last executing test programs: 47.206176072s ago: executing program 2 (id=1123): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000ac0)=@newlink={0x6c, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x1414, 0x2021}, [@IFLA_LINKINFO={0x44, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x34, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x3}, @IFLA_VLAN_EGRESS_QOS={0x28, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x0, 0x8}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x80000100, 0xffdfff00}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x0, 0xc6}}]}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000ac0)=@newlink={0x6c, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x1414, 0x2021}, [@IFLA_LINKINFO={0x44, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x34, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x3}, @IFLA_VLAN_EGRESS_QOS={0x28, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x0, 0x8}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x80000100, 0xffdfff00}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x0, 0xc6}}]}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) r3 = syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0xb8f1, 0x1, 0xffffffee, 0x1c3}, &(0x7f0000000040)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = syz_io_uring_setup(0x445e, &(0x7f0000000240)={0x0, 0x8cba, 0x10324, 0x0, 0x0, 0x0, r3}, &(0x7f0000000100)=0x0, &(0x7f0000000300)=0x0) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f00000001c0)=@IORING_OP_SPLICE={0x1e, 0x18, 0x0, @fd_index=0x4, 0x1, {0x0, r6}, 0x1, 0x7, 0x0, {0x0, r9}}) (async) syz_io_uring_submit(r7, r8, &(0x7f00000001c0)=@IORING_OP_SPLICE={0x1e, 0x18, 0x0, @fd_index=0x4, 0x1, {0x0, r6}, 0x1, 0x7, 0x0, {0x0, r9}}) io_uring_enter(r6, 0x291c, 0x0, 0x0, 0x0, 0x0) r10 = getpid() sched_setscheduler(r10, 0x2, &(0x7f0000000200)=0x6) (async) sched_setscheduler(r10, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r11, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r12, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r11, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r11, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000500)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x48, 0x0, 0x10000, 0x3, 0x0, 0xfffffffd, 0x0, 0x1, {0x3}}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) (async) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) 42.508157011s ago: executing program 2 (id=1135): syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xdc}}, 0x0) process_vm_readv(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount$overlay(0x0, 0x0, 0x0, 0x1a80005, 0x0) r1 = syz_socket_connect_nvme_tcp() recvmsg$inet_nvme(r1, 0x0, 0x101) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000000009010800"/18], 0x14}}, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_trace_dev_match', 0x0, 0x0) read$FUSE(r2, &(0x7f00000034c0)={0x2020}, 0x2020) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000000)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x14, r4}) setsockopt$inet6_mreq(r3, 0x29, 0x1b, &(0x7f0000004c40)={@remote, r4}, 0x14) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) write$nbd(r5, &(0x7f00000003c0)=ANY=[], 0x40) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sendmsg$TIPC_NL_NET_SET(r5, &(0x7f0000000540)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x801200}, 0xc, &(0x7f0000000500)={&(0x7f00000005c0)={0x188, 0x0, 0x4, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x3c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffbff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xc}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}]}, @TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}]}, @TIPC_NLA_SOCK={0x78, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xc}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3fc00000}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x285}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffffe00}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffffffd}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7fff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x80000001}]}]}, @TIPC_NLA_NODE={0x58, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x4a, 0x4, {'gcm(aes)\x00', 0x22, "566ddfa5f7115ef36a7d59262d89a5a83ef185c0a418d7d56e18258882188cd913a1"}}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xdccd}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}]}]}, 0x188}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 41.689388968s ago: executing program 2 (id=1137): madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) clock_gettime(0xfffffffffffffff6, 0x0) listen(0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00'}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) sendmmsg$inet6(r0, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000600)}}], 0x1, 0x40) prlimit64(0x0, 0x0, &(0x7f0000000140)={0xa, 0x8b}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0xd94e8ec69dc85bd8) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x9, 0x6, 0x101, 0xa, 0x0, {0x2}}, 0x1c}, 0x1, 0x0, 0x0, 0x440cc}, 0xfee2b3f3ef9b6668) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x42, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket(0x2, 0xa, 0x300) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) sendto$inet(r2, &(0x7f00000002c0)="f6474d61a9a477b7105a83a1baae0aee8c161f713c573dfe58674ede282bc87761f3da5b0bc328e5d56686887e4bb977b46b2f3b98ffdb5c45ec10617e48cc6a0b0af8470bb23346e01e0cf10a9303f6331aba9552c37fa56729b3e6663154dc6ad1f9acffc04aa0a2337269eb8934719210bb8789cb369302b5b2d96a", 0xffffffffffffff94, 0x8050, 0x0, 0xfffffffffffffdfc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20008081}, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) syz_open_procfs$namespace(0x0, 0x0) r4 = socket(0x1e, 0x4, 0x0) socketpair(0x8000000000001e, 0x1, 0x0, &(0x7f0000000140)) getsockname$inet(r4, &(0x7f0000000000), &(0x7f0000001200)=0x10) writev(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r4, &(0x7f0000000080), 0x0, 0x14) 36.717378299s ago: executing program 2 (id=1149): syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000070018610ac0562025342019d00010902120001010000000904dfcd14037e0200"], 0x0) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x2c00) syz_usb_connect$uac1(0x4, 0xd4, &(0x7f0000000640)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc2, 0x3, 0x1, 0xa7, 0x0, 0x8, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x7}, [@output_terminal={0x9, 0x24, 0x3, 0x6, 0x101, 0x6, 0x1, 0x8}, @input_terminal={0xc, 0x24, 0x2, 0x3, 0x1ff, 0x1, 0x3, 0x4, 0x9}, @selector_unit={0x9, 0x24, 0x5, 0x1, 0x3, "279cd665"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x7, 0xb, 0x1, {0x7, 0x25, 0x1, 0x83, 0x7, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x9, 0x24, 0x2, 0x1, 0x9, 0x1, 0x2, 0xa, 'O'}, @format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x5, 0x7f, 0x81, "4719a42899b6"}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0xe8, 0x1, 0x52, 0xf8, "f8b95df0c330df243b"}, @format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0xb, 0x2, 0x80, 0x6, "a72399", "62cc41"}, @as_header={0x7, 0x24, 0x1, 0xff, 0xb, 0x1803}, @as_header={0x7, 0x24, 0x1, 0x4, 0x80, 0xc6b0456a679d9ae7}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x6, 0x4, 0x8, {0x7, 0x25, 0x1, 0x1, 0x5}}}}}}}]}}, &(0x7f0000000a00)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x310, 0x1, 0x8, 0x2, 0x0, 0x4}, 0x27, &(0x7f0000000a80)=ANY=[@ANYBLOB="050f27000318100a03e30000000f8f0700cfc000005f0000003000000007810003100b00000000a1374bf81083a9293d9b8efb201ee8fc20c07678d463b9bf0dc8f03c6d8b65e73b41f1f8478ab82910f3c4cbf6442487a71fbc9d55f68c251859819e56830283bbed2f9a1c852314b0c35822d54467e8f9fa5db0cca3e771425aa128e9c7b306b78338ab7ab40ee12b4df474f6591a4b4299c548136d8a8d7a906df7c94cf11417fc4e4cf4"], 0x4, [{0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x458}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x2c}}, {0xe7, &(0x7f0000000840)=@string={0xe7, 0x3, "686568b0072043ad1ebd96b71fb0d10b18d913d6a0976f590d38d6d6427aafa536c670b07833341985d4a65f0bde73c296820450f08a77d504522e0999fe91be3f79f04ce8611b4bf8fb20c3fa34d28023d2e13e3cfab4052bf114a0ea723946fd2faf16858757f3b997bb87bda0773ca05789ff8e03844b742ce75cce0c712a7f6e76ab5ab74f1a82c2a5d931d279881e224a0a364fd21bba24b03c001013a048c9c4d4bd4e402e418e53a610e42a172e8669b615b7fa7b53f669ea63363e818f9f359ca2d8b5d41ce42b74833f392bca3eee34bbde3ce7b4d62a2e8f03c2c4d0cef7d86c"}}, {0x84, &(0x7f0000000940)=@string={0x84, 0x3, "d4efb6ee042d971e17681c877946598bac37b581f7432f7ccc9f46d7831fa5d2bb946e761d112bacdeb7942400efddf3922e7d4cf23c04594c192c451224a027ddfe70f81958d865c20a985e4a3a44ec67150ac9aa1dfe54f51709c7a91f5eb60449d592b8efae02aacf70231ea8ee2d88287c7333430c78076a926e47d0c3e5f191"}}]}) ioctl$SG_GET_VERSION_NUM(r0, 0x2284, &(0x7f0000000080)) syz_open_dev$MSR(&(0x7f0000000600), 0x9, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000d80)={0x60, 0x0, &(0x7f0000000c40)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000bc0)={@fda={0x66646185, 0x7, 0x2}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000b40)=""/84, 0x54, 0x0, 0xb}}, &(0x7f0000000780)={0x0, 0x20, 0x38}}, 0x40}, @acquire_done={0x40106309, 0x1}], 0xa8, 0x0, &(0x7f0000000cc0)="af23514d9feded85a573116f1ca37bbc8244f43046a45e101cb2cd015d24f6d4c6a169e804a332470eee6c1da1eb6e9335ab90021276c9872f64227f43b28a2b6b31c93c525b318984000ccc2f5c3b0b07b25dc25e54e7294b77441f4f9e38cb1618d57cdfe78156fbeaf1ad9c7155f7b17a3ace5b1ec6566523fa5f1030033c15183e7c58edc3b811fd96fee894eccdd06b301fb6adbf42e452cadcca9a06e04dba0641799a8df6"}) syz_usb_connect$uac1(0x2, 0x10d, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x0, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfb, 0x3, 0x1, 0x7, 0x30, 0x9, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x5, 0x3}, [@feature_unit={0xf, 0x24, 0x6, 0x4, 0x6, 0x4, [0x8, 0x2, 0x3, 0x5], 0x2}, @mixer_unit={0x7, 0x24, 0x4, 0x5, 0x2, "be1b"}, @mixer_unit={0xb, 0x24, 0x4, 0x5, 0x5, "4e41c195c7b0"}, @selector_unit={0x7, 0x24, 0x5, 0x4, 0x3, 'zh'}, @processing_unit={0x8, 0x24, 0x7, 0x3, 0x1, 0x0, "1d"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x0, 0x8, 0x30, "03"}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x7f, 0x1, 0xfa, 0x2, "b5cb5f62bbac60f88e"}, @format_type_i_discrete={0xf, 0x24, 0x2, 0x1, 0xc, 0x2, 0x1, 0x0, "ba349cf875c741"}, @format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x4, 0x65, 0xc, "eb26237b19d8"}, @as_header={0x7, 0x24, 0x1, 0x8d, 0x8, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x7, 0x6, 0x7, {0x7, 0x25, 0x1, 0x1, 0xf9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x2, 0x101, 0x6, "874c7b3853"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0xd5, 0x1, 0x9, 0x2, 'o{', "e8"}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x1, 0x2, 0x5, 0x1, "1f", "deea3b"}, @as_header={0x7, 0x24, 0x1, 0xfc, 0xc2, 0x3}]}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0xbb, 0xff, 0x1, {0x7, 0x25, 0x1, 0x2, 0x9, 0x5}}}}}}}]}}, &(0x7f0000000540)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x310, 0x3, 0xe0, 0x7, 0x8, 0x4}, 0xf6, &(0x7f00000001c0)={0x5, 0xf, 0xf6, 0x6, [@generic={0x89, 0x10, 0x4, "6719726ddf26323fee085e9bc4b4290e58888236e84ef53b8099cce3a98c0011373034bee962278836db5a0ea3c977322114c9f531a04de62b29b228c4bbc79e7d42a27a66175bcb9571d7f645a08cbe74a4a4449a99536628097ed4396c991f58880f7d73a1fdef7875d15c06b0b969448b09b7ad85e8c5422252d0b0ba60ffcadac0e286c2"}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x9, 0x5, 0x4, 0x4}, @generic={0x4d, 0x10, 0x1, "fadee0d7e21f1b3e033de52c7827d40927f377d2434ffb8d11847bd198db6de34383d91629f898388389ab625601dc0443a9cc07b25dee877dfcf08181db8c6f1f5691f4632d50c39f9e"}, @ext_cap={0x7, 0x10, 0x2, 0x1c, 0x1, 0x4, 0x5b30}, @ext_cap={0x7, 0x10, 0x2, 0xc, 0xc, 0x5, 0xe}]}, 0xa, [{0x5, &(0x7f00000002c0)=@string={0x5, 0x3, "66be9a"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x804}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0xb489cded69d5ee14}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x409}}, {0x4, &(0x7f00000003c0)=@string={0x4, 0x3, "318c"}}, {0x3, &(0x7f0000000400)=@string={0x3, 0x3, '='}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x425}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0xc09}}, {0x33, &(0x7f00000004c0)=@string={0x33, 0x3, "c542fc582f4f5acf971be834212f757534ae0778edd7401f726030f38192a81893186987816b0e1b27c01c181b42fdab43"}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x424}}]}) 32.345496704s ago: executing program 2 (id=1162): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x6, &(0x7f0000000f80)=ANY=[@ANYBLOB="180000000000000000000000fdffffff183300000500000300aa4c61ff000000000000009500000000000000950000000000000002969b4c5a4b3f7a1088b6e7a54695e4b5f78104299e0e92a1a06dd2d23a5d2b022d64000000000000"], &(0x7f0000000180)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f0000000000000000850000006d000000850000000800000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0xe1}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000001a00fffcbca300000000000024030000c0feffff620af0fff8ffffff71a4f2ff000000001f03000000000000e5000200000000002604fdffff02000014010000030000001d130000000000007a0a00fe0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x10, &(0x7f00000000c0), 0xfffffffffffffd27}, 0x48) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x10, 0x3, 0x0) write$rfkill(0xffffffffffffffff, &(0x7f0000000100)={0x15, 0x5, 0x2}, 0x8) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000001040)={r4, 0xffffffffffffffff, 0x26, 0x0, @val=@netfilter={0x3, 0x0, 0x1ff}}, 0x20) r5 = syz_io_uring_setup(0x498, 0x0, &(0x7f0000000340), &(0x7f0000000040)) io_uring_enter(r5, 0x627, 0x4c1, 0x43, 0x0, 0x0) semctl$IPC_RMID(0x0, 0x0, 0x0) open$dir(0x0, 0x200200, 0x15) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000}, 0x0) 31.234106404s ago: executing program 2 (id=1168): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5543, 0x47, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0xb1, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x101, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0xc}}}}}]}}]}}, 0x0) syz_open_dev$hiddev(&(0x7f0000000180), 0x10000, 0x1) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x1e, 0x0, 0x2, 0xff}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="84020000100001042cbd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="7b130000018000003c0012800b00010062726964676500002c00028008001b00e709000008001b00ff03001005002c0005000000050016000000000008001a00"], 0x284}}, 0x20000844) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000100)={0x90000004}) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="0000000000000000b7"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa101, 0x0) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000000c0)={0x4e00, 0x0, 0x730, 0xbdff, 0x10, "feeeff000000001b"}) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0xff2e) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$vim2m_VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f0000000240)={0x3, 0x80, 0x1, {0x1, @sliced={0x7fff, [0x3, 0x800, 0x8, 0x3, 0xc3f, 0x2, 0x6, 0x30, 0x7, 0xb, 0x4000, 0x400, 0xd9, 0x6, 0x8001, 0x7, 0x4, 0x0, 0x2, 0x4, 0xfff, 0x6, 0x0, 0xf, 0x5, 0x8000, 0x7, 0xc, 0x0, 0x6, 0x3, 0x101, 0x94c, 0x8, 0x1, 0x1, 0x7, 0x9, 0x2, 0xa, 0x6ca, 0x5, 0xea23, 0x87e1, 0x2, 0x8, 0x401, 0x60], 0x2}}, 0x8}) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x3, 0x0, 0x0, "0062ba7d82000000000000000000f7fffeff00"}) r4 = syz_open_pts(r2, 0x8182) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r4, 0x8008f512, &(0x7f00000001c0)) r5 = dup3(r4, r2, 0x0) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000000)=0x17) syz_usb_control_io(r0, 0x0, 0x0) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) syz_emit_ethernet(0xfdef, &(0x7f0000000740)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @remote, @void, {@x25={0x805, {0x2, 0x1, 0x27}}}}, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$FUSE_INIT(r6, &(0x7f0000000400)={0x6f, 0x0, 0x0, {0x7, 0x28, 0x80000001, 0x0, 0x0, 0x0, 0x2, 0x1}}, 0xfffffede) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r6, 0x89fa, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000080)={@local, @remote, 0x5, 0xa}}) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000040)={0x0, 0x7, 0x5, {0x5, 0x0, "00f400"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 19.121113278s ago: executing program 0 (id=1199): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x0) 18.241638413s ago: executing program 0 (id=1202): open(&(0x7f0000000240)='./file0\x00', 0x200240, 0x111) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000b40)={0x56, 0x0, 0x8, {0x80c, 0x1}, {0x45, 0x400}, @rumble={0xdd, 0x8}}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r4, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) ioctl$EVIOCGKEY(r1, 0x80404518, 0x0) r5 = socket$netlink(0x10, 0x3, 0x10) r6 = openat$smackfs_change_rule(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) write$smackfs_change_rule(r6, &(0x7f0000000000)=ANY=[@ANYBLOB='{+ #! xr r'], 0xe) r7 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000001000000000000002000095"], &(0x7f0000000100)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='contention_end\x00', r8}, 0x10) r9 = userfaultfd(0x0) ioctl$UFFDIO_API(r9, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r9, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r9, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00001b1000/0x4000)=nil, 0x400000, 0x2, 0x2}) madvise(&(0x7f0000be8000/0x1000)=nil, 0x1000, 0x4) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000000}, 0x0) 14.545702919s ago: executing program 32 (id=1168): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5543, 0x47, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0xb1, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x101, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0xc}}}}}]}}]}}, 0x0) syz_open_dev$hiddev(&(0x7f0000000180), 0x10000, 0x1) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x1e, 0x0, 0x2, 0xff}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="84020000100001042cbd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="7b130000018000003c0012800b00010062726964676500002c00028008001b00e709000008001b00ff03001005002c0005000000050016000000000008001a00"], 0x284}}, 0x20000844) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000100)={0x90000004}) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="0000000000000000b7"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa101, 0x0) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000000c0)={0x4e00, 0x0, 0x730, 0xbdff, 0x10, "feeeff000000001b"}) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0xff2e) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$vim2m_VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f0000000240)={0x3, 0x80, 0x1, {0x1, @sliced={0x7fff, [0x3, 0x800, 0x8, 0x3, 0xc3f, 0x2, 0x6, 0x30, 0x7, 0xb, 0x4000, 0x400, 0xd9, 0x6, 0x8001, 0x7, 0x4, 0x0, 0x2, 0x4, 0xfff, 0x6, 0x0, 0xf, 0x5, 0x8000, 0x7, 0xc, 0x0, 0x6, 0x3, 0x101, 0x94c, 0x8, 0x1, 0x1, 0x7, 0x9, 0x2, 0xa, 0x6ca, 0x5, 0xea23, 0x87e1, 0x2, 0x8, 0x401, 0x60], 0x2}}, 0x8}) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x3, 0x0, 0x0, "0062ba7d82000000000000000000f7fffeff00"}) r4 = syz_open_pts(r2, 0x8182) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r4, 0x8008f512, &(0x7f00000001c0)) r5 = dup3(r4, r2, 0x0) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000000)=0x17) syz_usb_control_io(r0, 0x0, 0x0) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) syz_emit_ethernet(0xfdef, &(0x7f0000000740)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @remote, @void, {@x25={0x805, {0x2, 0x1, 0x27}}}}, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$FUSE_INIT(r6, &(0x7f0000000400)={0x6f, 0x0, 0x0, {0x7, 0x28, 0x80000001, 0x0, 0x0, 0x0, 0x2, 0x1}}, 0xfffffede) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r6, 0x89fa, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000080)={@local, @remote, 0x5, 0xa}}) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000040)={0x0, 0x7, 0x5, {0x5, 0x0, "00f400"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 11.447425089s ago: executing program 3 (id=1211): syz_usb_connect(0x0, 0x24, &(0x7f0000000540)={{0x12, 0x1, 0x0, 0xe7, 0x19, 0x87, 0x40, 0xeb1, 0x7007, 0x205, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff, 0x0, 0xff}}]}}]}}, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYRES32=0x0], 0x0) syz_usb_control_io(r0, &(0x7f0000000200)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000740)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/fib_triestat\x00') write$P9_RWSTAT(r1, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e24, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}, 0x10000}, 0x1c) 11.309614407s ago: executing program 0 (id=1213): socket$tipc(0x1e, 0x4, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$alg(0x26, 0x5, 0x0) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$vhost_msg(0xffffffffffffffff, 0x0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000000000000000010"], 0x50}}, 0x0) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f00000000c0)='\x00', 0x1) preadv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000033a80)=""/102386, 0x18ff2}], 0x2a, 0x0, 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x80042, 0x0) r8 = socket$inet6(0xa, 0x3, 0x7) getsockopt$inet6_buf(r8, 0x29, 0x3d, &(0x7f0000000040)=""/154, &(0x7f0000000100)=0x9a) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000080)=0xd) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) 10.082682093s ago: executing program 0 (id=1214): bpf$PROG_LOAD(0x5, &(0x7f0000003380)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000006cfa000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000005"], 0x50) (async) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/freeze_filesystems', 0x101a02, 0xc8) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r1, &(0x7f0000000180)={0x5, 0x10, 0xfa00, {0x0, 0xffffffffffffffff, 0x1}}, 0x18) (async) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) (async) r3 = syz_open_procfs(0x0, 0x0) write$uinput_user_dev(r3, 0x0, 0x0) (async) pwrite64(r3, 0x0, 0x44, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) (async) r4 = syz_io_uring_setup(0xac9, &(0x7f00000002c0)={0x0, 0x3594, 0x10, 0x1103, 0x21e}, &(0x7f0000000240)=0x0, &(0x7f0000000340)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) r7 = socket$inet_sctp(0x2, 0x1, 0x84) r8 = dup(r7) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r8, 0x84, 0x85, &(0x7f00000012c0)={0x0, @in6={{0xa, 0x4e22, 0x7f, @empty, 0xf8b}}, 0x6, 0x6}, 0x90) (async) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e22, 0xf8d, @empty, 0x4}}, 0x13fffffe, 0x5, 0x0, 0x1f4, 0x30, 0xfffffffd, 0x13}, 0x9c) sendmmsg$inet(r8, &(0x7f00000009c0)=[{{&(0x7f0000000300)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000900)=[{&(0x7f0000000340)="04", 0x1}], 0x1}}], 0x1, 0x4000800) (async) syz_io_uring_submit(r5, r6, &(0x7f00000004c0)=@IORING_OP_TIMEOUT={0xb, 0x10, 0x0, 0x0, 0x0, &(0x7f00000005c0)={0x0, 0x3938700}, 0x1, 0x8}) io_uring_enter(r4, 0x6efc, 0x3900, 0xb, 0x0, 0x0) (async) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r4, 0x18, &(0x7f00000000c0)={0x1, 0xffffffffffffffff, 0x35, {0x5, 0x1}, 0x1}, 0x1) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) (async) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0x3, 0xc, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058", @ANYRES32=r2], 0x0}, 0x94) (async) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000780)={&(0x7f0000000400)='locks_get_lock_context\x00', r9}, 0x3d) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) fcntl$lock(r10, 