last executing test programs: 6.237150431s ago: executing program 3 (id=73): r0 = fsopen(&(0x7f0000000000)='binfmt_misc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x87) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x4000000000000000, 0x0, 0x0) 6.062007673s ago: executing program 3 (id=75): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101a00, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000f2303920422c021240850102030109022400010000100009040c0202c17f0c00090502020002020000090582020002"], 0x0) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000840)={0x84, &(0x7f0000000340)={0x0, 0x30, 0x1, 'D'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$rtl8150(r2, 0x0, &(0x7f0000000900)={0x2c, &(0x7f0000000800)={0x0, 0x16, 0x1, "dc"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000200)={0xffffffff, {{0xa, 0x2, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000080)={0x0, 'veth0_to_batadv\x00', {0x2}, 0xfff4}) syz_usb_control_io$uac3(r2, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$KVM_SET_TSC_KHZ_vm(r1, 0xaea2, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)=ANY=[@ANYBLOB="4c010000100013070000000000000000fc020000000000000000000000000001ac1414bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac14141700000000000000000000000000000424f1d218be5cbcd501000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002200e8000000000000000000000000000200000000000000000000005c001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000003509fe8fd57fd44aa5074c50bc700e53"], 0x14c}}, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000780)={0x1, 0x0, [{0xc0010015}]}) 5.888272394s ago: executing program 0 (id=79): socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f0000000000)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) r1 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r2, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r1, r2, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r3, 0xffffffffffffffff, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000180)=ANY=[@ANYBLOB="6000000002060108000004000000000001ffff0005000100070000000900020073797a30000000001400078008001240fffffffe080013000000ffff050004000000000011000300686173683a69702c6d61726b00000000050005000a"], 0x60}, 0x1, 0x0, 0x0, 0x4028055}, 0x0) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3000, 0x7, &(0x7f0000199000/0x3000)=nil) 5.733704623s ago: executing program 0 (id=80): syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="120100004b41460860163209ea800102030109021e0001000000000904"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x20402) readv(r0, &(0x7f0000002680)=[{&(0x7f0000002500)=""/74, 0x4a}], 0x1) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(0xffffffffffffffff, 0x4002f516, 0x0) ioctl$I2C_RDWR(r0, 0x707, &(0x7f00000002c0)={0x0}) 4.448775286s ago: executing program 0 (id=84): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x2d50, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x1, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0xeb}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0xf6}}}}}]}}]}}, 0x0) (async) r1 = add_key(&(0x7f0000000600)='cifs.idmap\x00', &(0x7f0000000640)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$clear(0x7, r1) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.114040131s ago: executing program 1 (id=86): getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@local, 0x0, 0x1, 0xff, 0xa}, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x400452c8, &(0x7f0000000100)) (fail_nth: 20) 4.044290872s ago: executing program 1 (id=87): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x5}) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r5, 0xc008ae88, &(0x7f0000000280)) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x4800}, 0x80) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000140)="fd78327c53705e5888bfecf2551466e5709bb2b858e796c42dbf7701682295e3170f4457739894a074512104cc61dfe8ddbb7c39c115ccd5cdf5494584529246a73b7a959372676291ef0342ec02df751768e3c5408e86fb752d6058ad26d4714c567a4f149020147004710ba3b94af128c0ce0bf557a405610ffa88ca5dc168533913e6476831", 0x87}, {&(0x7f0000000300)="1d6491b55a87a65eed941f7161dde3ce6d4077fe766abd7bb7ecfda480a096e7f4cc5dc73556a14edc1d6bc51e2b942fbeab30adcf80693f62bb9d6c4ce96c30634ee335e63deb29e3d051ee09459e19ee6d368fd115057fdf11c3d47769e8e78182e13a6253bff2980ce92c", 0x6c}], 0x2) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x3c, 0x3, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffe}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x46a57e9}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x84}}, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_open_dev$loop(&(0x7f0000000080), 0x4, 0x80000) ioctl$BLKTRACESTOP(r7, 0x1275, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, &(0x7f0000000100)) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f00000005c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r10 = dup3(r9, r8, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000e00)=[@acquire], 0x0, 0x0, 0x0}) r11 = socket(0x10, 0x803, 0x0) sendto(r11, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r11, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) sendmsg$NFT_BATCH(r10, &(0x7f0000000080)={0x0, 0x11, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYRES16=r10, @ANYRESHEX=r11, @ANYRES8=r1, @ANYRESDEC=r1, @ANYRES16=r5, @ANYRESOCT=r6, @ANYRESDEC=r4], 0xa8}, 0x1, 0x0, 0x0, 0x45}, 0x10) sendmsg$netlink(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000000)={0x2c, 0x11, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x1c, 0x0, 0x0, 0x0, [@typed={0x15, 0x0, 0x0, 0x0, @binary="56ccabd869c2033840919fdc5a8d2527ef"}]}]}, 0x2c}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) 3.517040203s ago: executing program 2 (id=88): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000080)='\b', 0x1, 0x0, &(0x7f00000000c0)={0x11, 0xe, r3, 0x1, 0x3, 0x6, @multicast}, 0x14) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'lo\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000380)={0x1c, r1, 0xf21, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20000015}, 0x0) 3.249666837s ago: executing program 2 (id=89): r0 = syz_open_dev$tty1(0xc, 0x4, 0x4) writev(r0, &(0x7f0000001400), 0x0) r1 = accept$inet6(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x1c) ioctl$TCFLSH(r0, 0x540b, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r2, 0x0) r3 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEY(r3, 0x110, 0x1, &(0x7f0000000100)='\x00\x00\t\a\x00\x00\xe9\x130\nI\xed\xe7Y\v\xce\x00\x00\x00\x00\x05K\x96w\x1b}P\x00\xe9\x8e\x1e\xb8\xb9\xfed\xc8\xc6\x19\r\x91\xa2\x0e\xa9X\xad\xd1\xe8\xbe\x00\x00\x13\xb2O\x8e\xaf\x00\x90\x99\xedS5\x14\xc1\x9e\xbe\x15\xc7\xb3\xa2\x05p\x02\f\xf0\xb5\xb93\xc8\x14\x15\xa6c *\x96\xfc\xac\xcd\xbe[\xef\x0fi\xed)\xe2\x970x0, 0x0}) ppoll(&(0x7f0000000140)=[{r0, 0x13a}, {r0, 0x21}, {r0, 0x35}, {r0, 0x100}, {r1, 0x184}, {r0, 0x10}, {r4, 0x9289}, {r0, 0x400}], 0x8, &(0x7f00000001c0)={r5, r6+60000000}, &(0x7f0000000200)={[0xff]}, 0x8) socket(0x15, 0x1, 0x2) 3.245449459s ago: executing program 1 (id=90): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@local, 0x9, 0x1, 0x3, 0x2, 0x0, 0x14}, 0x20) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r1, 0x8b32, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)) openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="04050400c9"], 0x68) syz_usb_connect$hid(0x4, 0x0, 0x0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) setresgid(0xffffffffffffffff, 0xee00, 0xffffffffffffffff) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4001, 0x9, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000003180), 0x0, 0x0) socket$kcm(0x11, 0xa, 0x300) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r4, &(0x7f0000000480)=[{{&(0x7f0000000800)={0x2, 0xce24, @multicast1}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r4, &(0x7f0000000c80)="e8", 0x6212, 0x12000000, 0x0, 0x0) inotify_init1(0x800) r5 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$IP_VS_SO_GET_SERVICES(r5, 0x0, 0x482, &(0x7f0000000300)=""/151, &(0x7f00000003c0)=0x97) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106161154d00000000000109022400010000000009040000010300000009210000000122f80409058103"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) syz_usb_control_io(r6, &(0x7f0000000300)={0x2c, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r6, &(0x7f00000001c0)={0x24, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x4, @string={0x4, 0x3, "31c0"}}, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) 3.03324969s ago: executing program 2 (id=91): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r2) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000680)={'veth1_vlan\x00', &(0x7f0000002840)=@ethtool_cmd={0x34, 0x7, 0x8, 0x2, 0x8, 0x8, 0x5, 0x9, 0x7, 0x81, 0x9, 0x7f, 0x8d, 0xe, 0x3f, 0x85fe, [0x9, 0x80000000]}}) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000426bd7000ffdbdf252e000000040046000400af000400cc0004004600"], 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x24000000) r5 = syz_genetlink_get_family_id$smc(&(0x7f00000033c0), 0xffffffffffffffff) r6 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$rose(r6, 0x104, 0x6, 0x0, &(0x7f0000000040)) sendmsg$SMC_PNETID_ADD(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002bbd7000fddbd725020000000900010073797a32000000001400020068737230"], 0x34}, 0x1, 0x0, 0x0, 0x24040000}, 0x800) 2.917060758s ago: executing program 3 (id=92): syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="120100004b41460860163209ea800102030109021e0001000000000904"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x20402) readv(r0, &(0x7f0000002680)=[{&(0x7f0000002500)=""/74, 0x4a}], 0x1) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(0xffffffffffffffff, 0x4002f516, 0x0) ioctl$I2C_RDWR(r0, 0x707, &(0x7f00000002c0)={0x0}) 2.769594283s ago: executing program 0 (id=93): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = memfd_create(&(0x7f0000000400)='\xe5e\t\x9f$\x19\x87\xb2]4t\xd8\xaf\x918\xc0y\x01c\x1fnux \xfd\xd7\x8e\x7f\x89\xb8\xc5U\x99A\x1b\x12\x10i\xc2aI\xb3>\xd2\x02\x1a;~\x04\x03~K\xfbP\x8c=\xfa\x81\f\x1e\x05\x00\x00\x00\x00\x00\x00.\x1cb]\xe7d\xac\x00*\xc3\x84;\x1a\x87\x96{\x18\xb2fd&\x9fP\x9cJ\xf2\x87\xed\xbd\"\x13E,\xc7[@\xe9!b\xf4a\x04\a\xff\x8d\x1a\xb5\xd2)i\x157\xabk\x1d\x12bV;\xb6\xdd\xe2|\xe5|M\xae\x1e\xac\xa1~?t\x17O\xb6\x1e\xed\xf5\xff\x11\x89+\xca\b\xc0V$\xb5\x90\xad\xf1\xe4\xeb\x1a\xd1\x9c\x7f\x8f\xdbb?2\x9a\xa0g\xba\x10\xf1\xd2+\x94\xc6\r\xbc\xce\x8c\xbcb\xb1e\xaa.s\x81\xab:\xbf\xe8\x97\x8b}g\xbe\xc0\xe7Y\xca\x876;\xc2\xc9U\x152wq8\x02\x87\x1fpK\xac\xdabx\xcb\xfc\xa5y\xa7\x1f\x9e\xbe]\xa6\x01\xeeN\xfa\xd4P\xaa\x9aN}\x0ea*\\\n\x16\xb0\t/Pi4\xd3\agW9\xb2=\xe0`\x862\x01d\x0ft\xb0\xb5\xe4\xd4X\x99/=\xb4\xf8QW\xa5\xff_`\x93\x1e8\xd1\xe4\x83t+\x8b\xc2#J4\x10k\xc1\xa3\rb`\x7f@\xfb\x90Q\v\xc8\x8e\x93\xbdcX6\xe8_\xef\x96\xd3\xec\f\x04\xc4\xda\x05\xfb\xf0E\xd4?