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0xfffffffe, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x2]}, 0x45c) (async)
ioctl$UI_DEV_CREATE(r0, 0x5501) (async)
mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='squashfs\x00', 0x208002, 0x0) (async)

kernel console output (not intermixed with test programs):

fig 1 contains an unexpected descriptor of type 0x1, skipping
[  124.271986][    T9] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config
[  124.314310][ T6224] overlay: ./file0 is not a directory
[  124.345148][ T6224] /dev/rnullb0: Can't open blockdev
[  124.363613][    T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3
[  124.399475][    T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  124.427106][    T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  124.457496][    T9] usb 4-1: Product: syz
[  124.461823][    T9] usb 4-1: Manufacturer: syz
[  124.462356][ T5955] usb 2-1: new high-speed USB device number 7 using dummy_hcd
[  124.495327][    T9] usb 4-1: SerialNumber: syz
[  124.553488][ T5955] usb 2-1: device descriptor read/8, error -71
[  124.631870][ T5948] usb 3-1: unable to get BOS descriptor or descriptor too short
[  124.692249][ T5948] usb 3-1: unable to read config index 0 descriptor/start: -71
[  124.704985][ T5948] usb 3-1: can't read configurations, error -71
[  124.824319][ T5955] usb 2-1: new high-speed USB device number 8 using dummy_hcd
[  124.875111][ T5955] usb 2-1: device descriptor read/8, error -71
[  124.992904][ T5955] usb usb2-port1: unable to enumerate USB device
[  125.133145][    T9] usb 4-1: 0:2 : does not exist
[  125.148680][ T5923] usb 1-1: new high-speed USB device number 8 using dummy_hcd
[  125.220540][    T9] usb 4-1: USB disconnect, device number 3
[  125.302320][ T5923] usb 1-1: device descriptor read/64, error -71
[  125.315690][ T6248] /dev/rnullb0: Can't open blockdev
[  125.322844][ T6248] cgroup2: Unknown parameter 'cpu'
[  125.542283][ T5923] usb 1-1: new high-speed USB device number 9 using dummy_hcd
[  125.692251][ T5923] usb 1-1: device descriptor read/64, error -71
[  125.782425][ T5948] usb 3-1: new high-speed USB device number 5 using dummy_hcd
[  125.802522][ T5923] usb usb1-port1: attempt power cycle
[  125.976603][ T5948] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  125.991586][ T5948] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  126.006804][ T5948] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  126.025965][ T5948] usb 3-1: New USB device found, idVendor=1223, idProduct=0107, bcdDevice= 0.00
[  126.037947][ T5948] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  126.058627][ T5948] usb 3-1: config 0 descriptor??
[  126.153073][ T5923] usb 1-1: new high-speed USB device number 10 using dummy_hcd
[  126.183830][ T5923] usb 1-1: device descriptor read/8, error -71
[  126.202281][ T5910] usb 4-1: new high-speed USB device number 4 using dummy_hcd
[  126.355392][ T5910] usb 4-1: Using ep0 maxpacket: 16
[  126.364349][ T5910] usb 4-1: config 14 has an invalid interface number: 10 but max is 0
[  126.374783][ T5910] usb 4-1: config 14 has no interface number 0
[  126.383409][ T5910] usb 4-1: config 14 interface 10 altsetting 8 bulk endpoint 0xF has invalid maxpacket 1024
[  126.394056][ T5910] usb 4-1: config 14 interface 10 has no altsetting 0
[  126.410560][ T5910] usb 4-1: New USB device found, idVendor=1b3d, idProduct=01c7, bcdDevice=ab.3a
[  126.420846][ T5910] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  126.429891][ T5910] usb 4-1: Product: syz
[  126.434576][ T5923] usb 1-1: new high-speed USB device number 11 using dummy_hcd
[  126.442723][ T5910] usb 4-1: Manufacturer: syz
[  126.447964][ T5910] usb 4-1: SerialNumber: syz
[  126.457382][ T6268] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22
[  126.474105][ T5923] usb 1-1: device descriptor read/8, error -71
[  126.476573][ T5948] hid (null): unknown global tag 0xc
[  126.482483][    T9] usb 2-1: new low-speed USB device number 9 using dummy_hcd
[  126.494600][ T5948] hid (null): usage index exceeded
[  126.500700][ T5948] hid (null): usage index exceeded
[  126.507694][ T5948] hid (null): unknown global tag 0xc
[  126.514549][ T5948] hid (null): invalid report_size 1078742164
[  126.521595][ T5948] hid (null): unknown global tag 0xc
[  126.531080][ T5948] hid-generic 0003:1223:0107.0004: unknown global tag 0xc
[  126.538929][ T5948] hid-generic 0003:1223:0107.0004: item 0 1 1 12 parsing failed
[  126.548332][ T5948] hid-generic 0003:1223:0107.0004: probe with driver hid-generic failed with error -22
[  126.602802][ T5923] usb usb1-port1: unable to enumerate USB device
[  126.622324][    T9] usb 2-1: device descriptor read/64, error -71
[  126.677599][ T6268] /dev/rnullb0: Can't open blockdev
[  126.698088][ T5910] ftdi_sio 4-1:14.10: FTDI USB Serial Device converter detected
[  126.714952][ T5910] ftdi_sio ttyUSB0: unknown device type: 0xab3a
[  126.762014][ T5910] usb 4-1: USB disconnect, device number 4
[  126.813196][ T5910] ftdi_sio 4-1:14.10: device disconnected
[  126.863191][    T9] usb 2-1: new low-speed USB device number 10 using dummy_hcd
[  127.032628][    T9] usb 2-1: device descriptor read/64, error -71
[  127.117072][ T5948] usb 3-1: USB disconnect, device number 5
[  127.153942][    T9] usb usb2-port1: attempt power cycle
[  127.332066][ T6280] /dev/rnullb0: Can't open blockdev
[  127.502485][    T9] usb 2-1: new low-speed USB device number 11 using dummy_hcd
[  127.523330][    T9] usb 2-1: device descriptor read/8, error -71
[  127.590742][ T6284] /dev/rnullb0: Can't open blockdev
[  127.767056][    T9] usb 2-1: new low-speed USB device number 12 using dummy_hcd
[  127.802991][    T9] usb 2-1: device descriptor read/8, error -71
[  127.931715][    T9] usb usb2-port1: unable to enumerate USB device
[  128.160648][ T6307] /dev/sg0: Can't lookup blockdev
[  128.202359][    T9] usb 4-1: new high-speed USB device number 5 using dummy_hcd
[  128.279448][ T6312] /dev/rnullb0: Can't open blockdev
[  128.291712][ T6312] /dev/rnullb0: Can't open blockdev
[  128.300538][ T6312] /dev/rnullb0: Can't open blockdev
[  128.307020][ T6312] /dev/rnullb0: Can't open blockdev
[  128.313814][ T6312] /dev/rnullb0: Can't open blockdev
[  128.321264][ T6312] /dev/rnullb0: Can't open blockdev
[  128.329118][ T6312] /dev/rnullb0: Can't open blockdev
[  128.337734][ T6312] /dev/rnullb0: Can't open blockdev
[  128.347880][ T6312] /dev/rnullb0: Can't open blockdev
[  128.356299][ T6312] /dev/rnullb0: Can't open blockdev
[  128.367982][ T6312] /dev/rnullb0: Can't open blockdev
[  128.374453][    T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 84, changing to 10
[  128.383776][ T6312] /dev/rnullb0: Can't open blockdev
[  128.412396][    T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 42344, setting to 1024
[  128.414541][ T6312] /dev/rnullb0: Can't open blockdev
[  128.430295][    T9] usb 4-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af
[  128.443800][    T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  128.447378][ T6312] /dev/rnullb0: Can't open blockdev
[  128.459608][ T6312] /dev/rnullb0: Can't open blockdev
[  128.470808][ T6312] /dev/rnullb0: Can't open blockdev
[  128.474946][    T9] usb 4-1: config 0 descriptor??
[  128.477615][ T6312] /dev/rnullb0: Can't open blockdev
[  128.488894][ T6312] /dev/rnullb0: Can't open blockdev
[  128.495162][ T6314] /dev/rnullb0: Can't open blockdev
[  128.497024][ T6297] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[  128.520194][ T6312] /dev/rnullb0: Can't open blockdev
[  128.530659][ T6312] /dev/rnullb0: Can't open blockdev
[  128.537861][ T6312] /dev/rnullb0: Can't open blockdev
[  128.545185][ T6312] /dev/rnullb0: Can't open blockdev
[  128.553274][ T6312] /dev/rnullb0: Can't open blockdev
[  128.587526][ T6312] /dev/rnullb0: Can't open blockdev
[  128.600492][ T6312] /dev/rnullb0: Can't open blockdev
[  128.607781][ T6312] /dev/rnullb0: Can't open blockdev
[  128.614586][ T6312] /dev/rnullb0: Can't open blockdev
[  128.621450][ T6312] /dev/rnullb0: Can't open blockdev
[  128.637262][ T6312] /dev/rnullb0: Can't open blockdev
[  128.645809][ T6312] /dev/rnullb0: Can't open blockdev
[  128.655394][ T6312] /dev/rnullb0: Can't open blockdev
[  128.663355][ T6312] /dev/rnullb0: Can't open blockdev
[  128.670102][ T6312] /dev/rnullb0: Can't open blockdev
[  128.679650][ T6312] /dev/rnullb0: Can't open blockdev
[  128.700358][ T6312] /dev/rnullb0: Can't open blockdev
[  128.720305][ T6312] /dev/rnullb0: Can't open blockdev
[  128.730436][ T6312] /dev/rnullb0: Can't open blockdev
[  128.739517][ T6312] /dev/rnullb0: Can't open blockdev
[  128.750031][ T6312] /dev/rnullb0: Can't open blockdev
[  128.757876][ T6312] /dev/rnullb0: Can't open blockdev
[  128.765937][ T6312] /dev/rnullb0: Can't open blockdev
[  128.773195][ T6312] /dev/rnullb0: Can't open blockdev
[  128.783290][ T6312] /dev/rnullb0: Can't open blockdev
[  128.790208][ T6312] /dev/rnullb0: Can't open blockdev
[  128.804829][ T6312] /dev/rnullb0: Can't open blockdev
[  128.812595][ T6312] /dev/rnullb0: Can't open blockdev
[  128.820130][ T6312] /dev/rnullb0: Can't open blockdev
[  128.829828][ T6312] /dev/rnullb0: Can't open blockdev
[  128.838383][ T6312] /dev/rnullb0: Can't open blockdev
[  128.846643][ T6312] /dev/rnullb0: Can't open blockdev
[  128.854099][ T6312] /dev/rnullb0: Can't open blockdev
[  128.867896][ T6312] /dev/rnullb0: Can't open blockdev
[  128.874567][ T6312] /dev/rnullb0: Can't open blockdev
[  128.881750][ T6312] /dev/rnullb0: Can't open blockdev
[  128.889022][ T6312] /dev/rnullb0: Can't open blockdev
[  128.896347][ T6312] /dev/rnullb0: Can't open blockdev
[  128.906227][ T6312] /dev/rnullb0: Can't open blockdev
[  128.914229][ T6312] /dev/rnullb0: Can't open blockdev
[  128.921705][ T6312] /dev/rnullb0: Can't open blockdev
[  128.928339][ T6312] /dev/rnullb0: Can't open blockdev
[  128.936409][ T6312] /dev/rnullb0: Can't open blockdev
[  128.943240][ T6312] /dev/rnullb0: Can't open blockdev
[  128.950298][ T6312] /dev/rnullb0: Can't open blockdev
[  128.959094][ T6312] /dev/rnullb0: Can't open blockdev
[  128.968371][ T6312] /dev/rnullb0: Can't open blockdev
[  129.017901][ T6325] afs: Unknown parameter 'dynock'
[  129.284755][ T5910] usb 3-1: new full-speed USB device number 6 using dummy_hcd
[  129.312521][ T5948] usb 1-1: new high-speed USB device number 12 using dummy_hcd
[  129.355178][ T5879] Bluetooth: hci0: Received unexpected HCI Event 0x00
[  129.356484][ T6333] /dev/rnullb0: Can't open blockdev
[  129.456114][ T5910] usb 3-1: not running at top speed; connect to a high speed hub
[  129.483139][ T5910] usb 3-1: config 252 has an invalid interface number: 2 but max is 1
[  129.495778][ T5910] usb 3-1: config 252 has an invalid interface number: 114 but max is 1
[  129.497564][ T5948] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  129.506431][ T5910] usb 3-1: config 252 has no interface number 0
[  129.535881][ T5910] usb 3-1: config 252 has no interface number 1
[  129.543184][ T5910] usb 3-1: config 252 interface 114 altsetting 72 has 0 endpoint descriptors, different from the interface descriptor's value: 28
[  129.555177][ T5948] usb 1-1: config 0 has no interfaces?
[  129.561377][ T5910] usb 3-1: config 252 interface 2 has no altsetting 0
[  129.572271][ T5910] usb 3-1: config 252 interface 114 has no altsetting 0
[  129.583703][ T5910] usb 3-1: New USB device found, idVendor=046d, idProduct=08f5, bcdDevice=58.50
[  129.598109][ T6336] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  129.606825][ T6336] /dev/rnullb0: Can't open blockdev
[  129.613418][ T5910] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  129.638060][    T9] usbhid 4-1:0.0: can't add hid device: -71
[  129.644788][    T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71
[  129.654647][ T5910] usb 3-1: Product: syz
[  129.659181][ T5910] usb 3-1: Manufacturer: syz
[  129.660190][ T5948] usb 1-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24
[  129.676960][ T5948] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  129.686399][ T5948] usb 1-1: Product: syz
[  129.690733][ T5948] usb 1-1: Manufacturer: syz
[  129.694823][ T5910] usb 3-1: SerialNumber: syz
[  129.696695][ T5948] usb 1-1: SerialNumber: syz
[  129.712392][    T9] usb 4-1: USB disconnect, device number 5
[  129.717520][ T5948] usb 1-1: config 0 descriptor??
[  129.967319][ T6325] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00aa with DS=0xee
[  130.130079][ T5910] usb 3-1: unknown interface protocol 0x7, assuming v1
[  130.154874][ T5910] usb 3-1: cannot find UAC_HEADER
[  130.293345][ T5910] snd-usb-audio 3-1:252.2: probe with driver snd-usb-audio failed with error -22
[  130.357605][ T5910] usb 3-1: USB disconnect, device number 6
[  130.463789][ T5885] udevd[5885]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:252.2/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  130.479746][ T6348] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  130.505471][ T6348] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  130.704655][ T5923] usb 4-1: new low-speed USB device number 6 using dummy_hcd
[  131.083541][ T5923] usb 4-1: unable to get BOS descriptor or descriptor too short
[  131.099247][ T5923] usb 4-1: config 1 interface 0 altsetting 3 endpoint 0x1 is Bulk; changing to Interrupt
[  131.111842][ T5923] usb 4-1: config 1 interface 0 altsetting 3 endpoint 0x82 is Bulk; changing to Interrupt
[  131.196408][ T5923] usb 4-1: config 1 interface 0 has no altsetting 0
[  131.269517][ T5923] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40
[  131.336421][ T5923] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  131.466748][ T6361] netlink: 12 bytes leftover after parsing attributes in process `syz.1.111'.
[  131.549236][ T5923] usb 4-1: SerialNumber: Њ
[  131.559837][ T6347] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[  131.568418][ T6347] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[  131.846829][    T9] usb 1-1: USB disconnect, device number 12
[  133.555633][ T5923] usb 4-1: USB disconnect, device number 6
[  133.932837][ T5923] usb 4-1: new high-speed USB device number 7 using dummy_hcd
[  133.973061][ T6410] /dev/sg0: Can't lookup blockdev
[  134.142358][ T5923] usb 4-1: Using ep0 maxpacket: 16
[  134.180905][ T5923] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  134.237598][ T5923] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  134.282524][ T5923] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  134.303772][ T5923] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  134.322832][ T5923] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  134.356333][ T5923] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  134.378069][ T5923] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  134.392227][ T5923] usb 4-1: Manufacturer: syz
[  134.407502][ T5923] usb 4-1: config 0 descriptor??
[  134.763416][ T6430] netlink: 44 bytes leftover after parsing attributes in process `syz.0.128'.
[  134.823700][ T5923] rc_core: IR keymap rc-hauppauge not found
[  134.846415][ T5923] Registered IR keymap rc-empty
[  134.858553][ T5923] mceusb 4-1:0.0: Error: mce write submit urb error = -90
[  134.902388][ T5923] mceusb 4-1:0.0: Error: mce write submit urb error = -90
[  134.941448][ T5923] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0
[  135.019700][ T5923] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input7
[  135.076684][ T5923] mceusb 4-1:0.0: Error: mce write submit urb error = -90
[  135.112320][ T5955] usb 1-1: new high-speed USB device number 13 using dummy_hcd
[  135.112376][ T5923] mceusb 4-1:0.0: Error: mce write submit urb error = -90
[  135.183124][ T5923] mceusb 4-1:0.0: Error: mce write submit urb error = -90
[  135.222383][ T5923] mceusb 4-1:0.0: Error: mce write submit urb error = -90
[  135.252455][ T5923] mceusb 4-1:0.0: Error: mce write submit urb error = -90
[  135.300470][ T5923] mceusb 4-1:0.0: Error: mce write submit urb error = -90
[  135.312190][ T5955] usb 1-1: Using ep0 maxpacket: 32
[  135.330337][ T5955] usb 1-1: config 0 has an invalid interface number: 12 but max is 0
[  135.363054][ T5923] mceusb 4-1:0.0: Error: mce write submit urb error = -90
[  135.377120][ T5955] usb 1-1: config 0 has no interface number 0
[  135.390642][ T5923] mceusb 4-1:0.0: Error: mce write submit urb error = -90
[  135.400713][ T5955] usb 1-1: config 0 interface 12 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0
[  135.432403][ T5955] usb 1-1: config 0 interface 12 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0
[  135.439745][ T5923] mceusb 4-1:0.0: Error: mce write submit urb error = -90
[  135.465980][ T5955] usb 1-1: config 0 interface 12 has no altsetting 0
[  135.485512][ T5923] mceusb 4-1:0.0: Error: mce write submit urb error = -90
[  135.491500][ T5955] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40
[  135.528239][ T5955] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  135.539636][ T5923] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  135.562051][ T5955] usb 1-1: Product: syz
[  135.584834][ T5923] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  135.588120][ T5955] usb 1-1: Manufacturer: syz
[  135.628823][ T5955] usb 1-1: SerialNumber: syz
[  135.646041][ T5923] usb 4-1: USB disconnect, device number 7
[  135.676256][ T5955] usb 1-1: config 0 descriptor??