0x26, &(0x7f0000000000)) 9.838065727s ago: executing program 0 (id=1215): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x13, &(0x7f0000000180)=0x80000004, 0x51) futex(&(0x7f000000cffc)=0x4, 0xb, 0x4, 0x0, 0x0, 0x0) futex(0x0, 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0) socket$xdp(0x2c, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000080), 0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt(r4, 0x3, 0x1, &(0x7f00000000c0)="c9a13e03d9b679a6", 0x8) sendmmsg$inet(r2, &(0x7f0000001540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40000) close(r3) syz_emit_ethernet(0x46, &(0x7f0000000000)={@local, @random='\x00 \x00\x00\x00\b', @void, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x2a}, {[@lsrr={0x83, 0x7, 0xd7, [@multicast2]}, @ssrr={0x89, 0x7, 0xd8, [@multicast2]}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001d00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) r5 = syz_io_uring_setup(0x1458, &(0x7f00000004c0)={0x0, 0x3, 0x10180, 0x2000, 0x3ae}, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='9'], 0x38}}, 0x4000) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r8, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r8, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x6a, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2040, 0x1}) io_uring_enter(r5, 0x2d3e, 0xfffffffd, 0x0, 0x0, 0x0) write$6lowpan_control(0xffffffffffffffff, &(0x7f0000000000)='connect aa:aa:aa:aa:aa:11 2', 0x1b) 9.630178718s ago: executing program 1 (id=1216): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000c00), 0x2, 0x0) write$vhost_msg_v2(r0, &(0x7f0000002b40)={0x2, 0x0, {&(0x7f0000000340)=""/172, 0xac, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg(r0, &(0x7f0000000540)={0x1, {&(0x7f0000000040)=""/62, 0x3e, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000280)={0x2, 0x0, {&(0x7f0000002cc0)=""/255, 0xff, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000004c0)={0x2, 0x0, {&(0x7f0000000400)=""/185, 0xb9, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000740)=""/187, 0xbb, 0x0, 0x2, 0x3}}, 0x48) 9.254202072s ago: executing program 1 (id=1218): r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0x4, 0xfffff00c}, {0x20, 0x0, 0x0, 0xfffff034}, {0x5, 0x2}]}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0x5, 0x8, 0x2, 0x4}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c3a00000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000080000850000007200000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_SEND_PRIO(r3, 0x6b, 0x3, &(0x7f0000000080)=0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000015000103f7ff0000000000000b0000002b58e3"], 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) 9.027042127s ago: executing program 1 (id=1219): socket$inet(0x2, 0x1, 0x100) socket$inet6_udplite(0xa, 0x2, 0x88) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) gettid() fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) msgctl$MSG_STAT_ANY(0x0, 0xd, &(0x7f0000000000)=""/83) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x67b}]}, 0x10) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x10) sendmmsg$inet(r5, &(0x7f0000002440)=[{{&(0x7f0000000680)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001180)="c545b8e6891930d00e0c9f9a34b60edab22431d599675d86f2f876ea962ace703f8afaf9c4262d97ed63349f484d868856c1bc9cca3150f7e96d42e36ab839caeb28614673b668f1d4bfbc2ffdc9bbb7faa421ca301c10368c46010ec37a088c3414908889082d9fdffe5f74be78e4ab3d545c22d3148d9b024b52ac9280db8ea86894997c083e31229fa2365a8bceb69178468b0b7741df61069d66365ec555624cf395e1359669aec4eb18c84c59149442a7", 0xb3}, {&(0x7f0000001040)="a632d1428982a252324f258392e316f18cf86b2e26ac0af8c71b95c35316f3831129f3e611dc5fa965da5032081ce03b9792739343bf80dbc4659935a61e2b9a7fe3a4a89869f95f15cd0fe0cbc18f6a6d873a310a108980d9011aad98d0e0dddb70480bd18486191b33112719854b86cb73be4fcff420a4caa64c932b46ba10031706e2fa27537ff5b9ee7f54d19f8a6d5dcc1711be704ea7424b04854aa7ea52a67f412b25168797edb27644d2b8356bedb99f1fbe00567f2438cb4f205ad8c0c91d75385b90c102000000000000002c8bcbe34f9411542cc837ee91388dc51b9c9e60a52da69045f95ade368dc4d145513ea2260dc86d637b44376576648e7adca3e283860d34b8bcb6d16aa39d00000000", 0x113}, {&(0x7f00000007c0)="ae21c1ffa47432736ef41d1ca7a55e6ee84fc95a490173e6f97a5c34095cb06b53d352aa1286e387f629ad9defaffa365aaf37ba4d1bac9280fe71822e0900ef5878455e97286102cdde893d7ccc8f6fbaf39ebfc87a0889162556dd2c750b72373cfc7c03b20d68bac0e03f2957d4cebb8fbac2af9aba141fe5820064122f5bd93ebef6e200989cdb", 0x89}, {&(0x7f0000000580)="6b9cacb7f6804c331a3aa9379734ec2aedb597c32af634ddb581e3cef4c3058812b5118b70a11b4169426d7df4887c10782a5cfc7f8ea9995dea4ac79993469d55895298a177c1e96fbc02b422b2f658450f124c1f7fbb0ffc995cac4fb8186835e2811d77f90cd9a4d933cb708bc5a346e7fc85379cca848191ce387c3aba4c12d2c7a110b4ce3114b3bd8d1b7b116a803bd8ce2405f7c43700329ad680dfa721b65823c09cca147a24f365e0cbc678092ae44a632b5c8da7f3e8b31ceaf1b5577b783908da7734f30d7ade6113b3adfebb2b03ed05", 0xd6}, {&(0x7f0000000940)="b3fe109a0a0e5fbf3f4e8ce314c9dee2296599bb37db484506f7f4a1fab11782e0e1581812720001a80b9a0f3b1906d25b5efb254a1119eafe8167fa354fb03a066c8733d91c9127a8c77f2d647fbee113e52351c782ebfba85879d9482fd52ff178111c30472dc8243f1e28fc4d6127452b0d5b98c225054f78c4db08b2aaa9275252150a05682058a0c2b50728dd04c8040000007233beaa311ecc5fe3fa158d", 0xa1}, {&(0x7f0000002500)="b85a302756b5c983924c342778e000aa1707d581478a9fc2db3eb7bb6c82e757c981749d65c93373f6549b488c1d2a4482dbbe77a836e6bd114cf72569cff1b57bc9054f77729d58073686e6fd5b1c92c883cdebfda1463120d2356e16d7cb26624ea547aea16f78ce1cd3c83041147ad29c7994a42c185bbeaa2b209232379157c4efcb82d1d1b1368cb36504f089940aa15f7351221d03d900d329d9019d343e39b49e6acb0bd17a95940f91a3a783f10b828fe8d260bf7600cc87f78a6dccaaa741bb90a1fc4ce4173068f3e3293db23abdf1c488ed70954d1fcafcae8cfe29c52384891d916f45ca246afbe2f81035ea92cf94145d43", 0xf8}, {&(0x7f0000000200)="db328433d8cfa472e00d6224a3fd8b1ce74f128f58df0bf2dd0c555b399256c989a373083e1245810b2661686c82667e784b508659132a8f", 0x38}], 0x7}}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000ac0)="65582f9359a0131171dfb403e1249c431ad1fe8b66afd6ef0c978154f4a27eb98cb25896eeff99e775a758a7a4ce88468bea15e461e3cc83087a642104112fe047a567b0714f81ac002aab74fc8c960ad78df3473fa60d537ecf5a373c13a0c8a6b5686c", 0x64}], 0x1}}], 0x3, 0xc044) write$binfmt_misc(r5, &(0x7f0000000300), 0x5b0) 8.565565993s ago: executing program 3 (id=1221): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x4000000053d2) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="170e0000000000000000010000600500070000000000080009e40000000014001f00000000007f000000000000000000000008000a0000000000060002000100000014002000fefc00000000000000000000000000aa"], 0x5c}}, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x2, &(0x7f00000001c0)=@raw=[@call={0x85, 0x0, 0x0, 0x6c}, @exit], &(0x7f0000000180)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x11}, 0x90) 7.001775312s ago: executing program 1 (id=1222): r0 = open(&(0x7f0000000240)='./file0\x00', 0x200240, 0x111) socket$netlink(0x10, 0x3, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000003c0)={r0, 0x20, &(0x7f0000000200)={&(0x7f0000000480)=""/219, 0xdb, 0x0, &(0x7f0000000b80)=""/4096, 0x1000}}, 0x10) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000b40)={0x56, 0x0, 0x8, {0x80c, 0x1}, {0x45, 0x400}, @rumble={0xdd, 0x8}}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r4, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) ioctl$EVIOCGKEY(r1, 0x80404518, 0x0) r5 = socket$netlink(0x10, 0x3, 0x10) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000001000000000000002000095"], &(0x7f0000000100)='GPL\x00'}, 0x94) r8 = socket$l2tp6(0xa, 0x2, 0x73) recvmsg(r8, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x22) shutdown(r8, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='contention_end\x00', r7}, 0x10) r9 = userfaultfd(0x801) ioctl$UFFDIO_API(r9, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r9, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r9, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00001b1000/0x4000)=nil, 0x400000, 0x2, 0x2}) 7.001251016s ago: executing program 3 (id=1223): socket$tipc(0x1e, 0x4, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$alg(0x26, 0x5, 0x0) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$vhost_msg(0xffffffffffffffff, 0x0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000000000000000010"], 0x50}}, 0x0) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f00000000c0)='\x00', 0x1) preadv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000033a80)=""/102386, 0x18ff2}], 0x2a, 0x0, 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x80042, 0x0) r8 = socket$inet6(0xa, 0x3, 0x7) getsockopt$inet6_buf(r8, 0x29, 0x3d, &(0x7f0000000040)=""/154, &(0x7f0000000100)=0x9a) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000080)=0xd) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) 6.181128513s ago: executing program 4 (id=1224): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@allocspi={0xf4, 0x16, 0x1, 0x0, 0x0, {{{@in6=@mcast1, @in6=@ipv4={'\x00', '\xff\xff', @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0xa0}, {@in6=@mcast2, 0x0, 0x33}, @in6=@empty, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff1, 0x3}, {0x0, 0x0, 0x0, 0xfffffffffffffffe}, {0x0, 0x0, 0x796}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x1a0b1}}, 0xf4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="20010000120013070000000000000000e0000001000000000000000000000000fc000000000000000000000000000000000000000000ffffffffffffff800000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000072c42572f64a264410b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbc18c8582fc7800000000000000000000000050019000000000028001a"], 0x120}}, 0x0) 5.281312472s ago: executing program 3 (id=1225): ioctl$IOCTL_VMCI_GET_CONTEXT_ID(0xffffffffffffffff, 0x7b3, &(0x7f0000000000)) r0 = ioctl$USERFAULTFD_IOC_NEW(0xffffffffffffffff, 0xaa00) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000040), &(0x7f0000000080), 0x2, 0x1) r1 = syz_open_dev$usbmon(&(0x7f00000000c0), 0x1ff, 0x400202) ioctl$MON_IOCQ_URB_LEN(r1, 0x9201) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0xa00) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r2, 0xc08c5336, &(0x7f0000000140)={0x80000000, 0x2, 0x0, 'queue1\x00', 0x10}) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000200)={0x0, 0x0, 0xccd07a331e6fa005, 0x7, 0x401}, &(0x7f0000000240)=0x18) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={r4, @in={{0x2, 0x4e22, @multicast2}}, 0x3, 0x800, 0x8001, 0x5, 0x19, 0xcb4e, 0x2}, 0x9c) ioctl$BLKGETDISKSEQ(0xffffffffffffffff, 0x80081280, &(0x7f0000000340)) io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x6, &(0x7f00000003c0)={0x8000, 0x0, &(0x7f0000000380)=[r0, r1, r2, r2]}, 0x4) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000440)=0x0) sendmsg$AUDIT_SET(r2, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x3c, 0x3e9, 0x2, 0x70bd25, 0x25dfdbfc, {0x2, 0x0, 0xc90b2c802fa9a6a3, r5, 0xed4f, 0x0, 0x2, 0x80000000, 0x0, 0x80, 0x9}, ["", "", "", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x71f51849069e238e) r6 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000540)={0x43, 0x2, 0x3}, 0x10) r7 = socket$unix(0x1, 0x2, 0x0) getsockopt$bt_hci(r7, 0x0, 0x3, &(0x7f0000000580)=""/191, &(0x7f0000000640)=0xbf) sendmsg$OSF_MSG_REMOVE(0xffffffffffffffff, &(0x7f0000001080)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001040)={&(0x7f00000006c0)={0x964, 0x1, 0x5, 0x301, 0x0, 0x0, {0x0, 0x0, 0x9}, [{{0x254, 0x1, {{0x3, 0x8}, 0xc, 0x7, 0x4, 0x0, 0x2, 'syz0\x00', "60a0974c1e88b2e40bdcb448d5ab5e14eabf8fe4eb7986ad3f59fa136ae405cf", "90aec94248c9bb88f0028913caf573f3f33598ed77ea25da24fb76c4ef7d5bfa", [{0xf5b0, 0x6, {0x2, 0x8000}}, {0x200, 0x3}, {0x8, 0x0, {0x2, 0x7}}, {0xc, 0x2, {0x1, 0x1}}, {0x4, 0x8, {0x1, 0x2}}, {0x4, 0x1, {0x0, 0x5}}, {0xd51, 0x4c, {0x1, 0x6}}, {0x5d16, 0x6, {0x0, 0x3ff}}, {0x4, 0x401, {0x3, 0x7}}, {0x0, 0x2, {0x3, 0x9309}}, {0x8, 0x1, {0x0, 0x66}}, {0xe00f, 0xddf2, {0x2, 0xfffffff9}}, {0x2, 0xf33, {0x3, 0xfffffffe}}, {0x770, 0x0, {0x3, 0x1}}, {0xff80, 0x3, {0x3}}, {0xd, 0x57, {0x3, 0x7}}, {0x800, 0x1, {0x2, 0x1}}, {0x8, 0xc, {0x0, 0x4}}, {0x9000, 0xa, {0x2, 0x3ff}}, {0x1, 0x401, {0x1, 0x3}}, {0x6, 0x1, {0x0, 0x4}}, {0x1000, 0x4, {0x0, 0x5}}, {0x4609, 0x8e6, {0x0, 0xc56}}, {0x6, 0x9, {0x1, 0x4}}, {0xfffe, 0xfff, {0x0, 0x1}}, {0x5, 0xcba9, {0x2, 0x6}}, {0x8, 0x9, {0x2, 0x2}}, {0x40, 0x9, {0x2, 0x1}}, {0x828, 0xfff9, {0x2, 0x8}}, {0x8000, 0x8, {0x2, 0x1b1e}}, {0x845, 0x1, {0x3, 0x6}}, {0xc3a, 0x0, {0x3, 0x9}}, {0xd0f8, 0x10, {0x3, 0x200}}, {0x6, 0x400, {0x2, 0x4}}, {0x0, 0x2988, {0x2, 0xbe5b}}, {0x1, 0x6ad7, {0x3, 0x928}}, {0xe, 0x5, {0x0, 0x689}}, {0x8, 0x82f, {0x2, 0x4}}, {0xfc01, 0xdf9e, {0x1, 0x1}}, {0x2, 0xce50, {0x3, 0x6}}]}}}, {{0x254, 0x1, {{0x2, 0xeb}, 0xce, 0x9d, 0x800, 0x7feb, 0x10, 'syz1\x00', "72b5674b723087932956b54f645b5829a270bb6ebac7fd0a0b33a80d96d2851d", "fafa730f390675bdaae24589d6d7fdf5188c8849e3640094c7543bd2c34fea4f", [{0x9, 0x3, {0x2, 0x9cef}}, {0x7d6, 0x9, {0x0, 0xd}}, {0x1, 0x401, {0x3, 0x3}}, {0x6, 0x0, {0x2, 0xfffffff7}}, {0x2, 0x100, {0x2, 0xfffffffc}}, {0x0, 0x8, {0x0, 0x200}}, {0xa2, 0x0, {0x2, 0xff}}, {0x1, 0xff, {0x43fbe0ff61584ebd, 0xffffff7f}}, {0x2, 0x6, {0x2, 0xf9}}, {0x1, 0xd, {0x3, 0x9}}, {0x6, 0x1, {0x3, 0xd4b}}, {0x5, 0x2, {0x2, 0x9}}, {0x1, 0x5, {0xea6717d8c6ccd0ee, 0x800}}, {0x9541, 0x4, {0x0, 0x7}}, {0x1, 0x1, {0x2, 0x1}}, {0xb, 0x2d3f, {0x0, 0x3}}, {0x9, 0x8, {0x2, 0x1}}, {0xffff, 0x4, {0x2, 0xfffffff8}}, {0x2, 0x9, {0x0, 0xff}}, {0x81, 0x8, {0x1, 0x1}}, {0x8859, 0xffe2, {0x0, 0x3}}, {0x1ff, 0xfff, {0x0, 0xffffffff}}, {0x7ff, 0x8000, {0x2, 0xf49}}, {0x1c, 0xf08b, {0x0, 0x6}}, {0x13f, 0x3, {0x3, 0x40000000}}, {0x1, 0x2, {0x0, 0x3}}, {0x3, 0x1, {0x0, 0xaf6}}, {0x528e, 0x6, {0x1, 0x4}}, {0x5, 0x2, {0x2, 0x124180}}, {0x0, 0x200, {0x2, 0xffffff01}}, {0x3, 0x6, {0x2, 0x7fffffff}}, {0x7, 0xc, {0x1, 0x3}}, {0x3, 0x5, {0x2, 0x9}}, {0x80, 0x3fde, {0x3, 0x1}}, {0x7fff, 0x2, {0x3}}, {0x4, 0x0, {0x2, 0x8}}, {0x40, 0x0, {0x0, 0x8}}, {0xfffd, 0x70, {0x2, 0x3}}, {0x4cb, 0x0, {0x2, 0x5}}, {0x8, 0x2, {0x0, 0x3ff}}]}}}, {{0x254, 0x1, {{0x3, 0x2}, 0xd, 0xec, 0xfffc, 0xfffc, 0xd, 'syz0\x00', "999fd903ba71bfed905155ca79b19cab4c6e015b8dfa6df6b6a1f45ffe20f279", "27b9c8cac84deff123eb478ccbbb561f79e112142cea9553ce60ee8031cfd03d", [{0xad, 0xffc0, {0x3, 0xfffffff7}}, {0x9, 0x7, {0x2, 0x100}}, {0x8001, 0xdb2, {0x1, 0xb1b}}, {0x401, 0x9, {0x1, 0x4}}, {0xfc09, 0xfffe, {0x1, 0xfffffff8}}, {0xd, 0x7, {0x0, 0x6}}, {0x8, 0x8001, {0x2, 0xd68e}}, {0x7, 0x101, {0x3, 0x5}}, {0x2, 0x1800, {0x2, 0x5}}, {0x4, 0x43, {0x3, 0xf33}}, {0x1000, 0x3, {0x4, 0xa499}}, {0xdd, 0x6, {0x1, 0x5}}, {0x7, 0xbd}, {0x8001, 0x7, {0x0, 0xb}}, {0x7d, 0x7fff, {0x2, 0x3}}, {0x4, 0x5, {0x0, 0x2723}}, {0x1, 0x7fff, {0x3, 0xdd}}, {0x1, 0x200, {0x0, 0x4}}, {0x7, 0x7, {0x0, 0x80}}, {0x5, 0x401, {0x3, 0x6}}, {0x5, 0x0, {0x2, 0x52cc}}, {0xd1, 0x8, {0x2, 0x5}}, {0xfa1a, 0x9, {0x0, 0x9}}, {0xc7, 0x58, {0x2, 0xa3}}, {0x1ff, 0x86, {0x1, 0x80}}, {0xb1, 0x8000, {0x3, 0x8}}, {0x0, 0x2, {0x3, 0x3}}, {0x6, 0x800, {0x1}}, {0x3, 0x8, {0x3, 0x3}}, {0x1, 0x47, {0x0, 0xfff}}, {0x9, 0x3888, {0x3, 0x8001}}, {0x2, 0xf, {0x2, 0x5995}}, {0x8001, 0xffa7, {0x1, 0x6}}, {0x2, 0xffff, {0x2, 0x7}}, {0x2, 0xffff, {0x2, 0xffffff36}}, {0x3, 0x800, {0x3, 0x5}}, {0x6, 0xffff, {0x2, 0x86}}, {0x400, 0x4f}, {0xd, 0x2, {0x3, 0x503880}}, {0x3, 0x5, {0x3, 0xff45}}]}}}, {{0x254, 0x1, {{0x2, 0x1}, 0x1, 0x8, 0x4, 0x8, 0x25, 'syz0\x00', "8f70c857514c4f4c3c585acb9730d294250ed85c1366dd0c7577dc9944ca5461", "8b0789f2685fd9fda475b4fde786c22c591532a5a06c566b1ec94b1db75a492a", [{0x9, 0x1, {0x1, 0x4}}, {0x8000, 0xfffa, {0x0, 0x1}}, {0x5, 0xfffb, {0x2, 0x2}}, {0x7, 0x6, {0x3, 0xe}}, {0x257, 0x200, {0x1, 0x3}}, {0x0, 0x5, {0x1, 0x9}}, {0x4, 0x4, {0x1, 0x2}}, {0x3, 0xfff7, {0x0, 0x5}}, {0x8000, 0xb, {0x1, 0x3}}, {0x8, 0x2, {0x0, 0x3a}}, {0x80, 0x4, {0x1, 0xa17}}, {0x9, 0x3, {0x1, 0x1}}, {0x80, 0x400, {0x2, 0x7f39}}, {0xfff6, 0xfffd, {0x3, 0xf}}, {0x30, 0x2, {0x0, 0x1070}}, {0x3ff, 0x3ff, {0x1, 0x60}}, {0x40, 0x2, {0x1, 0x401}}, {0x2, 0x3d2, {0x2, 0x6}}, {0x0, 0x7fff, {0x2, 0x5f8}}, {0x4a7, 0x9, {0x2, 0xb4}}, {0x7, 0x4, {0x2, 0xfffffffb}}, {0x3ff, 0x44, {0x2}}, {0x10, 0x1, {0x2, 0x98}}, {0x6, 0x2d2f, {0x1, 0x401}}, {0x7, 0xdb, {0x2, 0x40}}, {0x2, 0x1, {0x1, 0x401}}, {0x200, 0x100, {0x0, 0x2}}, {0x2, 0xfff8, {0x1, 0x8}}, {0x7, 0xb, {0x2, 0x213e}}, {0x3, 0xff, {0x1, 0x3}}, {0x2, 0x0, {0x3, 0x3}}, {0x8, 0x9, {0x0, 0xdd5}}, {0x6, 0x5, {0x1, 0x8000}}, {0xfff9, 0x100, {0x1}}, {0x1, 0xff98, {0x3, 0xf9}}, {0x3, 0x29, {0x4, 0x100}}, {0xe4a, 0x5, {0x0, 0x7}}, {0x101, 0x400, {0x0, 0x8}}, {0x4, 0x9e, {0x3, 0xffff0000}}, {0x2, 0x5, {0x1, 0x1ff}}]}}}]}, 0x964}, 0x1, 0x0, 0x0, 0x810}, 0xc0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000001180)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001140)={&(0x7f0000001100)={0x20, 0x0, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x10}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4040084}, 0x4000080) fsetxattr$security_evm(r0, &(0x7f00000011c0), &(0x7f0000001200)=@sha1={0x1, "ba5d555a4b0ef1e3d9e1c8bb4c61a974163f311b"}, 0x15, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r8 = accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000001240)) getsockname$packet(r8, &(0x7f0000001280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000012c0)=0x14) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000001340), r3) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(r6, &(0x7f00000014c0)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001480)={&(0x7f0000001380)={0xc8, r10, 0x400, 0x70bd26, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x2}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x6e36}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x66}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x7fff}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x2}}]}, 0xc8}, 0x1, 0x0, 0x0, 0x81}, 0x4004000) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000001580)={'syztnl0\x00', &(0x7f0000001500)={'ip6_vti0\x00', r9, 0x2f, 0x4, 0x8, 0xfffffffc, 0x40, @local, @remote, 0x8000, 0x0, 0x100, 0x5}}) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x40010, r2, 0xb310d000) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f00000015c0)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_OBJ_SETPROPERTY(r11, 0xc01864ba, &(0x7f0000001680)={0x80, 0x0, 0x0, 0xc0c0c0c0}) 4.993863265s ago: executing program 3 (id=1226): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x7, 0xc, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="b00000000002010400000000000000000700000608000940ffffffff080004400000008108000840000000032000018006"], 0xb0}, 0x1, 0x0, 0x0, 0x8004}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet(0x2, 0x3, 0x5) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000000380)={'syztnl2\x00', 0x0, 0x0, 0x700, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x65, 0x0, 0x0, 0x2f, 0x0, @local, @private=0xa010100}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000280)={'syztnl1\x00', r4, 0x20, 0x700, 0x1001000, 0x756, {{0x5, 0x4, 0x2, 0x2, 0x14, 0x66, 0x0, 0x8c, 0x2f, 0x0, @multicast1, @multicast1}}}}) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYRES16], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0x4004012) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r6, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2050) write$FUSE_INIT(r6, &(0x7f0000000040)={0x50, 0x0, r7, {0x7, 0x1f}}, 0x50) syz_fuse_handle_req(r6, &(0x7f0000008380)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100c4b600", 0x2000, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006340)={0x20, 0x0, 0x0, {0x0, 0x9c33cbf2f2cca353}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101481, 0x0) write$FUSE_ENTRY(r8, 0x0, 0x300) capget(&(0x7f0000000040)={0x20080522, r5}, &(0x7f00000001c0)={0x2, 0x6, 0x3, 0xfffffff8, 0x7, 0x400}) fcntl$setpipe(r1, 0x407, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) modify_ldt$write(0x1, &(0x7f0000000040)={0x600}, 0x10) modify_ldt$read(0x0, &(0x7f0000001840)=""/4105, 0x1009) write$FUSE_INIT(r1, &(0x7f0000000340)={0x50, 0xfffffffffffffff5, 0x0, {0x7, 0x28, 0xd19e, 0x0, 0x0, 0x4, 0x8d, 0x5, 0x0, 0x0, 0x10, 0xfffffffe}}, 0x50) vmsplice(r1, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x1, 0x0) r9 = syz_open_dev$vbi(&(0x7f00000003c0), 0x3, 0x2) ioctl$VIDIOC_G_SLICED_VBI_CAP(r9, 0xc0745645, &(0x7f0000000100)={0x6, [0xff, 0x8, 0x8, 0x7fff, 0x5, 0x800, 0x7, 0xff, 0xfc01, 0x1, 0x2, 0x10, 0x400, 0xa, 0x8, 0x2, 0x7, 0x8, 0x7f, 0x0, 0x4, 0x3, 0x97, 0x457f, 0x2, 0x5, 0x81, 0x1, 0x84, 0x8544, 0xb, 0x5, 0x6, 0x7685, 0x98bd, 0x0, 0x8000, 0x8, 0x5, 0x2, 0x0, 0x5, 0xe9da, 0xf, 0x8, 0x6, 0x0, 0x8], 0x6}) 4.958318099s ago: executing program 4 (id=1227): ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000002b40)={0x2, 0x0, {&(0x7f0000000340)=""/172, 0xac, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg(0xffffffffffffffff, &(0x7f0000000540)={0x1, {&(0x7f0000000040)=""/62, 0x3e, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, {&(0x7f0000002cc0)=""/255, 0xff, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000004c0)={0x2, 0x0, {&(0x7f0000000400)=""/185, 0xb9, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000740)=""/187, 0xbb, 0x0, 0x2, 0x3}}, 0x48) 4.7207792s ago: executing program 0 (id=1228): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000000c0)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="00000100000005"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000380)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x46d, 0xc52f, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x1}}}}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000001c0)={0x18, &(0x7f00000003c0)={0x0, 0x3b, 0x5, {0x5, 0xd, "4d8188"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000040)={0x40, 0x30, 0x2, "fa3e"}, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f0000000400)={0x0, 0x1b, 0xf, "1b4ad2813a6a86ff0733f16a5ae6fd"}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f0000000400)={0x0, 0x1b, 0xf, "1b4ad2813a6a86ff0733f16a5ae6fd"}, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.637624378s ago: executing program 4 (id=1229): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0xea) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x8, 0x4000) ioctl$SNDRV_PCM_IOCTL_REWIND(r6, 0x40084146, &(0x7f00000000c0)=0x3) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r7 = syz_io_uring_setup(0x4b9, &(0x7f0000010400)={0x0, 0xb1a3, 0x10152, 0x3, 0x3}, &(0x7f0000010080), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS(r7, 0x0, &(0x7f0000000140)=[{0x0}, {0x0}], 0x2) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r7, 0x10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)=[{0x0}, {&(0x7f0000000340), 0xa002a0}], &(0x7f00000005c0), 0x2}, 0x20) 4.021628128s ago: executing program 4 (id=1230): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) (async) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) (async) r2 = landlock_create_ruleset(&(0x7f00000001c0)={0xa019, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) (async) r3 = socket$unix(0x1, 0x1, 0x0) (async) r4 = socket$unix(0x1, 0x1, 0x0) bind$unix(r4, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) listen(r4, 0x0) connect$unix(r3, &(0x7f0000000000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000001ac0)={r0, 0x10000, {0x0, 0x0, 0x0, 0x2eed, 0x7fff, 0x0, 0x0, 0x0, 0xc, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a6a4274f440000000001000010e200"}}) writev(r1, &(0x7f0000000300)=[{&(0x7f00000000c0)='\b', 0x7e00}], 0x1) 3.613693648s ago: executing program 4 (id=1231): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x3, 0x7fff0004}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r2, 0x6, 0x22, &(0x7f0000000000)=0x1, 0x4) r3 = socket(0x15, 0x5, 