last executing test programs: 12m15.167916294s ago: executing program 2 (id=253): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x50) r2 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000100)={r0, r1, 0x7, 0x0, @val=@tcx={@void, @value=r0}}, 0x1c) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES16=r1, @ANYRESHEX=r2], 0x48) socket$kcm(0x10, 0x2, 0x4) close(0x4) r4 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r3, 0x4) bpf$LINK_DETACH(0x22, &(0x7f0000000340)=r4, 0x4) 12m15.091836357s ago: executing program 2 (id=254): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r1, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r3, 0xae80, 0x0) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) pwritev2(0xffffffffffffffff, &(0x7f0000000240)=[{0x0}], 0x1, 0x7a00, 0x0, 0x20) 12m12.915979879s ago: executing program 2 (id=262): write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x32600) prlimit64(0x0, 0xe, 0x0, 0x0) getpid() socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000002180)=0xfe1) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x4, 0x1}, 0xe) listen(r0, 0x3) accept4$bt_l2cap(r0, &(0x7f0000000200), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x204031, 0xffffffffffffffff, 0xffffd000) r1 = syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00') r2 = syz_open_dev$loop(&(0x7f0000000000), 0x400, 0x105000) ioctl$IOC_PR_PREEMPT_ABORT(r2, 0x401870cc, 0x0) pread64(r1, &(0x7f0000002240)=""/237, 0xed, 0x4eb) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f00000003c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x70, 0x70, 0x6, [@fwd={0xf}, @struct={0xb, 0x4, 0x0, 0x4, 0x0, 0xd, [{0x2, 0x1, 0x101}, {0xf, 0x5}, {0x10, 0x5, 0x3}, {0xe, 0x0, 0x8ef}]}, @volatile={0x3}, @var={0x1, 0x0, 0x0, 0xe, 0x2}, @ptr={0x2, 0x0, 0x0, 0x2, 0x3}]}, {0x0, [0x30, 0x2e, 0x0, 0x3e]}}, &(0x7f0000000480)=""/188, 0x8e, 0xbc, 0x0, 0x4ed, 0x10000, @value=r1}, 0x28) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/dev\x00') read$FUSE(r4, &(0x7f0000000140)={0x2020}, 0x2020) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYRES8=r4], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r3}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r5, 0xe0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x200000000000035f, 0x0, &(0x7f00000021c0)=[0x0, 0x0], 0x0, 0x0, 0xe8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffffffffcac, 0xfffffffffffffffd}}, 0x10) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r8, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r0, 0x26, &(0x7f0000000080)={0x1, 0x2, 0x2007, 0x1fd}) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xe, 0x9, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000006000000000000000400000085000000c1000000851000000600000018220000", @ANYRES32=r1, @ANYBLOB="00000000000800001839000001000000000000000200000095000000000000"], &(0x7f00000000c0)='syzkaller\x00', 0x2, 0xad, &(0x7f0000000600)=""/173, 0x41000, 0x10, '\x00', r6, @sk_skb=0x4, r1, 0x8, &(0x7f0000000140)={0xa, 0x2}, 0x8, 0x10, &(0x7f00000001c0)={0x4, 0x1, 0x18, 0x9}, 0x10, r7, r8, 0x0, &(0x7f0000000240), 0x0, 0x10, 0x4}, 0x94) socket$kcm(0x2, 0x200000000000001, 0x0) 12m11.240385331s ago: executing program 2 (id=268): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = open(&(0x7f0000000080)='./bus\x00', 0x109043, 0x100) mount$overlay(0x0, &(0x7f0000000180)='./bus\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000000)={[{@redirect_dir_nofollow}], [], 0x5c}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0x8000000, 0x9, 0x10001, 0xfffffffe, 0x0, [{0x2, 0x4, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x40, '\x00', 0xb}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x5, 0xf5, '\x00', 0xf}, {0x7, 0x9, 0xc, '\x00', 0xfb}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7b}, {0x3, 0x4, 0xc}, {0x7f, 0x5, 0xb, '\x00', 0xb}, {0xd7, 0xa, 0x8, '\x00', 0x2}, {0x0, 0x28, 0x80, '\x00', 0xdc}, {0xff, 0x1, 0xfa, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xcf, 0x3, 0x1, '\x00', 0x6}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x6, '\x00', 0xb}, {0x9, 0x6, 0x2, '\x00', 0x8}, {0x5, 0xc, 0x5, '\x00', 0xc}, {0x7, 0x7f, 0x7, '\x00', 0xc2}, {0x0, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x6, 0x3, '\x00', 0xd}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x9}]}}) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000100)={0x0, 0x7be}, &(0x7f0000000140)=0x8) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x306c5000) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) 12m5.746735164s ago: executing program 2 (id=289): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1e, 0x0, 0x0, &(0x7f00000004c0)='syzkaller\x00', 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000180)=0x10000000005) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x400000000001, 0x0, 0x1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000000)={0x8000001, 0x0, 0x0, 0x0, 0x4000007}) r5 = syz_io_uring_setup(0x315a, &(0x7f0000000140)={0x0, 0xc7ce, 0x42, 0x0, 0xfa}, &(0x7f0000000600)=0x0, &(0x7f0000000000)) io_uring_register$IORING_REGISTER_FILES(r5, 0x2, &(0x7f0000000040)=[r5], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f00000005c0)=ANY=[@ANYRESOCT=r6]) write$P9_RVERSION(r7, &(0x7f0000000480)=ANY=[@ANYBLOB="1500000065ffff0800000008003950323030302e4ca7"], 0x15) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000001c0)={{{@in=@initdev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@remote}}, &(0x7f0000000080)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000380)={{{@in6=@mcast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@empty}}, &(0x7f0000000340)=0xe8) setreuid(r8, r9) 12m3.339175511s ago: executing program 2 (id=292): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001cc0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000000208010100000000000000000a0000040600061d08000000050003"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) (fail_nth: 6) 12m0.627538117s ago: executing program 4 (id=300): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x7) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x28) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f0000000500)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000080)={0x10, 0xa, 0x4, "3258ae1e008fa200000000000000000000000000000100000000271e00000020", 0x44495658}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x9b80696e07a3fc3a, &(0x7f00000001c0)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b70200000000000085000000510000", @ANYRESOCT], 0x0, 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000480)={'macvlan1\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000001d00070f000000000000000007000000", @ANYRES32=r4, @ANYBLOB="000052000600050001000000080008"], 0x2c}}, 0x20008000) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000740)=@newtfilter={0x68, 0x2c, 0x10, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0xd, 0x9}, {0x0, 0x3}, {0xc, 0x1}}, [@TCA_CHAIN={0x8, 0xb, 0x3}, @TCA_CHAIN={0x8, 0xb, 0x8b79}, @TCA_RATE={0x6, 0x5, {0xf3, 0x5b}}, @filter_kind_options=@f_flow={{0x9}, {0x20, 0x2, [@TCA_FLOW_POLICE={0x1c, 0xa, 0x0, 0x1, [@TCA_POLICE_RATE64={0xc, 0x8, 0x1}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xd5}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000000}, 0x20044890) r5 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.idle_time\x00', 0x275a, 0x0) write$binfmt_misc(r6, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f00000002c0)={r6, 0x0, {0x2a00, 0x80010000, 0x1200, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) 11m59.979675654s ago: executing program 4 (id=301): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000300)={r1, 0x1, 0x6, @broadcast}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000200)={r1, 0x11, 0x6, @random="bdf19b71a0f9"}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r1, 0x1, 0x6, @broadcast}, 0x10) 11m59.180441761s ago: executing program 4 (id=306): syz_emit_ethernet(0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000008260001080006040003000000000000ac1414bbbbbbbbbbbbbbac1414"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffd32, 0x0, 0x0, 0x10, 0x6}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x715}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) 11m58.182866094s ago: executing program 4 (id=311): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a40)=ANY=[@ANYBLOB="b70200000d000000bfa300000000000005000000000000007a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065060400010000050404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf27fb6d2c643db7e2d5fb4b0936cdf827fb43a431ca711fcd0cdfa146ed3d09a6175037958e27106e225b7937f02008b5e5a076d83923dd29c034055b67d5b310efcfa89147a7fb0a93d035f2f206d2ef831ab7ea0c34f17e3ad6eecbb622003b538dfd8e012e79578e51bc53099e90f4580d7be3e8c254a5cba117cbdb9cd38bdb2ca8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e6a9f65f1328d6704902cbe7bc04b82d2789cb132b8667c214733a18c8b6619f28d996d60a17e3c184b751c51160100000000000080148b9a31ee8dc8b544f3c4a532e60a0ac346dfebd31a08060000000200000000000000334d83239dd20100008000000000d858e8327ef01fb6c86acac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e957bc73ddc4eabba08a406f99f7b1e1ad828267d4eadd3964663e085354133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0183babc190ae2ebf8aad34732181feb28cb0bae7c34dc5e7c805210600000000000000c3dec04b25df45d4f71ab158c36657b7218baa07a99bd50499ccc421ace5e845885efb5b9964e4beba3da8223fe5308e4e65ee93e107000000f8ddebf70132a4d01776839b8eccf707882042e716df9b57b290c661d4e85031086197bcc5cb0e221a0c34323c129102b6ff0100002e88a1940b3c02ed9c92d6f64b1282dc51bb0015982730711c599e1c72ffa11ed8be1a6830d7507005154c46bd3ca96318c570f0721fc7aa2a5836ba99fe1f86468694f22cdf550ef091a78098534f0d973059594119d06d5ea9a8d0857382ec6e2a071474cfc12346e47ad97f4ead7cf70a9d1cdac944779dc08a705414888700a30e2366c6a06b3367a389ca39059787790017b0689a173db9c24db65c1e00015c1d093dab18fd0699fe3304000000323e9c7080397bc49d70c060d57bc88fbe3bbaa058b040362ab926150363fb099408885afc2bf9a46a076b7babfcddeff8c35030669ea69f5e4be1b8e0d6697e97186f9ae97d5670dba6623279f73db9dec75070cd9ab0fda6b069ef6d2857ca3e4e6068f1bf710d133d541da86e0477e4a6cc999dc21c3ef408e6b178e7c9f274d7fafc8d757d33dfa35aa2b2ff7f9a7d365e63845f3e1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cadecc13219ba7518aa4f7db34ead13484742067ab743c1d82a5687f2ed690000010000000000000000000000000000000000000099d4fa0000000000003f0ecdc7c82e72919c91d2039afe17e95edef8ba72205beff7771bcb293747b88486cacee403000000a2919a4b09e168e4e4d5ff2ed893f2e314679fa69fc7e0cf761f918725704a01c56009a9f748e5aaf30a10bd8c409b1870c1f75e26b45264e3d3f8e0048e55ae289c2f884d0766cddc76eb7f601110ff39053c262279f4ef00fbdb8c328615a9ec84f27a9f3938ae736138b8c1ec220c1540bf3d162dc1c27fa30f0dc60b9f257db5d1c7ed2efce676a93110904d5e055af44664b53c764d61443f73552195c7ccfbf9f03c44432eaa3b7501d4239354da8de21eada75d3a3afb2c76ff0700007976694b6a0f0e946766f57544ff52cef0dd811bec4e3c0a30f2d7d19d26d201721b8eded3bc475958dd498ee2b2d6146e33fc0de1dc2e0516ac565ddb1d4ae89e671282a2d3066ac968c7d7d7db195f255b1b4a85eb9ee0a3b68c9e209756623adf685dd715d68ed1274b4d5502f512493af8f98c615cac3666c58f785c3f758be352a71871d5c081197d37980e4f4e26b5476fb20407ff7098b7174bef66fa03a99b5c0c20b378065fac4ef9ac2d0d804b9400000060e5d3f1749f6aecf69ba83a71caa9bdddc679f1b826f74b6563a4be1fd82b73c8c2bc65f63982b951fb058fd3c7b6341c4580376b2c16bd94d2da66059de81abfa15eeeae3b0ba38d8bb1bf032c73f1285e21fff5a1d138e061b1dc7bbda199b5fab8e0719e9cd69b47dcb52b0be6a3a73afdf328132e1d4f21065716be0c53a23940d07188b015fa341dbc92231c8b5e5717eac184f46c9f61b69f55cd2231bcf821052429a1f250e8b734be0605a15f25923d599544b319319ff0a32621019347df460a098119a6f47eb1bac47946d7a009cbc6ec74c19a93cc7c7138b28c95270116181fd5f5533d3c58104d2ad0e10d3663488e664401453f22f0d76d2162635365258af61ae1f46f4a7866f302d91e3f7c2781f602220522e84602a939a8d5e4137ae31ccd397404dc72e06715a6503d4d865182803ee6725da7293b23daeebefd6fce7411c9624a7e8d5ba5a13e1c32adc4f3274497c6882a72475e4280a4d9a47c003c6ed3071330c58145be813a10788a720a6b5a498ca2b42496c479a0a71e2f6f9bad8c84bc6be20281bde0b348cf2c60538a505ad4a0510eebb023e4954c9eb6cd70627f5c03d867dbf3ad5d1f1dc852064dd0efafc3df20ec8faf3d194db76127f88f284fa1b71ab964fdd2474471da76373e65e9a8bf844bdfdd348bc7d00c4c7e7abc231f8cde79b7a6c5aafe954b8ba37818e40c14b36f2d7c23f9f614576b689436fef2f27f8b1e756e00262e22bca49c43fd73e7e99b2fa44a8c1df7ffffff735ad6c5fabf082e0df0f8ba7e24272165f2f5b28230c095162b82ceaeaae9b1713b5f2ee68e2b53d44bd84bf6960157e96bbb96b5e10d66c87e7a9a7d53c281d88ebb175a4dbb82130e6870980e47913110f091d21760d985afd3163f2e6880682432f9b3b97d57a9f980edfa1116a3d04d58872a07d6a7e12db673acd2f7b8988d833e71943fe2c1c65a3cf355e5b91114052f8a398d8e10c96b955c56b55bfd3ecf0af694c71a03f2996c15b1ba971de1cb9c7e6a0000000000000014783ef54c51199317413f98dca8ff3df3572a7d9ef5f6103997f1f9e4b0c3970bda50f6c0af58dbd6c031b1a5a7512c58965c514adfa17d31429c68db50a93d88199defd3b4625fea426ff9293a28a544a6a9e24d192d67a1b3c6b14c4ec6d164e902ce4913843d65d841973468729ea12bf6d3499036dbb66718f3497855c3baa6cc07c0fa388ec9df0617c1a28ef5a595ee267a76175b8a057e6efaf4fefe46def451f2858fe71a53e77b1a44e98843bb3a40102da3703dfb9f61bdcea2fb810b32d52e2157a150a63ea6135d1cf6f864c2e68884d7245bc5d61dc5a114d10ffb2200040000fc1e3865d17d128306d1b81884a934cb0000000000d367000098a4526e6468987dbc63bff7590eb388afaba43d811996333eef7e9f472bee293f0c40d434b8be07cbd52325296e22802493edb5c590ad208bac683a8b2d4c9d2d57ff846ae8c422e0b28546671f11d8157bb762c91f3fbcca8e21589c92446ae65d408c0637ffcc2d44b615ce003dd1e12b085e186d069a55c2e96efbe5024d61a56a36d988c0f530043a6cd72af0fcd540a9d4e293690c5e697b3a1480e46df5371bca1cfb28a57c1b3c956ec81397e81fbf870a673804220423f52ad8178b9fd04bff816e00000000000000000000000000000000000000000079aaf19bd1e18f582aac5b83d76bd57297512fdcdad18bcf2455bc80394d8f34e2ef84733038f4b6ef516d7baa99f24f2f100fc46aec9dc19b30fe9966b7ae563b6459d86fd3b4c7173f06387517e4189f3fb09c069e20220354b054f2391efe55a0cc7f738b3987ae033ceabddec65ec31f98c7e0858e8d411087889964b8fb3c31f74fa7b2e6e1c1d84a46d8be8afff1ac67eb2da30294d4a0f89978d4e2137319b6448da45bd00eb23aa5be1d566782b5a4aa291a854a4932bcbf472fd1175b521edb1763bb7dae4a124b0006e2ce4799519b3dbd3c0109b17fe2b4b87f6ad4b7176c9c1959669ef42cfce81fbc6dcdc7f9bde1a66c0b3cf9329bfecf0217bda1b72924ee9d90a3bd0be833f206244b5ba0648309018da5442ebd22bca0363183aae9d38f80638f52015cab5a8d772f9b92cb2f286783fa976f7d215136cae0b0b0539dc7dbd56035a69807514c732763f542f10401e65368b821b584fe2f82c94b2f5930246800000000000000000000000000000000000000c8ed77d8ac9f28a2e8f205900241ec8872fe3ecdf73abfc4024298a69649e17f3fe5ebba1e17f2f280e6d3f094cd3448700c5ee102b5d1b04f08ab2e5272990646eca26a62431e8c942ea2c0c621b4821eb5beceee6d53468852159452cf47aead473a8638a4d1ce2d4c6df1074e8cb3ec16149e6b4b7ec1a9aa1b63f41d08afd3d885b98330e25eedaaf5f361b2e81ce0c52ee84a2b340afdc59b177921e2f2a99132b82ed3291196038fe9a4f5a5dc734788c71bf46222d266a48628774c87b88bf3dcbea4574a87726345587e1e233fd4117063d183f477cc53c52a3fafcb998a96cf9f61cdd9ffa82d648880552ac506811accffc85ca34b262ed983d4645f4657522ed32b278891c26d5e70d41f9a5c8df8dc163fd84a81af0020a10fe53ce940d350d62b526f198620abdad179a273682175da1d9d82fde7eb9a45b566e78904238d00908b5876b4ebfca376d631b9b0caf3f1ef32ae87507aace4715efaf840ebda28e741a8b6b29eed5861168b4e1b3842f6db4443974dd0f0d4ceed9ca62fd2a839a8150335dc2b9640825b83c8bf4f931a51b093bf2dc84809af7c14f04b58d64e4f852bc49cf1126567e11f61774559bdbcc500000000000000000000000000eab10c8c592cb6f1ebccd9eb16c155a0666189eb16cea09f164363456645c9b7c168bc214615a7e94ff3d53f85c6396c42050f3205cef3009458f33949efa6a583d87795448b8b21ab6a7ca4bd8b0da30dee0af8b3a0f3cfd0ad9a8e7819b2057e2e5d8b453b6f743f8fc4dee677658958c4d4663ddcdfd0fc44e996665ab5586a4eb40a959fb0dababa05e776c29cf2443ad1d2fa0920288db88e645033ae1a4357078810d20bd93b8194214554c3f8c6efd61bc40000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r0, 0x18000000000002a0, 0xe40, 0x0, &(0x7f00000002c0)="f6eb094549002060009b8538a4ba", 0x0, 0x806, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r3, 0x40049366, &(0x7f0000000500)=0x1) syz_clone(0x904000, 0x0, 0x5f, 0x0, 0x0, 0x0) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder-control\x00', 0x1802, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080)={0x0, r4}, 0x8) socket$alg(0x26, 0x5, 0x0) mount$tmpfs(0x0, &(0x7f00000021c0)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000480), 0x60b8fc9b9d7c977f, &(0x7f0000000600)=ANY=[@ANYBLOB="682c70f5efe623c74b8f0700000076696f63565f430fa18d972c00048b1699f16d3d4eb270f3c703d4f6ecb30c33e8fa57b3b11bc73066867ccfbf498b9154841e28f03f754af14a931d34e6040ea67e343be35e72bef906e93acd628570c46d6ad04fc0c475f3dd08064c8d76e9e90d368b28e8c751110c53b8da2cad"]) 11m56.868565877s ago: executing program 4 (id=314): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=@ipv6_newrule={0x24, 0x20, 0x1, 0x0, 0xffffffff, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20001}, [@FIB_RULE_POLICY=@FRA_FWMASK={0x8, 0x10, 0x9}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x0) 11m52.939779024s ago: executing program 4 (id=322): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) ioctl$UDMABUF_CREATE_LIST(r1, 0x40087543, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=@newtaction={0x258, 0x30, 0xb, 0x5, 0x25dfdbfc, {}, [{0x244, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x80000001, 0x0, 0x0, 0x0, 0x400}}, @TCA_CT_ACTION={0x6, 0x3, 0x19}, @TCA_CT_NAT_IPV4_MIN={0x8, 0x9, @private=0xa010102}, @TCA_CT_NAT_IPV4_MAX={0x8, 0xa, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}, @m_csum={0x1e4, 0x4, 0x0, 0x0, {{0x9}, {0xc8, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xfffff6a7, 0x2, 0x6, 0x9, 0x6}, 0x5b}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x800, 0x20000000, 0x8, 0x2615d5e5}, 0x1e}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xfffff800, 0x2, 0x8, 0x1, 0x4}, 0x3c}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x8, 0xffffffffffffffff, 0xb17, 0x8}, 0x47}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xa, 0x143, 0x0, 0x6, 0x7}, 0x23}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x95, 0x20000000, 0x0, 0x3}, 0x1e}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x91d, 0x25ef0ab4, 0x3, 0x44e, 0x101}, 0x1c}}]}, {0xf3, 0x6, "035208dc32d595f48727034c102fb77fa87dd39d288f5535e483d1d03c04df8463f6c4b8801a6ebd19a027ee562e947c0c988be1c881a7f94f1aebe1d17d160718faa150b247a5959fc0afebbfc860779330a6000bcc413fd08d6ede8acd0793006b4e2c52737fd9ed39a4129c48ee6e585d30224549cb6374d01582e841184d7dbc6aebe81a620120d50734b6c43a620fe033e4f69bd195955df26bfe9a4940ca9ffce190d31c1ee0bef3f67bb0655abb66c6130a112915ceb202e119e9f95deb03c2c37eae9d8c4387fe1bb2b1eff15f7df2f2a704f1783d7a5282398c6e61b2e573c71f835dd0c9975ccfeb3e7a"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0xcb4f04bf04272f1a}}}}]}]}, 0x258}, 0x1, 0x0, 0x0, 0x8890}, 0x40) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi2\x00', 0x181001, 0x0) r4 = memfd_create(&(0x7f00000002c0)='\xba:\x80%m~\x06\\\xaa\x1aU=8\xebR%\xca\xf7\x1f\x8da5\xf9\xf37\xd8r\xc6p\xb3\xd9T{F\xa1\xb3\t\xac\xd7\x7f\x88$}/-[\x80\xd7M]:\xf0\xdc\xbf\x9f\xe7\x8c\xda/\xdc]\xd8\x90\xdb\xcd\x14\xf9\xee\xf2\xfes\x8c\t}\xae\xa6a\x14\x01\x04\x00^f\xa4\xfc\xcc\xc5\xf7\xdc)z\xac\x8b\x80\x91\xad\xc4\x8c\xeb\x83T\x96\xbd\xc3\xf5\xe9L\x89v\"\x9b\xd7\x90I\xae\x13\x8c\xc4%6\xeb\xc9\xca\",R\xdb\x8d U%\x9a[\r\xce\xffrf\x8c\x1b\xeb\xa4\x8cK\xd7\xba\xd0\x16\x88', 0x1) dup(r4) socket$inet6_tcp(0xa, 0x1, 0x0) socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80b00, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r6) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0193a2e89a00000000001fffffff04000180080002"], 0x20}}, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r8 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002440), 0x2, 0x0) r9 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r9}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x111, 0x1}}, 0x84) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4e21, 0x9, @mcast1, 0x9}, r10, 0x8001}}, 0x48) 11m52.670118351s ago: executing program 32 (id=322): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) ioctl$UDMABUF_CREATE_LIST(r1, 0x40087543, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=@newtaction={0x258, 0x30, 0xb, 0x5, 0x25dfdbfc, {}, [{0x244, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x80000001, 0x0, 0x0, 0x0, 0x400}}, @TCA_CT_ACTION={0x6, 0x3, 0x19}, @TCA_CT_NAT_IPV4_MIN={0x8, 0x9, @private=0xa010102}, @TCA_CT_NAT_IPV4_MAX={0x8, 0xa, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}, @m_csum={0x1e4, 0x4, 0x0, 0x0, {{0x9}, {0xc8, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xfffff6a7, 0x2, 0x6, 0x9, 0x6}, 0x5b}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x800, 0x20000000, 0x8, 0x2615d5e5}, 0x1e}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xfffff800, 0x2, 0x8, 0x1, 0x4}, 0x3c}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x8, 0xffffffffffffffff, 0xb17, 0x8}, 0x47}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xa, 0x143, 0x0, 0x6, 0x7}, 0x23}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x95, 0x20000000, 0x0, 0x3}, 0x1e}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x91d, 0x25ef0ab4, 0x3, 0x44e, 0x101}, 0x1c}}]}, {0xf3, 0x6, "035208dc32d595f48727034c102fb77fa87dd39d288f5535e483d1d03c04df8463f6c4b8801a6ebd19a027ee562e947c0c988be1c881a7f94f1aebe1d17d160718faa150b247a5959fc0afebbfc860779330a6000bcc413fd08d6ede8acd0793006b4e2c52737fd9ed39a4129c48ee6e585d30224549cb6374d01582e841184d7dbc6aebe81a620120d50734b6c43a620fe033e4f69bd195955df26bfe9a4940ca9ffce190d31c1ee0bef3f67bb0655abb66c6130a112915ceb202e119e9f95deb03c2c37eae9d8c4387fe1bb2b1eff15f7df2f2a704f1783d7a5282398c6e61b2e573c71f835dd0c9975ccfeb3e7a"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0xcb4f04bf04272f1a}}}}]}]}, 0x258}, 0x1, 0x0, 0x0, 0x8890}, 0x40) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi2\x00', 0x181001, 0x0) r4 = memfd_create(&(0x7f00000002c0)='\xba:\x80%m~\x06\\\xaa\x1aU=8\xebR%\xca\xf7\x1f\x8da5\xf9\xf37\xd8r\xc6p\xb3\xd9T{F\xa1\xb3\t\xac\xd7\x7f\x88$}/-[\x80\xd7M]:\xf0\xdc\xbf\x9f\xe7\x8c\xda/\xdc]\xd8\x90\xdb\xcd\x14\xf9\xee\xf2\xfes\x8c\t}\xae\xa6a\x14\x01\x04\x00^f\xa4\xfc\xcc\xc5\xf7\xdc)z\xac\x8b\x80\x91\xad\xc4\x8c\xeb\x83T\x96\xbd\xc3\xf5\xe9L\x89v\"\x9b\xd7\x90I\xae\x13\x8c\xc4%6\xeb\xc9\xca\",R\xdb\x8d U%\x9a[\r\xce\xffrf\x8c\x1b\xeb\xa4\x8cK\xd7\xba\xd0\x16\x88', 0x1) dup(r4) socket$inet6_tcp(0xa, 0x1, 0x0) socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80b00, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r6) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0193a2e89a00000000001fffffff04000180080002"], 0x20}}, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r8 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002440), 0x2, 0x0) r9 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r9}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x111, 0x1}}, 0x84) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4e21, 0x9, @mcast1, 0x9}, r10, 0x8001}}, 0x48) 11m48.063165909s ago: executing program 33 (id=292): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001cc0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000000208010100000000000000000a0000040600061d08000000050003"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) (fail_nth: 6) 9m37.460170737s ago: executing program 3 (id=661): prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) socket(0x25, 0x5, 0xec2) syz_io_uring_setup(0x497, &(0x7f0000000540)={0x0, 0xa5a1, 0x400, 0x7, 0x285}, &(0x7f00000004c0), &(0x7f0000000280)) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000040), 0x10}, 0x94) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0xe044, 0x0, 0x0) syz_io_uring_setup(0x30da, 0x0, &(0x7f0000000100), 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) semop(0x0, &(0x7f0000000000)=[{0x3, 0xfff7, 0x1000}], 0x1) semop(0x0, &(0x7f00000000c0)=[{0x3, 0xa78d, 0x1000}], 0x1) r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev}}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000ac0)="ee", 0x1}], 0x1, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b57000000860f5878c37ffe36e1165814d435be5b317c6c8189587d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988ab013f40afe403041323110f62055394412158e7a3adb148d641aa40d4ab077fe34232aa8b31851466d0998a61d7da0c86d7"], 0x10b8}, 0xff4c) 9m37.053845208s ago: executing program 3 (id=662): syz_emit_ethernet(0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000008260001080006040003000000000000ac1414bbbbbbbbbbbbbbac1414"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffd32, 0x0, 0x0, 0x10, 0x6}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0]) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x715}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) 9m33.076966964s ago: executing program 3 (id=668): syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) syz_clone(0x40000, &(0x7f0000000000)="ef8dc089af", 0x5, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="93fb82971973f5475e6dbf0fd43cb3e950ea1efc528da172029f6fc372d6aa2e1d4680c123f4738e034c0e05893189efea7a66d6a9f28f9ef86662b9d60fdaaf9c5e8efe8a1a7bb622a13956fb45ca307f100f6ed25ca15f7e96e4") r0 = socket$inet6(0xa, 0x805, 0x0) getsockopt$bt_hci(r0, 0x84, 0x85, &(0x7f0000000080)=""/4060, &(0x7f00000010c0)=0xfdc) 9m31.564822495s ago: executing program 3 (id=674): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000640), 