[  135.729152][ T5955] f81534 1-1:0.12: unsupported endpoint max packet size
[  135.949160][ T5853] usb 1-1: USB disconnect, device number 13
[  136.831567][ T6484] /dev/rnullb0: Can't open blockdev
[  136.871889][   T30] audit: type=1326 audit(1754556877.950:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.1.137" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  136.898816][ T6484] /dev/rnullb0: Can't open blockdev
[  136.927748][ T6479] /dev/rnullb0: Can't open blockdev
[  136.934902][ T6484] /dev/rnullb0: Can't open blockdev
[  136.988227][   T30] audit: type=1326 audit(1754556877.950:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.1.137" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  137.096291][   T30] audit: type=1326 audit(1754556877.950:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.1.137" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  137.136048][   T30] audit: type=1326 audit(1754556877.960:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.1.137" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fc2f1590b07 code=0x7ffc0000
[  137.261572][   T30] audit: type=1326 audit(1754556877.970:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.1.137" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7fc2f1590a7c code=0x7ffc0000
[  137.309034][   T30] audit: type=1326 audit(1754556877.970:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.1.137" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7fc2f15909b4 code=0x7ffc0000
[  137.395863][   T30] audit: type=1326 audit(1754556877.970:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.1.137" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7fc2f15909b4 code=0x7ffc0000
[  137.481800][   T30] audit: type=1326 audit(1754556877.970:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.1.137" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7fc2f158d84a code=0x7ffc0000
[  137.511922][   T30] audit: type=1326 audit(1754556878.010:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.1.137" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  137.595018][   T30] audit: type=1326 audit(1754556878.020:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.1.137" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  137.892529][ T5853] usb 2-1: new high-speed USB device number 13 using dummy_hcd
[  138.052185][ T5853] usb 2-1: Using ep0 maxpacket: 16
[  138.059426][ T5853] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  138.070936][ T5853] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  138.095880][ T5853] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  138.119853][ T5853] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  138.141036][ T5853] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  138.173764][ T5853] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  138.212195][ T5853] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  138.220695][ T5853] usb 2-1: Manufacturer: syz
[  138.265666][ T5853] usb 2-1: config 0 descriptor??
[  138.278199][ T6517] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4026532037 (8053064074 ns) > initial count (3960471616 ns). Using initial count to start timer.
[  138.383639][ T6522] netlink: 'syz.2.151': attribute type 1 has an invalid length.
[  138.438773][ T6524] netlink: 'syz.3.152': attribute type 11 has an invalid length.
[  138.647273][ T1305] ieee802154 phy0 wpan0: encryption failed: -22
[  138.651847][ T5955] usb 3-1: new high-speed USB device number 7 using dummy_hcd
[  138.655250][ T1305] ieee802154 phy1 wpan1: encryption failed: -22
[  138.772178][ T5853] rc_core: IR keymap rc-hauppauge not found
[  138.781585][ T5853] Registered IR keymap rc-empty
[  138.790534][ T5853] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  138.825342][ T5853] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  138.864709][ T5955] usb 3-1: Using ep0 maxpacket: 16
[  138.874292][ T5853] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0
[  138.887921][ T5955] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  138.902345][ T5955] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  138.914831][ T5853] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input8
[  138.930140][ T5955] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  138.945307][ T5853] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  138.953020][ T5955] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  138.963314][ T5955] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  138.983489][ T5853] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  138.993601][ T5955] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  139.003346][ T5853] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  139.011303][ T5955] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  139.024543][ T5853] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  139.046115][ T5955] usb 3-1: Manufacturer: syz
[  139.054086][ T5955] usb 3-1: config 0 descriptor??
[  139.073701][ T5853] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  139.105171][ T5853] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  139.143433][ T5853] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  139.162342][ T5853] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  139.242340][ T5853] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  139.268236][ T5853] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  139.319409][ T5853] mceusb 2-1:0.0: Registered  with mce emulator interface version 1
[  139.383295][ T5853] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  139.642203][ T5955] rc_core: IR keymap rc-hauppauge not found
[  139.648638][ T5955] Registered IR keymap rc-empty
[  139.673031][ T5853] usb 2-1: USB disconnect, device number 13
[  139.684269][ T5955] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  139.708168][ T5955] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  139.764531][ T6546] /dev/rnullb0: Can't open blockdev
[  139.773481][ T5955] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc1
[  139.829626][ T5955] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc1/input9
[  139.932370][ T5955] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  139.967449][ T5955] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  140.003785][ T6555] /dev/rnullb0: Can't open blockdev
[  140.014560][ T5955] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  140.053823][ T5955] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  140.083607][ T5955] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  140.165252][ T5955] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  140.233112][ T5955] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  140.272784][ T5955] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  140.298938][ T5955] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  140.352394][ T5955] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  140.395879][ T5955] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  140.423967][ T5955] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  140.467729][ T5955] usb 3-1: USB disconnect, device number 7
[  140.517331][ T6565] /dev/rnullb0: Can't open blockdev
[  140.622424][ T5948] usb 2-1: new high-speed USB device number 14 using dummy_hcd
[  140.813432][ T5948] usb 2-1: Using ep0 maxpacket: 8
[  140.824813][ T5948] usb 2-1: config 179 has an invalid interface number: 65 but max is 0
[  140.856636][ T5948] usb 2-1: config 179 has no interface number 0
[  140.873883][ T5948] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7
[  140.906096][ T5948] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024
[  140.919530][ T5948] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  140.932293][ T5948] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0
[  140.943598][ T5948] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23
[  140.958351][ T5948] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb
[  140.970500][ T5948] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  141.001299][ T6563] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  141.015746][ T5948] xpad 2-1:179.65: probe with driver xpad failed with error -5
[  141.166987][ T6580] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem
[  141.240625][ T6563] FAT-fs (rnullb0): bogus number of reserved sectors
[  141.248445][ T6563] FAT-fs (rnullb0): Can't find a valid FAT filesystem
[  141.375140][ T5923] usb 2-1: USB disconnect, device number 14
[  143.059042][ T6626] warning: `syz.2.182' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[  143.073302][ T5923] usb 2-1: new full-speed USB device number 15 using dummy_hcd
[  143.182395][    T9] usb 4-1: new high-speed USB device number 8 using dummy_hcd
[  143.222592][ T5923] usb 2-1: device descriptor read/64, error -71
[  143.347123][    T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  143.365883][    T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  143.380115][    T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  143.404664][    T9] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  143.414910][    T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  143.434178][    T9] usb 4-1: config 0 descriptor??
[  143.462227][ T5923] usb 2-1: new full-speed USB device number 16 using dummy_hcd
[  143.558437][ T6631] openvswitch: netlink: Key 9 has unexpected len 2 expected 4
[  143.612309][ T5923] usb 2-1: device descriptor read/64, error -71
[  143.727952][ T5923] usb usb2-port1: attempt power cycle
[  143.812497][   T10] usb 1-1: new high-speed USB device number 14 using dummy_hcd
[  143.876136][    T9] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0
[  143.972253][   T10] usb 1-1: Using ep0 maxpacket: 16
[  143.980197][   T10] usb 1-1: config 0 has an invalid interface number: 13 but max is 0
[  143.991009][   T10] usb 1-1: config 0 has no interface number 0
[  143.997639][   T10] usb 1-1: config 0 interface 13 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16
[  144.008891][   T10] usb 1-1: config 0 interface 13 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 64
[  144.025189][   T10] usb 1-1: New USB device found, idVendor=0e8d, idProduct=00a7, bcdDevice=b5.31
[  144.037625][   T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  144.047193][   T10] usb 1-1: Product: syz
[  144.051623][   T10] usb 1-1: Manufacturer: syz
[  144.058294][   T10] usb 1-1: SerialNumber: syz
[  144.066264][   T10] usb 1-1: config 0 descriptor??
[  144.073179][ T6631] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22
[  144.081175][ T6631] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22
[  144.082623][ T5923] usb 2-1: new full-speed USB device number 17 using dummy_hcd
[  144.100349][   T10] option 1-1:0.13: GSM modem (1-port) converter detected
[  144.124618][ T5923] usb 2-1: device descriptor read/8, error -71
[  144.301479][   T10] usb 1-1: USB disconnect, device number 14
[  144.325400][   T10] option 1-1:0.13: device disconnected
[  144.373180][ T5923] usb 2-1: new full-speed USB device number 18 using dummy_hcd
[  144.411889][ T5923] usb 2-1: device descriptor read/8, error -71
[  144.505233][    C1] plantronics 0003:047F:FFFF.0005: hid_field_extract() called with n (132) > 32! (syz.3.180)
[  144.533914][ T5923] usb usb2-port1: unable to enumerate USB device
[  144.534830][ T6645] /dev/rnullb0: Can't open blockdev
[  144.736569][ T5948] usb 4-1: USB disconnect, device number 8
[  144.858638][ T6656] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[  144.954646][ T6659] NILFS (rnullb0): couldn't find nilfs on the device
[  145.059583][ T6663] netlink: 'syz.2.194': attribute type 2 has an invalid length.
[  145.068371][ T6663] netlink: 'syz.2.194': attribute type 1 has an invalid length.
[  145.141716][ T6665] Can't find a SQUASHFS superblock on rnullb0
[  146.352681][   T10] usb 4-1: new full-speed USB device number 9 using dummy_hcd
[  146.502187][   T10] usb 4-1: device descriptor read/64, error -71
[  146.742745][   T10] usb 4-1: new full-speed USB device number 10 using dummy_hcd
[  146.860151][ T6726] /dev/rnullb0: Can't open blockdev
[  146.912382][   T10] usb 4-1: device descriptor read/64, error -71
[  147.033482][   T10] usb usb4-port1: attempt power cycle
[  147.098414][ T6731] /dev/rnullb0: Can't open blockdev
[  147.372361][   T10] usb 4-1: new full-speed USB device number 11 using dummy_hcd
[  147.404675][   T10] usb 4-1: device descriptor read/8, error -71
[  147.662187][   T10] usb 4-1: new full-speed USB device number 12 using dummy_hcd
[  147.706228][   T10] usb 4-1: device descriptor read/8, error -71
[  147.787604][ T6739] /dev/rnullb0: Can't open blockdev
[  147.823241][   T10] usb usb4-port1: unable to enumerate USB device
[  147.939950][ T6743] netlink: 8 bytes leftover after parsing attributes in process `syz.1.217'.
[  148.159070][ T6754] No control pipe specified
[  148.307411][ T6757] mac80211_hwsim hwsim8 »»»»»»: renamed from wlan0 (while UP)
[  149.083532][   T10] usb 2-1: new high-speed USB device number 19 using dummy_hcd
[  149.286567][   T10] usb 2-1: Using ep0 maxpacket: 16
[  149.300044][   T10] usb 2-1: config 0 has an invalid interface number: 105 but max is 0
[  149.359546][   T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  149.381818][   T10] usb 2-1: config 0 has no interface number 0
[  149.399863][   T10] usb 2-1: New USB device found, idVendor=046d, idProduct=08d3, bcdDevice= b.28
[  149.412787][   T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  149.426112][   T10] usb 2-1: Product: syz
[  149.435708][   T10] usb 2-1: Manufacturer: syz
[  149.642601][   T10] usb 2-1: SerialNumber: syz
[  149.653237][   T10] usb 2-1: config 0 descriptor??
[  149.669758][   T10] uvcvideo 2-1:0.105: probe with driver uvcvideo failed with error -22
[  150.065437][ T5923] usb 2-1: USB disconnect, device number 19
[  150.428291][ T6780] netlink: 68 bytes leftover after parsing attributes in process `syz.2.227'.
[  150.849552][ T6787] FAULT_INJECTION: forcing a failure.
[  150.849552][ T6787] name failslab, interval 1, probability 0, space 0, times 1
[  150.891666][ T6787] CPU: 1 UID: 0 PID: 6787 Comm: syz.1.229 Not tainted 6.16.0-next-20250806-syzkaller #0 PREEMPT(full) 
[  150.891698][ T6787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  150.891719][ T6787] Call Trace:
[  150.891728][ T6787]  <TASK>
[  150.891736][ T6787]  dump_stack_lvl+0x189/0x250
[  150.891774][ T6787]  ? __pfx____ratelimit+0x10/0x10
[  150.891812][ T6787]  ? __pfx_dump_stack_lvl+0x10/0x10
[  150.891844][ T6787]  ? __pfx__printk+0x10/0x10
[  150.891882][ T6787]  ? __pfx___might_resched+0x10/0x10
[  150.891914][ T6787]  should_fail_ex+0x414/0x560
[  150.891947][ T6787]  ? seq_read_iter+0x1fd/0xe10
[  150.891967][ T6787]  should_failslab+0xa8/0x100
[  150.891993][ T6787]  __kvmalloc_node_noprof+0x161/0x5f0
[  150.892016][ T6787]  ? seq_read_iter+0x1fd/0xe10
[  150.892044][ T6787]  seq_read_iter+0x1fd/0xe10
[  150.892071][ T6787]  ? look_up_lock_class+0x74/0x170
[  150.892114][ T6787]  ? __asan_memset+0x22/0x50
[  150.892151][ T6787]  seq_read+0x369/0x480
[  150.892184][ T6787]  ? __pfx_seq_read+0x10/0x10
[  150.892220][ T6787]  ? rw_verify_area+0x2a6/0x4d0
[  150.892242][ T6787]  ? __lock_acquire+0xab9/0xd20
[  150.892264][ T6787]  ? __pfx_seq_read+0x10/0x10
[  150.892287][ T6787]  vfs_read+0x1fd/0xa30
[  150.892309][ T6787]  ? fdget_pos+0x247/0x320
[  150.892342][ T6787]  ? __pfx___mutex_lock+0x10/0x10
[  150.892375][ T6787]  ? __pfx_vfs_read+0x10/0x10
[  150.892402][ T6787]  ? __fget_files+0x2a/0x420
[  150.892435][ T6787]  ? __fget_files+0x3a0/0x420
[  150.892462][ T6787]  ? __fget_files+0x2a/0x420
[  150.892500][ T6787]  ksys_read+0x145/0x250
[  150.892528][ T6787]  ? __pfx_ksys_read+0x10/0x10
[  150.892549][ T6787]  ? rcu_is_watching+0x15/0xb0
[  150.892582][ T6787]  ? do_syscall_64+0xbe/0x3b0
[  150.892618][ T6787]  do_syscall_64+0xfa/0x3b0
[  150.892648][ T6787]  ? lockdep_hardirqs_on+0x9c/0x150
[  150.892677][ T6787]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  150.892698][ T6787]  ? clear_bhb_loop+0x60/0xb0
[  150.892725][ T6787]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  150.892745][ T6787] RIP: 0033:0x7fc2f158ebe9
[  150.892772][ T6787] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  150.892789][ T6787] RSP: 002b:00007fc2f2487038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  150.892815][ T6787] RAX: ffffffffffffffda RBX: 00007fc2f17b5fa0 RCX: 00007fc2f158ebe9
[  150.892831][ T6787] RDX: 0000000000002020 RSI: 0000200000000040 RDI: 0000000000000003
[  150.892844][ T6787] RBP: 00007fc2f2487090 R08: 0000000000000000 R09: 0000000000000000
[  150.892856][ T6787] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  150.892868][ T6787] R13: 00007fc2f17b6038 R14: 00007fc2f17b5fa0 R15: 00007ffe14cf6788
[  150.892903][ T6787]  </TASK>
[  151.167913][ T5879] Bluetooth: hci4: Entering manufacturer mode failed (-110)
[  151.187533][ T5871] Bluetooth: hci4: command 0xfc11 tx timeout
[  151.328766][ T6790] /dev/rnullb0: Can't open blockdev
[  151.590814][ T6801] /dev/rnullb0: Can't open blockdev
[  151.662345][    T9] usb 2-1: new high-speed USB device number 20 using dummy_hcd
[  151.812619][    T9] usb 2-1: device descriptor read/64, error -71
[  152.082434][    T9] usb 2-1: new high-speed USB device number 21 using dummy_hcd
[  152.243477][    T9] usb 2-1: device descriptor read/64, error -71
[  152.388313][    T9] usb usb2-port1: attempt power cycle
[  152.536471][ T6816] FAULT_INJECTION: forcing a failure.
