last executing test programs: 1m37.241036022s ago: executing program 0 (id=540): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000240)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4090}, 0x0) sendmsg$alg(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x15) setuid(0xee00) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffe11) mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xb0a54e68b1cd2fdb, 0x103) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x4a040, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000500)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r2, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4008804) sendmsg$NL80211_CMD_GET_INTERFACE(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r2, 0x10, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20008c14}, 0x10) r3 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x2) getdents64(r3, &(0x7f0000000140)=""/46, 0x2e) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x15, 0x4, &(0x7f0000000580)=ANY=[@ANYRES32=r1], &(0x7f0000000c40)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x2f, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x62, 0x51cfa, 0x0, 0x8000008, 0x3, 0xfffffffe, 0x1, 0x0, 0x7cce8c743ee810df}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r4, 0x40505330, &(0x7f00000001c0)={0x800100, 0xfffffffd, 0x22, 0x6, 0x1101, 0x1}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000280)={0x18f, @tick=0x8, 0x6, {0x8, 0x80}, 0x44, 0x1}) 1m36.542309024s ago: executing program 0 (id=542): r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000180)=0x8003, 0x12) ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, &(0x7f0000000400)={@none, 0xfffffff9}) tee(r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x7072f8a472c794ea) close_range(r0, r0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r2, &(0x7f0000000480)={&(0x7f0000000200), 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x140, 0x0, 0x9, 0x401, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1e}, @NFCTH_TUPLE={0x84, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x3}, @NFCTH_TUPLE={0x3c, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0xc}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6}]}, @NFCTH_TUPLE={0x54, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0xe}}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010102}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}]}, 0x140}, 0x1, 0x0, 0x0, 0x800}, 0x4000001) r3 = syz_ublk_setup_io_uring(0x3a66, &(0x7f0000000280)={0x0, 0xbce1, 0x1, 0x1, 0x3aa}, &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)) io_uring_enter(r3, 0x6116, 0x4663, 0x20, &(0x7f00000003c0)={[0x10]}, 0x8) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x4, 0x8, 0x3, 0x0, 0x0, {0x1, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x4044804}, 0x4004000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x14}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) r5 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'tunl0\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x10, 0x40, 0x2, 0x5, {{0xc, 0x4, 0x1, 0x1, 0x30, 0x68, 0x0, 0x87, 0x29, 0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0xe}, {[@noop, @rr={0x7, 0xf, 0xc2, [@remote, @local, @rand_addr=0x64010101]}, @lsrr={0x83, 0xb, 0x4a, [@remote, @private=0xa010102]}]}}}}}) bind$xdp(r5, &(0x7f0000000140)={0x2c, 0x5, r6, 0x35}, 0x10) r7 = syz_open_dev$rtc(&(0x7f0000000000), 0x2, 0x400242) ioctl$BTRFS_IOC_START_SYNC(r7, 0x80089418, &(0x7f0000000040)) 1m35.968841138s ago: executing program 0 (id=543): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x401, 0x0) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fc"], 0x0) ioctl$COMEDI_SETRSUBD(r0, 0x6410) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000d40)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf2000000000000007000000080000002d0301000000000095000000000000007126000000000000bf670000000000005601000000ff07ad67060000020000006a0200000ee60000bf250000000000003d350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000160400000400f9ffad3001000000000084000000000000004500000001f0ffff95000000000000006e8ad524a56601a5585b7351ca1136aef2e9407e5c2501d11900db85604036883647b1fb3f1403b816f511c8c56e56e40b01005505f8a89dae4293b10f3631b25fc9f189084c7fddccff01361d355f6cce8ec2abcdf1bc9040daef2cfa2046e2091e269f4734ffa55eb2d4e8de20b38c8808b365b46bd54c68cd30139a8c3827a7dd6d6e2b5fea3906f8456b0000000000ff07efffffff0047018ae79db613d2aec070f718ab629b4975320dd7a7da532281fd22c7b835005bf52715396669836db6000000005b4f0591ee7c8cd263dd172b28d01c4d8d4fee81e3cdd5daf2cdad3d1a74a2f078aa6402483856a6e494408d0b33047f06aec2cc590df28efc7dbec6857db922195a271af103f03e1155197e067b2ebf4e2dae060959c9639564f000fc3cdd05a1575c91cf5ba8b2db403681ee48f5287123a0d246c0c4c00fe979dbc09ed4db22d7172adc6ae8faa5f9ad188e07000000000000008d88a0b4684559d46cae41db1b914e93f1f8000000000000000000e33de432e488ad0e724c2d14a1e770e116984a5700afb8a1f3d47277ef0e33e7e00ec5f74e10937ba0e321346977b7d1b18013f509675b5b0f352e30dffda780e95c301f4fc7d5a76475ace6b128b02bfd71023daffdf748a6bd356fcba6ec96373d1101000736ac0bbcb5f4836bddfe8bf46308000000ade9e59fcf271bb98bd0b8b5216b858b414c31682f9f3db2e4d8e5898e445fe55ac56c0d642986f8bbc7340bc6393f774318c9fc9b05788de2c6e601b50777e8dff581de1d5ae3d801ead7eba31126e2172fa1eadf5f3bec81004d00000000c8e4692e051c731f9ac766b7fd66278d40f0760f23e8c7d1f47cd8e02504e85e152955ad8acd989c0b2eea71414f533f5685c3904bfe1d0011ffc1ba5398f3d6812467c1a4186edd036f15bf847c50f79e1a0ad3d2b5080ecb0148e2b86177869884ae62420c9f1b534e969fce97ffff070000000000dbbfe0ed7c5853a665c0805752dca0e571d75cac5a5d8e4f6e05055b6dec5a9a5696f053a92d81fd9e5f2b9dbbe24f38e745b5a95d45003d0600e413dc623f3e6b096c8b0ad7438c6631388892c55b0671140afbfb83bba415f729fea4c8a8a86189dceedad84cdd17c46bdd847a1f4b0facd3744f5bbb06abb319204fca4bcd4297fe7b4cee75abf43e14fe861224799c0f12702964fc890a176fdafa2c9387280b5693c000c0304cece48642649375dae0b7979b229f708a97349e96e783af9a23cd3980a2c29d3d62875e5319cd51bdd224878a0b25edf0e83c930633bd9a0c3e28f359608ea326c77a1aa17318f392a0ec6c188916f452533d4327feccfd68ec8278a90252693fb133c4615801077e1d75420017c03990b855fe481a20b4919bb11c6d737b6545ef140a0fc339bb53953662f1454f9852e7c4e17eb8668f076c659f56d6c7f97a96d6cdf45cfe88b30c170000000001000000effbf33bd1becb0de0a080931f137967de563c29d81aacb3d48226a4e4b6670900000000000000fa68bff3693afc44db223f2be09295e4a8da03d23b48bb38b31a14ffcddd92c38f6b6d86a0e5ed47a82bad5d2a6dce4c4d353261260c9d7a6bd9f2c872c4172a3d2ac80dfb718cc159e6423065624f130000000000000000000000000000000000000000002a37163e8d7ef2f3c58d045f0700000094029acbe333aebd10f2118fbfeda3fa5500d52cd5241588d2b68a332edfef6d701c8936a25d68b841f982511392cc0d3a78616f8ce0f2877d099258bf85866d0ee7f803fa50fd41ef62b028d12028a7b497d92f544523290f520b0d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @sched_cls}, 0x48) 1m34.361255195s ago: executing program 0 (id=552): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) ioctl$TIOCSERGETLSR(r0, 0x5459, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000000), 0x12) ioctl$TUNSETOWNER(r1, 0x400454cc, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRESDEC], 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) recvmmsg$unix(r2, &(0x7f0000007180)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/176, 0xb0}, {&(0x7f0000000380)=""/23, 0x17}, {&(0x7f00000003c0)=""/189, 0xbd}, {&(0x7f0000000480)=""/111, 0x6f}], 0x4, &(0x7f0000000540)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x28}}, {{&(0x7f0000000580)=@abs, 0x6e, &(0x7f0000000940)=[{&(0x7f0000000600)=""/10, 0xa}, {&(0x7f0000000640)=""/222, 0xde}, {&(0x7f0000000740)=""/20, 0x14}, {&(0x7f0000000780)=""/40, 0x28}, {&(0x7f00000007c0)=""/190, 0xbe}, {&(0x7f0000000880)=""/113, 0x71}, {&(0x7f0000000900)=""/14, 0xe}], 0x7, &(0x7f00000009c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x10}}], 0xd0}}, {{&(0x7f0000000ac0)=@abs, 0x6e, &(0x7f0000000cc0)=[{&(0x7f0000000b40)=""/183, 0xb7}, {&(0x7f0000000c00)=""/166, 0xa6}], 0x2, &(0x7f0000000d00)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x118}}, {{0x0, 0x0, &(0x7f0000002480)=[{&(0x7f0000000e40)=""/181, 0xb5}, {&(0x7f0000000f00)=""/101, 0x65}, {&(0x7f0000000f80)=""/92, 0x5c}, {&(0x7f0000001000)=""/215, 0xd7}, {&(0x7f0000001100)=""/233, 0xe9}, {&(0x7f0000001200)=""/214, 0xd6}, {&(0x7f0000001300)=""/91, 0x5b}, {&(0x7f0000001380)=""/4096, 0x1000}, {&(0x7f0000002380)=""/229, 0xe5}], 0x9, &(0x7f0000002540)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xf8}}, {{&(0x7f0000002640), 0x6e, &(0x7f00000028c0)=[{&(0x7f00000026c0)=""/209, 0xd1}, {&(0x7f00000027c0)=""/245, 0xf5}], 0x2, &(0x7f0000002900)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x30}}, {{0x0, 0x0, &(0x7f0000004a80)=[{&(0x7f0000002940)=""/186, 0xba}, {&(0x7f0000002a00)=""/97, 0x61}, {&(0x7f0000002a80)=""/4096, 0x1000}, {&(0x7f0000003a80)=""/4096, 0x1000}], 0x4, &(0x7f0000004ac0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{&(0x7f0000004b40)=@abs, 0x6e, &(0x7f0000007040)=[{&(0x7f0000004bc0)=""/11, 0xb}, {&(0x7f0000004c00)=""/78, 0x4e}, {&(0x7f0000004c80)=""/110, 0x6e}, {&(0x7f0000004d00)=""/4096, 0x1000}, {&(0x7f0000005d00)=""/4096, 0x1000}, {&(0x7f0000006d00)=""/214, 0xd6}, {&(0x7f0000006e00)=""/55, 0x37}, {&(0x7f0000006e40)=""/100, 0x64}, {&(0x7f0000006ec0)=""/88, 0x58}, {&(0x7f0000006f40)=""/232, 0xe8}], 0xa, &(0x7f0000007100)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x48}}], 0x7, 0x40002062, 0x0) write(r2, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) 1m32.985596596s ago: executing program 0 (id=555): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) r1 = openat$fb0(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FBIOPAN_DISPLAY(r1, 0x4606, &(0x7f0000000040)={0x356, 0xa0, 0x780, 0x670, 0x3, 0x2, 0x0, 0xfffffffe, {0x5, 0x7}, {0x27, 0x0, 0x1}, {0x401, 0x7}, {0x1, 0x4, 0x1}, 0x3, 0x0, 0xe512, 0x7fff, 0x1, 0x6e, 0x10, 0x2, 0x3, 0x80, 0x8fac, 0x5, 0x8, 0x100, 0x0, 0xa}) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x100) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002cad7000010000000200000008000300", @ANYRES32=r4, @ANYBLOB="080026006c09000008002700030000000800a0007609"], 0x34}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f0000000180)={{0x0, 0x0, 0x5, 0x3, 0x7}, 0xc, 0xa7}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) add_key(&(0x7f00000003c0)='rxrpc\x00', 0x0, &(0x7f0000000380)="01000000020000a9584109b35ae051630b008145e94cd9776e2666e8ef739ad4", 0x20, 0xfffffffffffffffd) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) acct(0x0) chroot(0x0) r8 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r8, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) r9 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r9, 0x0, 0xcc, &(0x7f0000000140)={@multicast2, @multicast1, 0x0, "aaa517d60f2811d48c8a2cc60c4380bc23b510d442ff13482864280a9c0f4eb5"}, 0x3c) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_REMOVE(r10, 0x0, 0x8052) 1m28.350927175s ago: executing program 0 (id=566): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="7000000002060500000000000000000000000000120003006269746d61703a69702c6d6163000000050004000000000009000200f3797a3000000000240007800c0002800800014000008e020c0001800800014000000000080008400000001005000500020000000500010006"], 0x70}, 0x1, 0x0, 0x0, 0x4008880}, 0x800) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) 25.166899247s ago: executing program 3 (id=721): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005e80), 0x0, 0x40080a1) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f00000007c0)='keyring\x00\b\xa1\xf7\x930\xc0M\x01\xc6\xe1\x88\x8b\f\xbf\x97\x15\x02RCBX`\xe3\x16y\xb9\xf3\x13\xef\xaa\x82\xaaic\x05\x1a\x8dP\b\xb0\x81\x8dm\xa6\xf5-\xe3\x95\x9a\xc9iL\xa5\xf3\x00\x00\x00z\x04WX\x99\x93\xdc$\x80\xde%\x9dK\xd0\x81\xda\xac\b\x13\x91\x1bgL\xbd\xce\x84\x89\xbe\x90_\xde\xb8\x8cp\x1e#E2\xa9sq\xcf\x87\xe5\v\x9c\xbcY\x1e\xa1=d\xcb\x92\x05\x99s\x90cyA%\x1f\x9a8K.o\xb6T\x86\xe8\xb7\xcb\xcfA!\xb8@\x86\xf5*\xca\x1by8g\xca=!\xbd\t\x86\v(l^\x02!\xc9\x88V$\xb6\xec\x06\xdd\x16\x95\xf1\xdd\x10q\xb2\xfb\xcf\xce\x05\xc46!\x0e\x89\x17\xc74:\xe3\xdb\x91[p', 0x0) setgroups(0x40000000000002e6, &(0x7f0000000140)=[0x0]) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') read$FUSE(r0, &(0x7f0000000280)={0x2020}, 0x2020) 24.809601821s ago: executing program 3 (id=723): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)) r0 = syz_open_procfs(0x0, 0x0) read$FUSE(r0, &(0x7f00000040c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1, 0x1000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) fgetxattr(r3, 0x0, &(0x7f0000000280)=""/198, 0xc6) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x0, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) truncate(&(0x7f00000002c0)='./cgroup.cpu/cgroup.procs\x00', 0x30000000) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x300000b, 0x11, 0xffffffffffffffff, 0x42795000) r5 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r5, 0x2) r6 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r6, 0x2) r7 = open(&(0x7f0000000300)='.\x00', 0x100000, 0x0) flock(r7, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x8031, r5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x2, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[], 0x1c}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYRES64=r1], 0x24}, 0x1, 0x0, 0x0, 0x2400c885}, 0x4000) 22.245040862s ago: executing program 3 (id=727): r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f0000000040)={0x3, @sdr={0x3031334d, 0x5}}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000140)={0x8000000, 0x57ffa8d8, 0x2}) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x40) setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f00000001c0)=[{0x1, 0x1, {0x1, 0x0, 0x2}, {0x0, 0xff, 0x2}, 0x2, 0xff}, {0x2, 0x0, {0x0, 0x0, 0x7}, {0x0, 0xf0, 0x3}, 0x2, 0xfd}, {0x0, 0x0, {0x2, 0x0, 0x3}, {}, 0xff46cf93715bb774, 0x6fd40a49b0caa10}, {0x1, 0x3, {0x0, 0x0, 0x3}, {0x2, 0xff, 0x1}, 0xfd, 0x1}, {0x2, 0x2, {0x0, 0x0, 0x4}, {0x1, 0xff, 0x3}, 0x2, 0x1}, {0x0, 0x2, {0x1, 0xff}, {0x0, 0xf0}, 0x2, 0x1}, {0x3, 0x3, {0x2, 0x0, 0x1}, {0x1, 0xff}, 0xfe, 0xfe}, {0x3, 0x2, {0x0, 0xf0, 0x1}, {0x1, 0x1, 0x4}, 0x0, 0x1}, {0x2, 0x1, {0x2, 0x1}, {0x1, 0xff}, 0xfd}, {0x3, 0x3, {0x1, 0xff, 0x1}, {0x0, 0x0, 0x3}, 0xfe, 0x1}], 0x140) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01864c2, &(0x7f0000000300)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01864c2, &(0x7f0000000340)={0x0, 0x1, r1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01864c2, &(0x7f0000000380)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f00000003c0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000400)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_RESET(r1, 0xc01064c4, &(0x7f0000000480)={&(0x7f0000000440)=[r2, r3, r4, r5, 0x0, r6], 0x6}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01864c2, &(0x7f00000004c0)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc03064ca, &(0x7f0000000580)={&(0x7f0000000500)=[r5, r4, r7, r6], &(0x7f0000000540)=[0x1, 0x10], 0x7e, 0x4, 0x2}) ioctl$BLKROSET(r1, 0x125d, &(0x7f00000005c0)=0xfffffffeffffffff) syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000600)={0x1, 0x100, 0x5}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000680)={0x0, 0x10, &(0x7f0000000640)=[@in={0x2, 0x4e22, @local}]}, &(0x7f00000006c0)=0x10) r8 = syz_open_dev$dri(&(0x7f0000000700), 0x8, 0x100) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01864c2, &(0x7f0000000740)={0x0, 0x1, r1}) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r8, 0xc02064cc, &(0x7f0000000780)={r9, r7, 0x4, 0x0, 0x9}) syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f0000000840)={0x14, &(0x7f00000007c0)={0x0, 0x21, 0x5, {0x5, 0x24, "6d8db5"}}, &(0x7f0000000800)={0x0, 0x3, 0x14, @string={0x14, 0x3, "5205b2355f4ed2e55ffea7a4e8721e9da07d"}}}, &(0x7f0000000ac0)={0x44, &(0x7f0000000880)={0x20, 0x17, 0x43, "b305e8c656cff612b2abf78f158f18d95bb61b9e25787fee147dc78a9ef9516ac02405e7da9d6704b964df641bc61bac0cbed4da29bfc0522917e9ae721ae69516967b"}, &(0x7f0000000900)={0x0, 0xa, 0x1, 0xb}, &(0x7f0000000940)={0x0, 0x8, 0x1, 0xff}, &(0x7f0000000980)={0x20, 0x81, 0x3, "9550ae"}, &(0x7f00000009c0)={0x20, 0x82, 0x2, '~|'}, &(0x7f0000000a00)={0x20, 0x83, 0x2, '8y'}, &(0x7f0000000a40)={0x20, 0x84, 0x1, '|'}, &(0x7f0000000a80)={0x20, 0x85, 0x3, "6e9547"}}) sendmsg$nl_route_sched(r1, &(0x7f0000000dc0)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000d80)={&(0x7f0000000b80)=@delqdisc={0x1c4, 0x25, 0x300, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x6, 0xffff}, {0xd, 0xffe0}, {0xfffc, 0x6}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x9, 0x8, 0x7, 0x7, 0x8}, 0x0, 0x0, 0x1, 0x7, 0x99, 0x1b, 0x2, 0x1e, 0xec, 0x90, {0xfff, 0x10, 0xfffffffd, 0xa660, 0x1, 0x80000000}}}}, @TCA_RATE={0x6, 0x5, {0x9, 0xf7}}, @qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0x2}}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x3}, @TCA_STAB={0x64, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0xf8, 0x8001, 0x4, 0x0, 0x4, 0x8000, 0xa}}, {0x18, 0x2, [0x7, 0x1, 0x3, 0x3ff, 0x1, 0x8, 0x1, 0x1, 0x5, 0x8000]}}, {{0x1c, 0x1, {0x4, 0x9, 0x8, 0x94a, 0x1, 0xa, 0x3, 0x5}}, {0xe, 0x2, [0x10, 0x5, 0x6, 0x1, 0x71]}}]}, @TCA_RATE={0x6, 0x5, {0xfd, 0x5}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x4}, @TCA_STAB={0xb4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x6, 0xe337, 0xed, 0x2, 0x6, 0xc, 0x4}}, {0xc, 0x2, [0x24, 0x9, 0x7ff, 0xff]}}, {{0x1c, 0x1, {0x3, 0x5, 0x4, 0x4, 0x1, 0x0, 0x9, 0x7}}, {0x12, 0x2, [0x7, 0x9, 0x9, 0xfb6e, 0x0, 0x6, 0x1]}}, {{0x1c, 0x1, {0x4, 0x80, 0x6, 0x2, 0x1, 0x1, 0x9, 0x7}}, {0x12, 0x2, [0x100, 0x7, 0x4, 0x2, 0x1, 0x80, 0xfffd]}}, {{0x1c, 0x1, {0x5, 0x4b, 0x1, 0x0, 0x1, 0x3, 0xfffffffb, 0x3}}, {0xa, 0x2, [0x8, 0x0, 0x2]}}]}]}, 0x1c4}, 0x1, 0x0, 0x0, 0x2}, 0x408c1) ioctl$VIDIOC_G_FREQUENCY(r0, 0xc02c5638, &(0x7f0000000e00)={0x7, 0x4}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000e40)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r8, 0xc03064ca, &(0x7f0000000f00)={&(0x7f0000000e80)=[r5, r5, r6, r5, r10], &(0x7f0000000ec0)=[0x4, 0x101], 0x5, 0x5, 0x770335a18d397f6}) r11 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000f40), 0x200000, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000000f80)={0x0}) ioctl$DRM_IOCTL_SWITCH_CTX(r11, 0x40086424, &(0x7f0000000fc0)={r12, 0x3}) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r1, &(0x7f00000010c0)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001080)={&(0x7f0000001040)={0x34, 0x0, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xd8e2}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x44851}, 0x8000) bind$packet(r1, &(0x7f0000001100)={0x11, 0xc, 0x0, 0x1, 0x5, 0x6, @link_local}, 0x14) 20.734185176s ago: executing program 3 (id=734): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x20902, 0x0) write$sequencer(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="81041000000000005e1ecf425dff36cab897cad5503d38fcb6400ec54f694b1415fd0f3070ccab41a1781dfe10d7f6b40c6028ed3b6568f2658694b4b473eae34e850bba88b9487f47271f6bc82d4b3e8d75f8f9c7dad62d7e5dfac263b49584adf5455a284791a4efd20a1c"], 0x8) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) r2 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'team_slave_0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, [], [0xff], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) setresuid(0xffffffffffffffff, 0xffffffffffffffff, 0xee01) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) accept4$inet6(r1, 0x0, &(0x7f0000000100), 0x800) r3 = getpgid(0x0) syz_open_procfs$pagemap(r3, &(0x7f0000000140)) r4 = syz_pidfd_open(r3, 0x0) r5 = pidfd_getfd(r4, r4, 0x0) setns(r5, 0x66020000) umount2(&(0x7f0000000040)='.