0x2d00, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000000)=0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r1, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(0x0, 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = syz_io_uring_setup(0x487, &(0x7f0000000240)={0x0, 0x59c4, 0x800, 0x1000, 0x5cc}, &(0x7f0000000300)=0x0, &(0x7f0000000080)=0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x401, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r6, 0xc0189374, &(0x7f0000000240)={{0x1, 0x1, 0x1018, 0xffffffffffffffff, {0x29}}, './file0\x00'}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x1}) io_uring_enter(r3, 0x749f, 0x4, 0x0, 0x0, 0xfffffffffffffef5) 9m30.196510621s ago: executing program 3 (id=679): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpgrp(0x0) sched_setaffinity(r1, 0xfffffffffffffdc3, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000000880)='./file0\x00') r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_SWBIT(r5, 0x4004556d, 0xb) ioctl$SIOCSIFHWADDR(r0, 0x89f9, &(0x7f0000000080)={'veth1_macvtap\x00', @broadcast}) 9m25.185278495s ago: executing program 3 (id=683): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) open(&(0x7f0000000080)='./bus\x00', 0x109043, 0x100) mount$overlay(0x0, &(0x7f0000000180)='./bus\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000000)={[{@redirect_dir_nofollow}], [], 0x5c}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0x8000000, 0x9, 0x10001, 0xfffffffe, 0x0, [{0x2, 0x4, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x40, '\x00', 0xb}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x5, 0xf5, '\x00', 0xf}, {0x7, 0x9, 0xc, '\x00', 0xfb}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7b}, {0x3, 0x4, 0xc}, {0x7f, 0x5, 0xb, '\x00', 0xb}, {0xd7, 0xa, 0x8, '\x00', 0x2}, {0x0, 0x28, 0x80, '\x00', 0xdc}, {0xff, 0x1, 0xfa, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xcf, 0x3, 0x1, '\x00', 0x6}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x6, '\x00', 0xb}, {0x9, 0x6, 0x2, '\x00', 0x8}, {0x5, 0xc, 0x5, '\x00', 0xc}, {0x7, 0x7f, 0x7, '\x00', 0xc2}, {0x0, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x6, 0x3, '\x00', 0xd}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x9}]}}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x306c5000) 9m9.552079001s ago: executing program 34 (id=683): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) open(&(0x7f0000000080)='./bus\x00', 0x109043, 0x100) mount$overlay(0x0, &(0x7f0000000180)='./bus\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000000)={[{@redirect_dir_nofollow}], [], 0x5c}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0x8000000, 0x9, 0x10001, 0xfffffffe, 0x0, [{0x2, 0x4, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x40, '\x00', 0xb}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x5, 0xf5, '\x00', 0xf}, {0x7, 0x9, 0xc, '\x00', 0xfb}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7b}, {0x3, 0x4, 0xc}, {0x7f, 0x5, 0xb, '\x00', 0xb}, {0xd7, 0xa, 0x8, '\x00', 0x2}, {0x0, 0x28, 0x80, '\x00', 0xdc}, {0xff, 0x1, 0xfa, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xcf, 0x3, 0x1, '\x00', 0x6}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x6, '\x00', 0xb}, {0x9, 0x6, 0x2, '\x00', 0x8}, {0x5, 0xc, 0x5, '\x00', 0xc}, {0x7, 0x7f, 0x7, '\x00', 0xc2}, {0x0, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x6, 0x3, '\x00', 0xd}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x9}]}}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x306c5000) 8m14.521995326s ago: executing program 7 (id=870): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r1, 0x6, 0x24, &(0x7f0000000c00), &(0x7f0000002000)=0x2) 8m13.287856471s ago: executing program 7 (id=871): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0), 0xc) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) ioctl$F2FS_IOC_GET_FEATURES(r0, 0x8004f50c, 0x0) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000280)) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f00000000c0)=0x7) write$nci(0xffffffffffffffff, 0x0, 0x4) syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, 0x0, 0x20000000) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r3, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x7, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) syz_usb_connect(0x5, 0x24, &(0x7f0000000680)={{0x12, 0x1, 0x250, 0x36, 0x39, 0xc9, 0x8, 0x6cd, 0x115, 0x933f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x6, 0x8f, 0x60, 0x5, [{{0x9, 0x4, 0x56, 0x5, 0x0, 0x2, 0x1b, 0x6e, 0x3f}}]}}]}}, &(0x7f00000005c0)={0x0, 0x0, 0x43, &(0x7f0000000300)=ANY=[@ANYBLOB="050f43000414100407619e357a25c7f2f28948c8e3815e797b07100208f7fdff0b10010c4000084209008118100a"]}) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r4, 0x890b, &(0x7f00000007c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x6, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bpq0, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r5, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x0, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @bcast, @null]}) ioctl$sock_rose_SIOCDELRT(r5, 0x890c, &(0x7f00000000c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x6, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bpq0, 0x1, [@null, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default]}) 8m10.718209985s ago: executing program 7 (id=880): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = creat(&(0x7f0000000200)='./file1\x00', 0x12e) close(r1) listen(r0, 0x80000003) syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x200000) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1b000000000000000000000045bb934800000000", @ANYRES32=r1, @ANYBLOB="10bcffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02040000000000"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000180)={r1, 0xffffffffffffffff}, 0x4) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000002c0)={0x0, @dev, @private}, &(0x7f0000000480)=0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x18, 0x24, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x98, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@btf_id={0x18, 0x0, 0x3, 0x0, 0x3}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}, @cb_func={0x18, 0x4, 0x4, 0x0, 0x2}, @exit, @jmp={0x5, 0x1, 0x1, 0x9, 0x8, 0x6}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @generic={0x1, 0x7, 0x4, 0x8000, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, &(0x7f0000000280), 0x40f00, 0x24, '\x00', r4, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000004c0)={0x0, 0x2}, 0x8, 0x10, &(0x7f0000000500)={0x2, 0x3, 0x8, 0x8}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000540)=[r1], &(0x7f0000000580)=[{0x5, 0x5, 0xa, 0xa}, {0x2, 0x2, 0xf, 0x6}], 0x10, 0x1d6000}, 0x94) userfaultfd(0x80801) mount$9p_fd(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="2c77857a20fc549e04a39e09cc4814f44fd1", @ANYRESHEX=r0, @ANYBLOB=',\x00']) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0) read$FUSE(r5, &(0x7f0000002400)={0x2020}, 0xfffffd54) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) splice(r5, 0x0, r6, 0x0, 0x7c1c, 0x8) ioctl$RTC_AIE_OFF(r6, 0x7002) 8m10.406985916s ago: executing program 7 (id=882): r0 = socket$key(0xf, 0x3, 0x2) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) sendmsg$key(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020e0000150000000000000001000000030005000000000002004e24ac1e00010000000000000000030006003c002000020000fc34000000000000000000000001001800000000000800120000000200fcffffff0000000006203300000000000000000000000000fe8000000000000000000000000000aa00000000000000000000000000000000040003"], 0xa8}}, 0x40000) clock_adjtime(0x0, &(0x7f0000000000)={0x3fd, 0x80000000, 0x0, 0x100000000, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x400000017ffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x8}) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040), 0x60001, 0x0) write$binfmt_script(r2, &(0x7f0000000380)={'#! ', './file0', [], 0xa, "60bde9e30fad40dc64293532d4972140df370ae6e4a5c11550fbf9146e6ad186c6d1b2c5a1f99c35098731e796fc066de058555f2010fd8146d46511d9aa6e0543a4daf73e9c30910decb1a4e2e778c4e245a329a91e096c98c8bbfcdf71637c9de1680d94fb004f13f18767b123afc25cd6135c749ced383b23b0f61b5022063cf5d38a4107a022cf65ac8ae0bd415863a30d59eeeda13d479e0588ab8b56d8ab3f070b0b05dded805b466ccb8bbe3042a3a586cada046aa91292732712c1bd1da222df349d4c209dc5109f0e4665903d9510cec6cc12979086ac03ea5e1347771f36a01037a93f5067990160f5de2311722885d3142074a041ac294e62b1f8e9cb7085beee0c8020a00faafce6d6dc196146bd08d9d6ca7357aac52601c2a0cd3b1b8f6cc2d8aeaf1c5b67b8845df4d3badb5f8c8f8a1a2522c770df3b076fe853858068708aa6c2498395d024623ab720273b6d96e69c86b42b2e18574d9fda6408fece9c6d92fcc91eec3949050699237b96f5249b49a205d6d86b67380cef3502318d752ba179b1b98f79df8db1e378a5356aff06e8ad5def9d2a9ce4156db893dd1e3861d9ffa6dd04f047290f539b1e85210833bb5259e7e9008e61a9ffd4a2376e09d5f3d3d095d11fed125bbb83a4fec6700bfd92a0a55d33f589607267f8105082d6c30e3f5c22cd9ab42899f6d6570aee18e0e3583c089b4809d2b67c6ee7bc8b0e04193f3b86094e9b052ace6356e0e1b4ef0641b9f8d0ce1344a0ebe2c8eb0174a5d26b2a9375b9a045c8eeebcf035914924f1628c627ec22f88f4b6a0bc56ea1ca03e87471013939cca1fd3a2816a42477806c28ba67d655c3f8a00436e8ae734bc6bbe7ffc63a982cd6e54aeda490b2be8ef5dd8d570bd0ccd74be81c909259a4d1d3ed6dd572d41865449423428af77175dfc39339e8e4d055be6fe4d29b9014d45f01d185a260c75b10e13cfb27a5faa1bba3bd7553c3c6f0bca8b380215847acdac0980cb050be7f133117d35b41101784c6b02141f34f508f0de6056793db633e2b861a744eec047fc1e6fdf2bf1d6214c708ad24735f68a102e15de8db993c2ac507945a784b755b0339c1c1f5b816abb26398ca0bb8a74dad97f42c0251b516e1c73e355f51dab0baa895fd98052b7e6e15f188011865ff8efc07ac9865f9e91888bc0510336ab8d03e20e5e2410bb012c3d4b33222981183f91723244417901624a13db36f243e5e0d10be78e6a270800d0188da6567f274b7b07d3f61dae95c9612b400a386b2ab75ab1aad7fc79844cca9dde1bd6bebc5fc93cd30b9baf97494b79c239cf17dfadd7ab93716c8ff8d1a29d2413b2b640fb0d868baa2c3bfa7dc067b595cea6c529ed71c6bfa4c83b22c0044bd3ff38245bf8dfefcbbc2d0134090aef3d7c7f6c478e50c4f403853dc5622ff8abca4975cdf1f5fcbbec33f18b84fd633c7fb872723ea90a42ef22313c596f50378201793714297b4c988ab7cd150ab26c73c4c4b7407ff2a94f25a7414bdc796d1b9d2c10a2a6bc1a74487a13bb0a6b19b0e3b5699ea208d7cbe36f1b4d1c5d8c6b0d9a08dc92ee9fc8047361c116fb85df1fb6764dacb122a86d188e6f3b582535b0606490e85644a51cd04f5c7a2cea35453c17810c40f8f7703b0848335ad8feff1be70e34de5b1673b094506e2a983bba613dba1b744b126e3b3db6a0d5f1b3df5b4e38bed04fed1afff5355c2fe18207652b4418b274898a14dfee7d74731a8d289e33131c13cce39f0879ed55c228487a58749846f719a85644d29757e489636da96137520239f3a2561f983c7e6cc86d45706c4596c7966fd8e0b129d2383a43aa84543d75108b3bc2076e6b4838c522e67cc84a7cb4e4e5c9e1344fa77564a3351db9bda8dd31ee08f890cb49b507ab8bffce98824bb0c904f5f2306193c101db382c5b9c9a6833e850f49114d22b313624ebfe600a733abcee61c285fab9e925c91dc1cc8416798c71c52065c0415af9b47a78a8fc9c0e2f57ec8ba33a2e34fc924a82a0978908c6c8993681848bf2fde56c68ef0617affddf9390441943e9f2afec5fc5c413c0755191d7d84599b02c5a203d3a66f52bd00db2f28660a942d023180ec0131f5375fb3e77bcee3544835fddfb188d512069a648092c80d498439557a3e2a6a0e191cea4c116fc69013544f4b8ce9232c554e333bbef34adc37adc0c0661d2c2143040a656f8790d64212c4b03e24d4bbdfbc643326a706d111bc65c83f6a9c628fec4c061bc16d1ac2195d2bdb13e0b074038e13c85932ad59d71ec7a84c64d4c4df2692ea01a06334074326f4acecba49d47b13c23265b52456f903896fab2405fb790de364acf6129a5cbb710e22b57c558fb323bf2fc520d907094fcf176bfc929c2f64c96ff87c39e9b224e83f69455d31615919f1e84df90d40c20f389896104db196f53cfca379f511f0822dc923fb0a9c71d98b60e5114a064e2573734884a3aad37cbacc0d3dc7400f6405e179ba9460776ac0a2c42b82e29119c4de580d7c0e034e6e212525f1992b640d1eea84294a674f657a739e41534a5e99237faa103253de699d907838e709febe79202bdb5296185a19b9744485ed0c5dc5427d91c156aa2fac595b40d53ad9ef00b0b861cb4fb1f748b1d68f7d4e7b4d05116d8656fa95e00604609c783422b36163d0f2c4b66ea5da0b794a1b77fc5fa9dabfbb2f974e84941cf0daa1cfd7be08c3184073843aafdf48ee353649452c03440562434e7439e7851dc28f2d0adba7ba5bb6a249a0d98cacfeffa27bcb6b7def54a743af7ccc054a9cb9f3406a43e3677d2d75104194cf59345612d932eac5913f4d10f976ef3afc2cb9d59518e65669c74d5edd755f0a9531e5f14987f4914e024dfd78bf2aef801bf211d3f393c4bc51468150988d0d4c23ebedf56ca1157304a2a7cec1ea674016a215fab9b056245bda38985e73969fc1f824e93bf3f5d9d31356207a6ca24eb753f50ec21f635fa7fe248964f4b4e6aed57f00a4e8091d9a04733b15410b9c01211b6772a7a35445a84449447117b4c52002956143f7656d36614c4644e8edd02a883f4cb73f653ef3e1d79d1f965082b91a0b6c3a4df50f1f5b35f25571f8a519104a2af5a106d3192a9d812193bfa3e46bdc91dfa086e1eea1a3e9040e94f024f34e6885b4526b6869751531f05b439f4263ec8f48dfe18a11dabd38a769b5efc821fce8661b20f271d0283c0f13033508a4ad83e2e905f7b1274c6edb437fe30ada89f139ee8064a7166aa777e98d5bb4210b8b2ad40a02dc778d9430874234dc702336c4107da014805922cf798b1cf13b6e2df9dbc705adb4532b80d466020888ee1d6cb06d338ac0e01c31ced19ae50ed3a17771dcb60173f88619dad74800e40dc3d38e46e46cc2a090b5a9de556b790095274d6577fc23b2e2028fecad2a0154db642240bfcd7aa760fe5c315517959d12fabdf7004a8c064a79f19157f3f4fa6dea0556da6e0c2c3a06478723688c9830070e8c2a13bf7d8826f35c1b198d8ff2427179a6a50f48c41088df0b9cf0ae115f740d9bffb7faa94ee136e46f1a21f452611f550f4b899c80959fec390d4dff2d6c7e6441e50a10c12cd693621280543e3da0a7405201d91ada43215fd54607e18e95c31423e26ff113a2819b1f64eff3a70280131e0b5cee64de540e0f5ae9c7045e8e998a70931efc3260b20921c597c02825e322145dc0b2ba584b907d806b6ffe6aac4aebd09d4cc0e26dd8a1975ec9b75d06990006d23dc6c43d6d862336d731eeb22dad08d1cc4cf34f252a56b983289e105a964981c388109765f54ab4373596e047e74aaeb5b02664d9b40171a2bb1c89ae81bb3027c6115898dc048a840aca15844e37d60869a38ada333b854cb6d1735831943ceb145fb17bd18657b0a8daf2ec5431b1e0b2684be8a8ed779d67ef729dd790fad09a50efdb546fea62807a8a01a1fb9526aeb0366403ee050086a801c2069ecf6411416ff3f221db1f2c414b29560f6d0aff3770c75afb594df6fe382955d2cb35b3e5e588aeadced432145bd056b2c6a354a6750af7c104e8f6cf5fc1c680a722313a045f8c03ae9cb7da4c3090f0a13f96c432d482b76eebd4a68116f262b92ba775047963cc6c68cc93d4932e308e1472a23560a34a34b477456f0c507d815ce83d2fbe5224328189d6536385171de8c59199858262fa226bc057c0641818804f9534387a2c724d59bc8f82349a950770c7f5655baf93d169778db61404e1b55dd51c8b705b89eac3b3f5263a332428993e60055635a9976f7555994c528de236cafde8faa3ab6e9db27c79e750818b288d45ea483f75403cee87b73ba8431d4a163cce940afd922b9a687e4a2c912c802bceffe5359254c6d15194ed66974c169b271fd9b96f67e8f5b632d3a3b301192200067d000eee29425fe46dd747658f8db3c309242e834c37b46ad187ac7db5944d84b4ca414e44f72c4e09abcae461f59a79db634604aee9c96386e3755cad4394696956746ee8e0b1dfef1c946c6880b290496b4e924310cfdfa06e79b4bc9b465083e9e45aa66cf967c046c9d84011211605edd1f98c170b42910265d863bd6dd5cfd8f629ab5f568f8807d85bccad347c899286c4bf1ca43abee5d02ea9adfa47e22adfb288d40d8b70bcf7ac3830a456500b6cde2e4fbc3ce3fb073e089aa4b1e96c46668b2760fd341878489d802622efd2c37f0b5273d6ef12b0adc0d5f16f0a1956b4649ef39a138618a68b32a79f853ce53a2fb8bda5c59e474ab46284d00c5057d7565a938dc3cd744e5209fd557567638f69b44301e003fdf615c5f1b7b20f25b52b4efaba08a1ecbebf258740a690ea6d908f21835d77b6c91bd2bdf47435b13c03e7121f365119294192cc4216372ba68243b00892b6bfe912de8ba9514e544561a2d2955f4891abefc1fad35432869c35f39d8a5761865f9c73e6a3ce74d9a69f0d2efda54b2d0d4d6737d1a23b41c2bd7ff285c0171b4afe020ed8c6bd46fe092f28f4b84041b96bd86c4d6b14ab6888dc3793a28ea4bd3dd2b526b84a2dd89f86102155fc7b57d33cd21fde5cba9f231aaa9598ca20e81093e681d182a32cf6980887dad1c70e82dd6061cb93041a6759c52ecd37afb1e5ec38fdd42ed454af84520af853817d15b24b7f73b8bff489d3d47ade45599cdc97f44594eaa89f7ef06b7fa92320470d519486c1afa2505094cc45e79acd6cea8d246d7538e5b03fe1240feaf5c4cd6543f197aee39c9932b91ae6c3ea53334b41984943252655e9e2281edfda1b4f76c6a195ce80d1a17d160ca41d0cc547403d45af9d9581cb946142a7352146e85536ecc1071478888f6971b5e11ba7da51e2d0a02816aa2aa26f5fe2a2548384cbb0925844154f890fd90fc96332f4fe54b228f037506e52d58143f8d96c66e5ce5fe8bb148a44baf0aac9a223bad5de144112a2f8d48565fe7aaa339c7025ec96440f7013584663489bd2c76dabff70bc7d25428baa468dee74e535eac5e4e8e189428809410d02a46cc1360500918918b96435ebb91e4a1cead10993568df61d02b9e318576ab3f2f1c65b925ad0e11dfec19ea0186306ef432ee0cc0040599f912daaaa5a731469fc87e9ae3140782fea14fee705bbf3f4c546ddb43738a63c48960eb1a6b58f092de30822ddd03115687d54a4f335fdef78d1154509cb846cc77deb408802125bb6e59f1eebeb"}, 0xffd) syz_usb_connect(0x2, 0x2d, 0x0, 0x0) r3 = creat(&(0x7f00000001c0)='./file0\x00', 0x20) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r5, 0x4030ae7b, &(0x7f0000000440)={0x4, 0x12, 0x10001, 0x4, 0xbf7a}) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r3, 0xc0984124, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r6, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x2, &(0x7f0000000040)=[{0x24, 0x7, 0x9, 0x4}, {0x6, 0x7, 0x5, 0x9}]}) syz_usb_connect(0x3, 0x2d, 0x0, 0x0) r7 = socket(0xa, 0x3, 0xff) setsockopt$sock_int(r7, 0x1, 0x28, &(0x7f0000000000)=0x36, 0x4) syz_emit_ethernet(0x3e, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3986dd6c4000000000000000010000000000000000000000000000fe8000000000000000000000000000aaff"], 0x0) epoll_create1(0x0) recvmmsg$unix(r7, &(0x7f0000002500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40010040, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x20, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x19, 0x0, 0x0, @binary}, @typed={0x8, 0xc, 0x0, 0x0, @uid}]}, 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000005240)=[{{0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000780)=""/180, 0xb4}], 0x1, &(0x7f0000000ac0)=""/23, 0x17}, 0xe}], 0x1, 0x40002080, 0x0) 8m6.402109659s ago: executing program 7 (id=892): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x401, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f00000005c0)={0x1, @pix={0x1, 0xffff8000, 0x33524742, 0x7, 0x3, 0x5, 0x1, 0xfeedcafe, 0x0, 0x6, 0x1, 0x3}}) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340), 0x50) setsockopt$inet_sctp_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, &(0x7f0000000000)={0x209, 0x6, 0x807, 0x2097}, 0x8) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000140)={r3, 0x4, 0x30, 0xfffffffffffffff8, 0x5}, &(0x7f0000000180)=0x18) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x1f, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b705000000000000850000009400000095"], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 8m6.074245743s ago: executing program 7 (id=894): socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$OSF_MSG_REMOVE(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000040c0)={0xe0c, 0x1, 0x5, 0x201, 0x0, 0x0, {0x0, 0x0, 0x5}, [{{0x254, 0x1, {{0x3, 0xa}, 0x5, 0xb, 0x3, 0x1000, 0xe, 'syz1\x00', "bc4571670f1622eb4d6a6c2cc1cb71ed68b8a7bac6f63a1ae4dedc827c0b7b95", "0b114c1ca21b2c66bb06ca53381d6d33eb708cce25746bbf821fdb6815e291a5", [{0x8, 0x4, {0x3, 0xfffffff8}}, {0x5, 0xffff, {0x1, 0x401}}, {0x5a5a, 0x2, {0x1, 0x7}}, {0x40, 0xfffa, {0x3, 0x2}}, {0x7, 0x7, {0x3, 0x7}}, {0x0, 0x4, {0x0, 0x10000}}, {0x491, 0x9, {0x1, 0x10000}}, {0xab, 0x4, {0x0, 0xffff}}, {0x9, 0x657, {0x3, 0x3ff}}, {0xc7, 0x5, {0x3, 0xf}}, {0x10, 0x40, {0x2, 0x800}}, {0x6, 0x2, {0x2, 0x1}}, {0x3, 0x1, {0x3, 0x7fff}}, {0x69de, 0x0, {0x0, 0x7}}, {0x0, 0x5a, {0x2, 0x9}}, {0x7fff, 0xff, {0x1}}, {0x5, 0x2, {0x1, 0x7f}}, {0x1, 0xf19, {0x0, 0xdfc3}}, {0x6, 0x40, {0x2, 0x6}}, {0xcd3, 0xf000, {0x0, 0x1}}, {0x8, 0x1, {0x1}}, {0x0, 0x2, {0x3, 0x2}}, {0x7, 0x2, {0x0, 0xf5}}, {0x8, 0x4, {0x2, 0x100}}, {0x2, 0x1, {0x2, 0x1}}, {0x7, 0xc914, {0x0, 0x8000}}, {0x6, 0x0, {0x2, 0x7}}, {0xe, 0x800, {0x1, 0x54}}, {0x400, 0x10, {0x3, 0x6}}, {0x4, 0x3, {0x1, 0xb}}, {0x0, 0x1, {0x1, 0xc}}, {0x4, 0x1, {0x2, 0x6}}, {0x7, 0x8, {0x1, 0x9}}, {0xf7d0, 0x9, {0x1, 0x219a}}, {0xb, 0x4, {0x0, 0x3}}, {0x8, 0x3, {0x3, 0x2}}, {0x62, 0x5, {0x3, 0xfffffff8}}, {0x615, 0x0, {0x1, 0xfffffff7}}, {0x8, 0x8, {0x0, 0x3}}, {0x5, 0x8, {0x2, 0x1}}]}}}, {{0x254, 0x1, {{0x3, 0x10000}, 0x8, 0x75, 0x100, 0x5, 0x26, 'syz0\x00', "2cd8decf0eec039a3dc712b484c35c7c7f1db927fd66025a656dca5af0df3b4c", "9c477526a537ecdbfa73d92e7be48b8e7f82abc93fd4e271f59601d70f687b3b", [{0x4, 0x8, {0x1, 0x3}}, {0x1, 0x4, {0x3, 0x7}}, {0x52f1, 0xdb3, {0x1, 0x8}}, {0x2, 0x101, {0x1, 0x8000}}, {0xd62, 0xff, {0x0, 0x9}}, {0x0, 0xd, {0x2, 0x4}}, {0x9, 0x2, {0x0, 0xa8}}, {0x2, 0x2, {0x0, 0xfffffff9}}, {0xfffb, 0x5, {0x1}}, {0x0, 0x8, {0x1, 0xfffffff9}}, {0x1, 0x6, {0x2, 0x2}}, {0x1, 0xfffc, {0x0, 0x3}}, {0xe, 0xb, {0x2, 0x80000000}}, {0x2, 0x6, {0x1, 0xc}}, {0x7, 0xfffd, {0x3, 0x200}}, {0x0, 0xffff, {0x0, 0x1000}}, {0x5, 0x7fff, {0x3, 0x400}}, {0x4, 0x8, {0x2, 0x3}}, {0x9, 0xb, {0x0, 0x9}}, {0x6, 0x6, {0x3, 0x81}}, {0xf206, 0x7, {0x2, 0x4c4b}}, {0x6, 0x0, {0x2, 0xb}}, {0x7, 0xff81, {0x1, 0x3}}, {0x9, 0x101, {0x3, 0x90}}, {0x1, 0x6, {0x0, 0x8}}, {0x8, 0x0, {0x0, 0xc}}, {0x67ca, 0x3df, {0x1, 0x6}}, {0x2, 0x9, {0x1, 0x7ff}}, {0xac0, 0x99c6, {0x1, 0x2}}, {0x6, 0x8, {0x1, 0x8}}, {0x114, 0x1}, {0x6, 0x6, {0x1, 0x5}}, {0x5, 0x3db, {0x0, 0x7}}, {0x1, 0x40, {0x0, 0x3ff}}, {0x9, 0x6, {0x2, 0x5a1}}, {0x8, 0x22, {0x1, 0x5}}, {0xdfbc, 0x7, {0x1, 0x1}}, {0xa3f3, 0x4, {0x1, 0xe0}}, {0xc, 0xf, {0x1, 0x6}}, {0x1ff, 0x1, {0x1}}]}}}, {{0x254, 0x1, {{0x0, 0xffffffff}, 0x7, 0xf, 0x2, 0x4, 0x1e, 'syz0\x00', "a6296e2087a2ad367073acdea626cc217e985b4126f637fbf2e8e416d4884f2b", "023a9cc3eb02b41d6fa9ffcec8921c05bc4037dd1d6bc64bb88d760eec8b1c98", [{0xe, 0x3fe, {0x0, 0x7fffffff}}, {0x5, 0x1, {0x0, 0x4}}, {0x6, 0x4, {0x3, 0xfff}}, {0x8000, 0x0, {0x1, 0x9c16}}, {0x56, 0x40, {0x0, 0x1}}, {0x9, 0x2, {0x3, 0x80000000}}, {0x8c46, 0xfa3d, {0x2, 0x9}}, {0x7, 0x9, {0x3, 0x7fffffff}}, {0x2, 0x2, {0x3, 0x10}}, {0x6, 0x2, {0x3, 0x6}}, {0x2, 0x7, {0x1, 0x6}}, {0x3, 0x5, {0x0, 0x4}}, {0x0, 0x3, {0x2, 0x2}}, {0x8, 0x2, {0x0, 0x5}}, {0x8, 0x1, {0x0, 0x4}}, {0x110, 0x2c5, {0x3}}, {0xf, 0x1, {0x1, 0x5}}, {0x0, 0x2, {0x0, 0x8}}, {0x5, 0x100, {0x0, 0x9}}, {0x5, 0x1ea, {0x0, 0x2}}, {0x65b, 0x1, {0x0, 0x8}}, {0x2, 0x5, {0x2, 0x80000000}}, {0x7, 0xf9d6, {0x3, 0x6}}, {0x100, 0x1, {0x3, 0x80000000}}, {0x75, 0x9, {0x2, 0x2}}, {0x4, 0x0, {0x1, 0xa864}}, {0xedf, 0xfe01, {0x2, 0x6}}, {0x9, 0xbbf2, {0x1, 0xb98}}, {0x3, 0x7, {0x3, 0x7}}, {0x1000, 0xf, {0x3, 0x7}}, {0x3, 0x400, {0x2, 0x3}}, {0xd, 0x0, {0x3, 0x3}}, {0x2d66, 0x1, {0x3, 0x3}}, {0xc0a2, 0x6}, {0x53e5, 0x7d6, {0x3, 0xbee}}, {0x4, 0xb, {0x3, 0x7}}, {0xfffc, 0x800, {0x0, 0x2}}, {0xff, 0xa, {0x2, 0x14}}, {0x0, 0x2, {0x0, 0x9}}, {0xd43, 0xfffd, {0x2, 0x80000000}}]}}}, {{0x254, 0x1, {{0x1, 0x3}, 0xf, 0x2, 0x954, 0x6, 0x2, 'syz0\x00', "0dbe1a16be6a97061ddc327c4404dde45518a9e60da69c939ad9fc6a65e43de2", "1aab102c1ca3314f501a1769d6777c6b729befbc4f88f6290b08dcf712752090", [{0x3, 0x7, {0x1, 0x1}}, {0xff5c, 0x2, {0x0, 0x7}}, {0xc, 0x1, {0x3, 0xa}}, {0xf3, 0xa6, {0x1, 0x8}}, {0x331f, 0xf26b, {0x2, 0x4}}, {0x1, 0x7f, {0x1, 0x2}}, {0xfffc, 0x6, {0x2, 0xff}}, {0x9, 0x38d, {0x0, 0x5}}, {0xffff, 0x3, {0x3, 0x8}}, {0x10, 0x2, {0x1, 0x2}}, {0x1, 0x7f, {0x3, 0x7f}}, {0x9, 0x7d0, {0x3, 0x200}}, {0x2, 0xa03b, {0x0, 0x10}}, {0x3ff, 0xfff9, {0x1, 0x10000}}, {0x2, 0xbed, {0x0, 0x4}}, {0x3, 0xff00, {0x0, 0x2}}, {0x1, 0x25, {0x0, 0x9}}, {0x7, 0xe, {0x3, 0x6}}, {0x0, 0xdeaf, {0x3, 0x2}}, {0x8, 0x6, {0x3, 0x3}}, {0x3, 0xfffe, {0x1, 0x4}}, {0x101, 0x1ff, {0x1, 0x4}}, {0x8001, 0x9, {0x3, 0x10001}}, {0x0, 0x6e, {0x0, 0xfffffff9}}, {0x2, 0x6, {0x1}}, {0x0, 0x1c, {0x3, 0x2}}, {0x80, 0x6, {0x1, 0x7}}, {0x9, 0x6, {0x3, 0x5}}, {0x54f5, 0x7, {0x0, 0x40}}, {0x4, 0x6acd, {0x1, 0x8}}, {0x5, 0x1, {0x1, 0x7fffffff}}, {0xfffe, 0x7, {0x3, 0x2}}, {0x5, 0x5, {0x0, 0x9}}, {0x7, 0x2, {0x0, 0x3}}, {0x9, 0x5, {0x1, 0xfffffffc}}, {0x2, 0x8001, {0x0, 0x3}}, {0xffff, 0x1, {0x0, 0x7f}}, {0x596, 0x4, {0x0, 0xd3ab}}, {0xc9b, 0x7, {0x2, 0x1}}, {0x9, 0x80}]}}}, {{0x254, 0x1, {{0x0, 0x5}, 0xfd, 0x7, 0x7, 0x0, 0x8, 'syz0\x00', "7893a5d681d265ebf337f53f5bf0985395488cefa58fbc488fe78410ad3dfcd5", "4864f5c47b960fe0f7dbd0d3fd9f908094fc36c746330914a33763fd5277c998", [{0x5, 0x6620, {0x3, 0x6}}, {0x1, 0x8}, {0x1, 0x8, {0x0, 0x800}}, {0x5, 0xbd8a, {0x3, 0x8}}, {0x5, 0xc63, {0x2, 0x24000}}, {0x8, 0x4, {0x3, 0x6}}, {0x2, 0x5, {0x2, 0x1}}, {0xd, 0x7, {0x1, 0x3}}, {0x7fff, 0xaa, {0x2, 0x8779}}, {0x6, 0x35ef, {0x3, 0x800}}, {0x1, 0x9, {0x2, 0x4}}, {0x0, 0x4, {0x3, 0x4}}, {0x101, 0x101, {0x0, 0x8}}, {0xffff, 0x1, {0x1, 0x1}}, {0x4, 0x8, {0x0, 0x40}}, {0x2, 0x7fff, {0x0, 0xffffffff}}, {0x1e5, 0x7d, {0x0, 0x800}}, {0x40, 0x9, {0x2, 0x8}}, {0x81, 0x800, {0x2, 0xa6d8}}, {0xc443, 0x2, {0x3, 0xe}}, {0x8001, 0x8, {0x3, 0xa8}}, {0x0, 0x8, {0x3}}, {0x0, 0x6, {0x1, 0x1}}, {0x81, 0xe, {0x2, 0x1}}, {0x2, 0x81, {0x2, 0x8001}}, {0xb, 0x7, {0x3, 0x7fffffff}}, {0xac, 0x8, {0x1, 0x1}}, {0x1, 0xa0, {0x2, 0x686f}}, {0x7e, 0xe257, {0x3, 0x6}}, {0x2, 0x3eb}, {0x9, 0xd30a, {0x7, 0x6d}}, {0xde0a, 0x401, {0x1, 0x336a5a0c}}, {0xb, 0xfffd, {0x3, 0x5}}, {0x4, 0xe, {0x1, 0x3}}, {0x8, 0x101, {0x2, 0x8}}, {0x0, 0x3ff, {0x1, 0x7fffffff}}, {0x6, 0x9, {0x0, 0x10001}}, {0x401, 0xe, {0x2, 0x4}}, {0xfab9, 0x5, {0x2, 0xa1}}, {0x8, 0x8, {0x3, 0x5}}]}}}, {{0x254, 0x1, {{0x1, 0x4}, 0x2, 0x7a, 0x7, 0x6, 0x11, 'syz1\x00', "4e88e90cb8b5972e80e323315dcd4b02f17a3d12fdcc766323f7a3305071d2d9", "923b3e25c9a48c6a98139f03ec68e6fc0a04675a0dd336eb4599f0a1fec68bd2", [{0x1, 0x5, {0x0, 0x1}}, {0x67, 0x10, {0x1, 0x6}}, {0x8, 0x3, {0x2, 0x5}}, {0x2, 0x0, {0x1, 0x3}}, {0x100, 0x7f, {0x1, 0x20}}, {0x5866, 0x0, {0x0, 0x8000}}, {0x6faf, 0x9, {0x2, 0x800}}, {0x7, 0x9, {0x0, 0xf4}}, {0x1000, 0x1000, {0x2, 0x6}}, {0x6, 0x6, {0x2, 