[  152.536471][ T6816] name fail_usercopy, interval 1, probability 0, space 0, times 1
[  152.555029][ T6816] CPU: 1 UID: 0 PID: 6816 Comm: syz.0.239 Not tainted 6.16.0-next-20250806-syzkaller #0 PREEMPT(full) 
[  152.555060][ T6816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  152.555073][ T6816] Call Trace:
[  152.555082][ T6816]  <TASK>
[  152.555091][ T6816]  dump_stack_lvl+0x189/0x250
[  152.555128][ T6816]  ? __pfx____ratelimit+0x10/0x10
[  152.555158][ T6816]  ? __pfx_dump_stack_lvl+0x10/0x10
[  152.555189][ T6816]  ? __pfx__printk+0x10/0x10
[  152.555220][ T6816]  ? __might_fault+0xb0/0x130
[  152.555254][ T6816]  should_fail_ex+0x414/0x560
[  152.555284][ T6816]  _copy_to_iter+0x3f5/0x16f0
[  152.555319][ T6816]  ? __pfx__copy_to_iter+0x10/0x10
[  152.555340][ T6816]  ? seq_write+0xd8/0x140
[  152.555368][ T6816]  ? sync_info_debugfs_show+0x3e4/0x400
[  152.555407][ T6816]  seq_read_iter+0xbeb/0xe10
[  152.555450][ T6816]  seq_read+0x369/0x480
[  152.555482][ T6816]  ? __pfx_seq_read+0x10/0x10
[  152.555523][ T6816]  ? rw_verify_area+0x2a6/0x4d0
[  152.555545][ T6816]  ? __lock_acquire+0xab9/0xd20
[  152.555565][ T6816]  ? __pfx_seq_read+0x10/0x10
[  152.555588][ T6816]  vfs_read+0x1fd/0xa30
[  152.555611][ T6816]  ? fdget_pos+0x247/0x320
[  152.555643][ T6816]  ? __pfx___mutex_lock+0x10/0x10
[  152.555676][ T6816]  ? __pfx_vfs_read+0x10/0x10
[  152.555700][ T6816]  ? __fget_files+0x2a/0x420
[  152.555733][ T6816]  ? __fget_files+0x3a0/0x420
[  152.555759][ T6816]  ? __fget_files+0x2a/0x420
[  152.555802][ T6816]  ksys_read+0x145/0x250
[  152.555828][ T6816]  ? __pfx_ksys_read+0x10/0x10
[  152.555848][ T6816]  ? rcu_is_watching+0x15/0xb0
[  152.555893][ T6816]  ? do_syscall_64+0xbe/0x3b0
[  152.555930][ T6816]  do_syscall_64+0xfa/0x3b0
[  152.555960][ T6816]  ? lockdep_hardirqs_on+0x9c/0x150
[  152.555990][ T6816]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  152.556011][ T6816]  ? clear_bhb_loop+0x60/0xb0
[  152.556037][ T6816]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  152.556058][ T6816] RIP: 0033:0x7f148738ebe9
[  152.556077][ T6816] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  152.556094][ T6816] RSP: 002b:00007f14855f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  152.556117][ T6816] RAX: ffffffffffffffda RBX: 00007f14875b5fa0 RCX: 00007f148738ebe9
[  152.556132][ T6816] RDX: 0000000000002020 RSI: 0000200000000040 RDI: 0000000000000003
[  152.556145][ T6816] RBP: 00007f14855f6090 R08: 0000000000000000 R09: 0000000000000000
[  152.556158][ T6816] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  152.556170][ T6816] R13: 00007f14875b6038 R14: 00007f14875b5fa0 R15: 00007ffdb6bc8948
[  152.556204][ T6816]  </TASK>
[  152.902231][    T9] usb 2-1: new high-speed USB device number 22 using dummy_hcd
[  152.922963][    T9] usb 2-1: device descriptor read/8, error -71
[  153.098787][ T6822] UDF-fs: warning (device rnullb0): udf_load_vrs: No VRS found
[  153.108177][ T6822] UDF-fs: Scanning with blocksize 4096 failed
[  153.122308][   T10] usb 4-1: new full-speed USB device number 13 using dummy_hcd
[  153.162240][    T9] usb 2-1: new high-speed USB device number 23 using dummy_hcd
[  153.209604][    T9] usb 2-1: device descriptor read/8, error -71
[  153.285009][   T10] usb 4-1: not running at top speed; connect to a high speed hub
[  153.304669][   T10] usb 4-1: config 9 has an invalid interface number: 133 but max is 0
[  153.325186][    T9] usb usb2-port1: unable to enumerate USB device
[  153.344768][   T10] usb 4-1: config 9 has no interface number 0
[  153.357579][   T10] usb 4-1: config 9 interface 133 has no altsetting 0
[  153.369739][   T10] usb 4-1: New USB device found, idVendor=050d, idProduct=0121, bcdDevice=93.9b
[  153.390107][   T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  153.409354][   T10] usb 4-1: Product: syz
[  153.422255][   T10] usb 4-1: Manufacturer: syz
[  153.432398][   T10] usb 4-1: SerialNumber: syz
[  153.503928][ T6837] fuse: Unknown parameter '000000000000000000030x0000000000000003'
[  153.676291][   T10] pegasus 4-1:9.133: probe with driver pegasus failed with error -71
[  153.719765][   T10] usb 4-1: USB disconnect, device number 13
[  154.363276][ T6852] FAULT_INJECTION: forcing a failure.
[  154.363276][ T6852] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  154.390150][ T6852] CPU: 1 UID: 0 PID: 6852 Comm: syz.3.249 Not tainted 6.16.0-next-20250806-syzkaller #0 PREEMPT(full) 
[  154.390180][ T6852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  154.390192][ T6852] Call Trace:
[  154.390199][ T6852]  <TASK>
[  154.390208][ T6852]  dump_stack_lvl+0x189/0x250
[  154.390245][ T6852]  ? __pfx____ratelimit+0x10/0x10
[  154.390275][ T6852]  ? __pfx_dump_stack_lvl+0x10/0x10
[  154.390307][ T6852]  ? __pfx__printk+0x10/0x10
[  154.390338][ T6852]  ? __might_fault+0xb0/0x130
[  154.390370][ T6852]  should_fail_ex+0x414/0x560
[  154.390403][ T6852]  _copy_to_iter+0x3f5/0x16f0
[  154.390438][ T6852]  ? __pfx__copy_to_iter+0x10/0x10
[  154.390459][ T6852]  ? seq_write+0xd8/0x140
[  154.390487][ T6852]  ? sync_info_debugfs_show+0x3e4/0x400
[  154.390646][ T6852]  seq_read_iter+0xbeb/0xe10
[  154.390689][ T6852]  seq_read+0x369/0x480
[  154.390720][ T6852]  ? __pfx_seq_read+0x10/0x10
[  154.390756][ T6852]  ? rw_verify_area+0x2a6/0x4d0
[  154.390778][ T6852]  ? __lock_acquire+0xab9/0xd20
[  154.390800][ T6852]  ? __pfx_seq_read+0x10/0x10
[  154.390824][ T6852]  vfs_read+0x1fd/0xa30
[  154.390847][ T6852]  ? fdget_pos+0x247/0x320
[  154.390881][ T6852]  ? __pfx___mutex_lock+0x10/0x10
[  154.390914][ T6852]  ? __pfx_vfs_read+0x10/0x10
[  154.390938][ T6852]  ? __fget_files+0x2a/0x420
[  154.390971][ T6852]  ? __fget_files+0x3a0/0x420
[  154.390998][ T6852]  ? __fget_files+0x2a/0x420
[  154.391034][ T6852]  ksys_read+0x145/0x250
[  154.391060][ T6852]  ? __pfx_ksys_read+0x10/0x10
[  154.391080][ T6852]  ? rcu_is_watching+0x15/0xb0
[  154.391112][ T6852]  ? do_syscall_64+0xbe/0x3b0
[  154.391148][ T6852]  do_syscall_64+0xfa/0x3b0
[  154.391176][ T6852]  ? lockdep_hardirqs_on+0x9c/0x150
[  154.391204][ T6852]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  154.391224][ T6852]  ? clear_bhb_loop+0x60/0xb0
[  154.391249][ T6852]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  154.391269][ T6852] RIP: 0033:0x7f5f9018ebe9
[  154.391290][ T6852] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  154.391307][ T6852] RSP: 002b:00007f5f90f9b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  154.391416][ T6852] RAX: ffffffffffffffda RBX: 00007f5f903b5fa0 RCX: 00007f5f9018ebe9
[  154.391433][ T6852] RDX: 0000000000002020 RSI: 0000200000000040 RDI: 0000000000000003
[  154.391444][ T6852] RBP: 00007f5f90f9b090 R08: 0000000000000000 R09: 0000000000000000
[  154.391454][ T6852] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  154.391467][ T6852] R13: 00007f5f903b6038 R14: 00007f5f903b5fa0 R15: 00007fff65d807b8
[  154.391612][ T6852]  </TASK>
[  154.762253][   T10] usb 3-1: new full-speed USB device number 8 using dummy_hcd
[  154.918502][   T10] usb 3-1: config 150 has an invalid interface number: 204 but max is 1
[  154.929631][   T10] usb 3-1: config 150 has no interface number 0
[  154.941605][ T6860] netlink: 'syz.3.252': attribute type 1 has an invalid length.
[  154.959225][ T6862] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.
[  154.982233][   T10] usb 3-1: config 150 interface 204 has no altsetting 0
[  155.005026][ T6859] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
[  155.021004][   T10] usb 3-1: config 150 interface 1 has no altsetting 0
[  155.088351][   T10] usb 3-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb
[  155.108702][   T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  155.122175][   T10] usb 3-1: Product: syz
[  155.127055][   T10] usb 3-1: Manufacturer: syz
[  155.137036][   T10] usb 3-1: SerialNumber: syz
[  155.380781][   T10] xr_serial 3-1:150.204: xr_serial converter detected
[  155.424639][ T6869] hpfs: Bad magic ... probably not HPFS
[  155.458862][   T10] xr_serial ttyUSB0: Failed to set reg 0x60: -71
[  155.469886][   T10] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71
[  155.493573][   T10] usb 3-1: USB disconnect, device number 8
[  155.505677][   T10] xr_serial 3-1:150.204: device disconnected
[  155.971977][ T1003] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  155.991104][ T6880] FAULT_INJECTION: forcing a failure.
[  155.991104][ T6880] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  156.050758][ T6880] CPU: 1 UID: 0 PID: 6880 Comm: syz.1.260 Not tainted 6.16.0-next-20250806-syzkaller #0 PREEMPT(full) 
[  156.050788][ T6880] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  156.050801][ T6880] Call Trace:
[  156.050809][ T6880]  <TASK>
[  156.050818][ T6880]  dump_stack_lvl+0x189/0x250
[  156.050856][ T6880]  ? __pfx____ratelimit+0x10/0x10
[  156.050888][ T6880]  ? __pfx_dump_stack_lvl+0x10/0x10
[  156.050920][ T6880]  ? __pfx__printk+0x10/0x10
[  156.050951][ T6880]  ? __might_fault+0xb0/0x130
[  156.050986][ T6880]  should_fail_ex+0x414/0x560
[  156.051020][ T6880]  _copy_from_user+0x2d/0xb0
[  156.051046][ T6880]  kstrtouint_from_user+0xc4/0x170
[  156.051083][ T6880]  ? __pfx_kstrtouint_from_user+0x10/0x10
[  156.051135][ T6880]  proc_fail_nth_write+0x88/0x200
[  156.051156][ T6880]  ? __pfx_proc_fail_nth_write+0x10/0x10
[  156.051183][ T6880]  ? __pfx_proc_fail_nth_write+0x10/0x10
[  156.051205][ T6880]  vfs_write+0x27e/0xb30
[  156.051240][ T6880]  ? __pfx_vfs_write+0x10/0x10
[  156.051266][ T6880]  ? __fget_files+0x2a/0x420
[  156.051298][ T6880]  ? __fget_files+0x3a0/0x420
[  156.051325][ T6880]  ? __fget_files+0x2a/0x420
[  156.051374][ T6880]  ksys_write+0x145/0x250
[  156.051402][ T6880]  ? __pfx_ksys_write+0x10/0x10
[  156.051423][ T6880]  ? rcu_is_watching+0x15/0xb0
[  156.051456][ T6880]  ? do_syscall_64+0xbe/0x3b0
[  156.051492][ T6880]  do_syscall_64+0xfa/0x3b0
[  156.051522][ T6880]  ? lockdep_hardirqs_on+0x9c/0x150
[  156.051552][ T6880]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  156.051572][ T6880]  ? clear_bhb_loop+0x60/0xb0
[  156.051599][ T6880]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  156.051619][ T6880] RIP: 0033:0x7fc2f158d69f
[  156.051636][ T6880] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
[  156.051653][ T6880] RSP: 002b:00007fc2f2487030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[  156.051675][ T6880] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc2f158d69f
[  156.051689][ T6880] RDX: 0000000000000001 RSI: 00007fc2f24870a0 RDI: 0000000000000005
[  156.051703][ T6880] RBP: 00007fc2f2487090 R08: 0000000000000000 R09: 0000000000000000
[  156.051715][ T6880] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
[  156.051728][ T6880] R13: 00007fc2f17b6038 R14: 00007fc2f17b5fa0 R15: 00007ffe14cf6788
[  156.051761][ T6880]  </TASK>
[  156.508437][ T1003] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  156.624697][ T6887] /dev/rnullb0: Can't open blockdev
[  156.695835][ T1003] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  156.792206][   T10] usb 3-1: new high-speed USB device number 9 using dummy_hcd
[  156.890726][ T1003] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  156.912639][ T5954] usb 2-1: new high-speed USB device number 24 using dummy_hcd
[  156.915300][ T6891] netlink: 108 bytes leftover after parsing attributes in process `syz.0.265'.
[  156.964336][   T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  156.982190][   T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  157.003183][ T6891] netlink: 8 bytes leftover after parsing attributes in process `syz.0.265'.
[  157.022264][   T10] usb 3-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00
[  157.054070][   T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  157.082469][ T5954] usb 2-1: Using ep0 maxpacket: 32
[  157.102924][   T10] usb 3-1: config 0 descriptor??
[  157.114653][ T5954] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  157.137148][ T6892] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.265'.
[  157.143236][ T5954] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  157.190810][ T5954] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40
[  157.212906][ T5871] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  157.226345][ T5871] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  157.232415][ T5954] usb 2-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0
[  157.238892][ T6892] ucma_write: process 195 (syz.0.265) changed security contexts after opening file descriptor, this is not allowed.
[  157.264705][ T6892] syz.0.265: attempt to access beyond end of device
[  157.264705][ T6892] loop0: rw=0, sector=1, nr_sectors = 1 limit=0
[  157.280089][ T5871] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  157.290016][ T6892] qnx4: unable to read the superblock
[  157.299548][ T5871] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  157.307963][ T5954] usb 2-1: Product: syz
[  157.314617][ T5871] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  157.341040][ T6891] netlink: 'syz.0.265': attribute type 21 has an invalid length.
[  157.352035][ T5954] usb 2-1: Manufacturer: syz
[  157.393794][ T6891] netlink: 4 bytes leftover after parsing attributes in process `syz.0.265'.
[  157.431896][ T5954] hub 2-1:4.0: USB hub found
[  157.653366][ T1003] bridge_slave_1: left allmulticast mode
[  157.667931][ T5954] hub 2-1:4.0: 2 ports detected
[  157.679608][ T1003] bridge_slave_1: left promiscuous mode
[  157.701556][ T1003] bridge0: port 2(bridge_slave_1) entered disabled state
[  157.715871][ T6883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  157.726998][ T6883] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  157.814339][ T1003] bridge_slave_0: left allmulticast mode
[  157.820812][ T1003] bridge_slave_0: left promiscuous mode
[  158.078821][ T1003] bridge0: port 1(bridge_slave_0) entered disabled state
[  158.096570][   T10] usbhid 3-1:0.0: can't add hid device: -71
[  158.106443][   T10] usbhid 3-1:0.0: probe with driver usbhid failed with error -71
[  158.169282][   T10] usb 3-1: USB disconnect, device number 9
[  159.010978][ T5954] hub 2-1:4.0: activate --> -90
[  159.216112][ T5948] hub 2-1:4.0: hub_ext_port_status failed (err = -71)
[  159.234495][   T10] usb 2-1: USB disconnect, device number 24
[  159.379211][ T1003] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  159.430868][ T1003] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  159.444044][ T5879] Bluetooth: hci2: command tx timeout
[  159.494555][ T1003] bond0 (unregistering): Released all slaves
[  161.019321][ T6960] sp0: Synchronizing with TNC
[  161.151454][ T6960] trusted_key: syz.0.278 sent an empty control message without MSG_MORE.