0x0) recvfrom$ax25(r3, 0x0, 0x0, 0x105, &(0x7f0000001c00)={{0x3, @default}, [@default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e24, @broadcast}, 0x10) setsockopt$inet_sctp_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000100)={0x5, 0x2, 0x71, 0x1, 0x3f, 0x2, 0x1, 0x5, 0x9, 0x0, 0xb, 0x9, 0xe, 0x2}, 0xe) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r4, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="6c000000020601000000000600000000000000000e0003006269746d61703a69700000000500040000ffed000900020073797a3200000000240007800c00028008000140ffffffff0c0001800800014080ffffff050014000200000005000500020000000500010006"], 0x6c}}, 0x2008800) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[], 0x90}, 0x1, 0x0, 0x0, 0x24044811}, 0x44005) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) syz_emit_ethernet(0x82, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000088a800008100000086dd605f106000442f00fc000000000000000000000000000000ff020000000000000000000000000001030000009000000000000800000086dd080088be86ddffff100000000100000000000000080022eb00000000200000000200000000000000000400000800655800000000"], 0x0) sendmmsg(r2, &(0x7f00000007c0)=[{{&(0x7f0000000380)=@in={0x2, 0x4e24, @local}, 0x80, &(0x7f0000000140)}}], 0x1, 0x2c000011) sendto(r2, 0x0, 0x0, 0x8000, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) 3.517510419s ago: executing program 1 (id=1232): socket$inet(0x2, 0x1, 0x100) socket$inet6_udplite(0xa, 0x2, 0x88) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) gettid() fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) msgctl$MSG_STAT_ANY(0x0, 0xd, &(0x7f0000000000)=""/83) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x67b}]}, 0x10) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x10) sendmmsg$inet(r5, &(0x7f0000002440)=[{{&(0x7f0000000680)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001180)="c545b8e6891930d00e0c9f9a34b60edab22431d599675d86f2f876ea962ace703f8afaf9c4262d97ed63349f484d868856c1bc9cca3150f7e96d42e36ab839caeb28614673b668f1d4bfbc2ffdc9bbb7faa421ca301c10368c46010ec37a088c3414908889082d9fdffe5f74be78e4ab3d545c22d3148d9b024b52ac9280db8ea86894997c083e31229fa2365a8bceb69178468b0b7741df61069d66365ec555624cf395e1359669aec4eb18c84c59149442a7", 0xb3}, {&(0x7f0000001040)="a632d1428982a252324f258392e316f18cf86b2e26ac0af8c71b95c35316f3831129f3e611dc5fa965da5032081ce03b9792739343bf80dbc4659935a61e2b9a7fe3a4a89869f95f15cd0fe0cbc18f6a6d873a310a108980d9011aad98d0e0dddb70480bd18486191b33112719854b86cb73be4fcff420a4caa64c932b46ba10031706e2fa27537ff5b9ee7f54d19f8a6d5dcc1711be704ea7424b04854aa7ea52a67f412b25168797edb27644d2b8356bedb99f1fbe00567f2438cb4f205ad8c0c91d75385b90c102000000000000002c8bcbe34f9411542cc837ee91388dc51b9c9e60a52da69045f95ade368dc4d145513ea2260dc86d637b44376576648e7adca3e283860d34b8bcb6d16aa39d00000000", 0x113}, {&(0x7f00000007c0)="ae21c1ffa47432736ef41d1ca7a55e6ee84fc95a490173e6f97a5c34095cb06b53d352aa1286e387f629ad9defaffa365aaf37ba4d1bac9280fe71822e0900ef5878455e97286102cdde893d7ccc8f6fbaf39ebfc87a0889162556dd2c750b72373cfc7c03b20d68bac0e03f2957d4cebb8fbac2af9aba141fe5820064122f5bd93ebef6e200989cdb", 0x89}, {&(0x7f0000000580)="6b9cacb7f6804c331a3aa9379734ec2aedb597c32af634ddb581e3cef4c3058812b5118b70a11b4169426d7df4887c10782a5cfc7f8ea9995dea4ac79993469d55895298a177c1e96fbc02b422b2f658450f124c1f7fbb0ffc995cac4fb8186835e2811d77f90cd9a4d933cb708bc5a346e7fc85379cca848191ce387c3aba4c12d2c7a110b4ce3114b3bd8d1b7b116a803bd8ce2405f7c43700329ad680dfa721b65823c09cca147a24f365e0cbc678092ae44a632b5c8da7f3e8b31ceaf1b5577b783908da7734f30d7ade6113b3adfebb2b03ed05", 0xd6}, {&(0x7f0000000940)="b3fe109a0a0e5fbf3f4e8ce314c9dee2296599bb37db484506f7f4a1fab11782e0e1581812720001a80b9a0f3b1906d25b5efb254a1119eafe8167fa354fb03a066c8733d91c9127a8c77f2d647fbee113e52351c782ebfba85879d9482fd52ff178111c30472dc8243f1e28fc4d6127452b0d5b98c225054f78c4db08b2aaa9275252150a05682058a0c2b50728dd04c8040000007233beaa311ecc5fe3fa158d", 0xa1}, {&(0x7f0000002500)="b85a302756b5c983924c342778e000aa1707d581478a9fc2db3eb7bb6c82e757c981749d65c93373f6549b488c1d2a4482dbbe77a836e6bd114cf72569cff1b57bc9054f77729d58073686e6fd5b1c92c883cdebfda1463120d2356e16d7cb26624ea547aea16f78ce1cd3c83041147ad29c7994a42c185bbeaa2b209232379157c4efcb82d1d1b1368cb36504f089940aa15f7351221d03d900d329d9019d343e39b49e6acb0bd17a95940f91a3a783f10b828fe8d260bf7600cc87f78a6dccaaa741bb90a1fc4ce4173068f3e3293db23abdf1c488ed70954d1fcafcae8cfe29c52384891d916f45ca246afbe2f81035ea92cf94145d43", 0xf8}, {&(0x7f0000000200)="db328433d8cfa472e00d6224a3fd8b1ce74f128f58df0bf2dd0c555b399256c989a373083e1245810b2661686c82667e784b508659132a8f", 0x38}], 0x7}}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000ac0)="65582f9359a0131171dfb403e1249c431ad1fe8b66afd6ef0c978154f4a27eb98cb25896eeff99e775a758a7a4ce88468bea15e461e3cc83087a642104112fe047a567b0714f81ac002aab74fc8c960ad78df3473fa60d537ecf5a373c13a0c8a6b5686c", 0x64}], 0x1}}], 0x3, 0xc044) write$binfmt_misc(r5, &(0x7f0000000300), 0x5b0) 1.978876157s ago: executing program 1 (id=1233): pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) epoll_create(0x3) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x4000}, 0x800) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000005c0)={'syztnl1\x00', &(0x7f0000000540)={'gre0\x00', 0x0, 0x8, 0x8000, 0xfffffff1, 0x1194, {{0x7, 0x4, 0x3, 0xc, 0x1c, 0x67, 0x0, 0x4, 0x4, 0x0, @private=0xa010100, @empty, {[@cipso={0x86, 0x8, 0x0, [{0x7, 0x2}]}]}}}}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x11, 0x7, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000060000000000000040000000183a00000900000000000000000000446aaffc0001000000000000000f00000095000000000000"], &(0x7f0000000480)='GPL\x00', 0xffff8000, 0x62, &(0x7f00000004c0)=""/98, 0x40f00, 0x52, '\x00', r3, 0x0, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000680)={0x1, 0x10, 0x200, 0x5}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[0x1, r0, r1, r1], &(0x7f0000000700), 0x10, 0x9}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) syz_genetlink_get_family_id$smc(0x0, 0xffffffffffffffff) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r5 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f00000001c0)={@val={0x0, 0x8864}, @void, @eth={@multicast, @local, @val={@void, {0x8100, 0x4}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x6, 0x14, 0xf4, 0x0, 0x41, 0x84, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x13}}}}}}}, 0x2a) sendmmsg$alg(0xffffffffffffffff, &(0x7f00000063c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x14}], 0x1, 0x800) recvmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001ec0)=[{&(0x7f0000000540)=""/113, 0x71}], 0x1}, 0x40000000) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000240)={&(0x7f0000000840)=ANY=[@ANYBLOB="2c010000", @ANYRES16=0x0, @ANYBLOB="00042bbd7000fedbdf25080000006400018014000280080003000700000008000400050000000c0002800800040007000000080003000400000038000400200001000a004e2200000007fe8000000000000000000000000000bb060000001400020002004e23640101010000000000000000300004802c0007800800040000000000080004000600000008000400ffff000008"], 0x12c}}, 0x40040088) ioctl$PIO_UNIMAPCLR(r7, 0x4b68, 0x0) socket$isdn(0x22, 0x2, 0x25) syz_io_uring_setup(0x4402, &(0x7f00000002c0)={0x0, 0x0, 0x2000, 0x0, 0x100}, 0x0, 0x0) 59.83585ms ago: executing program 3 (id=1234): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000001700)='cpu.weight.nice\x00', 0x2, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) write$sndseq(r2, &(0x7f0000000040)=[{0x0, 0x8, 0x0, 0xfd, @tick, {}, {0xe}, @control}], 0x1c) timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400)=0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') getdents64(r4, &(0x7f0000000280)=""/37, 0x34) getdents64(r4, 0xfffffffffffffffe, 0x64) timer_delete(r3) timer_settime(r3, 0x1, &(0x7f0000000080)={{0x77359400}}, &(0x7f00000000c0)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000380)=@bpf_lsm={0x10, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="791028000000000069002e000000000095"], &(0x7f0000000100)='GPL\x00'}, 0x80) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000a1121710950b2a17f4f7010203010902240001000000000904fb00"], 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x40) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSIFBRDADDR(r5, 0x891a, &(0x7f0000000400)={'lo\x00', {0x2, 0x4e23, @remote}}) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newchain={0x6c, 0x64, 0x1, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfff2, 0xd}, {0xe, 0xd}, {0xa, 0xd}}, [@filter_kind_options=@f_flow={{0x9}, {0x24, 0x2, [@TCA_FLOW_MASK={0x8, 0x6, 0xffff}, @TCA_FLOW_RSHIFT={0x8, 0x4, 0x8001}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1d05e}, @TCA_FLOW_ADDEND={0x8, 0x5, 0x7}]}}, @filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x5317}]}}]}, 0x6c}}, 0x48010) sendmsg$netlink(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)=ANY=[@ANYBLOB="180100002e"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r8) sendmsg$NL80211_CMD_DEL_KEY(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)={0x2c, r10, 0x1, 0x70bd31, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_KEY={0x10, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x1}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4480}, 0x4800) socket(0x2a, 0x80000, 0x8ef) write$cgroup_subtree(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB='-'], 0x27) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_CREATE(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)={0x5c, 0x0, 0x917, 0x0, 0x1000400, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @remote}}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x5c}}, 0x0) 0s ago: executing program 4 (id=1235): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x44, 0x86}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socket$nl_route(0x10, 0x3, 0x0) socket$rds(0x15, 0x5, 0x0) socket$rds(0x15, 0x5, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/tcp\x00') openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x820000, 0x0) bind$rds(0xffffffffffffffff, 0x0, 0x14) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f000001aa40)=""/102400, 0x19000) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000940)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000002000000e00000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000064010102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x310) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/mcfilter\x00') preadv(r2, &(0x7f0000000500)=[{&(0x7f0000000300)=""/85, 0x97}, {&(0x7f0000000080)=""/57, 0x39}, {&(0x7f00000000c0)=""/60, 0x3c}], 0x3, 0x5, 0xfff7fffd) openat$binfmt_register(0xffffff9c, 0x0, 0x1, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x240, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r3, 0x400455c8, 0x2) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000240)=0x30) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) socket$isdn_base(0x22, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0x400000}}, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000040)=0x45f1, 0x4) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x1000400000de, 0x0) kernel console output (not intermixed with test programs): ][ T7861] ? __pfx_smack_log+0x10/0x10 [ 292.920957][ T7861] ? smk_access+0x14c/0x4e0 [ 292.920987][ T7861] ? smk_tskacc+0x2fc/0x370 [ 292.921017][ T7861] ? smack_file_ioctl+0x2a9/0x340 [ 292.921037][ T7861] ? __pfx_smack_file_ioctl+0x10/0x10 [ 292.921065][ T7861] ? __fget_files+0x2a/0x420 [ 292.921084][ T7861] ? __fget_files+0x3a0/0x420 [ 292.921101][ T7861] ? __fget_files+0x2a/0x420 [ 292.921124][ T7861] ? bpf_lsm_file_ioctl+0x9/0x20 [ 292.921145][ T7861] ? __pfx_binder_ioctl+0x10/0x10 [ 292.921169][ T7861] __se_sys_ioctl+0xfc/0x170 [ 292.921198][ T7861] do_syscall_64+0xfa/0x3b0 [ 292.921217][ T7861] ? lockdep_hardirqs_on+0x9c/0x150 [ 292.921235][ T7861] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.921252][ T7861] ? clear_bhb_loop+0x60/0xb0 [ 292.921274][ T7861] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.921291][ T7861] RIP: 0033:0x7f31afd8ebe9 [ 292.921307][ T7861] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 292.921322][ T7861] RSP: 002b:00007f31b0b4b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 292.921341][ T7861] RAX: ffffffffffffffda RBX: 00007f31affb5fa0 RCX: 00007f31afd8ebe9 [ 292.921354][ T7861] RDX: 00002000000003c0 RSI: 00000000c0306201 RDI: 0000000000000003 [ 292.921365][ T7861] RBP: 00007f31b0b4b090 R08: 0000000000000000 R09: 0000000000000000 [ 292.921384][ T7861] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 292.921394][ T7861] R13: 00007f31affb6038 R14: 00007f31affb5fa0 R15: 00007ffef2bc62f8 [ 292.921425][ T7861] [ 292.921549][ T7861] binder: 7860:7861 ioctl c0306201 2000000003c0 returned -14 [ 293.134940][ T7869] FAULT_INJECTION: forcing a failure. [ 293.134940][ T7869] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 293.277542][ T7869] CPU: 0 UID: 0 PID: 7869 Comm: syz.2.482 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 293.277570][ T7869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 293.277587][ T7869] Call Trace: [ 293.277595][ T7869] [ 293.277605][ T7869] dump_stack_lvl+0x189/0x250 [ 293.277634][ T7869] ? __pfx____ratelimit+0x10/0x10 [ 293.277656][ T7869] ? __pfx_dump_stack_lvl+0x10/0x10 [ 293.277690][ T7869] ? __pfx__printk+0x10/0x10 [ 293.277732][ T7869] should_fail_ex+0x414/0x560 [ 293.277760][ T7869] _copy_to_user+0x31/0xb0 [ 293.277791][ T7869] simple_read_from_buffer+0xe1/0x170 [ 293.277819][ T7869] proc_fail_nth_read+0x1df/0x250 [ 293.277849][ T7869] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 293.277878][ T7869] ? rw_verify_area+0x258/0x650 [ 293.277908][ T7869] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 293.277934][ T7869] vfs_read+0x200/0x980 [ 293.277972][ T7869] ? __pfx___mutex_lock+0x10/0x10 [ 293.277995][ T7869] ? __pfx_vfs_read+0x10/0x10 [ 293.278026][ T7869] ? __fget_files+0x2a/0x420 [ 293.278053][ T7869] ? __fget_files+0x3a0/0x420 [ 293.278073][ T7869] ? __fget_files+0x2a/0x420 [ 293.278107][ T7869] ksys_read+0x145/0x250 [ 293.278130][ T7869] ? __pfx_ksys_read+0x10/0x10 [ 293.278145][ T7869] ? rcu_is_watching+0x15/0xb0 [ 293.278175][ T7869] ? do_syscall_64+0xbe/0x3b0 [ 293.278202][ T7869] do_syscall_64+0xfa/0x3b0 [ 293.278222][ T7869] ? lockdep_hardirqs_on+0x9c/0x150 [ 293.278243][ T7869] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.278263][ T7869] ? clear_bhb_loop+0x60/0xb0 [ 293.278288][ T7869] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.278327][ T7869] RIP: 0033:0x7f36b858d5fc [ 293.278346][ T7869] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 293.278362][ T7869] RSP: 002b:00007f36b94a2030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 293.278383][ T7869] RAX: ffffffffffffffda RBX: 00007f36b87b5fa0 RCX: 00007f36b858d5fc [ 293.278397][ T7869] RDX: 000000000000000f RSI: 00007f36b94a20a0 RDI: 0000000000000003 [ 293.278409][ T7869] RBP: 00007f36b94a2090 R08: 0000000000000000 R09: 0000000000000000 [ 293.278419][ T7869] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000001 [ 293.278430][ T7869] R13: 00007f36b87b6038 R14: 00007f36b87b5fa0 R15: 00007ffe7adedfc8 [ 293.278466][ T7869] [ 294.005768][ T7874] ./file0: Can't open blockdev [ 294.641036][ T7871] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 295.823559][ T7884] ceph: No mds server is up or the cluster is laggy [ 295.831494][ T5983] libceph: connect (1)[c::]:6789 error -101 [ 295.837700][ T5983] libceph: mon0 (1)[c::]:6789 connect error [ 295.897867][ T5988] pwc: Visionite VCS-UC300 USB webcam detected. [ 295.950784][ T5988] pwc: Failed to set LED on/off time (-71) [ 295.977218][ T5988] pwc: send_video_command error -71 [ 295.983628][ T5988] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 296.014238][ T5988] Philips webcam 1-1:5.0: probe with driver Philips webcam failed with error -71 [ 296.427752][ T5988] usb 1-1: USB disconnect, device number 10 [ 296.717776][ T7899] 9pnet_fd: Insufficient options for proto=fd [ 297.050642][ T9] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 297.361790][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 297.606869][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 297.680617][ T9] usb 2-1: New USB device found, idVendor=1532, idProduct=010e, bcdDevice= 0.00 [ 297.758054][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.195645][ T9] usb 2-1: config 0 descriptor?? [ 299.676565][ T7926] xt_hashlimit: max too large, truncated to 1048576 [ 299.838263][ T7933] tmpfs: Bad value for 'mpol' [ 300.910556][ T5953] usb 4-1: new full-speed USB device number 20 using dummy_hcd [ 301.144545][ T5953] usb 4-1: config 4 has an invalid interface number: 121 but max is 0 [ 301.177355][ T5953] usb 4-1: config 4 has no interface number 0 [ 301.194352][ T5953] usb 4-1: config 4 interface 121 has no altsetting 0 [ 301.221009][ T5988] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 302.307504][ T5953] usb 4-1: New USB device found, idVendor=6b86, idProduct=c211, bcdDevice=25.ca [ 303.664966][ T5953] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 303.673257][ T5953] usb 4-1: Product: syz [ 303.677718][ T5953] usb 4-1: Manufacturer: syz [ 303.682377][ T5953] usb 4-1: SerialNumber: syz [ 303.859537][ T9] usbhid 2-1:0.0: can't add hid device: -32 [ 303.867768][ T9] usbhid 2-1:0.0: probe with driver usbhid failed with error -32 [ 304.506461][ T9] usb 2-1: USB disconnect, device number 12 [ 304.547255][ T5988] usb 3-1: unable to read config index 0 descriptor/all [ 304.554634][ T5988] usb 3-1: can't read configurations, error -71 [ 304.605447][ T5953] usb 4-1: can't set config #4, error -71 [ 304.642300][ T5953] usb 4-1: USB disconnect, device number 20 [ 305.937617][ T7968] syz.0.505: attempt to access beyond end of device [ 305.937617][ T7968] nbd0: rw=6144, sector=128, nr_sectors = 8 limit=0 [ 306.339613][ T7968] gfs2: error -5 reading superblock [ 306.423943][ T7970] ALSA: mixer_oss: invalid index 40000 [ 307.887838][ T8005] netlink: 12 bytes leftover after parsing attributes in process `syz.1.514'. [ 310.850916][ T5988] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 311.040583][ T5988] usb 2-1: Using ep0 maxpacket: 16 [ 311.120821][ T5988] usb 2-1: config 0 has no interfaces? [ 311.135838][ T5988] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 311.287181][ T8049] syzkaller1: entered promiscuous mode [ 311.300885][ T5988] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.310317][ T5988] usb 2-1: Product: syz [ 311.322047][ T5988] usb 2-1: Manufacturer: syz [ 311.326791][ T5988] usb 2-1: SerialNumber: syz [ 311.333911][ T8049] syzkaller1: entered allmulticast mode [ 311.340824][ T5988] usb 2-1: config 0 descriptor?? [ 311.411569][ T5983] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 311.620680][ T5983] usb 3-1: Using ep0 maxpacket: 16 [ 311.638686][ T5983] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 10829, setting to 1024 [ 311.655482][ T9] usb 2-1: USB disconnect, device number 13 [ 311.656209][ T5983] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 311.684740][ T5983] usb 3-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 311.700559][ T5983] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.708617][ T5983] usb 3-1: Product: syz [ 311.723539][ T5983] usb 3-1: Manufacturer: syz [ 311.728298][ T5983] usb 3-1: SerialNumber: syz [ 311.776911][ T5983] usb 3-1: config 0 descriptor?? [ 311.797067][ T8047] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 311.851360][ T5983] hub 3-1:0.0: bad descriptor, ignoring hub [ 311.901255][ T5983] hub 3-1:0.0: probe with driver hub failed with error -5 [ 311.942962][ T5983] input: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input14 [ 311.973398][ T8049] netlink: 'syz.3.525': attribute type 39 has an invalid length. [ 312.138962][ T8047] netlink: 203276 bytes leftover after parsing attributes in process `syz.2.524'. [ 312.150432][ T8047] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 314.030624][ T5988] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 314.040255][ T8083] netlink: 4 bytes leftover after parsing attributes in process `syz.0.530'. [ 314.049853][ T8083] bridge_slave_1: left allmulticast mode [ 314.056930][ T8083] bridge_slave_1: left promiscuous mode [ 314.066422][ T8083] bridge0: port 2(bridge_slave_1) entered disabled state [ 314.205729][ T8083] bridge_slave_0: left allmulticast mode [ 314.240822][ T8083] bridge_slave_0: left promiscuous mode [ 314.246866][ T8083] bridge0: port 1(bridge_slave_0) entered disabled state [ 314.370538][ T5988] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 314.400484][ T5988] usb 5-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 314.435534][ T5988] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.247409][ T8090] delete_channel: no stack [ 315.340592][ T5988] usb 5-1: can't set config #4, error -71 [ 315.369966][ T5988] usb 5-1: USB disconnect, device number 11 [ 315.754423][ T8105] netlink: 88 bytes leftover after parsing attributes in process `syz.2.535'. [ 317.304046][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.320673][ T24] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 317.390022][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.090712][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 318.105437][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 318.206898][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 318.219670][ T24] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 318.234899][ T24] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 318.244265][ T24] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 318.254386][ T24] usb 2-1: Manufacturer: syz [ 318.285901][ T24] usb 2-1: config 0 descriptor?? [ 318.742568][ T24] usb 2-1: USB disconnect, device number 14 [ 319.142718][ T8131] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 319.156782][ T8131] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 319.279031][ T5988] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 319.760936][ T9] usb 3-1: USB disconnect, device number 18 [ 319.910519][ T5988] usb 4-1: Using ep0 maxpacket: 8 [ 320.005628][ T5988] usb 4-1: unable to get BOS descriptor or descriptor too short [ 320.015876][ T5988] usb 4-1: config 4 has an invalid interface number: 147 but max is 0 [ 320.027766][ T5988] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 320.042753][ T5988] usb 4-1: config 4 has no interface number 0 [ 320.052578][ T8138] delete_channel: no stack [ 320.140727][ T5988] usb 4-1: string descriptor 0 read error: -22 [ 320.148300][ T5988] usb 4-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 320.232540][ T5988] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.319440][ T5988] usb 4-1: Found UVC 0.02 device (04f2:b746) [ 320.347754][ T5988] usb 4-1: No streaming interface found for terminal 6. [ 320.529599][ T8152] netlink: 88 bytes leftover after parsing attributes in process `syz.2.547'. [ 320.588076][ T8131] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 321.260978][ T8132] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 321.269775][ T8132] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 321.381536][ T8131] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 321.439258][ T5983] usb 4-1: USB disconnect, device number 21 [ 321.635550][ T8134] syz.4.543 (8134): drop_caches: 2 [ 322.196910][ T8172] ./bus: Can't lookup blockdev [ 323.377267][ T8188] netlink: 'syz.4.555': attribute type 10 has an invalid length. [ 323.392165][ T8188] 8021q: adding VLAN 0 to HW filter on device team0 [ 323.400803][ T8188] bond0: (slave team0): Enslaving as an active interface with an up link [ 323.671335][ T9] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 323.826064][ T8201] netlink: 88 bytes leftover after parsing attributes in process `syz.4.559'. [ 323.868686][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 324.576764][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 324.718450][ T9] usb 1-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 324.808580][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.893925][ T9] usb 1-1: Product: syz [ 324.935421][ T9] usb 1-1: Manufacturer: syz [ 324.988445][ T9] usb 1-1: SerialNumber: syz [ 325.280400][ T9] usb 1-1: config 0 descriptor?? [ 325.445104][ T9] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 325.721897][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 325.890820][ T9] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 325.993917][ T9] usb 1-1: media controller created [ 327.236283][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 327.541587][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 327.961906][ T5857] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 328.218174][ T5857] usb 4-1: device descriptor read/64, error -71 [ 328.265381][ T9] DVB: Unable to find symbol tda10046_attach() [ 328.301401][ T9] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 328.336567][ T9] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 328.372717][ T9] dvb_usb_m920x 1-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 328.410624][ T9] usb 1-1: USB disconnect, device number 11 [ 328.500543][ T5857] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 328.528575][ T8226] netlink: 68 bytes leftover after parsing attributes in process `syz.0.568'. [ 328.595736][ T8229] netlink: 8 bytes leftover after parsing attributes in process `syz.0.568'. [ 329.457082][ T5857] usb 4-1: device descriptor read/64, error -71 [ 329.595716][ T5857] usb usb4-port1: attempt power cycle [ 329.715058][ T8227] netlink: 12 bytes leftover after parsing attributes in process `syz.1.567'. [ 329.981759][ T8244] netlink: 88 bytes leftover after parsing attributes in process `syz.0.571'. [ 330.773076][ T30] kauditd_printk_skb: 46 callbacks suppressed [ 330.773099][ T30] audit: type=1326 audit(1755895658.093:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8215 comm="syz.4.564" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0129f8ebe9 code=0x0 [ 330.869181][ T8247] netlink: 'syz.0.572': attribute type 10 has an invalid length. [ 330.912374][ T8247] veth1_vlan: entered allmulticast mode [ 330.982564][ T8247] team0: Device veth1_vlan failed to register rx_handler [ 332.560513][ T5857] usb 4-1: new full-speed USB device number 25 using dummy_hcd [ 334.814566][ T5857] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 336.071729][ T5857] usb 4-1: can't read configurations, error -22 [ 336.273624][ T8284] netlink: 88 bytes leftover after parsing attributes in process `syz.4.582'. [ 337.157369][ T8288] netlink: 28 bytes leftover after parsing attributes in process `syz.2.585'. [ 337.345740][ T8294] netlink: 16 bytes leftover after parsing attributes in process `syz.2.585'. [ 338.570542][ T5857] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 339.024385][ T5936] libceph: connect (1)[c::]:6789 error -101 [ 339.401886][ T8337] ceph: No mds server is up or the cluster is laggy [ 339.432429][ T5936] libceph: mon0 (1)[c::]:6789 connect error [ 339.460616][ T5857] usb 3-1: Using ep0 maxpacket: 32 [ 339.473715][ T5857] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 339.575718][ T5857] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 339.809851][ T9] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 339.824513][ T5857] usb 3-1: config 0 interface 0 has no altsetting 0 [ 339.852199][ T5857] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=dc.8e [ 339.864363][ T5857] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.872711][ T5857] usb 3-1: Product: syz [ 339.878399][ T5857] usb 3-1: Manufacturer: syz [ 340.127097][ T5983] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 340.410605][ T5983] usb 1-1: Using ep0 maxpacket: 8 [ 340.428867][ T5983] usb 1-1: New USB device found, idVendor=10d2, idProduct=2865, bcdDevice=a4.c9 [ 340.460821][ T5983] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 340.533382][ T5983] usb 1-1: config 0 descriptor?? [ 340.558300][ T5983] usblcd 1-1:0.0: USBLCD model not supported. [ 340.576005][ T5857] usb 3-1: SerialNumber: syz [ 340.626394][ T5857] usb 3-1: config 0 descriptor?? [ 340.650702][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 340.667620][ T9] usb 2-1: config 0 has no interfaces? [ 340.694500][ T9] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 340.720312][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.754374][ T8363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 340.777383][ T8363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 340.789606][ T9] usb 2-1: Product: syz [ 340.825841][ T9] usb 2-1: Manufacturer: syz [ 340.884043][ T9] usb 2-1: SerialNumber: syz [ 340.970799][ T8363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 341.099342][ T8363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 341.174737][ T5857] gs_usb 3-1:0.0: Configuring for 1 interfaces [ 341.209337][ T8363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 341.305945][ T8363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 341.389865][ T9] usb 2-1: config 0 descriptor?? [ 341.496082][ T8363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 341.723690][ T8363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 342.152563][ T8363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 342.439672][ T8363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 343.625462][ T9] usb 2-1: can't set config #0, error -71 [ 343.839630][ T9] usb 2-1: USB disconnect, device number 15 [ 344.193714][ T5920] usb 1-1: USB disconnect, device number 12 [ 344.222478][ T5857] usb 3-1: USB disconnect, device number 19 [ 349.003564][ T24] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 349.210546][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 349.281660][ T24] usb 4-1: config 0 has no interfaces? [ 349.308966][ T24] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 349.365553][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.413238][ T24] usb 4-1: Product: syz [ 349.441992][ T24] usb 4-1: Manufacturer: syz [ 349.466352][ T24] usb 4-1: SerialNumber: syz [ 349.519023][ T24] usb 4-1: config 0 descriptor?? [ 349.602864][ T8429] netlink: 8 bytes leftover after parsing attributes in process `syz.0.613'. [ 349.648825][ T8429] netlink: 8 bytes leftover after parsing attributes in process `syz.0.613'. [ 353.346768][ T24] libceph: connect (1)[c::]:6789 error -101 [ 353.781370][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 353.793795][ T24] usb 4-1: USB disconnect, device number 27 [ 353.801926][ T8444] ceph: No mds server is up or the cluster is laggy [ 354.186114][ T8453] usb usb8: usbfs: process 8453 (syz.0.619) did not claim interface 0 before use [ 355.489987][ T8469] netlink: 88 bytes leftover after parsing attributes in process `syz.2.624'. [ 355.770021][ T8472] netlink: 60 bytes leftover after parsing attributes in process `syz.0.623'. [ 356.719054][ T8474] netlink: 12 bytes leftover after parsing attributes in process `syz.4.626'. [ 357.558509][ T8473] genirq: Flags mismatch irq 4. 00200000 (das16m1) vs. 00200080 (ttyS0) [ 357.568261][ T8477] netlink: 4 bytes leftover after parsing attributes in process `syz.1.627'. [ 357.654167][ T8481] xt_hashlimit: size too large, truncated to 1048576 [ 357.717320][ T8485] : renamed from bridge_slave_0 (while UP) [ 358.100612][ T9] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 358.492309][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 358.766164][ T9] usb 1-1: config 0 has no interfaces? [ 358.881202][ T9] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 358.900524][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.908588][ T9] usb 1-1: Product: syz [ 358.922966][ T9] usb 1-1: Manufacturer: syz [ 358.927639][ T9] usb 1-1: SerialNumber: syz [ 358.971488][ T9] usb 1-1: config 0 descriptor?? [ 360.326894][ T9] usb 1-1: USB disconnect, device number 13 [ 361.744811][ T8536] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 361.796374][ T8536] overlayfs: missing 'lowerdir' [ 374.151515][ T8666] netlink: 'syz.4.681': attribute type 1 has an invalid length. [ 374.159357][ T8666] netlink: 180 bytes leftover after parsing attributes in process `syz.4.681'. [ 374.982043][ T8678] FAULT_INJECTION: forcing a failure. [ 374.982043][ T8678] name failslab, interval 1, probability 0, space 0, times 0 [ 374.996318][ T8678] CPU: 1 UID: 0 PID: 8678 Comm: syz.4.684 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 374.996347][ T8678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 374.996360][ T8678] Call Trace: [ 374.996368][ T8678] [ 374.996377][ T8678] dump_stack_lvl+0x189/0x250 [ 374.996407][ T8678] ? __pfx____ratelimit+0x10/0x10 [ 374.996432][ T8678] ? __pfx_dump_stack_lvl+0x10/0x10 [ 374.996456][ T8678] ? __pfx__printk+0x10/0x10 [ 374.996490][ T8678] ? __pfx___might_resched+0x10/0x10 [ 374.996527][ T8678] should_fail_ex+0x414/0x560 [ 374.996556][ T8678] should_failslab+0xa8/0x100 [ 374.996581][ T8678] __kmalloc_cache_node_noprof+0x73/0x3d0 [ 374.996605][ T8678] ? __get_vm_area_node+0x13f/0x300 [ 374.996632][ T8678] __get_vm_area_node+0x13f/0x300 [ 374.996661][ T8678] __vmalloc_node_range_noprof+0x301/0x12f0 [ 374.996685][ T8678] ? bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 374.996719][ T8678] ? is_bpf_text_address+0x26/0x2b0 [ 374.996771][ T8678] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 374.996792][ T8678] ? __might_fault+0xb0/0x130 [ 374.996816][ T8678] ? _parse_integer_limit+0x1ae/0x1f0 [ 374.996843][ T8678] ? bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 374.996870][ T8678] __vmalloc_noprof+0xb1/0xf0 [ 374.996891][ T8678] ? bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 374.996925][ T8678] bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 374.996960][ T8678] bpf_prog_alloc+0x3c/0x1a0 [ 374.996993][ T8678] bpf_prog_load+0x735/0x1930 [ 374.997040][ T8678] ? __pfx_bpf_prog_load+0x10/0x10 [ 374.997095][ T8678] ? bpf_lsm_bpf+0x9/0x20 [ 374.997117][ T8678] ? security_bpf+0x7e/0x300 [ 374.997144][ T8678] __sys_bpf+0x5f1/0x860 [ 374.997175][ T8678] ? __pfx___sys_bpf+0x10/0x10 [ 374.997238][ T8678] ? ksys_write+0x22a/0x250 [ 374.997261][ T8678] ? __pfx_ksys_write+0x10/0x10 [ 374.997276][ T8678] ? rcu_is_watching+0x15/0xb0 [ 374.997307][ T8678] __x64_sys_bpf+0x7c/0x90 [ 374.997335][ T8678] do_syscall_64+0xfa/0x3b0 [ 374.997356][ T8678] ? lockdep_hardirqs_on+0x9c/0x150 [ 374.997377][ T8678] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.997397][ T8678] ? clear_bhb_loop+0x60/0xb0 [ 374.997422][ T8678] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.997439][ T8678] RIP: 0033:0x7f0129f8ebe9 [ 374.997458][ T8678] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 374.997474][ T8678] RSP: 002b:00007f01281d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 374.997495][ T8678] RAX: ffffffffffffffda RBX: 00007f012a1b6090 RCX: 00007f0129f8ebe9 [ 374.997509][ T8678] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 374.997530][ T8678] RBP: 00007f01281d5090 R08: 0000000000000000 R09: 0000000000000000 [ 374.997541][ T8678] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 374.997552][ T8678] R13: 00007f012a1b6128 R14: 00007f012a1b6090 R15: 00007fffd8df77f8 [ 374.997584][ T8678] [ 374.998231][ T8678] syz.4.684: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 375.301299][ T8678] CPU: 1 UID: 0 PID: 8678 Comm: syz.4.684 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 375.301326][ T8678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 375.301337][ T8678] Call Trace: [ 375.301342][ T8678] [ 375.301347][ T8678] dump_stack_lvl+0x189/0x250 [ 375.301369][ T8678] ? __pfx_dump_stack_lvl+0x10/0x10 [ 375.301383][ T8678] ? __pfx__printk+0x10/0x10 [ 375.301399][ T8678] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 375.301414][ T8678] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 375.301429][ T8678] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 375.301446][ T8678] warn_alloc+0x214/0x310 [ 375.301464][ T8678] ? __pfx_warn_alloc+0x10/0x10 [ 375.301479][ T8678] ? __get_vm_area_node+0x13f/0x300 [ 375.301494][ T8678] ? __get_vm_area_node+0x2b5/0x300 [ 375.301514][ T8678] __vmalloc_node_range_noprof+0x326/0x12f0 [ 375.301529][ T8678] ? is_bpf_text_address+0x26/0x2b0 [ 375.301557][ T8678] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 375.301569][ T8678] ? __might_fault+0xb0/0x130 [ 375.301582][ T8678] ? _parse_integer_limit+0x1ae/0x1f0 [ 375.301599][ T8678] ? bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 375.301616][ T8678] __vmalloc_noprof+0xb1/0xf0 [ 375.301629][ T8678] ? bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 375.301649][ T8678] bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 375.301670][ T8678] bpf_prog_alloc+0x3c/0x1a0 [ 375.301690][ T8678] bpf_prog_load+0x735/0x1930 [ 375.301716][ T8678] ? __pfx_bpf_prog_load+0x10/0x10 [ 375.301748][ T8678] ? bpf_lsm_bpf+0x9/0x20 [ 375.301761][ T8678] ? security_bpf+0x7e/0x300 [ 375.301777][ T8678] __sys_bpf+0x5f1/0x860 [ 375.301795][ T8678] ? __pfx___sys_bpf+0x10/0x10 [ 375.301821][ T8678] ? ksys_write+0x22a/0x250 [ 375.301834][ T8678] ? __pfx_ksys_write+0x10/0x10 [ 375.301844][ T8678] ? rcu_is_watching+0x15/0xb0 [ 375.301862][ T8678] __x64_sys_bpf+0x7c/0x90 [ 375.301878][ T8678] do_syscall_64+0xfa/0x3b0 [ 375.301892][ T8678] ? lockdep_hardirqs_on+0x9c/0x150 [ 375.301905][ T8678] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.301917][ T8678] ? clear_bhb_loop+0x60/0xb0 [ 375.301932][ T8678] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.301943][ T8678] RIP: 0033:0x7f0129f8ebe9 [ 375.301954][ T8678] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 375.301965][ T8678] RSP: 002b:00007f01281d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 375.301979][ T8678] RAX: ffffffffffffffda RBX: 00007f012a1b6090 RCX: 00007f0129f8ebe9 [ 375.301992][ T8678] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 375.302005][ T8678] RBP: 00007f01281d5090 R08: 0000000000000000 R09: 0000000000000000 [ 375.302017][ T8678] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 375.302029][ T8678] R13: 00007f012a1b6128 R14: 00007f012a1b6090 R15: 00007fffd8df77f8 [ 375.302062][ T8678] [ 375.302071][ T8678] Mem-Info: [ 375.590770][ T8678] active_anon:254 inactive_anon:7182 isolated_anon:0 [ 375.590770][ T8678] active_file:5939 inactive_file:35875 isolated_file:0 [ 375.590770][ T8678] unevictable:768 dirty:248 writeback:0 [ 375.590770][ T8678] slab_reclaimable:10294 slab_unreclaimable:97566 [ 375.590770][ T8678] mapped:33586 shmem:4230 pagetables:1131 [ 375.590770][ T8678] sec_pagetables:0 bounce:0 [ 375.590770][ T8678] kernel_misc_reclaimable:0 [ 375.590770][ T8678] free:1326153 free_pcp:12943 free_cma:0 [ 375.636534][ T8678] Node 0 active_anon:1016kB inactive_anon:28728kB active_file:23552kB inactive_file:143500kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:134344kB dirty:992kB writeback:0kB shmem:15384kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:13260kB pagetables:4400kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 375.670571][ T8678] Node 1 active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:124kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 375.701974][ T8678] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 375.731120][ T8678] lowmem_reserve[]: 0 2500 2502 2502 2502 [ 375.736884][ T8678] Node 0 DMA32 free:1390244kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1012kB inactive_anon:28684kB active_file:21792kB inactive_file:143432kB unevictable:1536kB writepending:992kB present:3129332kB managed:2560996kB mlocked:0kB bounce:0kB free_pcp:30640kB local_pcp:9024kB free_cma:0kB [ 375.769424][ T8678] lowmem_reserve[]: 0 0 1 1 1 [ 375.774158][ T8678] Node 0 Normal free:20kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4kB inactive_anon:44kB active_file:1760kB inactive_file:68kB unevictable:0kB writepending:0kB present:1048580kB managed:1904kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 375.803598][ T8678] lowmem_reserve[]: 0 0 0 0 0 [ 375.808408][ T8678] Node 1 Normal free:3898988kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:21124kB local_pcp:10080kB free_cma:0kB [ 375.840029][ T8678] lowmem_reserve[]: 0 0 0 0 0 [ 375.844879][ T8678] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 375.857562][ T8678] Node 0 DMA32: 1395*4kB (UME) 781*8kB (UME) 75*16kB (UE) 298*32kB (U) 66*64kB (U) 26*128kB (UME) 35*256kB (UME) 11*512kB (UM) 6*1024kB (UME) 8*2048kB (UM) 323*4096kB (UM) = 1390244kB [ 375.875835][ T8678] Node 0 Normal: 1*4kB (M) 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20kB [ 375.888321][ T8678] Node 1 Normal: 177*4kB (UE) 55*8kB (UME) 39*16kB (UME) 78*32kB (UME) 39*64kB (UME) 8*128kB (UME) 2*256kB (M) 3*512kB (UM) 2*1024kB (UM) 0*2048kB 949*4096kB (ME) = 3898988kB [ 375.906161][ T8678] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 375.916365][ T8678] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 375.926220][ T8678] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 375.950189][ T8678] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 375.959646][ T8678] 46042 total pagecache pages [ 375.964358][ T8678] 0 pages in swap cache [ 375.968517][ T8678] Free swap = 124996kB [ 375.972790][ T8678] Total swap = 124996kB [ 375.976937][ T8678] 2097051 pages RAM [ 375.980790][ T8678] 0 pages HighMem/MovableOnly [ 375.985467][ T8678] 424695 pages reserved [ 375.989624][ T8678] 0 pages cma reserved [ 376.117656][ T8681] cgroup: Unknown subsys name 'noxattr•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•zCÏÚš•' [ 378.691514][ T30] audit: type=1326 audit(1755895706.013:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8713 comm="syz.4.697" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0129f8ebe9 code=0x7ffc0000 [ 378.764105][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.780171][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.786496][ T30] audit: type=1326 audit(1755895706.013:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8713 comm="syz.4.697" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0129f8ebe9 code=0x7ffc0000 [ 378.849547][ T8719] ttynull ttynull: ldisc open failed (-12), clearing slot 0 [ 378.910470][ T30] audit: type=1326 audit(1755895706.043:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8713 comm="syz.4.697" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0129f8ebe9 code=0x7ffc0000 [ 379.015445][ T30] audit: type=1326 audit(1755895706.043:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8713 comm="syz.4.697" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0129f8ebe9 code=0x7ffc0000 [ 379.176598][ T30] audit: type=1326 audit(1755895706.043:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8713 comm="syz.4.697" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0129f8ebe9 code=0x7ffc0000 [ 379.500662][ T9] usb 4-1: new low-speed USB device number 28 using dummy_hcd [ 379.661351][ T9] usb 4-1: Invalid ep0 maxpacket: 64 [ 379.800549][ T9] usb 4-1: new low-speed USB device number 29 using dummy_hcd [ 380.040564][ T9] usb 4-1: Invalid ep0 maxpacket: 64 [ 380.055129][ T9] usb usb4-port1: attempt power cycle [ 380.792310][ T9] usb 4-1: new low-speed USB device number 30 using dummy_hcd [ 381.191211][ T9] usb 4-1: Invalid ep0 maxpacket: 64 [ 381.258453][ T8752] smb3: Unknown parameter '' [ 381.331152][ T9] usb 4-1: new low-speed USB device number 31 using dummy_hcd [ 381.420651][ T9] usb 4-1: Invalid ep0 maxpacket: 64 [ 381.426511][ T9] usb usb4-port1: unable to enumerate USB device [ 381.506323][ T8758] syzkaller1: entered promiscuous mode [ 381.521744][ T8758] syzkaller1: entered allmulticast mode [ 381.619399][ T8761] syzkaller1: entered promiscuous mode [ 381.630971][ T8761] syzkaller1: entered allmulticast mode [ 381.812429][ T8758] netlink: 'syz.1.710': attribute type 39 has an invalid length. [ 382.104422][ T8761] netlink: 'syz.2.711': attribute type 39 has an invalid length. [ 382.938097][ T8776] netlink: 60 bytes leftover after parsing attributes in process `syz.3.713'. [ 384.837978][ T8792] trusted_key: encrypted_key: insufficient parameters specified [ 385.711479][ T5983] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 385.910483][ T5983] usb 2-1: Using ep0 maxpacket: 16 [ 385.925382][ T5983] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=d3.06 [ 386.090924][ T5983] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=67 [ 386.866556][ T5983] usb 2-1: Product: syz [ 386.890621][ T5983] usb 2-1: Manufacturer: syz [ 386.895366][ T5983] usb 2-1: SerialNumber: syz [ 386.928262][ T5983] r8152-cfgselector 2-1: Unknown version 0x0000 [ 386.960276][ T5983] r8152-cfgselector 2-1: config 0 descriptor?? [ 387.157355][ T8817] bond0: entered promiscuous mode [ 387.190278][ T8817] bond_slave_0: entered promiscuous mode [ 387.224677][ T8817] bond_slave_1: entered promiscuous mode [ 387.432345][ T5983] r8152-cfgselector 2-1: USB disconnect, device number 16 [ 387.586720][ T8829] FAULT_INJECTION: forcing a failure. [ 387.586720][ T8829] name failslab, interval 1, probability 0, space 0, times 0 [ 387.653565][ T8829] CPU: 0 UID: 0 PID: 8829 Comm: syz.3.727 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 387.653597][ T8829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 387.653609][ T8829] Call Trace: [ 387.653617][ T8829] [ 387.653626][ T8829] dump_stack_lvl+0x189/0x250 [ 387.653654][ T8829] ? __pfx____ratelimit+0x10/0x10 [ 387.653676][ T8829] ? __pfx_dump_stack_lvl+0x10/0x10 [ 387.653699][ T8829] ? __pfx__printk+0x10/0x10 [ 387.653733][ T8829] ? __pfx___might_resched+0x10/0x10 [ 387.653754][ T8829] ? fs_reclaim_acquire+0x7d/0x100 [ 387.653784][ T8829] should_fail_ex+0x414/0x560 [ 387.653812][ T8829] should_failslab+0xa8/0x100 [ 387.653837][ T8829] __kmalloc_noprof+0xcb/0x4f0 [ 387.653854][ T8829] ? kfree+0x4d/0x440 [ 387.653880][ T8829] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 387.653913][ T8829] tomoyo_realpath_from_path+0xe3/0x5d0 [ 387.653943][ T8829] ? tomoyo_domain+0xda/0x130 [ 387.653977][ T8829] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 387.653999][ T8829] tomoyo_path_number_perm+0x1e8/0x5a0 [ 387.654025][ T8829] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 387.654069][ T8829] ? __lock_acquire+0xab9/0xd20 [ 387.654116][ T8829] ? __fget_files+0x2a/0x420 [ 387.654153][ T8829] ? __fget_files+0x2a/0x420 [ 387.654174][ T8829] ? __fget_files+0x3a0/0x420 [ 387.654194][ T8829] ? __fget_files+0x2a/0x420 [ 387.654223][ T8829] security_file_ioctl+0xcb/0x2d0 [ 387.654248][ T8829] __se_sys_ioctl+0x47/0x170 [ 387.654281][ T8829] do_syscall_64+0xfa/0x3b0 [ 387.654302][ T8829] ? lockdep_hardirqs_on+0x9c/0x150 [ 387.654324][ T8829] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 387.654344][ T8829] ? clear_bhb_loop+0x60/0xb0 [ 387.654370][ T8829] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 387.654388][ T8829] RIP: 0033:0x7f31afd8ebe9 [ 387.654406][ T8829] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 387.654424][ T8829] RSP: 002b:00007f31b0b4b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 387.654446][ T8829] RAX: ffffffffffffffda RBX: 00007f31affb5fa0 RCX: 00007f31afd8ebe9 [ 387.654461][ T8829] RDX: 0000000000000000 RSI: 000000000000f505 RDI: 0000000000000003 [ 387.654473][ T8829] RBP: 00007f31b0b4b090 R08: 0000000000000000 R09: 0000000000000000 [ 387.654485][ T8829] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 387.654497][ T8829] R13: 00007f31affb6038 R14: 00007f31affb5fa0 R15: 00007ffef2bc62f8 [ 387.654534][ T8829] [ 387.654543][ T8829] ERROR: Out of memory at tomoyo_realpath_from_path. [ 389.061718][ T8852] netlink: 4 bytes leftover after parsing attributes in process `syz.3.734'. [ 