\x00', 0x0) sendmsg(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000000)="2c10", 0x2}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) ioctl$BTRFS_IOC_SYNC(r1, 0x9408, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000180)) socket(0x10, 0x3, 0x0) r6 = epoll_create(0x80) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) dup3(r7, r6, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) r9 = socket$inet(0xa, 0x801, 0x84) connect$inet(r9, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) 19.183357818s ago: executing program 3 (id=738): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000340)=ANY=[], 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x6, 0x9) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r0, &(0x7f00000193c0)=""/102392, 0x18ff8) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000c80)={0x148, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x134, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x58, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x2d}}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_EXPECT_NAT_TUPLE={0x34, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @private=0xa010100}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x9c, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x10}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @rand_addr=0x64010101}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x41}}}}]}]}]}, 0x148}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x181041, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000002c0)={0x28, 0x6, r3, 0x0, &(0x7f0000ae0000/0x2000)=nil, 0x2000, 0x7}) ioctl$IOMMU_IOAS_MAP(r2, 0x3b85, &(0x7f00000001c0)={0x28, 0x2, r3, 0x0, &(0x7f0000002500)="94", 0x1, 0x1000000007}) ioctl$IOMMU_IOAS_MAP(r2, 0x3b85, &(0x7f0000000400)={0x28, 0x2, r3, 0x0, &(0x7f0000000300)="d1", 0x1, 0xac}) ioctl$IOMMU_IOAS_UNMAP(r2, 0x3b86, &(0x7f0000000240)={0x18, r3, 0x7, 0x280000000}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='tmpfs\x00', 0x0, &(0x7f00000001c0)='grpquota') 15.218832344s ago: executing program 2 (id=745): listns(0x0, 0x0, 0x0, 0x0) gettid() r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008880}, 0x800) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c000000030601030000000000000000000000000500010007000000f3709de9584b253bd4bb6df0897754"], 0x1c}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0x6, 0x0, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) mremap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4000, 0x0, &(0x7f0000001000/0x4000)=nil) socket(0x2, 0x80805, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10) 15.110462984s ago: executing program 3 (id=746): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0xc000, 0x2000000a, 0x10001, 0x2, 0x0, [{0x2, 0x5, 0x87, '\x00', 0x9}, {0x2, 0x8, 0x5, '\x00', 0xa}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x2, 0xf5, '\x00', 0xf}, {0x9, 0x5, 0xc, '\x00', 0x9}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0xd, 0xd9, 0xfe, '\x00', 0x7f}, {0x3, 0x8, 0xc2, '\x00', 0x8}, {0x7f, 0x85, 0xb, '\x00', 0x8}, {0xd7, 0xd, 0x83, '\x00', 0x2}, {0x0, 0x8, 0x7, '\x00', 0xdc}, {0x44, 0xfe, 0x5, '\x00', 0x2}, {0xfe, 0x3, 0x26}, {0xcf, 0xf6, 0xb, '\x00', 0x5}, {0xf, 0x6, 0x5, '\x00', 0x10}, {0x81, 0x2, 0x6, '\x00', 0x8}, {0x9, 0x6, 0x42, '\x00', 0x18}, {0x5, 0x7, 0x2, '\x00', 0xc}, {0x3, 0x1, 0xc}, {0x0, 0x80, 0x1, '\x00', 0x81}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x3, 0x1, '\x00', 0x8}, {0x1, 0x23, 0xf3, '\x00', 0xfc}, {0x7, 0x81, 0x4, '\x00', 0x9}]}}) socket$inet6(0xa, 0xa, 0x10001) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = timerfd_create(0x0, 0x0) clock_gettime(0x0, 0x0) r3 = fanotify_init(0x1, 0x1) r4 = openat2$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)={0x4000, 0x28, 0x18}, 0x18) fanotify_mark(r3, 0x2, 0x3, r4, &(0x7f00000005c0)='./file0\x00') clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) timerfd_settime(r2, 0x0, &(0x7f0000000640)={{r5, r6+60000000}, {0x0, 0x3938700}}, 0x0) ppoll(&(0x7f0000000100), 0x0, 0x0, 0x0, 0x0) r7 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x0, 0x0) fchdir(r8) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/address_bits', 0x20000, 0x4) timerfd_settime(r8, 0x3, &(0x7f0000000440), 0x0) r9 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x2) syz_usb_connect(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="120100006e383a10d00701415cec0102030109022400010000000009042300020070400009058a03080004030e0905"], 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000080)={'syztnl2\x00', &(0x7f0000000000)={'ip6_vti0\x00', 0x0, 0x4, 0xb3, 0xb9, 0x5, 0x1, @initdev={0xfe, 0x88, '\x00', 0xfd, 0x0}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x10, 0x0, 0x80, 0x10008}}) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) setresgid(0x0, 0x0, 0xee01) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0xc004004) 9.922445547s ago: executing program 2 (id=754): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000240)={@cgroup, 0xffffffffffffffff, 0x1c, 0x2d}, 0x20) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, 0x0}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r1, 0x84, 0x7f, &(0x7f0000000140)="0000000000802089", 0x8) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfdef) r2 = syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba3e79"], 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000240)=ANY=[@ANYBLOB="40010400"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000280)={0x20, 0x10, 0x1b, "a6899846d25e0c2c03915940e5ee467b83b3fb0000000000000000"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x8d, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r4 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r4, 0x2) r5 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r5, 0x2) 6.74528154s ago: executing program 2 (id=761): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) ioctl$RTC_PIE_OFF(r0, 0x7006) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x2) ioctl$TIOCOUTQ(r1, 0x5411, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000080)={0x1, [0x0]}, &(0x7f0000000040)=0x8) r4 = socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100090c100000000000204e0000", 0x58}], 0x1) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) r10 = syz_open_procfs(0x0, &(0x7f00000010c0)='net\x00') fchdir(r10) creat(&(0x7f00000000c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xae) setitimer(0x2, &(0x7f0000000b40)={{}, {0x0, 0x2710}}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x40, 0x16f) execve(&(0x7f0000000080)='./file0\x00', &(0x7f0000000600)={[&(0x7f0000000900)=' wO\xd5\xce\x82\x89r\xa0\r\xc4Z\x15\xfds\x17g\n\xee\x9f\a0\xc3\x80\xbf\x80j$\xe6Z\xde\xf1pc\x96\x8f\xb5\x9d\xe3\x11m\x88~\xe3\xc7\xe3\t\xab\xbb@\xd9\xf8\xa2N\x03\xcf\xe4\xd6\x0ew\x10\xc2\xaa\x84bC\xc8\xd0\xe07\xa1\rIa\xb1^\xc5WG\xccV\xd3\x91\x84x\x9d\x8eg\x84\xeb\x9e;\x8f\xa1\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8r\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13S\x04\x12$\xcb\xbeV!\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m', &(0x7f0000000540)=' wO\xd5\xce\x82\x89r\xa0\r\xc4Z\x15\xfds\x17g\n\xee\x9f\a0\xc3\x80\xbf\x80j$\xe6Z\xde\xf1pc\x96\x8f\xb5\x9d\xe3\x11m\x88~\xe3\xc7\xe3\t\xab\xbb@\xd9\xf8\xa2N\x03\xcf\xe4\xd6\x0ew\x10\xc2\xaa\x84bC\xc8\xd0\xe07\xa1\rIa\xb1^\xc5WG\xccV\xd3\x91\x84x\x9d\x8eg\x84\xeb\x9e;\x8f\xa1\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8r\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13S\x04\x12$\xcb\xbeV!\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m']}, &(0x7f0000000240)={[&(0x7f0000000840)=' wO\xd5\xce\x82\x89r\xa0\r\xc4Z\x15\xfds\x17g\n\xee\x9f\a0\xc3\x80\xbf\x80j$\xe6Z\xde6\xfd\vQM`\x8f\xec\x11m\x88~\xe3\xc7\xe3\t\xab\xbb@\xd9\xf8\xa2N\x03\xcf\xe4\xd6\x0e}\x10\xc2\xaa\x84bC\xc8\xd0\xe07\xa1\rIa\xb1^\xc5WG\xccV\xd3\x91\x84x\x9d\x8eg\x84\xeb\x9e;\x8f\xa1\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8r\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13?\x87\'S\x04\x12$\xcb\xbeV!\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m']}) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) r14 = dup(r13) syz_ublk_setup_queues(r14, r12, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x1e1}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x40000, 0x1ffd, 0x10000004, 0x0, r14}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6388, 0x0, 0x20000000, 0x1f0, 0x0, r14}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x80, 0x2, 0x363}}], 0x1, &(0x7f0000000340)={0x2e, 0x12, 0x0, r14, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, r11, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r5, 0x84, 0x73, &(0x7f0000000140)={r3, 0x4, 0x30, 0xfffffffffffffff8, 0x5}, &(0x7f0000000180)=0x18) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="4015a2e40000941339e399fb0d5322214275e248868d71455aa0e63fe29305a5eb72b5e914051a41db7b9a1382cfabd01bb11311ad7b64a18f147e68dea2fbe048e73c578396e08f304650f929f74da4509a83fc8f0cdca73eb9810591ba4f25b98a764c69f9943e63c8d1f21af5dc3bab5e1f29b0f302f60cb615ed790b5faf9fef85063dfaf3b21bcec5c914ce06caedd105670f1b1b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x2, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="120100015ae4c41096050100f5050100030109021b0001000000000904d60001b5e14500090583"], 0x0) 5.02655693s ago: executing program 4 (id=765): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x5452, 0x0) 5.001066565s ago: executing program 4 (id=766): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000240)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4090}, 0x0) sendmsg$alg(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x15) setuid(0xee00) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffe11) mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xb0a54e68b1cd2fdb, 0x103) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x4a040, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r1) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r2, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4008804) sendmsg$NL80211_CMD_GET_INTERFACE(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r2, 0x10, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20008c14}, 0x10) r3 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x2) getdents64(r3, &(0x7f0000000140)=""/46, 0x2e) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x15, 0x4, &(0x7f0000000580)=ANY=[@ANYRES32=r1], &(0x7f0000000c40)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x2f, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x62, 0x51cfa, 0x0, 0x8000008, 0x3, 0xfffffffe, 0x1, 0x0, 0x7cce8c743ee810df}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r4, 0x40505330, &(0x7f00000001c0)={0x800100, 0xfffffffd, 0x22, 0x6, 0x1101, 0x1}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000280)={0x18f, @tick=0x8, 0x6, {0x8, 0x80}, 0x44, 0x1}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00'}) 3.750696093s ago: executing program 1 (id=767): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$usbfs(0x0, 0x76, 0x160341) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(0xffffffffffffffff, 0x0, 0x86) fchdir(r3) openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', &(0x7f0000000140)={0x474203, 0x408}, 0x18) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r4, 0x0) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a04000800ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) 3.701185383s ago: executing program 2 (id=768): syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, 0x0, 0x0, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa88a800008100000086dd6076cd8a0018000020010000000000000000000000000000fe80000000000000000000000000000000020000000000000709"], 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4e22, 0x2c, @mcast2, 0x9}, 0x1c) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x2100) ioctl$DRM_IOCTL_MODE_GET_LEASE(r2, 0xc01064c8, &(0x7f0000000840)={0x1, 0x0, &(0x7f0000000580)=[0x0]}) ioctl$DRM_IOCTL_MODE_SETPLANE(r2, 0xc03064b7, &(0x7f0000000300)={r3, 0x0, 0x0, 0x0, 0x10000, 0xa0000002, 0xddffffff, 0x80000001, 0x5, 0x3, 0x80000000, 0x31c}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = getpgrp(0xffffffffffffffff) kcmp$KCMP_EPOLL_TFD(0x0, r5, 0x7, r0, &(0x7f0000000a80)={0xffffffffffffffff, r1, 0x7}) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)={0x24, r6, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x200000c4) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @empty}, 0x1c) getsockopt$inet6_buf(r1, 0x29, 0x3d, 0x0, &(0x7f0000000140)) r7 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r7, 0x29, 0xc8, 0x0, 0xc000000) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) close_range(r8, 0xffffffffffffffff, 0x0) r9 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r10, 0x6, 0x1f, 0x0, &(0x7f0000000440)) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="2400000036000100fcff07000400000001000000100003800c00478008005c00", @ANYRES32=0x0, @ANYBLOB="0c29276a2f696bbdd6a2a155ae980933d994e6b814cbd0e3575d3e08d20bc48f9899e42c4d39c44d2d0ecb3727770478925f3c996813cf1491a56084c2dc65c21b951ef5eb63597779a28059aea3e47d9aaa38f8634d02115aa95798d41278ccbe95cbfa45762483a7ceef829da2d537b579"], 0x24}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) sendmmsg$alg(r0, &(0x7f0000000bc0)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000200)="b80130e3f0b0bd8dba50d8d335c5d3e054cd55411cf0f9122bda0fb9881a4a7750e00a284ff91e523f7cfb409855494de7028567d713859965a222bbaaaea186e9c7251672fdb25101e8fca604acb68bf3e04db64b23d10e40580c9f9bfa666f0cac", 0x62}, {&(0x7f0000000280)="20d834341cc2e3d19260381669e0beac163f8c9030", 0x15}, {&(0x7f00000002c0)="32e5a1acf6c8eb1b58c4c2c0473f423675afd4fc3315d5c4e7bdf4c044b81fa70e69ff5182bf694bbb", 0x29}, {&(0x7f0000000300)="52bbdf866fc1b0994d54b7f147bf", 0xe}, {&(0x7f0000000340)="f9d2677248595d9b78e80553fb39e2bc734887b7a7a59de54e92a1f303c6ec512cac7dd3cc3330f7d2e4eaddc0a3495b9a2831bc03e1e6407090aed145c49d4ee9d003c9714bd2f3363d71cf1fdd16a4c032d2f7199e849e5cdf0ab32bb7c6ba8348b9c2b359234ac6d6fa8bb95b9618eb1cc0c6f8434b6c51010e9a2e25362866221a67e043710c7d7b32cd3be7bb1ee03cd154f336681f15e5a50fe70bbc9932ca2c2e08a8b7daa9de7728c8206fef56fc2e0ed27576db7c7c27d741a82de358001ed2bf6b752df0ecd347c4321b05b46084fa", 0xd4}, {&(0x7f0000000440)="cb081eddc8562f13323cc94564a8d4e16ee8c957451580b8bc05e4a625c943906467083d34e0e877017f7acde34eaa4eb1e3a2230a05af2801d382ada741787283c8197eb75f24614cebddb4458e4a47f393e69cd4cd97aca466f87c612b2a7138c9dda97976598776a8d3ec7eea12ac1e67e8942763a50036b6fd9f175b16ab57b612a333eab4fc0c90248b4a70bb1fde4c00c4884ed5f0bf1dd04aca1d5db1bc1fd84fc64a4f26905e6141446ec733ce0af4d7464fa85dcd56325bad0c5c2fb1e2bc5c60210ed4199a1ac865b6ab3798020595629da25c946d6890ff", 0xdd}, {&(0x7f0000000540)="0d1cc6cf713bf3fa7ea9df17798522568104cc75462a81252924f0556820a66efa94c7ff59e129d53dc15f0f25806dbd03e17b1b901958180fd94076fbf09bb42e2433ed295355d9c55ca1de0c94d5ef87477d281668150439e5510c2d1c64132e708fb9629696df6cb2fcb49249ee6f3a6fe37243", 0x75}, {&(0x7f00000005c0)="a18e225364198a7d5dc958ce59c98edc65c40d06e6617cac30a21598038d85ab43552e43ae2f835f01d5582f53dc1b79fa081e6fe770b9b2243fbb669e6dcc716f5517dc33ef0ea06d70edf3c74e3a271c6b9aa417fe4d5483a109b60f6a93aac1b9901e45255507a35eb9c5", 0x6c}], 0x8, &(0x7f00000006c0)=ANY=[@ANYBLOB="b80000000000000017010000020000009d00000059fccdf8df4f66ef538c7b3e38b3954b6d11e2043b49c7690cb9c01a635cdfdd272b435933a63be4165188cdd20be69b6aa60fbcd08fa7821266a36c60a98b4b3f5836ab92b3eb76c7943b409d47b57a92b3035ce88dd2e8878a039bd5f24ada056f7ea4a7765e0d9c5cb549c3452fc28aafb1820ab06c036e5469be96f95c3a0323cc999191031a43d77d95b19c94cd36f7398827b978594cabc9728c0000000000000018000000000000001701000004000000251f000000000000180000000000000017010000040000000400000000000000600000000000000017010000020000004a0000006a33cf2af1e11438e04979eb04872bbd221291587e3543a4f9633502051d4c7cb6c6b060e33c7a3ebe72c6c3cf195d4c095c6a7d370234540cc2c15ffbde8d14e8fccf416f861d604a8200001800000000000000170100000300000001000000000000001800000000000000170100000400000001000100000000001800200000000000170100000400000008000000000000001800000000000000170100000300"/424], 0x1a8, 0x40000}, {0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000880)="303a4543bad7b7829d231996943d9407960a2379b028f248a00aefc61433dd9bd7f3636948dcae14d7ef9f9a9c5959b54bca2effbea7ec6492db4395a8d227b64914b6e2cf43f86aaf93818fd87eea28a5f76a60b36a057fda19b59224dc0d98a84441ee0ed90435d3d98bb53878b57eeae3bf1d4d90", 0x76}, {&(0x7f0000000900)="078c26ca1a9cb9a76bef5df3dd5c77a7462a9af374dcc5218a9c2ce9e1cf7697ec291d99144bf139b348a6822977c8a51a78289161f6b18ef03e6c7cca502ff66baca5d25d5cf9cce272cf4931490f9ed01eab5eb001ece63070a87f9f6d75f5fb94cb8d23668b4f3b61a29b1bcf5d4ceda028", 0x73}, {&(0x7f0000000980)="10b214355f82d7553e8cb7d449c8bb46bd443b052bcbb325e21096c976c1df31f443a2a99a5a960aa7913d908a838704e341be278f14543ff095f48d90cfca42472f82b51dfa6622d369df93fd54", 0x4e}], 0x3, &(0x7f0000000e80)=ANY=[@ANYBLOB="f0000000000000001701000002000000d90000000664c31fc08fbc37309ad50faf7a87707a264e68a2476acc86123ccece1e72ba07c9c0b0a5fd1d67205468eb0e932db2490a59f319bb9cd515159ff20cd1f1aee8128f4ce2c3f1900ca61d70057488e137d7398dd39f7013c78e72daf66df2e33567aed25f0bbef44d64474dfcb49806a59a08dce40af14daf39e28663835d9ac56a1d61b9111761f23bebd4cf9bfe1566c1bc4b7c3393990afacf391c41f45641a0d484989013c756933aff2d002953a5bcbdd3c560196967cdd69e24bc2b3431d2b42ba10156e3f86fb735208c2434057e96112cf683735fff08fe00000000010000000000001701000002000000e500000044e24132e9344e65eefca9024fe125fca6f827fa9b923e048c01d74787dead5eb2815599a97665da6ab42add58b5e9c00663810ec79e1c21df946f0a5ca5c617d626f302ed5f55dd56ef216ae36c48e778a2f82604d4c6efa7e0b860341812217e77789b14d57632585f731e0d4b36b9f5c995b47fe30a3132daf9d356867b97e6cab547874c7870a096e9c1886fc7e9aadbf1aa68763f05416ad136574877f70a79737939d8db7c059ba670ed60bbed2a07400e9a1dab0dcfeaf94e2d02d9087b7239143940f3829569aebdc1fa78422bf049c2618882e2916386c54d11073434a5f4c45dfff6a3b60188de9372e59700000000000000180000000000000017010000030000000000000000000000180000000000000017010000030000000100000000000000"], 0x220, 0x81}], 0x2, 0x4000041) r12 = syz_open_dev$sndpcmp(&(0x7f0000000500), 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r12, 0xc2604110, &(0x7f0000000280)={0x5, [[0x7ff, 0x0, 0x1, 0x0, 0xfffffffe], [0x101, 0x2, 0x200, 0x290, 0x0, 0x0, 0x0, 0x3], [0xfff, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3]], '\x00', [{0x0, 0x1, 0x1, 0x0, 0x0, 0x1}, {0x10}, {}, {0x0, 0x3}, {0x0, 0x1ff}, {0x63}, {}, {}, {}, {}, {0x1ff}, {0x3}], '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}) ioctl$SNDCTL_SEQ_SYNC(r9, 0x5101) 3.699966606s ago: executing program 4 (id=769): r0 = syz_io_uring_setup(0xefd, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) r4 = socket$inet6(0xa, 0x3, 0xccd) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x64, 0x0, r4, 0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0, 0x40000102, 0x0, {0xfffd}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x8880) io_uring_enter(r0, 0x1, 0xfffffffd, 0x9, 0x0, 0x0) setreuid(0xee01, 0xee00) r5 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x2}, {0x0, 0x9}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0xc}, @TCA_RATE={0x6, 0x5, {0x5, 0x4}}, @TCA_RATE={0x6, 0x5, {0x4c, 0x9}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x1}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x8, 0x2, 0x3800, 0x8, 0x0, 0xe190, 0x3}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x400c012}, 0x0) 2.650326852s ago: executing program 4 (id=770): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioprio_set$pid(0x2, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000180)=""/88, 0x58}], 0x1, 0x6, 0x0) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f0000000100)=0x3) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001000)=ANY=[@ANYBLOB="b7020000910c0000bfa30000000000000703000000feffff7a0af0ff0d00000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000009000000b7030000010000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb4500639100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4872f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd015c7bd3f15aa6aadbeab2a01685108e61aa00000000690e000000000000008b798b4f7458d1863cc67c4c6a06fa28e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1c6edc7a65d073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e183722537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d0616a48c7957e122665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f838f7eb12f63be72a3d817b324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b32176066599783568628f0309c3a01716d3706e1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d247714358d8b170c3b5cad11f72cd9d88e56b95fe9f3de5cfcfa5c1da8ba181580d9db035efe38834de171b64f4b4c1b242786dcc5679e3d0613cdf05b02d7ad4f3b8af27a696e9b8809c2d68fddfcbd451e81d37c11f95094b91fff61ab9e69780b133d1dbca5a78695131c34c855dd793f90ca3973a4bd5606151b3600373d2bbfb7b3638e713e7275af06107949ff5dffe24d3c448ae6e4646b346fe0a21eef1e55d0659eac930d00000000000ff52b98317c45417b900a47c1ae1103c09fc173c1cf28bf7ef7a61523c6b2dbb35f5ae29877bb8e1b3e257056c0d205d391ed7b2089a72a93885b9fc8430ff"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x4a) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x1f2f, 0xe80, 0x3253, &(0x7f00000007c0)="9f44948721919580684010a486dd", 0x0, 0x203ff, 0x0, 0xb1, 0x0, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39", &(0x7f0000000480)="586775fb9901db49815172c1f747d4b7f006cde302a9915d508a026726989f48e7d7a4f8ad25e0ba2080b91f0aa200a8337d1018b387d7cc57c2e4413b4a82788410d3e411cb0ca1efa96a886164d6c1f974cae23a3ebab481e5e42c99e6882ea35031d7f412f72150c3299311a83bb1e39af73c0c2350f08b8912c23c75902ac99f982b1ca770", 0x3}, 0x23) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0xe10, 0x870, 0x1, 0x1, 0xd59f80, 0x10000, 0x3f, 0x19ef, 0x3, 0x7, 0x2800, 0x2800, 0x2, 0xd1, 0xc, 0x30, {0x8, 0xfffffff7}, 0xd0, 0x9}}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYBLOB="05160000740f0000300012800b00010067726574617000002000028008000100", @ANYBLOB="663837633330b26389482ebd65df403d9059895dec90d0366022a62a40bfa3a31c8430e982c178bad78eb61cfa197a91ab19b6171effb3ef369df26c30290f51f642637e9a7f3a4ec489d2897adad6504bc78a0b26fb8efb12ae837c6fd8063472da93cd308c24caa9a57303f8e46c8773068c763129ceddb87094387c974482967ebd443e382c79d34993738155fed65857c23b6b7ac348ff5fa6533117605f8549e0512bddfa943d6229f1dcf4a96dc1b48479", @ANYBLOB="0800140000000a000400120006000300800000"], 0x58}}, 0x4000) 2.567897808s ago: executing program 1 (id=771): prctl$PR_MCE_KILL(0x4e, 0x0, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_REPLACE_IOAS(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0xb, r2, 0x0, r3}) 2.394175729s ago: executing program 1 (id=772): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x181041, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000002c0)={0x28, 0x6, r1, 0x0, &(0x7f0000ae0000/0x2000)=nil, 0x2000, 0x7}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f00000001c0)={0x28, 0x2, r1, 0x0, &(0x7f0000002500)="94", 0x1, 0x1000000007}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x7, r1, 0x0, 0x0, 0x0, 0xa}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000400)={0x28, 0x2, r1, 0x0, &(0x7f0000000300)="d1", 0x1, 0xac}) ioctl$IOMMU_IOAS_UNMAP(r0, 0x3b86, &(0x7f0000000240)={0x18, r1, 0x7, 0x280000000}) 2.169173376s ago: executing program 2 (id=773): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x24000800) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005e80)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000140)="2b3dcb037cf6eefdd865abf4cb8b1d17613cba0add0fc611e8e8edeb824ba694c30ed1d75eafde7ef357f25d275ad90b0ad65c4e3181039007d9096ab1a098bbd39415dc16914bbe91674f0deb1055864e2dc88798e3b3bf82e866c36f30af92cf204c04b58ef42e2744042bb5d5af77aff174539bd796f35aedbcaef63cce67d65f3321eb7700beef47308d9fc2b6d1a18e0484c097d27c0b2fc3b708c2897b9f55dd06c88b6db07b64431bff78a7eea64b1300bd6de2393e21f640e8b377e934245cd31a70d7f4823df271b235bd3d0b356a6bf5e7bd476d4ab8dd640f746dc0b90e080a49", 0xe6}, {&(0x7f0000000700)="fd3f12b11bb32a8a76e016794ce0643bb98d1c07715dc882ed4d2251b83d733eb420ce93c78f2f93f899e2bf36f1c58b9703d0ba118ad0b3f2cb5b3e51b06e5925d81e6e4fd80f16431e01f64990254de92d67902dd61b93f3006dfe188282923bb8aa3c7af13dec03b0521221868f11d0301d273e3f6726d107520e8b6aed", 0x7f}, {&(0x7f0000000600)="862581263117a595cc8b4d91c81820960c318c8396349d812700e75e525fa32b7544ceb489026264e882e6b071a12ffdb5e7ff35e2e1002046d831da9a75680854fe172d076b8dc3803ff9d26d49bf4b103373dff834806016adcd95ad25f436a81a0bd5d8cdc59c4ade543b23b68110ccfd37ccc3c778d40629a5e61b0e8cd6af005f30363c40c4bca955232d75b1609cd8da8771356513bf156c823aed462a5773220cfff599bc209f5f2d7baf2ac7cb7a896eb9708cef3b8c24cb243997889d197ee8bc4ab9a5c69628751008577fcf4074fb", 0xd4}, {&(0x7f0000000b40)="853d812375877866806fdff43051b4023fa2334c45b8d31dff2233f12c7ffec14b58976722a067ecd394dcf55ad8bc6adf88e0dd053d47e5ddc3b08ac01e128339844430d1033bc401927fd38018f2b0e9b713aa160d7b265e90ca90a88cbb0b1493ccdd35f17ed434451c742e3d9c7607fb338490fb578a48c1853a42bbd171367e33a75c9cde0160143ad61ffad513ae1059f9e31087c6448fae895aa68e70fa53628160525c97bf79f68247bf691e8e46c94c3c0fa018fd9d10c19d7bf717ef1da47e10b55a09cb5e411146c0", 0xce}], 0x4}}], 0x1, 0x40080a1) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f00000007c0)='keyring\x00\b\xa1\xf7\x930\xc0M\x01\xc6\xe1\x88\x8b\f\xbf\x97\x15\x02RCBX`\xe3\x16y\xb9\xf3\x13\xef\xaa\x82\xaaic\x05\x1a\x8dP\b\xb0\x81\x8dm\xa6\xf5-\xe3\x95\x9a\xc9iL\xa5\xf3\x00\x00\x00z\x04WX\x99\x93\xdc$\x80\xde%\x9dK\xd0\x81\xda\xac\b\x13\x91\x1bgL\xbd\xce\x84\x89\xbe\x90_\xde\xb8\x8cp\x1e#E2\xa9sq\xcf\x87\xe5\v\x9c\xbcY\x1e\xa1=d\xcb\x92\x05\x99s\x90cyA%\x1f\x9a8K.o\xb6T\x86\xe8\xb7\xcb\xcfA!