[  161.198640][ T1003] hsr_slave_0: left promiscuous mode
[  161.234241][ T1003] hsr_slave_1: left promiscuous mode
[  161.247879][ T1003] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  161.389995][ T1003] batman_adv: batadv0: Removing interface: batadv_slave_0
[  161.448000][ T1003] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  161.470166][ T1003] batman_adv: batadv0: Removing interface: batadv_slave_1
[  161.525405][ T5879] Bluetooth: hci2: command tx timeout
[  161.577333][ T1003] veth1_macvtap: left promiscuous mode
[  161.634760][ T1003] veth0_macvtap: left promiscuous mode
[  161.663192][ T1003] veth1_vlan: left promiscuous mode
[  161.669068][ T1003] veth0_vlan: left promiscuous mode
[  162.527473][ T1003] team0 (unregistering): Port device team_slave_1 removed
[  162.628642][ T1003] team0 (unregistering): Port device team_slave_0 removed
[  162.866868][ T7003] mmap: syz.2.282 (7003) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
[  163.636804][ T5879] Bluetooth: hci2: command tx timeout
[  164.025180][ T6893] chnl_net:caif_netlink_parms(): no params data found
[  164.444073][ T6893] bridge0: port 1(bridge_slave_0) entered blocking state
[  164.455103][ T6893] bridge0: port 1(bridge_slave_0) entered disabled state
[  164.456285][ T7031] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5)
[  164.464751][ T6893] bridge_slave_0: entered allmulticast mode
[  164.470094][ T7031] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
[  164.505671][ T6893] bridge_slave_0: entered promiscuous mode
[  164.525507][ T6893] bridge0: port 2(bridge_slave_1) entered blocking state
[  164.553629][ T7031] vhci_hcd vhci_hcd.0: Device attached
[  164.561065][ T7035] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(8)
[  164.568430][ T7035] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
[  164.577822][ T6893] bridge0: port 2(bridge_slave_1) entered disabled state
[  164.606747][ T6893] bridge_slave_1: entered allmulticast mode
[  164.629807][ T6893] bridge_slave_1: entered promiscuous mode
[  164.649635][ T7035] vhci_hcd vhci_hcd.0: Device attached
[  164.707702][ T7031] process 'syz.1.289' launched './file0' with NULL argv: empty string added
[  164.872251][    T9] usb 35-1: new low-speed USB device number 2 using vhci_hcd
[  164.940000][ T6893] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  164.995963][ T6893] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  165.186749][ T6893] team0: Port device team_slave_0 added
[  165.225673][ T6893] team0: Port device team_slave_1 added
[  165.395751][ T6893] batman_adv: batadv0: Adding interface: batadv_slave_0
[  165.422230][ T6893] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  165.449836][    C0] vkms_vblank_simulate: vblank timer overrun
[  165.523283][ T6893] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  165.670014][ T6893] batman_adv: batadv0: Adding interface: batadv_slave_1
[  165.683267][ T5879] Bluetooth: hci2: command tx timeout
[  165.696512][ T6893] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  165.808697][ T6893] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  165.876560][ T7066] rose0: entered allmulticast mode
[  165.945857][ T7070] ntfs3(rnullb0): Primary boot signature is not NTFS.
[  165.988097][ T7070] ntfs3(rnullb0): Alternative boot signature is not NTFS.
[  166.100307][ T6893] hsr_slave_0: entered promiscuous mode
[  166.137476][ T6893] hsr_slave_1: entered promiscuous mode
[  166.273943][ T5853] usb 1-1: new high-speed USB device number 15 using dummy_hcd
[  166.349933][ T7078] netlink: 8 bytes leftover after parsing attributes in process `syz.2.301'.
[  166.432373][ T5853] usb 1-1: device descriptor read/64, error -71
[  166.676875][ T5853] usb 1-1: new high-speed USB device number 16 using dummy_hcd
[  166.823355][ T5853] usb 1-1: device descriptor read/64, error -71
[  166.840185][ T6893] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  166.885751][ T6893] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  166.929124][ T6893] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  166.966617][ T5853] usb usb1-port1: attempt power cycle
[  167.031624][ T6893] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  167.332196][ T5853] usb 1-1: new high-speed USB device number 17 using dummy_hcd
[  167.349513][ T6893] 8021q: adding VLAN 0 to HW filter on device bond0
[  167.385036][ T5853] usb 1-1: device descriptor read/8, error -71
[  167.423922][ T6893] 8021q: adding VLAN 0 to HW filter on device team0
[  167.451957][ T1341] bridge0: port 1(bridge_slave_0) entered blocking state
[  167.460755][ T1341] bridge0: port 1(bridge_slave_0) entered forwarding state
[  167.518535][ T1003] bridge0: port 2(bridge_slave_1) entered blocking state
[  167.527024][ T1003] bridge0: port 2(bridge_slave_1) entered forwarding state
[  167.617361][ T7036] vhci_hcd: connection closed
[  167.618813][ T7032] vhci_hcd: connection reset by peer
[  167.630108][ T5853] usb 1-1: new high-speed USB device number 18 using dummy_hcd
[  167.670620][ T1341] vhci_hcd: stop threads
[  167.674024][ T5853] usb 1-1: device descriptor read/8, error -71
[  167.689806][ T1341] vhci_hcd: release socket
[  167.716743][ T1341] vhci_hcd: disconnect device
[  167.726369][ T1341] vhci_hcd: stop threads
[  167.730980][ T1341] vhci_hcd: release socket
[  167.753015][ T1341] vhci_hcd: disconnect device
[  167.802767][ T5853] usb usb1-port1: unable to enumerate USB device
[  168.060392][ T6893] 8021q: adding VLAN 0 to HW filter on device batadv0
[  168.927822][ T6893] veth0_vlan: entered promiscuous mode
[  168.932042][ T7143] nbd: couldn't find device at index 587202560
[  168.955392][ T7143] nfs: Unknown parameter '/dev/rnullb0'
[  168.981742][ T6893] veth1_vlan: entered promiscuous mode
[  168.991582][ T7143] /dev/rnullb0: Can't open blockdev
[  169.147723][ T6893] veth0_macvtap: entered promiscuous mode
[  169.199910][ T6893] veth1_macvtap: entered promiscuous mode
[  169.278327][ T6893] batman_adv: batadv0: Interface activated: batadv_slave_0
[  169.301237][ T6893] batman_adv: batadv0: Interface activated: batadv_slave_1
[  169.366712][   T49] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  169.396803][   T49] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  169.447188][ T1341] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  169.472223][ T1341] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  169.659168][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  169.700508][   T10] usb 1-1: new low-speed USB device number 19 using dummy_hcd
[  169.727903][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  169.820140][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  169.857769][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  169.892674][   T10] usb 1-1: Invalid ep0 maxpacket: 64
[  170.007143][    T9] vhci_hcd: vhci_device speed not set
[  170.032361][   T10] usb 1-1: new low-speed USB device number 20 using dummy_hcd
[  170.196757][   T10] usb 1-1: Invalid ep0 maxpacket: 64
[  170.221442][   T10] usb usb1-port1: attempt power cycle
[  170.295132][   T92] usb 2-1: new high-speed USB device number 25 using dummy_hcd
[  170.355104][ T7154] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[  170.453190][   T92] usb 2-1: device descriptor read/64, error -71
[  170.532329][ T7154] usb 5-1: Using ep0 maxpacket: 16
[  170.571826][ T7154] usb 5-1: New USB device found, idVendor=0483, idProduct=1234, bcdDevice=ff.76
[  170.584051][   T10] usb 1-1: new low-speed USB device number 21 using dummy_hcd
[  170.612319][ T7154] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  170.621178][ T7154] usb 5-1: Product: syz
[  170.717411][   T10] usb 1-1: Invalid ep0 maxpacket: 64
[  170.736193][ T7154] usb 5-1: Manufacturer: syz
[  170.741145][ T7154] usb 5-1: SerialNumber: syz
[  170.761050][ T7154] usb 5-1: config 0 descriptor??
[  170.773629][   T92] usb 2-1: new high-speed USB device number 26 using dummy_hcd
[  170.863114][   T10] usb 1-1: new low-speed USB device number 22 using dummy_hcd
[  170.902838][   T10] usb 1-1: Invalid ep0 maxpacket: 64
[  170.913419][   T92] usb 2-1: device descriptor read/64, error -71
[  170.921740][   T10] usb usb1-port1: unable to enumerate USB device
[  171.024632][   T92] usb usb2-port1: attempt power cycle
[  171.047125][ T7154] usb_8dev 5-1:0.0 can0: sending command message failed
[  171.055681][ T7198] netlink: 8 bytes leftover after parsing attributes in process `syz.2.320'.
[  171.071700][ T7198] hpfs: Bad magic ... probably not HPFS
[  171.075106][ T7154] usb_8dev 5-1:0.0 can0: can't get firmware version
[  171.170339][ T7202] FAULT_INJECTION: forcing a failure.
[  171.170339][ T7202] name failslab, interval 1, probability 0, space 0, times 0
[  171.185354][ T7154] usb_8dev 5-1:0.0: probe with driver usb_8dev failed with error -22
[  171.191178][ T7202] CPU: 1 UID: 0 PID: 7202 Comm: syz.2.321 Not tainted 6.16.0-next-20250806-syzkaller #0 PREEMPT(full) 
[  171.191219][ T7202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  171.191237][ T7202] Call Trace:
[  171.191248][ T7202]  <TASK>
[  171.191261][ T7202]  dump_stack_lvl+0x189/0x250
[  171.191307][ T7202]  ? __pfx____ratelimit+0x10/0x10
[  171.191348][ T7202]  ? __pfx_dump_stack_lvl+0x10/0x10
[  171.191388][ T7202]  ? __pfx__printk+0x10/0x10
[  171.191437][ T7202]  ? __pfx___might_resched+0x10/0x10
[  171.191470][ T7202]  ? fs_reclaim_acquire+0x7d/0x100
[  171.191509][ T7202]  should_fail_ex+0x414/0x560
[  171.191557][ T7202]  should_failslab+0xa8/0x100
[  171.191590][ T7202]  __kmalloc_noprof+0xcb/0x4f0
[  171.191615][ T7202]  ? kfree+0x4d/0x440
[  171.191635][ T7202]  ? tomoyo_realpath_from_path+0xe3/0x5d0
[  171.191681][ T7202]  tomoyo_realpath_from_path+0xe3/0x5d0
[  171.191725][ T7202]  ? tomoyo_domain+0xd9/0x130
[  171.191771][ T7202]  ? tomoyo_path_number_perm+0x1bc/0x5a0
[  171.191804][ T7202]  tomoyo_path_number_perm+0x1e8/0x5a0
[  171.191848][ T7202]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[  171.191886][ T7202]  ? __lock_acquire+0xab9/0xd20
[  171.191936][ T7202]  ? __fget_files+0x2a/0x420
[  171.191980][ T7202]  ? __fget_files+0x2a/0x420
[  171.192015][ T7202]  ? __fget_files+0x3a0/0x420
[  171.192049][ T7202]  ? __fget_files+0x2a/0x420
[  171.192096][ T7202]  security_file_ioctl+0xcb/0x2d0
[  171.192130][ T7202]  __se_sys_ioctl+0x47/0x170
[  171.192163][ T7202]  do_syscall_64+0xfa/0x3b0
[  171.192202][ T7202]  ? lockdep_hardirqs_on+0x9c/0x150
[  171.192240][ T7202]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  171.192267][ T7202]  ? clear_bhb_loop+0x60/0xb0
[  171.192300][ T7202]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  171.192327][ T7202] RIP: 0033:0x7f13dfb8ebe9
[  171.192351][ T7202] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  171.192372][ T7202] RSP: 002b:00007f13e0997038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  171.192401][ T7202] RAX: ffffffffffffffda RBX: 00007f13dfdb5fa0 RCX: 00007f13dfb8ebe9
[  171.192421][ T7202] RDX: 00002000000000c0 RSI: 0000000000004b47 RDI: 0000000000000003
[  171.192438][ T7202] RBP: 00007f13e0997090 R08: 0000000000000000 R09: 0000000000000000
[  171.192454][ T7202] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  171.192471][ T7202] R13: 00007f13dfdb6038 R14: 00007f13dfdb5fa0 R15: 00007ffd0e380948
[  171.192512][ T7202]  </TASK>
[  171.196384][ T7202] ERROR: Out of memory at tomoyo_realpath_from_path.
[  171.234493][ T7154] usb 5-1: USB disconnect, device number 2
[  171.542202][   T92] usb 2-1: new high-speed USB device number 27 using dummy_hcd
[  171.571095][   T92] usb 2-1: device descriptor read/8, error -71
[  171.712812][ T7211] ./cgroup: Can't lookup blockdev
[  171.822220][   T92] usb 2-1: new high-speed USB device number 28 using dummy_hcd
[  171.888554][   T92] usb 2-1: device descriptor read/8, error -71
[  172.014860][   T92] usb usb2-port1: unable to enumerate USB device
[  172.322682][   T92] usb 5-1: new high-speed USB device number 3 using dummy_hcd
[  172.476626][ T7236] UDF-fs: warning (device rnullb0): udf_load_vrs: No VRS found
[  172.476680][ T7236] UDF-fs: Scanning with blocksize 4096 failed
[  172.490226][   T92] usb 5-1: Using ep0 maxpacket: 16
[  172.505689][   T92] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  172.505748][   T92] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  172.505778][   T92] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  172.505800][   T92] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  172.505824][   T92] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  172.515615][   T92] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  172.515650][   T92] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  172.515675][   T92] usb 5-1: Manufacturer: syz
[  172.523769][   T92] usb 5-1: config 0 descriptor??
[  172.665001][ T5948] usb 1-1: new full-speed USB device number 23 using dummy_hcd
[  172.816131][   T92] rc_core: IR keymap rc-hauppauge not found
[  172.821945][ T5948] usb 1-1: not running at top speed; connect to a high speed hub
[  172.824524][ T5948] usb 1-1: config 106 has an invalid interface number: 192 but max is 2
[  172.830512][   T92] Registered IR keymap rc-empty
[  172.849856][   T92] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  172.864853][ T5948] usb 1-1: config 106 has an invalid interface number: 175 but max is 2
[  172.876701][ T5948] usb 1-1: config 106 has an invalid descriptor of length 0, skipping remainder of the config
[  172.893756][   T92] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  172.897209][ T5948] usb 1-1: config 106 has 2 interfaces, different from the descriptor's value: 3
[  172.911067][ T5948] usb 1-1: config 106 has no interface number 0
[  172.920842][ T5948] usb 1-1: config 106 has no interface number 1
[  172.928827][ T5948] usb 1-1: config 106 interface 192 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 12
[  172.933619][   T92] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0
[  172.950088][ T5948] usb 1-1: too many endpoints for config 106 interface 175 altsetting 201: 223, using maximum allowed: 30
[  172.981032][ T5948] usb 1-1: config 106 interface 175 altsetting 201 endpoint 0x7 has invalid maxpacket 1023, setting to 64
[  172.995025][   T92] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input10
[  172.999052][ T5948] usb 1-1: config 106 interface 175 altsetting 201 has an endpoint descriptor with address 0x32, changing to 0x2
[  173.026616][ T5948] usb 1-1: config 106 interface 175 altsetting 201 endpoint 0x2 has invalid maxpacket 24555, setting to 64
[  173.038818][ T5948] usb 1-1: config 106 interface 175 altsetting 201 has 5 endpoint descriptors, different from the interface descriptor's value: 223
[  173.040287][   T92] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  173.058204][ T5948] usb 1-1: config 106 interface 192 has no altsetting 0
[  173.122674][   T92] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  173.129684][ T5948] usb 1-1: config 106 interface 175 has no altsetting 0
[  173.151545][ T5948] usb 1-1: string descriptor 0 read error: -22
[  173.172299][   T92] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  173.173341][ T5948] usb 1-1: New USB device found, idVendor=0b00, idProduct=3070, bcdDevice=10.07
[  173.205924][   T92] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  173.211150][ T5948] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  173.229347][ T7252] FAULT_INJECTION: forcing a failure.
[  173.229347][ T7252] name failslab, interval 1, probability 0, space 0, times 0
[  173.244007][   T92] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  173.251376][ T7252] CPU: 0 UID: 0 PID: 7252 Comm: syz.1.331 Not tainted 6.16.0-next-20250806-syzkaller #0 PREEMPT(full) 
[  173.251404][ T7252] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  173.251422][ T7252] Call Trace:
[  173.251430][ T7252]  <TASK>
[  173.251438][ T7252]  dump_stack_lvl+0x189/0x250
[  173.251474][ T7252]  ? __pfx____ratelimit+0x10/0x10
[  173.251508][ T7252]  ? __pfx_dump_stack_lvl+0x10/0x10
[  173.251540][ T7252]  ? __pfx__printk+0x10/0x10
[  173.251573][ T7252]  ? __pfx___might_resched+0x10/0x10
[  173.251599][ T7252]  ? fs_reclaim_acquire+0x7d/0x100
[  173.251630][ T7252]  should_fail_ex+0x414/0x560
[  173.251663][ T7252]  should_failslab+0xa8/0x100
[  173.251687][ T7252]  __kmalloc_noprof+0xcb/0x4f0
[  173.251707][ T7252]  ? tomoyo_encode+0x28b/0x550
[  173.251742][ T7252]  tomoyo_encode+0x28b/0x550
[  173.251777][ T7252]  tomoyo_realpath_from_path+0x58d/0x5d0
[  173.251818][ T7252]  ? tomoyo_path_number_perm+0x1bc/0x5a0
[  173.251844][ T7252]  tomoyo_path_number_perm+0x1e8/0x5a0
[  173.251889][ T7252]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[  173.251929][ T7252]  ? __lock_acquire+0xab9/0xd20
[  173.251973][ T7252]  ? __fget_files+0x2a/0x420
[  173.252004][ T7252]  ? __fget_files+0x2a/0x420
[  173.252029][ T7252]  ? __fget_files+0x3a0/0x420
[  173.252055][ T7252]  ? __fget_files+0x2a/0x420
[  173.252087][ T7252]  security_file_ioctl+0xcb/0x2d0
[  173.252111][ T7252]  __se_sys_ioctl+0x47/0x170
[  173.252137][ T7252]  do_syscall_64+0xfa/0x3b0
[  173.252166][ T7252]  ? lockdep_hardirqs_on+0x9c/0x150
[  173.252195][ T7252]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  173.252216][ T7252]  ? clear_bhb_loop+0x60/0xb0
[  173.252242][ T7252]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  173.252262][ T7252] RIP: 0033:0x7fc2f158ebe9
[  173.252282][ T7252] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  173.252299][ T7252] RSP: 002b:00007fc2f2487038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  173.252321][ T7252] RAX: ffffffffffffffda RBX: 00007fc2f17b5fa0 RCX: 00007fc2f158ebe9
[  173.252337][ T7252] RDX: 00002000000000c0 RSI: 0000000000004b47 RDI: 0000000000000003
[  173.252350][ T7252] RBP: 00007fc2f2487090 R08: 0000000000000000 R09: 0000000000000000
[  173.252363][ T7252] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  173.252375][ T7252] R13: 00007fc2f17b6038 R14: 00007fc2f17b5fa0 R15: 00007ffe14cf6788
[  173.252409][ T7252]  </TASK>
[  173.258978][ T5948] cp210x 1-1:106.192: cp210x converter detected
[  173.266109][   T92] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  173.306908][ T7252] ERROR: Out of memory at tomoyo_realpath_from_path.