389.221334][ T5921] usb 1-1: new low-speed USB device number 14 using dummy_hcd [ 389.539502][ T5921] usb 1-1: device descriptor read/64, error -71 [ 389.790606][ T5921] usb 1-1: new low-speed USB device number 15 using dummy_hcd [ 389.971659][ T5921] usb 1-1: device descriptor read/64, error -71 [ 390.092194][ T5921] usb usb1-port1: attempt power cycle [ 390.470505][ T5921] usb 1-1: new low-speed USB device number 16 using dummy_hcd [ 390.521240][ T5921] usb 1-1: device descriptor read/8, error -71 [ 390.790531][ T5921] usb 1-1: new low-speed USB device number 17 using dummy_hcd [ 390.812908][ T24] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 390.831661][ T5921] usb 1-1: device descriptor read/8, error -71 [ 390.949069][ T8885] FAULT_INJECTION: forcing a failure. [ 390.949069][ T8885] name failslab, interval 1, probability 0, space 0, times 0 [ 390.962276][ T8885] CPU: 1 UID: 0 PID: 8885 Comm: syz.1.742 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 390.962304][ T8885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 390.962316][ T8885] Call Trace: [ 390.962331][ T8885] [ 390.962339][ T8885] dump_stack_lvl+0x189/0x250 [ 390.962368][ T8885] ? __pfx____ratelimit+0x10/0x10 [ 390.962389][ T8885] ? __pfx_dump_stack_lvl+0x10/0x10 [ 390.962412][ T8885] ? __pfx__printk+0x10/0x10 [ 390.962441][ T8885] ? __pfx___might_resched+0x10/0x10 [ 390.962463][ T8885] ? fs_reclaim_acquire+0x7d/0x100 [ 390.962493][ T8885] should_fail_ex+0x414/0x560 [ 390.962521][ T8885] should_failslab+0xa8/0x100 [ 390.962546][ T8885] __kmalloc_noprof+0xcb/0x4f0 [ 390.962565][ T8885] ? tomoyo_encode+0x28b/0x550 [ 390.962595][ T8885] tomoyo_encode+0x28b/0x550 [ 390.962629][ T8885] tomoyo_realpath_from_path+0x58d/0x5d0 [ 390.962668][ T8885] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 390.962690][ T8885] tomoyo_path_number_perm+0x1e8/0x5a0 [ 390.962717][ T8885] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 390.962761][ T8885] ? __lock_acquire+0xab9/0xd20 [ 390.962808][ T8885] ? __fget_files+0x2a/0x420 [ 390.962836][ T8885] ? __fget_files+0x2a/0x420 [ 390.962858][ T8885] ? __fget_files+0x3a0/0x420 [ 390.962878][ T8885] ? __fget_files+0x2a/0x420 [ 390.962907][ T8885] security_file_ioctl+0xcb/0x2d0 [ 390.962935][ T8885] __se_sys_ioctl+0x47/0x170 [ 390.962969][ T8885] do_syscall_64+0xfa/0x3b0 [ 390.962991][ T8885] ? lockdep_hardirqs_on+0x9c/0x150 [ 390.963013][ T8885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.963033][ T8885] ? clear_bhb_loop+0x60/0xb0 [ 390.963059][ T8885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.963078][ T8885] RIP: 0033:0x7f3cadb8ebe9 [ 390.963097][ T8885] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 390.963115][ T8885] RSP: 002b:00007f3cae9de038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 390.963138][ T8885] RAX: ffffffffffffffda RBX: 00007f3caddb5fa0 RCX: 00007f3cadb8ebe9 [ 390.963154][ T8885] RDX: 0000000000000000 RSI: 000000000000f505 RDI: 0000000000000003 [ 390.963167][ T8885] RBP: 00007f3cae9de090 R08: 0000000000000000 R09: 0000000000000000 [ 390.963180][ T8885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 390.963192][ T8885] R13: 00007f3caddb6038 R14: 00007f3caddb5fa0 R15: 00007ffcc2810078 [ 390.963229][ T8885] [ 390.963253][ T8885] ERROR: Out of memory at tomoyo_realpath_from_path. [ 390.974331][ T5921] usb usb1-port1: unable to enumerate USB device [ 391.000464][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 391.160984][ T5920] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 391.293567][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 391.305614][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 391.316574][ T24] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 391.711773][ T5842] Bluetooth: hci4: command 0x0405 tx timeout [ 391.747868][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 391.886173][ T24] usb 3-1: config 0 descriptor?? [ 391.909116][ T24] hub 3-1:0.0: USB hub found [ 391.980484][ T5920] usb 4-1: device descriptor read/64, error -71 [ 392.421327][ T24] hub 3-1:0.0: config failed, can't read hub descriptor (err -22) [ 392.946243][ T5920] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 393.087977][ T8907] netlink: 16 bytes leftover after parsing attributes in process `syz.0.747'. [ 393.100260][ T5920] usb 4-1: device descriptor read/64, error -71 [ 393.219234][ T5920] usb usb4-port1: attempt power cycle [ 393.920546][ T5920] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 393.985953][ T5920] usb 4-1: device descriptor read/8, error -71 [ 394.506880][ T24] usbhid 3-1:0.0: can't add hid device: -71 [ 394.513643][ T24] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 394.592333][ T24] usb 3-1: USB disconnect, device number 20 [ 395.906133][ T8933] netlink: 12 bytes leftover after parsing attributes in process `syz.0.755'. [ 396.950612][ T5920] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 397.142310][ T8944] netlink: 88 bytes leftover after parsing attributes in process `syz.0.759'. [ 397.151381][ T8944] netlink: 40 bytes leftover after parsing attributes in process `syz.0.759'. [ 398.930475][ T5920] usb 4-1: Using ep0 maxpacket: 32 [ 398.955085][ T5920] usb 4-1: unable to get BOS descriptor or descriptor too short [ 398.984531][ T5920] usb 4-1: config 255 has an invalid interface number: 81 but max is 0 [ 399.007638][ T5920] usb 4-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 399.049849][ T5920] usb 4-1: config 255 has no interface number 0 [ 399.093582][ T5920] usb 4-1: config 255 interface 81 altsetting 3 has an endpoint descriptor with address 0x93, changing to 0x83 [ 399.153199][ T5920] usb 4-1: config 255 interface 81 altsetting 3 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 399.214159][ T5920] usb 4-1: config 255 interface 81 has no altsetting 0 [ 399.253244][ T5920] usb 4-1: string descriptor 0 read error: -22 [ 399.259653][ T5920] usb 4-1: New USB device found, idVendor=0dfc, idProduct=0001, bcdDevice=24.ac [ 399.305046][ T5920] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.409642][ T5920] input: USB Touchscreen 0dfc:0001 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:255.81/input/input15 [ 399.453227][ T5921] usb 3-1: new full-speed USB device number 21 using dummy_hcd [ 399.610956][ T5921] usb 3-1: device descriptor read/64, error -71 [ 399.628656][ T5936] usb 4-1: USB disconnect, device number 36 [ 399.909262][ T8960] netlink: 51 bytes leftover after parsing attributes in process `syz.0.763'. [ 400.024811][ T5921] usb 3-1: new full-speed USB device number 22 using dummy_hcd [ 400.087949][ T8962] netlink: 8 bytes leftover after parsing attributes in process `syz.4.765'. [ 400.170526][ T5921] usb 3-1: device descriptor read/64, error -71 [ 400.341175][ T5921] usb usb3-port1: attempt power cycle [ 401.174473][ T8971] netlink: 12 bytes leftover after parsing attributes in process `syz.0.768'. [ 401.587873][ T5921] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 401.614453][ T5921] usb 3-1: device descriptor read/8, error -71 [ 401.821859][ T8977] netlink: 88 bytes leftover after parsing attributes in process `syz.3.770'. [ 401.831584][ T8977] netlink: 40 bytes leftover after parsing attributes in process `syz.3.770'. [ 402.620732][ T5921] usb 3-1: new full-speed USB device number 24 using dummy_hcd [ 402.642895][ T5921] usb 3-1: device descriptor read/8, error -71 [ 402.783358][ T5921] usb usb3-port1: unable to enumerate USB device [ 403.768038][ T8995] netlink: 4 bytes leftover after parsing attributes in process `syz.4.776'. [ 404.060529][ T5921] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 404.230452][ T5921] usb 5-1: Using ep0 maxpacket: 16 [ 404.249214][ T5921] usb 5-1: too many configurations: 65, using maximum allowed: 8 [ 404.276922][ T5921] usb 5-1: New USB device found, idVendor=17cf, idProduct=721e, bcdDevice=de.06 [ 404.312151][ T5921] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 404.331315][ T5921] usb 5-1: Product: syz [ 404.335548][ T5921] usb 5-1: Manufacturer: syz [ 404.351307][ T5921] usb 5-1: SerialNumber: syz [ 404.377772][ T5921] usb 5-1: config 0 descriptor?? [ 404.427847][ T9001] syzkaller1: entered promiscuous mode [ 404.451686][ T9001] syzkaller1: entered allmulticast mode [ 404.623585][ T5921] usb 5-1: USB disconnect, device number 12 [ 404.694878][ T9001] netlink: 'syz.3.777': attribute type 39 has an invalid length. [ 405.130480][ T5921] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 405.280497][ T5921] usb 2-1: Using ep0 maxpacket: 16 [ 405.329376][ T5921] usb 2-1: config 0 has no interfaces? [ 405.373020][ T5921] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 405.409055][ T5921] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.457390][ T5921] usb 2-1: Product: syz [ 405.540625][ T9] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 405.586340][ T9022] netlink: 165 bytes leftover after parsing attributes in process `syz.4.784'. [ 405.630418][ T5921] usb 2-1: Manufacturer: syz [ 405.968270][ T5921] usb 2-1: SerialNumber: syz [ 406.278018][ T5921] usb 2-1: config 0 descriptor?? [ 406.303590][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 406.311205][ T9] usb 4-1: config 0 has no interfaces? [ 406.324533][ T9] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 406.347383][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.365335][ T9] usb 4-1: Product: syz [ 406.369566][ T9] usb 4-1: Manufacturer: syz [ 406.382846][ T9] usb 4-1: SerialNumber: syz [ 406.399702][ T9] usb 4-1: config 0 descriptor?? [ 406.719407][ T9] usb 2-1: USB disconnect, device number 17 [ 406.930044][ T9] usb 4-1: USB disconnect, device number 37 [ 408.123217][ T9054] netlink: 12 bytes leftover after parsing attributes in process `syz.1.792'. [ 410.564727][ T9073] netlink: 60 bytes leftover after parsing attributes in process `syz.0.798'. [ 412.677285][ T9092] netlink: 88 bytes leftover after parsing attributes in process `syz.2.802'. [ 412.686997][ T9092] netlink: 40 bytes leftover after parsing attributes in process `syz.2.802'. [ 415.738132][ T9120] netlink: 60 bytes leftover after parsing attributes in process `syz.4.810'. [ 418.097380][ T9134] netlink: 24 bytes leftover after parsing attributes in process `syz.4.814'. [ 418.774566][ T5921] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 419.890494][ T5921] usb 2-1: device descriptor read/64, error -71 [ 420.084419][ T9149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.818'. [ 420.152209][ T5921] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 420.270466][ T5936] usb 3-1: new full-speed USB device number 25 using dummy_hcd [ 420.433884][ T5936] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 420.439349][ T5921] usb 2-1: device descriptor read/64, error -71 [ 420.457784][ T5936] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 420.472475][ T5936] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 420.481804][ T5936] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.489851][ T5936] usb 3-1: Product: syz [ 420.539704][ T5936] usb 3-1: Manufacturer: syz [ 420.572533][ T9160] netlink: 60 bytes leftover after parsing attributes in process `syz.0.821'. [ 420.622139][ T24] usb 5-1: new low-speed USB device number 13 using dummy_hcd [ 420.666432][ T5936] usb 3-1: SerialNumber: syz [ 420.877291][ T24] usb 5-1: Invalid ep0 maxpacket: 64 [ 421.184053][ T24] usb 5-1: new low-speed USB device number 14 using dummy_hcd [ 421.267009][ T5921] usb usb2-port1: attempt power cycle [ 421.393276][ T24] usb 5-1: Invalid ep0 maxpacket: 64 [ 421.432701][ T24] usb usb5-port1: attempt power cycle [ 421.654363][ T5921] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 421.911103][ T24] usb 5-1: new low-speed USB device number 15 using dummy_hcd [ 422.005489][ T5921] usb 2-1: device descriptor read/8, error -71 [ 422.014225][ T24] usb 5-1: Invalid ep0 maxpacket: 64 [ 422.160667][ T24] usb 5-1: new low-speed USB device number 16 using dummy_hcd [ 422.182425][ T9170] netlink: 248 bytes leftover after parsing attributes in process `syz.0.825'. [ 422.191358][ T24] usb 5-1: Invalid ep0 maxpacket: 64 [ 422.207263][ T24] usb usb5-port1: unable to enumerate USB device [ 422.257865][ T9171] netlink: 248 bytes leftover after parsing attributes in process `syz.0.825'. [ 422.657198][ T9176] usb usb8: usbfs: process 9176 (syz.0.826) did not claim interface 0 before use [ 422.767055][ T9179] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0 [ 422.775682][ T9178] fuse: blksize only supported for fuseblk [ 422.787900][ T9178] IPVS: stopping backup sync thread 9179 ... [ 423.299522][ T9186] vlan2: entered promiscuous mode [ 423.304834][ T9186] dummy0: entered promiscuous mode [ 423.312524][ T9186] vlan2: entered allmulticast mode [ 423.317842][ T9186] dummy0: entered allmulticast mode [ 423.497504][ T9186] fuse: Bad value for 'rootmode' [ 423.990489][ T5936] usb 3-1: 0:2 : does not exist [ 424.154013][ T5936] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 424.419006][ T5936] usb 3-1: USB disconnect, device number 25 [ 424.512642][ T9201] netlink: 60 bytes leftover after parsing attributes in process `syz.4.833'. [ 426.912889][ T9227] ptrace attach of "./syz-executor exec"[5836] was attempted by "./syz-executor exec"[9227] [ 429.500596][ T9253] netlink: 60 bytes leftover after parsing attributes in process `syz.2.844'. [ 429.620794][ T9] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 430.392639][ T9] usb 1-1: New USB device found, idVendor=0dba, idProduct=3000, bcdDevice=26.ea [ 430.422284][ T9258] 9pnet_fd: Insufficient options for proto=fd [ 430.460947][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.480023][ T9259] lo: Caught tx_queue_len zero misconfig [ 430.497054][ T9] usb 1-1: config 0 descriptor?? [ 430.514552][ T9] usb 1-1: Invalid firmware size=18. [ 430.950780][ T5936] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 431.122028][ T9] usb 1-1: USB disconnect, device number 18 [ 431.143429][ T9263] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 431.223538][ T5936] usb 2-1: config 6 has an invalid interface number: 108 but max is 0 [ 431.241392][ T5936] usb 2-1: config 6 has no interface number 0 [ 431.274172][ T5936] usb 2-1: config 6 interface 108 has no altsetting 0 [ 431.308910][ T5936] usb 2-1: New USB device found, idVendor=0856, idProduct=ac30, bcdDevice=d2.1d [ 431.341140][ T9272] sctp: failed to load transform for md5: -2 [ 431.365468][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 431.390973][ T5936] usb 2-1: Product: syz [ 431.395292][ T5936] usb 2-1: Manufacturer: syz [ 431.399964][ T5936] usb 2-1: SerialNumber: syz [ 431.680227][ T5936] mos7840 2-1:6.108: missing endpoints [ 431.730960][ T5936] usb 2-1: USB disconnect, device number 22 [ 432.516140][ T9309] netlink: 8 bytes leftover after parsing attributes in process `syz.1.857'. [ 432.588170][ T9310] netlink: 60 bytes leftover after parsing attributes in process `syz.2.856'. [ 433.757391][ T9319] o2cb: This node has not been configured. [ 433.763779][ T9319] o2cb: Cluster check failed. Fix errors before retrying. [ 433.771944][ T9319] (syz.2.860,9319,0):user_dlm_register:674 ERROR: status = -22 [ 433.782700][ T9319] (syz.2.860,9319,0):dlmfs_mkdir:438 ERROR: Error -22 could not register domain "bus" [ 434.343532][ T9324] xt_hashlimit: size too large, truncated to 1048576 [ 434.418664][ T9327] : renamed from bridge_slave_0 (while UP) [ 436.981261][ T9359] random: crng reseeded on system resumption [ 437.056429][ T9360] netlink: 60 bytes leftover after parsing attributes in process `syz.2.868'. [ 437.108414][ T5983] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 437.853026][ T5983] usb 2-1: Using ep0 maxpacket: 16 [ 437.913418][ T5983] usb 2-1: config 0 has no interfaces? [ 437.948843][ T5983] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 438.021335][ T5983] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.042896][ T5983] usb 2-1: Product: syz [ 438.047188][ T5983] usb 2-1: Manufacturer: syz [ 438.073029][ T5983] usb 2-1: SerialNumber: syz [ 438.091575][ T5983] usb 2-1: config 0 descriptor?? [ 438.417631][ T5983] usb 2-1: USB disconnect, device number 23 [ 439.260507][ T9] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 439.409984][ T9389] binder: BINDER_SET_CONTEXT_MGR already set [ 439.420436][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 439.427277][ T9389] binder: 9387:9389 ioctl 4018620d 200000004a80 returned -16 [ 439.456098][ T9] usb 4-1: config 0 has an invalid descriptor of length 241, skipping remainder of the config [ 439.487270][ T9] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 439.513606][ T9] usb 4-1: New USB device found, idVendor=1608, idProduct=020c, bcdDevice=e7.2c [ 439.542940][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.659689][ T9391] xt_hashlimit: size too large, truncated to 1048576 [ 439.666450][ T9] usb 4-1: Product: syz [ 439.666477][ T9] usb 4-1: Manufacturer: syz [ 439.666493][ T9] usb 4-1: SerialNumber: syz [ 439.669717][ T9] usb 4-1: rejected 1 configuration due to insufficient available bus power [ 439.738772][ T9394] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 439.760482][ T9] usb 4-1: no configuration chosen from 1 choice [ 440.186997][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.193581][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.298864][ T9] usb 4-1: USB disconnect, device number 38 [ 444.040461][ T9] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 444.330413][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 444.339964][ T9] usb 2-1: config 0 has no interfaces? [ 444.352379][ T9] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 444.368027][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.388894][ T9] usb 2-1: Product: syz [ 444.398839][ T9] usb 2-1: Manufacturer: syz [ 446.243155][ T9] usb 2-1: SerialNumber: syz [ 446.264202][ T9] usb 2-1: config 0 descriptor?? [ 446.410572][ T9] usb 2-1: can't set config #0, error -71 [ 446.418310][ T9] usb 2-1: USB disconnect, device number 24 [ 446.517524][ T9446] netlink: 12 bytes leftover after parsing attributes in process `syz.3.893'. [ 447.666947][ T9456] netlink: 12 bytes leftover after parsing attributes in process `syz.4.891'. [ 448.139225][ T9458] i2c i2c-0: Invalid block write size 34 [ 449.071207][ T9462] program syz.3.897 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 449.195687][ T9448] netlink: 12 bytes leftover after parsing attributes in process `syz.0.894'. [ 450.508537][ T9482] trusted_key: encrypted_key: insufficient parameters specified [ 453.130520][ T24] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 453.268520][ T9494] xt_hashlimit: size too large, truncated to 1048576 [ 453.318639][ T9498] : renamed from bridge_slave_0 (while UP) [ 453.450418][ T24] usb 5-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 453.480477][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.624874][ T24] usb 5-1: Product: syz [ 453.629550][ T24] usb 5-1: Manufacturer: syz [ 453.639310][ T24] usb 5-1: SerialNumber: syz [ 453.814450][ T9499] binder_alloc: 9496: binder_alloc_buf size 12280 failed, no address space [ 453.824285][ T9499] binder_alloc: allocated: 8 (num: 1 largest: 8), free: 8184 (num: 1 largest: 8184) [ 453.891759][ T24] r8152-cfgselector 5-1: Unknown version 0x0000 [ 453.986038][ T24] r8152-cfgselector 5-1: config 0 descriptor?? [ 454.254280][ T24] r8152-cfgselector 5-1: can't set config #0, error -71 [ 454.333177][ T24] r8152-cfgselector 5-1: USB disconnect, device number 17 [ 454.730530][ T5920] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 454.870630][ T5920] usb 3-1: device descriptor read/64, error -71 [ 454.937424][ T24] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 455.960491][ T24] usb 5-1: device descriptor read/64, error -71 [ 456.220565][ T5920] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 456.370670][ T5920] usb 3-1: device descriptor read/64, error -71 [ 456.480967][ T5920] usb usb3-port1: attempt power cycle [ 456.543339][ T24] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 456.880844][ T24] usb 5-1: device descriptor read/64, error -71 [ 457.007836][ T5920] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 457.011567][ T24] usb usb5-port1: attempt power cycle [ 457.051814][ T5920] usb 3-1: device descriptor read/8, error -71 [ 457.290433][ T5920] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 458.580682][ T24] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 458.623643][ T5920] usb 3-1: device descriptor read/8, error -71 [ 458.735172][ T5920] usb usb3-port1: unable to enumerate USB device [ 459.020473][ T24] usb 5-1: device not accepting address 20, error -71 [ 459.190222][ T9552] netlink: 60 bytes leftover after parsing attributes in process `syz.1.918'. [ 460.012457][ T9555] xt_hashlimit: size too large, truncated to 1048576 [ 463.045142][ T9584] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 463.160475][ T9589] netlink: 4 bytes leftover after parsing attributes in process `syz.3.931'. [ 463.263620][ T9590] netlink: 76 bytes leftover after parsing attributes in process `syz.4.928'. [ 463.331657][ T30] audit: type=1800 audit(1755895790.563:64): pid=9590 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.4.928" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 463.823054][ T9589] team1: entered promiscuous mode [ 463.828697][ T9589] team1: entered allmulticast mode [ 467.299515][ T9634] xt_hashlimit: size too large, truncated to 1048576 [ 467.480784][ T9642] : renamed from bridge_slave_0 (while UP) [ 468.197997][ T5921] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 468.482712][ T5921] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 468.506898][ T5921] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 468.519282][ T9652] input: syz0 as /devices/virtual/input/input16 [ 468.581922][ T5921] usb 5-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=a2.bf [ 468.612101][ T5921] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.632664][ T5921] usb 5-1: Product: syz [ 469.135305][ T5921] usb 5-1: Manufacturer: syz [ 469.154277][ T5921] usb 5-1: SerialNumber: syz [ 469.173397][ T5921] usb 5-1: config 0 descriptor?? [ 469.190251][ T5921] ssu100 5-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 469.370636][ T9] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 469.591202][ T5921] ssu100 5-1:0.0: probe with driver ssu100 failed with error -110 [ 469.628943][ T9665] trusted_key: encrypted_key: insufficient parameters specified [ 469.724529][ T9] usb 2-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 469.852475][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 469.876128][ T9] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 469.876163][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 469.876184][ T9] usb 2-1: SerialNumber: syz [ 470.006542][ T9668] netlink: 136 bytes leftover after parsing attributes in process `syz.3.954'. [ 470.006647][ T9668] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 470.161302][ T9] usb 2-1: 0:2 : does not exist [ 470.161369][ T9] usb 2-1: unit 255 not found! [ 470.180784][ T9] usb 2-1: USB disconnect, device number 25 [ 470.353992][ T9678] netlink: 4 bytes leftover after parsing attributes in process `syz.3.957'. [ 471.408724][ T24] usb 5-1: USB disconnect, device number 22 [ 471.529246][ T9690] netlink: 12 bytes leftover after parsing attributes in process `syz.4.960'. [ 471.545842][ T9690] netlink: 8 bytes leftover after parsing attributes in process `syz.4.960'. [ 471.719130][ T9700] xt_hashlimit: size too large, truncated to 1048576 [ 471.850501][ T24] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 472.031929][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 472.069182][ T24] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 472.145590][ T24] usb 5-1: config 0 has no interface number 0 [ 