\xb8@\x86\xf5*\xca\x1by8g\xca=!\xbd\t\x86\v(l^\x02!\xc9\x88V$\xb6\xec\x06\xdd\x16\x95\xf1\xdd\x10q\xb2\xfb\xcf\xce\x05\xc46!\x0e\x89\x17\xc74:\xe3\xdb\x91[p', 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB="020300030300000000070000fedbdf2501000900000065"], 0x18}, 0x1, 0x7}, 0x20008000) setgroups(0x40000000000002e6, &(0x7f0000000140)=[0x0]) read$FUSE(0xffffffffffffffff, &(0x7f0000000280)={0x2020}, 0x2020) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FIOCLEX(r3, 0x5451) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f00000000c0), 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket(0x40000000015, 0x5, 0x0) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r4, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[], 0x1a000}}, 0x0) sendmsg$rds(r4, &(0x7f0000001180)={0x0, 0x0, 0x0}, 0x0) 2.145122028s ago: executing program 1 (id=774): userfaultfd(0x80001) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000005580)=""/102392, 0x18ff8) syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) (fail_nth: 1) 1.430099651s ago: executing program 1 (id=775): userfaultfd(0x80001) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000005580)=""/102392, 0x18ff8) syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_DYNSET_SET_NAME={0x9, 0x1, 'syz1\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}]}], {0x14}}, 0x78}}, 0x0) syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) 545.999912ms ago: executing program 4 (id=776): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x5452, 0x0) 336.141709ms ago: executing program 4 (id=777): mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYRESHEX, @ANYRES32, @ANYRESDEC=0x0]) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x14018891) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x202, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = syz_usbip_server_init(0x1) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120008000000000904"], 0x0) write$usbip_server(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="0000000300000001"], 0x35) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000a40)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x128, 0x1170, 0x1398, 0x128, 0x1170, 0x288, 0x1398, 0x1398, 0x288, 0x1398, 0x3, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x1, 0x0, 0xd, 0x5}}]}, @unspec=@TRACE={0x20}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, [], [0x0, 0x0, 0xff000000], 'sit0\x00', 'veth1_vlan\x00', {}, {}, 0x84}, 0x0, 0xf8, 0x160, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}, @inet=@rpfilter={{0x28}, {0x4}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x4, 0xad84, 0x4, 0x2, 'snmp_trap\x00', 'syz0\x00', {0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) sendmsg$alg(0xffffffffffffffff, &(0x7f0000004840)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)}], 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) readv(r0, &(0x7f0000000440)=[{&(0x7f0000000100)=""/228, 0xe4}], 0x1) r3 = fsopen(0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) r5 = fsmount(r3, 0x0, 0x0) fchdir(r5) mmap$usbfs(&(0x7f0000a1d000/0x2000)=nil, 0x2000, 0x0, 0x80010, r5, 0x6) syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c0000"], 0x0) 273.947287ms ago: executing program 1 (id=778): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, 0x0) r1 = epoll_create(0x4) r2 = epoll_create1(0x80000) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_SET_FORCE_PACK_ID(r3, 0x227b, &(0x7f00000001c0)=0x2001) r4 = fcntl$dupfd(r3, 0x0, r3) readv(r4, &(0x7f0000000240)=[{&(0x7f0000001140)=""/136, 0x88}], 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f00000f5000/0x2000)=nil, 0x2000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000180)) syz_open_procfs(0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) socket$inet6(0xa, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) move_mount(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x145) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000040900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e64000000080002400000000058000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e640000000800024000000010140000001000010000000000000000000500000a25d9ccab7ce4521b437e6aa990dae4a622557550d5aa0759ffc37570be9ad5eca46bf675a9801cde9993e1242b97ce8e0a9ccfdaa1209df104"], 0xf8}}, 0x0) 0s ago: executing program 2 (id=779): ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000040000000500000a28000000000a030000000009000000000a00000708000240000000020900010073797a31003c66190000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100017b41b7fc0b6d52ebbb920f183fe463f29eaa38fc5546f4e71c2d8149f4a0e825e86e8b48d1b9dc1ea68c42c4411bd46a36eeff384a8d9a502e14144ef0545c15835b32000998fb5dd7a40a062c0e5438c04fb401ef4de00943ec2f7024b5fe461b42cee4d315aa0cfd17882a2b2f613a9eb0070e45ffe617696f9c6418a7ae23f1faad4379d2d8316b35f485882935778413425a0c3dee5f7717f25ef650c6fae6fc6be86020a253e6e281a89e7593a29a7024180633ecff6b9a0c68644138705be25c255ac33d736b4934590b92452791937452440820f36eda43617bb994326f0e90bc1afd5b60d81232e6b660f1ce23435e4076366c8666bd2ea468831fc0373622c5b2b687bf5b389eb3990194b1ef31624c2297dff7c214a342363f40636807b63b817f66f46ca827d3bbf11a32a1d4a6d0365f58e85922296663902361e1bf02"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$key(0xf, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], &(0x7f0000000840)=""/262, 0x37, 0x106, 0x1}, 0x28) bpf$MAP_CREATE(0xe4ffffff00000000, &(0x7f0000004440)=@base={0x14, 0x4, 0x4, 0x7, 0x4, 0xffffffffffffffff, 0x0, '\x00', 0x0, r1, 0x2, 0x1}, 0x48) syz_emit_ethernet(0x2a, &(0x7f0000000580)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x20, 0x1c, 0x0, 0x0, 0x0, 0x2f, 0x0, @empty, @multicast1}, {0x2001, 0x880b, 0x8}}}}}, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0x1, 0x48042) writev(r2, &(0x7f0000000c40)=[{0x0}, {&(0x7f00000005c0)="c21cfb", 0x3}, {&(0x7f00000007c0), 0x300}, {&(0x7f0000000900), 0x4000}], 0xe) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="6c0000000206010200000000000000000000000005000500000000000900020073797a3000000000100003006269746d61703a706f727400240007800600054000000000060004400000000008000640000000000800080099f7cd600500010007000000050004"], 0x6c}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f0000000140)={0xc, 0x8, {0x56, 0x3, 0x200, {0xc83, 0xe457}, {0x9, 0x6}, @period={0x5b, 0x80, 0xf2, 0x1, 0x8, {0x9, 0x1, 0x0, 0x8}, 0x5, &(0x7f0000000000)=[0xfff9, 0x4, 0x81, 0x1, 0x5]}}, {0x51, 0x73, 0x3ff, {0x4, 0x6}, {0x9, 0x10}, @ramp={0x14, 0x5, {0xc785, 0xd, 0x3, 0x4}}}}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0) unshare(0x400) r4 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) ftruncate(r4, 0xffff) fcntl$addseals(r4, 0x409, 0x7) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x8080, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x85bc, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x3, 0xffffffffffffffff, 0x9, 0xfffffffffffffffd, 0x10, 0x80000006}, 0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000040)={@multicast, @empty, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @empty, @remote, @multicast, @remote}}}}, 0x0) syz_emit_ethernet(0xfdef, &(0x7f0000000040)=ANY=[], 0x0) kernel console output (not intermixed with test programs): lecting invalid altsetting 1 [ 298.183052][ T11] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 298.226908][ T11] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 298.227253][ T11] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 298.227335][ T11] usb 2-1: media controller created [ 298.322083][ T11] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 298.836969][ T7100] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.972442][ T7100] bridge0: port 1(bridge_slave_0) entered disabled state [ 299.486230][ T11] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 299.486290][ T11] zl10353_read_register: readreg error (reg=127, ret==-71) [ 299.497338][ T11] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 299.724938][ T11] usb 2-1: USB disconnect, device number 10 [ 299.759823][ T7105] netlink: 48 bytes leftover after parsing attributes in process `syz.1.365'. [ 301.182687][ T7109] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.224285][ T7109] bridge0: port 1(bridge_slave_0) entered disabled state [ 301.899385][ T5846] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 301.985408][ T7127] mmap: syz.4.371 (7127) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 302.051714][ T5846] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 302.051761][ T5846] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 302.054777][ T5846] usb 2-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 302.054827][ T5846] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 302.054847][ T5846] usb 2-1: Product: syz [ 302.054862][ T5846] usb 2-1: Manufacturer: syz [ 302.054877][ T5846] usb 2-1: SerialNumber: syz [ 302.144685][ T5846] usb 2-1: config 0 descriptor?? [ 302.218641][ T7130] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 302.251052][ T11] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 302.260091][ T9] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 302.365175][ T5846] usb 2-1: USB disconnect, device number 11 [ 302.401278][ T11] usb 1-1: Using ep0 maxpacket: 16 [ 302.420745][ T11] usb 1-1: config 228 has too many interfaces: 245, using maximum allowed: 32 [ 302.420774][ T11] usb 1-1: config 228 has an invalid descriptor of length 0, skipping remainder of the config [ 302.420794][ T11] usb 1-1: config 228 has 1 interface, different from the descriptor's value: 245 [ 302.427300][ T11] usb 1-1: New USB device found, idVendor=0b05, idProduct=1743, bcdDevice= 0.40 [ 302.427321][ T11] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 302.427335][ T11] usb 1-1: Product: syz [ 302.427346][ T11] usb 1-1: Manufacturer: syz [ 302.427356][ T11] usb 1-1: SerialNumber: syz [ 302.510375][ T9] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 302.510417][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 302.553086][ T9] usb 5-1: config 0 descriptor?? [ 302.639853][ T9] cp210x 5-1:0.0: cp210x converter detected [ 302.768252][ T11] usb 1-1: skipping empty audio interface (v1) [ 303.960704][ T9] cp210x 5-1:0.0: failed to get vendor val 0x0010 size 3: -121 [ 304.512427][ T9] cp210x 5-1:0.0: failed to get vendor val 0x000e size 678: -71 [ 304.512488][ T9] cp210x 5-1:0.0: GPIO initialisation failed: -71 [ 304.697387][ T7145] FAULT_INJECTION: forcing a failure. [ 304.697387][ T7145] name failslab, interval 1, probability 0, space 0, times 0 [ 304.697420][ T7145] CPU: 1 UID: 0 PID: 7145 Comm: syz.3.376 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 304.697439][ T7145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 304.697449][ T7145] Call Trace: [ 304.697455][ T7145] [ 304.697462][ T7145] dump_stack_lvl+0xe8/0x150 [ 304.697489][ T7145] should_fail_ex+0x467/0x600 [ 304.697515][ T7145] should_failslab+0xa8/0x100 [ 304.697541][ T7145] __kmalloc_noprof+0xfe/0x780 [ 304.697562][ T7145] ? rcu_is_watching+0x15/0xb0 [ 304.697588][ T7145] ? tomoyo_realpath_from_path+0xef/0x640 [ 304.697606][ T7145] ? tomoyo_realpath_from_path+0xef/0x640 [ 304.697630][ T7145] tomoyo_realpath_from_path+0xef/0x640 [ 304.697656][ T7145] ? tomoyo_path_number_perm+0x219/0x5f0 [ 304.697683][ T7145] tomoyo_path_number_perm+0x246/0x5f0 [ 304.697713][ T7145] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 304.697737][ T7145] ? __lock_acquire+0x683/0x2ce0 [ 304.697769][ T7145] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 304.697789][ T7145] ? hook_file_ioctl+0x1f3/0x600 [ 304.697822][ T7145] ? lockdep_hardirqs_on+0x7a/0x110 [ 304.697857][ T7145] ? __fget_files+0x2a/0x420 [ 304.697882][ T7145] ? __fget_files+0x2a/0x420 [ 304.697902][ T7145] ? __fget_files+0x3a8/0x420 [ 304.697921][ T7145] ? __fget_files+0x2a/0x420 [ 304.697946][ T7145] security_file_ioctl+0xc3/0x2a0 [ 304.697975][ T7145] __se_sys_ioctl+0x47/0x170 [ 304.698002][ T7145] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 304.698022][ T7145] do_syscall_64+0x174/0x580 [ 304.698044][ T7145] ? trace_irq_disable+0x3b/0x140 [ 304.698066][ T7145] ? clear_bhb_loop+0x40/0x90 [ 304.698088][ T7145] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 304.698105][ T7145] RIP: 0033:0x7f8666f3de59 [ 304.698122][ T7145] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 304.698137][ T7145] RSP: 002b:00007f8665196028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 304.698155][ T7145] RAX: ffffffffffffffda RBX: 00007f86671c5fa0 RCX: 00007f8666f3de59 [ 304.698170][ T7145] RDX: 0000200000000240 RSI: 00000000c06864ce RDI: 0000000000000003 [ 304.698184][ T7145] RBP: 00007f8665196090 R08: 0000000000000000 R09: 0000000000000000 [ 304.698194][ T7145] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 304.698203][ T7145] R13: 00007f86671c6038 R14: 00007f86671c5fa0 R15: 00007ffdcd751058 [ 304.698228][ T7145] [ 304.698236][ T7145] ERROR: Out of memory at tomoyo_realpath_from_path. [ 304.993752][ T11] snd-usb-audio 1-1:228.0: probe with driver snd-usb-audio failed with error -22 [ 305.026600][ T9] usb 5-1: cp210x converter now attached to ttyUSB0 [ 305.060070][ T9] usb 5-1: USB disconnect, device number 11 [ 305.064289][ T11] usb 1-1: USB disconnect, device number 14 [ 305.211404][ T7153] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 305.320312][ T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 305.323734][ T9] cp210x 5-1:0.0: device disconnected [ 305.402730][ T6125] udevd[6125]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:228.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 305.547207][ T7160] netlink: 52 bytes leftover after parsing attributes in process `syz.0.382'. [ 306.404935][ T7174] sctp: [Deprecated]: syz.0.382 (pid 7174) Use of struct sctp_assoc_value in delayed_ack socket option. [ 306.404935][ T7174] Use struct sctp_sack_info instead [ 306.839288][ T5987] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 307.011464][ T5987] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 307.011492][ T5987] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 307.058260][ T5987] usb 4-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 307.058291][ T5987] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.058312][ T5987] usb 4-1: Product: syz [ 307.058327][ T5987] usb 4-1: Manufacturer: syz [ 307.058342][ T5987] usb 4-1: SerialNumber: syz [ 307.136041][ T5987] usb 4-1: config 0 descriptor?? [ 307.144622][ T7176] tmpfs: Unknown parameter 'grpquota' [ 307.360685][ T822] usb 4-1: USB disconnect, device number 16 [ 307.589239][ T5987] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 307.739211][ T5987] usb 2-1: Using ep0 maxpacket: 16 [ 307.747443][ T5987] usb 2-1: config 228 has too many interfaces: 245, using maximum allowed: 32 [ 307.747471][ T5987] usb 2-1: config 228 has an invalid descriptor of length 0, skipping remainder of the config [ 307.747491][ T5987] usb 2-1: config 228 has 1 interface, different from the descriptor's value: 245 [ 307.787148][ T5987] usb 2-1: New USB device found, idVendor=0b05, idProduct=1743, bcdDevice= 0.40 [ 307.787180][ T5987] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.787200][ T5987] usb 2-1: Product: syz [ 307.787215][ T5987] usb 2-1: Manufacturer: syz [ 307.787230][ T5987] usb 2-1: SerialNumber: syz [ 307.822617][ T7185] FAULT_INJECTION: forcing a failure. [ 307.822617][ T7185] name failslab, interval 1, probability 0, space 0, times 0 [ 307.822701][ T7185] CPU: 0 UID: 0 PID: 7185 Comm: syz.4.391 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 307.822765][ T7185] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 307.822797][ T7185] Call Trace: [ 307.822819][ T7185] [ 307.822841][ T7185] dump_stack_lvl+0xe8/0x150 [ 307.822938][ T7185] should_fail_ex+0x467/0x600 [ 307.823027][ T7185] should_failslab+0xa8/0x100 [ 307.823121][ T7185] __kmalloc_noprof+0xfe/0x780 [ 307.823206][ T7185] ? rcu_is_watching+0x15/0xb0 [ 307.823291][ T7185] ? tomoyo_realpath_from_path+0xef/0x640 [ 307.823352][ T7185] ? tomoyo_realpath_from_path+0xef/0x640 [ 307.823422][ T7185] tomoyo_realpath_from_path+0xef/0x640 [ 307.823487][ T7185] ? tomoyo_path_number_perm+0x219/0x5f0 [ 307.823518][ T7185] tomoyo_path_number_perm+0x246/0x5f0 [ 307.823623][ T7185] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 307.823739][ T7185] ? __lock_acquire+0x683/0x2ce0 [ 307.823855][ T7185] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 307.823919][ T7185] ? hook_file_ioctl+0x1f3/0x600 [ 307.823984][ T7185] ? lockdep_hardirqs_on+0x7a/0x110 [ 307.824101][ T7185] ? __fget_files+0x2a/0x420 [ 307.824188][ T7185] ? __fget_files+0x2a/0x420 [ 307.824253][ T7185] ? __fget_files+0x3a8/0x420 [ 307.824326][ T7185] ? __fget_files+0x2a/0x420 [ 307.824404][ T7185] security_file_ioctl+0xc3/0x2a0 [ 307.824498][ T7185] __se_sys_ioctl+0x47/0x170 [ 307.824585][ T7185] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.824648][ T7185] do_syscall_64+0x174/0x580 [ 307.824707][ T7185] ? trace_irq_disable+0x3b/0x140 [ 307.824773][ T7185] ? clear_bhb_loop+0x40/0x90 [ 307.824847][ T7185] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.824902][ T7185] RIP: 0033:0x7f65dee6de59 [ 307.824955][ T7185] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 307.824987][ T7185] RSP: 002b:00007f65dd0c6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 307.825010][ T7185] RAX: ffffffffffffffda RBX: 00007f65df0f5fa0 RCX: 00007f65dee6de59 [ 307.825053][ T7185] RDX: 00002000000002c0 RSI: 00000000c058560f RDI: 0000000000000003 [ 307.825101][ T7185] RBP: 00007f65dd0c6090 R08: 0000000000000000 R09: 0000000000000000 [ 307.825149][ T7185] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 307.825189][ T7185] R13: 00007f65df0f6038 R14: 00007f65df0f5fa0 R15: 00007ffeb9601bb8 [ 307.825274][ T7185] [ 307.832689][ T7185] ERROR: Out of memory at tomoyo_realpath_from_path. [ 308.322610][ T5987] usb 2-1: skipping empty audio interface (v1) [ 308.453327][ T822] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 308.526959][ T5987] snd-usb-audio 2-1:228.0: probe with driver snd-usb-audio failed with error -22 [ 308.540626][ T5987] usb 2-1: USB disconnect, device number 12 [ 308.611377][ T822] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 308.611416][ T822] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 308.611455][ T822] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 308.611479][ T822] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 308.665493][ T7187] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 308.696846][ T822] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 308.788222][ T6125] udevd[6125]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:228.