[  173.352368][   T92] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  173.613684][ T7258] Mount JFS Failure: -22
[  173.810142][ T5948] cp210x 1-1:106.192: failed to get vendor val 0x370b size 1: -71
[  173.852238][ T5948] cp210x 1-1:106.192: querying part number failed
[  173.921195][ T5948] usb 1-1: cp210x converter now attached to ttyUSB0
[  173.962327][   T92] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  173.975468][ T5948] cp210x 1-1:106.175: cp210x converter detected
[  173.996668][   T92] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  174.006309][ T7271] Mount JFS Failure: -22
[  174.012651][ T5948] cp210x 1-1:106.175: failed to get vendor val 0x370b size 1: -71
[  174.047499][ T7271] netlink: 'syz.0.335': attribute type 4 has an invalid length.
[  174.059557][ T5948] cp210x 1-1:106.175: querying part number failed
[  174.103211][   T92] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  174.152811][ T5948] usb 1-1: cp210x converter now attached to ttyUSB1
[  174.174470][   T92] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  174.235195][   T92] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  174.258198][ T5948] usb 1-1: USB disconnect, device number 23
[  174.312802][   T92] usb 5-1: USB disconnect, device number 3
[  174.324081][ T5948] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0
[  174.374698][ T5948] cp210x 1-1:106.192: device disconnected
[  174.439099][ T5948] cp210x ttyUSB1: cp210x converter now disconnected from ttyUSB1
[  174.470874][ T7283] FAULT_INJECTION: forcing a failure.
[  174.470874][ T7283] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  174.509070][ T5948] cp210x 1-1:106.175: device disconnected
[  174.516363][ T7283] CPU: 0 UID: 0 PID: 7283 Comm: syz.2.341 Not tainted 6.16.0-next-20250806-syzkaller #0 PREEMPT(full) 
[  174.516394][ T7283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  174.516407][ T7283] Call Trace:
[  174.516415][ T7283]  <TASK>
[  174.516424][ T7283]  dump_stack_lvl+0x189/0x250
[  174.516472][ T7283]  ? __pfx____ratelimit+0x10/0x10
[  174.516504][ T7283]  ? __pfx_dump_stack_lvl+0x10/0x10
[  174.516535][ T7283]  ? __pfx__printk+0x10/0x10
[  174.516567][ T7283]  ? __might_fault+0xb0/0x130
[  174.516600][ T7283]  should_fail_ex+0x414/0x560
[  174.516633][ T7283]  _copy_from_user+0x2d/0xb0
[  174.516658][ T7283]  vt_do_kdsk_ioctl+0xbb/0xbe0
[  174.516698][ T7283]  ? __pfx_vt_do_kdsk_ioctl+0x10/0x10
[  174.516731][ T7283]  ? bpf_lsm_capable+0x9/0x20
[  174.516752][ T7283]  ? security_capable+0x7e/0x2e0
[  174.516786][ T7283]  vt_ioctl+0x9ae/0x1f00
[  174.516819][ T7283]  ? __pfx_vt_ioctl+0x10/0x10
[  174.516861][ T7283]  ? __fget_files+0x2a/0x420
[  174.516894][ T7283]  ? __fget_files+0x3a0/0x420
[  174.516921][ T7283]  ? __fget_files+0x2a/0x420
[  174.516952][ T7283]  tty_ioctl+0x926/0xde0
[  174.516984][ T7283]  ? __pfx_tty_ioctl+0x10/0x10
[  174.517016][ T7283]  __se_sys_ioctl+0xf9/0x170
[  174.517041][ T7283]  do_syscall_64+0xfa/0x3b0
[  174.517072][ T7283]  ? lockdep_hardirqs_on+0x9c/0x150
[  174.517101][ T7283]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  174.517122][ T7283]  ? clear_bhb_loop+0x60/0xb0
[  174.517149][ T7283]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  174.517169][ T7283] RIP: 0033:0x7f13dfb8ebe9
[  174.517188][ T7283] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  174.517205][ T7283] RSP: 002b:00007f13e0997038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  174.517227][ T7283] RAX: ffffffffffffffda RBX: 00007f13dfdb5fa0 RCX: 00007f13dfb8ebe9
[  174.517242][ T7283] RDX: 00002000000000c0 RSI: 0000000000004b47 RDI: 0000000000000003
[  174.517256][ T7283] RBP: 00007f13e0997090 R08: 0000000000000000 R09: 0000000000000000
[  174.517268][ T7283] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  174.517280][ T7283] R13: 00007f13dfdb6038 R14: 00007f13dfdb5fa0 R15: 00007ffd0e380948
[  174.517316][ T7283]  </TASK>
[  174.682330][ T5853] usb 2-1: new high-speed USB device number 29 using dummy_hcd
[  174.821080][    C1] vkms_vblank_simulate: vblank timer overrun
[  175.372193][ T5954] usb 5-1: new high-speed USB device number 4 using dummy_hcd
[  175.380454][ T5853] usb 2-1: device descriptor read/64, error -71
[  175.532370][ T5954] usb 5-1: Using ep0 maxpacket: 16
[  175.552840][ T5954] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  175.568940][ T5954] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  175.593402][ T5954] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  175.615799][ T5954] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  175.633151][ T5853] usb 2-1: new high-speed USB device number 30 using dummy_hcd
[  175.644058][ T5954] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  175.661746][ T5954] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  175.692589][ T5954] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  175.724000][ T5954] usb 5-1: Manufacturer: syz
[  175.753713][ T5954] usb 5-1: config 0 descriptor??
[  175.782265][ T5853] usb 2-1: device descriptor read/64, error -71
[  175.892876][ T5853] usb usb2-port1: attempt power cycle
[  175.946691][ T7309] FAT-fs (rnullb0): bogus number of reserved sectors
[  175.968100][ T7309] FAT-fs (rnullb0): Can't find a valid FAT filesystem
[  176.093104][ T5954] rc_core: IR keymap rc-hauppauge not found
[  176.099447][ T5954] Registered IR keymap rc-empty
[  176.106195][ T5954] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  176.132490][ T5954] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  176.168304][ T5954] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0
[  176.213383][ T5954] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input11
[  176.400020][ T5853] usb 2-1: new high-speed USB device number 31 using dummy_hcd
[  176.451646][ T5954] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  176.461349][ T5853] usb 2-1: device descriptor read/8, error -71
[  176.494327][ T5954] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  176.522372][ T5954] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  176.552494][ T5954] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  176.591532][ T5954] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  176.615406][ T5954] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  176.653452][ T5954] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  176.682810][ T5954] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  176.704076][ T5853] usb 2-1: new high-speed USB device number 32 using dummy_hcd
[  176.712499][ T5954] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  176.733273][ T5853] usb 2-1: device descriptor read/8, error -71
[  176.742242][ T5954] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  176.777166][ T5954] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  176.795711][   T30] kauditd_printk_skb: 6 callbacks suppressed
[  176.795731][   T30] audit: type=1326 audit(1754556917.890:18): auid=4294967295 uid=16832 gid=0 ses=4294967295 subj=unconfined pid=7320 comm="syz.2.351" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f13dfb8ebe9 code=0x0
[  176.812240][ T5954] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  176.840867][ T7326] FAULT_INJECTION: forcing a failure.
[  176.840867][ T7326] name failslab, interval 1, probability 0, space 0, times 0
[  176.866981][ T5853] usb usb2-port1: unable to enumerate USB device
[  176.873608][ T7326] CPU: 0 UID: 0 PID: 7326 Comm: syz.0.352 Not tainted 6.16.0-next-20250806-syzkaller #0 PREEMPT(full) 
[  176.873658][ T7326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  176.873674][ T7326] Call Trace:
[  176.873683][ T7326]  <TASK>
[  176.873693][ T7326]  dump_stack_lvl+0x189/0x250
[  176.873734][ T7326]  ? __pfx____ratelimit+0x10/0x10
[  176.873771][ T7326]  ? __pfx_dump_stack_lvl+0x10/0x10
[  176.873806][ T7326]  ? __pfx__printk+0x10/0x10
[  176.873849][ T7326]  ? __pfx___might_resched+0x10/0x10
[  176.873878][ T7326]  ? fs_reclaim_acquire+0x7d/0x100
[  176.873911][ T7326]  should_fail_ex+0x414/0x560
[  176.873947][ T7326]  should_failslab+0xa8/0x100
[  176.873976][ T7326]  __kmalloc_cache_noprof+0x70/0x3d0
[  176.874000][ T7326]  ? vt_do_kdsk_ioctl+0x582/0xbe0
[  176.874044][ T7326]  vt_do_kdsk_ioctl+0x582/0xbe0
[  176.874088][ T7326]  ? __pfx_vt_do_kdsk_ioctl+0x10/0x10
[  176.874126][ T7326]  ? bpf_lsm_capable+0x9/0x20
[  176.874148][ T7326]  ? security_capable+0x7e/0x2e0
[  176.874188][ T7326]  vt_ioctl+0x9ae/0x1f00
[  176.874224][ T7326]  ? __pfx_vt_ioctl+0x10/0x10
[  176.874271][ T7326]  ? __fget_files+0x2a/0x420
[  176.874315][ T7326]  ? __fget_files+0x3a0/0x420
[  176.874345][ T7326]  ? __fget_files+0x2a/0x420
[  176.874380][ T7326]  tty_ioctl+0x926/0xde0
[  176.874417][ T7326]  ? __pfx_tty_ioctl+0x10/0x10
[  176.874453][ T7326]  __se_sys_ioctl+0xf9/0x170
[  176.874479][ T7326]  do_syscall_64+0xfa/0x3b0
[  176.874514][ T7326]  ? lockdep_hardirqs_on+0x9c/0x150
[  176.874549][ T7326]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  176.874571][ T7326]  ? clear_bhb_loop+0x60/0xb0
[  176.874600][ T7326]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  176.874622][ T7326] RIP: 0033:0x7f148738ebe9
[  176.874643][ T7326] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  176.874664][ T7326] RSP: 002b:00007f14855f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  176.874689][ T7326] RAX: ffffffffffffffda RBX: 00007f14875b5fa0 RCX: 00007f148738ebe9
[  176.874706][ T7326] RDX: 00002000000000c0 RSI: 0000000000004b47 RDI: 0000000000000003
[  176.874720][ T7326] RBP: 00007f14855f6090 R08: 0000000000000000 R09: 0000000000000000
[  176.874735][ T7326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  176.874748][ T7326] R13: 00007f14875b6038 R14: 00007f14875b5fa0 R15: 00007ffdb6bc8948
[  176.874789][ T7326]  </TASK>
[  176.879906][ T7327] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[  176.917540][ T5954] usb 5-1: USB disconnect, device number 4
[  176.937195][ T7327] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock
[  177.008993][ T7321] could not allocate digest TFM handle sha512-avx2
[  177.017764][ T7327] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[  177.189399][ T7327] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock
[  177.520538][ T7339] input: syz0 as /devices/virtual/input/input12
[  177.620729][ T7337] /dev/rnullb0: Can't open blockdev
[  177.692342][ T5954] usb 5-1: new full-speed USB device number 5 using dummy_hcd
[  177.783962][ T7346] /dev/rnullb0: Can't open blockdev
[  177.854624][ T5954] usb 5-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43
[  177.901708][ T5954] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  177.955335][ T5954] usb 5-1: config 0 descriptor??
[  177.964560][ T5954] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state.
[  178.057794][ T7350] /dev/rnullb0: Can't open blockdev
[  178.084414][ T7352] FAULT_INJECTION: forcing a failure.
[  178.084414][ T7352] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  178.118354][ T7352] CPU: 1 UID: 0 PID: 7352 Comm: syz.0.361 Not tainted 6.16.0-next-20250806-syzkaller #0 PREEMPT(full) 
[  178.118385][ T7352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  178.118398][ T7352] Call Trace:
[  178.118406][ T7352]  <TASK>
[  178.118420][ T7352]  dump_stack_lvl+0x189/0x250
[  178.118461][ T7352]  ? __pfx____ratelimit+0x10/0x10
[  178.118496][ T7352]  ? __pfx_dump_stack_lvl+0x10/0x10
[  178.118531][ T7352]  ? __pfx__printk+0x10/0x10
[  178.118582][ T7352]  should_fail_ex+0x414/0x560
[  178.118619][ T7352]  _copy_to_user+0x31/0xb0
[  178.118649][ T7352]  simple_read_from_buffer+0xe1/0x170
[  178.118685][ T7352]  proc_fail_nth_read+0x1b3/0x220
[  178.118726][ T7352]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  178.118768][ T7352]  ? rw_verify_area+0x2a6/0x4d0
[  178.118793][ T7352]  ? __lock_acquire+0xab9/0xd20
[  178.118817][ T7352]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  178.118856][ T7352]  vfs_read+0x1fd/0xa30
[  178.118881][ T7352]  ? fdget_pos+0x247/0x320
[  178.118917][ T7352]  ? __pfx___mutex_lock+0x10/0x10
[  178.118954][ T7352]  ? __pfx_vfs_read+0x10/0x10
[  178.118983][ T7352]  ? __fget_files+0x2a/0x420
[  178.119020][ T7352]  ? __fget_files+0x3a0/0x420
[  178.119050][ T7352]  ? __fget_files+0x2a/0x420
[  178.119093][ T7352]  ksys_read+0x145/0x250
[  178.119131][ T7352]  ? __fget_files+0x3a0/0x420
[  178.119165][ T7352]  ? __pfx_ksys_read+0x10/0x10
[  178.119199][ T7352]  ? do_syscall_64+0xbe/0x3b0
[  178.119238][ T7352]  do_syscall_64+0xfa/0x3b0
[  178.119271][ T7352]  ? lockdep_hardirqs_on+0x9c/0x150
[  178.119304][ T7352]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  178.119327][ T7352]  ? clear_bhb_loop+0x60/0xb0
[  178.119356][ T7352]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  178.119379][ T7352] RIP: 0033:0x7f148738d5fc
[  178.119401][ T7352] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48
[  178.119420][ T7352] RSP: 002b:00007f14855f6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  178.119457][ T7352] RAX: ffffffffffffffda RBX: 00007f14875b5fa0 RCX: 00007f148738d5fc
[  178.119474][ T7352] RDX: 000000000000000f RSI: 00007f14855f60a0 RDI: 0000000000000004
[  178.119488][ T7352] RBP: 00007f14855f6090 R08: 0000000000000000 R09: 0000000000000000
[  178.119503][ T7352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  178.119522][ T7352] R13: 00007f14875b6038 R14: 00007f14875b5fa0 R15: 00007ffdb6bc8948
[  178.119560][ T7352]  </TASK>
[  178.399597][    C1] vkms_vblank_simulate: vblank timer overrun
[  178.496803][ T7362] netlink: 224 bytes leftover after parsing attributes in process `syz.1.362'.
[  178.514476][ T7362] nbd: must specify a device to reconfigure
[  178.642756][ T5954] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter)
[  178.653651][ T5954] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19)
[  178.722295][ T5948] usb 1-1: new high-speed USB device number 24 using dummy_hcd
[  178.875945][ T5948] usb 1-1: Using ep0 maxpacket: 16
[  178.891739][ T5948] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  178.914268][ T5948] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1
[  178.928175][ T5948] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  178.958619][ T5948] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  178.985497][ T5948] usb 1-1: Manufacturer: syz
[  179.011722][ T5948] usb 1-1: config 0 descriptor??
[  179.393444][ T7372] /dev/rnullb0: Can't open blockdev
[  179.504976][    T9] usb 5-1: USB disconnect, device number 5
[  179.538068][ T7374] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.368'.
[  180.316827][ T7395] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7)
[  180.324378][ T7395] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed)
[  180.337342][ T7395] vhci_hcd vhci_hcd.0: Device attached
[  180.357612][ T7396] vhci_hcd: connection closed
[  180.367829][   T13] vhci_hcd: stop threads
[  180.382497][   T13] vhci_hcd: release socket
[  180.400189][   T13] vhci_hcd: disconnect device
[  180.741192][   T30] audit: type=1326 audit(6049524218.841:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  180.767446][   T30] audit: type=1326 audit(6049524218.841:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  180.790992][   T30] audit: type=1326 audit(6049524218.841:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  180.815561][   T30] audit: type=1326 audit(6049524218.851:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  180.839436][    C1] vkms_vblank_simulate: vblank timer overrun
[  180.848592][   T30] audit: type=1326 audit(6049524218.851:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  180.872429][    C1] vkms_vblank_simulate: vblank timer overrun
[  180.879226][   T30] audit: type=1326 audit(6049524218.851:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fc2f158d550 code=0x7ffc0000
[  180.902593][    C1] vkms_vblank_simulate: vblank timer overrun
[  180.912419][   T30] audit: type=1326 audit(6049524218.851:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fc2f158e7eb code=0x7ffc0000
[  180.935304][    C1] vkms_vblank_simulate: vblank timer overrun
[  180.945147][   T30] audit: type=1326 audit(6049524218.851:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  180.967550][    C1] vkms_vblank_simulate: vblank timer overrun
[  180.989033][ T7154] usb 3-1: new high-speed USB device number 10 using dummy_hcd
[  180.998735][   T30] audit: type=1326 audit(6049524218.851:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  181.022243][    C1] vkms_vblank_simulate: vblank timer overrun
[  181.033136][ T5954] usb 2-1: new high-speed USB device number 33 using dummy_hcd
[  181.152945][ T7154] usb 3-1: Using ep0 maxpacket: 32
[  181.170589][ T7154] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81
[  181.186379][ T7154] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  181.196353][ T5954] usb 2-1: config 220 has an invalid interface number: 76 but max is 2
[  181.201409][ T7154] usb 3-1: New USB device found, idVendor=06cd, idProduct=0112, bcdDevice=d2.a2
[  181.206739][ T5954] usb 2-1: config 220 contains an unexpected descriptor of type 0x2, skipping
[  181.222851][ T7154] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  181.242252][ T7154] usb 3-1: Product: syz
[  181.244600][ T5954] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config
[  181.246857][ T7154] usb 3-1: Manufacturer: syz
[  181.267755][ T5954] usb 2-1: config 220 has no interface number 2
[  181.268740][ T7154] usb 3-1: SerialNumber: syz
[  181.280277][ T5954] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12
[  181.295868][ T5954] usb 2-1: config 220 interface 0 has no altsetting 0
[  181.297026][ T7154] usb 3-1: config 0 descriptor??