0x3}}, {0x43e, 0xf890, {0x2, 0x5a}}, {0xd61, 0x2, {0x3, 0xff}}, {0x0, 0x1c0, {0x1, 0x14}}, {0x2, 0x0, {0x2, 0x1}}, {0x3, 0x0, {0x3, 0x8}}, {0xf6b, 0x8001, {0x2, 0x1e08}}, {0xf, 0x2, {0x2, 0xfffffff7}}, {0x7, 0x8001, {0x1, 0xffff7fff}}, {0x8, 0xfff7, {0x1, 0xd8de}}, {0x8, 0xe, {0x2, 0x3}}, {0x2, 0x8000, {0x1, 0x4}}, {0x7f, 0x8001, {0x2, 0xd}}, {0x160, 0xfffe, {0x3, 0x9}}, {0x7f, 0x3, {0x1, 0x9ff}}, {0x2, 0x7, {0x2, 0x88}}, {0x4, 0x1, {0x1, 0xff}}, {0x0, 0x8001, {0x2, 0x5}}, {0x0, 0x2, {0x1, 0x7}}, {0x9, 0x3ff, {0x2, 0xfff}}, {0x2, 0x2, {0x3, 0x7ff}}, {0x2, 0xe, {0x2, 0x9}}, {0x8, 0x8, {0x3, 0x8}}, {0x1, 0x6, {0x3, 0x4}}, {0x800, 0xf50, {0x1, 0x453d}}, {0x4, 0x1, {0x2, 0x7}}, {0xfff8, 0x8, {0x2, 0x2b00}}, {0x2, 0x5701, {0x3, 0x4}}, {0x1ff, 0x4, {0x1, 0x3}}, {0x0, 0x3, {0x2, 0x7093}}, {0x1, 0x923, {0x2, 0x1ff}}]}}}]}, 0xe0c}, 0x1, 0x0, 0x0, 0x4048040}, 0x20000004) r0 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) socket$isdn_base(0x22, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="aa00016acaee"], 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x79, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 7m49.985554499s ago: executing program 35 (id=894): socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$OSF_MSG_REMOVE(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000040c0)={0xe0c, 0x1, 0x5, 0x201, 0x0, 0x0, {0x0, 0x0, 0x5}, [{{0x254, 0x1, {{0x3, 0xa}, 0x5, 0xb, 0x3, 0x1000, 0xe, 'syz1\x00', "bc4571670f1622eb4d6a6c2cc1cb71ed68b8a7bac6f63a1ae4dedc827c0b7b95", "0b114c1ca21b2c66bb06ca53381d6d33eb708cce25746bbf821fdb6815e291a5", [{0x8, 0x4, {0x3, 0xfffffff8}}, {0x5, 0xffff, {0x1, 0x401}}, {0x5a5a, 0x2, {0x1, 0x7}}, {0x40, 0xfffa, {0x3, 0x2}}, {0x7, 0x7, {0x3, 0x7}}, {0x0, 0x4, {0x0, 0x10000}}, {0x491, 0x9, {0x1, 0x10000}}, {0xab, 0x4, {0x0, 0xffff}}, {0x9, 0x657, {0x3, 0x3ff}}, {0xc7, 0x5, {0x3, 0xf}}, {0x10, 0x40, {0x2, 0x800}}, {0x6, 0x2, {0x2, 0x1}}, {0x3, 0x1, {0x3, 0x7fff}}, {0x69de, 0x0, {0x0, 0x7}}, {0x0, 0x5a, {0x2, 0x9}}, {0x7fff, 0xff, {0x1}}, {0x5, 0x2, {0x1, 0x7f}}, {0x1, 0xf19, {0x0, 0xdfc3}}, {0x6, 0x40, {0x2, 0x6}}, {0xcd3, 0xf000, {0x0, 0x1}}, {0x8, 0x1, {0x1}}, {0x0, 0x2, {0x3, 0x2}}, {0x7, 0x2, {0x0, 0xf5}}, {0x8, 0x4, {0x2, 0x100}}, {0x2, 0x1, {0x2, 0x1}}, {0x7, 0xc914, {0x0, 0x8000}}, {0x6, 0x0, {0x2, 0x7}}, {0xe, 0x800, {0x1, 0x54}}, {0x400, 0x10, {0x3, 0x6}}, {0x4, 0x3, {0x1, 0xb}}, {0x0, 0x1, {0x1, 0xc}}, {0x4, 0x1, {0x2, 0x6}}, {0x7, 0x8, {0x1, 0x9}}, {0xf7d0, 0x9, {0x1, 0x219a}}, {0xb, 0x4, {0x0, 0x3}}, {0x8, 0x3, {0x3, 0x2}}, {0x62, 0x5, {0x3, 0xfffffff8}}, {0x615, 0x0, {0x1, 0xfffffff7}}, {0x8, 0x8, {0x0, 0x3}}, {0x5, 0x8, {0x2, 0x1}}]}}}, {{0x254, 0x1, {{0x3, 0x10000}, 0x8, 0x75, 0x100, 0x5, 0x26, 'syz0\x00', "2cd8decf0eec039a3dc712b484c35c7c7f1db927fd66025a656dca5af0df3b4c", "9c477526a537ecdbfa73d92e7be48b8e7f82abc93fd4e271f59601d70f687b3b", [{0x4, 0x8, {0x1, 0x3}}, {0x1, 0x4, {0x3, 0x7}}, {0x52f1, 0xdb3, {0x1, 0x8}}, {0x2, 0x101, {0x1, 0x8000}}, {0xd62, 0xff, {0x0, 0x9}}, {0x0, 0xd, {0x2, 0x4}}, {0x9, 0x2, {0x0, 0xa8}}, {0x2, 0x2, {0x0, 0xfffffff9}}, {0xfffb, 0x5, {0x1}}, {0x0, 0x8, {0x1, 0xfffffff9}}, {0x1, 0x6, {0x2, 0x2}}, {0x1, 0xfffc, {0x0, 0x3}}, {0xe, 0xb, {0x2, 0x80000000}}, {0x2, 0x6, {0x1, 0xc}}, {0x7, 0xfffd, {0x3, 0x200}}, {0x0, 0xffff, {0x0, 0x1000}}, {0x5, 0x7fff, {0x3, 0x400}}, {0x4, 0x8, {0x2, 0x3}}, {0x9, 0xb, {0x0, 0x9}}, {0x6, 0x6, {0x3, 0x81}}, {0xf206, 0x7, {0x2, 0x4c4b}}, {0x6, 0x0, {0x2, 0xb}}, {0x7, 0xff81, {0x1, 0x3}}, {0x9, 0x101, {0x3, 0x90}}, {0x1, 0x6, {0x0, 0x8}}, {0x8, 0x0, {0x0, 0xc}}, {0x67ca, 0x3df, {0x1, 0x6}}, {0x2, 0x9, {0x1, 0x7ff}}, {0xac0, 0x99c6, {0x1, 0x2}}, {0x6, 0x8, {0x1, 0x8}}, {0x114, 0x1}, {0x6, 0x6, {0x1, 0x5}}, {0x5, 0x3db, {0x0, 0x7}}, {0x1, 0x40, {0x0, 0x3ff}}, {0x9, 0x6, {0x2, 0x5a1}}, {0x8, 0x22, {0x1, 0x5}}, {0xdfbc, 0x7, {0x1, 0x1}}, {0xa3f3, 0x4, {0x1, 0xe0}}, {0xc, 0xf, {0x1, 0x6}}, {0x1ff, 0x1, {0x1}}]}}}, {{0x254, 0x1, {{0x0, 0xffffffff}, 0x7, 0xf, 0x2, 0x4, 0x1e, 'syz0\x00', "a6296e2087a2ad367073acdea626cc217e985b4126f637fbf2e8e416d4884f2b", "023a9cc3eb02b41d6fa9ffcec8921c05bc4037dd1d6bc64bb88d760eec8b1c98", [{0xe, 0x3fe, {0x0, 0x7fffffff}}, {0x5, 0x1, {0x0, 0x4}}, {0x6, 0x4, {0x3, 0xfff}}, {0x8000, 0x0, {0x1, 0x9c16}}, {0x56, 0x40, {0x0, 0x1}}, {0x9, 0x2, {0x3, 0x80000000}}, {0x8c46, 0xfa3d, {0x2, 0x9}}, {0x7, 0x9, {0x3, 0x7fffffff}}, {0x2, 0x2, {0x3, 0x10}}, {0x6, 0x2, {0x3, 0x6}}, {0x2, 0x7, {0x1, 0x6}}, {0x3, 0x5, {0x0, 0x4}}, {0x0, 0x3, {0x2, 0x2}}, {0x8, 0x2, {0x0, 0x5}}, {0x8, 0x1, {0x0, 0x4}}, {0x110, 0x2c5, {0x3}}, {0xf, 0x1, {0x1, 0x5}}, {0x0, 0x2, {0x0, 0x8}}, {0x5, 0x100, {0x0, 0x9}}, {0x5, 0x1ea, {0x0, 0x2}}, {0x65b, 0x1, {0x0, 0x8}}, {0x2, 0x5, {0x2, 0x80000000}}, {0x7, 0xf9d6, {0x3, 0x6}}, {0x100, 0x1, {0x3, 0x80000000}}, {0x75, 0x9, {0x2, 0x2}}, {0x4, 0x0, {0x1, 0xa864}}, {0xedf, 0xfe01, {0x2, 0x6}}, {0x9, 0xbbf2, {0x1, 0xb98}}, {0x3, 0x7, {0x3, 0x7}}, {0x1000, 0xf, {0x3, 0x7}}, {0x3, 0x400, {0x2, 0x3}}, {0xd, 0x0, {0x3, 0x3}}, {0x2d66, 0x1, {0x3, 0x3}}, {0xc0a2, 0x6}, {0x53e5, 0x7d6, {0x3, 0xbee}}, {0x4, 0xb, {0x3, 0x7}}, {0xfffc, 0x800, {0x0, 0x2}}, {0xff, 0xa, {0x2, 0x14}}, {0x0, 0x2, {0x0, 0x9}}, {0xd43, 0xfffd, {0x2, 0x80000000}}]}}}, {{0x254, 0x1, {{0x1, 0x3}, 0xf, 0x2, 0x954, 0x6, 0x2, 'syz0\x00', "0dbe1a16be6a97061ddc327c4404dde45518a9e60da69c939ad9fc6a65e43de2", "1aab102c1ca3314f501a1769d6777c6b729befbc4f88f6290b08dcf712752090", [{0x3, 0x7, {0x1, 0x1}}, {0xff5c, 0x2, {0x0, 0x7}}, {0xc, 0x1, {0x3, 0xa}}, {0xf3, 0xa6, {0x1, 0x8}}, {0x331f, 0xf26b, {0x2, 0x4}}, {0x1, 0x7f, {0x1, 0x2}}, {0xfffc, 0x6, {0x2, 0xff}}, {0x9, 0x38d, {0x0, 0x5}}, {0xffff, 0x3, {0x3, 0x8}}, {0x10, 0x2, {0x1, 0x2}}, {0x1, 0x7f, {0x3, 0x7f}}, {0x9, 0x7d0, {0x3, 0x200}}, {0x2, 0xa03b, {0x0, 0x10}}, {0x3ff, 0xfff9, {0x1, 0x10000}}, {0x2, 0xbed, {0x0, 0x4}}, {0x3, 0xff00, {0x0, 0x2}}, {0x1, 0x25, {0x0, 0x9}}, {0x7, 0xe, {0x3, 0x6}}, {0x0, 0xdeaf, {0x3, 0x2}}, {0x8, 0x6, {0x3, 0x3}}, {0x3, 0xfffe, {0x1, 0x4}}, {0x101, 0x1ff, {0x1, 0x4}}, {0x8001, 0x9, {0x3, 0x10001}}, {0x0, 0x6e, {0x0, 0xfffffff9}}, {0x2, 0x6, {0x1}}, {0x0, 0x1c, {0x3, 0x2}}, {0x80, 0x6, {0x1, 0x7}}, {0x9, 0x6, {0x3, 0x5}}, {0x54f5, 0x7, {0x0, 0x40}}, {0x4, 0x6acd, {0x1, 0x8}}, {0x5, 0x1, {0x1, 0x7fffffff}}, {0xfffe, 0x7, {0x3, 0x2}}, {0x5, 0x5, {0x0, 0x9}}, {0x7, 0x2, {0x0, 0x3}}, {0x9, 0x5, {0x1, 0xfffffffc}}, {0x2, 0x8001, {0x0, 0x3}}, {0xffff, 0x1, {0x0, 0x7f}}, {0x596, 0x4, {0x0, 0xd3ab}}, {0xc9b, 0x7, {0x2, 0x1}}, {0x9, 0x80}]}}}, {{0x254, 0x1, {{0x0, 0x5}, 0xfd, 0x7, 0x7, 0x0, 0x8, 'syz0\x00', "7893a5d681d265ebf337f53f5bf0985395488cefa58fbc488fe78410ad3dfcd5", "4864f5c47b960fe0f7dbd0d3fd9f908094fc36c746330914a33763fd5277c998", [{0x5, 0x6620, {0x3, 0x6}}, {0x1, 0x8}, {0x1, 0x8, {0x0, 0x800}}, {0x5, 0xbd8a, {0x3, 0x8}}, {0x5, 0xc63, {0x2, 0x24000}}, {0x8, 0x4, {0x3, 0x6}}, {0x2, 0x5, {0x2, 0x1}}, {0xd, 0x7, {0x1, 0x3}}, {0x7fff, 0xaa, {0x2, 0x8779}}, {0x6, 0x35ef, {0x3, 0x800}}, {0x1, 0x9, {0x2, 0x4}}, {0x0, 0x4, {0x3, 0x4}}, {0x101, 0x101, {0x0, 0x8}}, {0xffff, 0x1, {0x1, 0x1}}, {0x4, 0x8, {0x0, 0x40}}, {0x2, 0x7fff, {0x0, 0xffffffff}}, {0x1e5, 0x7d, {0x0, 0x800}}, {0x40, 0x9, {0x2, 0x8}}, {0x81, 0x800, {0x2, 0xa6d8}}, {0xc443, 0x2, {0x3, 0xe}}, {0x8001, 0x8, {0x3, 0xa8}}, {0x0, 0x8, {0x3}}, {0x0, 0x6, {0x1, 0x1}}, {0x81, 0xe, {0x2, 0x1}}, {0x2, 0x81, {0x2, 0x8001}}, {0xb, 0x7, {0x3, 0x7fffffff}}, {0xac, 0x8, {0x1, 0x1}}, {0x1, 0xa0, {0x2, 0x686f}}, {0x7e, 0xe257, {0x3, 0x6}}, {0x2, 0x3eb}, {0x9, 0xd30a, {0x7, 0x6d}}, {0xde0a, 0x401, {0x1, 0x336a5a0c}}, {0xb, 0xfffd, {0x3, 0x5}}, {0x4, 0xe, {0x1, 0x3}}, {0x8, 0x101, {0x2, 0x8}}, {0x0, 0x3ff, {0x1, 0x7fffffff}}, {0x6, 0x9, {0x0, 0x10001}}, {0x401, 0xe, {0x2, 0x4}}, {0xfab9, 0x5, {0x2, 0xa1}}, {0x8, 0x8, {0x3, 0x5}}]}}}, {{0x254, 0x1, {{0x1, 0x4}, 0x2, 0x7a, 0x7, 0x6, 0x11, 'syz1\x00', "4e88e90cb8b5972e80e323315dcd4b02f17a3d12fdcc766323f7a3305071d2d9", "923b3e25c9a48c6a98139f03ec68e6fc0a04675a0dd336eb4599f0a1fec68bd2", [{0x1, 0x5, {0x0, 0x1}}, {0x67, 0x10, {0x1, 0x6}}, {0x8, 0x3, {0x2, 0x5}}, {0x2, 0x0, {0x1, 0x3}}, {0x100, 0x7f, {0x1, 0x20}}, {0x5866, 0x0, {0x0, 0x8000}}, {0x6faf, 0x9, {0x2, 0x800}}, {0x7, 0x9, {0x0, 0xf4}}, {0x1000, 0x1000, {0x2, 0x6}}, {0x6, 0x6, {0x2, 0x3}}, {0x43e, 0xf890, {0x2, 0x5a}}, {0xd61, 0x2, {0x3, 0xff}}, {0x0, 0x1c0, {0x1, 0x14}}, {0x2, 0x0, {0x2, 0x1}}, {0x3, 0x0, {0x3, 0x8}}, {0xf6b, 0x8001, {0x2, 0x1e08}}, {0xf, 0x2, {0x2, 0xfffffff7}}, {0x7, 0x8001, {0x1, 0xffff7fff}}, {0x8, 0xfff7, {0x1, 0xd8de}}, {0x8, 0xe, {0x2, 0x3}}, {0x2, 0x8000, {0x1, 0x4}}, {0x7f, 0x8001, {0x2, 0xd}}, {0x160, 0xfffe, {0x3, 0x9}}, {0x7f, 0x3, {0x1, 0x9ff}}, {0x2, 0x7, {0x2, 0x88}}, {0x4, 0x1, {0x1, 0xff}}, {0x0, 0x8001, {0x2, 0x5}}, {0x0, 0x2, {0x1, 0x7}}, {0x9, 0x3ff, {0x2, 0xfff}}, {0x2, 0x2, {0x3, 0x7ff}}, {0x2, 0xe, {0x2, 0x9}}, {0x8, 0x8, {0x3, 0x8}}, {0x1, 0x6, {0x3, 0x4}}, {0x800, 0xf50, {0x1, 0x453d}}, {0x4, 0x1, {0x2, 0x7}}, {0xfff8, 0x8, {0x2, 0x2b00}}, {0x2, 0x5701, {0x3, 0x4}}, {0x1ff, 0x4, {0x1, 0x3}}, {0x0, 0x3, {0x2, 0x7093}}, {0x1, 0x923, {0x2, 0x1ff}}]}}}]}, 0xe0c}, 0x1, 0x0, 0x0, 0x4048040}, 0x20000004) r0 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) socket$isdn_base(0x22, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="aa00016acaee"], 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x79, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 9.656324847s ago: executing program 1 (id=2445): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x6, r0, 0x4}, 0x38) 9.556605787s ago: executing program 1 (id=2446): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x8242, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xc0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0xb}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0xfa}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0xc, {[@local=@item_4={0x3, 0x2, 0xa, "e81e5197"}, @local=@item_4={0x3, 0x2, 0x4, "c175025c"}, @global=@item_012={0x1, 0x1, 0x4, "b9"}]}}, 0x0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x40004) 8.212922183s ago: executing program 0 (id=2448): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/diskstats\x00', 0x0, 0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendfile(r1, r0, 0x0, 0x7ffff000) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, 0x0, 0x24000004) 7.82041353s ago: executing program 8 (id=2449): r0 = syz_io_uring_setup(0x132a, &(0x7f0000000000)={0x0, 0x5042, 0x40, 0x1, 0x3df}, &(0x7f0000000080), &(0x7f00000000c0)) io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0xa, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0xa, 0x0, 0x0) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0xa, 0x0, r1) 7.754924661s ago: executing program 0 (id=2450): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01032abd0000140001800d"], 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x840) 7.685016484s ago: executing program 8 (id=2451): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000280)=[{0x40, 0xfd}, {0x6, 0xba, 0xa, 0xfffb}]}, 0x10) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x4040181, 0x0, 0x59) 7.572269939s ago: executing program 6 (id=2452): capset(&(0x7f0000000080)={0x20080522}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00800010003b15fd070000fbdbdf", @ANYBLOB="0000000000b401001c00128009000100626f6e64"], 0x3c}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x4000081, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x3, 0x7, 0x80000, 0x5, 0x0, 0x0, 0x8001], 0xffff1000, 0x2200}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x4, 0x5, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x1c, 0x0, 0xffffffffffffffff, 0x6], 0x0, 0x41901}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7.519293661s ago: executing program 0 (id=2453): syz_emit_ethernet(0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0) syz_emit_ethernet(0x72, &(0x7f0000000640)=ANY=[@ANYRES8], 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}, 0x1}, 0x20) read$FUSE(0xffffffffffffffff, &(0x7f0000002140)={0x2020}, 0x2020) 7.332174998s ago: executing program 5 (id=2454): unshare(0x20000000) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x6200, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) wait4(0x0, 0x0, 0x40000000, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) 7.331560322s ago: executing program 8 (id=2455): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$key(0xf, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000400)={r5}, 0xc) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r5}, 0xc) sendmsg$key(r1, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="020700"], 0x10}}, 0x800) r6 = socket(0x10, 0x3, 0x0) write(r6, &(0x7f0000000100)="140000001a004f7fb3e45f2024d2f1c9fb470000", 0x14) recvmmsg(r6, &(0x7f0000001e00)=[{{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0x10000005}, {{0x0, 0x0, 0x0}, 0xc}, {{0x0, 0x0, 0x0}, 0x2}], 0x4, 0x10122, 0x0) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r6, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r7, 0x300, 0x70bd2a, 0x25dfdbfe, {{}, {}, {0x10, 0x13, @udp='udp:syz1\x00'}}, ["", "", "", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000010}, 0x40) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) r8 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r8, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) setsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast1, 0x0, 0x1, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x1, 0x0, 0x4, 0x4}, {0x0, 0x1}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x4d5, 0x3c}, 0x2, @in6=@loopback, 0x0, 0x0, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8) sendmmsg(r8, &(0x7f0000007fc0), 0x800001d, 0x0) 7.107014175s ago: executing program 0 (id=2456): unshare(0x62040200) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000180)={'raw\x00', 0x0, [0x7ffe, 0xd16f, 0x3, 0x8009, 0x2]}, &(0x7f00000002c0)=0x54) 7.100948935s ago: executing program 6 (id=2457): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='oom_adj\x00') write$cgroup_int(r0, &(0x7f0000000000)=0x1, 0x12) 6.873840717s ago: executing program 6 (id=2458): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000080)={0x0, r1}) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000580)={0x0, 0x0, 0x0, &(0x7f0000000780)=""/77, 0x0, 0x8080000}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$int_in(0xffffffffffffffff, 0x5452, 0x0) 5.867852597s ago: executing program 1 (id=2459): r0 = socket$vsock_stream(0x28, 0x1, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x11e) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$USBDEVFS_REAPURB(0xffffffffffffffff, 0x4008550c, 0x0) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20000050) r5 = syz_io_uring_setup(0x126e, &(0x7f0000000480)={0x0, 0x72d9, 0x80, 0x0, 0x100000}, &(0x7f0000000500), &(0x7f0000000780)) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r5, 0x2, 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES_UPDATE(r5, 0x6, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x3b8, 0x0, 0x12, 0x60d, 0x1d8, 0x202, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x2c0, 0x4, 0x0, {[{{@ipv6={@private1, @ipv4={'\x00', '\xff\xff', @empty}, [0x0, 0xff], [], 'ip_vti0\x00', 'macsec0\x00', {0xff}}, 0x0, 0x190, 0x1d8, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "000000165a8c2e0617ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f672225d6147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac05a602061c96baebc989f1f34a214e6726401fe4b124e0f7323a587d2a1fcf07000000eca0a7b66c60c527bac2b5", 0x74, 0x2}}, @common=@icmp6={{0x28}, {0xd, "ea9c", 0x1}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@ipv6={@mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xff, 0x0, 0xffffff00, 0xff000000], [0xff, 0xff000000, 0x0, 0xff], 'ipvlan1\x00', 'erspan0\x00', {}, {0xff}, 0x2b, 0x5, 0x6, 0x33}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x5, 0x8001, 0xf53, 'syz0\x00', 'syz1\x00', {0xffffffffffffff7f}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418) sched_rr_get_interval(r2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) setxattr$incfs_size(&(0x7f0000000000)='./cgroup.cpu/cpuset.cpus\x00', &(0x7f0000000100), 0x0, 0x0, 0x0) r6 = openat$cgroup_subtree(r1, &(0x7f0000000200), 0x2, 0x0) sendfile(r6, r6, 0x0, 0x8) getsockopt(r0, 0x28, 0x0, &(0x7f00000012c0)=""/4096, &(0x7f0000000080)=0x1000) 5.695274279s ago: executing program 8 (id=2460): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB='target PCI:'], 0x14) 5.558893652s ago: executing program 6 (id=2461): r0 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(0xffffffffffffffff, 0xa, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(0xffffffffffffffff, 0xa, 0x0, r0) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(0xffffffffffffffff, 0xa, 0x0, r1) 5.523632273s ago: executing program 8 (id=2462): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000047ff4f40d3131132677a010203010902120001760fb30f09040001"], 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000001440)=ANY=[@ANYBLOB="120141014813442024040075ee690102030109022400010000100000d49eff680904b8070296d1ca000905060200020d0006"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f00000013c0)={0x44, &(0x7f00000011c0)={0x20, 0x14, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_disconnect(r0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[], 0x0) syz_usb_control_io$sierra_net(r0, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3409}}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000a80)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) 5.364575365s ago: executing program 6 (id=2463): r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x54, 0x30, 0x5, 0x10, 0xdb0, 0x6869, 0x73b3, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xf9, 0x0, 0x0, 0xb5, 0xe5, 0x49}}]}}]}}, &(0x7f0000000080)={0x37, 0x0, 0x0, 0x0}) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000b40)=ANY=[], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000001c0)=ANY=[@ANYBLOB="000b25000000c2b2761afec60981c5ffe573bc557222d57547b58de7c05a702438"], &(0x7f0000000440)={0x0, 0xa, 0x1, 0x20}, 0x0, 0x0, &(0x7f0000000500)={0x20, 0x1, 0x1, 0x3}, 0x0}) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x403, 0x6030, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x2}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000ec0)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a00)={0x40, 0x7, 0x2, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x550c, 0x0) 4.388253096s ago: executing program 5 (id=2464): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x80003, 0x6) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r3, 0x0, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x4, 0x10, 0xfffffffffffffffe}, {0x0, 0x4, 0x4, 0xa78a}, 0xab, 0x0, 0x1, 0x0, 0x3}, {{@in=@loopback, 0x0, 0x33}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x38}, 0x0, 0x3, 0x1, 0x7}}, 0xe8) sendmmsg(r2, &(0x7f0000000480), 0x2e9, 0x0) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f00000001c0)={0xa61, {{0xa, 0x4e20, 0x8, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x6}}, 0x0, 0x1, [{{0xa, 0x4e24, 0x6, @empty, 0xfffffffd}}]}, 0x110) r4 = socket$key(0xf, 0x3, 0x2) socket$inet(0x2, 0xa, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$key(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x2, 0x6, 0x2, 0x0, 0x2, 0x0, 0x2}, 0x10}}, 0x0) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e20, 0xffffffff, @empty, 0x5}, 0x1c) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r0, r5, 0x80000) write$binfmt_misc(r6, &(0x7f0000000980), 0xfdef) 4.282705789s ago: executing program 1 (id=2465): r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000400)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x0, 0x0, 0xffffffffffff8001, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x5d, 0x12, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x0, 0xfe}}], {{0x9, 0x5, 0x82, 0x2, 0x60}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0xfe}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$uac1(0x7, 0x71, &(0x7f0000000040)=ANY=[@ANYBLOB="00406b1d01"], 0x0) r1 = syz_usb_connect(0x0, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102882333404f17cf8af4390102030109024500013f06400409044207000e0100010a240107000105ff010302070724050107638c0924030500030406810c2402"], &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000ec0)={0x84, 0x0, &(0x7f0000000b00)={0x0, 0xa, 0x1, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000dc0)={0x40, 0x1a, 0x2, 0x8}, &(0x7f0000000e00)={0x40, 0x1c, 0x1, 0x8}, 0x0, 0x0}) syz_usb_disconnect(r1) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f00000007c0)={0x84, &(0x7f0000000300)={0x40, 0x9, 0x3b, "07996be599dd6e2dc226a4a4d1340655680caa62e264b9e9aae247123e94e0eb78805b3febe10994f7a17235812b933bc8694ce2accace2212a295"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x6c}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0xc}, &(0x7f0000000400)={0x20, 0x0, 0x4, {0x3, 0x1}}, 0x0, &(0x7f0000000480)={0x40, 0x7, 0x2, 0x48}, &(0x7f00000004c0)={0x40, 0x9, 0x1, 0x6}, 0x0, 0x0, &(0x7f0000000580)={0x40, 0x13, 0x6, @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000000000040cf1090ea000000000001090224000100"], 0x0) r2 = syz_usb_connect(0x6, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0xa8, &(0x7f0000000480)={0x5, 0xf, 0xa8, 0x3, [@ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0x9, 0x0, 0x9, [0xffc000, 0x0, 0xc0]}, @generic={0x61, 0x10, 0x3, "d7ed2023826fde69948ff8e1bd20dec276342d509451f3c940e0f31cf7f0ebf226ed4c1be16f6ccf150baf9911d3ceb40cf73134cce3c52f3385187695dbaf054c728fe3f2f42b1787a24fbf89227d9c692c66746539a23a0fad4d59bb8b"}, @generic={0x2a, 0x10, 0x1, "5e2ecdd422a598234be89a0dde2ce5f4191860ddd7ab283d21b5ed0f9789c23f0a5b00cff46236"}]}}) syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000600)={0x14, &(0x7f0000000540)={0x0, 0x22, 0xa2, {0xa2, 0x8, "af33d4d8bbbdcc1bcdbd3988f4ac610bda2cac11471dc07627228586e23338e22455b940bbc6ed5037d02dbb03c1da52807c184a674fb1f4008c821fbec968d1c8af356b661381f60bcb54204d44e8e83bc2fe24d276073934097c49990b7356a40e7785da7f345066583a9df6924967cb50a170a4a52b88b170fc56cc0b5a77e6c1e6f38d9d0e8bde99f6d4a3fe1d2871c1f2069bdbae6dbc23223da2a298ad"}}, &(0x7f0000000300)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000b40)={0x1c, &(0x7f0000000780)=ANY=[@ANYBLOB="0000ff00000045ce749acfad982c8d81eacf11b6533db3e7fd4d68a2077db386a08d130a590664f338e74b70264f0cdd1fb6691dd4b800d35684ef4a323ecd375fdc085056a33ef0521d4c6cd09ebdd43ccdb56f881cbf67b1ced877d48551844e47dd01d951e263c071178a7718ec3e016bdbd8e056a9f53385fbcb34d99dfdc51faf9c9187994bb665e90e6dd9bebe527904095aae858f6b231868706266062185ea88a35e0a4c8ce83f642583c227f867f68fc2fecc44ee649437eaeb8a04e0ad6f7093b9d5f5d110253cad23896735b66b3ae3ca02b5f5037bceea9124cbe3db3568b0912b5890ec89a9c47678bc74cf9923fdd373d6808726930daf3cb2bff7108d9e"], &(0x7f0000000940)={0x0, 0xa, 0x1, 0x5d}, &(0x7f0000000ac0)={0x0, 0x8, 0x1, 0x10}}) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write(r0, 0x82, 0x21, &(0x7f0000000140)="16688a4a3f1cd2db8dcf350051f14ac00d7c36e54167f08f961d2fc0c37d7c8c21") syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)={{0x12, 0x1, 0x0, 0xb, 0xf9, 0x8b, 0x40, 0x4f2, 0xaffc, 0x8861, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff}}]}}]}}, 0x0) r4 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(r3, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000000)={0x40, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, &(0x7f0000000ec0)={0x84, &(0x7f0000000b00)={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000900)={0x2c, &(0x7f00000006c0)=ANY=[@ANYBLOB="201081000000676358bacb1fa93459ee0b06ff3805fb0d88ff7f69c02e0ed1c2eae476b4703e4fe5fe679e97cdbac4ca029220528535c5dcd77bc8b8bff6e8213fc62d74393573a145c84bd2d0f4cbebccfa68cfba3e41098f10ad81d76d903b1ff6ea1b2b7cc88436fecbea31f5ec5a9154253e0eda46659945d501096bab89ffd57e09265eea"], 0x0, 0x0, &(0x7f00000009c0)={0x20, 0x1, 0xc8, "3831776d9eccc00161f5153a46ee5e51b92e1d00fac6a2ecc2fd14d38dfcef848f3049f4b190570a444920f14057f610c821acfbe45aa440ae8615cde5fa3fcda5b5900000000064ad8a1bb7d318d5a50f47ed40d10d56db847aa282f1a8725ab369024d89e22b53f2aedd730d8974001d984bbe567a8e444607dcce184225e1be2c7f0bc5c4e63ae32f7dce4d72573f5729d7aba4b8cd827f5dd9ea6e3dc2dea2bc4f4077f41acfa994306f39a33cb9e56f591497e1f8a263d44f5e9d0169440904792e90047935"}, &(0x7f00000008c0)={0x20, 0x3, 0x1}}) syz_usb_ep_write(r4, 0x9, 0xce, &(0x7f00000001c0)="ebdac0c2d0a9df0243fe9ff60520c8e62a30a4cd6eff01a17614452e1e53dda51a96610f84111a605d7ff5e4621449903694f82d2f47e9b5e8f44e7addaacc26349aace09d1eae42e61a9f5d0f73827dbcd3e870a0c12852f547dc80dc81111ce844d6e6d474ae3219002b82bbc996b29e10c93bffc1e988b1311e2478ea19a2807b1fef4e921a2851dcd84447b19ba1cb3d04399481668921c651376aba235230f3e26770d41e3314122e4e06b861968ffc66c576383239712255695559341268c86087c312d12451d6043c39a8") syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000640)={0x44, &(0x7f00000003c0)={0x0, 0x1, 0x1f, "c9b970400a04e00ea37a6b13f3fb1ef1b96bfae203ee83946cde3bb149420b"}, 0x0, &(0x7f0000000340)={0x0, 0x8, 0x1, 0xe5}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x6) 2.798828386s ago: executing program 5 (id=2466): syz_emit_ethernet(0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0) syz_emit_ethernet(0x72, &(0x7f0000000640)=ANY=[@ANYRES8], 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}, 