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 308.977827][ T37] kauditd_printk_skb: 47 callbacks suppressed [ 308.977846][ T37] audit: type=1326 audit(1782952636.375:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7186 comm="syz.3.392" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8666f3de59 code=0x0 [ 310.779356][ T7211] netlink: 28 bytes leftover after parsing attributes in process `syz.0.400'. [ 310.979177][ T11] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 311.144258][ T11] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 311.144289][ T11] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 311.155654][ T11] usb 5-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 311.156353][ T11] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.156396][ T11] usb 5-1: Product: syz [ 311.156457][ T11] usb 5-1: Manufacturer: syz [ 311.156489][ T11] usb 5-1: SerialNumber: syz [ 311.197979][ T11] usb 5-1: config 0 descriptor?? [ 311.543027][ T11] usb 5-1: USB disconnect, device number 12 [ 311.603871][ T7225] syz.1.408(7225): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 311.798358][ T11] usb 4-1: USB disconnect, device number 17 [ 311.985552][ T7233] netlink: 52 bytes leftover after parsing attributes in process `syz.0.410'. [ 313.295751][ T7242] sctp: [Deprecated]: syz.0.410 (pid 7242) Use of struct sctp_assoc_value in delayed_ack socket option. [ 313.295751][ T7242] Use struct sctp_sack_info instead [ 313.584419][ T7249] netlink: 68 bytes leftover after parsing attributes in process `syz.4.414'. [ 314.420551][ T11] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 314.549623][ T7267] ÿ: renamed from bond_slave_0 (while UP) [ 314.589206][ T11] usb 4-1: Using ep0 maxpacket: 32 [ 314.592646][ T11] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 314.592680][ T11] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 314.592708][ T11] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 314.592731][ T11] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 314.629988][ T11] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 314.630028][ T11] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.630061][ T11] usb 4-1: Product: syz [ 314.630076][ T11] usb 4-1: Manufacturer: syz [ 314.630124][ T11] usb 4-1: SerialNumber: syz [ 314.640971][ T5739] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 314.731034][ T11] usb 4-1: config 0 descriptor?? [ 314.822854][ T37] audit: type=1326 audit(1782952642.225:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7271 comm="syz.0.425" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f84428cde59 code=0x7ffc0000 [ 314.823452][ T37] audit: type=1326 audit(1782952642.225:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7271 comm="syz.0.425" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f84428cde59 code=0x7ffc0000 [ 314.823739][ T37] audit: type=1326 audit(1782952642.225:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7271 comm="syz.0.425" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f84428cde59 code=0x7ffc0000 [ 314.824030][ T37] audit: type=1326 audit(1782952642.225:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7271 comm="syz.0.425" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=429 compat=0 ip=0x7f84428cde59 code=0x7ffc0000 [ 314.824391][ T37] audit: type=1326 audit(1782952642.225:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7271 comm="syz.0.425" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f84428cde59 code=0x7ffc0000 [ 314.824890][ T37] audit: type=1326 audit(1782952642.225:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7271 comm="syz.0.425" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f84428cde59 code=0x7ffc0000 [ 314.825312][ T37] audit: type=1326 audit(1782952642.225:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7271 comm="syz.0.425" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f84428cde59 code=0x7ffc0000 [ 314.825359][ T37] audit: type=1326 audit(1782952642.225:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7271 comm="syz.0.425" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f84428cde59 code=0x7ffc0000 [ 314.826696][ T5739] usb 3-1: Using ep0 maxpacket: 16 [ 314.860408][ T5739] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 314.860568][ T5739] usb 3-1: config 0 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 314.860645][ T5739] usb 3-1: config 0 interface 0 has no altsetting 0 [ 314.860734][ T5739] usb 3-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 314.860798][ T5739] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.921257][ T37] audit: type=1326 audit(1782952642.325:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7271 comm="syz.0.425" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f84428cde59 code=0x7ffc0000 [ 314.921420][ T37] audit: type=1326 audit(1782952642.325:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7271 comm="syz.0.425" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f84428cdbc2 code=0x7ffc0000 [ 314.951958][ T5739] usb 3-1: config 0 descriptor?? [ 315.355973][ T7276] netlink: 52 bytes leftover after parsing attributes in process `syz.1.426'. [ 315.752886][ T7276] sctp: [Deprecated]: syz.1.426 (pid 7276) Use of struct sctp_assoc_value in delayed_ack socket option. [ 315.752886][ T7276] Use struct sctp_sack_info instead [ 315.777002][ T5739] petalynx 0003:18B1:0037.0001: reserved main item tag 0xd [ 315.777164][ T5739] petalynx 0003:18B1:0037.0001: unknown main item tag 0x0 [ 315.777200][ T5739] petalynx 0003:18B1:0037.0001: unknown main item tag 0x1 [ 315.777228][ T5739] petalynx 0003:18B1:0037.0001: unknown main item tag 0x0 [ 315.777256][ T5739] petalynx 0003:18B1:0037.0001: unknown main item tag 0x0 [ 315.777284][ T5739] petalynx 0003:18B1:0037.0001: unknown main item tag 0x3 [ 315.777311][ T5739] petalynx 0003:18B1:0037.0001: item fetching failed at offset 43/44 [ 315.789274][ T5739] petalynx 0003:18B1:0037.0001: parse failed [ 315.789357][ T5739] petalynx 0003:18B1:0037.0001: probe with driver petalynx failed with error -22 [ 315.997660][ T5725] usb 4-1: USB disconnect, device number 18 [ 316.100761][ T5739] usb 3-1: USB disconnect, device number 14 [ 316.472266][ T7296] macsec1: entered promiscuous mode [ 316.893089][ T7304] netlink: 8 bytes leftover after parsing attributes in process `syz.2.433'. [ 317.313809][ T7310] ALSA: mixer_oss: invalid OSS volume '' [ 319.195461][ T7333] netlink: 16 bytes leftover after parsing attributes in process `syz.0.444'. [ 319.195494][ T7333] netlink: 40 bytes leftover after parsing attributes in process `syz.0.444'. [ 319.229395][ T7333] netlink: 20 bytes leftover after parsing attributes in process `syz.0.444'. [ 321.539625][ T5987] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 322.465116][ T7374] FAULT_INJECTION: forcing a failure. [ 322.465116][ T7374] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 322.465150][ T7374] CPU: 0 UID: 0 PID: 7374 Comm: syz.2.456 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 322.465174][ T7374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 322.465187][ T7374] Call Trace: [ 322.465204][ T7374] [ 322.465213][ T7374] dump_stack_lvl+0xe8/0x150 [ 322.465245][ T7374] should_fail_ex+0x467/0x600 [ 322.465280][ T7374] _copy_to_user+0x31/0xb0 [ 322.465317][ T7374] simple_read_from_buffer+0xe1/0x170 [ 322.465351][ T7374] proc_fail_nth_read+0x1be/0x230 [ 322.465383][ T7374] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 322.465414][ T7374] ? rw_verify_area+0x250/0x4d0 [ 322.465444][ T7374] ? __fget_files+0x2a/0x420 [ 322.465472][ T7374] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 322.465500][ T7374] vfs_read+0x219/0xa90 [ 322.465540][ T7374] ? __pfx_vfs_read+0x10/0x10 [ 322.465575][ T7374] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 322.465602][ T7374] ? lockdep_hardirqs_on+0x7a/0x110 [ 322.465628][ T7374] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 322.465653][ T7374] ? mutex_lock_nested+0x152/0x1d0 [ 322.465684][ T7374] ? fdget_pos+0x252/0x320 [ 322.465721][ T7374] ksys_read+0x156/0x270 [ 322.465756][ T7374] ? __pfx_ksys_read+0x10/0x10 [ 322.465799][ T7374] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.465823][ T7374] do_syscall_64+0x174/0x580 [ 322.465848][ T7374] ? trace_irq_disable+0x3b/0x140 [ 322.465874][ T7374] ? clear_bhb_loop+0x40/0x90 [ 322.465901][ T7374] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.465922][ T7374] RIP: 0033:0x7ffb7db2e68e [ 322.465942][ T7374] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 322.465961][ T7374] RSP: 002b:00007ffb7bda4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 322.465984][ T7374] RAX: ffffffffffffffda RBX: 00007ffb7bda56c0 RCX: 00007ffb7db2e68e [ 322.465998][ T7374] RDX: 000000000000000f RSI: 00007ffb7bda50a0 RDI: 0000000000000004 [ 322.466010][ T7374] RBP: 00007ffb7bda5090 R08: 0000000000000000 R09: 0000000000000000 [ 322.466021][ T7374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 322.466032][ T7374] R13: 00007ffb7ddf6128 R14: 00007ffb7ddf6090 R15: 00007ffd7fbb3238 [ 322.466065][ T7374] [ 322.923826][ T5987] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 322.923857][ T5987] usb 5-1: config 0 has no interface number 0 [ 322.923905][ T5987] usb 5-1: config 0 interface 41 has no altsetting 0 [ 322.968068][ T5987] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 322.968098][ T5987] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.968117][ T5987] usb 5-1: Product: syz [ 322.968131][ T5987] usb 5-1: Manufacturer: syz [ 322.968207][ T5987] usb 5-1: SerialNumber: syz [ 323.027236][ T5987] usb 5-1: config 0 descriptor?? [ 323.683604][ T7387] tmpfs: Unknown parameter 'grpquota' [ 323.787669][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 323.787799][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 325.630609][ T5726] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 325.790393][ T5726] usb 3-1: Using ep0 maxpacket: 8 [ 325.805625][ T5726] usb 3-1: config 0 interface 0 altsetting 3 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 325.805988][ T5726] usb 3-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 325.806593][ T5726] usb 3-1: config 0 interface 0 has no altsetting 0 [ 325.806635][ T5726] usb 3-1: New USB device found, idVendor=5543, idProduct=0004, bcdDevice= 0.00 [ 325.806661][ T5726] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 325.912262][ T5726] usb 3-1: config 0 descriptor?? [ 326.051426][ T7423] overlayfs: missing 'lowerdir' [ 326.129317][ T11] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 326.296021][ T11] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 326.296055][ T11] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 326.296081][ T11] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 326.323324][ T11] usb 1-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 326.323363][ T11] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 326.323383][ T11] usb 1-1: Product: syz [ 326.323399][ T11] usb 1-1: Manufacturer: syz [ 326.323435][ T11] usb 1-1: SerialNumber: syz [ 326.382200][ T11] usb 1-1: config 0 descriptor?? [ 326.383216][ T7421] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 326.383412][ T7421] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 326.399496][ T11] usb 1-1: ucan: probing device on interface #0 [ 326.420442][ T5726] hid (null): unknown global tag 0xd [ 326.486447][ T5726] uclogic 0003:5543:0004.0002: unknown main item tag 0x0 [ 326.486481][ T5726] uclogic 0003:5543:0004.0002: unknown global tag 0xd [ 326.486494][ T5726] uclogic 0003:5543:0004.0002: item 0 0 1 13 parsing failed [ 326.487626][ T5726] uclogic 0003:5543:0004.0002: parse failed [ 326.487793][ T5726] uclogic 0003:5543:0004.0002: probe with driver uclogic failed with error -22 [ 326.596677][ T11] usb 1-1: ucan: could not read protocol version, ret=-32 [ 326.596703][ T11] usb 1-1: ucan: probe failed; try to update the device firmware [ 326.773513][ T822] usb 3-1: USB disconnect, device number 15 [ 326.845035][ T5987] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -71 [ 326.876859][ T5987] usb 5-1: USB disconnect, device number 13 [ 327.697726][ T7441] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 328.987732][ T7448] FAULT_INJECTION: forcing a failure. [ 328.987732][ T7448] name failslab, interval 1, probability 0, space 0, times 0 [ 328.987793][ T7448] CPU: 1 UID: 0 PID: 7448 Comm: syz.2.474 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 328.987819][ T7448] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 328.987832][ T7448] Call Trace: [ 328.987841][ T7448] [ 328.987850][ T7448] dump_stack_lvl+0xe8/0x150 [ 328.987883][ T7448] should_fail_ex+0x467/0x600 [ 328.987918][ T7448] should_failslab+0xa8/0x100 [ 328.987961][ T7448] __kmalloc_noprof+0xfe/0x780 [ 328.987990][ T7448] ? rcu_is_watching+0x15/0xb0 [ 328.988024][ T7448] ? tomoyo_realpath_from_path+0xef/0x640 [ 328.988048][ T7448] ? tomoyo_realpath_from_path+0xef/0x640 [ 328.988080][ T7448] tomoyo_realpath_from_path+0xef/0x640 [ 328.988115][ T7448] ? tomoyo_path_number_perm+0x219/0x5f0 [ 328.988149][ T7448] tomoyo_path_number_perm+0x246/0x5f0 [ 328.988185][ T7448] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 328.988215][ T7448] ? __lock_acquire+0x683/0x2ce0 [ 328.988262][ T7448] ? __pfx___schedule+0x10/0x10 [ 328.988289][ T7448] ? hook_file_ioctl+0x1f3/0x600 [ 328.988339][ T7448] ? __fget_files+0x2a/0x420 [ 328.988371][ T7448] ? __fget_files+0x2a/0x420 [ 328.988398][ T7448] ? __fget_files+0x3a8/0x420 [ 328.988425][ T7448] ? __fget_files+0x2a/0x420 [ 328.988459][ T7448] security_file_ioctl+0xc3/0x2a0 [ 328.988496][ T7448] __se_sys_ioctl+0x47/0x170 [ 328.988533][ T7448] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.988558][ T7448] do_syscall_64+0x174/0x580 [ 328.988587][ T7448] ? clear_bhb_loop+0x40/0x90 [ 328.988615][ T7448] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.988637][ T7448] RIP: 0033:0x7ffb7db6de59 [ 328.988658][ T7448] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 328.988676][ T7448] RSP: 002b:00007ffb7bd84028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 328.988699][ T7448] RAX: ffffffffffffffda RBX: 00007ffb7ddf6180 RCX: 00007ffb7db6de59 [ 328.988716][ T7448] RDX: 0000200000000180 RSI: 0000000000003ba0 RDI: 0000000000000005 [ 328.988729][ T7448] RBP: 00007ffb7bd84090 R08: 0000000000000000 R09: 0000000000000000 [ 328.988742][ T7448] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 328.988754][ T7448] R13: 00007ffb7ddf6218 R14: 00007ffb7ddf6180 R15: 00007ffd7fbb3238 [ 328.988789][ T7448] [ 328.988825][ T7448] ERROR: Out of memory at tomoyo_realpath_from_path. [ 329.015294][ T7448] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 330.136540][ T822] usb 1-1: USB disconnect, device number 15 [ 330.319429][ T5987] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 330.899968][ T5726] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 331.245218][ T5987] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 331.245256][ T5987] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 331.245285][ T5987] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 331.245325][ T5987] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 331.245349][ T5987] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.333134][ T5987] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 331.389190][ T5726] usb 4-1: Using ep0 maxpacket: 16 [ 331.408911][ T5726] usb 4-1: config 228 has too many interfaces: 245, using maximum allowed: 32 [ 331.408944][ T5726] usb 4-1: config 228 has an invalid descriptor of length 0, skipping remainder of the config [ 331.408967][ T5726] usb 4-1: config 228 has 1 interface, different from the descriptor's value: 245 [ 331.451045][ T5726] usb 4-1: New USB device found, idVendor=0b05, idProduct=1743, bcdDevice= 0.40 [ 331.451077][ T5726] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 331.451098][ T5726] usb 4-1: Product: syz [ 331.451113][ T5726] usb 4-1: Manufacturer: syz [ 331.451129][ T5726] usb 4-1: SerialNumber: syz [ 331.524504][ T7451] FAULT_INJECTION: forcing a failure. [ 331.524504][ T7451] name failslab, interval 1, probability 0, space 0, times 0 [ 331.524540][ T7451] CPU: 1 UID: 0 PID: 7451 Comm: syz.2.476 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 331.524564][ T7451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 331.524578][ T7451] Call Trace: [ 331.524586][ T7451] [ 331.524595][ T7451] dump_stack_lvl+0xe8/0x150 [ 331.524627][ T7451] should_fail_ex+0x467/0x600 [ 331.524661][ T7451] should_failslab+0xa8/0x100 [ 331.524696][ T7451] kmem_cache_alloc_noprof+0xa4/0x650 [ 331.524724][ T7451] ? do_getname+0x2e/0x250 [ 331.524747][ T7451] ? do_getname+0x2e/0x250 [ 331.524771][ T7451] ? rt_mutex_slowunlock+0x219/0x460 [ 331.524810][ T7451] do_getname+0x2e/0x250 [ 331.524833][ T7451] ? getname_flags+0x11/0x20 [ 331.524864][ T7451] do_sys_openat2+0xcc/0x200 [ 331.524895][ T7451] ? __pfx_do_sys_openat2+0x10/0x10 [ 331.524924][ T7451] ? ksys_write+0x248/0x270 [ 331.524960][ T7451] ? __pfx_ksys_write+0x10/0x10 [ 331.524997][ T7451] __x64_sys_openat+0x138/0x170 [ 331.525030][ T7451] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 331.525054][ T7451] do_syscall_64+0x174/0x580 [ 331.525080][ T7451] ? trace_irq_disable+0x3b/0x140 [ 331.525108][ T7451] ? clear_bhb_loop+0x40/0x90 [ 331.525136][ T7451] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 331.525158][ T7451] RIP: 0033:0x7ffb7db6de59 [ 331.525178][ T7451] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 331.525196][ T7451] RSP: 002b:00007ffb7bdc6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 331.525219][ T7451] RAX: ffffffffffffffda RBX: 00007ffb7ddf5fa0 RCX: 00007ffb7db6de59 [ 331.525234][ T7451] RDX: 00000000000c2882 RSI: 0000200000000240 RDI: ffffffffffffff9c [ 331.525249][ T7451] RBP: 00007ffb7bdc6090 R08: 0000000000000000 R09: 0000000000000000 [ 331.525261][ T7451] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 331.525273][ T7451] R13: 00007ffb7ddf6038 R14: 00007ffb7ddf5fa0 R15: 00007ffd7fbb3238 [ 331.525313][ T7451] [ 332.173434][ T7436] syz.4.472 (7436) used greatest stack depth: 17160 bytes left [ 332.761875][ T6211] udevd[6211]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 333.977461][ T5987] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 334.045265][ T5726] usb 4-1: 0:1 : does not exist [ 334.045290][ T5726] usb 4-1: 0:2 : does not exist [ 334.059230][ T5987] usb 3-1: USB disconnect, device number 16 [ 334.220457][ T5726] usb 4-1: USB disconnect, device number 19 [ 334.550082][ T6491] udevd[6491]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:228.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 334.639237][ T5987] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 334.680434][ T5725] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 334.789718][ T5987] usb 3-1: Using ep0 maxpacket: 32 [ 334.794276][ T5987] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 334.794307][ T5987] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 334.794333][ T5987] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 334.794357][ T5987] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 334.852644][ T5987] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 334.852676][ T5987] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.852697][ T5987] usb 3-1: Product: syz [ 334.852712][ T5987] usb 3-1: Manufacturer: syz [ 334.852727][ T5987] usb 3-1: SerialNumber: syz [ 334.891299][ T5725] usb 5-1: Using ep0 maxpacket: 16 [ 334.894350][ T5725] usb 5-1: config 0 has an invalid interface number: 35 but max is 0 [ 334.894377][ T5725] usb 5-1: config 0 has no interface number 0 [ 334.894424][ T5725] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0xC has an invalid bInterval 0, changing to 7 [ 334.894457][ T5725] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0xC has invalid maxpacket 1025, setting to 1024 [ 334.897803][ T5725] usb 5-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 334.897831][ T5725] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.897852][ T5725] usb 5-1: Product: syz [ 334.897867][ T5725] usb 5-1: Manufacturer: syz [ 334.897882][ T5725] usb 5-1: SerialNumber: syz [ 334.983324][ T5725] usb 5-1: config 0 descriptor?? [ 334.984517][ T7499] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 335.003544][ T5987] usb 3-1: config 0 descriptor?? [ 335.058677][ T5725] cypress_m8 5-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 335.209301][ T5726] usb 2-1: new full-speed USB device number 13 using dummy_hcd [ 335.615617][ T5726] usb 2-1: unable to get BOS descriptor or descriptor too short [ 335.631165][ T5726] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 335.631204][ T5726] usb 2-1: can't read configurations, error -71 [ 335.682862][ T7532] netlink: 28 bytes leftover after parsing attributes in process `syz.3.500'. [ 335.682888][ T7532] netlink: 28 bytes leftover after parsing attributes in process `syz.3.500'. [ 335.966576][ T5842] usb 3-1: USB disconnect, device number 17 [ 336.057225][ T7537] netlink: 20 bytes leftover after parsing attributes in process `syz.3.502'. [ 336.166336][ T7539] FAULT_INJECTION: forcing a failure. [ 336.166336][ T7539] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 336.166371][ T7539] CPU: 0 UID: 0 PID: 7539 Comm: syz.0.503 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 336.166395][ T7539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 336.166409][ T7539] Call Trace: [ 336.166417][ T7539] [ 336.166427][ T7539] dump_stack_lvl+0xe8/0x150 [ 336.166460][ T7539] should_fail_ex+0x467/0x600 [ 336.166494][ T7539] _copy_from_user+0x2d/0xb0 [ 336.166527][ T7539] ___sys_sendmsg+0x1c6/0x360 [ 336.166559][ T7539] ? __lock_acquire+0x683/0x2ce0 [ 336.166595][ T7539] ? __pfx____sys_sendmsg+0x10/0x10 [ 336.166671][ T7539] ? __fget_files+0x2a/0x420 [ 336.166699][ T7539] ? __fget_files+0x3a8/0x420 [ 336.166739][ T7539] __x64_sys_sendmsg+0x1b7/0x290 [ 336.166779][ T7539] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 336.166831][ T7539] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.166855][ T7539] do_syscall_64+0x174/0x580 [ 336.166883][ T7539] ? trace_irq_disable+0x3b/0x140 [ 336.166912][ T7539] ? clear_bhb_loop+0x40/0x90 [ 336.166940][ T7539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.166962][ T7539] RIP: 0033:0x7f84428cde59 [ 336.166983][ T7539] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 336.167001][ T7539] RSP: 002b:00007f8440b26028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 336.167026][ T7539] RAX: ffffffffffffffda RBX: 00007f8442b55fa0 RCX: 00007f84428cde59 [ 336.167043][ T7539] RDX: 0000000000000820 RSI: 0000200000000140 RDI: 0000000000000005 [ 336.167058][ T7539] RBP: 