[  181.311167][ T7412] syz.4.379: vmalloc error: size 7864320, failed to allocated page array size 15360, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[  181.331187][ T5954] usb 2-1: config 220 interface 76 has no altsetting 0
[  181.333682][ T7154] keyspan 3-1:0.0: Keyspan 1 port adapter converter detected
[  181.338958][ T5954] usb 2-1: config 220 interface 1 has no altsetting 0
[  181.347843][ T7154] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 87
[  181.365438][ T7154] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 7
[  181.365620][ T7412] CPU: 1 UID: 0 PID: 7412 Comm: syz.4.379 Not tainted 6.16.0-next-20250806-syzkaller #0 PREEMPT(full) 
[  181.365649][ T7412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  181.365665][ T7412] Call Trace:
[  181.365674][ T7412]  <TASK>
[  181.365684][ T7412]  dump_stack_lvl+0x189/0x250
[  181.365735][ T7412]  ? __pfx_dump_stack_lvl+0x10/0x10
[  181.365769][ T7412]  ? __pfx__printk+0x10/0x10
[  181.365804][ T7412]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  181.365841][ T7412]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  181.365879][ T7412]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[  181.365918][ T7412]  warn_alloc+0x214/0x310
[  181.365954][ T7412]  ? __pfx_warn_alloc+0x10/0x10
[  181.365992][ T7412]  ? __get_vm_area_node+0x28f/0x300
[  181.366028][ T7412]  ? vb2_vmalloc_alloc+0xef/0x340
[  181.366068][ T7412]  __vmalloc_node_range_noprof+0x67e/0x12f0
[  181.366131][ T7412]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  181.366164][ T7412]  ? __kasan_kmalloc+0x93/0xb0
[  181.366193][ T7412]  vmalloc_user_noprof+0xad/0xf0
[  181.366219][ T7412]  ? vb2_vmalloc_alloc+0xef/0x340
[  181.366245][ T7412]  vb2_vmalloc_alloc+0xef/0x340
[  181.366269][ T7412]  ? __pfx_vb2_vmalloc_alloc+0x10/0x10
[  181.366294][ T7412]  __vb2_queue_alloc+0x9c2/0x15a0
[  181.366371][ T7412]  vb2_core_reqbufs+0xc31/0x1420
[  181.366407][ T7412]  ? kfree+0x18e/0x440
[  181.366449][ T7412]  ? __pfx_vb2_core_reqbufs+0x10/0x10
[  181.366498][ T7412]  ? vb2_verify_memory_type+0x1fc/0x570
[  181.366538][ T7412]  vb2_ioctl_reqbufs+0x4c0/0x830
[  181.366591][ T7412]  __video_do_ioctl+0xc9b/0xdb0
[  181.366628][ T7412]  ? __pfx___video_do_ioctl+0x10/0x10
[  181.366670][ T7412]  video_usercopy+0x871/0x14f0
[  181.366707][ T7412]  ? __pfx___video_do_ioctl+0x10/0x10
[  181.366731][ T7412]  ? __pfx_video_usercopy+0x10/0x10
[  181.366767][ T7412]  ? __fget_files+0x2a/0x420
[  181.366804][ T7412]  ? __fget_files+0x2a/0x420
[  181.366835][ T7412]  ? __fget_files+0x3a0/0x420
[  181.366870][ T7412]  v4l2_ioctl+0x18d/0x1e0
[  181.366895][ T7412]  ? __pfx_v4l2_ioctl+0x10/0x10
[  181.366918][ T7412]  __se_sys_ioctl+0xf9/0x170
[  181.366947][ T7412]  do_syscall_64+0xfa/0x3b0
[  181.366983][ T7412]  ? lockdep_hardirqs_on+0x9c/0x150
[  181.367029][ T7412]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  181.367054][ T7412]  ? clear_bhb_loop+0x60/0xb0
[  181.367091][ T7412]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  181.367120][ T7412] RIP: 0033:0x7fae9318ebe9
[  181.367142][ T7412] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  181.367165][ T7412] RSP: 002b:00007fae93fe7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  181.367189][ T7412] RAX: ffffffffffffffda RBX: 00007fae933b5fa0 RCX: 00007fae9318ebe9
[  181.367208][ T7412] RDX: 00002000000000c0 RSI: 00000000c0145608 RDI: 0000000000000008
[  181.367224][ T7412] RBP: 00007fae93211e19 R08: 0000000000000000 R09: 0000000000000000
[  181.367239][ T7412] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  181.367253][ T7412] R13: 00007fae933b6038 R14: 00007fae933b5fa0 R15: 00007fff74826268
[  181.367291][ T7412]  </TASK>
[  181.368097][ T7412] Mem-Info:
[  181.386509][ T7154] keyspan 3-1:0.0: unsupported endpoint type 0
[  181.407775][ T5954] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9
[  181.410292][ T7154] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 1
[  181.415551][ T5954] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  181.420588][ T7154] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 2
[  181.446557][ T5954] usb 2-1: Product: syz
[  181.458041][ T7154] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 85
[  181.497527][ T5954] usb 2-1: Manufacturer: syz
[  181.497552][ T5954] usb 2-1: SerialNumber: syz
[  181.500196][ T7412] active_anon:6034 inactive_anon:0 isolated_anon:0
[  181.500196][ T7412]  active_file:13079 inactive_file:39919 isolated_file:0
[  181.500196][ T7412]  unevictable:768 dirty:12 writeback:0
[  181.500196][ T7412]  slab_reclaimable:10611 slab_unreclaimable:94011
[  181.500196][ T7412]  mapped:24846 shmem:1370 pagetables:1299
[  181.500196][ T7412]  sec_pagetables:0 bounce:0
[  181.500196][ T7412]  kernel_misc_reclaimable:0
[  181.500196][ T7412]  free:1326370 free_pcp:19624 free_cma:0
[  181.528567][ T7154] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 5
[  181.587846][ T5948] usb 1-1: USB disconnect, device number 24
[  181.605052][ T7412] Node 0 active_anon:24156kB inactive_anon:0kB active_file:52252kB inactive_file:159472kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:99380kB dirty:48kB writeback:0kB shmem:3944kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11884kB pagetables:5196kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  181.623941][ T7405] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  181.675598][ T7154] usb 3-1: Keyspan 1 port adapter converter now attached to ttyUSB0
[  181.757467][ T7406] befs: (nullb0): No write support. Marking filesystem read-only
[  181.761439][ T7405] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  181.781172][ T7406] befs: (nullb0): invalid magic header
[  181.830689][ T7412] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  181.960377][   T30] kauditd_printk_skb: 33 callbacks suppressed
[  181.960398][   T30] audit: type=1326 audit(6049524220.061:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  182.011968][ T7412] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  182.054377][   T30] audit: type=1326 audit(6049524220.061:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  182.105148][ T7154] usb 3-1: USB disconnect, device number 10
[  182.135186][ T7412] lowmem_reserve[]: 0 2496 2497 2497 2497
[  182.165349][ T7154] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0
[  182.180178][ T7412] Node 0 DMA32 free:1417452kB boost:0kB min:34216kB low:42768kB high:51320kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24344kB inactive_anon:0kB active_file:52252kB inactive_file:158692kB unevictable:1536kB writepending:48kB present:3129332kB managed:2555964kB mlocked:0kB bounce:0kB free_pcp:47896kB local_pcp:24904kB free_cma:0kB
[  182.222408][   T30] audit: type=1326 audit(6049524220.191:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  182.242833][ T7412] lowmem_reserve[]: 0 0 1 1 1
[  182.254181][ T7154] keyspan 3-1:0.0: device disconnected
[  182.264244][ T7412] Node 0 Normal free:0kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:1088kB unevictable:0kB writepending:0kB present:1048580kB managed:1132kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  182.265424][   T30] audit: type=1326 audit(6049524220.191:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  182.373979][   T30] audit: type=1326 audit(6049524220.191:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  182.374032][ T7412] lowmem_reserve[]:
[  182.408524][   T30] audit: type=1326 audit(6049524220.191:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  182.418452][ T7412]  0 0 0 0 0
[  182.440280][   T30] audit: type=1326 audit(6049524220.191:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  182.452205][ T7427] sctp: [Deprecated]: syz.0.381 (pid 7427) Use of int in max_burst socket option.
[  182.452205][ T7427] Use struct sctp_assoc_value instead
[  182.473164][   T30] audit: type=1326 audit(6049524220.201:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7ffc0000
[  182.480382][ T7412] Node 1 Normal free:3874628kB boost:0kB min:55668kB low:69584kB high:83500kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:28412kB local_pcp:8200kB free_cma:0kB
[  182.545914][ T7412] lowmem_reserve[]: 0 0 0 0 0
[  182.551529][ T7412] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[  182.565200][ T7412] Node 0 DMA32: 436*4kB (UME) 7*8kB (M) 121*16kB (UM) 256*32kB (UME) 295*64kB (UME) 112*128kB (UME) 106*256kB (UM) 17*512kB (UME) 14*1024kB (UME) 6*2048kB (UME) 320*4096kB (UM) = 1418328kB
[  182.607129][ T7412] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
[  182.624611][ T7412] Node 1 Normal: 187*4kB (UME) 8*8kB (UME) 24*16kB (UME) 81*32kB (UM) 20*64kB (UME) 5*128kB (UM) 2*256kB (UM) 4*512kB (UME) 2*1024kB (UE) 3*2048kB (UME) 942*4096kB (UM) = 3874892kB
[  182.689599][ T7412] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  182.715131][ T7431] overlay: Unknown parameter 'appraise_type'
[  182.732213][ T7412] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  182.745931][ T7412] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  182.757765][ T7412] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  182.772759][ T7412] 54342 total pagecache pages
[  182.778333][ T7412] 0 pages in swap cache
[  182.783731][ T7412] Free swap  = 124996kB
[  182.788395][ T7412] Total swap = 124996kB
[  182.794393][ T7412] 2097051 pages RAM
[  182.798408][ T7412] 0 pages HighMem/MovableOnly
[  182.805910][ T7412] 426162 pages reserved
[  182.810596][ T7412] 0 pages cma reserved
[  183.153506][ T5853] usb 3-1: new high-speed USB device number 11 using dummy_hcd
[  183.312284][ T5853] usb 3-1: Using ep0 maxpacket: 16
[  183.328188][ T5853] usb 3-1: unable to get BOS descriptor or descriptor too short
[  183.343436][ T5853] usb 3-1: config 13 has an invalid interface number: 50 but max is 0
[  183.356014][ T5853] usb 3-1: config 13 has no interface number 0
[  183.363811][ T5853] usb 3-1: config 13 interface 50 altsetting 167 bulk endpoint 0x8 has invalid maxpacket 16
[  183.374771][ T5853] usb 3-1: config 13 interface 50 has no altsetting 0
[  183.391038][ T5853] usb 3-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32
[  183.401579][ T5853] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  183.411206][ T5853] usb 3-1: Product: syz
[  183.416028][ T5853] usb 3-1: Manufacturer: syz
[  183.421015][ T5853] usb 3-1: SerialNumber: syz
[  183.433750][ T7443] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  183.559211][ T7455] netlink: 18128 bytes leftover after parsing attributes in process `syz.0.388'.
[  183.627152][   T30] audit: type=1326 audit(6049524221.731:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7401 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2f158ebe9 code=0x7fc00000
[  183.721443][ T5954] usb 2-1: Found UVC 7.01 device syz (8086:0b07)
[  183.748659][ T5954] usb 2-1: No valid video chain found.
[  183.775406][ T5954] usb 2-1: selecting invalid altsetting 0
[  183.898225][ T5853] usb 3-1: Quirk or no altset; falling back to MIDI 1.0
[  183.942259][ T5853] usb 3-1: MIDIStreaming interface descriptor not found
[  183.956253][ T5954] usb 2-1: selecting invalid altsetting 0
[  183.972396][ T5954] usbtest 2-1:220.1: probe with driver usbtest failed with error -22
[  184.016767][ T5954] usb 2-1: USB disconnect, device number 33
[  184.118701][ T5853] usb 3-1: USB disconnect, device number 11
[  184.403205][ T7466] blktrace: Concurrent blktraces are not allowed on rnullb0
[  184.543547][ T7470] /dev/rnullb0: Can't open blockdev
[  184.610037][ T7473] IPVS: length: 78 != 8
[  184.716887][   T30] audit: type=1326 audit(6049524222.811:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7480 comm="syz.4.394" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fae9318ebe9 code=0x0
[  185.035625][ T7490] trusted_key: encrypted_key: key trusted:syz not found
[  186.088428][ T7508] netlink: 12 bytes leftover after parsing attributes in process `syz.1.400'.
[  186.445340][ T7519] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  186.574427][ T7519] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  186.673444][ T5853] usb 5-1: new high-speed USB device number 6 using dummy_hcd
[  186.895250][ T7532] netlink: 'syz.0.405': attribute type 29 has an invalid length.
[  186.906773][ T7520] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(7)
[  186.913450][ T7520] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
[  186.915213][ T7532] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.405'.
[  186.946095][ T7520] vhci_hcd vhci_hcd.0: Device attached
[  187.031271][ T7533] vhci_hcd: connection closed
[  187.032797][ T1003] vhci_hcd: stop threads
[  187.043110][ T1003] vhci_hcd: release socket
[  187.049635][ T1003] vhci_hcd: disconnect device
[  187.400206][ T7554] syz.2.409 (7554): attempted to duplicate a private mapping with mremap.  This is not supported.
[  187.416236][ T7554] qnx4: no qnx4 filesystem (no root dir).
[  187.430070][ T7556] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  187.437276][ T5853] usb 5-1: device descriptor read/64, error -71
[  187.446379][ T7556] VFS: Can't find a romfs filesystem on dev rnullb0.
[  187.446379][ T7556] 
[  187.505502][ T7558] netlink: 100 bytes leftover after parsing attributes in process `syz.2.411'.
[  187.682159][ T5853] usb 5-1: new high-speed USB device number 7 using dummy_hcd
[  187.752224][ T5948] usb 3-1: new high-speed USB device number 12 using dummy_hcd
[  187.817017][   T49] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  187.842516][ T5853] usb 5-1: Using ep0 maxpacket: 8
[  187.858001][ T5853] usb 5-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00
[  187.871973][ T5853] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  187.880581][ T5853] usb 5-1: Product: syz
[  187.886062][ T5853] usb 5-1: Manufacturer: syz
[  187.891203][ T5853] usb 5-1: SerialNumber: syz
[  187.909841][ T5853] usb 5-1: config 0 descriptor??
[  187.921479][ T5853] radio-usb-si4713 5-1:0.0: Si4713 development board discovered: (10C4:8244)
[  187.939067][ T5948] usb 3-1: Using ep0 maxpacket: 16
[  187.942148][    T9] usb 2-1: new high-speed USB device number 34 using dummy_hcd
[  187.956672][   T49] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  187.971669][ T5948] usb 3-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15
[  187.987631][ T5948] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  187.998505][ T5948] usb 3-1: Product: syz
[  188.003289][ T5948] usb 3-1: Manufacturer: syz
[  188.008243][ T5948] usb 3-1: SerialNumber: syz
[  188.019409][ T5948] usb 3-1: config 0 descriptor??
[  188.031676][ T5948] ssu100 3-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected
[  188.071758][   T49] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  188.125603][    T9] usb 2-1: Using ep0 maxpacket: 16
[  188.141113][    T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  188.164846][   T49] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  188.172205][    T9] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1
[  188.208935][    T9] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  188.235833][    T9] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  188.259139][    T9] usb 2-1: Manufacturer: syz
[  188.280893][    T9] usb 2-1: config 0 descriptor??
[  188.498327][   T49] bridge_slave_1: left allmulticast mode
[  188.534412][   T49] bridge_slave_1: left promiscuous mode
[  188.540443][   T49] bridge0: port 2(bridge_slave_1) entered disabled state
[  188.571160][ T5853] radio-usb-si4713 5-1:0.0: probe with driver radio-usb-si4713 failed with error -71
[  188.595324][ T5853] usbhid 5-1:0.0: couldn't find an input interrupt endpoint
[  188.604787][   T49] bridge_slave_0: left allmulticast mode
[  188.610529][   T49] bridge_slave_0: left promiscuous mode
[  188.634273][ T5853] usb 5-1: USB disconnect, device number 7
[  188.640691][   T49] bridge0: port 1(bridge_slave_0) entered disabled state
[  188.840445][ T7558] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  188.851867][ T7558] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  188.885088][ T5948] ssu100 3-1:0.0: probe with driver ssu100 failed with error -71
[  188.923554][ T5948] usb 3-1: USB disconnect, device number 12
[  189.088859][ T5871] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  189.115713][ T5871] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  189.124816][ T5871] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  189.135753][ T5871] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  189.147604][ T5871] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  189.311485][ T7581] netlink: 56 bytes leftover after parsing attributes in process `syz.4.416'.