\x88\xa0\xbb', 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000002c80)={0xa, 0x14e24}, 0x1c) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) recvmmsg(r2, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000001e40)=""/104, 0x68}], 0x20}, 0x2}], 0x1, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)='3', 0x1}, {&(0x7f0000000100)="127d589163267e4b0eda2e4186729989fdd2e24baac09a37b374a16c27a136d37e08121d3864d6559759e5bfba0a1c8b2c7d20228827e09902302ddc29760ee36ce64699", 0x44}], 0x2}}], 0x1, 0x20e8086) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000086dd0001110004000000a60c6eec00be00442ffffe8000000000000000000000d178000000aa"], 0xfdef) 2.721702928s ago: executing program 2 (id=94): mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0/file1/file2\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file1/file2/file3\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file0/file1/file2/file3/file5\x00', 0x81c0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0/file6\x00', 0x1c0) mount$bind(&(0x7f0000000300)='./file0/file1\x00', &(0x7f0000000340)='./file0/file6\x00', 0x0, 0x5000, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)={0x8c, r2, 0x5, 0x70bd26, 0x4, {{}, {@val={0x8, 0x3, r3}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x55, 0xe, {{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x2d, 0x1a, {0x1, 0x1, 0x7, 0x0, {0xa600000000000000, 0x2, 0x0, 0x3fe, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x9, 0x3}}, @val={0x72, 0x6}, @val={0x71, 0x7, {0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xb2}}, @void}}, @NL80211_ATTR_IE={0x4}, @NL80211_ATTR_FTM_RESPONDER={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x8c}}, 0x20000014) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file6/file2\x00', 0x0, 0x0) mount(&(0x7f00000001c0)=@md0, &(0x7f0000000280)='./file0/file1/file2/file3/file5\x00', &(0x7f00000002c0)='ocfs2\x00', 0x210000, 0x0) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file1/file2\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./file0/file2\x00', 0x0) r5 = landlock_create_ruleset(&(0x7f0000000440)={0x2004}, 0x18, 0x0) landlock_restrict_self(r5, 0x0) openat(r4, &(0x7f0000000500)='file3/file5\x00', 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) setresuid(r6, r6, 0x0) syz_fuse_handle_req(r0, &(0x7f00000021c0), 0x2000, &(0x7f00000041c0)={&(0x7f0000000140)={0x50, 0x0, 0x1000000000, {0x7, 0x2b, 0x0, 0xffffffff80050200, 0x600, 0xfc, 0x8, 0x0, 0x0, 0x0, 0x10, 0x100}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.050684062s ago: executing program 2 (id=95): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0xfffffffc, 0xb, 0x0, 0xfffffffc, 0x7f, "db8f2d2b3b7596160c6981acf8805944823a7f"}) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[], 0xff2e) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x7000000) pipe(&(0x7f0000000240)) ioctl$TCSETSW(r0, 0x5403, &(0x7f00000000c0)={0xb4, 0x201, 0x46, 0x1, 0xff, "7f0700c29b67661c0196011d42d7d7cf39f600"}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$PNPIPE_ENCAP(r3, 0x113, 0x7ffffffe, 0x0, 0x0) unshare(0x6020400) sendmmsg(r2, 0x0, 0x0, 0x300) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x18, "00000000000700000000fffe00"}) r4 = syz_open_pts(r0, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000240)=0x1) 1.641571278s ago: executing program 0 (id=96): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0x5e}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x14e22, 0xfffffff8, @ipv4}, 0x1c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0xa7ba) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r7, &(0x7f00000000c0)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) 1.617895508s ago: executing program 0 (id=97): bind$inet(0xffffffffffffffff, 0x0, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, 0x0, &(0x7f0000000100)) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000500)={'syztnl2\x00', &(0x7f0000000440)={'gretap0\x00', 0x0, 0x8000, 0x1, 0xd15f, 0x101, {{0x24, 0x4, 0x0, 0x16, 0x90, 0x66, 0x0, 0xf, 0x2f, 0x0, @private=0xa010100, @remote, {[@timestamp={0x44, 0x28, 0x30, 0x0, 0x3, [0x0, 0x7, 0x1, 0x1, 0x10, 0x1, 0x1220, 0x0, 0xf]}, @cipso={0x86, 0x50, 0x3, [{0x6, 0x12, "e6a5d826f698b693d72dde8a07a0d4c5"}, {0x6, 0x11, "52ed03a5d2f89bbad15938889a9fdf"}, {0x2, 0x3, "f1"}, {0x6, 0xb, "c3012bc7e664faaf82"}, {0x7, 0xd, "b035836f952a679a506c46"}, {0x5, 0xc, "95db8650d92bb4564973"}]}, @noop, @end, @end]}}}}}) (async, rerun: 32) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x4, @mcast2, 0x9}, 0x1c) (rerun: 32) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c000000480001ffffffe000000000000a0000000000000000000000140001800d2a79075827af5aa534d6815c2e93f10c0002"], 0x3c}}, 0x0) r2 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="12012000f104920001000109021b1901000000d4090415d17cad2a8c345c00e5bc108f2cef58225cb8af57f5af9be473bc24e4f63d4ae00ad76b97d8cb658d00039e057c8eb1b9d82a6c023b5bcdfc32c31c3f0cda7f4d3f1e46d73e983b514121bf195f23e53e11eda2469afc9764ceb81fc8", @ANYRESDEC=r0, @ANYRESOCT=r1, @ANYRES64], 0x0) (async) r3 = syz_open_dev$video(&(0x7f0000000000), 0x101, 0xab02) ioctl$VIDIOC_S_CROP(r3, 0x4014563c, &(0x7f0000000040)={0x9, {0xf8001004, 0x9, 0x6, 0x80b}}) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x94, r4, 0x200, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY_SEQ={0x12, 0xa, "20bd21dd37d8f339e3dc12970d23"}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "d4b486bb54"}, @NL80211_ATTR_KEY_SEQ={0x9, 0xa, "9b25ce8a8d"}, @NL80211_ATTR_KEY_SEQ={0xf, 0xa, "2a4a8aab1a818d38b90efc"}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY={0x20, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac01}, @NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "85c699b39d"}]}, @NL80211_ATTR_KEY_DEFAULT={0x4}]}, 0x94}, 0x1, 0x0, 0x0, 0x40}, 0x2400c020) (async) syz_usb_control_io$rtl8150(r2, 0x0, 0x0) (async) syz_usb_control_io(r2, 0x0, 0x0) 1.593557248s ago: executing program 3 (id=98): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000340)="3900000014008144f2003c00e9ff008311001f9f640fcf066505acb612f6b8bf44ebb392175f39dbb7d5cac0040071c2ed5453b0e921550000", 0x39}], 0x1}, 0x4000000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x800000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0xc, &(0x7f0000000040)=0x9, 0x4) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r4, 0x4048aecb, &(0x7f00000034c0)) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1.125402636s ago: executing program 1 (id=99): r0 = socket(0x400000000010, 0x3, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {&(0x7f0000000480)="4ce09043b6aa2ae5946f67306c7f73ed469dfcfc5e1f4d8123a4a8a7b9be82f67f89605cd9bbf7254c156b00437f753a248daf68c5ebdc4a6346d336a6502e98eae72777956d1ebeeb855fae46b3ccb9fb3d593651b95ee00afe0816b3c6e7f3cb3b18fb5198643daa6b9cafde584957dd72ba27cef6604f5df59f0bee60bca63d75a9d812eb699c2d665b7179b22027cf748ac63bcc212703d44cb083e962eee9b5d212523c162b42377ebd0bc624bf9425f6f4772e36c6c2fd4f69b65cc435f93c1a490cb75162251e15942b29de8d9d", 0xd1}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b", 0x42}, {0x0}, {&(0x7f00000000c0)}], 0x6}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e98e92fe2fd18e63d4d5699814d9843367774e155678592d0eec07073e851f50827bde418748aa0741684fe603e34dcc960678c7b3e71e48befa166d4a5247325fa881fc7857a8caadde6a2ac9cdcc4ead01267dbb4c639d6d8a80f9637e0c2a3f9623478134b943d5fba4f7e0ceed66c93cc", 0xe5}, {&(0x7f0000000580)="8f966bd94d169820f6b844307d323b8c13deaeff91566b7f1725f3", 0x1b}], 0x3}}, {{&(0x7f0000000d80)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e23, @local}, 0x2, 0x3, 0x1, 0x3}}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000003a40)=[{&(0x7f0000000640)="f3f4c60f4caeeeb0b0c17aa46461", 0xe}], 0x1}}], 0x4, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000480), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x4c, r2, 0x207, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x4}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x1}, {0x5}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x1}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}]}, 0x4c}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r4 = accept4(r3, 0x0, 0x0, 0x800) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r5, 0x40085112, &(0x7f00000002c0)=0x1ff) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) lseek(r6, 0x1000000, 0x0) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f38d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299e4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f0000000800)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da9884b93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f111b8d1ca3fe4a1aab578ae0adc3252aa18e8c3bbc46db5dfe1fdfbc64893615e4634781f4222da9bac4280b4008971d81a329fe42f26a711d31083e9e052bfaeb2089fd9016266d3482e7c218b68c7f6e6c44d7a2709216772b4f531a894f5bae0dd081bc84c7bda9bd882a00"/313, 0x139}], 0x3, &(0x7f0000000380)}], 0x1, 0x40800) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r11 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) setrlimit(0x7, &(0x7f0000000400)) keyctl$KEYCTL_WATCH_KEY(0x20, r11, r10, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r11, r10, 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r8, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r9, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 936.675558ms ago: executing program 2 (id=100): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000000)={0x1c, 0x12, 0xb6cc17e4840f351b, 0x0, 0x0, "", [@nested={0x4, 0x0, 0x0, 0x0}, @nested={0x8, 0x1d, 0x0, 0x1, [@generic="b112ed56"]}]}, 0x1c}], 0x1}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_EMULATED_CPUID(r0, 0xc008ae09, &(0x7f0000000300)={0x5, 0x0, [{0xc0000001, 0x4, 0x2, 0x10001, 0xf42b, 0x0, 0x9}, {0x2, 0x1f5, 0x3, 0xfff, 0x9, 0x1, 0x80}, {0x80000019, 0x0, 0x6, 0x5, 0x7f, 0xfffff000, 0xb8}, {0x4, 0x80000000, 0x0, 0xfffffff7, 0x5, 0x6, 0x4}, {0x80000000, 0xeb, 0x3, 0xffff6afc, 0x800, 0xf01d, 0x1b8c}]}) ioctl$KVM_GET_MSRS_cpu(r3, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0x4b564dff}]}) r4 = syz_open_procfs(0x0, &(0x7f0000000180)='clear_refs\x00') writev(r4, &(0x7f00000002c0)=[{&(0x7f0000000280)='2', 0x1}, {&(0x7f0000000080)='-6', 0x3f}], 0x2) syz_usb_connect(0x2, 0x3f0, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000072771c40e00500069bf9010203010902de0301000000000904af00100de1130009050900400000b208ab035ac996787ecb440a6cd869ab0f7077064618a072d7bb7916a199dedaf7708866e5233e204dd14444c3ee6b718038526c6bd45123a28131dc5c483de3e462a652473d558e27e67a040b3ce5b78166e74a0f16f9df02be33a9b200b92587ba73bd6c540e25637c4e8e6a381c9d3ee1e8521863c2d3ceb4a3a28d93fec28c8604a378f65ff31e903b4b79031a4301e0244b2ff9f0b469afb99f40f79a6de21f2f29bc61cf090aa1e112da07250101000300090507080800040406b505bce3"], 