0x1}, 0x20) read$FUSE(0xffffffffffffffff, &(0x7f0000002140)={0x2020}, 0x2020) 2.456727844s ago: executing program 0 (id=2467): syz_usb_connect(0x2, 0x2d, &(0x7f00000010c0)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES8], 0x0) 2.248873733s ago: executing program 5 (id=2468): bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1b, 0x3, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x88f}}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000440), 0x10) listen(r0, 0xfffffffe) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x200002, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={@cgroup=r1, 0xffffffffffffffff, 0x3, 0x0, 0x4000}, 0x10) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)=0x1, 0x12) 2.228866991s ago: executing program 8 (id=2469): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000000004026093333400000000001090224"], 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x17ef, 0x6067, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xc0, 0x40, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x0, 0x1, {0x22, 0xa0}}}}]}}]}}, 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000b10b5103a092226"], 0x0) syz_usb_disconnect(r1) r2 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) 1.836229417s ago: executing program 5 (id=2470): bind$inet(0xffffffffffffffff, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) r0 = syz_open_procfs(0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000200), 0x0, 0x6, 0x0) syz_usb_connect$lan78xx(0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) writev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300090468fe0700000000000000ff3f04000000484100100000000004e438d2fd00000000004a7b72000000000000000000f90000", 0x39}], 0x1) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000040)="4dff000013001118680907070000000f0000ff3f04000000170a001700000000040014001000030001302564aa58b9a64411f6bbf44dc48f57", 0xff4d}], 0x1) 789.688444ms ago: executing program 1 (id=2471): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x80, 0x0, 0x0, 0xfffffffd, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @dev={0xac, 0x14, 0x14, 0x2a}}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x10, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x8, 0x0, 0x0, @loopback, @local}}}}) 499.36523ms ago: executing program 0 (id=2472): syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000600)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276d1"], 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) syz_usb_control_io$printer(r0, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000580)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)={{0x12, 0x1, 0x310, 0x4f, 0x73, 0x40, 0x10, 0xeb1, 0x7007, 0x209, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x2, 0x20, 0x8, [{{0x9, 0x4, 0xe2, 0x1, 0x1, 0xff, 0x0, 0xff, 0x8, [], [{{0x9, 0x5, 0x4, 0x4, 0x20, 0x3, 0x1}}]}}]}}]}}, 0x0) ioctl$EVIOCGSW(0xffffffffffffffff, 0x8040451b, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hiddev(0x0, 0x0, 0x0) 155.546299ms ago: executing program 6 (id=2473): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d240f010000000003000000f906241a0000000905810300000100040904010000020d00000904010102020d000009058202000200000409050302000200000051d863771e9bd0bbf1918d7d84f694f118c16347f1a623d64ecb8dd41869db5c6d5a81e7e5d4733c4b6a"], 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x1b, 0x0, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x80, 0x1c, {0x6, 0x10, 0x7590, 0xa, 0xfff, 0xee7, 0xcc48, 0x2e, 0x7, 0x0, 0x100, 0x4}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 87.269815ms ago: executing program 5 (id=2474): r0 = open(&(0x7f0000000000)='./file0\x00', 0x8c200, 0x159) r1 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/wireless\x00') preadv(r1, &(0x7f0000000100), 0x0, 0x1fc, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x509500, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = fsopen(&(0x7f0000000000)='proc\x00', 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="4000000001010101000000000000000002001c002000018006000340000000001400018008c301007f000001080002007f0000010c00198008000100", @ANYRES64=r4], 0x40}, 0x1, 0x0, 0x0, 0x4004410}, 0x0) r6 = openat$kvm(0xffffff9c, 0x0, 0x800, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r8, 0x4090ae82, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r3, 0x4010ae67, 0x0) 0s ago: executing program 1 (id=2475): r0 = syz_usb_connect(0x0, 0x202, &(0x7f0000000180)=ANY=[@ANYBLOB="1201100152018b401e040740185d000000010902f00101040000030904"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000040)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109"], 0x0) kernel console output (not intermixed with test programs): stack_lvl+0xe8/0x150 [ 740.729567][T12521] should_fail_ex+0x46b/0x600 [ 740.729610][T12521] should_failslab+0xa8/0x100 [ 740.729648][T12521] __kmalloc_noprof+0xdf/0x7b0 [ 740.729683][T12521] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 740.729734][T12521] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 740.729775][T12521] genl_family_rcv_msg_doit+0xd9/0x330 [ 740.729813][T12521] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 740.729843][T12521] ? rcu_is_watching+0x15/0xb0 [ 740.729870][T12521] ? rcu_is_watching+0x15/0xb0 [ 740.729895][T12521] ? cap_capable+0x123/0x490 [ 740.729925][T12521] ? safesetid_security_capable+0xa9/0x1a0 [ 740.729956][T12521] ? bpf_lsm_capable+0x9/0x20 [ 740.729982][T12521] ? security_capable+0x7e/0x2c0 [ 740.730024][T12521] genl_rcv_msg+0x61c/0x7a0 [ 740.730061][T12521] ? __pfx_genl_rcv_msg+0x10/0x10 [ 740.730091][T12521] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 740.730120][T12521] ? __pfx_nl80211_tx_mgmt+0x10/0x10 [ 740.730143][T12521] ? __pfx_nl80211_post_doit+0x10/0x10 [ 740.730178][T12521] ? __pfx_ref_tracker_free+0x10/0x10 [ 740.730200][T12521] ? __skb_clone+0x63/0x7a0 [ 740.730239][T12521] netlink_rcv_skb+0x232/0x4b0 [ 740.730264][T12521] ? __pfx_genl_rcv_msg+0x10/0x10 [ 740.730297][T12521] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 740.730348][T12521] genl_rcv+0x28/0x40 [ 740.730374][T12521] netlink_unicast+0x831/0x9f0 [ 740.730418][T12521] ? __pfx_netlink_unicast+0x10/0x10 [ 740.730456][T12521] ? netlink_sendmsg+0x650/0xb40 [ 740.730477][T12521] ? skb_put+0x11b/0x210 [ 740.730509][T12521] netlink_sendmsg+0x813/0xb40 [ 740.730544][T12521] ? __pfx_netlink_sendmsg+0x10/0x10 [ 740.730584][T12521] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 740.730621][T12521] ____sys_sendmsg+0xa4e/0xac0 [ 740.730662][T12521] ? __pfx_____sys_sendmsg+0x10/0x10 [ 740.730703][T12521] ? import_iovec+0x73/0xa0 [ 740.730740][T12521] ___sys_sendmsg+0x2a5/0x360 [ 740.730778][T12521] ? __pfx____sys_sendmsg+0x10/0x10 [ 740.730847][T12521] ? __fget_files+0x2a/0x420 [ 740.730874][T12521] ? __fget_files+0x3a6/0x420 [ 740.730912][T12521] __x64_sys_sendmsg+0x1c3/0x2a0 [ 740.730947][T12521] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 740.730989][T12521] ? __pfx_ksys_write+0x10/0x10 [ 740.731035][T12521] do_syscall_64+0x14d/0xf80 [ 740.731065][T12521] ? trace_irq_disable+0x3b/0x150 [ 740.731092][T12521] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.731115][T12521] ? clear_bhb_loop+0x40/0x90 [ 740.731143][T12521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.731165][T12521] RIP: 0033:0x7f2f3b08c629 [ 740.731188][T12521] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 740.731207][T12521] RSP: 002b:00007f2f392e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 740.731232][T12521] RAX: ffffffffffffffda RBX: 00007f2f3b305fa0 RCX: 00007f2f3b08c629 [ 740.731249][T12521] RDX: 00000000000008c0 RSI: 00002000000095c0 RDI: 0000000000000004 [ 740.731263][T12521] RBP: 00007f2f392e6090 R08: 0000000000000000 R09: 0000000000000000 [ 740.731278][T12521] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 740.731292][T12521] R13: 00007f2f3b306038 R14: 00007f2f3b305fa0 R15: 00007fff010dc038 [ 740.731328][T12521] [ 741.204337][ T9] usb 7-1: USB disconnect, device number 54 [ 742.898097][T12542] FAULT_INJECTION: forcing a failure. [ 742.898097][T12542] name failslab, interval 1, probability 0, space 0, times 0 [ 742.898143][T12542] CPU: 1 UID: 0 PID: 12542 Comm: syz.0.1920 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 742.898185][T12542] Tainted: [L]=SOFTLOCKUP [ 742.898194][T12542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 742.898209][T12542] Call Trace: [ 742.898218][T12542] [ 742.898228][T12542] dump_stack_lvl+0xe8/0x150 [ 742.898267][T12542] should_fail_ex+0x46b/0x600 [ 742.898307][T12542] should_failslab+0xa8/0x100 [ 742.898344][T12542] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 742.898380][T12542] ? alloc_vmap_area+0x229/0x14b0 [ 742.898416][T12542] alloc_vmap_area+0x229/0x14b0 [ 742.898463][T12542] ? __pfx_alloc_vmap_area+0x10/0x10 [ 742.898496][T12542] ? __kmalloc_cache_node_noprof+0x27d/0x6c0 [ 742.898532][T12542] ? __get_vm_area_node+0x171/0x350 [ 742.898561][T12542] ? bpf_prog_alloc_no_stats+0x4a/0x4f0 [ 742.898600][T12542] __get_vm_area_node+0x226/0x350 [ 742.898639][T12542] __vmalloc_node_range_noprof+0x372/0x1730 [ 742.898673][T12542] ? bpf_prog_alloc_no_stats+0x4a/0x4f0 [ 742.898716][T12542] ? __lock_acquire+0x6b5/0x2cf0 [ 742.898752][T12542] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 742.898785][T12542] ? irqentry_exit+0x59e/0x620 [ 742.898815][T12542] ? trace_irq_disable+0x3b/0x150 [ 742.898855][T12542] ? bpf_prog_alloc_no_stats+0x4a/0x4f0 [ 742.898883][T12542] __vmalloc_noprof+0xd2/0x120 [ 742.898916][T12542] ? bpf_prog_alloc_no_stats+0x4a/0x4f0 [ 742.898949][T12542] bpf_prog_alloc_no_stats+0x4a/0x4f0 [ 742.898985][T12542] bpf_prog_alloc+0x3c/0x1a0 [ 742.899018][T12542] bpf_prog_load+0x7ba/0x1ae0 [ 742.899063][T12542] ? __pfx_bpf_prog_load+0x10/0x10 [ 742.899116][T12542] ? bpf_lsm_bpf+0x9/0x20 [ 742.899138][T12542] ? security_bpf+0x7e/0x2d0 [ 742.899174][T12542] __sys_bpf+0x618/0x950 [ 742.899203][T12542] ? __pfx___sys_bpf+0x10/0x10 [ 742.899227][T12542] ? rt_mutex_slowunlock+0x1cb/0x300 [ 742.899267][T12542] ? ksys_write+0x248/0x270 [ 742.899302][T12542] ? __pfx_ksys_write+0x10/0x10 [ 742.899341][T12542] __x64_sys_bpf+0x7c/0x90 [ 742.899366][T12542] do_syscall_64+0x14d/0xf80 [ 742.899395][T12542] ? trace_irq_disable+0x3b/0x150 [ 742.899419][T12542] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.899442][T12542] ? clear_bhb_loop+0x40/0x90 [ 742.899470][T12542] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.899493][T12542] RIP: 0033:0x7f80f424c629 [ 742.899537][T12542] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 742.899557][T12542] RSP: 002b:00007f80f24a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 742.899582][T12542] RAX: ffffffffffffffda RBX: 00007f80f44c5fa0 RCX: 00007f80f424c629 [ 742.899606][T12542] RDX: 0000000000000094 RSI: 00002000000000c0 RDI: 0000000000000005 [ 742.899622][T12542] RBP: 00007f80f24a6090 R08: 0000000000000000 R09: 0000000000000000 [ 742.899637][T12542] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 742.899652][T12542] R13: 00007f80f44c6038 R14: 00007f80f44c5fa0 R15: 00007ffd4484f0d8 [ 742.899688][T12542] [ 742.899713][T12542] syz.0.1920: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 742.899786][T12542] CPU: 1 UID: 0 PID: 12542 Comm: syz.0.1920 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 742.899817][T12542] Tainted: [L]=SOFTLOCKUP [ 742.899825][T12542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 742.899838][T12542] Call Trace: [ 742.899847][T12542] [ 742.899856][T12542] dump_stack_lvl+0xe8/0x150 [ 742.899893][T12542] warn_alloc+0x263/0x3e0 [ 742.899929][T12542] ? kasan_quarantine_put+0xbb/0x1f0 [ 742.899961][T12542] ? __pfx_warn_alloc+0x10/0x10 [ 742.899997][T12542] ? __get_vm_area_node+0x23f/0x350 [ 742.900025][T12542] ? __get_vm_area_node+0x171/0x350 [ 742.900056][T12542] ? bpf_prog_alloc_no_stats+0x4a/0x4f0 [ 742.900087][T12542] ? __get_vm_area_node+0x23f/0x350 [ 742.900126][T12542] __vmalloc_node_range_noprof+0x397/0x1730 [ 742.900175][T12542] ? __lock_acquire+0x6b5/0x2cf0 [ 742.900212][T12542] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 742.900245][T12542] ? irqentry_exit+0x59e/0x620 [ 742.900275][T12542] ? trace_irq_disable+0x3b/0x150 [ 742.900313][T12542] ? bpf_prog_alloc_no_stats+0x4a/0x4f0 [ 742.900340][T12542] __vmalloc_noprof+0xd2/0x120 [ 742.900371][T12542] ? bpf_prog_alloc_no_stats+0x4a/0x4f0 [ 742.900404][T12542] bpf_prog_alloc_no_stats+0x4a/0x4f0 [ 742.900439][T12542] bpf_prog_alloc+0x3c/0x1a0 [ 742.900471][T12542] bpf_prog_load+0x7ba/0x1ae0 [ 742.900515][T12542] ? __pfx_bpf_prog_load+0x10/0x10 [ 742.900566][T12542] ? bpf_lsm_bpf+0x9/0x20 [ 742.900594][T12542] ? security_bpf+0x7e/0x2d0 [ 742.900629][T12542] __sys_bpf+0x618/0x950 [ 742.900657][T12542] ? __pfx___sys_bpf+0x10/0x10 [ 742.900681][T12542] ? rt_mutex_slowunlock+0x1cb/0x300 [ 742.900722][T12542] ? ksys_write+0x248/0x270 [ 742.900755][T12542] ? __pfx_ksys_write+0x10/0x10 [ 742.900798][T12542] __x64_sys_bpf+0x7c/0x90 [ 742.900825][T12542] do_syscall_64+0x14d/0xf80 [ 742.900852][T12542] ? trace_irq_disable+0x3b/0x150 [ 742.900877][T12542] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.900900][T12542] ? clear_bhb_loop+0x40/0x90 [ 742.900929][T12542] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.900951][T12542] RIP: 0033:0x7f80f424c629 [ 742.900971][T12542] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 742.900992][T12542] RSP: 002b:00007f80f24a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 742.901013][T12542] RAX: ffffffffffffffda RBX: 00007f80f44c5fa0 RCX: 00007f80f424c629 [ 742.901031][T12542] RDX: 0000000000000094 RSI: 00002000000000c0 RDI: 0000000000000005 [ 742.901046][T12542] RBP: 00007f80f24a6090 R08: 0000000000000000 R09: 0000000000000000 [ 742.901061][T12542] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 742.901076][T12542] R13: 00007f80f44c6038 R14: 00007f80f44c5fa0 R15: 00007ffd4484f0d8 [ 742.901112][T12542] [ 742.948646][T12542] Mem-Info: [ 742.948664][T12542] active_anon:276 inactive_anon:9875 isolated_anon:0 [ 742.948664][T12542] active_file:27607 inactive_file:37953 isolated_file:0 [ 742.948664][T12542] unevictable:768 dirty:160 writeback:0 [ 742.948664][T12542] slab_reclaimable:12714 slab_unreclaimable:105629 [ 742.948664][T12542] mapped:33772 shmem:3413 pagetables:1978 [ 742.948664][T12542] sec_pagetables:0 bounce:0 [ 742.948664][T12542] kernel_misc_reclaimable:0 [ 742.948664][T12542] free:1282173 free_pcp:8137 free_cma:0 [ 742.948876][T12542] Node 0 active_anon:1104kB inactive_anon:39500kB active_file:110228kB inactive_file:151812kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:135088kB dirty:640kB writeback:0kB shmem:12116kB kernel_stack:14408kB pagetables:7760kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 742.949026][T12542] Node 1 active_anon:0kB inactive_anon:0kB active_file:200kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:64kB pagetables:152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 742.949153][T12542] Node 0 DMA free:15356kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 742.949326][T12542] lowmem_reserve[]: 0 2506 2506 2506 2506 [ 742.949434][T12542] Node 0 DMA32 free:1177116kB boost:0kB min:3932kB low:6468kB high:9004kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1104kB inactive_anon:39500kB active_file:110228kB inactive_file:151812kB unevictable:1536kB writepending:640kB zspages:0kB present:3129332kB managed:2566644kB mlocked:0kB bounce:0kB free_pcp:32548kB local_pcp:28436kB free_cma:0kB [ 742.949601][T12542] lowmem_reserve[]: 0 0 0 0 0 [ 742.949702][T12542] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:424kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 742.949883][T12542] lowmem_reserve[]: 0 0 0 0 0 [ 742.949977][T12542] Node 1 Normal free:3936220kB boost:0kB min:6364kB low:10472kB high:14580kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:200kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 742.950153][T12542] lowmem_reserve[]: 0 0 0 0 0 [ 742.950276][T12542] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15356kB [ 742.950683][T12542] Node 0 DMA32: 1531*4kB (UE) 1914*8kB (U) 1020*16kB (UME) 284*32kB (UME) 425*64kB (UME) 253*128kB (UME) 166*256kB (UME) 114*512kB (UME) 57*1024kB (UME) 19*2048kB (UM) 213*4096kB (UM) = 1177020kB [ 742.951155][T12542] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 742.951441][T12542] Node 1 Normal: 3*4kB (UME) 2*8kB (ME) 14*16kB (UME) 11*32kB (UME) 6*64kB (UME) 4*128kB (UME) 4*256kB (UME) 3*512kB (ME) 2*1024kB (UM) 3*2048kB (ME) 958*4096kB (M) = 3936220kB [ 742.951918][T12542] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 742.951963][T12542] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 742.952015][T12542] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 742.952055][T12542] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 742.952108][T12542] 68966 total pagecache pages [ 742.952132][T12542] 0 pages in swap cache [ 742.952155][T12542] Free swap = 124996kB [ 742.952177][T12542] Total swap = 124996kB [ 742.952208][T12542] 2097051 pages RAM [ 742.952230][T12542] 0 pages HighMem/MovableOnly [ 742.952251][T12542] 423669 pages reserved [ 742.952273][T12542] 0 pages cma reserved [ 743.359054][T12544] fuse: Unknown parameter 'group_id00000000000000000000' [ 744.386625][ T6135] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 744.521495][T12564] FAULT_INJECTION: forcing a failure. [ 744.521495][T12564] name failslab, interval 1, probability 0, space 0, times 0 [ 744.521536][T12564] CPU: 0 UID: 0 PID: 12564 Comm: syz.1.1927 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 744.521567][T12564] Tainted: [L]=SOFTLOCKUP [ 744.521576][T12564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 744.521590][T12564] Call Trace: [ 744.521599][T12564] [ 744.521610][T12564] dump_stack_lvl+0xe8/0x150 [ 744.521648][T12564] should_fail_ex+0x46b/0x600 [ 744.521691][T12564] should_failslab+0xa8/0x100 [ 744.521728][T12564] __kmalloc_noprof+0xdf/0x7b0 [ 744.521760][T12564] ? tomoyo_encode+0x28b/0x550 [ 744.521794][T12564] ? tomoyo_realpath_from_path+0x5a2/0x5d0 [ 744.521834][T12564] tomoyo_encode+0x28b/0x550 [ 744.521874][T12564] tomoyo_mount_permission+0x4c1/0x9d0 [ 744.521913][T12564] ? tomoyo_mount_permission+0x2b3/0x9d0 [ 744.521945][T12564] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 744.522039][T12564] security_sb_mount+0xe4/0x320 [ 744.522067][T12564] path_mount+0xbc/0x10e0 [ 744.522091][T12564] ? user_path_at+0xd4/0x160 [ 744.522128][T12564] ? user_path_at+0xd4/0x160 [ 744.522160][T12564] __se_sys_mount+0x31d/0x420 [ 744.522194][T12564] ? __pfx___se_sys_mount+0x10/0x10 [ 744.522228][T12564] ? __x64_sys_mount+0x20/0xc0 [ 744.522257][T12564] do_syscall_64+0x14d/0xf80 [ 744.522288][T12564] ? trace_irq_disable+0x3b/0x150 [ 744.522313][T12564] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 744.522338][T12564] ? clear_bhb_loop+0x40/0x90 [ 744.522364][T12564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 744.522387][T12564] RIP: 0033:0x7fb9d5a4c629 [ 744.522416][T12564] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 744.522435][T12564] RSP: 002b:00007fb9d3c9e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 744.522458][T12564] RAX: ffffffffffffffda RBX: 00007fb9d5cc5fa0 RCX: 00007fb9d5a4c629 [ 744.522474][T12564] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000000 [ 744.522487][T12564] RBP: 00007fb9d3c9e090 R08: 0000000000000000 R09: 0000000000000000 [ 744.522501][T12564] R10: 0000000000084000 R11: 0000000000000246 R12: 0000000000000001 [ 744.522513][T12564] R13: 00007fb9d5cc6038 R14: 00007fb9d5cc5fa0 R15: 00007fff650e04f8 [ 744.522550][T12564] [ 744.552740][ T6135] usb 9-1: Using ep0 maxpacket: 16 [ 744.664361][ T6135] usb 9-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 744.664463][ T6135] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 744.664569][ T6135] usb 9-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 744.664644][ T6135] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 744.794798][ T6135] usb 9-1: config 0 descriptor?? [ 746.538222][T12575] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1929'. [ 747.397811][ T5881] usb 9-1: USB disconnect, device number 24 [ 747.476904][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.477008][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.626365][T12427] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 747.788413][T12427] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 747.788469][T12427] usb 6-1: New USB device found, idVendor=056a, idProduct=0018, bcdDevice= 0.00 [ 747.788496][T12427] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 747.793944][T12427] usb 6-1: config 0 descriptor?? [ 747.846395][ T5881] usb 1-1: new full-speed USB device number 47 using dummy_hcd [ 747.986303][ T5881] usb 1-1: device descriptor read/64, error -71 [ 748.576743][ T5881] usb 1-1: new full-speed USB device number 48 using dummy_hcd [ 748.766320][ T5881] usb 1-1: device descriptor read/64, error -71 [ 748.812022][T12427] wacom 0003:056A:0018.000C: unbalanced collection at end of report description [ 748.838806][T12427] wacom 0003:056A:0018.000C: parse failed [ 748.839869][T12427] wacom 0003:056A:0018.000C: probe with driver wacom failed with error -22 [ 748.899877][ T5881] usb usb1-port1: attempt power cycle [ 749.407363][ T5881] usb 1-1: new full-speed USB device number 49 using dummy_hcd [ 749.946972][T12600] FAULT_INJECTION: forcing a failure. [ 749.946972][T12600] name failslab, interval 1, probability 0, space 0, times 0 [ 749.947003][T12600] CPU: 1 UID: 0 PID: 12600 Comm: syz.1.1941 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 749.947026][T12600] Tainted: [L]=SOFTLOCKUP [ 749.947032][T12600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 749.947043][T12600] Call Trace: [ 749.947049][T12600] [ 749.947057][T12600] dump_stack_lvl+0xe8/0x150 [ 749.947089][T12600] should_fail_ex+0x46b/0x600 [ 749.947119][T12600] should_failslab+0xa8/0x100 [ 749.947146][T12600] kmem_cache_alloc_noprof+0x87/0x680 [ 749.947170][T12600] ? lockdep_hardirqs_on+0x7a/0x110 [ 749.947191][T12600] ? do_getname+0x2e/0x250 [ 749.947217][T12600] do_getname+0x2e/0x250 [ 749.947232][T12600] ? getname_flags+0x11/0x20 [ 749.947250][T12600] do_sys_openat2+0xca/0x200 [ 749.947271][T12600] ? __pfx_do_sys_openat2+0x10/0x10 [ 749.947290][T12600] ? ksys_write+0x248/0x270 [ 749.947314][T12600] ? __pfx_ksys_write+0x10/0x10 [ 749.947339][T12600] __x64_sys_openat+0x138/0x170 [ 749.947362][T12600] do_syscall_64+0x14d/0xf80 [ 749.947383][T12600] ? trace_irq_disable+0x3b/0x150 [ 749.947402][T12600] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 749.947419][T12600] ? clear_bhb_loop+0x40/0x90 [ 749.947440][T12600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 749.947456][T12600] RIP: 0033:0x7fb9d5a4c629 [ 749.947471][T12600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 749.947486][T12600] RSP: 002b:00007fb9d3c9e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 749.947504][T12600] RAX: ffffffffffffffda RBX: 00007fb9d5cc5fa0 RCX: 00007fb9d5a4c629 [ 749.947516][T12600] RDX: 0000000000000004 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 749.947527][T12600] RBP: 00007fb9d3c9e090 R08: 0000000000000000 R09: 0000000000000000 [ 749.947538][T12600] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000001 [ 749.947548][T12600] R13: 00007fb9d5cc6038 R14: 00007fb9d5cc5fa0 R15: 00007fff650e04f8 [ 749.947573][T12600] [ 750.966237][ T5881] usb 1-1: device descriptor read/8, error -71 [ 751.321255][T12614] netlink: 'syz.6.1945': attribute type 5 has an invalid length. [ 751.456464][ T6135] usb 9-1: new full-speed USB device number 25 using dummy_hcd [ 752.064334][ T7527] usb 6-1: USB disconnect, device number 52 [ 752.112788][ T6135] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 752.112864][ T6135] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFC, changing to 0x8C [ 752.112894][ T6135] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 10 [ 752.112922][ T6135] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 212, setting to 64 [ 752.112951][ T6135] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 752.170282][ T6135] usb 9-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 752.170316][ T6135] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 752.170338][ T6135] usb 9-1: Product: syz [ 752.170354][ T6135] usb 9-1: Manufacturer: syz [ 752.170371][ T6135] usb 9-1: SerialNumber: syz [ 752.238113][ T6135] usb 9-1: config 0 descriptor?? [ 752.239103][T12610] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 752.556461][ T6135] rc_core: IR keymap rc-xbox-dvd not found [ 752.556483][ T6135] Registered IR keymap rc-empty [ 752.558373][ T6135] rc rc0: syz syz as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0 [ 752.561916][ T6135] input: syz syz as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0/input37 [ 752.761248][ T6135] usb 9-1: USB disconnect, device number 25 [ 752.761335][ C0] xbox_remote 9-1:0.0: xbox_remote_irq_in: usb_submit_urb()=-19 [ 755.079425][T12665] netlink: 'syz.0.1960': attribute type 5 has an invalid length. [ 756.372870][T12721] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1979'. [ 758.746304][ T5881] usb 7-1: new high-speed USB device