[  189.520176][   T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  189.537650][   T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  189.562633][   T49] bond0 (unregistering): Released all slaves
[  190.730175][   T43] usb 2-1: USB disconnect, device number 34
[  190.820730][ T7576] chnl_net:caif_netlink_parms(): no params data found
[  190.940946][   T49] hsr_slave_0: left promiscuous mode
[  190.953503][   T49] hsr_slave_1: left promiscuous mode
[  190.959971][   T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  190.997896][   T49] batman_adv: batadv0: Removing interface: batadv_slave_0
[  191.006709][   T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  191.022209][   T49] batman_adv: batadv0: Removing interface: batadv_slave_1
[  191.075295][   T49] veth1_macvtap: left promiscuous mode
[  191.083343][   T49] veth0_macvtap: left promiscuous mode
[  191.090566][   T49] veth1_vlan: left promiscuous mode
[  191.112232][   T49] veth0_vlan: left promiscuous mode
[  191.162460][   T43] usb 2-1: new low-speed USB device number 35 using dummy_hcd
[  191.203278][ T5879] Bluetooth: hci1: command tx timeout
[  191.327437][   T43] usb 2-1: device descriptor read/64, error -71
[  191.432474][ T5948] usb 5-1: new high-speed USB device number 8 using dummy_hcd
[  191.572191][   T43] usb 2-1: new low-speed USB device number 36 using dummy_hcd
[  191.592132][ T5948] usb 5-1: Using ep0 maxpacket: 8
[  191.607457][ T5948] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  191.620402][ T5948] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  191.635159][ T5948] usb 5-1: New USB device found, idVendor=0c70, idProduct=f00a, bcdDevice= 0.00
[  191.646684][ T5948] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  191.676237][ T5948] usb 5-1: config 0 descriptor??
[  191.729150][   T43] usb 2-1: device descriptor read/64, error -71
[  191.842841][   T43] usb usb2-port1: attempt power cycle
[  191.899528][   T49] team0 (unregistering): Port device team_slave_1 removed
[  191.957044][   T49] team0 (unregistering): Port device team_slave_0 removed
[  192.147627][ T5948] aquacomputer_d5next 0003:0C70:F00A.0006: unknown main item tag 0x0
[  192.157299][ T5948] aquacomputer_d5next 0003:0C70:F00A.0006: unknown main item tag 0x0
[  192.179426][ T5948] aquacomputer_d5next 0003:0C70:F00A.0006: unknown main item tag 0x0
[  192.190934][ T5948] aquacomputer_d5next 0003:0C70:F00A.0006: unknown main item tag 0x0
[  192.223477][    C1] vkms_vblank_simulate: vblank timer overrun
[  192.234761][   T43] usb 2-1: new low-speed USB device number 37 using dummy_hcd
[  192.244598][ T5948] aquacomputer_d5next 0003:0C70:F00A.0006: unknown main item tag 0x0
[  192.263794][   T43] usb 2-1: device descriptor read/8, error -71
[  192.291566][ T5948] aquacomputer_d5next 0003:0C70:F00A.0006: hidraw0: USB HID v0.00 Device [HID 0c70:f00a] on usb-dummy_hcd.4-1/input0
[  192.341691][ T7619] sctp: [Deprecated]: syz.4.422 (pid 7619) Use of int in max_burst socket option deprecated.
[  192.341691][ T7619] Use struct sctp_assoc_value instead
[  192.503194][   T43] usb 2-1: new low-speed USB device number 38 using dummy_hcd
[  192.527905][   T43] usb 2-1: device descriptor read/8, error -71
[  192.646687][   T43] usb usb2-port1: unable to enumerate USB device
[  192.721635][ T7629] /dev/rnullb0: Can't open blockdev
[  192.798201][   T10] usb 5-1: USB disconnect, device number 8
[  193.069906][ T7576] bridge0: port 1(bridge_slave_0) entered blocking state
[  193.080524][ T7576] bridge0: port 1(bridge_slave_0) entered disabled state
[  193.090613][ T7576] bridge_slave_0: entered allmulticast mode
[  193.129243][ T7576] bridge_slave_0: entered promiscuous mode
[  193.165909][ T7576] bridge0: port 2(bridge_slave_1) entered blocking state
[  193.194790][ T7576] bridge0: port 2(bridge_slave_1) entered disabled state
[  193.215990][ T7576] bridge_slave_1: entered allmulticast mode
[  193.241821][ T7576] bridge_slave_1: entered promiscuous mode
[  193.284689][ T5879] Bluetooth: hci1: command tx timeout
[  193.379330][ T7576] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  193.445308][ T7576] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  193.594726][ T7576] team0: Port device team_slave_0 added
[  193.665288][ T7576] team0: Port device team_slave_1 added
[  193.887087][ T7576] batman_adv: batadv0: Adding interface: batadv_slave_0
[  193.912317][ T7576] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  193.952944][ T7576] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  193.958791][ T7657] netlink: 12 bytes leftover after parsing attributes in process `syz.4.429'.
[  194.006422][ T7657] netlink: 12 bytes leftover after parsing attributes in process `syz.4.429'.
[  194.047618][ T7576] batman_adv: batadv0: Adding interface: batadv_slave_1
[  194.072110][ T7576] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  194.099895][    C1] vkms_vblank_simulate: vblank timer overrun
[  194.125680][ T7660] /dev/rnullb0: Can't open blockdev
[  194.138789][ T7576] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  194.253029][ T7576] hsr_slave_0: entered promiscuous mode
[  194.296106][ T7576] hsr_slave_1: entered promiscuous mode
[  194.310555][ T7576] debugfs: 'hsr0' already exists in 'hsr'
[  194.334575][ T7576] Cannot create hsr debugfs directory
[  194.473554][ T7668] cgroup: Unknown subsys name 'appraise'
[  194.783074][   T10] usb 2-1: new high-speed USB device number 39 using dummy_hcd
[  194.940514][ T7576] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  194.947900][   T10] usb 2-1: device descriptor read/64, error -71
[  194.974504][ T7576] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  195.011632][ T7576] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  195.074385][ T7576] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  195.222132][   T10] usb 2-1: new high-speed USB device number 40 using dummy_hcd
[  195.364624][ T5879] Bluetooth: hci1: command tx timeout
[  195.396138][   T10] usb 2-1: device descriptor read/64, error -71
[  195.414945][ T7576] 8021q: adding VLAN 0 to HW filter on device bond0
[  195.480194][ T7576] 8021q: adding VLAN 0 to HW filter on device team0
[  195.524292][ T1003] bridge0: port 1(bridge_slave_0) entered blocking state
[  195.533956][ T1003] bridge0: port 1(bridge_slave_0) entered forwarding state
[  195.542814][   T10] usb usb2-port1: attempt power cycle
[  195.571606][   T59] bridge0: port 2(bridge_slave_1) entered blocking state
[  195.579289][   T59] bridge0: port 2(bridge_slave_1) entered forwarding state
[  195.902188][   T10] usb 2-1: new high-speed USB device number 41 using dummy_hcd
[  195.935053][   T10] usb 2-1: device descriptor read/8, error -71
[  196.194048][   T10] usb 2-1: new high-speed USB device number 42 using dummy_hcd
[  196.247523][   T10] usb 2-1: device descriptor read/8, error -71
[  196.301590][ T7576] 8021q: adding VLAN 0 to HW filter on device batadv0
[  196.325914][    T9] usb 5-1: new full-speed USB device number 9 using dummy_hcd
[  196.368652][ T7722] FAULT_INJECTION: forcing a failure.
[  196.368652][ T7722] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  196.389268][ T7722] CPU: 1 UID: 0 PID: 7722 Comm: syz.2.439 Not tainted 6.16.0-next-20250806-syzkaller #0 PREEMPT(full) 
[  196.389301][ T7722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  196.389314][ T7722] Call Trace:
[  196.389323][ T7722]  <TASK>
[  196.389332][ T7722]  dump_stack_lvl+0x189/0x250
[  196.389370][ T7722]  ? __pfx____ratelimit+0x10/0x10
[  196.389412][ T7722]  ? __pfx_dump_stack_lvl+0x10/0x10
[  196.389444][ T7722]  ? __pfx__printk+0x10/0x10
[  196.389476][ T7722]  ? __might_fault+0xb0/0x130
[  196.389509][ T7722]  should_fail_ex+0x414/0x560
[  196.389543][ T7722]  _copy_from_iter+0x1db/0x16f0
[  196.389568][ T7722]  ? __lock_acquire+0xab9/0xd20
[  196.389599][ T7722]  ? __pfx__copy_from_iter+0x10/0x10
[  196.389636][ T7722]  tun_get_user+0x219/0x3e20
[  196.389680][ T7722]  ? aa_file_perm+0x44d/0x1550
[  196.389711][ T7722]  ? __pfx_tun_get_user+0x10/0x10
[  196.389731][ T7722]  ? _parse_integer_limit+0x1ae/0x1f0
[  196.389772][ T7722]  ? __lock_acquire+0xab9/0xd20
[  196.389801][ T7722]  ? ref_tracker_alloc+0x318/0x460
[  196.389829][ T7722]  ? __lock_acquire+0xab9/0xd20
[  196.389854][ T7722]  ? __pfx_ref_tracker_alloc+0x10/0x10
[  196.389890][ T7722]  ? tun_get+0x1c/0x2f0
[  196.389917][ T7722]  ? tun_get+0x1c/0x2f0
[  196.389937][ T7722]  ? tun_get+0x1c/0x2f0
[  196.389962][ T7722]  tun_chr_write_iter+0x113/0x200
[  196.389986][ T7722]  vfs_write+0x5c6/0xb30
[  196.390017][ T7722]  ? __pfx_tun_chr_write_iter+0x10/0x10
[  196.390039][ T7722]  ? __pfx_vfs_write+0x10/0x10
[  196.390073][ T7722]  ? __fget_files+0x2a/0x420
[  196.390113][ T7722]  ksys_write+0x145/0x250
[  196.390164][ T7722]  ? __pfx_ksys_write+0x10/0x10
[  196.390186][ T7722]  ? rcu_is_watching+0x15/0xb0
[  196.390219][ T7722]  ? do_syscall_64+0xbe/0x3b0
[  196.390256][ T7722]  do_syscall_64+0xfa/0x3b0
[  196.390287][ T7722]  ? lockdep_hardirqs_on+0x9c/0x150
[  196.390317][ T7722]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  196.390339][ T7722]  ? clear_bhb_loop+0x60/0xb0
[  196.390365][ T7722]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  196.390394][ T7722] RIP: 0033:0x7f13dfb8ebe9
[  196.390414][ T7722] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  196.390433][ T7722] RSP: 002b:00007f13e0997038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  196.390457][ T7722] RAX: ffffffffffffffda RBX: 00007f13dfdb5fa0 RCX: 00007f13dfb8ebe9
[  196.390473][ T7722] RDX: 000000000000004a RSI: 0000200000000280 RDI: 0000000000000004
[  196.390487][ T7722] RBP: 00007f13e0997090 R08: 0000000000000000 R09: 0000000000000000
[  196.390500][ T7722] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  196.390513][ T7722] R13: 00007f13dfdb6038 R14: 00007f13dfdb5fa0 R15: 00007ffd0e380948
[  196.390545][ T7722]  </TASK>
[  196.393960][   T10] usb usb2-port1: unable to enumerate USB device
[  196.798182][    T9] usb 5-1: config 6 has an invalid interface number: 2 but max is 0
[  196.808211][    T9] usb 5-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config
[  196.842228][    T9] usb 5-1: config 6 has no interface number 0
[  196.852247][    T9] usb 5-1: config 6 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2
[  196.890201][    T9] usb 5-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91
[  196.905077][    T9] usb 5-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3
[  196.914212][    T9] usb 5-1: Product: syz
[  196.918608][    T9] usb 5-1: Manufacturer: syz
[  196.926012][    T9] usb 5-1: SerialNumber: syz
[  196.960257][    T9] hso 5-1:6.2: Failed to find INT IN ep
[  197.113715][ T7742] netlink: 8 bytes leftover after parsing attributes in process `syz.2.441'.
[  197.123633][ T7742] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  197.201515][ T7576] veth0_vlan: entered promiscuous mode
[  197.236570][ T7576] veth1_vlan: entered promiscuous mode
[  197.246023][    T9] usb 5-1: USB disconnect, device number 9
[  197.389501][ T7576] veth0_macvtap: entered promiscuous mode
[  197.411100][ T7576] veth1_macvtap: entered promiscuous mode
[  197.444812][ T5879] Bluetooth: hci1: command tx timeout
[  197.471813][ T7576] batman_adv: batadv0: Interface activated: batadv_slave_0
[  197.518966][ T7576] batman_adv: batadv0: Interface activated: batadv_slave_1
[  197.580230][ T1003] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  197.640125][ T1003] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  197.695066][ T1003] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  197.739342][ T1003] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  198.013593][ T1003] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  198.046737][ T1003] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  198.104756][   T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  198.131119][   T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  198.336178][ T7762] /dev/rnullb0: Can't open blockdev
[  198.362159][ T5948] usb 5-1: new high-speed USB device number 10 using dummy_hcd
[  198.542961][ T5948] usb 5-1: Using ep0 maxpacket: 16
[  198.566338][ T5948] usb 5-1: config 4 has an invalid interface number: 51 but max is 0
[  198.597316][ T5948] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config
[  198.677856][ T5948] usb 5-1: config 4 has no interface number 0
[  198.686389][ T5948] usb 5-1: config 4 interface 51 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 2
[  198.705891][ T5948] usb 5-1: config 4 interface 51 has no altsetting 0
[  198.720423][ T5948] usb 5-1: New USB device found, idVendor=954f, idProduct=4199, bcdDevice= f.76
[  198.738156][ T5948] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  198.778259][ T5948] usb 5-1: Product: syz
[  198.801472][ T5948] usb 5-1: Manufacturer: syz
[  198.829749][ T5948] usb 5-1: SerialNumber: syz
[  198.857015][ T5948] cdc_eem 5-1:4.51: probe with driver cdc_eem failed with error -22
[  198.940637][ T7785] random: crng reseeded on system resumption
[  199.054839][ T7757] netlink: 'syz.4.444': attribute type 40 has an invalid length.
[  199.068998][ T7789] /dev/rnullb0: Can't open blockdev
[  199.089005][ T5853] IPVS: starting estimator thread 0...
[  199.211608][ T7791] IPVS: using max 26 ests per chain, 62400 per kthread
[  199.280747][ T7154] usb 5-1: USB disconnect, device number 10
[  199.556858][ T7803] netlink: 'syz.4.451': attribute type 1 has an invalid length.
[  199.580654][ T7803] netlink: 216 bytes leftover after parsing attributes in process `syz.4.451'.
[  200.042255][ T5853] usb 2-1: new high-speed USB device number 43 using dummy_hcd
[  200.102495][ T1305] aoe: packet could not be sent on bond0.  consider increasing tx_queue_len
[  200.113303][ T1305] ieee802154 phy0 wpan0: encryption failed: -22
[  200.119951][ T1305] ieee802154 phy1 wpan1: encryption failed: -22
[  200.222269][ T5853] usb 2-1: Using ep0 maxpacket: 16
[  200.260281][ T5853] usb 2-1: config 1 has an invalid descriptor of length 232, skipping remainder of the config
[  200.315408][ T5853] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3
[  200.411739][ T5853] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  200.461183][ T5853] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1
[  200.546374][ T5853] usb 2-1: SerialNumber: syz
[  200.706341][ T7822] ntfs3(rnullb0): Primary boot signature is not NTFS.
[  200.737542][ T7822] ntfs3(rnullb0): Alternative boot signature is not NTFS.
[  200.822626][ T5853] cdc_acm 2-1:1.0: Control and data interfaces are not separated!
[  200.867595][ T5853] cdc_acm 2-1:1.0: This needs exactly 3 endpoints
[  200.930551][ T5853] cdc_acm 2-1:1.0: probe with driver cdc_acm failed with error -22
[  200.970093][ T7825] overlay: Unknown parameter 'appraise_type'
[  201.007167][ T5853] usb 2-1: USB disconnect, device number 43
[  201.613414][ T7840] /dev/rnullb0: Can't open blockdev
[  201.626474][ T7842] netlink: 8 bytes leftover after parsing attributes in process `syz.1.461'.
[  201.914733][ T7842] 
[  201.917225][ T7842] ======================================================
[  201.924456][ T7842] WARNING: possible circular locking dependency detected
[  201.931716][ T7842] 6.16.0-next-20250806-syzkaller #0 Not tainted
[  201.938513][ T7842] ------------------------------------------------------
[  201.945798][ T7842] syz.1.461/7842 is trying to acquire lock:
[  201.952161][ T7842] ffff88801b6ff988 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove+0x30/0x60
[  201.961884][ T7842] 
[  201.961884][ T7842] but task is already holding lock:
[  201.969803][ T7842] ffff888143be1448 (&q->q_usage_counter(io)#50){++++}-{0:0}, at: nbd_start_device+0x17f/0xb10
[  201.981587][ T7842] 
[  201.981587][ T7842] which lock already depends on the new lock.