0x0) 570.953377ms ago: executing program 3 (id=101): ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) futex(&(0x7f0000000540)=0x2, 0x8c, 0x1, 0x0, 0x0, 0x2) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x20010444, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0x2288, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(twofish-asm)\x00'}, 0x58) close_range(r2, 0xffffffffffffffff, 0x0) connect$unix(r0, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e22}, 0x6e) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000100)=""/115, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/63, 0x130}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000540)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 285.389864ms ago: executing program 3 (id=102): r0 = socket(0x400000000010, 0x3, 0x8000) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)}, {&(0x7f0000000480)="4ce09043b6aa2ae5946f67306c7f73ed469dfcfc5e1f4d8123a4a8a7b9be82f67f89605cd9bbf7254c156b00437f753a248daf68c5ebdc4a6346d336a6502e98eae72777956d1ebeeb855fae46b3ccb9fb3d593651b95ee00afe0816b3c6e7f3cb3b18fb5198643daa6b9cafde584957dd72ba27cef6604f5df59f0bee60bca63d75a9d812eb699c2d665b7179b22027cf748ac63bcc212703d44cb083e962eee9b5d212523c162b42377ebd0bc624bf9425f6f4772e36c6c2fd4f69b65cc435f93c1a490cb75162251e15942b29de8d9d", 0xd1}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83a", 0x5a}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ede331312f556ecea24236759bf0d51003477ec489820505cea6045a9939974c6f2ee3815378dc0a", 0xb7}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4f08e90d5313fb91fbdc5acd212f7d8c800a837a0236309d25e82d5767d8df7512b2beb324c2a2fd6f4ed3a3eb7396f02d515396a3be574d721df257dbf0bc39c617c69458d721eb85d0e5372751cd2", 0x98}, {&(0x7f00000000c0)}], 0x6}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e98e92fe2fd18e63d4d5699814d9843367774e155678592d0eec07073e851f50827bde418748aa0741684fe603e34dcc960678c7b3e71e48befa166d4a5247325fa881fc7857a8caadde6a2ac9cdcc4ead01267dbb4c639d6d8a80f9637e0c2a3f9623478134b943d5fba4f7e0ceed66c93cc8b", 0xe6}, {&(0x7f0000000580)="8f966bd94d169820f6b844307d323b8c13deaeff91566b7f1725f39f", 0x1c}], 0x3, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x78}}, {{&(0x7f0000000d80)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e23, @local}, 0x2, 0x3, 0x1, 0x3}}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000003a40)=[{&(0x7f0000000640)="f3f4c60f4caeeeb0b0c17aa464613c", 0xf}], 0x1}}], 0x4, 0x20000044) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f0000001100)=[{{0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f0000000280)=""/24, 0x18}], 0x1}, 0x9}], 0x1, 0x400000a0, 0x0) sendmsg$alg(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)="c049d285d9bbff3bb6d5f6ee2b38a01b4935d97818e5382a", 0x18}], 0x1, 0x0, 0x0, 0x4000004}, 0x404c8c1) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000bc0)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x80203, 0x0) ioctl$KVM_CHECK_EXTENSION(r6, 0xae03, 0x3b) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r6, 0xc0385868, &(0x7f0000000700)={r4, &(0x7f0000000300)='-+{\x00', 0x101000, &(0x7f0000000340)={@_ha_fsid={[0xc, 0x3]}, {0x4000, 0x74, 0x2, 0x8}}, 0xffff, &(0x7f0000000680)={@_ha_fsid}, &(0x7f00000006c0)=0x43000}) setsockopt$WPAN_WANTLQI(r7, 0x0, 0x3, &(0x7f0000000740), 0x4) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r9, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r10, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 246.634123ms ago: executing program 1 (id=103): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x1000000000000000) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev={0xfe, 0x80, '\x00', 0x3d}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) migrate_pages(0x0, 0x507, &(0x7f00000002c0)=0x1000, &(0x7f0000000300)=0xd) 0s ago: executing program 1 (id=104): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = memfd_create(&(0x7f0000000400)='\xe5e\t\x9f$\x19\x87\xb2]4t\xd8\xaf\x918\xc0y\x01c\x1fnux \xfd\xd7\x8e\x7f\x89\xb8\xc5U\x99A\x1b\x12\x10i\xc2aI\xb3>\xd2\x02\x1a;~\x04\x03~K\xfbP\x8c=\xfa\x81\f\x1e\x05\x00\x00\x00\x00\x00\x00.\x1cb]\xe7d\xac\x00*\xc3\x84;\x1a\x87\x96{\x18\xb2fd&\x9fP\x9cJ\xf2\x87\xed\xbd\"\x13E,\xc7[@\xe9!b\xf4a\x04\a\xff\x8d\x1a\xb5\xd2)i\x157\xabk\x1d\x12bV;\xb6\xdd\xe2|\xe5|M\xae\x1e\xac\xa1~?t\x17O\xb6\x1e\xed\xf5\xff\x11\x89+\xca\b\xc0V$\xb5\x90\xad\xf1\xe4\xeb\x1a\xd1\x9c\x7f\x8f\xdbb?2\x9a\xa0g\xba\x10\xf1\xd2+\x94\xc6\r\xbc\xce\x8c\xbcb\xb1e\xaa.s\x81\xab:\xbf\xe8\x97\x8b}g\xbe\xc0\xe7Y\xca\x876;\xc2\xc9U\x152wq8\x02\x87\x1fpK\xac\xdabx\xcb\xfc\xa5y\xa7\x1f\x9e\xbe]\xa6\x01\xeeN\xfa\xd4P\xaa\x9aN}\x0ea*\\\n\x16\xb0\t/Pi4\xd3\agW9\xb2=\xe0`\x862\x01d\x0ft\xb0\xb5\xe4\xd4X\x99/=\xb4\xf8QW\xa5\xff_`\x93\x1e8\xd1\xe4\x83t+\x8b\xc2#J4\x10k\xc1\xa3\rb`\x7f@\xfb\x90Q\v\xc8\x8e\x93\xbdcX6\xe8_\xef\x96\xd3\xec\f\x04\xc4\xda\x05\xfb\xf0E\xd4?\x88\xa0\xbb', 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000002c80)={0xa, 0x14e24}, 0x1c) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) recvmmsg(r2, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000001e40)=""/104, 0x68}], 0x20}, 0x2}], 0x1, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)='3', 0x1}, {&(0x7f0000000100)="127d589163267e4b0eda2e4186729989fdd2e24baac09a37b374a16c27a136d37e08121d3864d6559759e5bfba0a1c8b2c7d20228827e09902302ddc29760ee36ce64699", 0x44}], 0x2}}], 0x1, 0x20e8086) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) pipe2$watch_queue(&(0x7f0000000040), 0x80) write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000086dd0001110004000000a60c6eec00be00442ffffe8000000000000000000000d178000000aa"], 0xfdef) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.189' (ED25519) to the list of known hosts. [ 75.076209][ T5811] cgroup: Unknown subsys name 'net' [ 75.316701][ T5811] cgroup: Unknown subsys name 'cpuset' [ 75.373094][ T5811] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 76.958096][ T5811] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 80.606781][ T5836] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 80.619286][ T5836] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 80.625262][ T5836] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 80.628943][ T5836] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 80.629118][ T5836] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 80.643251][ T5836] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 80.665803][ T5842] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 80.668416][ T5842] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 80.692973][ T5837] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 80.703283][ T5837] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.704278][ T5837] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 80.714379][ T5837] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 80.714747][ T5837] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 80.716429][ T5842] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 80.716835][ T5842] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 80.718996][ T5842] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 80.722806][ T5835] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 80.727718][ T5842] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 80.728766][ T5842] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 80.753442][ T5829] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 81.615949][ T5825] chnl_net:caif_netlink_parms(): no params data found [ 81.691260][ T5827] chnl_net:caif_netlink_parms(): no params data found [ 81.737726][ T5826] chnl_net:caif_netlink_parms(): no params data found [ 81.815592][ T5824] chnl_net:caif_netlink_parms(): no params data found [ 82.103244][ T5825] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.103411][ T5825] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.103775][ T5825] bridge_slave_0: entered allmulticast mode [ 82.107243][ T5825] bridge_slave_0: entered promiscuous mode [ 82.161340][ T5825] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.161493][ T5825] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.161652][ T5825] bridge_slave_1: entered allmulticast mode [ 82.165134][ T5825] bridge_slave_1: entered promiscuous mode [ 82.207462][ T5827] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.207626][ T5827] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.207764][ T5827] bridge_slave_0: entered allmulticast mode [ 82.209539][ T5827] bridge_slave_0: entered promiscuous mode [ 82.238472][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.238646][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.238785][ T5826] bridge_slave_0: entered allmulticast mode [ 82.240506][ T5826] bridge_slave_0: entered promiscuous mode [ 82.267664][ T5827] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.267928][ T5827] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.268501][ T5827] bridge_slave_1: entered allmulticast mode [ 82.277376][ T5827] bridge_slave_1: entered promiscuous mode [ 82.311291][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.311567][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.312075][ T5826] bridge_slave_1: entered allmulticast mode [ 82.320327][ T5826] bridge_slave_1: entered promiscuous mode [ 82.331824][ T5824] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.332088][ T5824] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.333147][ T5824] bridge_slave_0: entered allmulticast mode [ 82.335995][ T5824] bridge_slave_0: entered promiscuous mode [ 82.370265][ T5825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.386487][ T5824] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.386636][ T5824] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.386979][ T5824] bridge_slave_1: entered allmulticast mode [ 82.388651][ T5824] bridge_slave_1: entered promiscuous mode [ 82.427232][ T5825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.464083][ T5827] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.486580][ T5826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.508608][ T5827] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.529943][ T5826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.534801][ T5824] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.715555][ T5825] team0: Port device team_slave_0 added [ 82.733139][ T5824] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.755002][ T5829] Bluetooth: hci0: command tx timeout [ 82.755331][ T5825] team0: Port device team_slave_1 added [ 82.792162][ T5827] team0: Port device team_slave_0 added [ 82.815864][ T5826] team0: Port device team_slave_0 added [ 82.833380][ T5827] team0: Port device team_slave_1 added [ 82.833554][ T5842] Bluetooth: hci3: command tx timeout [ 