472.346284][ T24] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 473.141748][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 473.679212][ T24] usb 5-1: config 0 descriptor?? [ 473.904413][ T24] viperboard 5-1:0.143: version 0.00 found at bus 005 address 023 [ 474.088693][ T24] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 474.137530][ T24] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 474.158112][ T24] usb 5-1: USB disconnect, device number 23 [ 474.337472][ T9717] netlink: 'syz.2.966': attribute type 6 has an invalid length. [ 474.530468][ T5983] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 474.697173][ T5983] usb 2-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 474.718999][ T5983] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 474.736180][ T5983] usb 2-1: Product: syz [ 474.747659][ T5983] usb 2-1: Manufacturer: syz [ 474.752592][ T5983] usb 2-1: SerialNumber: syz [ 474.760632][ T5983] usb 2-1: config 0 descriptor?? [ 474.770938][ T5983] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 474.810813][ T24] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 475.190540][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 475.448954][ T24] usb 4-1: config 0 has no interfaces? [ 475.479453][ T5983] gspca_sq905c: sq905c_command: usb_control_msg failed (-71) [ 475.501104][ T24] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 475.510807][ T5983] sq905c 2-1:0.0: probe with driver sq905c failed with error -71 [ 475.524673][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.544726][ T5983] usb 2-1: USB disconnect, device number 26 [ 475.573120][ T24] usb 4-1: Product: syz [ 475.577354][ T24] usb 4-1: Manufacturer: syz [ 475.619492][ T24] usb 4-1: SerialNumber: syz [ 475.671850][ T24] usb 4-1: config 0 descriptor?? [ 476.231577][ T5983] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 476.418495][ T5983] usb 2-1: unable to get BOS descriptor or descriptor too short [ 476.444437][ T5842] Bluetooth: hci4: command 0x0405 tx timeout [ 476.853476][ T5983] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 476.862246][ T5983] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 476.872440][ T5983] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 476.897842][ T5983] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 476.907143][ T5983] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.915172][ T5983] usb 2-1: Product: syz [ 476.919400][ T5983] usb 2-1: Manufacturer: syz [ 476.924019][ T5983] usb 2-1: SerialNumber: syz [ 477.021927][ T24] usb 4-1: USB disconnect, device number 39 [ 477.194961][ T5983] usb 2-1: 0:2 : does not exist [ 477.273436][ T5983] usb 2-1: USB disconnect, device number 27 [ 477.436145][ T9760] ISOFS: Unable to identify CD-ROM format. [ 477.781197][ T9773] netlink: 4 bytes leftover after parsing attributes in process `syz.4.975'. [ 478.307438][ T9782] xt_hashlimit: size too large, truncated to 1048576 [ 479.767276][ T9804] qnx4: no qnx4 filesystem (no root dir). [ 480.420043][ T9810] netlink: 12 bytes leftover after parsing attributes in process `syz.0.982'. [ 480.731154][ T9812] netlink: 4 bytes leftover after parsing attributes in process `syz.2.983'. [ 481.503240][ T5921] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 481.840747][ T9833] netlink: 60 bytes leftover after parsing attributes in process `syz.4.987'. [ 482.675479][ T5921] usb 1-1: Using ep0 maxpacket: 8 [ 482.690840][ T5921] usb 1-1: config 2 has an invalid interface number: 21 but max is 0 [ 482.702824][ T5921] usb 1-1: config 2 has no interface number 0 [ 482.711510][ T5921] usb 1-1: config 2 interface 21 has no altsetting 0 [ 482.799644][ T5921] usb 1-1: New USB device found, idVendor=061d, idProduct=c140, bcdDevice=31.1e [ 482.808909][ T5921] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.840418][ T5921] usb 1-1: Product: syz [ 482.853751][ T5921] usb 1-1: Manufacturer: syz [ 482.960565][ T5921] usb 1-1: SerialNumber: syz [ 483.290412][ T30] audit: type=1326 audit(1755895810.303:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.988" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 483.318424][ T30] audit: type=1326 audit(1755895810.303:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.988" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 483.360035][ T30] audit: type=1326 audit(1755895810.353:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.988" exe="/root/syz-executor" sig=0 arch=c000003e syscall=99 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 483.381309][ C0] vkms_vblank_simulate: vblank timer overrun [ 483.639263][ T30] audit: type=1326 audit(1755895810.363:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.988" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 483.660032][ T9820] x_tables: duplicate underflow at hook 2 [ 483.669602][ T9820] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 484.368048][ T30] audit: type=1326 audit(1755895810.363:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.988" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 484.388491][ T9820] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 484.402868][ T9820] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 484.416027][ T9820] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 484.488335][ T30] audit: type=1326 audit(1755895810.363:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.988" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 484.540913][ T9850] loop6: detected capacity change from 0 to 7 [ 484.571340][ T9850] Dev loop6: unable to read RDB block 7 [ 484.577037][ T9850] loop6: AHDI p1 p2 [ 484.580530][ T30] audit: type=1326 audit(1755895810.363:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.988" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 484.615390][ T30] audit: type=1326 audit(1755895810.363:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.988" exe="/root/syz-executor" sig=0 arch=c000003e syscall=101 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 484.639056][ T9854] Can't find a SQUASHFS superblock on nullb0 [ 484.640517][ T30] audit: type=1326 audit(1755895810.363:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.988" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 484.667928][ T30] audit: type=1326 audit(1755895810.363:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9829 comm="syz.3.988" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 484.693120][ T9850] loop6: partition table partially beyond EOD, truncated [ 484.701665][ T9850] loop6: p1 start 926365495 is beyond EOD, truncated [ 484.742991][ T9856] netlink: 5636 bytes leftover after parsing attributes in process `syz.2.993'. [ 484.880890][ T5921] quatech2 1-1:2.21: Quatech 2nd gen USB to Serial Driver converter detected [ 484.901431][ T5921] usb 1-1: qt2_attach - failed to power on unit: -71 [ 484.908472][ T5921] quatech2 1-1:2.21: probe with driver quatech2 failed with error -71 [ 484.957737][ T5921] usb 1-1: USB disconnect, device number 19 [ 487.463117][ T9880] xt_hashlimit: size too large, truncated to 1048576 [ 487.522908][ T24] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 487.781022][ T24] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 488.084723][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 489.250623][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 489.473169][ T24] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 489.568527][ T24] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 489.620389][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 489.664363][ T24] usb 2-1: config 0 descriptor?? [ 489.678893][ T9878] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 490.106606][ T24] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 490.125023][ T24] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 490.175735][ T24] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 490.196003][ T24] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 490.200241][ T5921] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 490.220440][ T24] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 490.270753][ T24] plantronics 0003:047F:FFFF.0006: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 490.327319][ T9914] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1004'. [ 490.392802][ T5921] usb 5-1: Using ep0 maxpacket: 32 [ 490.408370][ T5921] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 490.429324][ T5921] usb 5-1: config 0 interface 0 has no altsetting 0 [ 490.440260][ T5921] usb 5-1: New USB device found, idVendor=1044, idProduct=7a4d, bcdDevice= 0.00 [ 490.454065][ T5921] usb 5-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 490.470544][ T5921] usb 5-1: Product: syz [ 490.482192][ T5921] usb 5-1: config 0 descriptor?? [ 490.563299][ T9919] netlink: 4 bytes leftover after parsing attributes in process `syz.1.997'. [ 490.707279][ T9911] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1003'. [ 492.411421][ T24] usb 2-1: reset high-speed USB device number 28 using dummy_hcd [ 492.420770][ T5842] Bluetooth: hci5: command 0x1003 tx timeout [ 492.427962][ T5840] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 492.869979][ T9940] devtmpfs: Too few inodes for current use [ 494.234337][ T5921] usbhid 5-1:0.0: can't add hid device: -71 [ 494.250728][ T5921] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 494.287177][ T5921] usb 5-1: USB disconnect, device number 24 [ 494.291222][ T24] usb 2-1: device descriptor read/64, error -71 [ 494.580920][ T9944] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1010'. [ 494.614153][ T24] usb 2-1: reset high-speed USB device number 28 using dummy_hcd [ 494.644133][ T24] usb 2-1: device reset changed ep0 maxpacket size! [ 494.685349][ T5983] usb 2-1: USB disconnect, device number 28 [ 495.260916][ T5983] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 495.272578][ T9957] loop6: detected capacity change from 0 to 1 [ 495.283204][ T9957] Dev loop6: unable to read RDB block 1 [ 495.288816][ T9957] loop6: unable to read partition table [ 495.294696][ T9957] loop6: partition table beyond EOD, truncated [ 495.300940][ T9957] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 495.680587][ T9961] Cannot find del_set index 0 as target [ 495.812037][ T9958] xt_hashlimit: size too large, truncated to 1048576 [ 495.845156][ T9962] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1016'. [ 496.729029][ T9976] input: syz1 as /devices/virtual/input/input18 [ 497.050486][ T5953] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 497.186247][ T9986] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ÿÿÿÿ [ 497.324783][ T5953] usb 5-1: config index 0 descriptor too short (expected 1051, got 27) [ 497.344628][ T5953] usb 5-1: config 0 has an invalid interface number: 0 but max is -1 [ 497.458100][ T5953] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 497.680458][ T5983] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 497.716321][ T5953] usb 5-1: config 0 interface 0 altsetting 12 bulk endpoint 0x87 has invalid maxpacket 149 [ 497.763723][ T5953] usb 5-1: config 0 interface 0 has no altsetting 0 [ 498.071348][ T5983] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 498.080005][ T5953] usb 5-1: New USB device found, idVendor=06cd, idProduct=010a, bcdDevice=d9.c3 [ 498.143208][ T5983] usb 2-1: config 0 has no interface number 0 [ 498.175105][ T5953] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.286918][ T5983] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 498.299925][ T5953] usb 5-1: Product: syz [ 498.336382][ T5953] usb 5-1: Manufacturer: syz [ 498.362710][ T5983] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.380523][ T5953] usb 5-1: SerialNumber: syz [ 498.406603][ T5953] usb 5-1: config 0 descriptor?? [ 498.411868][ T5983] usb 2-1: Product: syz [ 498.440378][ T5983] usb 2-1: Manufacturer: syz [ 498.446037][ T9971] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 498.474814][ T5983] usb 2-1: SerialNumber: syz [ 498.511989][ T5983] usb 2-1: config 0 descriptor?? [ 498.527528][ T9992] usb usb1: usbfs: process 9992 (syz.3.1025) did not claim interface 0 before use [ 498.601343][ T9992] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1340 [ 498.727431][ T5983] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 498.777825][ T5983] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 498.806289][ T5983] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 498.841648][ T5983] usb 2-1: media controller created [ 499.088698][T10002] program syz.0.1028 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 499.168027][T10003] program syz.0.1028 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 499.249427][T10003] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 499.263683][ T5983] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 499.762568][ T5953] keyspan 5-1:0.0: Keyspan 4 port adapter converter detected [ 499.791009][ T5953] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 7 [ 499.818621][ T5953] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 81 [ 499.892345][ T5983] i2c i2c-2: ec100: i2c rd failed=-71 reg=33 [ 499.902994][ T5953] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 1 [ 500.642355][ T5953] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 500.849085][ T5953] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 82 [ 500.900665][ T5953] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 2 [ 500.969802][ T5953] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 501.039872][T10014] xt_hashlimit: size too large, truncated to 1048576 [ 501.224365][ T5983] usb 2-1: USB disconnect, device number 30 [ 501.236120][ T5953] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 83 [ 501.251506][ T5953] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 3 [ 501.271692][ T5953] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 501.282100][ T5953] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 84 [ 501.300512][ T5953] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 4 [ 501.325088][ T5953] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 501.359278][ T5953] usb 5-1: USB disconnect, device number 25 [ 501.515050][ T5953] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 501.539062][ T5953] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 501.550594][ T5953] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 501.562102][ T5953] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 501.578715][ T5953] keyspan 5-1:0.0: device disconnected [ 501.623795][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.630171][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.949170][T10017] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.133316][ T5983] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 502.252306][T10017] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.300404][ T5983] usb 4-1: Using ep0 maxpacket: 16 [ 502.317743][ T5983] usb 4-1: config 0 has no interfaces? [ 502.333598][ T5983] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 502.343057][ T5983] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.351250][ T5983] usb 4-1: Product: syz [ 502.355591][ T5983] usb 4-1: Manufacturer: syz [ 502.360598][ T5983] usb 4-1: SerialNumber: syz [ 502.368747][ T5983] usb 4-1: config 0 descriptor?? [ 502.528517][T10017] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.898228][T10036] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1036'. [ 505.770801][T10017] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 505.785479][ T5983] usb 4-1: USB disconnect, device number 40 [ 506.030261][T10017] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 506.089801][T10017] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 506.311327][T10017] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 506.339574][T10017] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 506.672516][T10058] ptm ptm1: ldisc open failed (-12), clearing slot 1 [ 508.581910][T10080] xt_hashlimit: size too large, truncated to 1048576 [ 509.320665][ T5842] Bluetooth: hci4: command 0x0405 tx timeout [ 509.850450][ T5983] usb 2-1: new full-speed USB device number 31 using dummy_hcd [ 510.553193][T10101] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1051'. [ 510.684952][ T5983] usb 2-1: config 0 has an invalid interface number: 213 but max is 0 [ 510.720355][ T5983] usb 2-1: config 0 has no interface number 0 [ 510.747113][ T5983] usb 2-1: New USB device found, idVendor=0079, idProduct=85eb, bcdDevice=90.b7 [ 510.806241][ T5983] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.808691][T10106] binder: 10105:10106 ioctl c0306201 200000000240 returned -11 [ 510.836804][ T5983] usb 2-1: Product: syz [ 510.850375][ T5983] usb 2-1: Manufacturer: syz [ 510.855031][ T5983] usb 2-1: SerialNumber: syz [ 510.890574][ T5983] usb 2-1: config 0 descriptor?? [ 511.925016][ T5983] usb 2-1: USB disconnect, device number 31 [ 511.942868][T10112] ceph: No mds server is up or the cluster is laggy [ 511.991013][ T24] libceph: connect (1)[c::]:6789 error -101 [ 511.997166][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 512.293408][T10127] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1056'. [ 512.330489][ T5920] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 512.476493][T10131] x_tables: ip6_tables: sctp match: only valid for protocol 132 [ 512.530392][ T5920] usb 1-1: Using ep0 maxpacket: 16 [ 513.056734][ T5920] usb 1-1: config 0 has no interfaces? [ 513.279568][ T5920] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 513.384021][ T5920] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.459335][ T5920] usb 1-1: Product: syz [ 513.463757][ T5920] usb 1-1: Manufacturer: syz [ 513.468391][ T5920] usb 1-1: SerialNumber: syz [ 513.476891][ T5920] usb 1-1: config 0 descriptor?? [ 514.340640][ T5920] usb 1-1: USB disconnect, device number 20 [ 514.404730][T10148] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1063'. [ 516.240713][T10163] xt_hashlimit: size too large, truncated to 1048576 [ 518.070429][ T5983] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 518.250521][ T5983] usb 1-1: Using ep0 maxpacket: 32 [ 518.287310][ T5983] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 518.330449][ T5983] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 518.368591][ T5983] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 518.640118][ T5983] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 518.814236][ T5983] usb 1-1: config 0 descriptor?? [ 518.876679][T10194] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 519.331007][T10200] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1076'. [ 521.170544][ T24] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 522.047524][ T5983] usbhid 1-1:0.0: can't add hid device: -71 [ 522.065425][ T5983] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 522.110959][ T5983] usb 1-1: USB disconnect, device number 21 [ 522.120502][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 522.127824][ T24] usb 5-1: config 0 has no interfaces? [ 522.155698][ T24] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 522.183022][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.235360][ T24] usb 5-1: Product: syz [ 522.239611][ T24] usb 5-1: Manufacturer: syz [ 522.249551][T10228] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1081'. [ 522.252280][ T24] usb 5-1: SerialNumber: syz [ 522.266816][ T24] usb 5-1: config 0 descriptor?? [ 522.560474][ T5983] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 522.565977][ T5920] usb 5-1: USB disconnect, device number 26 [ 522.584574][ T5921] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 522.710395][ T5983] usb 1-1: Using ep0 maxpacket: 8 [ 522.727229][ T5983] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 522.740495][ T5983] usb 1-1: New USB device found, idVendor=0c70, idProduct=f00b, bcdDevice= 0.00 [ 522.749759][ T5983] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 522.761282][ T5921] usb 3-1: Using ep0 maxpacket: 32 [ 522.762095][ T5983] usb 1-1: config 0 descriptor?? [ 522.773602][ T5921] usb 3-1: config 0 has an invalid interface number: 255 but max is 1 [ 522.794335][ T5921] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 522.817081][ T5921] usb 3-1: config 0 has no interface number 1 [ 522.832503][ T5921] usb 3-1: config 0 interface 0 altsetting 245 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 522.846053][ T5921] usb 3-1: config 0 interface 0 has no altsetting 0 [ 522.852890][ T5921] usb 3-1: config 0 interface 255 has no altsetting 0 [ 522.864952][ T5921] usb 3-1: New USB device found, idVendor=0582, idProduct=0033, bcdDevice=8e.57 [ 522.878239][ T5921] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.886456][ T5921] usb 3-1: Product: syz [ 522.894811][ T5921] usb 3-1: Manufacturer: syz [ 522.899550][ T5921] usb 3-1: SerialNumber: syz [ 522.911611][ T5921] usb 3-1: config 0 descriptor?? [ 522.922949][ T5921] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 522.931714][ T5921] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 522.939350][ T5921] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 523.269686][ T5921] usb 3-1: USB disconnect, device number 30 [ 523.446463][ T5983] usb 1-1: string descriptor 0 read error: -71 [ 523.468369][ T5983] usbhid 1-1:0.0: can't add hid device: -71 [ 523.475640][ T5983] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 523.511129][ T5983] usb 1-1: USB disconnect, device number 22 [ 523.524609][T10244] xt_hashlimit: size too large, truncated to 1048576 [ 523.583186][T10245] : renamed from bridge_slave_0 (while UP) [ 524.484601][T10257] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1088'. [ 524.809585][T10259] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 525.630741][ T5921] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 526.034475][ T5921] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 526.822853][ T5921] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 527.083411][ T5921] usb 3-1: config 0 descriptor?? [ 527.206337][ T5921] cp210x 3-1:0.0: cp210x converter detected [ 527.318856][ T5921] cp210x 3-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 527.372822][ T5921] usb 3-1: cp210x converter now attached to ttyUSB0 [ 527.542384][T10287] 9pnet_fd: Insufficient options for proto=fd [ 527.580878][T10285] tap0: tun_chr_ioctl cmd 1074025677 [ 527.586454][T10285] tap0: linktype set to 805 [ 527.605699][ T5921] usb 3-1: USB disconnect, device number 31 [ 527.633758][ T5921] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 527.794471][T10294] netlink: 'syz.0.1096': attribute type 4 has an invalid length. [ 527.794544][T10294] netlink: 3657 bytes leftover after parsing attributes in process `syz.0.1096'. [ 528.465219][ T5921] cp210x 3-1:0.0: device disconnected [ 528.880694][T10303] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1100'. [ 530.665836][T10324] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1106'. [ 530.698648][T10324] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1106'. [ 531.590032][T10338] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1109'. [ 532.663793][T10346] netlink: 2384 bytes leftover after parsing attributes in process `syz.0.1111'. [ 534.480643][ T5921] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 534.911792][ T5921] usb 3-1: Using ep0 maxpacket: 16 [ 534.935213][ T5921] usb 3-1: config 2 has an invalid interface number: 123 but max is 0 [ 534.985456][ T5921] usb 3-1: config 2 has no interface number 0 [ 535.023820][ T5921] usb 3-1: config 2 interface 123 has no altsetting 0 [ 535.074674][ T5921] usb 3-1: New USB device found, idVendor=07ca, idProduct=b800, bcdDevice=17.2e [ 535.293785][ T5921] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.325335][ T5921] usb 3-1: Product: syz [ 535.333586][ T5921] usb 3-1: Manufacturer: syz [ 