00007f8440b26090 R08: 0000000000000000 R09: 0000000000000000 [ 336.167072][ T7539] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 336.167086][ T7539] R13: 00007f8442b56038 R14: 00007f8442b55fa0 R15: 00007fffa0a004a8 [ 336.167121][ T7539] [ 336.929873][ T7548] tipc: Failed to obtain node identity [ 336.929908][ T7548] tipc: Enabling of bearer rejected, failed to enable media [ 337.336417][ T5725] usb 5-1: Nokia CA-42 V2 Adapter converter now attached to ttyUSB0 [ 337.388207][ T5725] usb 5-1: USB disconnect, device number 14 [ 337.467029][ T5725] nokiaca42v2 ttyUSB0: Nokia CA-42 V2 Adapter converter now disconnected from ttyUSB0 [ 337.483145][ T5725] cypress_m8 5-1:0.35: device disconnected [ 337.708793][ T9] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 338.472462][ T11] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 338.502403][ T9] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 338.502437][ T9] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 338.502462][ T9] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 338.555425][ T9] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 338.555461][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 338.555486][ T9] usb 4-1: Product: syz [ 338.555503][ T9] usb 4-1: Manufacturer: syz [ 338.555520][ T9] usb 4-1: SerialNumber: syz [ 338.619740][ T11] usb 3-1: Using ep0 maxpacket: 32 [ 338.640362][ T11] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 338.640404][ T11] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 338.640426][ T11] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 338.640447][ T11] usb 3-1: config 1 has no interface number 0 [ 338.640495][ T11] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 338.640522][ T11] usb 3-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 338.640565][ T11] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 338.640588][ T11] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.695064][ T9] usb 4-1: config 0 descriptor?? [ 338.745548][ T7567] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 338.747659][ T7567] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 338.792866][ T9] usb 4-1: ucan: probing device on interface #0 [ 338.967324][ T11] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 339.009645][ T9] usb 4-1: ucan: could not read protocol version, ret=-32 [ 339.009670][ T9] usb 4-1: ucan: probe failed; try to update the device firmware [ 339.067253][ T7570] tmpfs: Unknown parameter 'grpquota' [ 339.553270][ T11] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now attached [ 339.794742][ T11] usb 3-1: USB disconnect, device number 18 [ 339.906051][ T11] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 340.369177][ T5739] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 340.519179][ T5739] usb 2-1: Using ep0 maxpacket: 32 [ 340.521894][ T5739] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 340.521927][ T5739] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 340.521953][ T5739] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 340.521977][ T5739] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 340.530653][ T5739] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 340.530684][ T5739] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.530705][ T5739] usb 2-1: Product: syz [ 340.530721][ T5739] usb 2-1: Manufacturer: syz [ 340.530736][ T5739] usb 2-1: SerialNumber: syz [ 340.576547][ T5739] usb 2-1: config 0 descriptor?? [ 343.409867][ T9] usb 4-1: USB disconnect, device number 20 [ 345.343793][ T9] usb 2-1: USB disconnect, device number 15 [ 345.476142][ T7627] FAULT_INJECTION: forcing a failure. [ 345.476142][ T7627] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 345.476179][ T7627] CPU: 0 UID: 0 PID: 7627 Comm: syz.1.530 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 345.476203][ T7627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 345.476220][ T7627] Call Trace: [ 345.476228][ T7627] [ 345.476237][ T7627] dump_stack_lvl+0xe8/0x150 [ 345.476358][ T7627] should_fail_ex+0x467/0x600 [ 345.476485][ T7627] _copy_from_user+0x2d/0xb0 [ 345.476572][ T7627] ___sys_sendmsg+0x1c6/0x360 [ 345.476698][ T7627] ? __lock_acquire+0x683/0x2ce0 [ 345.476785][ T7627] ? __pfx____sys_sendmsg+0x10/0x10 [ 345.476852][ T7627] ? __fget_files+0x2a/0x420 [ 345.476968][ T7627] ? __fget_files+0x3a8/0x420 [ 345.477006][ T7627] __x64_sys_sendmsg+0x1b7/0x290 [ 345.477043][ T7627] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 345.477092][ T7627] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 345.477164][ T7627] do_syscall_64+0x174/0x580 [ 345.477280][ T7627] ? trace_irq_disable+0x3b/0x140 [ 345.477371][ T7627] ? clear_bhb_loop+0x40/0x90 [ 345.477397][ T7627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 345.477420][ T7627] RIP: 0033:0x7f13e9eede59 [ 345.477442][ T7627] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 345.477461][ T7627] RSP: 002b:00007f13e8146028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 345.477484][ T7627] RAX: ffffffffffffffda RBX: 00007f13ea175fa0 RCX: 00007f13e9eede59 [ 345.477500][ T7627] RDX: 0000000000000820 RSI: 0000200000000140 RDI: 0000000000000005 [ 345.477514][ T7627] RBP: 00007f13e8146090 R08: 0000000000000000 R09: 0000000000000000 [ 345.477527][ T7627] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 345.477539][ T7627] R13: 00007f13ea176038 R14: 00007f13ea175fa0 R15: 00007ffe4875f448 [ 345.477572][ T7627] [ 345.503614][ T7624] netlink: 20 bytes leftover after parsing attributes in process `syz.4.528'. [ 346.147591][ T11] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 346.329959][ T11] usb 5-1: unable to get BOS descriptor or descriptor too short [ 346.330886][ T11] usb 5-1: not running at top speed; connect to a high speed hub [ 346.332384][ T11] usb 5-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 346.332409][ T11] usb 5-1: config 14 has 1 interface, different from the descriptor's value: 2 [ 346.337051][ T11] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 346.337084][ T11] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 346.337106][ T11] usb 5-1: Product: syz [ 346.337121][ T11] usb 5-1: Manufacturer: syz [ 346.337136][ T11] usb 5-1: SerialNumber: syz [ 346.561884][ T9] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 346.569291][ T5726] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 346.687988][ T7634] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 346.743578][ T7634] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 346.755374][ T5726] usb 3-1: Using ep0 maxpacket: 32 [ 346.777402][ T5726] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 346.777438][ T5726] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 346.777479][ T5726] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 346.777503][ T5726] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 346.829947][ T9] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 346.836308][ T5726] usb 3-1: config 0 descriptor?? [ 346.866820][ T5726] hub 3-1:0.0: USB hub found [ 347.049684][ T5726] hub 3-1:0.0: 1 port detected [ 347.661068][ T9] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 347.714501][ T7632] fuse: Bad value for 'fd' [ 347.717681][ T11] legousbtower 5-1:14.0: interrupt endpoints not found [ 347.754821][ T11] usb 5-1: USB disconnect, device number 15 [ 347.820905][ T9] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 347.820933][ T9] usb 4-1: config 0 has no interface number 0 [ 347.827428][ T9] usb 4-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 347.827458][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.827478][ T9] usb 4-1: Product: syz [ 347.827503][ T9] usb 4-1: Manufacturer: syz [ 347.827516][ T9] usb 4-1: SerialNumber: syz [ 347.914273][ T9] usb 4-1: config 0 descriptor?? [ 347.967598][ T9] usb 4-1: selecting invalid altsetting 1 [ 347.967749][ T9] dvb_ttusb_budget: ttusb_init_controller: error [ 347.967820][ T9] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 348.082920][ T5726] hub 3-1:0.0: activate --> -90 [ 348.103058][ T9] DVB: Unable to find symbol stv0299_attach() [ 348.216236][ T9] DVB: Unable to find symbol tda8083_attach() [ 348.216266][ T9] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 348.237863][ T9] usb 4-1: USB disconnect, device number 21 [ 348.262520][ T5842] hub 3-1:0.0: hub_ext_port_status failed (err = -71) [ 348.305330][ T5846] usb 3-1: USB disconnect, device number 19 [ 348.318257][ T1316] usb 3-1: Failed to suspend device, error -71 [ 348.339984][ T11] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 348.489138][ T11] usb 1-1: Using ep0 maxpacket: 8 [ 348.573708][ T11] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 348.573739][ T11] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 348.573790][ T11] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 348.573813][ T11] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 348.573838][ T11] usb 1-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 348.573881][ T11] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 348.573905][ T11] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 348.707721][ T11] usbtmc 1-1:16.0: bulk endpoints not found [ 348.871676][ T7672] netlink: 52 bytes leftover after parsing attributes in process `syz.1.546'. [ 348.879262][ T7672] sctp: [Deprecated]: syz.1.546 (pid 7672) Use of struct sctp_assoc_value in delayed_ack socket option. [ 348.879262][ T7672] Use struct sctp_sack_info instead [ 348.939165][ T5842] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 349.044400][ T5846] usb 1-1: USB disconnect, device number 16 [ 349.102865][ T5842] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 349.102925][ T5842] usb 5-1: New USB device found, idVendor=056a, idProduct=00ec, bcdDevice= 0.00 [ 349.102950][ T5842] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 349.151135][ T5842] usb 5-1: config 0 descriptor?? [ 349.158880][ T5842] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 349.208506][ T7682] netlink: 24 bytes leftover after parsing attributes in process `syz.2.545'. [ 350.948332][ T11] usb 5-1: USB disconnect, device number 16 [ 351.033688][ T5609] cgroup: fork rejected by pids controller in [ 351.046329][ T7700] tmpfs: Unsupported parameter 'huge' [ 351.071615][ T5609] /syz0 [ 351.280473][ T7697] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 351.280500][ T7697] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 351.282222][ T7697] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 351.282244][ T7697] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 351.561427][ T7706] netlink: 40 bytes leftover after parsing attributes in process `syz.2.556'. [ 351.645180][ T11] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 352.788774][ T11] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 352.788850][ T11] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 352.791879][ T11] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 352.791952][ T11] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 353.120400][ T11] usb 4-1: config 0 descriptor?? [ 353.127281][ T7700] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 353.131133][ T11] hub 4-1:0.0: USB hub found [ 353.379629][ T11] hub 4-1:0.0: config failed, can't read hub descriptor (err -90) [ 353.382438][ T7703] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(11) [ 353.382464][ T7703] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 353.419165][ T7708] vhci_hcd: connection closed [ 353.586013][ T11] usbhid 4-1:0.0: can't add hid device: -71 [ 353.586111][ T11] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 353.692252][ T37] kauditd_printk_skb: 33 callbacks suppressed [ 353.692280][ T37] audit: type=1326 audit(1782952681.095:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7710 comm="syz.4.557" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65dee6de59 code=0x7ffc0000 [ 353.692635][ T37] audit: type=1326 audit(1782952681.095:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7710 comm="syz.4.557" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65dee6de59 code=0x7ffc0000 [ 353.807395][ T7703] vhci_hcd vhci_hcd.0: Device attached [ 353.816681][ T37] audit: type=1326 audit(1782952681.205:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7710 comm="syz.4.557" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65dee6de59 code=0x7ffc0000 [ 353.816866][ T37] audit: type=1326 audit(1782952681.205:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7710 comm="syz.4.557" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65dee6de59 code=0x7ffc0000 [ 353.816970][ T37] audit: type=1326 audit(1782952681.205:107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7710 comm="syz.4.557" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f65dee6de59 code=0x7ffc0000 [ 353.817089][ T37] audit: type=1326 audit(1782952681.205:108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7710 comm="syz.4.557" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65dee6de59 code=0x7ffc0000 [ 353.817210][ T37] audit: type=1326 audit(1782952681.205:109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7710 comm="syz.4.557" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65dee6de59 code=0x7ffc0000 [ 353.817338][ T37] audit: type=1326 audit(1782952681.205:110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7710 comm="syz.4.557" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f65dee6de59 code=0x7ffc0000 [ 353.979458][ T1449] vhci_hcd vhci_hcd.2: stop threads [ 354.049248][ T11] usb 4-1: USB disconnect, device number 22 [ 354.068278][ T1449] vhci_hcd vhci_hcd.2: release socket [ 354.068627][ T1449] vhci_hcd vhci_hcd.2: disconnect device [ 354.107122][ T37] audit: type=1326 audit(1782952681.505:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7710 comm="syz.4.557" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f65dee6de59 code=0x7ffc0000 [ 354.647146][ T7719] sctp: [Deprecated]: syz.4.559 (pid 7719) Use of struct sctp_assoc_value in delayed_ack socket option. [ 354.647146][ T7719] Use struct sctp_sack_info instead [ 355.524420][ T7717] netlink: 52 bytes leftover after parsing attributes in process `syz.4.559'. [ 355.939327][ T11] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 356.059282][ T5842] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 356.108131][ T11] usb 4-1: unable to get BOS descriptor or descriptor too short [ 356.121880][ T11] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 356.121908][ T11] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 356.147337][ T11] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 356.147369][ T11] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.147390][ T11] usb 4-1: Product: syz [ 356.147419][ T11] usb 4-1: Manufacturer: syz [ 356.147435][ T11] usb 4-1: SerialNumber: syz [ 356.242602][ T5842] usb 5-1: Using ep0 maxpacket: 16 [ 356.257350][ T5842] usb 5-1: unable to get BOS descriptor or descriptor too short [ 356.258368][ T5842] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 356.258404][ T5842] usb 5-1: can't read configurations, error -71 [ 356.259576][ T11] usb 4-1: selecting invalid altsetting 1 [ 356.388246][ T11] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 356.499178][ T6125] udevd[6125]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 356.704453][ T1422] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.095047][ T7748] sctp: [Deprecated]: syz.2.571 (pid 7748) Use of struct sctp_assoc_value in delayed_ack socket option. [ 357.095047][ T7748] Use struct sctp_sack_info instead [ 357.445408][ T5619] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 357.526935][ T5619] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 357.530114][ T5619] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 357.532731][ T5619] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 357.547762][ T5619] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 357.639363][ T7743] netlink: 52 bytes leftover after parsing attributes in process `syz.2.571'. [ 359.599578][ T59] Bluetooth: hci4: command tx timeout [ 359.928700][ T7767] IPv6: NLM_F_CREATE should be specified when creating new route [ 359.988167][ T5842] usb 4-1: USB disconnect, device number 23 [ 360.468844][ T1422] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 360.489411][ T36] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 360.507557][ T7787] syz.1.583 uses obsolete (PF_INET,SOCK_PACKET) [ 360.669220][ T36] usb 5-1: Using ep0 maxpacket: 32 [ 360.671015][ T36] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 360.676318][ T36] usb 5-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=d8.11 [ 360.676347][ T36] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 360.676367][ T36] usb 5-1: Product: syz [ 360.676381][ T36] usb 5-1: Manufacturer: syz [ 360.676395][ T36] usb 5-1: SerialNumber: syz [ 360.757731][ T36] usb 5-1: config 0 descriptor?? [ 360.776206][ T36] redrat3 5-1:0.0: Couldn't find all endpoints [ 361.265548][ T1422] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 361.305887][ T7806] FAULT_INJECTION: forcing a failure. [ 361.305887][ T7806] name failslab, interval 1, probability 0, space 0, times 0 [ 361.305944][ T7806] CPU: 0 UID: 0 PID: 7806 Comm: syz.2.588 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 361.305963][ T7806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 361.305975][ T7806] Call Trace: [ 361.305981][ T7806] [ 361.305987][ T7806] dump_stack_lvl+0xe8/0x150 [ 361.306012][ T7806] should_fail_ex+0x467/0x600 [ 361.306036][ T7806] should_failslab+0xa8/0x100 [ 361.306147][ T7806] __kmalloc_noprof+0xfe/0x780 [ 361.306186][ T7806] ? rcu_is_watching+0x15/0xb0 [ 361.306251][ T7806] ? tomoyo_realpath_from_path+0xef/0x640 [ 361.306311][ T7806] ? tomoyo_realpath_from_path+0xef/0x640 [ 361.306333][ T7806] tomoyo_realpath_from_path+0xef/0x640 [ 361.306357][ T7806] ? tomoyo_path_number_perm+0x219/0x5f0 [ 361.306402][ T7806] tomoyo_path_number_perm+0x246/0x5f0 [ 361.306427][ T7806] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 361.306477][ T7806] ? __lock_acquire+0x683/0x2ce0 [ 361.306522][ T7806] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 361.306586][ T7806] ? hook_file_ioctl+0x1f3/0x600 [ 361.306625][ T7806] ? lockdep_hardirqs_on+0x7a/0x110 [ 361.306673][ T7806] ? __fget_files+0x2a/0x420 [ 361.306696][ T7806] ? __fget_files+0x2a/0x420 [ 361.306715][ T7806] ? __fget_files+0x3a8/0x420 [ 361.306734][ T7806] ? __fget_files+0x2a/0x420 [ 361.306759][ T7806] security_file_ioctl+0xc3/0x2a0 [ 361.306820][ T7806] __se_sys_ioctl+0x47/0x170 [ 361.306884][ T7806] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 361.306901][ T7806] do_syscall_64+0x174/0x580 [ 361.306920][ T7806] ? trace_irq_disable+0x3b/0x140 [ 361.306961][ T7806] ? clear_bhb_loop+0x40/0x90 [ 361.306990][ T7806] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 361.307019][ T7806] RIP: 0033:0x7ffb7db6de59 [ 361.307040][ T7806] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 361.307064][ T7806] RSP: 002b:00007ffb7bdc6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 361.307081][ T7806] RAX: ffffffffffffffda RBX: 00007ffb7ddf5fa0 RCX: 00007ffb7db6de59 [ 361.307093][ T7806] RDX: 0000200000000040 RSI: 0000000080045518 RDI: 0000000000000003 [ 361.307103][ T7806] RBP: 00007ffb7bdc6090 R08: 0000000000000000 R09: 0000000000000000 [ 361.307113][ T7806] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 361.307122][ T7806] R13: 00007ffb7ddf6038 R14: 00007ffb7ddf5fa0 R15: 00007ffd7fbb3238 [ 361.307147][ T7806] [ 361.307305][ T7806] ERROR: Out of memory at tomoyo_realpath_from_path. [ 361.382177][ T7777] netlink: 'syz.4.581': attribute type 1 has an invalid length. [ 361.382250][ T7777] netlink: 44 bytes leftover after parsing attributes in process `syz.4.581'. [ 361.469172][ T11] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 361.673186][ T59] Bluetooth: hci4: command tx timeout [ 361.682675][ T11] usb 2-1: Using ep0 maxpacket: 32 [ 361.696318][ T11] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 361.696346][ T11] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 361.696367][ T11] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 361.696418][ T11] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 361.696439][ T11] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 361.696463][ T11] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 361.696485][ T11] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 361.696509][ T11] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 361.696559][ T11] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 361.696583][ T11] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 362.751595][ T11] usb 2-1: config 0 descriptor?? [ 363.195035][ T5726] usb 5-1: USB disconnect, device number 19 [ 363.820497][ T7820] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 363.821165][ T7820] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 363.826226][ T59] Bluetooth: hci4: command tx timeout [ 364.018682][ T7822] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 364.018710][ T7822] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 364.043047][ T7822] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 364.043074][ T7822] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 364.421559][ T1422] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.244567][ T11] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 16 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 365.316435][ T11] usb 2-1: USB disconnect, device number 16 [ 365.363997][ T11] usblp0: removed [ 365.829623][ T5619] Bluetooth: hci4: command tx timeout [ 366.532369][ T7859] FAULT_INJECTION: forcing a failure. [ 