number 55 using dummy_hcd [ 758.848171][T12738] FAULT_INJECTION: forcing a failure. [ 758.848171][T12738] name failslab, interval 1, probability 0, space 0, times 0 [ 758.848214][T12738] CPU: 1 UID: 0 PID: 12738 Comm: syz.1.1984 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 758.848255][T12738] Tainted: [L]=SOFTLOCKUP [ 758.848265][T12738] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 758.848281][T12738] Call Trace: [ 758.848291][T12738] [ 758.848302][T12738] dump_stack_lvl+0xe8/0x150 [ 758.848343][T12738] should_fail_ex+0x46b/0x600 [ 758.848385][T12738] should_failslab+0xa8/0x100 [ 758.848424][T12738] __kmalloc_cache_noprof+0x84/0x690 [ 758.848459][T12738] ? nfc_genl_rcv_nl_event+0xa8/0x2d0 [ 758.848489][T12738] nfc_genl_rcv_nl_event+0xa8/0x2d0 [ 758.848517][T12738] notifier_call_chain+0x1be/0x400 [ 758.848552][T12738] blocking_notifier_call_chain+0x6a/0x90 [ 758.848581][T12738] netlink_release+0x1259/0x1af0 [ 758.848613][T12738] ? netlink_release+0x101/0x1af0 [ 758.848641][T12738] ? __pfx_netlink_release+0x10/0x10 [ 758.848665][T12738] ? rwbase_write_lock+0x568/0x730 [ 758.848714][T12738] sock_close+0xc3/0x240 [ 758.848749][T12738] ? __pfx_sock_close+0x10/0x10 [ 758.848783][T12738] __fput+0x461/0xa90 [ 758.848823][T12738] task_work_run+0x1d9/0x270 [ 758.848854][T12738] ? __pfx_task_work_run+0x10/0x10 [ 758.848880][T12738] ? kick_process+0xeb/0x160 [ 758.848918][T12738] ? task_work_add+0x395/0x440 [ 758.848950][T12738] get_signal+0x11c3/0x1310 [ 758.848993][T12738] ? __fput_deferred+0x253/0x3e0 [ 758.849021][T12738] ? __pfx___fput_deferred+0x10/0x10 [ 758.849056][T12738] arch_do_signal_or_restart+0xbc/0x830 [ 758.849086][T12738] ? __x64_sys_sendmsg+0x275/0x2a0 [ 758.849119][T12738] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 758.849172][T12738] exit_to_user_mode_loop+0x86/0x480 [ 758.849207][T12738] ? rcu_is_watching+0x15/0xb0 [ 758.849242][T12738] do_syscall_64+0x32d/0xf80 [ 758.849272][T12738] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 758.849295][T12738] ? clear_bhb_loop+0x40/0x90 [ 758.849324][T12738] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 758.849348][T12738] RIP: 0033:0x7fb9d5a4c629 [ 758.849371][T12738] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 758.849392][T12738] RSP: 002b:00007fb9d3c5c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 758.849418][T12738] RAX: 000000000000004c RBX: 00007fb9d5cc6180 RCX: 00007fb9d5a4c629 [ 758.849435][T12738] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000006 [ 758.849449][T12738] RBP: 00007fb9d3c5c090 R08: 0000000000000000 R09: 0000000000000000 [ 758.849463][T12738] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 758.849478][T12738] R13: 00007fb9d5cc6218 R14: 00007fb9d5cc6180 R15: 00007fff650e04f8 [ 758.849515][T12738] [ 759.110734][ T5881] usb 7-1: Using ep0 maxpacket: 8 [ 759.266464][ T5881] usb 7-1: unable to get BOS descriptor or descriptor too short [ 759.270888][ T5881] usb 7-1: config 6 has an invalid interface number: 86 but max is 0 [ 759.270917][ T5881] usb 7-1: config 6 has no interface number 0 [ 759.270951][ T5881] usb 7-1: config 6 interface 86 has no altsetting 0 [ 759.313830][ T5881] usb 7-1: New USB device found, idVendor=06cd, idProduct=0115, bcdDevice=93.3f [ 759.313863][ T5881] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 759.313884][ T5881] usb 7-1: Product: syz [ 759.313900][ T5881] usb 7-1: Manufacturer: syz [ 759.313915][ T5881] usb 7-1: SerialNumber: syz [ 759.623861][ T5881] keyspan 7-1:6.86: Keyspan 2 port adapter converter detected [ 759.624136][ T5881] keyspan 7-1:6.86: found no endpoint descriptor for endpoint 87 [ 759.624211][ T5881] keyspan 7-1:6.86: found no endpoint descriptor for endpoint 7 [ 759.662863][ T5881] keyspan 7-1:6.86: found no endpoint descriptor for endpoint 81 [ 759.662972][ T5881] keyspan 7-1:6.86: found no endpoint descriptor for endpoint 1 [ 759.663058][ T5881] keyspan 7-1:6.86: found no endpoint descriptor for endpoint 2 [ 759.663155][ T5881] keyspan 7-1:6.86: found no endpoint descriptor for endpoint 85 [ 759.663915][ T5881] keyspan 7-1:6.86: found no endpoint descriptor for endpoint 5 [ 759.716681][ T5881] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 759.719259][ T5881] keyspan 7-1:6.86: found no endpoint descriptor for endpoint 83 [ 759.719352][ T5881] keyspan 7-1:6.86: found no endpoint descriptor for endpoint 3 [ 759.719447][ T5881] keyspan 7-1:6.86: found no endpoint descriptor for endpoint 4 [ 759.719538][ T5881] keyspan 7-1:6.86: found no endpoint descriptor for endpoint 86 [ 759.719624][ T5881] keyspan 7-1:6.86: found no endpoint descriptor for endpoint 6 [ 759.776730][ T5881] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 759.806381][ T5881] usb 7-1: USB disconnect, device number 55 [ 759.827301][ T5881] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 759.853607][ T5881] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 759.854552][ T5881] keyspan 7-1:6.86: device disconnected [ 760.266799][T12763] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1996'. [ 762.786238][ T5882] usb 7-1: new full-speed USB device number 56 using dummy_hcd [ 762.950129][ T5882] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 762.950176][ T5882] usb 7-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 762.950253][ T5882] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 762.954576][ T5882] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 762.954606][ T5882] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 762.954625][ T5882] usb 7-1: SerialNumber: syz [ 763.269761][T12768] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 763.281144][ T5882] usb 7-1: USB disconnect, device number 56 [ 763.659363][ T5808] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 763.676559][ T5808] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 763.680392][ T5808] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 763.682028][ T5808] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 763.682844][ T5808] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 763.866237][ T5881] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 764.026395][ T5881] usb 9-1: Using ep0 maxpacket: 8 [ 764.033326][ T5881] usb 9-1: unable to get BOS descriptor or descriptor too short [ 764.034614][ T5881] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 764.034665][ T5881] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 764.034693][ T5881] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 764.106830][ T5881] usb 9-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 764.106864][ T5881] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.106886][ T5881] usb 9-1: Product: syz [ 764.106901][ T5881] usb 9-1: Manufacturer: syz [ 764.106917][ T5881] usb 9-1: SerialNumber: syz [ 764.107007][ T5882] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 764.157483][ T5881] usb 9-1: config 0 descriptor?? [ 764.178817][ T5881] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 764.290249][ T5882] usb 6-1: Using ep0 maxpacket: 8 [ 764.294035][ T5882] usb 6-1: unable to get BOS descriptor or descriptor too short [ 764.295454][ T5882] usb 6-1: config 6 has an invalid interface number: 86 but max is 0 [ 764.295481][ T5882] usb 6-1: config 6 has no interface number 0 [ 764.295515][ T5882] usb 6-1: config 6 interface 86 has no altsetting 0 [ 764.343402][ T5882] usb 6-1: New USB device found, idVendor=06cd, idProduct=0115, bcdDevice=93.3f [ 764.343433][ T5882] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.343451][ T5882] usb 6-1: Product: syz [ 764.343464][ T5882] usb 6-1: Manufacturer: syz [ 764.343477][ T5882] usb 6-1: SerialNumber: syz [ 764.518433][ T5881] snd-usb-audio 9-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 764.769314][ T9306] udevd[9306]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 764.778098][T12788] 9pnet_fd: Insufficient options for proto=fd [ 764.822818][ T9] usb 9-1: USB disconnect, device number 26 [ 764.905242][ T5882] keyspan 6-1:6.86: Keyspan 2 port adapter converter detected [ 764.910388][ T5882] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 87 [ 764.910524][ T5882] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 7 [ 764.946453][ T5882] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 81 [ 764.946550][ T5882] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 1 [ 764.946638][ T5882] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 2 [ 764.946703][ T5882] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 85 [ 764.946768][ T5882] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 5 [ 764.950998][ T5882] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 764.955562][ T5882] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 83 [ 764.955658][ T5882] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 3 [ 764.955747][ T5882] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 4 [ 764.955834][ T5882] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 86 [ 764.955922][ T5882] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 6 [ 765.008634][ T5882] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 765.054942][ T5882] usb 6-1: USB disconnect, device number 53 [ 765.074891][ T5882] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 765.101842][ T5882] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 765.102774][ T5882] keyspan 6-1:6.86: device disconnected [ 765.396376][T12803] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2009'. [ 765.396404][T12803] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2009'. [ 765.525462][T12802] netlink: 256 bytes leftover after parsing attributes in process `syz.6.2009'. [ 767.798854][ T5808] Bluetooth: hci4: command tx timeout [ 768.009826][ T1410] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.262321][T12791] chnl_net:caif_netlink_parms(): no params data found [ 768.483879][T12830] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2019'. [ 770.206759][ T5808] Bluetooth: hci4: command tx timeout [ 770.266438][ T9] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 770.354282][ T1410] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 770.422091][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 770.424688][ T9] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 770.424717][ T9] usb 1-1: config 0 has no interface number 0 [ 770.456502][ T9] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 770.456543][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.456565][ T9] usb 1-1: Product: syz [ 770.456581][ T9] usb 1-1: Manufacturer: syz [ 770.456597][ T9] usb 1-1: SerialNumber: syz [ 770.465027][ T9] usb 1-1: config 0 descriptor?? [ 770.520785][ T9] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 770.690573][T12837] netlink: 'syz.6.2018': attribute type 5 has an invalid length. [ 770.706741][ T9] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 770.741211][ T9] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 770.929561][ C0] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 114 [ 771.147028][T12825] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.147628][T12825] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 771.192831][ T37] audit: type=1326 audit(1772113009.534:228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12824 comm="syz.0.2014" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f80f424c629 code=0x0 [ 773.214057][ T5798] Bluetooth: hci4: command tx timeout [ 773.322491][ T1410] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.607605][ C0] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 773.609826][ T809] usb 1-1: USB disconnect, device number 51 [ 773.632728][ T809] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 773.646804][T12791] bridge0: port 1(bridge_slave_0) entered blocking state [ 773.646953][T12791] bridge0: port 1(bridge_slave_0) entered disabled state [ 773.647234][T12791] bridge_slave_0: entered allmulticast mode [ 773.683639][T12791] bridge_slave_0: entered promiscuous mode [ 773.713634][ T809] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 773.714573][ T809] quatech2 1-1:0.51: device disconnected [ 773.912093][ T1410] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.065612][T12791] bridge0: port 2(bridge_slave_1) entered blocking state [ 774.065858][T12791] bridge0: port 2(bridge_slave_1) entered disabled state [ 774.071130][T12791] bridge_slave_1: entered allmulticast mode [ 774.082211][T12791] bridge_slave_1: entered promiscuous mode [ 774.260224][T12791] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 774.264859][T12791] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 774.296241][ T809] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 774.386314][T12791] team0: Port device team_slave_0 added [ 774.436447][ T5881] usb 7-1: new high-speed USB device number 57 using dummy_hcd [ 774.460521][ T809] usb 1-1: Using ep0 maxpacket: 16 [ 774.463054][ T809] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=28.00 [ 774.463086][ T809] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 774.486286][ T5925] usb 9-1: new high-speed USB device number 27 using dummy_hcd [ 774.509760][ T809] usb 1-1: config 0 descriptor?? [ 774.514369][ T809] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 774.515669][ T809] usb 1-1: Detected FT2233HP [ 774.579485][T12791] team0: Port device team_slave_1 added [ 774.621361][ T5881] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 774.621449][ T5881] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 774.621468][ T5881] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 774.637059][ T5925] usb 9-1: Using ep0 maxpacket: 8 [ 774.662366][ T5925] usb 9-1: unable to get BOS descriptor or descriptor too short [ 774.674960][ T5925] usb 9-1: config 6 has an invalid interface number: 86 but max is 0 [ 774.674981][ T5925] usb 9-1: config 6 has no interface number 0 [ 774.675029][ T5925] usb 9-1: config 6 interface 86 has no altsetting 0 [ 774.713302][ T5925] usb 9-1: New USB device found, idVendor=06cd, idProduct=0115, bcdDevice=93.3f [ 774.713326][ T5925] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 774.713341][ T5925] usb 9-1: Product: syz [ 774.713352][ T5925] usb 9-1: Manufacturer: syz [ 774.713403][ T5925] usb 9-1: SerialNumber: syz [ 774.762145][ T5881] usb 7-1: config 0 descriptor?? [ 774.976027][ T5881] usbhid 7-1:0.0: can't add hid device: -71 [ 774.987214][ T5881] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 775.143736][ T5925] keyspan 9-1:6.86: Keyspan 2 port adapter converter detected [ 775.145053][ T5925] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 87 [ 775.145837][ T5925] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 7 [ 775.163314][ T5881] usb 7-1: USB disconnect, device number 57 [ 775.219155][ T5925] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 81 [ 775.219264][ T5925] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 1 [ 775.219323][ T5925] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 2 [ 775.219420][ T5925] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 85 [ 775.219477][ T5925] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 5 [ 775.229262][ T5798] Bluetooth: hci4: command tx timeout [ 775.303964][T12791] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 775.303984][T12791] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 775.304015][T12791] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 775.339985][ T5925] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 775.371226][T12791] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 775.371246][T12791] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 775.371278][T12791] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 775.454954][ T5925] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 83 [ 775.455042][ T5925] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 3 [ 775.455170][ T5925] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 4 [ 775.455288][ T5925] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 86 [ 775.455353][ T5925] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 6 [ 775.529064][ T5925] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB2 [ 775.571064][ T5925] usb 9-1: USB disconnect, device number 27 [ 775.636730][ T5925] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 775.641658][ T809] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 775.642032][ T809] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 775.690346][ T809] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 775.695111][T12875] tmpfs: Bad value for 'size' [ 775.729441][ T809] usb 1-1: USB disconnect, device number 52 [ 775.766268][ T5881] usb 7-1: new full-speed USB device number 58 using dummy_hcd [ 775.801198][ T5925] keyspan_2 ttyUSB2: Keyspan 2 port adapter converter now disconnected from ttyUSB2 [ 775.802090][ T5925] keyspan 9-1:6.86: device disconnected [ 775.868364][ T809] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 775.874584][ T809] ftdi_sio 1-1:0.0: device disconnected [ 776.139181][ T5881] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 776.139236][ T5881] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 776.139261][ T5881] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 776.909770][ T5881] usb 7-1: config 0 descriptor?? [ 776.940716][ T5881] hub 7-1:0.0: USB hub found [ 777.156269][ T5881] hub 7-1:0.0: 1 port detected [ 777.408255][T12791] hsr_slave_0: entered promiscuous mode [ 777.410854][T12791] hsr_slave_1: entered promiscuous mode [ 777.411867][T12791] debugfs: 'hsr0' already exists in 'hsr' [ 777.411894][T12791] Cannot create hsr debugfs directory [ 778.785326][ T5881] usb 7-1: USB disconnect, device number 58 [ 778.800586][ T809] hub 7-1:0.0: hub_ext_port_status failed (err = -71) [ 778.949184][T12897] FAULT_INJECTION: forcing a failure. [ 778.949184][T12897] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 778.949226][T12897] CPU: 0 UID: 0 PID: 12897 Comm: syz.0.2032 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 778.949257][T12897] Tainted: [L]=SOFTLOCKUP [ 778.949266][T12897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 778.949280][T12897] Call Trace: [ 778.949290][T12897] [ 778.949300][T12897] dump_stack_lvl+0xe8/0x150 [ 778.949339][T12897] should_fail_ex+0x46b/0x600 [ 778.949379][T12897] _copy_to_user+0x31/0xb0 [ 778.949407][T12897] bpf_prog_test_run_raw_tp+0x511/0x6c0 [ 778.949453][T12897] ? __pfx_bpf_prog_test_run_raw_tp+0x10/0x10 [ 778.949490][T12897] ? __fget_files+0x2a/0x420 [ 778.949522][T12897] ? __pfx_bpf_prog_test_run_raw_tp+0x10/0x10 [ 778.949559][T12897] bpf_prog_test_run+0x2cd/0x340 [ 778.949607][T12897] __sys_bpf+0x643/0x950 [ 778.949637][T12897] ? __pfx___sys_bpf+0x10/0x10 [ 778.949661][T12897] ? rt_mutex_slowunlock+0x1cb/0x300 [ 778.949703][T12897] ? ksys_write+0x248/0x270 [ 778.949736][T12897] ? __pfx_ksys_write+0x10/0x10 [ 778.949774][T12897] __x64_sys_bpf+0x7c/0x90 [ 778.949800][T12897] do_syscall_64+0x14d/0xf80 [ 778.949829][T12897] ? trace_irq_disable+0x3b/0x150 [ 778.949856][T12897] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 778.949879][T12897] ? clear_bhb_loop+0x40/0x90 [ 778.949909][T12897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 778.949944][T12897] RIP: 0033:0x7f80f424c629 [ 778.949966][T12897] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 778.949987][T12897] RSP: 002b:00007f80f24a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 778.950021][T12897] RAX: ffffffffffffffda RBX: 00007f80f44c5fa0 RCX: 00007f80f424c629 [ 778.950037][T12897] RDX: 000000000000000c RSI: 00002000000003c0 RDI: 000000000000000a [ 778.950052][T12897] RBP: 00007f80f24a6090 R08: 0000000000000000 R09: 0000000000000000 [ 778.950066][T12897] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 778.950079][T12897] R13: 00007f80f44c6038 R14: 00007f80f44c5fa0 R15: 00007ffd4484f0d8 [ 778.950114][T12897] [ 780.385983][ T1410] bridge_slave_1: left allmulticast mode [ 780.386016][ T1410] bridge_slave_1: left promiscuous mode [ 780.387897][ T1410] bridge0: port 2(bridge_slave_1) entered disabled state [ 780.632016][ T1410] bridge_slave_0: left allmulticast mode [ 780.632046][ T1410] bridge_slave_0: left promiscuous mode [ 780.642073][T12907] IPVS: set_ctl: invalid protocol: 98 127.0.0.1:20003 [ 780.667184][ T1410] bridge0: port 1(bridge_slave_0) entered disabled state [ 781.056370][ T9] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 783.099763][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 783.248829][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 783.250594][ T9] usb 6-1: config 6 has an invalid interface number: 86 but max is 0 [ 783.250622][ T9] usb 6-1: config 6 has no interface number 0 [ 783.250656][ T9] usb 6-1: config 6 interface 86 has no altsetting 0 [ 783.253332][ T9] usb 6-1: New USB device found, idVendor=06cd, idProduct=0115, bcdDevice=93.3f [ 783.253362][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 783.253385][ T9] usb 6-1: Product: syz [ 783.253400][ T9] usb 6-1: Manufacturer: syz [ 783.253415][ T9] usb 6-1: SerialNumber: syz [ 783.719704][ T5881] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 783.886304][ T5881] usb 1-1: Using ep0 maxpacket: 16 [ 783.889566][ T5881] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 783.889604][ T5881] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 783.889627][ T5881] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 783.889680][ T5881] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 783.889705][ T5881] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 783.922783][ T5881] usb 1-1: config 0 descriptor?? [ 784.386673][ T5881] microsoft 0003:045E:07DA.000D: unbalanced collection at end of report description [ 784.387712][ T5881] microsoft 0003:045E:07DA.000D: parse failed [ 784.387825][ T5881] microsoft 0003:045E:07DA.000D: probe with driver microsoft failed with error -22 [ 784.607679][ T5881] usb 1-1: USB disconnect, device number 53 [ 786.041491][ T1410] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 786.043878][T12930] loop3: detected capacity change from 0 to 3 [ 786.071448][T12930] Buffer I/O error on dev loop3, logical block 0, async page read [ 786.071519][T12930] Buffer I/O error on dev loop3, logical block 0, async page read [ 786.071695][T12930] Buffer I/O error on dev loop3, logical block 0, async page read [ 786.071816][T12930] Buffer I/O error on dev loop3, logical block 0, async page read [ 786.071858][T12930] Buffer I/O error on dev loop3, logical block 0, async page read [ 786.073063][T12930] ldm_validate_partition_table(): Disk read failed. [ 786.073123][T12930] Buffer I/O error on dev loop3, logical block 0, async page read [ 786.073243][T12930] Buffer I/O error on dev loop3, logical block 0, async page read [ 786.073286][T12930] Buffer I/O error on dev loop3, logical block 0, async page read [ 786.073396][T12930] Buffer I/O error on dev loop3, logical block 0, async page read [ 786.073422][T12930] Dev loop3: unable to read RDB block 0 [ 786.073462][T12930] Buffer I/O error on dev loop3, logical block 0, async page read [ 786.073884][T12930] loop3: unable to read partition table [ 786.074820][T12930] loop3: partition table beyond EOD, truncated [ 786.074864][T12930] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 786.156503][T12930] loop3: detected capacity change from 3 to 5 [ 786.256981][ T1410] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 786.347152][ T1410] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 786.424481][ T1410] bond0 (unregistering): Released all slaves [ 786.756219][ T5882] usb 7-1: new high-speed USB device number 59 using dummy_hcd [ 786.949769][ T9] keyspan 6-1:6.86: Keyspan 2 port adapter converter detected [ 786.950058][ T9] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 87 [ 786.950136][ T9] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 7 [ 786.952398][ T9] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 81 [ 786.952491][ T9] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 1 [ 786.952579][ T9] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 2 [ 786.952665][ T9] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 85 [ 786.952751][ T9] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 5 [ 787.106375][ T5882] usb 7-1: Using ep0 maxpacket: 16 [ 787.109241][ T5882] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 787.109269][ T5882] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 787.109310][ T5882] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 787.109336][ T5882] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 787.207229][ T9] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 787.209882][ T9] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 83 [ 787.209974][ T9] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 3 [ 787.210078][ T9] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 4 [ 787.210177][ T9] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 86 [ 787.210266][ T9] keyspan 6-1:6.86: found no endpoint descriptor for endpoint 6 [ 787.254390][ T9] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 787.401407][ T9] usb 6-1: USB disconnect, device number 54 [ 787.443236][ T5882] usb 7-1: config 0 descriptor?? [ 787.445090][ T9] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 