82.833714][ T5829] Bluetooth: hci2: command tx timeout [ 82.856972][ T5826] team0: Port device team_slave_1 added [ 82.861069][ T5824] team0: Port device team_slave_0 added [ 82.884892][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.884903][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.884916][ T5825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.907745][ T5824] team0: Port device team_slave_1 added [ 82.933045][ T5829] Bluetooth: hci1: command tx timeout [ 82.955352][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.955367][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.955391][ T5825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.018701][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.018711][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.018724][ T5827] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.036343][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.036358][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.036380][ T5826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.061268][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.061284][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.061306][ T5827] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.069370][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.069384][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.069406][ T5826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.076086][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.076100][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.076122][ T5824] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.115857][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.115872][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.115895][ T5824] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.238212][ T5825] hsr_slave_0: entered promiscuous mode [ 83.240358][ T5825] hsr_slave_1: entered promiscuous mode [ 83.325132][ T5827] hsr_slave_0: entered promiscuous mode [ 83.326216][ T5827] hsr_slave_1: entered promiscuous mode [ 83.327236][ T5827] debugfs: 'hsr0' already exists in 'hsr' [ 83.327327][ T5827] Cannot create hsr debugfs directory [ 83.358960][ T5826] hsr_slave_0: entered promiscuous mode [ 83.360096][ T5826] hsr_slave_1: entered promiscuous mode [ 83.360956][ T5826] debugfs: 'hsr0' already exists in 'hsr' [ 83.360976][ T5826] Cannot create hsr debugfs directory [ 83.397085][ T5824] hsr_slave_0: entered promiscuous mode [ 83.398229][ T5824] hsr_slave_1: entered promiscuous mode [ 83.399091][ T5824] debugfs: 'hsr0' already exists in 'hsr' [ 83.399113][ T5824] Cannot create hsr debugfs directory [ 84.365424][ T5825] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 84.389499][ T5825] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.396022][ T5825] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 84.427054][ T5825] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.428039][ T5825] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 84.468006][ T5825] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.487191][ T5825] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 84.526690][ T5825] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.643378][ T5826] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 84.679579][ T5826] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.689107][ T5826] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 84.727444][ T5826] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.731953][ T5826] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 84.768335][ T5826] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.791567][ T5826] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 84.828057][ T5826] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.835246][ T5829] Bluetooth: hci0: command tx timeout [ 84.912777][ T5829] Bluetooth: hci2: command tx timeout [ 84.912804][ T5829] Bluetooth: hci3: command tx timeout [ 84.956933][ T5824] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 84.987084][ T5824] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.996001][ T5842] Bluetooth: hci1: command tx timeout [ 84.999961][ T5824] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 85.035703][ T5824] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 85.041572][ T5824] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 85.081674][ T5824] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 85.108626][ T5824] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 85.137420][ T5824] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 85.268341][ T5827] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 85.306827][ T5827] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 85.321774][ T5827] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 85.346098][ T5827] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 85.355319][ T5827] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 85.399717][ T5827] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 85.406887][ T5827] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 85.445427][ T5827] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 85.511051][ T5825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.587710][ T5825] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.622292][ T5826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.648181][ T1140] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.648332][ T1140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.695384][ T1140] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.695821][ T1140] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.765995][ T5826] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.787230][ T5824] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.817492][ T126] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.817632][ T126] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.851993][ T126] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.852123][ T126] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.917352][ T5824] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.960530][ T5827] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.978538][ T68] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.978663][ T68] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.020822][ T68] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.025360][ T68] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.140001][ T5827] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.198129][ T126] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.198386][ T126] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.296307][ T68] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.296534][ T68] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.498526][ T5825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.700028][ T5826] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.854750][ T44] cfg80211: failed to load regulatory.db [ 86.914479][ T5842] Bluetooth: hci0: command tx timeout [ 86.987132][ T5825] veth0_vlan: entered promiscuous mode [ 86.993096][ T5842] Bluetooth: hci3: command tx timeout [ 86.993123][ T5842] Bluetooth: hci2: command tx timeout [ 87.000114][ T5824] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.066501][ T5825] veth1_vlan: entered promiscuous mode [ 87.072880][ T5829] Bluetooth: hci1: command tx timeout [ 87.117038][ T5827] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.134359][ T5826] veth0_vlan: entered promiscuous mode [ 87.195738][ T5826] veth1_vlan: entered promiscuous mode [ 87.249848][ T5824] veth0_vlan: entered promiscuous mode [ 87.275946][ T5825] veth0_macvtap: entered promiscuous mode [ 87.306024][ T5824] veth1_vlan: entered promiscuous mode [ 87.308481][ T5825] veth1_macvtap: entered promiscuous mode [ 87.385905][ T5827] veth0_vlan: entered promiscuous mode [ 87.405873][ T5826] veth0_macvtap: entered promiscuous mode [ 87.411395][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.447991][ T5826] veth1_macvtap: entered promiscuous mode [ 87.461774][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.463842][ T5827] veth1_vlan: entered promiscuous mode [ 87.521493][ T1142] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.536974][ T5824] veth0_macvtap: entered promiscuous mode [ 87.538991][ T1142] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.563671][ T1142] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.566245][ T1142] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.577381][ T5824] veth1_macvtap: entered promiscuous mode [ 87.590365][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.675808][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.872307][ T68] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.901644][ T68] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.918848][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.918930][ T68] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.940708][ T68] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.953491][ T5827] veth0_macvtap: entered promiscuous mode [ 87.981539][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.040176][ T5827] veth1_macvtap: entered promiscuous mode [ 88.126913][ T126] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.155603][ T1140] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.159094][ T1140] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.179857][ T1140] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.235498][ T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.235574][ T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.445323][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.520199][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.596655][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.596673][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.708812][ T1571] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.711322][ T1571] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.715613][ T1571] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.722049][ T1571] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.890041][ T126] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.890059][ T126] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.994900][ T5829] Bluetooth: hci0: command tx timeout [ 89.080542][ T1140] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.080558][ T1140] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.083549][ T5829] Bluetooth: hci2: command tx timeout [ 89.083574][ T5829] Bluetooth: hci3: command tx timeout [ 89.152592][ T5842] Bluetooth: hci1: command tx timeout [ 89.365021][ T1571] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.365040][ T1571] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.704692][ T1140] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.704709][ T1140] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.838138][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 89.856135][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.856151][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.025407][ T1140] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.025435][ T1140] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.117474][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 90.117529][ T9] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 90.117549][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.270829][ T9] usb 2-1: config 0 descriptor?? [ 90.451333][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 91.020968][ T5923] qnx4: unable to read the superblock [ 91.052276][ T5925] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 91.153416][ T5928] netlink: 84 bytes leftover after parsing attributes in process `syz.3.4'. [ 91.194640][ T9] pwc: recv_control_msg error -32 req 02 val 2b00 [ 91.202060][ T9] pwc: recv_control_msg error -32 req 02 val 2700 [ 91.208266][ T9] pwc: recv_control_msg error -32 req 02 val 2c00 [ 91.212356][ T9] pwc: recv_control_msg error -32 req 04 val 1000 [ 91.213295][ T9] pwc: recv_control_msg error -32 req 04 val 1300 [ 91.216013][ T9] pwc: recv_control_msg error -32 req 04 val 1400 [ 91.218246][ T9] pwc: recv_control_msg error -32 req 02 val 2000 [ 91.221807][ T9] pwc: recv_control_msg error -32 req 02 val 2100 [ 91.224586][ T9] pwc: recv_control_msg error -32 req 04 val 1500 [ 91.292813][ T9] pwc: recv_control_msg error -32 req 02 val 2500 [ 91.364033][ T5932] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5'. [ 93.696698][ T9] pwc: recv_control_msg error -71 req 02 val 2400 [ 93.701856][ T9] pwc: recv_control_msg error -71 req 02 val 2600 [ 93.717353][ T9] pwc: recv_control_msg error -71 req 02 val 2900 [ 93.717871][ T9] pwc: recv_control_msg error -71 req 02 val 2800 [ 93.735664][ T9] pwc: recv_control_msg error -71 req 04 val 1100 [ 93.736249][ T9] pwc: recv_control_msg error -71 req 04 val 1200 [ 93.778958][ T5950] syz.3.9 uses obsolete (PF_INET,SOCK_PACKET) [ 93.846029][ T9] pwc: Registered as video103. [ 93.873413][ T5831] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 93.905172][ T9] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input5 [ 93.991106][ T9] usb 2-1: USB disconnect, device number 2 [ 94.023651][ T5831] usb 1-1: Using ep0 maxpacket: 8 [ 94.044250][ T5831] usb 1-1: config index 0 descriptor too short (expected 30, got 18) [ 94.054852][ T5831] usb 1-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 94.054879][ T5831] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.054897][ T5831] usb 1-1: Product: syz [ 94.054911][ T5831] usb 1-1: Manufacturer: syz [ 94.054923][ T5831] usb 1-1: SerialNumber: syz [ 94.160034][ T5831] usb 1-1: config 0 descriptor?? [ 94.220558][ T5831] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 94.220616][ T5831] usb 1-1: setting power ON [ 94.255621][ T5831] dvb-usb: bulk message failed: -22 (2/0) [ 94.544514][ T5953] dvb-usb: bulk message failed: -22 (3/0) [ 94.584373][ T5831] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 94.611901][ T5831] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 94.628246][ T5831] usb 1-1: media controller created [ 94.727669][ T5831] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 94.895546][ T5831] usb 1-1: selecting invalid altsetting 6 [ 94.895582][ T5831] usb 1-1: digital interface selection failed (-22) [ 94.895601][ T5831] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 94.925068][ T5831] usb 1-1: setting power OFF [ 94.954910][ T5831] dvb-usb: bulk message failed: -22 (2/0) [ 94.954935][ T5831] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 94.954948][ T5831] (NULL device *): no alternate interface [ 95.336808][ T5952] syz.3.9 (5952) used greatest stack depth: 18800 bytes left [ 95.394619][ T5831] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 95.426126][ T5831] usb 1-1: USB disconnect, device number 2 [ 95.437113][ T5973] cgroup: No subsys list or none specified [ 95.562100][ T5975] faux_driver vkms: [drm] Unknown color mode 29997; guessing buffer size. [ 95.787775][ T5979] veth1_to_bond: entered allmulticast mode [ 96.232774][ T5813] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 96.276122][ T5978] veth1_to_bond: left allmulticast mode [ 96.434958][ T5993] FAULT_INJECTION: forcing a failure. [ 96.434958][ T5993] name failslab, interval 1, probability 0, space 0, times 1 [ 96.440200][ T5993] CPU: 0 UID: 0 PID: 5993 Comm: syz.1.23 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 96.440221][ T5993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 96.440236][ T5993] Call Trace: [ 96.440242][ T5993] [ 96.440248][ T5993] dump_stack_lvl+0xe8/0x150 [ 96.440272][ T5993] should_fail_ex+0x46b/0x600 [ 96.440306][ T5993] should_failslab+0xa8/0x100 [ 96.440333][ T5993] __kmalloc_noprof+0xdf/0x7b0 [ 96.440354][ T5993] ? do_raw_spin_lock+0x12b/0x2f0 [ 96.440372][ T5993] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 96.440402][ T5993] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 96.440430][ T5993] genl_start+0x180/0x6c0 [ 96.440456][ T5993] __netlink_dump_start+0x469/0x7e0 [ 96.440479][ T5993] genl_family_rcv_msg_dumpit+0x213/0x310 [ 96.440502][ T5993] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 96.440524][ T5993] ? genl_get_cmd+0x6cb/0x960 [ 96.440550][ T5993] ? __pfx_genl_start+0x10/0x10 [ 96.440573][ T5993] ? __pfx_genl_dumpit+0x10/0x10 [ 96.440595][ T5993] ? __pfx_genl_done+0x10/0x10 [ 96.440623][ T5993] ? lockdep_hardirqs_on+0x7a/0x110 [ 96.440642][ T5993] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 96.440671][ T5993] genl_rcv_msg+0x5e8/0x7a0 [ 96.440703][ T5993] ? __pfx_genl_rcv_msg+0x10/0x10 [ 96.440727][ T5993] ? __pfx_nl802154_list_associations+0x10/0x10 [ 96.440759][ T5993] netlink_rcv_skb+0x232/0x4b0 [ 96.440780][ T5993] ? __pfx_genl_rcv_msg+0x10/0x10 [ 96.440804][ T5993] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 96.440834][ T5993] ? netlink_deliver_tap+0x2e/0x1b0 [ 96.440854][ T5993] ? netlink_deliver_tap+0x2e/0x1b0 [ 96.440877][ T5993] genl_rcv+0x28/0x40 [ 96.440901][ T5993] netlink_unicast+0x780/0x920 [ 96.440931][ T5993] netlink_sendmsg+0x813/0xb40 [ 96.440961][ T5993] ? __pfx_netlink_sendmsg+0x10/0x10 [ 96.440985][ T5993] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 96.441015][ T5993] ? aa_sock_msg_perm+0x122/0x200 [ 96.441040][ T5993] ? __pfx_netlink_sendmsg+0x10/0x10 [ 96.441061][ T5993] sock_sendmsg_nosec+0x112/0x150 [ 96.441091][ T5993] ____sys_sendmsg+0x55c/0x870 [ 96.441121][ T5993] ? __pfx_____sys_sendmsg+0x10/0x10 [ 96.441153][ T5993] ? import_iovec+0x73/0xa0 [ 96.441181][ T5993] ___sys_sendmsg+0x2a5/0x360 [ 96.441200][ T5993] ? __lock_acquire+0x6b5/0x2cf0 [ 96.441222][ T5993] ? __pfx____sys_sendmsg+0x10/0x10 [ 96.441272][ T5993] ? __fget_files+0x2a/0x420 [ 96.441292][ T5993] ? __fget_files+0x3a6/0x420 [ 96.441327][ T5993] __x64_sys_sendmsg+0x1c3/0x2a0 [ 96.441352][ T5993] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 96.441380][ T5993] ? rcu_is_watching+0x15/0xb0 [ 96.441409][ T5993] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.441427][ T5993] do_syscall_64+0x15f/0xf80 [ 96.441443][ T5993] ? trace_irq_disable+0x3b/0x140 [ 96.441462][ T5993] ? clear_bhb_loop+0x40/0x90 [ 96.441475][ T5813] usb 3-1: config 6 has an invalid interface number: 48 but max is 0 [ 96.441483][ T5993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.441497][ T5813] usb 3-1: config 6 has an invalid descriptor of length 48, skipping remainder of the config [ 96.441503][ T5993] RIP: 0033:0x7f36acf9c819 [ 96.441515][ T5813] usb 3-1: config 6 has no interface number 0 [ 96.441528][ T5993] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.441542][ T5993] RSP: 002b:00007f36ab1ee028 EFLAGS: 00000246 [ 96.441546][ T5813] usb 3-1: too many endpoints for config 6 interface 48 altsetting 48: 48, using maximum allowed: 30 [ 96.441553][ T5993] ORIG_RAX: 000000000000002e [ 96.441561][ T5993] RAX: ffffffffffffffda RBX: 00007f36ad215fa0 RCX: 00007f36acf9c819 [ 96.441574][ T5993] RDX: 000000000400c000 RSI: 0000200000000300 RDI: 0000000000000004 [ 96.441585][ T5993] RBP: 00007f36ab1ee090 R08: 0000000000000000 R09: 0000000000000000 [ 96.441586][ T5813] usb 3-1: config 6 interface 48 altsetting 48 has 0 endpoint descriptors, different from the interface descriptor's value: 48 [ 96.441596][ T5993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 96.441607][ T5993] R13: 00007f36ad216038 R14: 00007f36ad215fa0 R15: 00007ffe8e929278 [ 96.441612][ T5813] usb 3-1: config 6 interface 48 has no altsetting 0 [ 96.441636][ T5993] [ 96.508252][ T5813] usb 3-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 96.508281][ T5813] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.508299][ T5813] usb 3-1: Product: syz [ 96.508313][ T5813] usb 3-1: Manufacturer: syz [ 96.508326][ T5813] usb 3-1: SerialNumber: syz [ 97.105051][ T5831] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 97.345688][ T5831] usb 1-1: Using ep0 maxpacket: 8 [ 97.347536][ T5831] usb 1-1: config index 0 descriptor too short (expected 30, got 18) [ 97.438761][ T5831] usb 1-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 97.438788][ T5831] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.438806][ T5831] usb 1-1: Product: syz [ 97.438819][ T5831] usb 1-1: Manufacturer: syz [ 97.438833][ T5831] usb 1-1: SerialNumber: syz [ 97.496285][ T5831] usb 1-1: config 0 descriptor?? [ 97.683986][ T5831] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 97.684095][ T5831] usb 1-1: setting power ON [ 97.684115][ T5831] dvb-usb: bulk message failed: -22 (2/0) [ 97.741214][ T5831] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 97.741959][ T5831] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 97.742008][ T5831] usb 1-1: media controller created [ 97.784799][ T5991] dvb-usb: bulk message failed: -22 (3/0) [ 97.784822][ T5991] dvb-usb: bulk message failed: -22 (4/0) [ 97.784836][ T5991] cxusb: i2c read failed [ 97.809756][ T5831] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 97.864882][ T5831] usb 1-1: selecting invalid altsetting 6 [ 97.864904][ T5831] usb 1-1: digital interface selection failed (-22) [ 97.864918][ T5831] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 97.865658][ T5831] usb 1-1: setting power OFF [ 97.865675][ T5831] dvb-usb: bulk message failed: -22 (2/0) [ 97.865689][ T5831] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 97.865708][ T5831] (NULL device *): no alternate interface [ 98.077253][ T5831] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 98.140609][ T5831] usb 1-1: USB disconnect, device number 3 [ 99.145606][ T5813] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 99.145695][ T5813] command