535.338511][ T5921] usb 3-1: SerialNumber: syz [ 535.470185][T10375] netlink: 'syz.4.1119': attribute type 10 has an invalid length. [ 536.240681][ T5921] (null): radio-mr800 - initialization failed [ 536.247288][ T5921] radio-mr800 3-1:2.123: probe with driver radio-mr800 failed with error -22 [ 536.258525][T10375] team0: Port device wlan1 removed [ 536.270259][T10375] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 536.438163][ T5921] usbhid 3-1:2.123: couldn't find an input interrupt endpoint [ 536.478892][T10381] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 538.161786][ T5983] usb 3-1: USB disconnect, device number 32 [ 538.858976][T10400] unknown channel width for channel at 909000KHz? [ 538.865964][T10400] unknown channel width for channel at 909000KHz? [ 538.872787][T10400] unknown channel width for channel at 909000KHz? [ 538.957495][T10400] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 541.066561][ T24] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 541.310659][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 541.330154][ T24] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 541.346621][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 541.364482][ T24] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 541.382120][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.392109][ T24] usb 2-1: Product: syz [ 541.396777][ T24] usb 2-1: Manufacturer: syz [ 541.441891][ T24] usb 2-1: SerialNumber: syz [ 541.561979][T10433] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1132'. [ 541.868759][ T24] usb 2-1: 0:2 : does not exist [ 541.885527][ T24] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 542.580592][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 542.731292][ T24] usb 2-1: USB disconnect, device number 32 [ 543.558277][T10442] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 546.444271][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 546.444286][ T30] audit: type=1326 audit(1755895873.763:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10467 comm="syz.3.1142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 546.794676][T10474] sctp: failed to load transform for md5: -2 [ 547.325091][ T30] audit: type=1326 audit(1755895873.763:88): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10467 comm="syz.3.1142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=105 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 547.501709][ T30] audit: type=1326 audit(1755895873.763:89): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10467 comm="syz.3.1142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 547.594120][T10485] netlink: 'syz.4.1145': attribute type 2 has an invalid length. [ 547.601939][T10485] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1145'. [ 547.618621][T10485] : entered promiscuous mode [ 547.879598][ T30] audit: type=1326 audit(1755895873.763:90): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10467 comm="syz.3.1142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 547.960411][ T30] audit: type=1326 audit(1755895873.763:91): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10467 comm="syz.3.1142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 548.106438][ T30] audit: type=1326 audit(1755895873.763:92): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10467 comm="syz.3.1142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 548.476946][ T30] audit: type=1326 audit(1755895873.763:93): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10467 comm="syz.3.1142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 548.508035][ T30] audit: type=1326 audit(1755895873.763:94): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10467 comm="syz.3.1142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 548.576917][ T30] audit: type=1326 audit(1755895873.763:95): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10467 comm="syz.3.1142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 548.672655][ T30] audit: type=1326 audit(1755895873.763:96): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10467 comm="syz.3.1142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f31afd8ebe9 code=0x7ffc0000 [ 549.231359][ T5920] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 549.357884][T10508] lo speed is unknown, defaulting to 1000 [ 549.364505][T10508] lo speed is unknown, defaulting to 1000 [ 549.379223][T10508] lo speed is unknown, defaulting to 1000 [ 549.417178][T10508] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 549.487591][T10508] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 550.086196][T10508] lo speed is unknown, defaulting to 1000 [ 550.093860][T10508] lo speed is unknown, defaulting to 1000 [ 550.103007][T10508] lo speed is unknown, defaulting to 1000 [ 550.110030][T10508] lo speed is unknown, defaulting to 1000 [ 550.117152][T10508] lo speed is unknown, defaulting to 1000 [ 550.150424][ T5920] usb 3-1: Using ep0 maxpacket: 16 [ 550.270824][ T5920] usb 3-1: config 1 has an invalid interface number: 223 but max is 0 [ 550.284594][ T5920] usb 3-1: config 1 has no interface number 0 [ 550.346298][ T5920] usb 3-1: config 1 interface 223 altsetting 205 has 0 endpoint descriptors, different from the interface descriptor's value: 20 [ 550.351599][T10512] FAULT_INJECTION: forcing a failure. [ 550.351599][T10512] name failslab, interval 1, probability 0, space 0, times 0 [ 550.479019][ T5920] usb 3-1: config 1 interface 223 has no altsetting 0 [ 550.504154][T10512] CPU: 0 UID: 0 PID: 10512 Comm: syz.3.1152 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 550.504176][T10512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 550.504183][T10512] Call Trace: [ 550.504189][T10512] [ 550.504195][T10512] dump_stack_lvl+0x189/0x250 [ 550.504226][T10512] ? __pfx____ratelimit+0x10/0x10 [ 550.504240][T10512] ? __pfx_dump_stack_lvl+0x10/0x10 [ 550.504254][T10512] ? __pfx__printk+0x10/0x10 [ 550.504273][T10512] ? __pfx___might_resched+0x10/0x10 [ 550.504290][T10512] should_fail_ex+0x414/0x560 [ 550.504308][T10512] should_failslab+0xa8/0x100 [ 550.504323][T10512] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 550.504336][T10512] ? __alloc_skb+0x112/0x2d0 [ 550.504356][T10512] __alloc_skb+0x112/0x2d0 [ 550.504376][T10512] netlink_dump+0x1b1/0xe60 [ 550.504401][T10512] ? __pfx_netlink_dump+0x10/0x10 [ 550.504426][T10512] ? genl_start+0x499/0x6c0 [ 550.504444][T10512] __netlink_dump_start+0x5cb/0x7e0 [ 550.504466][T10512] genl_family_rcv_msg_dumpit+0x1e7/0x2c0 [ 550.504488][T10512] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 550.504501][T10512] ? genl_get_cmd+0x496/0x910 [ 550.504517][T10512] ? __pfx_genl_start+0x10/0x10 [ 550.504527][T10512] ? __pfx_genl_dumpit+0x10/0x10 [ 550.504538][T10512] ? __pfx_genl_done+0x10/0x10 [ 550.504561][T10512] genl_rcv_msg+0x5da/0x790 [ 550.504578][T10512] ? __pfx_genl_rcv_msg+0x10/0x10 [ 550.504589][T10512] ? ref_tracker_free+0x63a/0x7d0 [ 550.504602][T10512] ? __pfx_netdev_nl_napi_get_dumpit+0x10/0x10 [ 550.504620][T10512] ? __pfx_ref_tracker_free+0x10/0x10 [ 550.504641][T10512] netlink_rcv_skb+0x205/0x470 [ 550.504658][T10512] ? __pfx_genl_rcv_msg+0x10/0x10 [ 550.504672][T10512] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 550.504700][T10512] ? down_read+0x1ad/0x2e0 [ 550.504717][T10512] genl_rcv+0x28/0x40 [ 550.504728][T10512] netlink_unicast+0x75c/0x8e0 [ 550.504751][T10512] netlink_sendmsg+0x805/0xb30 [ 550.504775][T10512] ? __pfx_netlink_sendmsg+0x10/0x10 [ 550.504798][T10512] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 550.504810][T10512] ? __pfx_netlink_sendmsg+0x10/0x10 [ 550.504827][T10512] __sock_sendmsg+0x21c/0x270 [ 550.504850][T10512] ____sys_sendmsg+0x505/0x830 [ 550.504887][T10512] ? __pfx_____sys_sendmsg+0x10/0x10 [ 550.504913][T10512] ? import_iovec+0x74/0xa0 [ 550.504933][T10512] ___sys_sendmsg+0x21f/0x2a0 [ 550.504960][T10512] ? __pfx____sys_sendmsg+0x10/0x10 [ 550.505005][T10512] ? __fget_files+0x2a/0x420 [ 550.505017][T10512] ? __fget_files+0x3a0/0x420 [ 550.505038][T10512] __x64_sys_sendmsg+0x19b/0x260 [ 550.505058][T10512] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 550.505084][T10512] ? __pfx_ksys_write+0x10/0x10 [ 550.505093][T10512] ? rcu_is_watching+0x15/0xb0 [ 550.505111][T10512] ? do_syscall_64+0xbe/0x3b0 [ 550.505127][T10512] do_syscall_64+0xfa/0x3b0 [ 550.505139][T10512] ? lockdep_hardirqs_on+0x9c/0x150 [ 550.505152][T10512] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.505164][T10512] ? clear_bhb_loop+0x60/0xb0 [ 550.505179][T10512] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.505196][T10512] RIP: 0033:0x7f31afd8ebe9 [ 550.505214][T10512] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 550.505224][T10512] RSP: 002b:00007f31b0b4b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 550.505239][T10512] RAX: ffffffffffffffda RBX: 00007f31affb5fa0 RCX: 00007f31afd8ebe9 [ 550.505248][T10512] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 550.505256][T10512] RBP: 00007f31b0b4b090 R08: 0000000000000000 R09: 0000000000000000 [ 550.505269][T10512] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 550.505276][T10512] R13: 00007f31affb6038 R14: 00007f31affb5fa0 R15: 00007ffef2bc62f8 [ 550.505297][T10512] [ 550.877407][ T5920] usb 3-1: New USB device found, idVendor=05ac, idProduct=0262, bcdDevice=42.53 [ 550.886792][ T5920] usb 3-1: New USB device strings: Mfr=1, Product=157, SerialNumber=0 [ 550.895044][ T5920] usb 3-1: Product: syz [ 550.899254][ T5920] usb 3-1: Manufacturer: syz [ 550.909417][ T5920] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.223/input/input19 [ 551.883484][T10516] delete_channel: no stack [ 551.934200][T10500] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 551.974989][T10500] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 552.041141][ T5192] bcm5974 3-1:1.223: could not read from device [ 552.041575][ T5920] usb 3-1: USB disconnect, device number 33 [ 552.116738][ T5192] bcm5974 3-1:1.223: could not read from device [ 552.128794][ T5192] bcm5974 3-1:1.223: could not read from device [ 552.142913][ T5192] bcm5974 3-1:1.223: could not read from device [ 552.178785][T10530] netlink: 'syz.1.1156': attribute type 4 has an invalid length. [ 552.536496][ T5921] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 553.138223][T10542] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1161'. [ 553.149328][T10542] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1161'. [ 553.181359][ T5921] usb 1-1: Using ep0 maxpacket: 8 [ 553.192758][ T5921] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 553.251269][ T5921] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 553.267292][ T5921] pvrusb2: Hardware description: Terratec Grabster AV400 [ 553.279812][ T5921] pvrusb2: ********** [ 553.302613][ T5921] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 553.354340][ T5921] pvrusb2: Important functionality might not be entirely working. [ 553.430862][T10550] 9pnet_fd: Insufficient options for proto=fd [ 553.442725][T10550] netlink: 'syz.1.1163': attribute type 21 has an invalid length. [ 553.451691][ T5921] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 553.485040][ T5921] pvrusb2: ********** [ 553.500734][ T2344] pvrusb2: Invalid write control endpoint [ 553.679730][T10554] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 553.709435][T10532] fuse: Bad value for 'group_id' [ 553.721099][ T2344] pvrusb2: Invalid write control endpoint [ 553.746092][T10532] fuse: Bad value for 'group_id' [ 553.754429][ T2344] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 553.770535][ T2344] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 553.778326][ T2344] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 553.801891][ T5921] usb 1-1: USB disconnect, device number 23 [ 553.808113][ T2344] pvrusb2: Device being rendered inoperable [ 553.820378][ T2344] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 553.838832][ T2344] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 553.852767][ T2344] pvrusb2: Attached sub-driver cx25840 [ 553.858811][ T2344] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 553.869996][ T2344] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 555.160761][T10563] delete_channel: no stack [ 555.360545][ T5983] usb 3-1: new full-speed USB device number 34 using dummy_hcd [ 555.390933][T10582] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 555.397626][T10582] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 555.409772][T10582] vhci_hcd vhci_hcd.0: Device attached [ 555.938736][ T5983] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 556.080459][ T5921] usb 41-1: new high-speed USB device number 4 using vhci_hcd [ 556.169228][T10583] vhci_hcd: connection reset by peer [ 556.179852][ T1149] vhci_hcd: stop threads [ 556.180402][ T5983] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 556.186609][ T1149] vhci_hcd: release socket [ 556.246048][ T1149] vhci_hcd: disconnect device [ 556.284096][T10595] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1175'. [ 556.303910][ T5983] usb 3-1: New USB device found, idVendor=5543, idProduct=0047, bcdDevice= 0.00 [ 556.330179][ T5983] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 556.373470][ T5983] usb 3-1: config 0 descriptor?? [ 556.393870][T10572] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 556.565682][T10601] FAULT_INJECTION: forcing a failure. [ 556.565682][T10601] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 556.581038][T10601] CPU: 0 UID: 0 PID: 10601 Comm: syz.3.1177 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 556.581068][T10601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 556.581081][T10601] Call Trace: [ 556.581090][T10601] [ 556.581098][T10601] dump_stack_lvl+0x189/0x250 [ 556.581127][T10601] ? __pfx____ratelimit+0x10/0x10 [ 556.581150][T10601] ? __pfx_dump_stack_lvl+0x10/0x10 [ 556.581173][T10601] ? __pfx__printk+0x10/0x10 [ 556.581212][T10601] should_fail_ex+0x414/0x560 [ 556.581239][T10601] _copy_to_user+0x31/0xb0 [ 556.581266][T10601] simple_read_from_buffer+0xe1/0x170 [ 556.581291][T10601] proc_fail_nth_read+0x1df/0x250 [ 556.581317][T10601] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 556.581343][T10601] ? rw_verify_area+0x258/0x650 [ 556.581371][T10601] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 556.581394][T10601] vfs_read+0x200/0x980 [ 556.581503][T10601] ? __pfx___mutex_lock+0x10/0x10 [ 556.581540][T10601] ? __pfx_vfs_read+0x10/0x10 [ 556.581570][T10601] ? __fget_files+0x2a/0x420 [ 556.581599][T10601] ? __fget_files+0x3a0/0x420 [ 556.581618][T10601] ? __fget_files+0x2a/0x420 [ 556.581650][T10601] ksys_read+0x145/0x250 [ 556.581671][T10601] ? __pfx_ksys_read+0x10/0x10 [ 556.581686][T10601] ? rcu_is_watching+0x15/0xb0 [ 556.581713][T10601] ? do_syscall_64+0xbe/0x3b0 [ 556.581845][T10601] do_syscall_64+0xfa/0x3b0 [ 556.581871][T10601] ? lockdep_hardirqs_on+0x9c/0x150 [ 556.581980][T10601] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 556.582006][T10601] ? clear_bhb_loop+0x60/0xb0 [ 556.582032][T10601] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 556.582052][T10601] RIP: 0033:0x7f31afd8d5fc [ 556.582071][T10601] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 556.582088][T10601] RSP: 002b:00007f31b0b4b030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 556.582110][T10601] RAX: ffffffffffffffda RBX: 00007f31affb5fa0 RCX: 00007f31afd8d5fc [ 556.582124][T10601] RDX: 000000000000000f RSI: 00007f31b0b4b0a0 RDI: 0000000000000004 [ 556.582135][T10601] RBP: 00007f31b0b4b090 R08: 0000000000000000 R09: 0000000000000000 [ 556.582146][T10601] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 556.582157][T10601] R13: 00007f31affb6038 R14: 00007f31affb5fa0 R15: 00007ffef2bc62f8 [ 556.582191][T10601] [ 556.884830][T10602] netdevsim netdevsim0: Direct firmware load for ./file0 failed with error -2 [ 556.894198][T10602] netdevsim netdevsim0: Falling back to sysfs fallback for: ./file0 [ 557.215221][T10572] netlink: 552 bytes leftover after parsing attributes in process `syz.2.1168'. [ 557.333907][T10572] bridge0: the hash_elasticity option has been deprecated and is always 16 [ 560.115764][T10626] delete_channel: no stack [ 560.297787][T10632] loop2: detected capacity change from 0 to 7 [ 560.348286][T10632] Dev loop2: unable to read RDB block 7 [ 560.425402][T10632] loop2: unable to read partition table [ 560.474421][T10632] loop2: partition table beyond EOD, truncated [ 560.528625][T10632] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 561.210487][ T5921] vhci_hcd: vhci_device speed not set [ 561.851164][T10661] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1189'. [ 563.069904][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.076408][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.292092][ T9] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 563.642116][ T5983] usb 3-1: string descriptor 0 read error: -32 [ 563.649281][ T5983] uclogic 0003:5543:0047.0007: interface is invalid, ignoring [ 563.970345][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 564.056246][ T9] usb 1-1: config 0 has an invalid interface number: 132 but max is 0 [ 564.070321][ T9] usb 1-1: config 0 has no interface number 0 [ 564.086722][ T9] usb 1-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 564.101953][ T9] usb 1-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 564.116242][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.176542][ T9] usb 1-1: Product: syz [ 564.216712][ T9] usb 1-1: Manufacturer: syz [ 564.222768][ T9] usb 1-1: SerialNumber: syz [ 564.600381][ T9] usb 1-1: config 0 descriptor?? [ 564.736477][ T9] em28xx 1-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 564.764163][ T9] em28xx 1-1:0.132: Video interface 132 found: [ 564.971522][T10681] delete_channel: no stack [ 566.279944][T10610] syz.2.1168: vmalloc error: size 2101248, failed to allocated page array size 4104, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 566.304424][ T9] em28xx 1-1:0.132: unknown em28xx chip ID (0) [ 566.386885][T10610] CPU: 1 UID: 0 PID: 10610 Comm: syz.2.1168 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 566.386922][T10610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 566.386933][T10610] Call Trace: [ 566.386940][T10610] [ 566.386947][T10610] dump_stack_lvl+0x189/0x250 [ 566.386975][T10610] ? __pfx_dump_stack_lvl+0x10/0x10 [ 566.386994][T10610] ? __pfx__printk+0x10/0x10 [ 566.387015][T10610] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 566.387035][T10610] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 566.387059][T10610] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 566.387088][T10610] warn_alloc+0x214/0x310 [ 566.387119][T10610] ? __pfx_warn_alloc+0x10/0x10 [ 566.387152][T10610] ? __get_vm_area_node+0x28f/0x300 [ 566.387173][T10610] ? vb2_vmalloc_alloc+0xef/0x340 [ 566.387203][T10610] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 566.387246][T10610] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 566.387268][T10610] ? vb2_vmalloc_alloc+0xef/0x340 [ 566.387297][T10610] ? __get_vm_area_node+0x28f/0x300 [ 566.387314][T10610] ? vb2_vmalloc_alloc+0xef/0x340 [ 566.387336][T10610] __vmalloc_node_range_noprof+0x56a/0x12f0 [ 566.387356][T10610] ? vb2_vmalloc_alloc+0xef/0x340 [ 566.387440][T10610] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 566.387469][T10610] ? __kasan_kmalloc+0x93/0xb0 [ 566.387493][T10610] vmalloc_user_noprof+0xad/0xf0 [ 566.387513][T10610] ? vb2_vmalloc_alloc+0xef/0x340 [ 566.387539][T10610] vb2_vmalloc_alloc+0xef/0x340 [ 566.387563][T10610] ? __pfx_vb2_vmalloc_alloc+0x10/0x10 [ 566.387589][T10610] __vb2_queue_alloc+0x9c2/0x15a0 [ 566.387643][T10610] vb2_core_create_bufs+0x765/0xde0 [ 566.387679][T10610] ? __pfx_vb2_core_create_bufs+0x10/0x10 [ 566.387710][T10610] ? vb2_set_flags_and_caps+0x309/0x5f0 [ 566.387739][T10610] vb2_create_bufs+0x5b9/0xae0 [ 566.387777][T10610] ? __pfx_vb2_create_bufs+0x10/0x10 [ 566.387802][T10610] ? v4l_sanitize_format+0x5d6/0x9f0 [ 566.387836][T10610] v4l_create_bufs+0x193/0x2a0 [ 566.387865][T10610] __video_do_ioctl+0xc9b/0xdb0 [ 566.387910][T10610] ? __pfx___video_do_ioctl+0x10/0x10 [ 566.387952][T10610] video_usercopy+0x871/0x14f0 [ 566.387989][T10610] ? __pfx___video_do_ioctl+0x10/0x10 [ 566.388013][T10610] ? __pfx_video_usercopy+0x10/0x10 [ 566.388035][T10610] ? smack_file_ioctl+0x2a9/0x340 [ 566.388070][T10610] ? __fget_files+0x2a/0x420 [ 566.388089][T10610] ? __fget_files+0x3a0/0x420 [ 566.388112][T10610] v4l2_ioctl+0x18a/0x1e0 [ 566.388146][T10610] ? __pfx_v4l2_ioctl+0x10/0x10 [ 566.388169][T10610] __se_sys_ioctl+0xfc/0x170 [ 566.388199][T10610] do_syscall_64+0xfa/0x3b0 [ 566.388218][T10610] ? lockdep_hardirqs_on+0x9c/0x150 [ 566.388236][T10610] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.388254][T10610] ? clear_bhb_loop+0x60/0xb0 [ 566.388276][T10610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.388293][T10610] RIP: 0033:0x7f36b858ebe9 [ 566.388310][T10610] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 566.388332][T10610] RSP: 002b:00007f36b9460038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 566.388354][T10610] RAX: ffffffffffffffda RBX: 00007f36b87b6180 RCX: 00007f36b858ebe9 [ 566.388368][T10610] RDX: 0000200000000240 RSI: 00000000c100565c RDI: 0000000000000008 [ 566.388380][T10610] RBP: 00007f36b8611e19 R08: 0000000000000000 R09: 0000000000000000 [ 566.388391][T10610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 566.388402][T10610] R13: 00007f36b87b6218 R14: 00007f36b87b6180 R15: 00007ffe7adedfc8 [ 566.388433][T10610] [ 566.388441][T10610] Mem-Info: [ 566.389713][ T9] em28xx 1-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 566.405794][T10695] 9pnet_fd: Insufficient options for proto=fd [ 566.456647][ T9] em28xx 1-1:0.132: board has no eeprom [ 566.490413][T10610] active_anon:254 inactive_anon:7177 isolated_anon:0 [ 566.490413][T10610] active_file:6539 inactive_file:45087 isolated_file:0 [ 566.490413][T10610] unevictable:768 dirty:93 writeback:0 [ 566.490413][T10610] slab_reclaimable:10424 slab_unreclaimable:97786 [ 566.490413][T10610] mapped:36500 shmem:4235 pagetables:1206 [ 566.490413][T10610] sec_pagetables:0 bounce:0 [ 566.490413][T10610] kernel_misc_reclaimable:0 [ 566.490413][T10610] free:1281194 free_pcp:16435 free_cma:0 [ 566.525060][T10695] kernel profiling enabled (shift: 9) [ 566.547054][T10610] Node 0 active_anon:1016kB inactive_anon:28808kB active_file:25952kB inactive_file:180348kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:146000kB dirty:372kB writeback:0kB shmem:15404kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12540kB pagetables:4800kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 566.573809][ T9] em28xx 1-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 566.708125][T10610] Node 1 active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:124kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 566.918547][T10610] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 566.953086][T10695] netlink: 'syz.1.1198': attribute type 10 has an invalid length. [ 566.956075][T10610] lowmem_reserve[]: 0 2500 2502 2502 2502 [ 566.976650][T10610] Node 0 DMA32 free:1210152kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1012kB inactive_anon:17364kB active_file:24192kB inactive_file:180280kB unevictable:1536kB writepending:372kB present:3129332kB managed:2560996kB mlocked:0kB bounce:0kB free_pcp:54936kB local_pcp:42180kB free_cma:0kB [ 567.041979][T10695] 8021q: adding VLAN 0 to HW filter on device bond0 [ 567.193054][T10695] team0: Port device bond0 added [ 567.281947][T10705] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1200'. [ 567.362431][T10610] lowmem_reserve[]: 0 0 1 1 1 [ 567.372703][T10610] Node 0 Normal free:20kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4kB inactive_anon:44kB active_file:1760kB