366.532369][ T7859] name failslab, interval 1, probability 0, space 0, times 0 [ 366.532405][ T7859] CPU: 1 UID: 0 PID: 7859 Comm: syz.1.603 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 366.532430][ T7859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 366.532443][ T7859] Call Trace: [ 366.532451][ T7859] [ 366.532460][ T7859] dump_stack_lvl+0xe8/0x150 [ 366.532501][ T7859] should_fail_ex+0x467/0x600 [ 366.532535][ T7859] should_failslab+0xa8/0x100 [ 366.532569][ T7859] __kmalloc_noprof+0xfe/0x780 [ 366.532590][ T7859] ? rcu_is_watching+0x15/0xb0 [ 366.532616][ T7859] ? tomoyo_realpath_from_path+0xef/0x640 [ 366.532634][ T7859] ? tomoyo_realpath_from_path+0xef/0x640 [ 366.532657][ T7859] tomoyo_realpath_from_path+0xef/0x640 [ 366.532683][ T7859] ? tomoyo_path_number_perm+0x219/0x5f0 [ 366.532708][ T7859] tomoyo_path_number_perm+0x246/0x5f0 [ 366.532734][ T7859] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 366.532760][ T7859] ? __lock_acquire+0x683/0x2ce0 [ 366.532793][ T7859] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 366.532813][ T7859] ? hook_file_ioctl+0x1f3/0x600 [ 366.532834][ T7859] ? lockdep_hardirqs_on+0x7a/0x110 [ 366.532869][ T7859] ? __fget_files+0x2a/0x420 [ 366.532892][ T7859] ? __fget_files+0x2a/0x420 [ 366.532912][ T7859] ? __fget_files+0x3a8/0x420 [ 366.532932][ T7859] ? __fget_files+0x2a/0x420 [ 366.532956][ T7859] security_file_ioctl+0xc3/0x2a0 [ 366.532987][ T7859] __se_sys_ioctl+0x47/0x170 [ 366.533022][ T7859] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.533041][ T7859] do_syscall_64+0x174/0x580 [ 366.533062][ T7859] ? clear_bhb_loop+0x40/0x90 [ 366.533084][ T7859] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.533101][ T7859] RIP: 0033:0x7f13e9eede59 [ 366.533119][ T7859] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 366.533134][ T7859] RSP: 002b:00007f13e8146028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 366.533153][ T7859] RAX: ffffffffffffffda RBX: 00007f13ea175fa0 RCX: 00007f13e9eede59 [ 366.533167][ T7859] RDX: 00002000000017c0 RSI: 000000004188aec6 RDI: 0000000000000004 [ 366.533179][ T7859] RBP: 00007f13e8146090 R08: 0000000000000000 R09: 0000000000000000 [ 366.533190][ T7859] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 366.533202][ T7859] R13: 00007f13ea176038 R14: 00007f13ea175fa0 R15: 00007ffe4875f448 [ 366.533228][ T7859] [ 366.534819][ T7859] ERROR: Out of memory at tomoyo_realpath_from_path. [ 367.006649][ T7863] F2FS-fs (loop4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 367.006678][ T7863] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 367.072588][ T7863] F2FS-fs (loop4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 367.072618][ T7863] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock [ 367.471574][ T7869] FAULT_INJECTION: forcing a failure. [ 367.471574][ T7869] name failslab, interval 1, probability 0, space 0, times 0 [ 367.471606][ T7869] CPU: 1 UID: 0 PID: 7869 Comm: syz.4.606 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 367.471626][ T7869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 367.471639][ T7869] Call Trace: [ 367.471645][ T7869] [ 367.471653][ T7869] dump_stack_lvl+0xe8/0x150 [ 367.471682][ T7869] should_fail_ex+0x467/0x600 [ 367.471709][ T7869] should_failslab+0xa8/0x100 [ 367.471739][ T7869] __kmalloc_noprof+0xfe/0x780 [ 367.471764][ T7869] ? rcu_is_watching+0x15/0xb0 [ 367.471791][ T7869] ? tomoyo_realpath_from_path+0xef/0x640 [ 367.471809][ T7869] ? tomoyo_realpath_from_path+0xef/0x640 [ 367.471832][ T7869] tomoyo_realpath_from_path+0xef/0x640 [ 367.471858][ T7869] ? tomoyo_path_number_perm+0x219/0x5f0 [ 367.471883][ T7869] tomoyo_path_number_perm+0x246/0x5f0 [ 367.471911][ T7869] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 367.471935][ T7869] ? __lock_acquire+0x683/0x2ce0 [ 367.471969][ T7869] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 367.471991][ T7869] ? hook_file_ioctl+0x1f3/0x600 [ 367.472012][ T7869] ? lockdep_hardirqs_on+0x7a/0x110 [ 367.472048][ T7869] ? __fget_files+0x2a/0x420 [ 367.472076][ T7869] ? __fget_files+0x2a/0x420 [ 367.472098][ T7869] ? __fget_files+0x3a8/0x420 [ 367.472119][ T7869] ? __fget_files+0x2a/0x420 [ 367.472155][ T7869] security_file_ioctl+0xc3/0x2a0 [ 367.472184][ T7869] __se_sys_ioctl+0x47/0x170 [ 367.472213][ T7869] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 367.472237][ T7869] do_syscall_64+0x174/0x580 [ 367.472257][ T7869] ? trace_irq_disable+0x3b/0x140 [ 367.472278][ T7869] ? clear_bhb_loop+0x40/0x90 [ 367.472299][ T7869] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 367.472316][ T7869] RIP: 0033:0x7f65dee6de59 [ 367.472332][ T7869] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 367.472347][ T7869] RSP: 002b:00007f65dd0a5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 367.472366][ T7869] RAX: ffffffffffffffda RBX: 00007f65df0f6090 RCX: 00007f65dee6de59 [ 367.472378][ T7869] RDX: 0000200000000180 RSI: 00000000000007ab RDI: 0000000000000003 [ 367.472389][ T7869] RBP: 00007f65dd0a5090 R08: 0000000000000000 R09: 0000000000000000 [ 367.472401][ T7869] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 367.472411][ T7869] R13: 00007f65df0f6128 R14: 00007f65df0f6090 R15: 00007ffeb9601bb8 [ 367.472439][ T7869] [ 367.472446][ T7869] ERROR: Out of memory at tomoyo_realpath_from_path. [ 367.815519][ T7873] FAULT_INJECTION: forcing a failure. [ 367.815519][ T7873] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 367.815556][ T7873] CPU: 1 UID: 0 PID: 7873 Comm: syz.2.608 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 367.815581][ T7873] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 367.815594][ T7873] Call Trace: [ 367.815603][ T7873] [ 367.815612][ T7873] dump_stack_lvl+0xe8/0x150 [ 367.815645][ T7873] should_fail_ex+0x467/0x600 [ 367.815679][ T7873] _copy_from_user+0x2d/0xb0 [ 367.815715][ T7873] dev_write+0xc6/0xc20 [ 367.815831][ T7873] ? __lock_acquire+0x683/0x2ce0 [ 367.815863][ T7873] ? __pfx_dev_write+0x10/0x10 [ 367.815893][ T7873] ? bpf_lsm_file_permission+0x9/0x20 [ 367.815997][ T7873] ? security_file_permission+0x75/0x260 [ 367.816032][ T7873] ? rw_verify_area+0x209/0x4d0 [ 367.816112][ T7873] ? __pfx_dev_write+0x10/0x10 [ 367.816136][ T7873] vfs_write+0x29f/0xbb0 [ 367.816175][ T7873] ? __pfx_vfs_write+0x10/0x10 [ 367.816210][ T7873] ? __fget_files+0x2a/0x420 [ 367.816241][ T7873] ? __fget_files+0x2a/0x420 [ 367.816267][ T7873] ? __fget_files+0x3a8/0x420 [ 367.816294][ T7873] ? __fget_files+0x2a/0x420 [ 367.816330][ T7873] ksys_write+0x156/0x270 [ 367.816365][ T7873] ? __pfx_ksys_write+0x10/0x10 [ 367.816404][ T7873] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 367.816429][ T7873] do_syscall_64+0x174/0x580 [ 367.816457][ T7873] ? trace_irq_disable+0x3b/0x140 [ 367.816485][ T7873] ? clear_bhb_loop+0x40/0x90 [ 367.816513][ T7873] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 367.816535][ T7873] RIP: 0033:0x7ffb7db6de59 [ 367.816557][ T7873] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 367.816576][ T7873] RSP: 002b:00007ffb7bdc6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 367.816601][ T7873] RAX: ffffffffffffffda RBX: 00007ffb7ddf5fa0 RCX: 00007ffb7db6de59 [ 367.816618][ T7873] RDX: 0000000000000040 RSI: 00002000000003c0 RDI: 0000000000000003 [ 367.816632][ T7873] RBP: 00007ffb7bdc6090 R08: 0000000000000000 R09: 0000000000000000 [ 367.816645][ T7873] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 367.816657][ T7873] R13: 00007ffb7ddf6038 R14: 00007ffb7ddf5fa0 R15: 00007ffd7fbb3238 [ 367.816690][ T7873] [ 369.027679][ T1422] bridge_slave_1: left allmulticast mode [ 369.043772][ T1422] bridge_slave_1: left promiscuous mode [ 369.061865][ T9] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 369.098557][ T1422] bridge0: port 2(bridge_slave_1) entered disabled state [ 369.229153][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 369.236053][ T9] usb 2-1: config 228 has too many interfaces: 245, using maximum allowed: 32 [ 369.236084][ T9] usb 2-1: config 228 has an invalid descriptor of length 0, skipping remainder of the config [ 369.236106][ T9] usb 2-1: config 228 has 1 interface, different from the descriptor's value: 245 [ 369.481499][ T9] usb 2-1: New USB device found, idVendor=0b05, idProduct=1743, bcdDevice= 0.40 [ 369.481531][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 369.481553][ T9] usb 2-1: Product: syz [ 369.481568][ T9] usb 2-1: Manufacturer: syz [ 369.481582][ T9] usb 2-1: SerialNumber: syz [ 369.720603][ T7916] capability: warning: `syz.3.619' uses deprecated v2 capabilities in a way that may be insecure [ 369.765542][ T9] usb 2-1: 0:1 : does not exist [ 369.765566][ T9] usb 2-1: 0:2 : does not exist [ 369.790629][ T1422] bridge_slave_0: left allmulticast mode [ 369.796425][ T1422] bridge_slave_0: left promiscuous mode [ 369.797819][ T1422] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.861568][ T9] usb 2-1: USB disconnect, device number 17 [ 369.956609][ T6125] udevd[6125]: setting owner of /dev/bus/usb/002/017 to uid=0, gid=0 failed: No such file or directory [ 369.987764][ T6125] udevd[6125]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:228.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 370.723146][ T7924] netlink: 388 bytes leftover after parsing attributes in process `syz.3.619'. [ 371.992411][ T1422] bond0 (unregistering): (slave 73ÿ): Releasing backup interface [ 372.551938][ T1422] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 372.579523][ T11] usb 4-1: new full-speed USB device number 24 using dummy_hcd [ 372.811464][ T1422] bond0 (unregistering): Released all slaves [ 373.546976][ T5265] 8021q: adding VLAN 0 to HW filter on device eth1 [ 373.729135][ T5842] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 373.741017][ T11] usb 4-1: device not accepting address 24, error -71 [ 373.900167][ T5842] usb 3-1: Using ep0 maxpacket: 32 [ 373.902701][ T5842] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 373.902735][ T5842] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 373.902775][ T5842] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 373.902800][ T5842] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.957326][ T5842] usb 3-1: config 0 descriptor?? [ 373.984567][ T5842] hub 3-1:0.0: USB hub found [ 374.055690][ T7941] FAULT_INJECTION: forcing a failure. [ 374.055690][ T7941] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 374.055728][ T7941] CPU: 1 UID: 0 PID: 7941 Comm: syz.4.626 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 374.055757][ T7941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 374.055770][ T7941] Call Trace: [ 374.055777][ T7941] [ 374.055788][ T7941] dump_stack_lvl+0xe8/0x150 [ 374.055813][ T7941] should_fail_ex+0x467/0x600 [ 374.055837][ T7941] _copy_from_user+0x2d/0xb0 [ 374.055860][ T7941] ___sys_recvmsg+0x173/0x5a0 [ 374.055887][ T7941] ? __pfx____sys_recvmsg+0x10/0x10 [ 374.055912][ T7941] ? __fget_files+0x2a/0x420 [ 374.055943][ T7941] ? __fget_files+0x3a8/0x420 [ 374.055969][ T7941] do_recvmmsg+0x320/0x7f0 [ 374.056003][ T7941] ? __pfx_do_recvmmsg+0x10/0x10 [ 374.056027][ T7941] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 374.056054][ T7941] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 374.056089][ T7941] __x64_sys_recvmmsg+0x198/0x250 [ 374.056115][ T7941] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 374.056138][ T7941] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.056161][ T7941] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.056178][ T7941] do_syscall_64+0x174/0x580 [ 374.056199][ T7941] ? clear_bhb_loop+0x40/0x90 [ 374.056218][ T7941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.056234][ T7941] RIP: 0033:0x7f65dee6de59 [ 374.056249][ T7941] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 374.056262][ T7941] RSP: 002b:00007f65dd0a5028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 374.056279][ T7941] RAX: ffffffffffffffda RBX: 00007f65df0f6090 RCX: 00007f65dee6de59 [ 374.056291][ T7941] RDX: 000000000000001b RSI: 0000200000005c80 RDI: 0000000000000003 [ 374.056302][ T7941] RBP: 00007f65dd0a5090 R08: 0000000000000000 R09: 0000000000000000 [ 374.056311][ T7941] R10: 0000000000010122 R11: 0000000000000246 R12: 0000000000000001 [ 374.056320][ T7941] R13: 00007f65df0f6128 R14: 00007f65df0f6090 R15: 00007ffeb9601bb8 [ 374.056345][ T7941] [ 374.284210][ T5842] hub 3-1:0.0: 1 port detected [ 374.946847][ T7747] bridge0: port 1(bridge_slave_0) entered blocking state [ 374.947115][ T7747] bridge0: port 1(bridge_slave_0) entered disabled state [ 374.947324][ T7747] bridge_slave_0: entered allmulticast mode [ 374.971004][ T5842] hub 3-1:0.0: activate --> -90 [ 374.982213][ T7747] bridge_slave_0: entered promiscuous mode [ 374.986317][ T7747] bridge0: port 2(bridge_slave_1) entered blocking state [ 374.986544][ T7747] bridge0: port 2(bridge_slave_1) entered disabled state [ 374.986702][ T7747] bridge_slave_1: entered allmulticast mode [ 375.016820][ T7747] bridge_slave_1: entered promiscuous mode [ 375.090951][ T7747] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 375.098572][ T7747] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 375.194019][ T5842] hub 3-1:0.0: hub_ext_port_status failed (err = -71) [ 375.196788][ T9] usb 3-1: USB disconnect, device number 20 [ 375.263518][ T7747] team0: Port device team_slave_0 added [ 375.267260][ T7747] team0: Port device team_slave_1 added [ 375.371708][ T7747] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 375.371727][ T7747] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 375.371762][ T7747] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 375.423587][ T7747] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 375.423605][ T7747] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 375.423633][ T7747] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 375.564606][ T7747] hsr_slave_0: entered promiscuous mode [ 375.565982][ T7747] hsr_slave_1: entered promiscuous mode [ 375.566937][ T7747] debugfs: 'hsr0' already exists in 'hsr' [ 375.566962][ T7747] Cannot create hsr debugfs directory [ 375.818331][ T7959] process 'syz.4.629' launched '/dev/fd/4' with NULL argv: empty string added [ 376.218834][ T7971] netlink: 20 bytes leftover after parsing attributes in process `syz.1.631'. [ 377.469292][ T9] usb 2-1: new full-speed USB device number 18 using dummy_hcd [ 377.657447][ T9] usb 2-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 377.657477][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 377.664346][ T5725] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 377.701069][ T9] usb 2-1: config 0 descriptor?? [ 377.745949][ T9] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 377.819206][ T5725] usb 5-1: Using ep0 maxpacket: 16 [ 377.821680][ T5725] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 377.821711][ T5725] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 377.821733][ T5725] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 377.821773][ T5725] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 377.821797][ T5725] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 377.833237][ T5725] usb 5-1: config 0 descriptor?? [ 377.941704][ T9] gp8psk: usb in 128 operation failed. [ 378.145718][ T9] gp8psk: usb in 146 operation failed. [ 378.145741][ T9] gp8psk: failed to get FW version [ 378.146348][ T9] gp8psk: usb in 149 operation failed. [ 378.146359][ T9] gp8psk: failed to get FPGA version [ 378.146843][ T9] gp8psk: usb in 138 operation failed. [ 378.146960][ T9] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 378.147012][ T9] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 378.207113][ T9] usb 2-1: USB disconnect, device number 18 [ 378.456185][ T5725] microsoft 0003:045E:07DA.0004: global environment stack underflow [ 378.456208][ T5725] microsoft 0003:045E:07DA.0004: item 0 1 1 11 parsing failed [ 378.457003][ T5725] microsoft 0003:045E:07DA.0004: parse failed [ 378.457124][ T5725] microsoft 0003:045E:07DA.0004: probe with driver microsoft failed with error -22 [ 378.732071][ T8003] FAULT_INJECTION: forcing a failure. [ 378.732071][ T8003] name failslab, interval 1, probability 0, space 0, times 0 [ 378.732175][ T8003] CPU: 0 UID: 0 PID: 8003 Comm: syz.3.637 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 378.732201][ T8003] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 378.732214][ T8003] Call Trace: [ 378.732223][ T8003] [ 378.732233][ T8003] dump_stack_lvl+0xe8/0x150 [ 378.732267][ T8003] should_fail_ex+0x467/0x600 [ 378.732303][ T8003] should_failslab+0xa8/0x100 [ 378.732338][ T8003] kmem_cache_alloc_lru_noprof+0xa7/0x650 [ 378.732369][ T8003] ? alloc_inode+0xb8/0x1b0 [ 378.732394][ T8003] ? alloc_inode+0xb8/0x1b0 [ 378.732427][ T8003] alloc_inode+0xb8/0x1b0 [ 378.732455][ T8003] create_pipe_files+0x52/0x7d0 [ 378.732553][ T8003] __do_pipe_flags+0x46/0x1f0 [ 378.732577][ T8003] do_pipe2+0xaa/0x190 [ 378.732601][ T8003] ? __pfx___schedule+0x10/0x10 [ 378.732627][ T8003] ? __pfx_do_pipe2+0x10/0x10 [ 378.732653][ T8003] ? rcu_is_watching+0x15/0xb0 [ 378.732695][ T8003] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.732721][ T8003] __x64_sys_pipe2+0x5a/0x70 [ 378.732746][ T8003] do_syscall_64+0x174/0x580 [ 378.732776][ T8003] ? clear_bhb_loop+0x40/0x90 [ 378.732804][ T8003] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.732826][ T8003] RIP: 0033:0x7f8666f3de59 [ 378.732848][ T8003] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 378.732868][ T8003] RSP: 002b:00007f8665175028 EFLAGS: 00000246 ORIG_RAX: 0000000000000125 [ 378.732892][ T8003] RAX: ffffffffffffffda RBX: 00007f86671c6090 RCX: 00007f8666f3de59 [ 378.732909][ T8003] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 0000200000000000 [ 378.732923][ T8003] RBP: 00007f8665175090 R08: 0000000000000000 R09: 0000000000000000 [ 378.732937][ T8003] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 378.732950][ T8003] R13: 00007f86671c6128 R14: 00007f86671c6090 R15: 00007ffdcd751058 [ 378.732985][ T8003] [ 379.575934][ T5265] 8021q: adding VLAN 0 to HW filter on device eth2 [ 380.171822][ T8022] sctp: [Deprecated]: syz.2.641 (pid 8022) Use of struct sctp_assoc_value in delayed_ack socket option. [ 380.171822][ T8022] Use struct sctp_sack_info instead [ 380.899944][ T5726] usb 5-1: USB disconnect, device number 20 [ 380.971980][ T8025] tmpfs: Unknown parameter 'grpquota' [ 381.385930][ T8032] tmpfs: Unknown parameter 'grpquota' [ 381.479212][ T36] usb 4-1: new full-speed USB device number 26 using dummy_hcd [ 381.641751][ T36] usb 4-1: config 8 has an invalid interface number: 177 but max is 0 [ 381.641773][ T36] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 381.641786][ T36] usb 4-1: config 8 has no interface number 0 [ 381.641817][ T36] usb 4-1: config 8 interface 177 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 381.641837][ T36] usb 4-1: config 8 interface 177 has no altsetting 0 [ 381.641861][ T36] usb 4-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 381.641878][ T36] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.741506][ T36] ir_toy 4-1:8.177: required endpoints not found [ 381.845997][ T8034] FAULT_INJECTION: forcing a failure. [ 381.845997][ T8034] name failslab, interval 1, probability 0, space 0, times 0 [ 381.846024][ T8034] CPU: 0 UID: 0 PID: 8034 Comm: syz.4.647 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 381.846046][ T8034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 381.846056][ T8034] Call Trace: [ 381.846062][ T8034] [ 381.846069][ T8034] dump_stack_lvl+0xe8/0x150 [ 381.846115][ T8034] should_fail_ex+0x467/0x600 [ 381.846141][ T8034] should_failslab+0xa8/0x100 [ 381.846166][ T8034] __kmalloc_noprof+0xfe/0x780 [ 381.846186][ T8034] ? rcu_is_watching+0x15/0xb0 [ 381.846211][ T8034] ? tomoyo_realpath_from_path+0xef/0x640 [ 381.846227][ T8034] ? tomoyo_realpath_from_path+0xef/0x640 [ 381.846250][ T8034] tomoyo_realpath_from_path+0xef/0x640 [ 381.846273][ T8034] ? tomoyo_path_number_perm+0x219/0x5f0 [ 381.846298][ T8034] tomoyo_path_number_perm+0x246/0x5f0 [ 381.846323][ T8034] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 381.846345][ T8034] ? __lock_acquire+0x683/0x2ce0 [ 381.846377][ T8034] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 381.846397][ T8034] ? hook_file_ioctl+0x1f3/0x600 [ 381.846416][ T8034] ? lockdep_hardirqs_on+0x7a/0x110 [ 381.846449][ T8034] ? __fget_files+0x2a/0x420 [ 381.846472][ T8034] ? __fget_files+0x2a/0x420 [ 381.846491][ T8034] ? __fget_files+0x3a8/0x420 [ 381.846510][ T8034] ? __fget_files+0x2a/0x420 [ 381.846533][ T8034] security_file_ioctl+0xc3/0x2a0 [ 381.846560][ T8034] __se_sys_ioctl+0x47/0x170 [ 381.846598][ T8034] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 381.846615][ T8034] do_syscall_64+0x174/0x580 [ 381.846635][ T8034] ? clear_bhb_loop+0x40/0x90 [ 381.846655][ T8034] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 381.846670][ T8034] RIP: 0033:0x7f65dee6de59 [ 381.846686][ T8034] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 381.846699][ T8034] RSP: 002b:00007f65dd0c6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 381.846716][ T8034] RAX: ffffffffffffffda RBX: 00007f65df0f5fa0 RCX: 00007f65dee6de59 [ 381.846728][ T8034] RDX: 0000200000000500 RSI: 0000000041015500 RDI: 0000000000000003 [ 381.846738][ T8034] RBP: 00007f65dd0c6090 R08: 0000000000000000 R09: 0000000000000000 [ 381.846748][ T8034] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 381.846762][ T8034] R13: 00007f65df0f6038 R14: 00007f65df0f5fa0 R15: 00007ffeb9601bb8 [ 381.846802][ T8034] [ 381.850237][ T8034] ERROR: Out of memory at tomoyo_realpath_from_path. [ 382.979239][ T5725] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 