write [95] error -22 [ 99.215922][ T5813] usb 3-1: USB disconnect, device number 2 [ 99.700999][ T6031] netlink: 4 bytes leftover after parsing attributes in process `syz.3.32'. [ 100.424271][ T5831] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 100.502640][ T822] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 100.603882][ T5831] usb 2-1: Using ep0 maxpacket: 16 [ 100.615374][ T5831] usb 2-1: config 166 has an invalid interface number: 177 but max is 1 [ 100.615398][ T5831] usb 2-1: config 166 has an invalid interface number: 34 but max is 1 [ 100.615416][ T5831] usb 2-1: config 166 has no interface number 0 [ 100.615430][ T5831] usb 2-1: config 166 has no interface number 1 [ 100.615480][ T5831] usb 2-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 100.615499][ T5831] usb 2-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 100.615531][ T5831] usb 2-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 100.615553][ T5831] usb 2-1: config 166 interface 34 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 100.615576][ T5831] usb 2-1: config 166 interface 34 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024 [ 100.615601][ T5831] usb 2-1: config 166 interface 34 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024 [ 100.615624][ T5831] usb 2-1: config 166 interface 34 altsetting 1 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 100.615646][ T5831] usb 2-1: config 166 interface 34 altsetting 1 endpoint 0x85 has invalid wMaxPacketSize 0 [ 100.615666][ T5831] usb 2-1: config 166 interface 34 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 100.615690][ T5831] usb 2-1: config 166 interface 177 has no altsetting 0 [ 100.615706][ T5831] usb 2-1: config 166 interface 34 has no altsetting 0 [ 100.625813][ T5831] usb 2-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 100.625839][ T5831] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.625857][ T5831] usb 2-1: Product: syz [ 100.625870][ T5831] usb 2-1: Manufacturer: syz [ 100.625884][ T5831] usb 2-1: SerialNumber: syz [ 100.684146][ T822] usb 1-1: Using ep0 maxpacket: 8 [ 100.688569][ T6047] capability: warning: `syz.3.38' uses deprecated v2 capabilities in a way that may be insecure [ 100.728561][ T37] audit: type=1326 audit(1776732652.728:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6046 comm="syz.3.38" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6ee751c819 code=0x0 [ 100.768800][ T822] usb 1-1: config index 0 descriptor too short (expected 30, got 18) [ 100.874004][ T822] usb 1-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 100.874032][ T822] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.874050][ T822] usb 1-1: Product: syz [ 100.874063][ T822] usb 1-1: Manufacturer: syz [ 100.874074][ T822] usb 1-1: SerialNumber: syz [ 100.978496][ T822] usb 1-1: config 0 descriptor?? [ 100.998879][ T822] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 100.998920][ T822] usb 1-1: setting power ON [ 100.998935][ T822] dvb-usb: bulk message failed: -22 (2/0) [ 101.090455][ T822] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 101.091733][ T822] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 101.091785][ T822] usb 1-1: media controller created [ 101.170716][ T822] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 101.204236][ T6039] dvb-usb: bulk message failed: -22 (3/0) [ 101.204251][ T6039] dvb-usb: bulk message failed: -22 (4/0) [ 101.204259][ T6039] cxusb: i2c read failed [ 101.205314][ T822] usb 1-1: selecting invalid altsetting 6 [ 101.205333][ T822] usb 1-1: digital interface selection failed (-22) [ 101.205347][ T822] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 101.206100][ T822] usb 1-1: setting power OFF [ 101.206117][ T822] dvb-usb: bulk message failed: -22 (2/0) [ 101.206131][ T822] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 101.206143][ T822] (NULL device *): no alternate interface [ 101.315257][ T822] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 101.345231][ T822] usb 1-1: USB disconnect, device number 4 [ 101.435906][ T5831] ums-realtek 2-1:166.177: USB Mass Storage device detected [ 101.618101][ T5831] ums-realtek 2-1:166.34: USB Mass Storage device detected [ 101.640144][ T6060] cgroup2: Unknown parameter 'obj_user' [ 101.749087][ T5831] ums-realtek 2-1:166.34: probe with driver ums-realtek failed with error -5 [ 101.757820][ T5831] uvcvideo 2-1:166.34: Found UVC 0.00 device syz (0bda:0138) [ 101.757860][ T5831] uvcvideo 2-1:166.34: No valid video chain found. [ 101.931232][ T5831] usb 2-1: USB disconnect, device number 3 [ 102.122670][ T44] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 102.215749][ T6067] trusted_key: syz.1.44 sent an empty control message without MSG_MORE. [ 102.284903][ T44] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 102.284934][ T44] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 102.284955][ T44] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 102.284973][ T44] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0 [ 102.287707][ T44] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 102.287734][ T44] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.287752][ T44] usb 4-1: Product: syz [ 102.287774][ T44] usb 4-1: Manufacturer: syz [ 102.287786][ T44] usb 4-1: SerialNumber: syz [ 102.369776][ T44] usb 4-1: config 0 descriptor?? [ 102.379257][ T6062] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 102.440371][ T44] usb 4-1: ucan: probing device on interface #0 [ 102.440395][ T44] usb 4-1: ucan: invalid in_ep MaxPacketSize [ 102.440408][ T44] usb 4-1: ucan: probe failed; try to update the device firmware [ 102.612159][ T6062] fuse: Unknown parameter '' [ 102.633310][ T5831] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 102.659634][ T44] usb 4-1: USB disconnect, device number 2 [ 102.825739][ T5831] usb 2-1: config 0 has an invalid interface number: 83 but max is 0 [ 102.825767][ T5831] usb 2-1: config 0 has no interface number 0 [ 102.825795][ T5831] usb 2-1: too many endpoints for config 0 interface 83 altsetting 218: 49, using maximum allowed: 30 [ 102.825830][ T5831] usb 2-1: config 0 interface 83 altsetting 218 has 0 endpoint descriptors, different from the interface descriptor's value: 49 [ 102.825855][ T5831] usb 2-1: config 0 interface 83 has no altsetting 0 [ 102.830395][ T5831] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 102.830424][ T5831] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.830443][ T5831] usb 2-1: Product: syz [ 102.830455][ T5831] usb 2-1: Manufacturer: syz [ 102.830468][ T5831] usb 2-1: SerialNumber: syz [ 102.855522][ T5831] usb 2-1: config 0 descriptor?? [ 103.211556][ T6088] capability: warning: `syz.2.50' uses 32-bit capabilities (legacy support in use) [ 103.522642][ T5831] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 103.572634][ T5944] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 103.693236][ T5831] usb 3-1: Using ep0 maxpacket: 8 [ 103.695509][ T5831] usb 3-1: config index 0 descriptor too short (expected 30, got 18) [ 103.697600][ T5831] usb 3-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 103.697624][ T5831] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.697642][ T5831] usb 3-1: Product: syz [ 103.697655][ T5831] usb 3-1: Manufacturer: syz [ 103.697668][ T5831] usb 3-1: SerialNumber: syz [ 103.722153][ T5831] usb 3-1: config 0 descriptor?? [ 103.731893][ T5831] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 103.731941][ T5831] usb 3-1: setting power ON [ 103.731958][ T5831] dvb-usb: bulk message failed: -22 (2/0) [ 103.748296][ T5944] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 103.748345][ T5944] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 103.748369][ T5944] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 103.748392][ T5944] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 103.748411][ T5944] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 103.777905][ T5944] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 103.777931][ T5944] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 103.777949][ T5944] usb 4-1: Product: syz [ 103.777963][ T5944] usb 4-1: Manufacturer: syz [ 103.777976][ T5944] usb 4-1: SerialNumber: syz [ 103.821353][ T5831] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 103.825451][ T5944] usb 4-1: config 0 descriptor?? [ 103.833708][ T5831] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 103.833876][ T5831] usb 3-1: media controller created [ 103.977188][ T5831] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 103.978949][ T6090] dvb-usb: bulk message failed: -22 (3/0) [ 103.978967][ T6090] dvb-usb: bulk message failed: -22 (4/0) [ 103.978977][ T6090] cxusb: i2c read failed [ 104.043675][ T5944] radio-si470x 4-1:0.0: si470x_get_report: usb_control_msg returned -32 [ 104.044011][ T5944] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -5 [ 104.168804][ T5831] usb 3-1: selecting invalid altsetting 6 [ 104.168826][ T5831] usb 3-1: digital interface selection failed (-22) [ 104.168849][ T5831] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 104.169525][ T5831] usb 3-1: setting power OFF [ 104.169539][ T5831] dvb-usb: bulk message failed: -22 (2/0) [ 104.169548][ T5831] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 104.169555][ T5831] (NULL device *): no alternate interface [ 104.260547][ T5831] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 104.285730][ T6092] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 104.286307][ T6092] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 104.294810][ T5831] usb 3-1: USB disconnect, device number 3 [ 104.611258][ T6106] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 104.627130][ T6106] ntfs3(nullb0): Primary boot signature is not NTFS. [ 104.627657][ T6106] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 105.211650][ T44] usb 2-1: USB disconnect, device number 4 [ 105.744187][ T44] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 105.903573][ T44] usb 2-1: Using ep0 maxpacket: 16 [ 105.924348][ T44] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 105.936770][ T44] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice=27.0a [ 105.936798][ T44] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.936828][ T44] usb 2-1: Product: syz [ 105.936840][ T44] usb 2-1: Manufacturer: syz [ 105.936853][ T44] usb 2-1: SerialNumber: syz [ 105.958676][ T44] usb 2-1: config 0 descriptor?? [ 106.504576][ T6138] netlink: 703 bytes leftover after parsing attributes in process `syz.3.66'. [ 106.672967][ T5813] usb 4-1: USB disconnect, device number 3 [ 106.712640][ T10] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 106.797407][ T6142] netlink: 16 bytes leftover after parsing attributes in process `syz.2.67'. [ 106.885446][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 106.893034][ T10] usb 1-1: config index 0 descriptor too short (expected 30, got 18) [ 106.906148][ T10] usb 1-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 106.906176][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.906194][ T10] usb 1-1: Product: syz [ 106.906206][ T10] usb 1-1: Manufacturer: syz [ 106.906220][ T10] usb 1-1: SerialNumber: syz [ 106.980096][ T10] usb 1-1: config 0 descriptor?? [ 107.033512][ T10] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 107.033574][ T10] usb 1-1: setting power ON [ 107.033592][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 107.079513][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 107.080442][ T10] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 107.080492][ T10] usb 1-1: media controller created [ 107.126198][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 107.140225][ T10] usb 1-1: selecting invalid altsetting 6 [ 107.140246][ T10] usb 1-1: digital interface selection failed (-22) [ 107.140260][ T10] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 107.141036][ T10] usb 1-1: setting power OFF [ 107.141054][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 107.141069][ T10] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 107.141080][ T10] (NULL device *): no alternate interface [ 107.201963][ T6136] dvb-usb: bulk message failed: -22 (3/0) [ 107.201989][ T6136] dvb-usb: bulk message failed: -22 (4/0) [ 107.202002][ T6136] cxusb: i2c read failed [ 107.272330][ T44] usb 2-1: USB disconnect, device number 5 [ 107.388136][ T10] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 107.473128][ T10] usb 1-1: USB disconnect, device number 5 [ 107.762328][ T6152] netlink: 8 bytes leftover after parsing attributes in process `syz.1.69'. [ 108.292638][ T822] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 108.447690][ T822] usb 2-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 108.447719][ T822] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.447737][ T822] usb 2-1: Product: syz [ 108.447750][ T822] usb 2-1: Manufacturer: syz [ 108.447763][ T822] usb 2-1: SerialNumber: syz [ 108.506805][ T822] usb 2-1: config 0 descriptor?? [ 108.522613][ T44] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 108.534000][ T822] ch341 2-1:0.0: ch341-uart converter detected [ 108.672750][ T44] usb 4-1: Using ep0 maxpacket: 32 [ 108.677126][ T44] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 108.677149][ T44] usb 4-1: config 0 has no interface number 0 [ 108.677191][ T44] usb 4-1: config 0 interface 12 has no altsetting 0 [ 108.679440][ T44] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 108.679466][ T44] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.679479][ T44] usb 4-1: Product: syz [ 108.679523][ T44] usb 4-1: Manufacturer: syz [ 108.679538][ T44] usb 4-1: SerialNumber: syz [ 108.722759][ T9] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 108.757943][ T44] usb 4-1: config 0 descriptor?? [ 108.878313][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 108.880601][ T9] usb 1-1: config index 0 descriptor too short (expected 30, got 18) [ 108.883270][ T9] usb 1-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 108.883295][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.883313][ T9] usb 1-1: Product: syz [ 108.883326][ T9] usb 1-1: Manufacturer: syz [ 108.883338][ T9] usb 1-1: SerialNumber: syz [ 108.940976][ T9] usb 1-1: config 0 descriptor?? [ 108.958153][ T9] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 108.958199][ T9] usb 1-1: setting power ON [ 108.958215][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 108.985113][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 108.987831][ T9] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 108.987880][ T9] usb 1-1: media controller created [ 109.028939][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 109.065306][ T9] usb 1-1: selecting invalid altsetting 6 [ 109.065328][ T9] usb 1-1: digital interface selection failed (-22) [ 109.065342][ T9] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 109.066496][ T9] usb 1-1: setting power OFF [ 109.066515][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 109.066530][ T9] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 109.066541][ T9] (NULL device *): no alternate interface [ 109.142095][ T822] usb 2-1: failed to send control message: -71 [ 109.166334][ T822] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 109.225704][ T9] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 109.267974][ T9] usb 1-1: USB disconnect, device number 6 [ 109.351799][ T822] usb 2-1: USB disconnect, device number 6 [ 109.411725][ T822] ch341 2-1:0.0: device disconnected [ 110.104248][ T822] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 110.128721][ T6198] FAULT_INJECTION: forcing a failure. [ 110.128721][ T6198] name failslab, interval 1, probability 0, space 0, times 0 [ 110.128752][ T6198] CPU: 0 UID: 0 PID: 6198 Comm: syz.1.86 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 110.128772][ T6198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 110.128782][ T6198] Call Trace: [ 110.128789][ T6198] [ 110.128801][ T6198] dump_stack_lvl+0xe8/0x150 [ 110.128825][ T6198] should_fail_ex+0x46b/0x600 [ 110.128854][ T6198] should_failslab+0xa8/0x100 [ 110.128883][ T6198] kmem_cache_alloc_noprof+0x87/0x680 [ 110.128908][ T6198] ? __kernfs_new_node+0xea/0x980 [ 110.128932][ T6198] __kernfs_new_node+0xea/0x980 [ 110.128953][ T6198] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 110.128973][ T6198] ? lockdep_hardirqs_on+0x7a/0x110 [ 110.128995][ T6198] ? __pfx___kernfs_new_node+0x10/0x10 [ 110.129019][ T6198] ? kernfs_root+0x1c/0x230 [ 110.129045][ T6198] ? kernfs_root+0x1c/0x230 [ 110.129064][ T6198] ? kernfs_root+0x1c/0x230 [ 110.129083][ T6198] ? kernfs_root+0x1c/0x230 [ 110.129108][ T6198] kernfs_new_node+0x102/0x210 [ 110.129135][ T6198] __kernfs_create_file+0x4b/0x2e0 [ 110.129164][ T6198] sysfs_add_file_mode_ns+0x238/0x300 [ 110.129192][ T6198] sysfs_merge_group+0x183/0x320 [ 110.129225][ T6198] ? __pfx_sysfs_merge_group+0x10/0x10 [ 110.129248][ T6198] ? kobject_put+0x516/0x560 [ 110.129275][ T6198] dpm_sysfs_add+0xd2/0x270 [ 110.129295][ T6198] device_add+0x4d8/0xbb0 [ 110.129324][ T6198] tty_register_device_attr+0x422/0x950 [ 110.129349][ T6198] ? __pfx_tty_register_device_attr+0x10/0x10 [ 110.129366][ T6198] ? rt_mutex_slowunlock+0x1cb/0x300 [ 110.129400][ T6198] ? tty_port_register_device+0xca/0x150 [ 110.129423][ T6198] rfcomm_dev_ioctl+0x1b7b/0x21e0 [ 110.129449][ T6198] ? kasan_quarantine_put+0xbb/0x1f0 [ 110.129471][ T6198] ? __pfx_rfcomm_dev_ioctl+0x10/0x10 [ 110.129494][ T6198] ? tomoyo_path_number_perm+0x219/0x630 [ 110.129514][ T6198] ? tomoyo_path_number_perm+0x219/0x630 [ 110.129541][ T6198] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 110.129574][ T6198] sock_do_ioctl+0x101/0x320 [ 110.129603][ T6198] ? __pfx_sock_do_ioctl+0x10/0x10 [ 110.129643][ T6198] sock_ioctl+0x5c9/0x7f0 [ 110.129669][ T6198] ? __pfx_sock_ioctl+0x10/0x10 [ 110.129694][ T6198] ? __fget_files+0x2a/0x420 [ 110.129713][ T6198] ? __fget_files+0x3a6/0x420 [ 110.129733][ T6198] ? __fget_files+0x2a/0x420 [ 110.129754][ T6198] ? bpf_lsm_file_ioctl+0x9/0x20 [ 110.129774][ T6198] ? __pfx_sock_ioctl+0x10/0x10 [ 110.129799][ T6198] __se_sys_ioctl+0xff/0x170 [ 110.129825][ T6198] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.129845][ T6198] do_syscall_64+0x15f/0xf80 [ 110.129861][ T6198] ? trace_irq_disable+0x3b/0x140 [ 110.129881][ T6198] ? clear_bhb_loop+0x40/0x90 [ 110.129904][ T6198] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.129922][ T6198] RIP: 0033:0x7f36acf9c819 [ 110.129939][ T6198] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 110.129953][ T6198] RSP: 002b:00007f36ab1ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 110.129972][ T6198] RAX: ffffffffffffffda RBX: 00007f36ad215fa0 RCX: 00007f36acf9c819 [ 110.129985][ T6198] RDX: 0000200000000100 RSI: 00000000400452c8 RDI: 0000000000000004 [ 110.129996][ T6198] RBP: 00007f36ab1ee090 R08: 0000000000000000 R09: 0000000000000000 [ 110.130006][ T6198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 110.130016][ T6198] R13: 00007f36ad216038 R14: 00007f36ad215fa0 R15: 00007ffe8e929278 [ 110.130045][ T6198] [ 110.394766][ T6202] netlink: 12 bytes leftover after parsing attributes in process `syz.1.87'. [ 110.498636][ T822] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 246, changing to 11 [ 110.498657][ T822] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 110.498681][ T822] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 110.503196][ T822] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.574247][ T44] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 110.574298][ T44] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 110.574315][ T44] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 110.574398][ T44] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 110.636698][ T822] usb 1-1: config 0 descriptor?? [ 110.648483][ T44] usb 4-1: USB disconnect, device number 4 [ 110.848512][ T822] usbhid 1-1:0.0: can't add hid device: -71 [ 110.848619][ T822] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 110.875972][ T822] usb 1-1: USB disconnect, device number 7 [ 110.985077][ T5842] Bluetooth: hci1: unexpected event 0x05 length: 101 > 4 [ 111.357078][ T6217] Zero length message leads to an empty skb [ 111.382708][ T822] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 111.544558][ T822] usb 2-1: Using ep0 maxpacket: 16 [ 111.548080][ T822] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 111.548109][ T822] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 111.548144][ T822] usb 2-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 111.548164][ T822] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.572622][ T44] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 111.607869][ T822] usb 2-1: config 0 descriptor?? [ 111.722654][ T44] usb 4-1: Using ep0 maxpacket: 8 [ 111.730691][ T44] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 111.748617][ T44] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 111.748645][ T44] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.748786][ T44] usb 4-1: Product: syz [ 111.748801][ T44] usb 4-1: Manufacturer: syz [ 111.748813][ T44] usb 4-1: SerialNumber: syz [ 111.815442][ T44] usb 4-1: config 0 descriptor?? [ 111.833987][ T44] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 111.834036][ T44] usb 4-1: setting power ON [ 111.834054][ T44] dvb-usb: bulk message failed: -22 (2/0) [ 111.873315][ T44] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 111.874914][ T44] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 111.875021][ T44] usb 4-1: media controller created [ 111.929202][ T44] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 