787.451300][ T9] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 787.452184][ T9] keyspan 6-1:6.86: device disconnected [ 790.705640][ T5882] usb 7-1: USB disconnect, device number 59 [ 790.743498][T12964] FAULT_INJECTION: forcing a failure. [ 790.743498][T12964] name failslab, interval 1, probability 0, space 0, times 0 [ 790.743546][T12964] CPU: 1 UID: 0 PID: 12964 Comm: syz.5.2052 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 790.743577][T12964] Tainted: [L]=SOFTLOCKUP [ 790.743585][T12964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 790.743599][T12964] Call Trace: [ 790.743608][T12964] [ 790.743618][T12964] dump_stack_lvl+0xe8/0x150 [ 790.743658][T12964] should_fail_ex+0x46b/0x600 [ 790.743700][T12964] should_failslab+0xa8/0x100 [ 790.743737][T12964] __kmalloc_noprof+0xdf/0x7b0 [ 790.743770][T12964] ? kfree+0x4d/0x6c0 [ 790.743798][T12964] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 790.743840][T12964] tomoyo_realpath_from_path+0xe3/0x5d0 [ 790.743888][T12964] ? tomoyo_path_number_perm+0x219/0x630 [ 790.743917][T12964] tomoyo_path_number_perm+0x246/0x630 [ 790.743950][T12964] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 790.743983][T12964] ? __lock_acquire+0x6b5/0x2cf0 [ 790.744042][T12964] ? __fget_files+0x2a/0x420 [ 790.744073][T12964] ? __fget_files+0x2a/0x420 [ 790.744098][T12964] ? __fget_files+0x3a6/0x420 [ 790.744125][T12964] ? __fget_files+0x2a/0x420 [ 790.744156][T12964] security_file_ioctl+0xc3/0x2a0 [ 790.744188][T12964] __se_sys_ioctl+0x47/0x170 [ 790.744225][T12964] do_syscall_64+0x14d/0xf80 [ 790.744254][T12964] ? trace_irq_disable+0x3b/0x150 [ 790.744280][T12964] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 790.744305][T12964] ? clear_bhb_loop+0x40/0x90 [ 790.744332][T12964] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 790.744355][T12964] RIP: 0033:0x7f3d3e81c629 [ 790.744374][T12964] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 790.744394][T12964] RSP: 002b:00007f3d3ca76028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 790.744417][T12964] RAX: ffffffffffffffda RBX: 00007f3d3ea95fa0 RCX: 00007f3d3e81c629 [ 790.744434][T12964] RDX: 0000200000000280 RSI: 00000000c0505350 RDI: 0000000000000003 [ 790.744449][T12964] RBP: 00007f3d3ca76090 R08: 0000000000000000 R09: 0000000000000000 [ 790.744462][T12964] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 790.744476][T12964] R13: 00007f3d3ea96038 R14: 00007f3d3ea95fa0 R15: 00007ffd174c7738 [ 790.744512][T12964] [ 790.744541][T12964] ERROR: Out of memory at tomoyo_realpath_from_path. [ 791.441748][T12968] netlink: 80 bytes leftover after parsing attributes in process `syz.6.2054'. [ 791.734550][ T809] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 791.896381][ T809] usb 9-1: Using ep0 maxpacket: 8 [ 791.899110][ T809] usb 9-1: unable to get BOS descriptor or descriptor too short [ 791.900930][ T809] usb 9-1: config 6 has an invalid interface number: 86 but max is 0 [ 791.900958][ T809] usb 9-1: config 6 has no interface number 0 [ 791.900991][ T809] usb 9-1: config 6 interface 86 has no altsetting 0 [ 791.904473][ T809] usb 9-1: New USB device found, idVendor=06cd, idProduct=0115, bcdDevice=93.3f [ 791.904511][ T809] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 791.904533][ T809] usb 9-1: Product: syz [ 791.904549][ T809] usb 9-1: Manufacturer: syz [ 791.904565][ T809] usb 9-1: SerialNumber: syz [ 792.297737][ T809] keyspan 9-1:6.86: Keyspan 2 port adapter converter detected [ 792.298028][ T809] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 87 [ 792.298104][ T809] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 7 [ 792.320151][ T809] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 81 [ 792.320414][ T809] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 1 [ 792.320636][ T809] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 2 [ 792.320853][ T809] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 85 [ 792.321067][ T809] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 5 [ 792.353774][ T809] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 792.372804][ T809] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 83 [ 792.373059][ T809] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 3 [ 792.373188][ T809] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 4 [ 792.373268][ T809] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 86 [ 792.373406][ T809] keyspan 9-1:6.86: found no endpoint descriptor for endpoint 6 [ 792.441535][ T809] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 792.450677][ T809] usb 9-1: USB disconnect, device number 28 [ 792.581406][ T809] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 792.852586][ T809] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 792.853555][ T809] keyspan 9-1:6.86: device disconnected [ 794.072296][T13006] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2063'. [ 795.465879][T13006] netdevsim netdevsim8 netdevsim0: entered allmulticast mode [ 795.466581][T13006] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2063'. [ 797.125909][ T1410] hsr_slave_0: left promiscuous mode [ 797.148541][ T1410] hsr_slave_1: left promiscuous mode [ 797.149341][ T1410] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 797.149361][ T1410] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 797.193002][ T1410] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 797.193034][ T1410] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 797.368119][ T1410] veth1_macvtap: left promiscuous mode [ 797.385202][ T1410] veth0_macvtap: left promiscuous mode [ 797.409240][ T1410] veth1_vlan: left promiscuous mode [ 797.409429][ T1410] veth0_vlan: left promiscuous mode [ 797.795381][T13035] autofs4:pid:13035:check_dev_ioctl_version: ioctl control interface version mismatch: kernel(1.1), user(1986356271.1937072943), cmd(0xc0189374) [ 797.795417][T13035] autofs4:pid:13035:validate_dev_ioctl: invalid device control module version supplied for cmd(0xc0189374) [ 797.898848][ T9] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 797.936559][T13038] FAULT_INJECTION: forcing a failure. [ 797.936559][T13038] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 797.936600][T13038] CPU: 1 UID: 0 PID: 13038 Comm: syz.0.2075 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 797.936629][T13038] Tainted: [L]=SOFTLOCKUP [ 797.936637][T13038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 797.936651][T13038] Call Trace: [ 797.936660][T13038] [ 797.936670][T13038] dump_stack_lvl+0xe8/0x150 [ 797.936709][T13038] should_fail_ex+0x46b/0x600 [ 797.936747][T13038] _copy_from_user+0x2d/0xb0 [ 797.936775][T13038] sk_getsockopt+0x1d4/0x2790 [ 797.936812][T13038] ? __pfx_sk_getsockopt+0x10/0x10 [ 797.936855][T13038] ? __lock_acquire+0x6b5/0x2cf0 [ 797.936905][T13038] do_sock_getsockopt+0x223/0x3f0 [ 797.936940][T13038] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 797.936970][T13038] ? __fget_files+0x3a6/0x420 [ 797.936996][T13038] ? __fget_files+0x2a/0x420 [ 797.937029][T13038] __x64_sys_getsockopt+0x1aa/0x250 [ 797.937067][T13038] do_syscall_64+0x14d/0xf80 [ 797.937095][T13038] ? trace_irq_disable+0x3b/0x150 [ 797.937119][T13038] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 797.937143][T13038] ? clear_bhb_loop+0x40/0x90 [ 797.937171][T13038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 797.937194][T13038] RIP: 0033:0x7f80f424c629 [ 797.937215][T13038] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 797.937234][T13038] RSP: 002b:00007f80f24a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 797.937265][T13038] RAX: ffffffffffffffda RBX: 00007f80f44c5fa0 RCX: 00007f80f424c629 [ 797.937281][T13038] RDX: 0000000000000037 RSI: 0000000000000001 RDI: 0000000000000003 [ 797.937295][T13038] RBP: 00007f80f24a6090 R08: 0000200000000180 R09: 0000000000000000 [ 797.937310][T13038] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 797.937325][T13038] R13: 00007f80f44c6038 R14: 00007f80f44c5fa0 R15: 00007ffd4484f0d8 [ 797.937361][T13038] [ 798.166182][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 798.171524][T13039] netlink: 80 bytes leftover after parsing attributes in process `syz.6.2076'. [ 798.181730][ T9] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 798.181758][ T9] usb 6-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 798.181779][ T9] usb 6-1: config 179 has no interface number 0 [ 798.181837][ T9] usb 6-1: config 179 interface 65 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 798.181884][ T9] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 798.181910][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 798.987624][T13046] netlink: 'syz.5.2073': attribute type 1 has an invalid length. [ 798.987700][T13046] netlink: 'syz.5.2073': attribute type 2 has an invalid length. [ 799.041549][T13046] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 799.047136][T13046] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 800.548493][ T1410] team0 (unregistering): Port device team_slave_1 removed [ 800.597655][ T1410] team0 (unregistering): Port device team_slave_0 removed [ 800.874017][ T7527] usb 6-1: USB disconnect, device number 55 [ 801.049923][ T1432] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 801.442881][T13060] FAULT_INJECTION: forcing a failure. [ 801.442881][T13060] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 801.442924][T13060] CPU: 1 UID: 0 PID: 13060 Comm: syz.6.2083 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 801.442959][T13060] Tainted: [L]=SOFTLOCKUP [ 801.442968][T13060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 801.442983][T13060] Call Trace: [ 801.442993][T13060] [ 801.443004][T13060] dump_stack_lvl+0xe8/0x150 [ 801.443047][T13060] should_fail_ex+0x46b/0x600 [ 801.443090][T13060] _copy_from_user+0x2d/0xb0 [ 801.443121][T13060] do_ip_getsockopt+0x292/0x1d40 [ 801.443156][T13060] ? __lock_acquire+0x610/0x2cf0 [ 801.443183][T13060] ? __pfx_do_ip_getsockopt+0x10/0x10 [ 801.443219][T13060] ? kstrtouint+0x6e/0xe0 [ 801.443260][T13060] ? get_pid_task+0x20/0x1f0 [ 801.443292][T13060] ? __lock_acquire+0x6b5/0x2cf0 [ 801.443330][T13060] ? __lock_acquire+0x6b5/0x2cf0 [ 801.443362][T13060] ip_getsockopt+0xbb/0x230 [ 801.443400][T13060] ? __pfx_ip_getsockopt+0x10/0x10 [ 801.443437][T13060] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 801.443465][T13060] do_sock_getsockopt+0x2d3/0x3f0 [ 801.443499][T13060] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 801.443532][T13060] ? __fget_files+0x3a6/0x420 [ 801.443559][T13060] ? __fget_files+0x2a/0x420 [ 801.443594][T13060] __x64_sys_getsockopt+0x1aa/0x250 [ 801.443637][T13060] do_syscall_64+0x14d/0xf80 [ 801.443667][T13060] ? trace_irq_disable+0x3b/0x150 [ 801.443694][T13060] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 801.443729][T13060] ? clear_bhb_loop+0x40/0x90 [ 801.443760][T13060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 801.443784][T13060] RIP: 0033:0x7f74d90dc629 [ 801.443807][T13060] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 801.443829][T13060] RSP: 002b:00007f74d7336028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 801.443854][T13060] RAX: ffffffffffffffda RBX: 00007f74d9355fa0 RCX: 00007f74d90dc629 [ 801.443873][T13060] RDX: 0000000000000030 RSI: 0000000000000000 RDI: 0000000000000003 [ 801.443888][T13060] RBP: 00007f74d7336090 R08: 0000200000000180 R09: 0000000000000000 [ 801.443904][T13060] R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000001 [ 801.443919][T13060] R13: 00007f74d9356038 R14: 00007f74d9355fa0 R15: 00007ffd27a825f8 [ 801.443955][T13060] [ 801.781162][T12791] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 802.042890][T13066] FAULT_INJECTION: forcing a failure. [ 802.042890][T13066] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 802.042933][T13066] CPU: 0 UID: 0 PID: 13066 Comm: syz.5.2085 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 802.042966][T13066] Tainted: [L]=SOFTLOCKUP [ 802.042976][T13066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 802.042990][T13066] Call Trace: [ 802.043000][T13066] [ 802.043010][T13066] dump_stack_lvl+0xe8/0x150 [ 802.043054][T13066] should_fail_ex+0x46b/0x600 [ 802.043096][T13066] strncpy_from_user+0x36/0x2b0 [ 802.043137][T13066] do_getname+0x77/0x250 [ 802.043165][T13066] do_fchownat+0xe3/0x250 [ 802.043193][T13066] ? __pfx_do_fchownat+0x10/0x10 [ 802.043217][T13066] ? __pfx_ksys_write+0x10/0x10 [ 802.043257][T13066] __x64_sys_fchownat+0xb5/0xd0 [ 802.043284][T13066] do_syscall_64+0x14d/0xf80 [ 802.043314][T13066] ? trace_irq_disable+0x3b/0x150 [ 802.043347][T13066] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 802.043373][T13066] ? clear_bhb_loop+0x40/0x90 [ 802.043402][T13066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 802.043426][T13066] RIP: 0033:0x7f3d3e81c629 [ 802.043448][T13066] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 802.043470][T13066] RSP: 002b:00007f3d3ca76028 EFLAGS: 00000246 ORIG_RAX: 0000000000000104 [ 802.043496][T13066] RAX: ffffffffffffffda RBX: 00007f3d3ea95fa0 RCX: 00007f3d3e81c629 [ 802.043514][T13066] RDX: ffffffffffffffff RSI: 0000200000000080 RDI: 0000000000000004 [ 802.043529][T13066] RBP: 00007f3d3ca76090 R08: 0000000000000000 R09: 0000000000000000 [ 802.043544][T13066] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 802.043558][T13066] R13: 00007f3d3ea96038 R14: 00007f3d3ea95fa0 R15: 00007ffd174c7738 [ 802.043593][T13066] [ 802.575810][T12791] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 802.659980][T12791] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 802.772475][T12791] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 805.736296][T13105] binder: BINDER_SET_CONTEXT_MGR already set [ 805.736309][T13105] binder: 13101:13105 ioctl 4018620d 200000004a80 returned -16 [ 806.688745][ T70] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 807.081166][T12791] 8021q: adding VLAN 0 to HW filter on device bond0 [ 807.140147][T12791] 8021q: adding VLAN 0 to HW filter on device team0 [ 807.210550][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 807.210645][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 807.212288][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 807.212376][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 807.310491][T13116] FAULT_INJECTION: forcing a failure. [ 807.310491][T13116] name failslab, interval 1, probability 0, space 0, times 0 [ 807.310521][T13116] CPU: 0 UID: 0 PID: 13116 Comm: syz.0.2094 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 807.310544][T13116] Tainted: [L]=SOFTLOCKUP [ 807.310550][T13116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 807.310560][T13116] Call Trace: [ 807.310567][T13116] [ 807.310574][T13116] dump_stack_lvl+0xe8/0x150 [ 807.310604][T13116] should_fail_ex+0x46b/0x600 [ 807.310633][T13116] should_failslab+0xa8/0x100 [ 807.310658][T13116] __kmalloc_noprof+0xdf/0x7b0 [ 807.310680][T13116] ? tomoyo_encode+0x28b/0x550 [ 807.310707][T13116] tomoyo_encode+0x28b/0x550 [ 807.310733][T13116] tomoyo_realpath_from_path+0x58d/0x5d0 [ 807.310764][T13116] ? tomoyo_path_number_perm+0x219/0x630 [ 807.310784][T13116] tomoyo_path_number_perm+0x246/0x630 [ 807.310806][T13116] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 807.310828][T13116] ? __lock_acquire+0x6b5/0x2cf0 [ 807.310867][T13116] ? __fget_files+0x2a/0x420 [ 807.310888][T13116] ? __fget_files+0x2a/0x420 [ 807.310904][T13116] ? __fget_files+0x3a6/0x420 [ 807.310920][T13116] ? __fget_files+0x2a/0x420 [ 807.310941][T13116] security_file_ioctl+0xc3/0x2a0 [ 807.310964][T13116] __se_sys_ioctl+0x47/0x170 [ 807.310988][T13116] do_syscall_64+0x14d/0xf80 [ 807.311008][T13116] ? trace_irq_disable+0x3b/0x150 [ 807.311026][T13116] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.311042][T13116] ? clear_bhb_loop+0x40/0x90 [ 807.311060][T13116] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.311076][T13116] RIP: 0033:0x7f80f424c629 [ 807.311090][T13116] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 807.311105][T13116] RSP: 002b:00007f80f2485028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 807.311122][T13116] RAX: ffffffffffffffda RBX: 00007f80f44c6090 RCX: 00007f80f424c629 [ 807.311135][T13116] RDX: 0000200000000140 RSI: 0000000000005412 RDI: 0000000000000003 [ 807.311146][T13116] RBP: 00007f80f2485090 R08: 0000000000000000 R09: 0000000000000000 [ 807.311156][T13116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 807.311166][T13116] R13: 00007f80f44c6128 R14: 00007f80f44c6090 R15: 00007ffd4484f0d8 [ 807.311198][T13116] [ 807.311226][T13116] ERROR: Out of memory at tomoyo_realpath_from_path. [ 808.402724][T13124] FAULT_INJECTION: forcing a failure. [ 808.402724][T13124] name failslab, interval 1, probability 0, space 0, times 0 [ 808.402773][T13124] CPU: 0 UID: 0 PID: 13124 Comm: syz.0.2096 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 808.402805][T13124] Tainted: [L]=SOFTLOCKUP [ 808.402814][T13124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 808.402828][T13124] Call Trace: [ 808.402837][T13124] [ 808.402847][T13124] dump_stack_lvl+0xe8/0x150 [ 808.402886][T13124] should_fail_ex+0x46b/0x600 [ 808.402927][T13124] should_failslab+0xa8/0x100 [ 808.402966][T13124] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 808.402998][T13124] ? __alloc_skb+0x1d0/0x7d0 [ 808.403023][T13124] ? lockdep_hardirqs_on+0x7a/0x110 [ 808.403061][T13124] __alloc_skb+0x1d0/0x7d0 [ 808.403094][T13124] netlink_sendmsg+0x5d4/0xb40 [ 808.403128][T13124] ? __pfx_netlink_sendmsg+0x10/0x10 [ 808.403170][T13124] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 808.403208][T13124] ____sys_sendmsg+0xa4e/0xac0 [ 808.403248][T13124] ? __pfx_____sys_sendmsg+0x10/0x10 [ 808.403290][T13124] ? import_iovec+0x73/0xa0 [ 808.403321][T13124] ___sys_sendmsg+0x2a5/0x360 [ 808.403357][T13124] ? __pfx____sys_sendmsg+0x10/0x10 [ 808.403425][T13124] ? __fget_files+0x2a/0x420 [ 808.403452][T13124] ? __fget_files+0x3a6/0x420 [ 808.403490][T13124] __x64_sys_sendmsg+0x1c3/0x2a0 [ 808.403524][T13124] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 808.403566][T13124] ? __pfx_ksys_write+0x10/0x10 [ 808.403609][T13124] do_syscall_64+0x14d/0xf80 [ 808.403639][T13124] ? trace_irq_disable+0x3b/0x150 [ 808.403663][T13124] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.403688][T13124] ? clear_bhb_loop+0x40/0x90 [ 808.403718][T13124] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.403742][T13124] RIP: 0033:0x7f80f424c629 [ 808.403763][T13124] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 808.403784][T13124] RSP: 002b:00007f80f2485028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 808.403810][T13124] RAX: ffffffffffffffda RBX: 00007f80f44c6090 RCX: 00007f80f424c629 [ 808.403828][T13124] RDX: 00000000040008c0 RSI: 0000200000000280 RDI: 0000000000000003 [ 808.403843][T13124] RBP: 00007f80f2485090 R08: 0000000000000000 R09: 0000000000000000 [ 808.403858][T13124] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 808.403871][T13124] R13: 00007f80f44c6128 R14: 00007f80f44c6090 R15: 00007ffd4484f0d8 [ 808.403906][T13124] [ 808.768975][T12791] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 808.915316][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.915366][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.097085][T12791] veth0_vlan: entered promiscuous mode [ 809.142931][T12791] veth1_vlan: entered promiscuous mode [ 809.251447][T12791] veth0_macvtap: entered promiscuous mode [ 809.277146][T12791] veth1_macvtap: entered promiscuous mode [ 809.330292][T12791] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 809.355583][T12791] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 809.385074][ T1432] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 809.415529][ T1432] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 809.416054][ T1432] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 809.418692][ T1432] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 813.436316][T13148] binder: BINDER_SET_CONTEXT_MGR already set [ 813.436329][T13148] binder: 13145:13148 ioctl 4018620d 200000004a80 returned -16 [ 814.329768][ T7841] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 814.329791][ T7841] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 814.430307][ T7841] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 814.430331][ T7841] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 815.515306][T13160] FAULT_INJECTION: forcing a failure. [ 815.515306][T13160] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 815.515337][T13160] CPU: 0 UID: 0 PID: 13160 Comm: syz.1.2107 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 815.515360][T13160] Tainted: [L]=SOFTLOCKUP [ 815.515367][T13160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 815.515377][T13160] Call Trace: [ 815.515384][T13160] [ 815.515391][T13160] dump_stack_lvl+0xe8/0x150 [ 815.515420][T13160] should_fail_ex+0x46b/0x600 [ 815.515450][T13160] _copy_from_user+0x2d/0xb0 [ 815.515478][T13160] memdup_user+0x5e/0xd0 [ 815.515499][T13160] strndup_user+0x68/0xd0 [ 815.515519][T13160] __se_sys_mount+0x9d/0x420 [ 815.515539][T13160] ? ksys_write+0x248/0x270 [ 815.515564][T13160] ? __pfx___se_sys_mount+0x10/0x10 [ 815.515588][T13160] ? __x64_sys_mount+0x20/0xc0 [ 815.515608][T13160] do_syscall_64+0x14d/0xf80 [ 815.515629][T13160] ? trace_irq_disable+0x3b/0x150 [ 815.515648][T13160] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 815.515665][T13160] ? clear_bhb_loop+0x40/0x90 [ 815.515685][T13160] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 815.515702][T13160] RIP: 0033:0x7fc9ea99c629 [ 815.515719][T13160] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 815.515733][T13160] RSP: 002b:00007fc9e8bee028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 815.515750][T13160] RAX: ffffffffffffffda RBX: 00007fc9eac15fa0 RCX: 00007fc9ea99c629 [ 815.515762][T13160] RDX: 0000200000000000 RSI: 0000200000000300 RDI: 0000000000000000 [ 815.515773][T13160] RBP: 00007fc9e8bee090 R08: 00002000000001c0 R09: 0000000000000000 [ 815.515784][T13160] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 815.515794][T13160] R13: 00007fc9eac16038 R14: 00007fc9eac15fa0 R15: 00007ffc7329b048 [ 815.515819][T13160] [ 817.690230][T13176] netlink: 104 bytes leftover after parsing attributes in process `syz.5.2113'. [ 817.815708][T13178] fuse: Bad value for 'fd' [ 818.832254][T13180] binder: BINDER_SET_CONTEXT_MGR already set [ 818.832267][T13180] binder: 13179:13180 ioctl 4018620d 200000004a80 returned -16 [ 819.092032][T13198] fuse: Bad value for 'rootmode' [ 820.790944][T13206] netlink: 80 bytes leftover after parsing attributes in process `syz.8.2120'. [ 822.178909][T13218] netlink: 104 bytes leftover after parsing attributes in process `syz.5.2124'. [ 823.174989][T13221] netlink: 'syz.0.2126': attribute type 5 has an invalid length. [ 826.470004][T13254] binder: BINDER_SET_CONTEXT_MGR already set [ 826.470038][T13254] binder: 13250:13254 ioctl 4018620d 200000004a80 returned -16 [ 827.097745][T13256] fuse: Bad value for 'fd' [ 827.228292][T13263] overlay: ./file0 is not a directory [ 828.980588][T13273] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2137'. [ 829.048343][T13276] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2138'. [ 830.508386][ T5882] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 830.686195][ T5882] usb 6-1: Using ep0 maxpacket: 8 [ 830.690003][ T5882] usb 6-1: unable to get BOS descriptor or descriptor too short [ 830.695633][ T5882] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 830.695692][ T5882] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 830.695722][ T5882] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 830.769529][ T5882] usb 6-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 830.769587][ T5882] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 830.797304][ T5882] usb 6-1: Product: syz [ 830.797328][ T5882] usb 6-1: Manufacturer: syz [ 830.797345][ T5882] usb 6-1: SerialNumber: syz [ 830.820847][ T5882] usb 6-1: config 0 descriptor?? [ 830.835808][ T5882] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 830.980081][ T5882] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 832.412338][T13279] 9pnet_fd: Insufficient options for proto=fd [ 832.466353][T12427] usb 6-1: USB disconnect, device number 56 [ 832.480288][T13293] binder: BINDER_SET_CONTEXT_MGR already set [ 832.480301][T13293] binder: 13292:13293 ioctl 4018620d 200000004a80 returned -16 [ 832.874540][T13302] netlink: 'syz.6.2145': attribute type 5 has an invalid length. [ 834.096943][ T9317] udevd[9317]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 835.037947][T13333] autofs4:pid:13333:check_dev_ioctl_version: ioctl control interface version mismatch: kernel(1.1), user(1986356271.1937072943), cmd(0xc0189374) [ 835.037974][T13333] autofs4:pid:13333:validate_dev_ioctl: invalid device control module version supplied for cmd(0xc0189374) [ 840.076277][T12427] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 840.200681][T13372] autofs4:pid:13372:check_dev_ioctl_version: ioctl control interface version mismatch: kernel(1.1), user(1986356271.1937072943), cmd(0xc0189374) [ 840.200709][T13372] autofs4:pid:13372:validate_dev_ioctl: invalid device control module version supplied