383.129174][ T5725] usb 5-1: Using ep0 maxpacket: 32 [ 383.144546][ T5725] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 383.144579][ T5725] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 383.144608][ T5725] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 383.144631][ T5725] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 383.147661][ T5725] usb 5-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 383.147692][ T5725] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.147712][ T5725] usb 5-1: Product: syz [ 383.147727][ T5725] usb 5-1: Manufacturer: syz [ 383.147742][ T5725] usb 5-1: SerialNumber: syz [ 383.242848][ T1422] hsr_slave_0: left promiscuous mode [ 383.289672][ T5725] usb 5-1: config 0 descriptor?? [ 383.389526][ T1422] hsr_slave_1: left promiscuous mode [ 383.416385][ T11] usb 4-1: USB disconnect, device number 26 [ 383.430943][ T5846] usb 2-1: new full-speed USB device number 19 using dummy_hcd [ 383.476436][ T1422] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 383.476537][ T1422] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 383.610702][ T5846] usb 2-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 383.610726][ T5846] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 383.644595][ T1422] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 383.644618][ T1422] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 383.661039][ T5846] usb 2-1: config 0 descriptor?? [ 383.695675][ T5846] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 383.910806][ T5846] gp8psk: usb in 128 operation failed. [ 384.120789][ T5846] gp8psk: usb in 146 operation failed. [ 384.120810][ T5846] gp8psk: failed to get FW version [ 384.123398][ T5846] gp8psk: usb in 149 operation failed. [ 384.123412][ T5846] gp8psk: failed to get FPGA version [ 384.126954][ T5846] gp8psk: usb in 138 operation failed. [ 384.126974][ T5846] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 384.127023][ T5846] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 384.188795][ T5846] usb 2-1: USB disconnect, device number 19 [ 384.534186][ T8066] netlink: 20 bytes leftover after parsing attributes in process `syz.2.652'. [ 384.534220][ T8066] netlink: 8 bytes leftover after parsing attributes in process `syz.2.652'. [ 384.534379][ T8065] netlink: 20 bytes leftover after parsing attributes in process `syz.2.652'. [ 384.534399][ T8065] netlink: 8 bytes leftover after parsing attributes in process `syz.2.652'. [ 384.989231][ T5725] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 385.015141][ T1422] veth1_macvtap: left promiscuous mode [ 385.015495][ T1422] veth0_macvtap: left promiscuous mode [ 385.015809][ T1422] veth1_vlan: left promiscuous mode [ 385.017326][ T1422] veth0_vlan: left promiscuous mode [ 385.055965][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 385.056044][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 385.199242][ T5725] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 385.199274][ T5725] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 385.199299][ T5725] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 385.242716][ T5725] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 385.242739][ T5725] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.242754][ T5725] usb 4-1: Product: syz [ 385.242765][ T5725] usb 4-1: Manufacturer: syz [ 385.242791][ T5725] usb 4-1: SerialNumber: syz [ 385.295912][ T5725] usb 4-1: config 0 descriptor?? [ 385.297005][ T8070] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 385.297132][ T8070] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 385.319683][ T5725] usb 4-1: ucan: probing device on interface #0 [ 385.503565][ T5725] usb 4-1: ucan: could not read protocol version, ret=0 [ 385.503590][ T5725] usb 4-1: ucan: probe failed; try to update the device firmware [ 386.323670][ T8083] sctp: [Deprecated]: syz.1.656 (pid 8083) Use of struct sctp_assoc_value in delayed_ack socket option. [ 386.323670][ T8083] Use struct sctp_sack_info instead [ 387.509984][ T1422] team0 (unregistering): Port device team_slave_1 removed [ 387.570570][ T1422] team0 (unregistering): Port device team_slave_0 removed [ 388.205818][ T8066] erspan1: entered allmulticast mode [ 388.343373][ T5265] 8021q: adding VLAN 0 to HW filter on device eth3 [ 388.481517][ T5726] usb 5-1: USB disconnect, device number 21 [ 388.564553][ T5725] usb 4-1: USB disconnect, device number 27 [ 390.076730][ T8090] tmpfs: Unknown parameter 'grpquota' [ 390.502726][ T5725] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 390.679468][ T5725] usb 5-1: Using ep0 maxpacket: 16 [ 390.681378][ T5725] usb 5-1: config 0 has an invalid interface number: 35 but max is 0 [ 390.682801][ T5725] usb 5-1: config 0 has no interface number 0 [ 390.682851][ T5725] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0xC has an invalid bInterval 0, changing to 7 [ 390.682880][ T5725] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0xC has invalid maxpacket 1025, setting to 1024 [ 390.687892][ T5725] usb 5-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 390.687928][ T5725] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.687943][ T5725] usb 5-1: Product: syz [ 390.687954][ T5725] usb 5-1: Manufacturer: syz [ 390.687971][ T5725] usb 5-1: SerialNumber: syz [ 390.712215][ T8114] tmpfs: Unknown parameter 'grpquota' [ 390.822615][ T5725] usb 5-1: config 0 descriptor?? [ 390.852046][ T8106] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 390.872980][ T5725] cypress_m8 5-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 391.478268][ T5846] usb 3-1: new full-speed USB device number 21 using dummy_hcd [ 391.635446][ T5846] usb 3-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 391.635479][ T5846] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 391.674443][ T5846] usb 3-1: config 0 descriptor?? [ 391.693236][ T5846] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 391.910160][ T5846] gp8psk: usb in 128 operation failed. [ 392.140685][ T5846] gp8psk: usb in 146 operation failed. [ 392.140730][ T5846] gp8psk: failed to get FW version [ 392.141590][ T5846] gp8psk: usb in 149 operation failed. [ 392.141607][ T5846] gp8psk: failed to get FPGA version [ 392.143848][ T5846] gp8psk: usb in 138 operation failed. [ 392.143867][ T5846] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 392.145444][ T5846] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 392.233882][ T5846] usb 3-1: USB disconnect, device number 21 [ 392.919150][ T5725] usb 5-1: Nokia CA-42 V2 Adapter converter now attached to ttyUSB0 [ 393.172110][ T5725] usb 5-1: USB disconnect, device number 22 [ 393.284820][ T8130] sctp: [Deprecated]: syz.2.667 (pid 8130) Use of struct sctp_assoc_value in delayed_ack socket option. [ 393.284820][ T8130] Use struct sctp_sack_info instead [ 394.181629][ T5725] nokiaca42v2 ttyUSB0: Nokia CA-42 V2 Adapter converter now disconnected from ttyUSB0 [ 394.182572][ T5725] cypress_m8 5-1:0.35: device disconnected [ 394.248311][ T8135] FAULT_INJECTION: forcing a failure. [ 394.248311][ T8135] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 394.248342][ T8135] CPU: 0 UID: 0 PID: 8135 Comm: syz.2.668 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 394.248361][ T8135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 394.248372][ T8135] Call Trace: [ 394.248378][ T8135] [ 394.248386][ T8135] dump_stack_lvl+0xe8/0x150 [ 394.248413][ T8135] should_fail_ex+0x467/0x600 [ 394.248440][ T8135] _copy_from_user+0x2d/0xb0 [ 394.248474][ T8135] __sys_sendto+0x2b5/0x5d0 [ 394.248504][ T8135] ? __pfx___sys_sendto+0x10/0x10 [ 394.248553][ T8135] ? __pfx_ksys_write+0x10/0x10 [ 394.248588][ T8135] __x64_sys_sendto+0xde/0x100 [ 394.248612][ T8135] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.248631][ T8135] do_syscall_64+0x174/0x580 [ 394.248653][ T8135] ? trace_irq_disable+0x3b/0x140 [ 394.248675][ T8135] ? clear_bhb_loop+0x40/0x90 [ 394.248697][ T8135] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.248713][ T8135] RIP: 0033:0x7ffb7db6de59 [ 394.248730][ T8135] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 394.248745][ T8135] RSP: 002b:00007ffb7bda5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 394.248764][ T8135] RAX: ffffffffffffffda RBX: 00007ffb7ddf6090 RCX: 00007ffb7db6de59 [ 394.248776][ T8135] RDX: 0000000000034000 RSI: 0000200000000300 RDI: 0000000000000005 [ 394.248788][ T8135] RBP: 00007ffb7bda5090 R08: 0000200000000000 R09: 000000000000001c [ 394.248799][ T8135] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 394.248809][ T8135] R13: 00007ffb7ddf6128 R14: 00007ffb7ddf6090 R15: 00007ffd7fbb3238 [ 394.248835][ T8135] [ 394.653557][ T8138] smc: net device vlan1 applied user defined pnetid SYZ2 [ 394.907829][ T8141] FAULT_INJECTION: forcing a failure. [ 394.907829][ T8141] name failslab, interval 1, probability 0, space 0, times 0 [ 394.907866][ T8141] CPU: 0 UID: 0 PID: 8141 Comm: syz.1.666 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 394.907890][ T8141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 394.907904][ T8141] Call Trace: [ 394.907912][ T8141] [ 394.907922][ T8141] dump_stack_lvl+0xe8/0x150 [ 394.907956][ T8141] should_fail_ex+0x467/0x600 [ 394.907991][ T8141] should_failslab+0xa8/0x100 [ 394.908026][ T8141] __kvmalloc_node_noprof+0x17a/0x8a0 [ 394.908129][ T8141] ? proc_sys_call_handler+0x3d1/0x830 [ 394.908201][ T8141] ? proc_sys_call_handler+0x3d1/0x830 [ 394.908242][ T8141] proc_sys_call_handler+0x3d1/0x830 [ 394.908275][ T8141] ? vfs_write+0x231/0xbb0 [ 394.908314][ T8141] ? __pfx_proc_sys_call_handler+0x10/0x10 [ 394.908360][ T8141] vfs_write+0x61e/0xbb0 [ 394.908403][ T8141] ? __pfx_vfs_write+0x10/0x10 [ 394.908446][ T8141] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 394.908472][ T8141] ? lockdep_hardirqs_on+0x7a/0x110 [ 394.908504][ T8141] ? mutex_lock_nested+0x152/0x1d0 [ 394.908528][ T8141] ? fdget_pos+0x252/0x320 [ 394.908555][ T8141] ksys_write+0x156/0x270 [ 394.908581][ T8141] ? __pfx_ksys_write+0x10/0x10 [ 394.908612][ T8141] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.908629][ T8141] do_syscall_64+0x174/0x580 [ 394.908647][ T8141] ? trace_irq_disable+0x3b/0x140 [ 394.908668][ T8141] ? clear_bhb_loop+0x40/0x90 [ 394.908687][ T8141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.908702][ T8141] RIP: 0033:0x7f13e9eede59 [ 394.908718][ T8141] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 394.908732][ T8141] RSP: 002b:00007f13e8146028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 394.908749][ T8141] RAX: ffffffffffffffda RBX: 00007f13ea175fa0 RCX: 00007f13e9eede59 [ 394.908761][ T8141] RDX: 0000000000000012 RSI: 0000200000000080 RDI: 0000000000000003 [ 394.908771][ T8141] RBP: 00007f13e8146090 R08: 0000000000000000 R09: 0000000000000000 [ 394.908780][ T8141] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 394.908789][ T8141] R13: 00007f13ea176038 R14: 00007f13ea175fa0 R15: 00007ffe4875f448 [ 394.908814][ T8141] [ 395.504104][ T11] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 395.669585][ T11] usb 5-1: Using ep0 maxpacket: 32 [ 395.672650][ T11] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 395.672673][ T11] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 395.672692][ T11] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 395.672708][ T11] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 395.678850][ T11] usb 5-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 395.678874][ T11] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.678889][ T11] usb 5-1: Product: syz [ 395.678900][ T11] usb 5-1: Manufacturer: syz [ 395.678910][ T11] usb 5-1: SerialNumber: syz [ 395.781588][ T11] usb 5-1: config 0 descriptor?? [ 397.527875][ T8160] netlink: 'syz.1.672': attribute type 29 has an invalid length. [ 397.527898][ T8160] netlink: 8 bytes leftover after parsing attributes in process `syz.1.672'. [ 397.748884][ T8170] tmpfs: Unknown parameter 'grpquota' [ 398.599273][ T5846] usb 3-1: new full-speed USB device number 22 using dummy_hcd [ 398.753592][ T5846] usb 3-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 398.753624][ T5846] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 398.988335][ T5846] usb 3-1: config 0 descriptor?? [ 399.016970][ T5846] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 399.080329][ T8188] sctp: [Deprecated]: syz.1.678 (pid 8188) Use of struct sctp_assoc_value in delayed_ack socket option. [ 399.080329][ T8188] Use struct sctp_sack_info instead [ 399.844677][ T11] usb 5-1: USB disconnect, device number 23 [ 399.863260][ T5846] gp8psk: usb in 128 operation failed. [ 400.080454][ T5846] gp8psk: usb in 146 operation failed. [ 400.080474][ T5846] gp8psk: failed to get FW version [ 400.080918][ T5846] gp8psk: usb in 149 operation failed. [ 400.080932][ T5846] gp8psk: failed to get FPGA version [ 400.081313][ T5846] gp8psk: usb in 138 operation failed. [ 400.081328][ T5846] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 400.081366][ T5846] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 400.197912][ T5846] usb 3-1: USB disconnect, device number 22 [ 401.675543][ T8210] FAULT_INJECTION: forcing a failure. [ 401.675543][ T8210] name failslab, interval 1, probability 0, space 0, times 0 [ 401.675604][ T8210] CPU: 0 UID: 0 PID: 8210 Comm: syz.4.682 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 401.675636][ T8210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 401.675649][ T8210] Call Trace: [ 401.675658][ T8210] [ 401.675666][ T8210] dump_stack_lvl+0xe8/0x150 [ 401.675724][ T8210] should_fail_ex+0x467/0x600 [ 401.675750][ T8210] should_failslab+0xa8/0x100 [ 401.675775][ T8210] kmem_cache_alloc_noprof+0xa4/0x650 [ 401.675796][ T8210] ? do_getname+0x2e/0x250 [ 401.675815][ T8210] ? do_getname+0x2e/0x250 [ 401.675846][ T8210] do_getname+0x2e/0x250 [ 401.675862][ T8210] ? getname_flags+0x11/0x20 [ 401.675881][ T8210] __x64_sys_newlstat+0x107/0x1e0 [ 401.675901][ T8210] ? __pfx___x64_sys_newlstat+0x10/0x10 [ 401.675938][ T8210] ? arch_syscall_is_vdso_sigreturn+0x11f/0x1a0 [ 401.675963][ T8210] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.675979][ T8210] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.675996][ T8210] do_syscall_64+0x174/0x580 [ 401.676016][ T8210] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.676032][ T8210] ? clear_bhb_loop+0x40/0x90 [ 401.676052][ T8210] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.676067][ T8210] RIP: 0033:0x7f65dee6de59 [ 401.676082][ T8210] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 401.676096][ T8210] RSP: 002b:00007f65dd0c6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000006 [ 401.676112][ T8210] RAX: ffffffffffffffda RBX: 00007f65df0f5fa0 RCX: 00007f65dee6de59 [ 401.676124][ T8210] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 401.676135][ T8210] RBP: 00007f65dd0c6090 R08: 0000000000000000 R09: 0000000000000000 [ 401.676145][ T8210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 401.676154][ T8210] R13: 00007f65df0f6038 R14: 00007f65df0f5fa0 R15: 00007ffeb9601bb8 [ 401.676179][ T8210] [ 402.991537][ T8227] tmpfs: Unknown parameter 'grpquota' [ 403.108855][ T37] audit: type=1800 audit(1782952730.505:112): pid=8231 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.2.687" name="file0" dev="overlay" ino=831 res=0 errno=0 [ 403.551446][ T8239] sctp: [Deprecated]: syz.1.689 (pid 8239) Use of struct sctp_assoc_value in delayed_ack socket option. [ 403.551446][ T8239] Use struct sctp_sack_info instead [ 404.892255][ T7747] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 406.707230][ T8249] hub 8-0:1.0: USB hub found [ 406.803326][ T8249] hub 8-0:1.0: 1 port detected [ 407.084595][ T7747] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 407.115464][ T7747] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 407.203458][ T7747] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 407.205218][ T7747] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 407.433943][ T7747] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 407.472280][ T7747] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 407.768652][ T7747] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 408.361318][ T8276] ptrace attach of "ci-upstream-kasan-gce-smack-root/syz-executor exec"[5605] was attempted by "ci-upstream-kasan-gce-smack-root/syz-executor exec"[8276] [ 409.039134][ T5739] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 409.200754][ T5739] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 409.200819][ T5739] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 409.200847][ T5739] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 409.246691][ T5739] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 409.246722][ T5739] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.246743][ T5739] usb 2-1: Product: syz [ 409.246758][ T5739] usb 2-1: Manufacturer: syz [ 409.246773][ T5739] usb 2-1: SerialNumber: syz [ 409.303920][ T5739] usb 2-1: config 0 descriptor?? [ 409.306157][ T8282] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 409.306287][ T8282] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 409.331883][ T5739] usb 2-1: ucan: probing device on interface #0 [ 409.387528][ T8290] netlink: 76 bytes leftover after parsing attributes in process `syz.2.698'. [ 409.519180][ T5739] usb 2-1: ucan: could not read protocol version, ret=0 [ 409.519206][ T5739] usb 2-1: ucan: probe failed; try to update the device firmware [ 410.207729][ T7747] 8021q: adding VLAN 0 to HW filter on device bond0 [ 410.305053][ T8302] sctp: [Deprecated]: syz.2.700 (pid 8302) Use of struct sctp_assoc_value in delayed_ack socket option. [ 410.305053][ T8302] Use struct sctp_sack_info instead [ 411.470550][ T8304] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 411.470577][ T8304] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 411.470873][ T8304] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 411.470895][ T8304] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 411.624106][ T7747] 8021q: adding VLAN 0 to HW filter on device team0 [ 412.614511][ T8313] hub 8-0:1.0: USB hub found [ 412.615294][ T8313] hub 8-0:1.0: 1 port detected [ 412.973357][ T1419] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.973500][ T1419] bridge0: port 1(bridge_slave_0) entered forwarding state [ 413.112476][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 413.112618][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 413.226006][ T8315] netlink: 12 bytes leftover after parsing attributes in process `syz.3.703'. [ 413.615752][ T8315] bond1: entered allmulticast mode [ 413.629927][ T8315] 8021q: adding VLAN 0 to HW filter on device bond1 [ 413.883099][ T9] usb 2-1: USB disconnect, device number 20 [ 415.050768][ T9] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 415.199095][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 415.201545][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 415.201579][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 415.201619][ T9] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 415.201644][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 415.238349][ T9] usb 4-1: config 0 descriptor?? [ 415.275901][ T9] hub 4-1:0.0: USB hub found [ 415.670481][ T9] hub 4-1:0.0: 1 port detected [ 416.371040][ T9] hub 4-1:0.0: activate --> -90 [ 416.529707][ T5619] Bluetooth: hci0: unexpected event for opcode 0x0c26 [ 416.572042][ T9] hub 4-1:0.0: hub_ext_port_status failed (err = -71) [ 416.698169][ T8344] netlink: 44 bytes leftover after parsing attributes in process `syz.1.710'. [ 416.734083][ T36] usb 4-1: USB disconnect, device number 28 [ 416.758002][ T1422] usb 4-1: Failed to suspend device, error -71 [ 416.958367][ T8381] tmpfs: Unknown parameter 'grpquota' [ 417.443620][ T822] IPVS: starting estimator thread 0... [ 417.600018][ T8387] IPVS: using max 7 ests per chain, 16800 per kthread [ 418.378665][ T59] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 418.460951][ T59] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 418.483146][ T59] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 418.491550][ T59] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 418.493350][ T59] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 419.379508][ T36] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 419.554339][ T36] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 419.554397][ T36] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 419.554422][ T36] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.700528][ T5846] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 419.854083][ T5846] usb 5-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 419.854107][ T5846] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.898673][ T5846] usb 5-1: config 0 descriptor?? [ 419.911321][ T36] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 420.034885][ T5846] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 420.629629][ T5619] Bluetooth: hci5: command tx timeout [ 420.651183][ T5846] gp8psk: usb in 137 operation failed. [ 420.651206][ T5846] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 420.651248][ T5846] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 420.689586][ T5846] usb 5-1: USB disconnect, device number 24 [ 420.954142][ T36] stv0680 2-1:4.0: STV(e): camera ping failed!! [ 420.955173][ T36] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -32 [ 420.955194][ T36] stv0680 2-1:4.0: last error: 0, command = 0x0 [ 421.167663][ T5846] usb 2-1: USB disconnect, device number 21 [ 422.539230][ T5846] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 422.689163][ T5846] usb 2-1: Using ep0 maxpacket: 32 [ 