112.035963][ T6216] dvb-usb: bulk message failed: -22 (3/0) [ 112.035988][ T6216] dvb-usb: bulk message failed: -22 (4/0) [ 112.036001][ T6216] cxusb: i2c read failed [ 112.061264][ T44] usb 4-1: selecting invalid altsetting 6 [ 112.061285][ T44] usb 4-1: digital interface selection failed (-22) [ 112.061299][ T44] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 112.089259][ T44] usb 4-1: setting power OFF [ 112.095600][ T44] dvb-usb: bulk message failed: -22 (2/0) [ 112.095622][ T44] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 112.095633][ T44] (NULL device *): no alternate interface [ 112.204659][ T44] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 112.228420][ T44] usb 4-1: USB disconnect, device number 5 [ 112.261593][ T822] usbhid 2-1:0.0: can't add hid device: -71 [ 112.273493][ T822] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 112.344093][ T822] usb 2-1: USB disconnect, device number 7 [ 112.942685][ T9] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 113.083987][ T9] usb 1-1: device descriptor read/64, error -71 [ 113.095902][ T37] audit: type=1326 audit(1776732665.118:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6241 comm="syz.1.99" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f36acf9c819 code=0x0 [ 113.332741][ T9] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 113.462700][ T9] usb 1-1: device descriptor read/64, error -71 [ 113.562963][ T10] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 113.585536][ T9] usb usb1-port1: attempt power cycle [ 113.727201][ T10] usb 3-1: config 0 has an invalid interface number: 175 but max is 0 [ 113.727230][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 113.727247][ T10] usb 3-1: config 0 has no interface number 0 [ 113.727291][ T10] usb 3-1: config 0 interface 175 altsetting 0 has an endpoint descriptor with address 0xBC, changing to 0x8C [ 113.727314][ T10] usb 3-1: config 0 interface 175 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 10 [ 113.727337][ T10] usb 3-1: config 0 interface 175 altsetting 0 endpoint 0x8C has invalid wMaxPacketSize 0 [ 113.727356][ T10] usb 3-1: config 0 interface 175 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 16 [ 113.732227][ T10] usb 3-1: New USB device found, idVendor=05e0, idProduct=0600, bcdDevice=f9.9b [ 113.732311][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.732329][ T10] usb 3-1: Product: syz [ 113.732341][ T10] usb 3-1: Manufacturer: syz [ 113.732354][ T10] usb 3-1: SerialNumber: syz [ 113.757722][ T10] usb 3-1: config 0 descriptor?? [ 113.791872][ T10] symbolserial 3-1:0.175: symbol converter detected [ 113.844939][ T10] usb 3-1: symbol converter now attached to ttyUSB0 [ 113.947291][ T9] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 113.969851][ T9] usb 1-1: device descriptor read/8, error -71 [ 114.041283][ T10] usb 3-1: USB disconnect, device number 4 [ 114.232032][ T10] symbol ttyUSB0: symbol converter now disconnected from ttyUSB0 [ 114.238075][ T10] symbolserial 3-1:0.175: device disconnected [ 114.262674][ T9] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 114.307476][ T9] usb 1-1: device descriptor read/8, error -71 [ 114.361544][ T6254] ------------[ cut here ]------------ [ 114.361554][ T6254] kcov->t != t [ 114.361562][ T6254] WARNING: kernel/kcov.c:483 at kcov_task_exit+0xf5/0x160, CPU#0: syz.3.102/6254 [ 114.361583][ T6254] Modules linked in: [ 114.361602][ T6254] CPU: 0 UID: 0 PID: 6254 Comm: syz.3.102 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 114.361615][ T6254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 114.361622][ T6254] RIP: 0010:kcov_task_exit+0xf5/0x160 [ 114.361634][ T6254] Code: 10 00 00 48 8b bb 90 00 00 00 e8 06 1e 58 00 48 89 df 5b 41 5e 41 5f e9 89 dc 5d 00 7c 1c 5b 41 5e 41 5f e9 7d 6d 80 09 cc 90 <0f> 0b 90 4c 89 f7 5b 41 5e 41 5f e9 ab 06 7f 09 48 89 df be 03 00 [ 114.361643][ T6254] RSP: 0018:ffffc9000636fae0 EFLAGS: 00010202 [ 114.361652][ T6254] RAX: 8272f097054fb700 RBX: ffff888027115a00 RCX: 0000000000000000 [ 114.361660][ T6254] RDX: 0000000017db0af7 RSI: ffffffff8bca5740 RDI: 00000000ffffffff [ 114.361668][ T6254] RBP: ffffc9000636fc30 R08: ffffffff8b440760 R09: ffffffff8e3c8140 [ 114.361675][ T6254] R10: dffffc0000000000 R11: fffffbfff1f9e8df R12: dffffc0000000000 [ 114.361683][ T6254] R13: 0000000000000000 R14: ffff888027115a08 R15: ffff888027cfdc40 [ 114.361690][ T6254] FS: 00007f6ee576e6c0(0000) GS:ffff888125a62000(0000) knlGS:0000000000000000 [ 114.361699][ T6254] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 114.361706][ T6254] CR2: 000000110c2bbeb4 CR3: 000000003c410000 CR4: 00000000003526f0 [ 114.361738][ T6254] Call Trace: [ 114.361743][ T6254] [ 114.361749][ T6254] do_exit+0x150/0x22c0 [ 114.361767][ T6254] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 114.361780][ T6254] ? lockdep_hardirqs_on+0x7a/0x110 [ 114.361791][ T6254] ? __pfx_do_exit+0x10/0x10 [ 114.361804][ T6254] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 114.361819][ T6254] ? reacquire_held_locks+0x104/0x190 [ 114.361834][ T6254] ? rt_spin_lock+0x1e0/0x400 [ 114.361849][ T6254] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 114.361867][ T6254] do_group_exit+0x21b/0x2d0 [ 114.361881][ T6254] ? rt_spin_unlock+0x160/0x200 [ 114.361895][ T6254] get_signal+0x1284/0x1330 [ 114.361915][ T6254] arch_do_signal_or_restart+0xbc/0x830 [ 114.361933][ T6254] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 114.361956][ T6254] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.361967][ T6254] exit_to_user_mode_loop+0x86/0x480 [ 114.361980][ T6254] ? rcu_is_watching+0x15/0xb0 [ 114.361994][ T6254] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.362005][ T6254] do_syscall_64+0x33e/0xf80 [ 114.362015][ T6254] ? trace_irq_disable+0x3b/0x140 [ 114.362027][ T6254] ? clear_bhb_loop+0x40/0x90 [ 114.362039][ T6254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.362056][ T6254] RIP: 0033:0x7f6ee751c819 [ 114.362073][ T6254] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.362081][ T6254] RSP: 002b:00007f6ee576e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 114.362093][ T6254] RAX: fffffffffffffe00 RBX: 00007f6ee7795fa8 RCX: 00007f6ee751c819 [ 114.362100][ T6254] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f6ee7795fa8 [ 114.362107][ T6254] RBP: 00007f6ee7795fa0 R08: 0000000000000000 R09: 0000000000000000 [ 114.362113][ T6254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.362119][ T6254] R13: 00007f6ee7796038 R14: 00007ffc1e2c3430 R15: 00007ffc1e2c3518 [ 114.362135][ T6254] [ 114.362141][ T6254] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 114.362150][ T6254] CPU: 0 UID: 0 PID: 6254 Comm: syz.3.102 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 114.362162][ T6254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 114.362167][ T6254] Call Trace: [ 114.362172][ T6254] [ 114.362176][ T6254] vpanic+0x56c/0xa60 [ 114.362189][ T6254] ? __pfx__printk+0x10/0x10 [ 114.362207][ T6254] ? __pfx_vpanic+0x10/0x10 [ 114.362218][ T6254] ? is_bpf_text_address+0x292/0x2b0 [ 114.362232][ T6254] ? is_bpf_text_address+0x26/0x2b0 [ 114.362249][ T6254] panic+0xc5/0xd0 [ 114.362261][ T6254] ? __pfx_panic+0x10/0x10 [ 114.362281][ T6254] __warn+0x315/0x4c0 [ 114.362293][ T6254] ? kcov_task_exit+0xf5/0x160 [ 114.362304][ T6254] ? kcov_task_exit+0xf5/0x160 [ 114.362315][ T6254] __report_bug+0x29a/0x540 [ 114.362328][ T6254] ? kcov_task_exit+0xf5/0x160 [ 114.362338][ T6254] ? __pfx___report_bug+0x10/0x10 [ 114.362347][ T6254] ? try_to_take_rt_mutex+0x840/0xb00 [ 114.362362][ T6254] ? reacquire_held_locks+0x104/0x190 [ 114.362378][ T6254] ? __pfx_rtlock_slowlock_locked+0x10/0x10 [ 114.362394][ T6254] ? rt_spin_lock+0x1e0/0x400 [ 114.362408][ T6254] ? rt_spin_lock+0x1e0/0x400 [ 114.362423][ T6254] ? kcov_task_exit+0xf5/0x160 [ 114.362433][ T6254] report_bug+0x16a/0x220 [ 114.362443][ T6254] ? kcov_task_exit+0xf5/0x160 [ 114.362458][ T6254] ? kcov_task_exit+0xf7/0x160 [ 114.362473][ T6254] handle_bug+0x9c/0x200 [ 114.362495][ T6254] exc_invalid_op+0x1a/0x50 [ 114.362516][ T6254] asm_exc_invalid_op+0x1a/0x20 [ 114.362557][ T6254] RIP: 0010:kcov_task_exit+0xf5/0x160 [ 114.362575][ T6254] Code: 10 00 00 48 8b bb 90 00 00 00 e8 06 1e 58 00 48 89 df 5b 41 5e 41 5f e9 89 dc 5d 00 7c 1c 5b 41 5e 41 5f e9 7d 6d 80 09 cc 90 <0f> 0b 90 4c 89 f7 5b 41 5e 41 5f e9 ab 06 7f 09 48 89 df be 03 00 [ 114.362591][ T6254] RSP: 0018:ffffc9000636fae0 EFLAGS: 00010202 [ 114.362607][ T6254] RAX: 8272f097054fb700 RBX: ffff888027115a00 RCX: 0000000000000000 [ 114.362621][ T6254] RDX: 0000000017db0af7 RSI: ffffffff8bca5740 RDI: 00000000ffffffff [ 114.362630][ T6254] RBP: ffffc9000636fc30 R08: ffffffff8b440760 R09: ffffffff8e3c8140 [ 114.362638][ T6254] R10: dffffc0000000000 R11: fffffbfff1f9e8df R12: dffffc0000000000 [ 114.362646][ T6254] R13: 0000000000000000 R14: ffff888027115a08 R15: ffff888027cfdc40 [ 114.362657][ T6254] ? rt_spin_lock+0x1e0/0x400 [ 114.362690][ T6254] do_exit+0x150/0x22c0 [ 114.362707][ T6254] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 114.362719][ T6254] ? lockdep_hardirqs_on+0x7a/0x110 [ 114.362730][ T6254] ? __pfx_do_exit+0x10/0x10 [ 114.362742][ T6254] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 114.362757][ T6254] ? reacquire_held_locks+0x104/0x190 [ 114.362772][ T6254] ? rt_spin_lock+0x1e0/0x400 [ 114.362787][ T6254] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 114.362819][ T6254] do_group_exit+0x21b/0x2d0 [ 114.362833][ T6254] ? rt_spin_unlock+0x160/0x200 [ 114.362849][ T6254] get_signal+0x1284/0x1330 [ 114.362869][ T6254] arch_do_signal_or_restart+0xbc/0x830 [ 114.362887][ T6254] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 114.362910][ T6254] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.362921][ T6254] exit_to_user_mode_loop+0x86/0x480 [ 114.362934][ T6254] ? rcu_is_watching+0x15/0xb0 [ 114.362950][ T6254] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.362961][ T6254] do_syscall_64+0x33e/0xf80 [ 114.362971][ T6254] ? trace_irq_disable+0x3b/0x140 [ 114.362982][ T6254] ? clear_bhb_loop+0x40/0x90 [ 114.362994][ T6254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.363005][ T6254] RIP: 0033:0x7f6ee751c819 [ 114.363014][ T6254] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.363023][ T6254] RSP: 002b:00007f6ee576e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 114.363033][ T6254] RAX: fffffffffffffe00 RBX: 00007f6ee7795fa8 RCX: 00007f6ee751c819 [ 114.363041][ T6254] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f6ee7795fa8 [ 114.363047][ T6254] RBP: 00007f6ee7795fa0 R08: 0000000000000000 R09: 0000000000000000 [ 114.363060][ T6254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.363066][ T6254] R13: 00007f6ee7796038 R14: 00007ffc1e2c3430 R15: 00007ffc1e2c3518 [ 114.363082][ T6254] [ 114.363434][ T6254] Kernel Offset: disabled