for cmd(0xc0189374) [ 840.256181][T12427] usb 2-1: Using ep0 maxpacket: 16 [ 840.258502][T12427] usb 2-1: config 0 has an invalid interface number: 126 but max is 0 [ 840.258532][T12427] usb 2-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 840.258553][T12427] usb 2-1: config 0 has no interface number 0 [ 840.258608][T12427] usb 2-1: config 0 interface 126 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 840.258637][T12427] usb 2-1: config 0 interface 126 altsetting 0 endpoint 0x87 has invalid maxpacket 34328, setting to 1024 [ 840.258666][T12427] usb 2-1: config 0 interface 126 altsetting 0 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 840.258701][T12427] usb 2-1: config 0 interface 126 altsetting 0 endpoint 0x4 has invalid maxpacket 26159, setting to 1024 [ 840.258729][T12427] usb 2-1: config 0 interface 126 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1024 [ 840.258754][T12427] usb 2-1: config 0 interface 126 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 840.258798][T12427] usb 2-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=56.88 [ 840.258823][T12427] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 840.335458][T12427] usb 2-1: config 0 descriptor?? [ 840.338653][T13363] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 840.339030][T13363] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 840.463008][T12427] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 840.500174][T13375] netlink: 'syz.0.2165': attribute type 1 has an invalid length. [ 841.773850][T13378] loop7: detected capacity change from 0 to 7 [ 841.804755][T13378] buffer_io_error: 12 callbacks suppressed [ 841.804780][T13378] Buffer I/O error on dev loop7, logical block 0, async page read [ 841.804831][T13378] Buffer I/O error on dev loop7, logical block 0, async page read [ 841.804873][T13378] Buffer I/O error on dev loop7, logical block 0, async page read [ 841.804904][T13378] Buffer I/O error on dev loop7, logical block 0, async page read [ 841.804953][T13378] Buffer I/O error on dev loop7, logical block 0, async page read [ 841.805001][T13378] Buffer I/O error on dev loop7, logical block 0, async page read [ 841.805033][T13378] Buffer I/O error on dev loop7, logical block 0, async page read [ 841.805051][T13378] ldm_validate_partition_table(): Disk read failed. [ 841.805077][T13378] Buffer I/O error on dev loop7, logical block 0, async page read [ 841.805107][T13378] Buffer I/O error on dev loop7, logical block 0, async page read [ 841.805138][T13378] Buffer I/O error on dev loop7, logical block 0, async page read [ 841.805171][T13378] Dev loop7: unable to read RDB block 0 [ 841.805237][T13378] loop7: unable to read partition table [ 841.805425][T13378] loop7: partition table beyond EOD, truncated [ 841.805446][T13378] loop_reread_partitions: partition scan of loop7 (7x~Sj̖P@?X) failed (rc=-5) [ 844.485315][ T5882] usb 2-1: USB disconnect, device number 67 [ 844.789989][T13401] netlink: 80 bytes leftover after parsing attributes in process `syz.8.2173'. [ 850.212253][T13431] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2180'. [ 856.723257][T13476] ubi31: attaching mtd0 [ 856.739618][T13476] ubi31: scanning is finished [ 856.739639][T13476] ubi31: empty MTD device detected [ 857.677876][T13141] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 857.826236][T13141] usb 1-1: Using ep0 maxpacket: 16 [ 857.828989][T13141] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 857.829051][T13141] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 857.829083][T13141] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 857.829107][T13141] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 857.829133][T13141] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 857.830728][T13141] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 857.830759][T13141] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 857.830782][T13141] usb 1-1: Manufacturer: syz [ 857.842464][T13141] usb 1-1: config 0 descriptor?? [ 858.236181][T13141] rc_core: IR keymap rc-hauppauge not found [ 858.236203][T13141] Registered IR keymap rc-empty [ 858.236376][T13141] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 858.256776][T13141] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 858.320445][T13141] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 858.324161][T13141] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input38 [ 858.380786][T13476] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 858.380810][T13476] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 858.380824][T13476] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 858.380837][T13476] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 858.380850][T13476] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 858.380863][T13476] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 858.380883][T13476] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 322423594 [ 858.380899][T13476] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 858.384082][T13495] ubi31: background thread "ubi_bgt31d" started, PID 13495 [ 858.475828][T13141] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 858.486411][T13141] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 858.506974][T13141] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 858.526475][T13141] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 858.546406][T13141] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 858.566499][T13141] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 858.586342][T13141] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 858.606359][T13141] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 858.636363][T13141] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 858.657055][T13141] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 858.756143][T13141] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 858.756172][T13141] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 858.817234][T13141] usb 1-1: USB disconnect, device number 54 [ 861.305523][T13517] netlink: 80 bytes leftover after parsing attributes in process `syz.6.2207'. [ 861.514903][T13511] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 862.229299][T13536] openvswitch: netlink: VXLAN extension 292 out of range max 1 [ 862.686216][ T5882] usb 9-1: new high-speed USB device number 29 using dummy_hcd [ 862.836177][ T5882] usb 9-1: Using ep0 maxpacket: 8 [ 862.838655][ T5882] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 862.838715][ T5882] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 862.838740][ T5882] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 862.838767][ T5882] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 862.838802][ T5882] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 862.838847][ T5882] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 862.838873][ T5882] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 863.063857][T13541] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 863.064427][T13541] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 863.068429][ T5882] usb 9-1: usb_control_msg returned -32 [ 863.068566][ T5882] usbtmc 9-1:16.0: can't read capabilities [ 863.275175][T13549] binfmt_misc: register: failed to install interpreter file ./file0 [ 864.189553][T13557] ntfs3(nullb0): Primary boot signature is not NTFS. [ 864.230851][T13557] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 865.088941][T13570] FAULT_INJECTION: forcing a failure. [ 865.088941][T13570] name failslab, interval 1, probability 0, space 0, times 0 [ 865.088982][T13570] CPU: 0 UID: 0 PID: 13570 Comm: syz.1.2227 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 865.089014][T13570] Tainted: [L]=SOFTLOCKUP [ 865.089023][T13570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 865.089038][T13570] Call Trace: [ 865.089048][T13570] [ 865.089059][T13570] dump_stack_lvl+0xe8/0x150 [ 865.089098][T13570] should_fail_ex+0x46b/0x600 [ 865.089141][T13570] should_failslab+0xa8/0x100 [ 865.089178][T13570] __kmalloc_noprof+0xdf/0x7b0 [ 865.089214][T13570] ? tomoyo_encode+0x28b/0x550 [ 865.089263][T13570] tomoyo_encode+0x28b/0x550 [ 865.089305][T13570] tomoyo_realpath_from_path+0x58d/0x5d0 [ 865.089371][T13570] ? tomoyo_path_number_perm+0x219/0x630 [ 865.089402][T13570] tomoyo_path_number_perm+0x246/0x630 [ 865.089436][T13570] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 865.089469][T13570] ? sb_end_write+0xe9/0x1c0 [ 865.089495][T13570] ? vfs_write+0x9ce/0xba0 [ 865.089564][T13570] ? ksys_write+0x202/0x270 [ 865.089604][T13570] security_file_ioctl+0xc3/0x2a0 [ 865.089646][T13570] __se_sys_ioctl+0x47/0x170 [ 865.089684][T13570] do_syscall_64+0x14d/0xf80 [ 865.089717][T13570] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 865.089742][T13570] ? clear_bhb_loop+0x40/0x90 [ 865.089771][T13570] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 865.089794][T13570] RIP: 0033:0x7fc9ea99c629 [ 865.089816][T13570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 865.089838][T13570] RSP: 002b:00007fc9e8bee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 865.089862][T13570] RAX: ffffffffffffffda RBX: 00007fc9eac15fa0 RCX: 00007fc9ea99c629 [ 865.089880][T13570] RDX: 0000000000000000 RSI: 000000000000b704 RDI: 0000000000000003 [ 865.089894][T13570] RBP: 00007fc9e8bee090 R08: 0000000000000000 R09: 0000000000000000 [ 865.089909][T13570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 865.089922][T13570] R13: 00007fc9eac16038 R14: 00007fc9eac15fa0 R15: 00007ffc7329b048 [ 865.089958][T13570] [ 865.089980][T13570] ERROR: Out of memory at tomoyo_realpath_from_path. [ 865.431987][T13572] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2229'. [ 867.629133][T13141] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 867.785495][T13141] usb 1-1: Using ep0 maxpacket: 16 [ 868.063209][T13141] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 868.063297][T13141] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 868.063378][T13141] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 868.063431][T13141] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 868.137989][T13141] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 868.138023][T13141] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 868.138046][T13141] usb 1-1: SerialNumber: syz [ 868.228882][T13141] cdc_acm 1-1:1.0: skipping garbage [ 868.230593][T13141] cdc_acm 1-1:1.0: probe with driver cdc_acm failed with error -12 [ 868.524666][T13547] usbtmc 9-1:16.0: usb_control_msg returned -110 [ 868.530135][T13542] usbtmc 9-1:16.0: usb_control_msg returned -32 [ 868.658669][T13141] usb 9-1: USB disconnect, device number 29 [ 868.788903][T13607] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2238'. [ 868.841613][T13609] netlink: 'syz.8.2241': attribute type 10 has an invalid length. [ 868.992207][T13614] FAULT_INJECTION: forcing a failure. [ 868.992207][T13614] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 868.992256][T13614] CPU: 0 UID: 0 PID: 13614 Comm: syz.1.2239 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 868.992298][T13614] Tainted: [L]=SOFTLOCKUP [ 868.992308][T13614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 868.992324][T13614] Call Trace: [ 868.992335][T13614] [ 868.992345][T13614] dump_stack_lvl+0xe8/0x150 [ 868.992388][T13614] should_fail_ex+0x46b/0x600 [ 868.992431][T13614] strncpy_from_user+0x36/0x2b0 [ 868.992471][T13614] path_setxattrat+0x191/0x440 [ 868.992517][T13614] ? __pfx_path_setxattrat+0x10/0x10 [ 868.992580][T13614] ? ksys_write+0x248/0x270 [ 868.992616][T13614] ? __pfx_ksys_write+0x10/0x10 [ 868.992646][T13614] ? __task_pid_nr_ns+0x28/0x470 [ 868.992678][T13614] __x64_sys_lsetxattr+0xbf/0xe0 [ 868.992713][T13614] do_syscall_64+0x14d/0xf80 [ 868.992746][T13614] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 868.992772][T13614] ? clear_bhb_loop+0x40/0x90 [ 868.992800][T13614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 868.992824][T13614] RIP: 0033:0x7fc9ea99c629 [ 868.992845][T13614] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 868.992866][T13614] RSP: 002b:00007fc9e8bee028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd [ 868.992891][T13614] RAX: ffffffffffffffda RBX: 00007fc9eac15fa0 RCX: 00007fc9ea99c629 [ 868.992909][T13614] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000200000000280 [ 868.992924][T13614] RBP: 00007fc9e8bee090 R08: 0000000000000001 R09: 0000000000000000 [ 868.992940][T13614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 868.992955][T13614] R13: 00007fc9eac16038 R14: 00007fc9eac15fa0 R15: 00007ffc7329b048 [ 868.992990][T13614] [ 869.166537][T13141] usb 7-1: new full-speed USB device number 60 using dummy_hcd [ 869.370524][T13141] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 869.370557][T13141] usb 7-1: config 0 has no interface number 0 [ 869.370628][T13141] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 869.370659][T13141] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 869.370702][T13141] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 869.370728][T13141] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 869.436450][T13141] usb 7-1: config 0 descriptor?? [ 869.490554][T13141] iowarrior 7-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 869.646887][T12427] usb 7-1: USB disconnect, device number 60 [ 870.406981][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.407058][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.936693][ T5998] usb 1-1: USB disconnect, device number 55 [ 871.145836][T13632] mmap: syz.0.2247 (13632): VmData 37724160 exceed data ulimit 93. Update limits or use boot option ignore_rlimit_data. [ 871.479499][T13641] tipc: Started in network mode [ 871.479532][T13641] tipc: Node identity , cluster identity 4711 [ 874.599949][T13670] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2257'. [ 875.928241][T12427] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 876.096309][T12427] usb 2-1: Using ep0 maxpacket: 32 [ 876.100624][T12427] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 876.100661][T12427] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 876.100705][T12427] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 876.100732][T12427] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 876.162015][T12427] usb 2-1: config 0 descriptor?? [ 876.188616][T12427] hub 2-1:0.0: USB hub found [ 876.418448][T12427] hub 2-1:0.0: config failed, can't read hub descriptor (err -90) [ 876.637153][T12427] usbhid 2-1:0.0: can't add hid device: -71 [ 876.637279][T12427] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 876.661176][T12427] usb 2-1: USB disconnect, device number 68 [ 881.816237][T13778] vlan2: entered promiscuous mode [ 881.816263][T13778] bridge0: entered promiscuous mode [ 881.827068][T13778] bridge0: port 3(vlan2) entered blocking state [ 881.827462][T13778] bridge0: port 3(vlan2) entered disabled state [ 881.827678][T13778] vlan2: entered allmulticast mode [ 881.827696][T13778] bridge0: entered allmulticast mode [ 881.905964][T13778] vlan2: left allmulticast mode [ 881.905992][T13778] bridge0: left allmulticast mode [ 883.936614][T13811] kvm: pic: non byte read [ 883.951405][T13811] kvm: pic: level sensitive irq not supported [ 883.951587][T13811] kvm: pic: non byte read [ 883.951835][T13811] kvm: pic: level sensitive irq not supported [ 883.951907][T13811] kvm: pic: non byte read [ 883.952136][T13811] kvm: pic: level sensitive irq not supported [ 883.952198][T13811] kvm: pic: non byte read [ 883.952433][T13811] kvm: pic: level sensitive irq not supported [ 883.952494][T13811] kvm: pic: non byte read [ 883.952719][T13811] kvm: pic: level sensitive irq not supported [ 883.952780][T13811] kvm: pic: non byte read [ 883.953055][T13811] kvm: pic: level sensitive irq not supported [ 883.953116][T13811] kvm: pic: non byte read [ 883.953343][T13811] kvm: pic: level sensitive irq not supported [ 883.953405][T13811] kvm: pic: non byte read [ 883.953634][T13811] kvm: pic: level sensitive irq not supported [ 883.953695][T13811] kvm: pic: non byte read [ 885.320294][T13824] netlink: 104 bytes leftover after parsing attributes in process `syz.1.2298'. [ 885.346176][ T7527] usb 7-1: new high-speed USB device number 61 using dummy_hcd [ 885.497490][ T7527] usb 7-1: Using ep0 maxpacket: 32 [ 885.502553][ T7527] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 885.502588][ T7527] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 885.514165][ T7527] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.50 [ 885.514261][ T7527] usb 7-1: New USB device strings: Mfr=0, Product=32, SerialNumber=0 [ 885.514316][ T7527] usb 7-1: Product: syz [ 885.563904][ T7527] usb 7-1: config 0 descriptor?? [ 885.577060][ T7527] hub 7-1:0.0: USB hub found [ 885.784249][ T7527] hub 7-1:0.0: 1 port detected [ 885.831238][T13835] 9p: Bad value for 'rfdno' [ 886.015342][ T7527] hub 7-1:0.0: hub_hub_status failed (err = -71) [ 886.015372][ T7527] hub 7-1:0.0: config failed, can't get hub status (err -71) [ 886.042504][ T7527] usbhid 7-1:0.0: can't add hid device: -71 [ 886.042644][ T7527] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 886.078709][ T7527] usb 7-1: USB disconnect, device number 61 [ 887.539423][T13856] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2311'. [ 887.539466][T13856] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 887.644185][T13860] netlink: 104 bytes leftover after parsing attributes in process `syz.8.2312'. [ 887.661830][T13862] af_packet: tpacket_rcv: packet too big, clamped from 38 to 4294967286. macoff=82 [ 887.789662][ T5798] Bluetooth: hci4: command 0x0406 tx timeout [ 889.261913][T13884] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2319'. [ 891.386370][ T5925] usb 7-1: new high-speed USB device number 62 using dummy_hcd [ 891.407631][T13906] netlink: 64 bytes leftover after parsing attributes in process `syz.5.2326'. [ 891.547099][ T5925] usb 7-1: Using ep0 maxpacket: 16 [ 891.549431][ T5925] usb 7-1: config 0 interface 0 has no altsetting 0 [ 891.549471][ T5925] usb 7-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 891.549496][ T5925] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 891.555058][ T5925] usb 7-1: config 0 descriptor?? [ 892.028408][ T5925] hid (null): report_id 0 is invalid [ 892.257044][ T7527] usb 7-1: USB disconnect, device number 62 [ 893.766714][T13924] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 894.044093][T13924] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 894.612223][T13924] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 895.177370][T13949] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 896.079272][ T5808] Bluetooth: hci1: command 0x0406 tx timeout [ 896.085468][T13924] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 896.085561][T13924] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 896.113253][T13957] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 896.358890][T13924] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 896.367143][T13924] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 896.432527][T13924] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 896.432661][T13924] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 896.459828][T13959] bridge0: entered promiscuous mode [ 896.474789][T13959] bridge0: port 3(macsec1) entered blocking state [ 896.474930][T13959] bridge0: port 3(macsec1) entered disabled state [ 896.475201][T13959] macsec1: entered allmulticast mode [ 896.475219][T13959] bridge0: entered allmulticast mode [ 896.557798][T13924] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 896.557895][T13924] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 896.564804][T13959] macsec1: left allmulticast mode [ 896.564821][T13959] bridge0: left allmulticast mode [ 896.622475][T13959] bridge0: left promiscuous mode [ 897.875939][ T5925] usb 9-1: new high-speed USB device number 30 using dummy_hcd [ 898.106337][ T5808] Bluetooth: hci2: command 0x0406 tx timeout [ 898.106385][ T5808] Bluetooth: hci1: command 0x0406 tx timeout [ 898.426184][ T5798] Bluetooth: hci5: command 0x0406 tx timeout [ 898.506367][ T5798] Bluetooth: hci0: command 0x0406 tx timeout [ 898.586206][ T5798] Bluetooth: hci4: command 0x0406 tx timeout [ 900.186958][ T5808] Bluetooth: hci2: command 0x0406 tx timeout [ 900.187299][ T5798] Bluetooth: hci1: command 0x0406 tx timeout [ 900.908403][ T5798] Bluetooth: hci5: command 0x0406 tx timeout [ 900.908456][ T5798] Bluetooth: hci0: command 0x0406 tx timeout [ 900.908486][ T5798] Bluetooth: hci4: command 0x0406 tx timeout [ 901.376207][ T5998] usb 7-1: new high-speed USB device number 63 using dummy_hcd [ 901.626229][ T5998] usb 7-1: Using ep0 maxpacket: 32 [ 901.628867][ T5998] usb 7-1: config 0 has an invalid interface number: 184 but max is 0 [ 901.628895][ T5998] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 901.628916][ T5998] usb 7-1: config 0 has no interface number 0 [ 901.628964][ T5998] usb 7-1: config 0 interface 184 altsetting 7 endpoint 0x6 has invalid wMaxPacketSize 0 [ 901.628990][ T5998] usb 7-1: config 0 interface 184 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 901.629019][ T5998] usb 7-1: config 0 interface 184 has no altsetting 0 [ 901.632345][ T5998] usb 7-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 901.632377][ T5998] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.632398][ T5998] usb 7-1: Product: syz [ 901.632415][ T5998] usb 7-1: Manufacturer: syz [ 901.632431][ T5998] usb 7-1: SerialNumber: syz [ 901.764753][ T5998] usb 7-1: config 0 descriptor?? [ 901.804991][ T5998] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 901.805276][ T5998] smsc75xx 7-1:0.184: probe with driver smsc75xx failed with error -22 [ 902.013480][ T5998] usb 7-1: USB disconnect, device number 63 [ 909.790749][T14072] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 910.042593][T14072] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 910.071229][T14072] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 910.087981][T14072] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 910.090360][T14072] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 911.147569][T14094] Bluetooth: hci1: command 0x0406 tx timeout [ 912.602277][T14094] Bluetooth: hci4: command 0x0406 tx timeout [ 912.602327][T14094] Bluetooth: hci0: command 0x0406 tx timeout [ 912.602361][T14094] Bluetooth: hci5: command 0x0406 tx timeout [ 912.602392][T14094] Bluetooth: hci2: command 0x0406 tx timeout [ 916.815848][ T5925] usb 2-1: new full-speed USB device number 69 using dummy_hcd [ 918.000858][ T5925] usb 2-1: config 2 has an invalid interface number: 88 but max is 0 [ 918.000887][ T5925] usb 2-1: config 2 has no interface number 0 [ 918.000935][ T5925] usb 2-1: config 2 interface 88 altsetting 7 endpoint 0x6 has invalid maxpacket 256, setting to 64 [ 918.000961][ T5925] usb 2-1: config 2 interface 88 altsetting 7 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 918.000992][ T5925] usb 2-1: config 2 interface 88 has no altsetting 0 [ 918.055924][ T5925] usb 2-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.1e [ 918.055959][ T5925] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 918.055981][ T5925] usb 2-1: Product: syz [ 918.055998][ T5925] usb 2-1: Manufacturer: syz [ 918.056201][ T5925] usb 2-1: SerialNumber: syz [ 918.099265][T14151] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 918.099410][T14151] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 918.327032][T14151] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 918.327185][T14151] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 918.535976][ T5925] asix 2-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 918.547019][ T5925] asix 2-1:2.88: probe with driver asix failed with error -71 [ 918.578621][ T5925] usb 2-1: USB disconnect, device number 69 [ 918.583405][ T7527] kernel write not supported for file /uinput (pid: 7527 comm: kworker/0:8) [ 918.611212][T14152] udevd[14152]: setting owner of /dev/bus/usb/002/069 to uid=0, gid=0 failed: No such file or directory [ 920.534572][T14205] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2423'. [ 920.666308][ T5925] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 920.716372][T14206] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 920.872047][ T5925] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 920.872081][ T5925] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 920.872103][ T5925] usb 1-1: config 220 has no interface number 2 [ 920.872188][ T5925] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 920.872221][ T5925] usb 1-1: config 220 interface 0 has no altsetting 0 [ 920.872243][ T5925] usb 1-1: config 220 interface 76 has no altsetting 0 [ 920.872264][ T5925] usb 1-1: config 220 interface 1 has no altsetting 0 [ 920.939952][ T5925] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 920.939982][ T5925] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 920.940004][ T5925] usb 1-1: Product: syz [ 920.940020][ T5925] usb 1-1: Manufacturer: syz [ 920.940036][ T5925] usb 1-1: SerialNumber: syz [ 921.000270][T14208] : Can't lookup blockdev [ 921.308821][ T5925] usb 1-1: selecting invalid altsetting 0 [ 921.340306][ T5925] uvcvideo 