inactive_file:68kB unevictable:0kB writepending:0kB present:1048580kB managed:1904kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 567.490610][ T5921] usb 4-1: new full-speed USB device number 41 using dummy_hcd [ 567.534142][T10610] lowmem_reserve[]: 0 0 0 0 0 [ 567.553096][T10610] Node 1 Normal free:3898988kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:21292kB local_pcp:11176kB free_cma:0kB [ 567.589602][ T9] em28xx 1-1:0.132: analog set to bulk mode. [ 567.597753][ T5920] em28xx 1-1:0.132: Registering V4L2 extension [ 567.639355][ T9] usb 1-1: USB disconnect, device number 24 [ 567.665641][ T9] em28xx 1-1:0.132: Disconnecting em28xx [ 567.692983][ T5921] usb 4-1: config 2 has an invalid interface number: 108 but max is 0 [ 567.738392][T10610] lowmem_reserve[]: 0 0 0 0 0 [ 567.743515][T10610] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 567.760519][T10610] Node 0 DMA32: 2*4kB (ME) 2*8kB (UE) 1*16kB (E) 175*32kB (UME) 358*64kB (M) 63*128kB (UME) 22*256kB (ME) 11*512kB (ME) 5*1024kB (UM) 5*2048kB (UM) 280*4096kB (M) = 1210120kB [ 567.761690][ T5921] usb 4-1: config 2 has no interface number 0 [ 567.778248][T10610] Node 0 Normal: 1*4kB (M) 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20kB [ 567.798723][T10610] Node 1 Normal: 177*4kB (UE) 55*8kB (UME) 39*16kB (UME) 78*32kB (UME) 39*64kB (UME) 8*128kB (UME) 2*256kB (M) 3*512kB (UM) 2*1024kB (UM) 0*2048kB 949*4096kB (ME) = 3898988kB [ 567.857994][T10610] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 567.860343][ T5921] usb 4-1: config 2 interface 108 has no altsetting 0 [ 567.882841][T10610] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 567.888510][ T5921] usb 4-1: New USB device found, idVendor=129b, idProduct=160c, bcdDevice=1b.d8 [ 567.904955][T10610] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 567.930407][T10610] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 567.932336][ T5921] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.948157][T10610] 53005 total pagecache pages [ 567.948177][T10610] 1 pages in swap cache [ 567.948186][T10610] Free swap = 124992kB [ 567.948197][T10610] Total swap = 124996kB [ 567.948208][T10610] 2097051 pages RAM [ 567.948217][T10610] 0 pages HighMem/MovableOnly [ 567.948226][T10610] 424695 pages reserved [ 567.948235][T10610] 0 pages cma reserved [ 568.079412][ T5921] usb 4-1: Product: syz [ 568.083817][ T5921] usb 4-1: Manufacturer: syz [ 568.088541][ T5921] usb 4-1: SerialNumber: syz [ 569.990544][T10702] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1201'. [ 570.973998][ T5921] usb 4-1: Could not find all expected endpoints [ 571.002920][ T5920] em28xx 1-1:0.132: Config register raw data: 0xffffffed [ 571.097260][ T5920] em28xx 1-1:0.132: AC97 chip type couldn't be determined [ 571.151778][ T5920] em28xx 1-1:0.132: No AC97 audio processor [ 571.158402][ T5921] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 571.186310][ T5921] usb 4-1: MIDIStreaming interface descriptor not found [ 571.214275][ T5920] usb 1-1: Decoder not found [ 571.235184][ T5920] em28xx 1-1:0.132: failed to create media graph [ 571.296435][ T5920] em28xx 1-1:0.132: V4L2 device video103 deregistered [ 571.404533][ T5920] em28xx 1-1:0.132: Remote control support is not available for this card. [ 571.414327][ T5921] usb 4-1: USB disconnect, device number 41 [ 571.433949][ T9] em28xx 1-1:0.132: Closing input extension [ 571.564145][ T9] em28xx 1-1:0.132: Freeing device [ 573.858877][T10739] delete_channel: no stack [ 574.503243][ T5840] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 574.520139][ T5840] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 574.529008][ T5840] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 574.540436][ T5840] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 574.547967][ T5840] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 574.560585][ T5983] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 574.623779][T10754] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1213'. [ 575.434266][ T5921] usb 3-1: USB disconnect, device number 34 [ 575.562636][ T5983] usb 4-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.05 [ 575.594084][ T5983] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 575.625196][ T5983] usb 4-1: Product: syz [ 575.638742][ T5983] usb 4-1: Manufacturer: syz [ 575.658253][ T8302] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.659076][ T5983] usb 4-1: SerialNumber: syz [ 575.731779][ T5983] usb 4-1: config 0 descriptor?? [ 575.755047][ T5983] go7007 4-1:0.0: probe with driver go7007 failed with error -12 [ 575.766186][T10751] lo speed is unknown, defaulting to 1000 [ 576.056175][T10746] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 576.079906][T10746] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 576.134914][ T5953] usb 4-1: USB disconnect, device number 42 [ 576.271663][ T8302] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.581112][ T5840] Bluetooth: hci5: command tx timeout [ 576.865531][ T8302] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.691516][ T5840] Bluetooth: hci5: command tx timeout [ 578.740778][ T8302] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.869990][T10774] delete_channel: no stack [ 579.542323][T10798] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1223'. [ 580.320504][T10800] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1224'. [ 580.537303][T10751] chnl_net:caif_netlink_parms(): no params data found [ 580.753497][ T5840] Bluetooth: hci5: command tx timeout [ 581.340550][ T5983] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 581.597351][T10824] loop6: detected capacity change from 0 to 63 [ 581.607739][T10824] buffer_io_error: 27 callbacks suppressed [ 581.607758][T10824] Buffer I/O error on dev loop6, logical block 0, async page read [ 581.636849][T10824] Buffer I/O error on dev loop6, logical block 0, async page read [ 581.652633][T10824] Buffer I/O error on dev loop6, logical block 3, async page read [ 581.665319][ T5983] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 581.674852][ T5983] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 581.687264][T10822] Buffer I/O error on dev loop6, logical block 0, lost async page write [ 581.702623][T10824] loop6: unable to read partition table [ 581.709111][ T5983] usb 1-1: config 0 descriptor?? [ 581.716461][ T5983] cp210x 1-1:0.0: cp210x converter detected [ 581.723104][T10822] Buffer I/O error on dev loop6, logical block 1, lost async page write [ 581.732137][T10824] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 581.741369][T10822] Buffer I/O error on dev loop6, logical block 2, lost async page write [ 581.750842][T10822] Buffer I/O error on dev loop6, logical block 3, lost async page write [ 581.759789][T10822] Buffer I/O error on dev loop6, logical block 4, lost async page write [ 581.768646][T10822] Buffer I/O error on dev loop6, logical block 5, lost async page write [ 581.777485][T10822] Buffer I/O error on dev loop6, logical block 6, lost async page write [ 582.131684][T10814] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 582.375195][T10814] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 582.767439][ T5983] cp210x 1-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 582.899434][ T5840] Bluetooth: hci5: command tx timeout [ 584.209728][ T5983] cp210x 1-1:0.0: failed to get vendor val 0x3711 size 2: -32 [ 584.508131][ T5983] cp210x 1-1:0.0: GPIO initialisation failed: -32 [ 584.520718][ T5983] usb 1-1: cp210x converter now attached to ttyUSB0 [ 585.186040][ T8302] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 585.206121][ T8302] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 585.220955][ T8302] bond0 (unregistering): Released all slaves [ 585.417270][ T8302] [ 585.419754][ T8302] ====================================================== [ 585.426806][ T8302] WARNING: possible circular locking dependency detected [ 585.433857][ T8302] 6.16.0-syzkaller #0 Not tainted [ 585.438908][ T8302] ------------------------------------------------------ [ 585.445955][ T8302] kworker/u8:22/8302 is trying to acquire lock: [ 585.452309][ T8302] ffff888028a8ce00 (team->team_lock_key){+.+.}-{4:4}, at: team_del_slave+0x32/0x1c0 [ 585.461867][ T8302] [ 585.461867][ T8302] but task is already holding lock: [ 585.469236][ T8302] ffff88807e2e0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x133/0x6d0 [ 585.479700][ T8302] [ 585.479700][ T8302] which lock already depends on the new lock. [ 585.479700][ T8302] [ 585.490629][ T8302] [ 585.490629][ T8302] the existing dependency chain (in reverse order) is: [ 585.499733][ T8302] [ 585.499733][ T8302] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 585.507476][ T8302] lock_acquire+0x120/0x360 [ 585.512687][ T8302] __mutex_lock+0x182/0xe80 [ 585.517818][ T8302] ieee80211_open+0xed/0x1f0 [ 585.522947][ T8302] __dev_open+0x470/0x880 [ 585.527810][ T8302] netif_open+0xaa/0x170 [ 585.532691][ T8302] dev_open+0x125/0x260 [ 585.537382][ T8302] team_add_slave+0xb36/0x2840 [ 585.542679][ T8302] do_set_master+0x530/0x6d0 [ 585.547808][ T8302] do_setlink+0xcf0/0x41c0 [ 585.552754][ T8302] rtnl_newlink+0x160b/0x1c70 [ 585.557964][ T8302] rtnetlink_rcv_msg+0x7cc/0xb70 [ 585.563689][ T8302] netlink_rcv_skb+0x205/0x470 [ 585.569026][ T8302] netlink_unicast+0x75c/0x8e0 [ 585.574334][ T8302] netlink_sendmsg+0x805/0xb30 [ 585.579648][ T8302] __sock_sendmsg+0x21c/0x270 [ 585.584857][ T8302] ____sys_sendmsg+0x505/0x830 [ 585.590154][ T8302] ___sys_sendmsg+0x21f/0x2a0 [ 585.595383][ T8302] __x64_sys_sendmsg+0x19b/0x260 [ 585.600880][ T8302] do_syscall_64+0xfa/0x3b0 [ 585.605922][ T8302] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.612350][ T8302] [ 585.612350][ T8302] -> #0 (team->team_lock_key){+.+.}-{4:4}: [ 585.620638][ T8302] validate_chain+0xb9b/0x2140 [ 585.625932][ T8302] __lock_acquire+0xab9/0xd20 [ 585.631230][ T8302] lock_acquire+0x120/0x360 [ 585.636257][ T8302] __mutex_lock+0x182/0xe80 [ 585.641287][ T8302] team_del_slave+0x32/0x1c0 [ 585.646407][ T8302] team_device_event+0x285/0xa20 [ 585.651879][ T8302] notifier_call_chain+0x1b3/0x3e0 [ 585.657537][ T8302] unregister_netdevice_many_notify+0x15d8/0x2320 [ 585.664576][ T8302] unregister_netdevice_queue+0x33c/0x380 [ 585.670831][ T8302] _cfg80211_unregister_wdev+0x165/0x590 [ 585.676999][ T8302] ieee80211_remove_interfaces+0x49a/0x6d0 [ 585.683336][ T8302] ieee80211_unregister_hw+0x5d/0x2c0 [ 585.689509][ T8302] mac80211_hwsim_del_radio+0x275/0x460 [ 585.695591][ T8302] hwsim_exit_net+0x584/0x640 [ 585.700806][ T8302] ops_undo_list+0x497/0x990 [ 585.705928][ T8302] cleanup_net+0x4c5/0x800 [ 585.710874][ T8302] process_scheduled_works+0xade/0x17b0 [ 585.717031][ T8302] worker_thread+0x8a0/0xda0 [ 585.722148][ T8302] kthread+0x70e/0x8a0 [ 585.726920][ T8302] ret_from_fork+0x3fc/0x770 [ 585.732036][ T8302] ret_from_fork_asm+0x1a/0x30 [ 585.737329][ T8302] [ 585.737329][ T8302] other info that might help us debug this: [ 585.737329][ T8302] [ 585.747562][ T8302] Possible unsafe locking scenario: [ 585.747562][ T8302] [ 585.755015][ T8302] CPU0 CPU1 [ 585.760384][ T8302] ---- ---- [ 585.765756][ T8302] lock(&rdev->wiphy.mtx); [ 585.770272][ T8302] lock(team->team_lock_key); [ 585.777582][ T8302] lock(&rdev->wiphy.mtx); [ 585.784700][ T8302] lock(team->team_lock_key); [ 585.789556][ T8302] [ 585.789556][ T8302] *** DEADLOCK *** [ 585.789556][ T8302] [ 585.797704][ T8302] 5 locks held by kworker/u8:22/8302: [ 585.803080][ T8302] #0: ffff88801b2fb948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 585.813992][ T8302] #1: ffffc9000485fbc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 585.824554][ T8302] #2: ffffffff8f4fd310 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 [ 585.833908][ T8302] #3: ffffffff8f509f08 (rtnl_mutex){+.+.}-{4:4}, at: ieee80211_unregister_hw+0x55/0x2c0 [ 585.843802][ T8302] #4: ffff88807e2e0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x133/0x6d0 [ 585.854703][ T8302] [ 585.854703][ T8302] stack backtrace: [ 585.860608][ T8302] CPU: 1 UID: 0 PID: 8302 Comm: kworker/u8:22 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 585.860627][ T8302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 585.860639][ T8302] Workqueue: netns cleanup_net [ 585.860662][ T8302] Call Trace: [ 585.860669][ T8302] [ 585.860676][ T8302] dump_stack_lvl+0x189/0x250 [ 585.860695][ T8302] ? __pfx_dump_stack_lvl+0x10/0x10 [ 585.860718][ T8302] ? __pfx__printk+0x10/0x10 [ 585.860738][ T8302] ? print_lock_name+0xde/0x100 [ 585.860756][ T8302] print_circular_bug+0x2ee/0x310 [ 585.860776][ T8302] check_noncircular+0x134/0x160 [ 585.860795][ T8302] validate_chain+0xb9b/0x2140 [ 585.860814][ T8302] ? lockdep_unlock+0x89/0x120 [ 585.860835][ T8302] ? validate_chain+0x897/0x2140 [ 585.860856][ T8302] __lock_acquire+0xab9/0xd20 [ 585.860872][ T8302] ? team_del_slave+0x32/0x1c0 [ 585.860891][ T8302] lock_acquire+0x120/0x360 [ 585.860903][ T8302] ? team_del_slave+0x32/0x1c0 [ 585.860924][ T8302] ? __mutex_trylock_common+0x153/0x260 [ 585.860943][ T8302] __mutex_lock+0x182/0xe80 [ 585.860960][ T8302] ? team_del_slave+0x32/0x1c0 [ 585.860979][ T8302] ? rcu_is_watching+0x15/0xb0 [ 585.860997][ T8302] ? team_del_slave+0x32/0x1c0 [ 585.861017][ T8302] ? __pfx___mutex_lock+0x10/0x10 [ 585.861033][ T8302] ? bond_netdev_event+0xd9/0xe80 [ 585.861055][ T8302] ? __pfx___mutex_lock+0x10/0x10 [ 585.861071][ T8302] ? __pfx_bond_netdev_event+0x10/0x10 [ 585.861095][ T8302] team_del_slave+0x32/0x1c0 [ 585.861115][ T8302] team_device_event+0x285/0xa20 [ 585.861131][ T8302] notifier_call_chain+0x1b3/0x3e0 [ 585.861150][ T8302] unregister_netdevice_many_notify+0x15d8/0x2320 [ 585.861172][ T8302] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 585.861190][ T8302] ? __lock_acquire+0xab9/0xd20 [ 585.861212][ T8302] unregister_netdevice_queue+0x33c/0x380 [ 585.861228][ T8302] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 585.861246][ T8302] _cfg80211_unregister_wdev+0x165/0x590 [ 585.861268][ T8302] ieee80211_remove_interfaces+0x49a/0x6d0 [ 585.861286][ T8302] ? __pfx_synchronize_rcu+0x10/0x10 [ 585.861304][ T8302] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 585.861321][ T8302] ? rcu_is_watching+0x15/0xb0 [ 585.861338][ T8302] ieee80211_unregister_hw+0x5d/0x2c0 [ 585.861363][ T8302] mac80211_hwsim_del_radio+0x275/0x460 [ 585.861387][ T8302] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10 [ 585.861413][ T8302] hwsim_exit_net+0x584/0x640 [ 585.861432][ T8302] ? __pfx_hwsim_exit_net+0x10/0x10 [ 585.861451][ T8302] ? __ip_vs_dev_cleanup_batch+0x238/0x260 [ 585.861475][ T8302] ops_undo_list+0x497/0x990 [ 585.861497][ T8302] ? __pfx_ops_undo_list+0x10/0x10 [ 585.861521][ T8302] cleanup_net+0x4c5/0x800 [ 585.861541][ T8302] ? __pfx_cleanup_net+0x10/0x10 [ 585.861561][ T8302] ? _raw_spin_unlock_irq+0x23/0x50 [ 585.861574][ T8302] ? process_scheduled_works+0x9ef/0x17b0 [ 585.861590][ T8302] ? process_scheduled_works+0x9ef/0x17b0 [ 585.861606][ T8302] process_scheduled_works+0xade/0x17b0 [ 585.861630][ T8302] ? __pfx_process_scheduled_works+0x10/0x10 [ 585.861651][ T8302] worker_thread+0x8a0/0xda0 [ 585.861676][ T8302] kthread+0x70e/0x8a0 [ 585.861696][ T8302] ? __pfx_worker_thread+0x10/0x10 [ 585.861717][ T8302] ? __pfx_kthread+0x10/0x10 [ 585.861737][ T8302] ? _raw_spin_unlock_irq+0x23/0x50 [ 585.861750][ T8302] ? lockdep_hardirqs_on+0x9c/0x150 [ 585.861764][ T8302] ? __pfx_kthread+0x10/0x10 [ 585.861783][ T8302] ret_from_fork+0x3fc/0x770 [ 585.861799][ T8302] ? __pfx_ret_from_fork+0x10/0x10 [ 585.861815][ T8302] ? __switch_to_asm+0x39/0x70 [ 585.861832][ T8302] ? __switch_to_asm+0x33/0x70 [ 585.861848][ T8302] ? __pfx_kthread+0x10/0x10 [ 585.861867][ T8302] ret_from_fork_asm+0x1a/0x30 [ 585.861890][ T8302] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 586.222029][T10838] delete_channel: no stack [ 586.233803][ T8302] team0: Port device wlan1 removed [ 586.284729][T10751] bridge0: port 1(bridge_slave_0) entered blocking state [ 586.292058][T10751] bridge0: port 1(bridge_slave_0) entered disabled state [ 586.299271][T10751] bridge_slave_0: entered allmulticast mode [ 586.305852][T10751] bridge_slave_0: entered promiscuous mode [ 586.312876][T10751] bridge0: port 2(bridge_slave_1) entered blocking state [ 586.320241][T10751] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.327413][T10751] bridge_slave_1: entered allmulticast mode [ 586.334067][T10751] bridge_slave_1: entered promiscuous mode [ 586.351815][T10751] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 586.362337][T10751] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 586.381707][T10751] team0: Port device team_slave_0 added [ 586.388556][T10751] team0: Port device team_slave_1 added [ 586.404195][T10751] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 586.411269][T10751] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 586.437396][T10751] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 586.449119][T10751] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 586.456277][T10751] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 586.482311][T10751] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 586.507622][T10751] hsr_slave_0: entered promiscuous mode [ 586.513804][T10751] hsr_slave_1: entered promiscuous mode [ 586.519936][T10751] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 586.527587][T10751] Cannot create hsr debugfs directory [ 586.571949][ T5988] usb 1-1: USB disconnect, device number 25 [ 586.616823][ T5988] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 586.630426][ T5921] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 586.680408][ T5988] cp210x 1-1:0.0: device disconnected [ 586.840538][ T5921] usb 4-1: Using ep0 maxpacket: 16 [ 586.977100][ T5921] usb 4-1: config 0 has an invalid interface number: 251 but max is 0 [ 586.995216][ T5921] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 587.005619][ T8356] Bluetooth: (null): Invalid header checksum [ 587.020548][ T5921] usb 4-1: config 0 has no interface number 0 [ 587.027026][ T8356] Bluetooth: (null): Invalid header checksum [ 587.033653][ T8356] Bluetooth: (null): Invalid header checksum [ 587.047167][T10848] base_sock_release(ffff88805cedda00) sk=ffff8880240c5000 [ 587.057455][ T5921] usb 4-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 587.066818][ T5921] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 587.110405][ T5921] usb 4-1: Product: syz [ 587.114731][ T5921] usb 4-1: Manufacturer: syz [ 587.119392][ T5921] usb 4-1: SerialNumber: syz [ 587.136045][ T8356] Bluetooth: (null): Invalid header checksum [ 587.181991][ T5921] usb 4-1: config 0 descriptor?? [ 587.436716][ T8302] hsr_slave_0: left promiscuous mode [ 587.460681][ T8302] hsr_slave_1: left promiscuous mode [ 587.472254][ T8302] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 587.500435][ T8302] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 587.538995][ T8302] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 587.560459][ T8302] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 587.597524][ T8302] veth1_macvtap: left promiscuous mode [ 587.603320][ T8302] veth0_macvtap: left promiscuous mode [ 587.608981][ T8302] veth1_vlan: left promiscuous mode [ 587.614507][ T8302] veth0_vlan: left promiscuous mode [ 587.865114][ T8302] team0 (unregistering): Port device team_slave_1 removed [ 587.879485][ T8302] team0 (unregistering): Port device team_slave_0 removed [ 588.080677][T10848] bond0: (slave syz_tun): Releasing backup interface [ 588.190370][ T5921] usb 4-1: can't set config #0, error -71 [ 588.230892][ T5921] usb 4-1: USB disconnect, device number 43 [ 588.410121][ T8302] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.473797][ T8302] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.554473][ T8302] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.624994][ T8302] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.681244][ T8302] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.714968][ T8302] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.764687][ T8302] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.843612][ T8302] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.918626][ T8302] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.983876][ T8302] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.035248][ T8302] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.103717][ T8302] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.178479][ T8302] tipc: Resetting bearer [ 589.234174][ T8302] tipc: Disabling bearer [ 589.255029][ T8302] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 589.267913][ T8302] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 589.280457][ T8302] bond0 (unregistering): Released all slaves [ 589.472058][ T8302] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 589.481549][ T8302] bond_slave_0: left promiscuous mode [ 589.487974][ T8302] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 589.496814][ T8302] bond_slave_1: left promiscuous mode [ 589.502901][ T8302] bond0 (unregistering): Released all slaves [ 589.638088][ T8302] team0: Port device bond0 removed [ 589.644532][ T8302] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 589.654424][ T8302] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 589.666228][ T8302] bond0 (unregistering): Released all slaves [ 589.754829][ T8302] tipc: Left network mode [ 590.218787][ T8302] hsr_slave_0: left promiscuous mode [ 590.224563][ T8302] hsr_slave_1: left promiscuous mode [ 590.230131][ T8302] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 590.237633][ T8302] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 590.245213][ T8302] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 590.253845][ T8302] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 590.264707][ T8302] hsr_slave_0: left promiscuous mode [ 590.271519][ T8302] hsr_slave_1: left promiscuous mode [ 590.277141][ T8302] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 590.284752][ T8302] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 590.292530][ T8302] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 590.299921][ T8302] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 590.309870][ T8302] hsr_slave_0: left promiscuous mode [ 590.315616][ T8302] hsr_slave_1: left promiscuous mode [ 590.321307][ T8302] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 590.328730][ T8302] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 590.336538][ T8302] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 590.344044][ T8302] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 590.357084][ T8302] veth1_macvtap: left promiscuous mode [ 590.362743][ T8302] veth0_macvtap: left promiscuous mode [ 590.368332][ T8302] veth0_vlan: left promiscuous mode [ 590.374198][ T8302] veth1_macvtap: left promiscuous mode [ 590.379677][ T8302] veth0_macvtap: left promiscuous mode [ 590.385262][ T8302] veth1_vlan: left promiscuous mode [ 590.391167][ T8302] veth0_vlan: left promiscuous mode [ 590.397210][ T8302] veth1_macvtap: left promiscuous mode [ 590.402784][ T8302] veth0_macvtap: left promiscuous mode [ 590.408297][ T8302] veth1_vlan: left promiscuous mode [ 590.413583][ T8302] veth0_vlan: left promiscuous mode [ 590.682958][ T8302] team0 (unregistering): Port device team_slave_1 removed [ 590.712327][ T8302] team0 (unregistering): Port device team_slave_0 removed [ 590.900774][ T8302] team0 (unregistering): Port device team_slave_1 removed [ 590.916056][ T8302] team0 (unregistering): Port device team_slave_0 removed [ 591.229651][ T8302] team0 (unregistering): Port device team_slave_1 removed [ 591.261566][ T8302] team0 (unregistering): Port device team_slave_0 removed [ 591.355213][ T5921] lo speed is unknown, defaulting to 1000 [ 591.361684][ T5921] syz0: Port: 1 Link DOWN