[  201.981587][ T7842] 
[  201.992711][ T7842] 
[  201.992711][ T7842] the existing dependency chain (in reverse order) is:
[  202.002295][ T7842] 
[  202.002295][ T7842] -> #2 (&q->q_usage_counter(io)#50){++++}-{0:0}:
[  202.011490][ T7842]        lock_acquire+0x120/0x360
[  202.017013][ T7842]        blk_alloc_queue+0x538/0x620
[  202.022544][ T7842]        __blk_mq_alloc_disk+0x15c/0x340
[  202.029934][ T7842]        nbd_dev_add+0x46c/0xae0
[  202.035360][ T7842]        nbd_init+0x168/0x1f0
[  202.040561][ T7842]        do_one_initcall+0x233/0x820
[  202.046075][ T7842]        do_initcall_level+0x104/0x190
[  202.052368][ T7842]        do_initcalls+0x59/0xa0
[  202.057346][ T7842]        kernel_init_freeable+0x334/0x4b0
[  202.063390][ T7842]        kernel_init+0x1d/0x1d0
[  202.068369][ T7842]        ret_from_fork+0x3f9/0x770
[  202.073861][ T7842]        ret_from_fork_asm+0x1a/0x30
[  202.079354][ T7842] 
[  202.079354][ T7842] -> #1 (fs_reclaim){+.+.}-{0:0}:
[  202.087247][ T7842]        lock_acquire+0x120/0x360
[  202.093002][ T7842]        fs_reclaim_acquire+0x72/0x100
[  202.098665][ T7842]        kmem_cache_alloc_lru_noprof+0x49/0x3d0
[  202.105197][ T7842]        alloc_inode+0xb8/0x1b0
[  202.110251][ T7842]        iget_locked+0xf0/0x570
[  202.115125][ T7842]        kernfs_get_inode+0x4f/0x780
[  202.120532][ T7842]        kernfs_get_tree+0x5a9/0x920
[  202.126223][ T7842]        sysfs_get_tree+0x46/0x110
[  202.131608][ T7842]        vfs_get_tree+0x8f/0x2b0
[  202.136865][ T7842]        do_new_mount+0x2a2/0x9e0
[  202.142202][ T7842]        __se_sys_mount+0x317/0x410
[  202.147879][ T7842]        do_syscall_64+0xfa/0x3b0
[  202.153216][ T7842]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  202.160184][ T7842] 
[  202.160184][ T7842] -> #0 (&root->kernfs_rwsem){++++}-{4:4}:
[  202.168796][ T7842]        validate_chain+0xb9b/0x2140
[  202.174762][ T7842]        __lock_acquire+0xab9/0xd20
[  202.180353][ T7842]        lock_acquire+0x120/0x360
[  202.185705][ T7842]        down_write+0x96/0x1f0
[  202.191028][ T7842]        kernfs_remove+0x30/0x60
[  202.196520][ T7842]        __kobject_del+0xe1/0x300
[  202.202146][ T7842]        kobject_del+0x45/0x60
[  202.207357][ T7842]        elevator_change_done+0xef/0x540
[  202.213417][ T7842]        elevator_change+0x332/0x450
[  202.219564][ T7842]        elevator_set_none+0x42/0xb0
[  202.226008][ T7842]        blk_mq_update_nr_hw_queues+0x72c/0x19a0
[  202.233071][ T7842]        nbd_start_device+0x17f/0xb10
[  202.238646][ T7842]        nbd_genl_connect+0x135b/0x18f0
[  202.244579][ T7842]        genl_family_rcv_msg_doit+0x215/0x300
[  202.251101][ T7842]        genl_rcv_msg+0x60e/0x790
[  202.256693][ T7842]        netlink_rcv_skb+0x208/0x470
[  202.262420][ T7842]        genl_rcv+0x28/0x40
[  202.267309][ T7842]        netlink_unicast+0x82c/0x9e0
[  202.272890][ T7842]        netlink_sendmsg+0x805/0xb30
[  202.278475][ T7842]        __sock_sendmsg+0x21c/0x270
[  202.284067][ T7842]        ____sys_sendmsg+0x505/0x830
[  202.289773][ T7842]        ___sys_sendmsg+0x21f/0x2a0
[  202.295573][ T7842]        __x64_sys_sendmsg+0x19b/0x260
[  202.301149][ T7842]        do_syscall_64+0xfa/0x3b0
[  202.306553][ T7842]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  202.314441][ T7842] 
[  202.314441][ T7842] other info that might help us debug this:
[  202.314441][ T7842] 
[  202.325384][ T7842] Chain exists of:
[  202.325384][ T7842]   &root->kernfs_rwsem --> fs_reclaim --> &q->q_usage_counter(io)#50
[  202.325384][ T7842] 
[  202.339959][ T7842]  Possible unsafe locking scenario:
[  202.339959][ T7842] 
[  202.347620][ T7842]        CPU0                    CPU1
[  202.353274][ T7842]        ----                    ----
[  202.358752][ T7842]   lock(&q->q_usage_counter(io)#50);
[  202.364512][ T7842]                                lock(fs_reclaim);
[  202.371497][ T7842]                                lock(&q->q_usage_counter(io)#50);
[  202.380288][ T7842]   lock(&root->kernfs_rwsem);
[  202.385645][ T7842] 
[  202.385645][ T7842]  *** DEADLOCK ***
[  202.385645][ T7842] 
[  202.395293][ T7842] 6 locks held by syz.1.461/7842:
[  202.400475][ T7842]  #0: ffffffff8f9a3bb0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
[  202.408885][ T7842]  #1: ffffffff8f9a39c8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790
[  202.418511][ T7842]  #2: ffff888025299188 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xa7/0x19a0
[  202.430600][ T7842]  #3: ffff8880252990d8 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xba/0x19a0
[  202.442230][ T7842]  #4: ffff888143be1448 (&q->q_usage_counter(io)#50){++++}-{0:0}, at: nbd_start_device+0x17f/0xb10
[  202.453573][ T7842]  #5: ffff888143be1480 (&q->q_usage_counter(queue)#2){+.+.}-{0:0}, at: nbd_start_device+0x17f/0xb10
[  202.464997][ T7842] 
[  202.464997][ T7842] stack backtrace:
[  202.471357][ T7842] CPU: 0 UID: 0 PID: 7842 Comm: syz.1.461 Not tainted 6.16.0-next-20250806-syzkaller #0 PREEMPT(full) 
[  202.471386][ T7842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  202.471399][ T7842] Call Trace:
[  202.471409][ T7842]  <TASK>
[  202.471418][ T7842]  dump_stack_lvl+0x189/0x250
[  202.471452][ T7842]  ? __pfx_dump_stack_lvl+0x10/0x10
[  202.471479][ T7842]  ? __pfx__printk+0x10/0x10
[  202.471506][ T7842]  ? print_lock_name+0xde/0x100
[  202.471532][ T7842]  print_circular_bug+0x2ee/0x310
[  202.471559][ T7842]  check_noncircular+0x134/0x160
[  202.471586][ T7842]  validate_chain+0xb9b/0x2140
[  202.471619][ T7842]  __lock_acquire+0xab9/0xd20
[  202.471641][ T7842]  ? kernfs_remove+0x30/0x60
[  202.471659][ T7842]  lock_acquire+0x120/0x360
[  202.471677][ T7842]  ? kernfs_remove+0x30/0x60
[  202.471701][ T7842]  down_write+0x96/0x1f0
[  202.471726][ T7842]  ? kernfs_remove+0x30/0x60
[  202.471743][ T7842]  ? __pfx_down_write+0x10/0x10
[  202.471759][ T7842]  ? kernfs_root+0x1c/0x230
[  202.471774][ T7842]  ? kernfs_root+0x1c/0x230
[  202.471788][ T7842]  ? kernfs_root+0x1c/0x230
[  202.471803][ T7842]  ? kernfs_root+0x1ea/0x230
[  202.471818][ T7842]  kernfs_remove+0x30/0x60
[  202.471835][ T7842]  __kobject_del+0xe1/0x300
[  202.471853][ T7842]  kobject_del+0x45/0x60
[  202.471867][ T7842]  elevator_change_done+0xef/0x540
[  202.471891][ T7842]  elevator_change+0x332/0x450
[  202.471915][ T7842]  elevator_set_none+0x42/0xb0
[  202.471937][ T7842]  blk_mq_update_nr_hw_queues+0x72c/0x19a0
[  202.471974][ T7842]  ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10
[  202.472010][ T7842]  ? sysfs_add_file_mode_ns+0x259/0x300
[  202.472040][ T7842]  nbd_start_device+0x17f/0xb10
[  202.472073][ T7842]  ? device_create_file+0xf4/0x1c0
[  202.472091][ T7842]  nbd_genl_connect+0x135b/0x18f0
[  202.472121][ T7842]  ? __pfx_nbd_genl_connect+0x10/0x10
[  202.472152][ T7842]  ? __nla_parse+0x40/0x60
[  202.472180][ T7842]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  202.472206][ T7842]  genl_family_rcv_msg_doit+0x215/0x300
[  202.472231][ T7842]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  202.472257][ T7842]  ? stack_trace_save+0x9c/0xe0
[  202.472286][ T7842]  genl_rcv_msg+0x60e/0x790
[  202.472308][ T7842]  ? __pfx_genl_rcv_msg+0x10/0x10
[  202.472328][ T7842]  ? __pfx_nbd_genl_connect+0x10/0x10
[  202.472360][ T7842]  netlink_rcv_skb+0x208/0x470
[  202.472386][ T7842]  ? __lock_acquire+0xab9/0xd20
[  202.472404][ T7842]  ? __pfx_genl_rcv_msg+0x10/0x10
[  202.472424][ T7842]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  202.472458][ T7842]  ? down_read+0x1ad/0x2e0
[  202.472474][ T7842]  genl_rcv+0x28/0x40
[  202.472492][ T7842]  netlink_unicast+0x82c/0x9e0
[  202.472519][ T7842]  ? __pfx_netlink_unicast+0x10/0x10
[  202.472543][ T7842]  ? netlink_sendmsg+0x642/0xb30
[  202.472569][ T7842]  ? skb_put+0x11b/0x210
[  202.472586][ T7842]  netlink_sendmsg+0x805/0xb30
[  202.472619][ T7842]  ? __pfx_netlink_sendmsg+0x10/0x10
[  202.472648][ T7842]  ? aa_sock_msg_perm+0xf1/0x1d0
[  202.472672][ T7842]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  202.472697][ T7842]  ? __pfx_netlink_sendmsg+0x10/0x10
[  202.472731][ T7842]  __sock_sendmsg+0x21c/0x270
[  202.472755][ T7842]  ____sys_sendmsg+0x505/0x830
[  202.472776][ T7842]  ? __pfx_____sys_sendmsg+0x10/0x10
[  202.472798][ T7842]  ? import_iovec+0x74/0xa0
[  202.472818][ T7842]  ___sys_sendmsg+0x21f/0x2a0
[  202.472837][ T7842]  ? __pfx____sys_sendmsg+0x10/0x10
[  202.472869][ T7842]  ? __fget_files+0x2a/0x420
[  202.472892][ T7842]  ? __fget_files+0x3a0/0x420
[  202.472919][ T7842]  __x64_sys_sendmsg+0x19b/0x260
[  202.472939][ T7842]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  202.472963][ T7842]  ? rcu_is_watching+0x15/0xb0
[  202.472987][ T7842]  ? do_syscall_64+0xbe/0x3b0
[  202.473015][ T7842]  do_syscall_64+0xfa/0x3b0
[  202.473042][ T7842]  ? lockdep_hardirqs_on+0x9c/0x150
[  202.473066][ T7842]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  202.473083][ T7842]  ? clear_bhb_loop+0x60/0xb0
[  202.473102][ T7842]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  202.473120][ T7842] RIP: 0033:0x7fc2f158ebe9
[  202.473137][ T7842] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  202.473154][ T7842] RSP: 002b:00007fc2f2487038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  202.473175][ T7842] RAX: ffffffffffffffda RBX: 00007fc2f17b5fa0 RCX: 00007fc2f158ebe9
[  202.473189][ T7842] RDX: 0000000020000000 RSI: 0000200000001ac0 RDI: 0000000000000005
[  202.473201][ T7842] RBP: 00007fc2f1611e19 R08: 0000000000000000 R09: 0000000000000000
[  202.473212][ T7842] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  202.473223][ T7842] R13: 00007fc2f17b6038 R14: 00007fc2f17b5fa0 R15: 00007ffe14cf6788
[  202.473243][ T7842]  </TASK>
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  202.995779][ T7846] input: syz1 as /devices/virtual/input/input13
[  203.064999][ T7847] /dev/rnullb0: Can't open blockdev
[  203.070491][ T5879] block nbd0: Receive control failed (result -32)
[  203.077560][ T5871] block nbd0: Receive control failed (result -32)
[  203.085603][ T5884] block nbd0: Receive control failed (result -32)
[  203.176094][ T7842] nbd0: detected capacity change from 0 to 127
[  203.213281][ T5885] block nbd0: Dead connection, failed to find a fallback
[  203.267174][ T5885] block nbd0: shutting down sockets
[  203.304235][ T5885] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  203.317489][ T5885] Buffer I/O error on dev nbd0, logical block 0, async page read
[  203.327605][ T5885] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  203.338613][ T5885] Buffer I/O error on dev nbd0, logical block 1, async page read
[  203.348655][ T5885] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  203.358896][ T5885] Buffer I/O error on dev nbd0, logical block 2, async page read
[  203.368429][ T5885] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  203.382153][ T5885] Buffer I/O error on dev nbd0, logical block 3, async page read
[  203.390926][ T5885] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  203.401869][ T5885] Buffer I/O error on dev nbd0, logical block 0, async page read
[  203.412263][ T5885] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  203.422079][ T5885] Buffer I/O error on dev nbd0, logical block 1, async page read
[  203.430610][ T5885] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  203.440301][ T5885] Buffer I/O error on dev nbd0, logical block 2, async page read
[  203.448963][ T5885] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  203.459248][ T5885] Buffer I/O error on dev nbd0, logical block 3, async page read
[  203.467373][ T5885] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  203.476661][ T5885] Buffer I/O error on dev nbd0, logical block 0, async page read
[  203.486167][ T5885] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  203.495661][ T5885] Buffer I/O error on dev nbd0, logical block 1, async page read
[  203.506260][ T5885] ldm_validate_partition_table(): Disk read failed.
[  203.515030][ T5885] Dev nbd0: unable to read RDB block 0
[  203.522652][ T5885]  nbd0: unable to read partition table
[  203.535676][ T5885] ldm_validate_partition_table(): Disk read failed.
[  203.573365][ T5885] Dev nbd0: unable to read RDB block 0
[  203.612299][ T5885]  nbd0: unable to read partition table
[  204.179155][ T1003] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  204.240698][ T1003] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  204.316432][ T1003] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  204.378974][ T1003] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  204.533692][ T1003] bridge_slave_1: left allmulticast mode
[  204.539657][ T1003] bridge_slave_1: left promiscuous mode
[  204.545857][ T1003] bridge0: port 2(bridge_slave_1) entered disabled state
[  204.557243][ T1003] bridge_slave_0: left allmulticast mode
[  204.569506][ T1003] bridge_slave_0: left promiscuous mode
[  204.575936][ T1003] bridge0: port 1(bridge_slave_0) entered disabled state
[  204.697796][ T1003] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  204.710228][ T1003] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  204.720616][ T1003] bond0 (unregistering): Released all slaves
[  204.937513][ T1003] hsr_slave_0: left promiscuous mode
[  204.946541][ T1003] hsr_slave_1: left promiscuous mode
[  204.954165][ T1003] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  204.961934][ T1003] batman_adv: batadv0: Removing interface: batadv_slave_0
[  204.971421][ T1003] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  204.983449][ T1003] batman_adv: batadv0: Removing interface: batadv_slave_1
[  204.999734][ T1003] veth1_macvtap: left promiscuous mode
[  205.007897][ T1003] veth0_macvtap: left promiscuous mode
[  205.014534][ T1003] veth1_vlan: left promiscuous mode
[  205.020227][ T1003] veth0_vlan: left promiscuous mode
[  205.241658][ T1003] team0 (unregistering): Port device team_slave_1 removed
[  205.266676][ T1003] team0 (unregistering): Port device team_slave_0 removed
[  205.624200][ T1003] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  205.691959][ T1003] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  205.749190][ T1003] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  205.809652][ T1003] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  205.928029][ T1003] bridge_slave_1: left allmulticast mode
[  205.936720][ T1003] bridge_slave_1: left promiscuous mode
[  205.942693][ T1003] bridge0: port 2(bridge_slave_1) entered disabled state
[  205.952305][ T1003] bridge_slave_0: left allmulticast mode
[  205.958087][ T1003] bridge_slave_0: left promiscuous mode
[  205.965446][ T1003] bridge0: port 1(bridge_slave_0) entered disabled state
[  206.095239][ T1003] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  206.108346][ T1003] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  206.121068][ T1003] bond0 (unregistering): Released all slaves
[  206.340406][ T1003] hsr_slave_0: left promiscuous mode
[  206.348642][ T1003] hsr_slave_1: left promiscuous mode
[  206.356699][ T1003] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  206.364751][ T1003] batman_adv: batadv0: Removing interface: batadv_slave_0
[  206.378169][ T1003] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  206.390682][ T1003] batman_adv: batadv0: Removing interface: batadv_slave_1
[  206.405359][ T1003] veth1_macvtap: left promiscuous mode
[  206.411689][ T1003] veth0_macvtap: left promiscuous mode
[  206.418283][ T1003] veth1_vlan: left promiscuous mode
[  206.424689][ T1003] veth0_vlan: left promiscuous mode
[  206.632859][ T1003] team0 (unregistering): Port device team_slave_1 removed
[  206.657736][ T1003] team0 (unregistering): Port device team_slave_0 removed
[  206.959056][ T1003] IPVS: stop unused estimator thread 0...