1-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 921.340347][ T5925] uvcvideo 1-1:220.0: No valid video chain found. [ 921.375672][ T5925] usb 1-1: selecting invalid altsetting 0 [ 921.375723][ T5925] usbtest 1-1:220.1: probe with driver usbtest failed with error -22 [ 921.602863][T14210] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2426'. [ 922.408571][ T5925] usb 1-1: USB disconnect, device number 56 [ 922.976246][ T9] usb 9-1: new high-speed USB device number 31 using dummy_hcd [ 923.126236][ T9] usb 9-1: Using ep0 maxpacket: 32 [ 923.128896][ T9] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 923.133213][ T9] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 923.133243][ T9] usb 9-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 923.133264][ T9] usb 9-1: Product: syz [ 923.133279][ T9] usb 9-1: Manufacturer: syz [ 923.133295][ T9] usb 9-1: SerialNumber: syz [ 923.197870][ T9] usb 9-1: config 0 descriptor?? [ 923.251371][ T9] hub 9-1:0.0: bad descriptor, ignoring hub [ 923.251415][ T9] hub 9-1:0.0: probe with driver hub failed with error -5 [ 924.811534][T14237] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2437'. [ 924.932740][T14242] kvm: pic: level sensitive irq not supported [ 924.933590][T14242] kvm: pic: single mode not supported [ 924.933606][T14242] kvm: pic: level sensitive irq not supported [ 924.933825][T14242] kvm: pic: non byte write [ 924.933980][T14242] kvm: pic: non byte write [ 924.934126][T14242] kvm: pic: non byte write [ 924.934264][T14242] kvm: pic: non byte write [ 924.935261][T14242] kvm: pic: non byte write [ 924.997833][T14237] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 925.005156][T14242] kvm: pic: non byte write [ 927.502559][ T5998] usb 9-1: USB disconnect, device number 31 [ 928.306212][ T5881] usb 7-1: new high-speed USB device number 64 using dummy_hcd [ 929.576920][ T5881] usb 7-1: config 14 has an invalid interface number: 21 but max is 0 [ 929.576960][ T5881] usb 7-1: config 14 has no interface number 0 [ 929.577009][ T5881] usb 7-1: config 14 interface 21 altsetting 251 bulk endpoint 0xA has invalid maxpacket 32 [ 929.577037][ T5881] usb 7-1: config 14 interface 21 has no altsetting 0 [ 929.585537][ T5881] usb 7-1: string descriptor 0 read error: -22 [ 929.585701][ T5881] usb 7-1: New USB device found, idVendor=c880, idProduct=760e, bcdDevice=35.fc [ 929.585727][ T5881] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 929.598761][T14254] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 929.702158][ T5881] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 929.702238][ T5881] usb 7-1: MIDIStreaming interface descriptor not found [ 929.846188][ T9] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 929.895581][ T5881] usb 7-1: USB disconnect, device number 64 [ 929.995488][T14272] udevd[14272]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:14.21/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 930.000402][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 930.010248][ T9] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 930.010622][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 930.010700][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 930.010742][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 930.010835][ T9] usb 2-1: New USB device found, idVendor=05ac, idProduct=8242, bcdDevice= 0.00 [ 930.010907][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 930.101313][ T9] usb 2-1: config 0 descriptor?? [ 930.538517][ T9] appleir 0003:05AC:8242.000F: item fetching failed at offset 10/11 [ 930.556463][ T9] appleir 0003:05AC:8242.000F: parse failed [ 930.556584][ T9] appleir 0003:05AC:8242.000F: probe with driver appleir failed with error -22 [ 930.752779][ T809] usb 2-1: USB disconnect, device number 70 [ 931.103254][T14296] syz.6.2457 (14296): /proc/14296/oom_adj is deprecated, please use /proc/14296/oom_score_adj instead. [ 932.088338][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 932.088413][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 933.686164][ T9] usb 9-1: new high-speed USB device number 32 using dummy_hcd [ 933.881147][ T9] usb 9-1: config 118 interface 0 has no altsetting 0 [ 933.892798][ T9] usb 9-1: New USB device found, idVendor=13d3, idProduct=3211, bcdDevice=7a.67 [ 933.892898][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 933.892949][ T9] usb 9-1: Product: syz [ 933.892964][ T9] usb 9-1: Manufacturer: syz [ 933.892988][ T9] usb 9-1: SerialNumber: syz [ 934.056275][ T809] usb 7-1: new high-speed USB device number 65 using dummy_hcd [ 934.086163][ T6135] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 934.236138][ T809] usb 7-1: Using ep0 maxpacket: 16 [ 934.239138][ T809] usb 7-1: unable to get BOS descriptor or descriptor too short [ 934.239438][T14314] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 934.240485][ T809] usb 7-1: config 0 has an invalid interface number: 249 but max is 0 [ 934.240508][ T809] usb 7-1: config 0 has no interface number 0 [ 934.242986][ T809] usb 7-1: New USB device found, idVendor=0db0, idProduct=6869, bcdDevice=73.b3 [ 934.243016][ T809] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 934.243039][ T809] usb 7-1: Product: syz [ 934.243055][ T809] usb 7-1: Manufacturer: syz [ 934.243072][ T809] usb 7-1: SerialNumber: syz [ 934.271095][ T6135] usb 2-1: Using ep0 maxpacket: 16 [ 934.334122][ T6135] usb 2-1: config 1 interface 0 altsetting 93 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 934.334150][ T6135] usb 2-1: config 1 interface 0 altsetting 93 bulk endpoint 0x82 has invalid maxpacket 96 [ 934.334169][ T6135] usb 2-1: config 1 interface 0 altsetting 93 bulk endpoint 0x3 has invalid maxpacket 8 [ 934.334226][ T6135] usb 2-1: config 1 interface 0 altsetting 93 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 934.334248][ T6135] usb 2-1: config 1 interface 0 has no altsetting 0 [ 934.391180][T14314] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 934.393255][ T6135] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 934.393286][ T6135] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 934.393308][ T6135] usb 2-1: SerialNumber: syz [ 934.426473][ T809] usb 7-1: config 0 descriptor?? [ 934.459894][ T9] dvb-usb: found a 'Pinnacle PCTV 310e' in warm state. [ 934.464798][T14320] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 934.464948][T14320] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 934.639131][ T809] usb 7-1: USB disconnect, device number 65 [ 934.707888][T14320] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 934.708440][T14320] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 934.833664][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 934.866373][ T9] dvbdev: DVB: registering new adapter (Pinnacle PCTV 310e) [ 934.866543][ T9] usb 9-1: media controller created [ 934.948534][T14320] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 934.949121][T14320] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 935.171617][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 935.196316][ T809] usb 7-1: new high-speed USB device number 66 using dummy_hcd [ 935.350073][ T809] usb 7-1: Using ep0 maxpacket: 16 [ 935.355835][ T809] usb 7-1: unable to get BOS descriptor or descriptor too short [ 935.357558][ T809] usb 7-1: config 0 has an invalid interface number: 249 but max is 0 [ 935.357587][ T809] usb 7-1: config 0 has no interface number 0 [ 935.372572][T14320] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 935.373568][T14320] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 935.409057][ T809] usb 7-1: New USB device found, idVendor=0db0, idProduct=6869, bcdDevice=73.b3 [ 935.409091][ T809] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 935.409113][ T809] usb 7-1: Product: syz [ 935.409129][ T809] usb 7-1: Manufacturer: syz [ 935.409145][ T809] usb 7-1: SerialNumber: syz [ 935.472704][ T809] usb 7-1: config 0 descriptor?? [ 935.716382][ T6135] cdc_ether 2-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.1-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 935.725663][ T9] DVB: Unable to find symbol mt352_attach() [ 935.725681][ T9] dvb-usb: no frontend was attached by 'Pinnacle PCTV 310e' [ 935.756431][ T9] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input40 [ 935.765178][ T9] dvb-usb: schedule remote query interval to 100 msecs. [ 935.765204][ T9] dvb-usb: Pinnacle PCTV 310e successfully initialized and connected. [ 935.766491][ T9] dvb_usb_m920x 9-1:118.0: probe with driver dvb_usb_m920x failed with error -71 [ 935.826791][ T9] usb 9-1: USB disconnect, device number 32 [ 935.917709][ T7527] m920x_read = error: -19 [ 935.917740][ T7527] dvb-usb: error while querying for an remote control event. [ 935.920267][ T6135] usb 1-1: new full-speed USB device number 57 using dummy_hcd [ 936.032197][T14333] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 936.032765][T14333] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 936.033533][ T5882] m920x_read = error: -19 [ 936.033558][ T5882] dvb-usb: error while querying for an remote control event. [ 936.081588][ T6135] usb 1-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 936.081627][ T6135] usb 1-1: config 36 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 936.084640][ T6135] usb 1-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 936.084673][ T6135] usb 1-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 936.084696][ T6135] usb 1-1: Manufacturer: syz [ 936.084713][ T6135] usb 1-1: SerialNumber: syz [ 936.171109][T14336] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 936.173911][T14336] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 936.246755][ T7527] m920x_read = error: -19 [ 936.251086][ T7527] dvb-usb: error while querying for an remote control event. [ 936.360108][ T7527] m920x_read = error: -19 [ 936.360141][ T7527] dvb-usb: error while querying for an remote control event. [ 936.406178][ T9] usb 9-1: new high-speed USB device number 33 using dummy_hcd [ 936.434281][ T6135] usbhid 1-1:36.0: couldn't find an input interrupt endpoint [ 936.457834][ T6135] usb 1-1: USB disconnect, device number 57 [ 936.468795][ T7527] m920x_read = error: -19 [ 936.468822][ T7527] dvb-usb: error while querying for an remote control event. [ 936.576701][ T7527] m920x_read = error: -19 [ 936.576789][ T7527] dvb-usb: error while querying for an remote control event. [ 936.718619][ T6135] m920x_read = error: -19 [ 936.718656][ T6135] dvb-usb: error while querying for an remote control event. [ 936.836457][ T7527] m920x_read = error: -19 [ 936.836724][ T7527] dvb-usb: error while querying for an remote control event. [ 936.946227][ T7527] m920x_read = error: -19 [ 936.946315][ T7527] dvb-usb: error while querying for an remote control event. [ 937.099780][ T9] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 937.099800][ T9] usb 9-1: config 0 has no interfaces? [ 937.099825][ T9] usb 9-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 937.099843][ T9] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 937.139912][ T7527] m920x_read = error: -19 [ 937.139940][ T7527] dvb-usb: error while querying for an remote control event. [ 937.158194][ T9] usb 9-1: config 0 descriptor?? [ 937.246267][ T9] m920x_read = error: -19 [ 937.246297][ T9] dvb-usb: error while querying for an remote control event. [ 937.284671][ T809] usb 2-1: USB disconnect, device number 71 [ 937.328027][ T809] cdc_ether 2-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.1-1, CDC Ethernet Device [ 937.356214][ T9] m920x_read = error: -19 [ 937.356243][ T9] dvb-usb: error while querying for an remote control event. [ 937.425746][T14332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 937.444443][T14332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 937.449022][ T5998] usb 9-1: USB disconnect, device number 33 [ 937.466220][ T7527] m920x_read = error: -19 [ 937.466246][ T7527] dvb-usb: error while querying for an remote control event. [ 937.576213][ T7527] m920x_read = error: -19 [ 937.576238][ T7527] dvb-usb: error while querying for an remote control event. [ 937.686890][ T7527] m920x_read = error: -19 [ 937.686918][ T7527] dvb-usb: error while querying for an remote control event. [ 937.796300][ T7527] m920x_read = error: -19 [ 937.796331][ T7527] dvb-usb: error while querying for an remote control event. [ 937.874445][ T5925] usb 7-1: USB disconnect, device number 66 [ 937.906278][ T7527] m920x_read = error: -19 [ 937.906307][ T7527] dvb-usb: error while querying for an remote control event. [ 937.946520][ T5998] usb 9-1: new high-speed USB device number 34 using dummy_hcd [ 938.008557][ T5881] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 938.016352][ T7527] m920x_read = error: -19 [ 938.016382][ T7527] dvb-usb: error while querying for an remote control event. [ 938.107812][ T5998] usb 9-1: Using ep0 maxpacket: 16 [ 938.110286][ T5998] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 938.110324][ T5998] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 938.110365][ T5998] usb 9-1: New USB device found, idVendor=17ef, idProduct=6067, bcdDevice= 0.00 [ 938.110391][ T5998] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 938.126327][ T7527] m920x_read = error: -19 [ 938.126354][ T7527] dvb-usb: error while querying for an remote control event. [ 938.156424][ T5881] usb 1-1: Using ep0 maxpacket: 16 [ 938.178841][ T5881] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 938.178896][ T5881] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 938.178924][ T5881] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 209 [ 938.178949][ T5881] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 938.231801][ T5881] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 938.231833][ T5881] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 938.231854][ T5881] usb 1-1: Manufacturer: syz [ 938.236186][ T7527] m920x_read = error: -19 [ 938.236212][ T7527] dvb-usb: error while querying for an remote control event. [ 938.249292][ T5998] usb 9-1: config 0 descriptor?? [ 938.335807][ T5881] usb 1-1: config 0 descriptor?? [ 938.346202][ T7527] m920x_read = error: -19 [ 938.346228][ T7527] dvb-usb: error while querying for an remote control event. [ 938.426311][ T5925] usb 7-1: new high-speed USB device number 67 using dummy_hcd [ 938.462501][ T7527] m920x_read = error: -19 [ 938.462541][ T7527] dvb-usb: error while querying for an remote control event. [ 938.510565][T14332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 938.530360][T14332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 938.563672][ T5998] usbhid 9-1:0.0: can't add hid device: -71 [ 938.566207][ T7527] m920x_read = error: -19 [ 938.566241][ T7527] dvb-usb: error while querying for an remote control event. [ 938.567682][ T5998] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 938.642720][ T5925] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 938.676231][ T7527] m920x_read = error: -19 [ 938.676260][ T7527] dvb-usb: error while querying for an remote control event. [ 938.677877][ T5925] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 938.679142][ T5925] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 938.679169][ T5925] usb 7-1: Product: syz [ 938.679185][ T5925] usb 7-1: Manufacturer: syz [ 938.679580][ T5925] usb 7-1: SerialNumber: syz [ 938.783074][ T5998] usb 9-1: USB disconnect, device number 34 [ 938.786251][ T7527] m920x_read = error: -19 [ 938.786278][ T7527] dvb-usb: error while querying for an remote control event. [ 938.807670][T14365] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 938.896184][ T7527] m920x_read = error: -19 [ 938.896222][ T7527] dvb-usb: error while querying for an remote control event. [ 938.999249][T14365] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 938.999535][T14365] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 938.999562][T14365] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 939.006236][ T6135] m920x_read = error: -19 [ 939.038268][ T6135] dvb-usb: error while querying for an remote control event. [ 939.137681][ T5881] rc_core: IR keymap rc-hauppauge not found [ 939.137704][ T5881] Registered IR keymap rc-empty [ 939.139574][ T5881] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 939.146635][ T6135] m920x_read = error: -19 [ 939.146663][ T6135] dvb-usb: error while querying for an remote control event. [ 939.183082][ T5881] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 939.256254][ T6135] m920x_read = error: -19 [ 939.256284][ T6135] dvb-usb: error while querying for an remote control event. [ 939.264869][ T5881] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 939.327733][T14370] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 939.354151][T14370] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 939.366186][ T6135] m920x_read = error: -19 [ 939.366213][ T6135] dvb-usb: error while querying for an remote control event. [ 939.412370][T14365] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 939.426271][ T5998] usb 9-1: new full-speed USB device number 35 using dummy_hcd [ 939.427332][ T5881] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input41 [ 939.432160][T14370] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 939.476196][ T7527] m920x_read = error: -19 [ 939.476223][ T7527] dvb-usb: error while querying for an remote control event. [ 939.525745][T14370] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 939.586207][ T7527] m920x_read = error: -19 [ 939.586236][ T7527] dvb-usb: error while querying for an remote control event. [ 939.631747][ T5881] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 939.659036][ T5881] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 939.673899][ T5998] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 939.673934][ T5998] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 939.674128][ T5998] usb 9-1: New USB device found, idVendor=093a, idProduct=2622, bcdDevice= 0.00 [ 939.674157][ T5998] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 939.696248][ T6135] m920x_read = error: -19 [ 939.696293][ T6135] dvb-usb: error while querying for an remote control event. [ 939.741539][ T5881] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 939.759910][ T5881] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 939.789961][ T5881] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 939.806275][ T7527] m920x_read = error: -19 [ 939.806303][ T7527] dvb-usb: error while querying for an remote control event. [ 939.812703][ T5881] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 939.855635][T14375] ODEBUG: Out of memory. ODEBUG disabled [ 939.897616][ T5998] usb 9-1: config 0 descriptor?? [ 939.914271][ T5881] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 939.916269][ T7527] m920x_read = error: -19 [ 939.916293][ T7527] dvb-usb: error while querying for an remote control event. [ 939.935566][ T5881] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 939.957078][ C1] ------------[ cut here ]------------ [ 939.957094][ C1] 1 [ 939.957109][ C1] WARNING: kernel/time/timer.c:716 at stub_timer+0xa/0x20, CPU#1: ktimers/1/29 [ 939.957163][ C1] Modules linked in: [ 939.957188][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 939.957222][ C1] Tainted: [L]=SOFTLOCKUP [ 939.957232][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 939.957247][ C1] RIP: 0010:stub_timer+0xa/0x20 [ 939.957270][ C1] Code: 0f 94 c0 5b 41 5e c3 cc cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa e8 f7 bc 13 00 90 <0f> 0b 90 e9 fe fc 74 09 cc 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 [ 939.957294][ C1] RSP: 0018:ffffc90000a3fa38 EFLAGS: 00010246 [ 939.957315][ C1] RAX: ffffffff81b09619 RBX: 0000000080000000 RCX: ffff88801d2b3c80 [ 939.957335][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100 [ 939.957350][ C1] RBP: ffffc90000a3fb30 R08: 0000000000000000 R09: 0000000000000100 [ 939.957366][ C1] R10: dffffc0000000000 R11: ffffffff81b09610 R12: 0000000000000001 [ 939.957384][ C1] R13: 000000010000f930 R14: 1ffff92000147f4c R15: ffff88802afd0210 [ 939.957403][ C1] FS: 0000000000000000(0000) GS:ffff888126443000(0000) knlGS:0000000000000000 [ 939.957424][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 939.957440][ C1] CR2: 00007fc9e8bcdd58 CR3: 000000002c0e6000 CR4: 00000000003526f0 [ 939.957462][ C1] Call Trace: [ 939.957472][ C1] [ 939.957482][ C1] call_timer_fn+0x192/0x640 [ 939.957508][ C1] ? __pfx_stub_timer+0x10/0x10 [ 939.957528][ C1] ? call_timer_fn+0xd4/0x640 [ 939.957552][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 939.957573][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 939.957620][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 939.957651][ C1] ? __pfx_stub_timer+0x10/0x10 [ 939.957677][ C1] __run_timer_base+0x6a3/0x9f0 [ 939.957730][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 939.957762][ C1] ? rt_spin_lock+0x1e0/0x400 [ 939.957807][ C1] run_timer_softirq+0xb7/0x170 [ 939.957843][ C1] handle_softirqs+0x1de/0x6f0 [ 939.957888][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 939.957924][ C1] run_ktimerd+0x69/0x100 [ 939.957961][ C1] smpboot_thread_fn+0x541/0xa50 [ 939.957999][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 939.958045][ C1] kthread+0x388/0x470 [ 939.958071][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 939.958106][ C1] ? __pfx_kthread+0x10/0x10 [ 939.958142][ C1] ret_from_fork+0x51e/0xb90 [ 939.958180][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 939.958213][ C1] ? __switch_to+0xc7d/0x1450 [ 939.958247][ C1] ? __pfx_kthread+0x10/0x10 [ 939.958275][ C1] ret_from_fork_asm+0x1a/0x30 [ 939.958320][ C1] [ 939.958344][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 939.958364][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 939.958397][ C1] Tainted: [L]=SOFTLOCKUP [ 939.958407][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 939.958422][ C1] Call Trace: [ 939.958432][ C1] [ 939.958442][ C1] vpanic+0x56c/0xa60 [ 939.958479][ C1] ? __pfx__printk+0x10/0x10 [ 939.958506][ C1] ? __pfx_vpanic+0x10/0x10 [ 939.958539][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 939.958572][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 939.958615][ C1] panic+0xc5/0xd0 [ 939.958650][ C1] ? __pfx_panic+0x10/0x10 [ 939.958696][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 939.958726][ C1] __warn+0x315/0x4f0 [ 939.958760][ C1] ? stub_timer+0xa/0x20 [ 939.958784][ C1] ? stub_timer+0xa/0x20 [ 939.958807][ C1] __report_bug+0x29a/0x540 [ 939.958846][ C1] ? stub_timer+0xa/0x20 [ 939.958869][ C1] ? __pfx___report_bug+0x10/0x10 [ 939.958898][ C1] ? add_lock_to_list+0xc7/0x100 [ 939.958928][ C1] ? lockdep_unlock+0x5d/0xd0 [ 939.958961][ C1] ? __lock_acquire+0x146e/0x2cf0 [ 939.958997][ C1] ? stub_timer+0xa/0x20 [ 939.959018][ C1] report_bug+0x16a/0x220 [ 939.959049][ C1] ? stub_timer+0xa/0x20 [ 939.959069][ C1] ? stub_timer+0xc/0x20 [ 939.959089][ C1] handle_bug+0x98/0x200 [ 939.959131][ C1] exc_invalid_op+0x1a/0x50 [ 939.959166][ C1] asm_exc_invalid_op+0x1a/0x20 [ 939.959191][ C1] RIP: 0010:stub_timer+0xa/0x20 [ 939.959213][ C1] Code: 0f 94 c0 5b 41 5e c3 cc cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa e8 f7 bc 13 00 90 <0f> 0b 90 e9 fe fc 74 09 cc 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 [ 939.959235][ C1] RSP: 0018:ffffc90000a3fa38 EFLAGS: 00010246 [ 939.959256][ C1] RAX: ffffffff81b09619 RBX: 0000000080000000 RCX: ffff88801d2b3c80 [ 939.959275][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100 [ 939.959291][ C1] RBP: ffffc90000a3fb30 R08: 0000000000000000 R09: 0000000000000100 [ 939.959308][ C1] R10: dffffc0000000000 R11: ffffffff81b09610 R12: 0000000000000001 [ 939.959325][ C1] R13: 000000010000f930 R14: 1ffff92000147f4c R15: ffff88802afd0210 [ 939.959350][ C1] ? __pfx_stub_timer+0x10/0x10 [ 939.959375][ C1] ? stub_timer+0x9/0x20 [ 939.959404][ C1] ? stub_timer+0x9/0x20 [ 939.959424][ C1] call_timer_fn+0x192/0x640 [ 939.959449][ C1] ? __pfx_stub_timer+0x10/0x10 [ 939.959470][ C1] ? call_timer_fn+0xd4/0x640 [ 939.959493][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 939.959515][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 939.959560][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 939.959590][ C1] ? __pfx_stub_timer+0x10/0x10 [ 939.959615][ C1] __run_timer_base+0x6a3/0x9f0 [ 939.959674][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 939.959706][ C1] ? rt_spin_lock+0x1e0/0x400 [ 939.959752][ C1] run_timer_softirq+0xb7/0x170 [ 939.959788][ C1] handle_softirqs+0x1de/0x6f0 [ 939.959833][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 939.959869][ C1] run_ktimerd+0x69/0x100 [ 939.959905][ C1] smpboot_thread_fn+0x541/0xa50 [ 939.959945][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 939.959992][ C1] kthread+0x388/0x470 [ 939.960018][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 939.960053][ C1] ? __pfx_kthread+0x10/0x10 [ 939.960080][ C1] ret_from_fork+0x51e/0xb90 [ 939.960116][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 939.960210][ C1] ? __switch_to+0xc7d/0x1450 [ 939.960244][ C1] ? __pfx_kthread+0x10/0x10 [ 939.960271][ C1] ret_from_fork_asm+0x1a/0x30 [ 939.960314][ C1] [ 939.960942][ C1] Kernel Offset: disabled