422.691686][ T5846] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 422.691717][ T5846] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 422.691757][ T5846] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 422.691779][ T5846] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.710494][ T5619] Bluetooth: hci5: command tx timeout [ 422.766737][ T5846] usb 2-1: config 0 descriptor?? [ 422.788153][ T5846] hub 2-1:0.0: USB hub found [ 422.827674][ T8450] Bluetooth: MGMT ver 1.23 [ 423.004464][ T5846] hub 2-1:0.0: 1 port detected [ 423.586653][ T8479] netlink: 48 bytes leftover after parsing attributes in process `syz.2.735'. [ 423.663930][ T5846] hub 2-1:0.0: activate --> -90 [ 423.866554][ T5846] hub 2-1:0.0: hub_ext_port_status failed (err = -71) [ 423.898137][ T5622] usb 2-1: USB disconnect, device number 22 [ 423.948340][ T1418] usb 2-1: Failed to suspend device, error -19 [ 424.592042][ T822] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 424.840628][ T822] usb 5-1: Using ep0 maxpacket: 32 [ 424.853167][ T822] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 424.853255][ T822] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 424.853369][ T822] usb 5-1: New USB device found, idVendor=056a, idProduct=0028, bcdDevice= 0.00 [ 424.853445][ T822] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 424.925985][ T5619] Bluetooth: hci5: command tx timeout [ 425.260050][ T822] usb 5-1: config 0 descriptor?? [ 426.860750][ T8486] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 426.949527][ T5619] Bluetooth: hci5: command tx timeout [ 427.156575][ T8505] netlink: 52 bytes leftover after parsing attributes in process `syz.2.742'. [ 427.863129][ T8510] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.743'. [ 428.696827][ T5846] usb 5-1: USB disconnect, device number 25 [ 429.280626][ T5622] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 429.485664][ T5622] usb 2-1: Using ep0 maxpacket: 32 [ 429.488558][ T5622] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 429.488594][ T5622] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 429.488623][ T5622] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 429.488650][ T5622] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 429.526238][ T5622] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 429.526271][ T5622] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.526293][ T5622] usb 2-1: Product: syz [ 429.526308][ T5622] usb 2-1: Manufacturer: syz [ 429.526335][ T5622] usb 2-1: SerialNumber: syz [ 429.770110][ T5622] usb 2-1: config 0 descriptor?? [ 431.440034][ T59] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 431.488503][ T59] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 431.508285][ T59] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 431.526931][ T59] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 431.542375][ T59] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 431.782552][ T5725] usb 2-1: USB disconnect, device number 23 [ 433.467161][ T8553] hub 8-0:1.0: USB hub found [ 433.468700][ T8553] hub 8-0:1.0: 1 port detected [ 433.668277][ T158] bridge_slave_1: left allmulticast mode [ 433.668313][ T158] bridge_slave_1: left promiscuous mode [ 433.704853][ T158] bridge0: port 2(bridge_slave_1) entered disabled state [ 433.750227][ T5619] Bluetooth: hci1: command tx timeout [ 434.115179][ T8562] input: syz0 as /devices/virtual/input/input6 [ 434.177262][ T158] bridge_slave_0: left allmulticast mode [ 434.177299][ T158] bridge_slave_0: left promiscuous mode [ 434.177613][ T158] bridge0: port 1(bridge_slave_0) entered disabled state [ 434.339589][ T822] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 434.514865][ T822] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 434.514890][ T822] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 434.514908][ T822] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 434.517400][ T822] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 434.517421][ T822] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.517435][ T822] usb 3-1: Product: syz [ 434.517446][ T822] usb 3-1: Manufacturer: syz [ 434.517456][ T822] usb 3-1: SerialNumber: syz [ 434.536724][ T822] usb 3-1: config 0 descriptor?? [ 434.549077][ T8565] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 434.570933][ T8565] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 434.580928][ T822] usb 3-1: ucan: probing device on interface #0 [ 434.801985][ T822] usb 3-1: ucan: could not read protocol version, ret=0 [ 434.802011][ T822] usb 3-1: ucan: probe failed; try to update the device firmware [ 435.078633][ T8567] netlink: 52 bytes leftover after parsing attributes in process `syz.1.755'. [ 435.422528][ T158] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 435.500322][ T158] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 435.522028][ T158] bond0 (unregistering): Released all slaves [ 435.831074][ T5619] Bluetooth: hci1: command tx timeout [ 436.851582][ T8585] netlink: 10 bytes leftover after parsing attributes in process `syz.4.758'. [ 436.883119][ T8393] bridge0: port 1(bridge_slave_0) entered blocking state [ 436.883282][ T8393] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.883564][ T8393] bridge_slave_0: entered allmulticast mode [ 437.017127][ T8393] bridge_slave_0: entered promiscuous mode [ 437.160095][ T5846] usb 3-1: USB disconnect, device number 23 [ 438.215404][ T37] audit: type=1326 audit(1782952765.615:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8589 comm="syz.2.761" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb7db6de59 code=0x7ffc0000 [ 438.223491][ T37] audit: type=1326 audit(1782952765.615:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8589 comm="syz.2.761" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb7db6de59 code=0x7ffc0000 [ 438.223552][ T37] audit: type=1326 audit(1782952765.625:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8589 comm="syz.2.761" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ffb7db6de59 code=0x7ffc0000 [ 438.223599][ T37] audit: type=1326 audit(1782952765.625:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8589 comm="syz.2.761" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb7db6de59 code=0x7ffc0000 [ 438.232661][ T37] audit: type=1326 audit(1782952765.635:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8589 comm="syz.2.761" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb7db6de59 code=0x7ffc0000 [ 438.237076][ T37] audit: type=1326 audit(1782952765.635:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8589 comm="syz.2.761" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb7db6de59 code=0x7ffc0000 [ 438.237133][ T37] audit: type=1326 audit(1782952765.635:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8589 comm="syz.2.761" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb7db6de59 code=0x7ffc0000 [ 438.237181][ T37] audit: type=1326 audit(1782952765.635:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8589 comm="syz.2.761" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7ffb7db6de59 code=0x7ffc0000 [ 438.237229][ T37] audit: type=1326 audit(1782952765.635:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8589 comm="syz.2.761" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb7db6de59 code=0x7ffc0000 [ 438.241343][ T37] audit: type=1326 audit(1782952765.635:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8589 comm="syz.2.761" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb7db6de59 code=0x7ffc0000 [ 438.612201][ T158] hsr_slave_0: left promiscuous mode [ 438.614695][ T8595] netlink: 104 bytes leftover after parsing attributes in process `syz.4.762'. [ 438.629696][ T5619] Bluetooth: hci1: command tx timeout [ 438.766159][ T158] hsr_slave_1: left promiscuous mode [ 438.768309][ T158] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 438.814518][ T158] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 439.079454][ T5726] usb 3-1: new full-speed USB device number 24 using dummy_hcd [ 439.199479][ T5619] Bluetooth: hci2: command 0x0406 tx timeout [ 439.226857][ T5725] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 439.226879][ T5725] Bluetooth: hci2: Error when powering off device on rfkill (-110) [ 439.265616][ T5726] usb 3-1: config 0 has an invalid interface number: 214 but max is 0 [ 439.265645][ T5726] usb 3-1: config 0 has no interface number 0 [ 439.265692][ T5726] usb 3-1: config 0 interface 214 altsetting 0 endpoint 0x83 has an invalid bInterval 97, changing to 4 [ 439.265720][ T5726] usb 3-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid maxpacket 24929, setting to 1023 [ 439.292509][ T5726] usb 3-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 439.292542][ T5726] usb 3-1: New USB device strings: Mfr=1, Product=0, SerialNumber=3 [ 439.292564][ T5726] usb 3-1: Manufacturer: syz [ 439.292579][ T5726] usb 3-1: SerialNumber: syz [ 439.363902][ T5726] usb 3-1: config 0 descriptor?? [ 439.609262][ T5846] usb 3-1: USB disconnect, device number 24 [ 439.791541][ T158] team0 (unregistering): Port device team_slave_1 removed [ 439.840694][ T158] team0 (unregistering): Port device team_slave_0 removed [ 440.085507][ T8393] bridge0: port 2(bridge_slave_1) entered blocking state [ 440.085723][ T8393] bridge0: port 2(bridge_slave_1) entered disabled state [ 440.085898][ T8393] bridge_slave_1: entered allmulticast mode [ 440.088291][ T8393] bridge_slave_1: entered promiscuous mode [ 440.154485][ T8602] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 440.713578][ T59] Bluetooth: hci1: command tx timeout [ 441.537740][ T59] Bluetooth: hci0: command 0x0406 tx timeout [ 441.539176][ T5725] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 441.539199][ T5725] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 441.680215][ T8393] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 441.743169][ T8393] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 442.157272][ T8393] team0: Port device team_slave_0 added [ 442.254672][ T8636] FAULT_INJECTION: forcing a failure. [ 442.254672][ T8636] name failslab, interval 1, probability 0, space 0, times 0 [ 442.254708][ T8636] CPU: 1 UID: 0 PID: 8636 Comm: syz.1.774 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 442.254733][ T8636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 442.254745][ T8636] Call Trace: [ 442.254753][ T8636] [ 442.254762][ T8636] dump_stack_lvl+0xe8/0x150 [ 442.254798][ T8636] should_fail_ex+0x467/0x600 [ 442.254833][ T8636] should_failslab+0xa8/0x100 [ 442.254870][ T8636] kmem_cache_alloc_noprof+0xa4/0x650 [ 442.254899][ T8636] ? do_getname+0x2e/0x250 [ 442.254922][ T8636] ? do_getname+0x2e/0x250 [ 442.254947][ T8636] ? rt_mutex_slowunlock+0x219/0x460 [ 442.254989][ T8636] do_getname+0x2e/0x250 [ 442.255012][ T8636] ? getname_flags+0x11/0x20 [ 442.255040][ T8636] do_sys_openat2+0xcc/0x200 [ 442.255071][ T8636] ? __pfx_do_sys_openat2+0x10/0x10 [ 442.255099][ T8636] ? ksys_write+0x248/0x270 [ 442.255135][ T8636] ? __pfx_ksys_write+0x10/0x10 [ 442.255172][ T8636] __x64_sys_openat+0x138/0x170 [ 442.255203][ T8636] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.255227][ T8636] do_syscall_64+0x174/0x580 [ 442.255254][ T8636] ? trace_irq_disable+0x3b/0x140 [ 442.255283][ T8636] ? clear_bhb_loop+0x40/0x90 [ 442.255312][ T8636] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.255337][ T8636] RIP: 0033:0x7f13e9eae68e [ 442.255357][ T8636] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 442.255377][ T8636] RSP: 002b:00007f13e8124b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 442.255399][ T8636] RAX: ffffffffffffffda RBX: 00007f13e81256c0 RCX: 00007f13e9eae68e [ 442.255415][ T8636] RDX: 0000000000000000 RSI: 00007f13e8124c00 RDI: ffffffffffffff9c [ 442.255429][ T8636] RBP: 00007f13e8124c00 R08: 0000000000000000 R09: 0000000000000000 [ 442.255442][ T8636] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 442.255455][ T8636] R13: 00007f13ea176128 R14: 00007f13ea176090 R15: 00007ffe4875f448 [ 442.255489][ T8636] [ 442.526418][ T8393] team0: Port device team_slave_1 added [ 443.684010][ T8393] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 443.684040][ T8393] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 443.684083][ T8393] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 443.835590][ T8393] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 443.835608][ T8393] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 443.835636][ T8393] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 443.973950][ T8652] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 443.973984][ T8652] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 443.974083][ T8652] vhci_hcd vhci_hcd.0: Device attached [ 444.229296][ T5622] usb 41-1: new low-speed USB device number 2 using vhci_hcd [ 444.230094][ T59] Bluetooth: hci3: command 0x0406 tx timeout [ 444.230167][ T5725] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 444.230183][ T5725] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 444.282985][ T5845] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 444.730648][ T5845] usb 5-1: Using ep0 maxpacket: 16 [ 444.886730][ T5845] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 8 [ 444.898603][ T5845] usb 5-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 4.00 [ 444.898639][ T5845] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.898664][ T5845] usb 5-1: Product: syz [ 444.898681][ T5845] usb 5-1: Manufacturer: syz [ 444.898709][ T5845] usb 5-1: SerialNumber: syz [ 445.181808][ T5845] usb 5-1: config 0 descriptor?? [ 445.213263][ T5845] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 445.223945][ T5845] usb 5-1: Detected FT232B [ 445.572588][ T8652] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 445.586001][ T8652] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 445.835355][ T5265] 8021q: adding VLAN 0 to HW filter on device eth1 [ 445.885656][ T8393] hsr_slave_0: entered promiscuous mode [ 445.888019][ T8393] hsr_slave_1: entered promiscuous mode [ 445.968637][ T8656] ================================================================== [ 445.968650][ T8656] BUG: KASAN: slab-use-after-free in vhci_tx_loop+0x3e9/0x1c70 [ 445.968758][ T8656] Read of size 8 at addr ffff888060141520 by task vhci_tx/8656 [ 445.968771][ T8656] [ 445.968781][ T8656] CPU: 1 UID: 0 PID: 8656 Comm: vhci_tx Not tainted syzkaller #0 PREEMPT_{RT,(full)} SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 445.968824][ T8656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 445.968838][ T8656] Call Trace: [ 445.968847][ T8656] [ 445.968856][ T8656] dump_stack_lvl+0xe8/0x150 [ 445.968883][ T8656] print_address_description+0x55/0x1e0 [ 445.968924][ T8656] ? vhci_tx_loop+0x3e9/0x1c70 [ 445.968942][ T8656] print_report+0x58/0x70 [ 445.968965][ T8656] kasan_report+0x117/0x150 [ 445.969031][ T8656] ? vhci_tx_loop+0x3e9/0x1c70 [ 445.969056][ T8656] vhci_tx_loop+0x3e9/0x1c70 [ 445.969087][ T8656] ? __pfx_vhci_tx_loop+0x10/0x10 [ 445.969112][ T8656] ? __lock_acquire+0x683/0x2ce0 [ 445.969146][ T8656] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 445.969174][ T8656] ? lockdep_hardirqs_on+0x7a/0x110 [ 445.969217][ T8656] ? do_raw_spin_lock+0x12b/0x2f0 [ 445.969287][ T8656] ? __pfx_autoremove_wake_function+0x10/0x10 [ 445.969287][ T8656] ? __pfx_autoremove_wake_function+0x10/0x10 [ 445.969335][ T8656] ? __kthread_parkme+0x71/0x1f0 [ 445.969396][ T8656] ? __kthread_parkme+0x196/0x1f0 [ 445.969420][ T8656] kthread+0x388/0x470 [ 445.969443][ T8656] ? __pfx_vhci_tx_loop+0x10/0x10 [ 445.969462][ T8656] ? __pfx_kthread+0x10/0x10 [ 445.969486][ T8656] ret_from_fork+0x514/0xb70 [ 445.969554][ T8656] ? __pfx_ret_from_fork+0x10/0x10 [ 445.969579][ T8656] ? __switch_to+0xc89/0x1420 [ 445.969623][ T8656] ? __pfx_kthread+0x10/0x10 [ 445.969649][ T8656] ret_from_fork_asm+0x1a/0x30 [ 445.969685][ T8656] [ 445.969692][ T8656] [ 445.969703][ T8656] Allocated by task 5622: [ 445.969713][ T8656] kasan_save_track+0x3e/0x80 [ 445.969739][ T8656] __kasan_kmalloc+0x93/0xb0 [ 445.969763][ T8656] __kmalloc_cache_noprof+0x3d2/0x6b0 [ 445.969789][ T8656] vhci_urb_enqueue+0x5c2/0xe00 [ 445.969809][ T8656] usb_hcd_submit_urb+0x322/0x1b40 [ 445.969894][ T8656] usb_start_wait_urb+0x13f/0x5b0 [ 445.969941][ T8656] usb_control_msg+0x234/0x3e0 [ 445.969964][ T8656] hub_port_init+0xb0b/0x28b0 [ 445.969990][ T8656] hub_event+0x24e2/0x4cf0 [ 445.970015][ T8656] process_scheduled_works+0xa8e/0x14e0 [ 445.970089][ T8656] worker_thread+0xa47/0xfb0 [ 445.970119][ T8656] kthread+0x388/0x470 [ 445.970139][ T8656] ret_from_fork+0x514/0xb70 [ 445.970160][ T8656] ret_from_fork_asm+0x1a/0x30 [ 445.970192][ T8656] [ 445.970196][ T8656] Freed by task 8655: [ 445.970203][ T8656] kasan_save_track+0x3e/0x80 [ 445.970219][ T8656] kasan_save_free_info+0x40/0x50 [ 445.970247][ T8656] __kasan_slab_free+0x5c/0x80 [ 445.970264][ T8656] kfree+0x1c5/0x6c0 [ 445.970288][ T8656] pickup_urb_and_free_priv+0x225/0x3f0 [ 445.970302][ T8656] vhci_rx_loop+0x3c5/0xa00 [ 445.970314][ T8656] kthread+0x388/0x470 [ 445.970329][ T8656] ret_from_fork+0x514/0xb70 [ 445.970344][ T8656] ret_from_fork_asm+0x1a/0x30 [ 445.970362][ T8656] [ 445.970365][ T8656] The buggy address belongs to the object at ffff888060141500 [ 445.970365][ T8656] which belongs to the cache kmalloc-64 of size 64 [ 445.970379][ T8656] The buggy address is located 32 bytes inside of [ 445.970379][ T8656] freed 64-byte region [ffff888060141500, ffff888060141540) [ 445.970394][ T8656] [ 445.970398][ T8656] The buggy address belongs to the physical page: [ 445.970413][ T8656] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x60141 [ 445.970427][ T8656] flags: 0x80000000000000(node=0|zone=1) [ 445.970443][ T8656] page_type: f5(slab) [ 445.970457][ T8656] raw: 0080000000000000 ffff88801a0178c0 dead000000000100 dead000000000122 [ 445.970471][ T8656] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 [ 445.970479][ T8656] page dumped because: kasan: bad access detected [ 445.970524][ T8656] page_owner tracks the page as allocated [ 445.970533][ T8656] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5608, tgid 5608 (syz-executor), ts 115026460752, free_ts 0 [ 445.970574][ T8656] post_alloc_hook+0x1f9/0x250 [ 445.970628][ T8656] get_page_from_freelist+0x262a/0x26a0 [ 445.970665][ T8656] __alloc_frozen_pages_noprof+0x18d/0x380 [ 445.970688][ T8656] allocate_slab+0x79/0x5e0 [ 445.970701][ T8656] refill_objects+0x2d8/0x350 [ 445.970714][ T8656] __pcs_replace_empty_main+0x330/0x690 [ 445.970737][ T8656] __kmalloc_noprof+0x544/0x780 [ 445.970755][ T8656] kobject_get_path+0xc5/0x2f0 [ 445.970799][ T8656] kobject_uevent_env+0x2a1/0x9e0 [ 445.970821][ T8656] netdev_queue_update_kobjects+0x337/0x6a0 [ 445.970898][ T8656] netdev_register_kobject+0x258/0x310 [ 445.970912][ T8656] register_netdevice+0x1455/0x1ed0 [ 445.970967][ T8656] veth_newlink+0x676/0xb70 [ 445.971013][ T8656] rtnl_newlink_create+0x310/0xb00 [ 445.971050][ T8656] rtnl_newlink+0x167f/0x1bd0 [ 445.971068][ T8656] rtnetlink_rcv_msg+0x802/0xc00 [ 445.971084][ T8656] page_owner free stack trace missing [ 445.971089][ T8656] [ 445.971093][ T8656] Memory state around the buggy address: [ 445.971100][ T8656] ffff888060141400: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 445.971111][ T8656] ffff888060141480: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 445.971122][ T8656] >ffff888060141500: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 445.971129][ T8656] ^ [ 445.971137][ T8656] ffff888060141580: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 445.971147][ T8656] ffff888060141600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 445.971155][ T8656] ================================================================== [ 446.128640][ T8656] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 446.128664][ T8656] CPU: 0 UID: 0 PID: 8656 Comm: vhci_tx Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 446.128736][ T8656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 446.128779][ T8656] Call Trace: [ 446.128788][ T8656] [ 446.128798][ T8656] vpanic+0x56c/0xa60 [ 446.128834][ T8656] ? __pfx_vpanic+0x10/0x10 [ 446.128916][ T8656] panic+0xc5/0xd0 [ 446.128966][ T8656] ? __pfx_panic+0x10/0x10 [ 446.128994][ T8656] ? preempt_schedule_thunk+0x16/0x40 [ 446.129030][ T8656] ? vhci_tx_loop+0x3e9/0x1c70 [ 446.129050][ T8656] ? preempt_schedule_thunk+0x16/0x40 [ 446.129086][ T8656] ? vhci_tx_loop+0x3e9/0x1c70 [ 446.129104][ T8656] check_panic_on_warn+0x89/0xb0 [ 446.129197][ T8656] ? vhci_tx_loop+0x3e9/0x1c70 [ 446.129218][ T8656] end_report+0x73/0x170 [ 446.129249][ T8656] ? vhci_tx_loop+0x3e9/0x1c70 [ 446.129269][ T8656] kasan_report+0x128/0x150 [ 446.129309][ T8656] ? vhci_tx_loop+0x3e9/0x1c70 [ 446.129334][ T8656] vhci_tx_loop+0x3e9/0x1c70 [ 446.129367][ T8656] ? __pfx_vhci_tx_loop+0x10/0x10 [ 446.129392][ T8656] ? __lock_acquire+0x683/0x2ce0 [ 446.129424][ T8656] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 446.129452][ T8656] ? lockdep_hardirqs_on+0x7a/0x110 [ 446.129515][ T8656] ? do_raw_spin_lock+0x12b/0x2f0 [ 446.129545][ T8656] ? __pfx_autoremove_wake_function+0x10/0x10 [ 446.129604][ T8656] ? __kthread_parkme+0x71/0x1f0 [ 446.129633][ T8656] ? __kthread_parkme+0x196/0x1f0 [ 446.129657][ T8656] kthread+0x388/0x470 [ 446.129682][ T8656] ? __pfx_vhci_tx_loop+0x10/0x10 [ 446.129700][ T8656] ? __pfx_kthread+0x10/0x10 [ 446.129724][ T8656] ret_from_fork+0x514/0xb70 [ 446.129751][ T8656] ? __pfx_ret_from_fork+0x10/0x10 [ 446.129777][ T8656] ? __switch_to+0xc89/0x1420 [ 446.129813][ T8656] ? __pfx_kthread+0x10/0x10 [ 446.129839][ T8656] ret_from_fork_asm+0x1a/0x30 [ 446.129899][ T8656] [ 446.130097][ T8656] Kernel Offset: disabled