last executing test programs: 2m52.983655552s ago: executing program 1 (id=843): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000180), 0x651, 0x0) recvmmsg(r1, &(0x7f00000001c0), 0x10106, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) r3 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000001c0)={'macsec0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="400000001000010010000000ffdbdf2500000000", @ANYRES32=r5, @ANYBLOB="dc02000011000400140012800b0001006d6163736563000004000280"], 0x40}}, 0x800) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setns(0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000200)=[{0x0}], 0x1, 0x800, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000001600)={0x0, 0x0}) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001640), 0x0, 0x0) ioctl$TCSETAW(r6, 0x5407, &(0x7f0000001680)={0x400a, 0x7, 0x80, 0x40e0, 0xc}) ioctl$TIOCMSET(r6, 0x5418, &(0x7f00000016c0)=0x8001) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001700), 0x42003, 0x0) pipe2(&(0x7f0000001740)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) fcntl$setpipe(r7, 0x407, 0x2000000) setns(0xc9, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001800), 0x16) 2m51.328341457s ago: executing program 1 (id=845): r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2}, 0x10) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002cc0), r4) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000002d00)={0x0, 0x0, &(0x7f0000002d40)={&(0x7f0000002d80)=ANY=[@ANYBLOB="70020000", @ANYRES16=r5, @ANYBLOB="0f0700000000000000006700000048000e00"], 0x270}, 0x1, 0x0, 0x0, 0x44810}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000002dc0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_WOWLAN(r1, &(0x7f0000002e80)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000002e40)={&(0x7f0000002e00)={0x24, r5, 0x2, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x29}, @val={0x8, 0x3, r6}, @void}}, ["", "", "", ""]}, 0x24}}, 0x8000) sendto$packet(r2, &(0x7f0000000040)="15", 0x1, 0x0, &(0x7f0000000080)={0x11, 0xc, r3, 0x1, 0x0, 0x6, @remote}, 0x14) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x3514}], 0x1}}], 0x400000000000181, 0x9200000000000000) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002c00)=[{{&(0x7f0000000100)={0x2, 0x4e22, @rand_addr=0x64010100}, 0x10, &(0x7f0000000480)=[{&(0x7f0000000140)="7675922939c7bc5b9054978e5e9efb3aecf91885c0f13050d2692c6078faf2031665258938f79784198423dc4b3eae4b7c03fb841808c39232aa918f08d04f8f1b5b9d3bf16cd7f86cb6bdfe4b4cb47fdbc0234b3ea319dee411", 0x5a}, {&(0x7f00000001c0)="93a02e25b27a60d4aa8b0a8b647300f12dabd21f516ea37b75a3", 0x1a}, {&(0x7f0000000200)="fe2ea4e48001177347e7c92b65a61cac3e5a473a1b606db2feafaf93ceea3719cb77783cc8226ffae1143a88f9e704b80ebb93650f0fcbfc6f2a16f96cfe7618b9ecf2a03944e814ab01ce6f1e56f9bae04d1b3634212c2f37c48666f5c906ab21c2f32626da5c040a5b2c7ef50cd32e7bafb2f7e50ab12e117c876745a7efa53e462542587abf2ee78643dbadc3bc9d32ce6e87dfe047d01a5c", 0x9a}, {&(0x7f00000002c0)="beb81b7ab2196d392f966f16a08059aae3a1844f", 0x14}, {&(0x7f0000000300)="57347d6d5f79bc333ddd42383d512a3fea373fef54c2a58edb99947427a7df8c9b73f7899dcf69cffe44e1fb815c98b48046ce5b03e089352959b5b90faffa03a7769107b9f9874f08f7e41aafcffdf355473c3c4fcdde1dd891ab9de68660192e2f22e45623fd7713daefb5fa00b9a37132e9706f8ad81dbd33de9b8f3f22e8ede814b4c9d4b0a424debc18231a41d1fadabc89ac2b96e07901a7640b276d0fde0713b849ca4afb9d569a75a52f6410f55c5537046c", 0xb6}], 0x5, &(0x7f0000000500)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @remote, @private=0xa010100}}}], 0x20}}, {{&(0x7f0000000540)={0x2, 0x4e20, @multicast1}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000580)="e9d245b43763631ce97f1534553035f2e354d5b58ef226d48c517969b0cb04e2c5027a294ff00e72544264a27567ec5876b5520fe766c00b19aacc885d105df22b8cb911ed48a173a18aedea5d9b1bc1f988f18d18d1a6e949e712e989b2d697262b8f99788ae0fa93ee6c3fe6e0c3d2ba85fbc2e21987aaec06bedcb691f2f11ed4217b08f6fb0dab3fd24a38c168d6a1af0a3b3c2dee56afa9498bbf204790d4707f90adb3464d6d224cf20dbcae2ef1fba144a3afa9d2c216129b8f159d7e3bafb043", 0xc4}, {&(0x7f0000000680)="47eda3192b2a2c27a139ed829ba693b00ced10f67a", 0x15}], 0x2, &(0x7f0000000700)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x32}}], 0x18}}, {{&(0x7f0000000740)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x6, 0x0}}, 0x10, &(0x7f0000002b80)=[{&(0x7f0000000780)="efa820308fc850d2b0383122881330e7495d6e235603552e6729e056ffa511394e8f95dc0e5d09ad7ea9a175526ad78f09264b11e434992f9f69acd1946b4d8289818a9619b8f0245cfb9ada98c438d37c5e4f346de4cb1c491cd1e3dff76ebd458ebfe6402ec92a2fe203e570a9ace4e4aa132ba34d34c384dc5686601d7c9d278012d2ed3d0221832b3b304e252ffb165ab95a203af8e37ec19efb67f7b23a437e62e30c7bf222a1d3288e89178f19517b120a4cfacdb4f1a8f6ee46e4574bb15b5353aaac7a38a81954899ced873294caf2ff15099d34e0567bf80a4579ca991f812cf3c93a1d33dbd17e9d8a098a916ffdd98991dbb25ad47edfbfd1bd2dc98d9077a6379d74364b0c6e9bc53c8b7e08cc3b7160c32a8e3ae45db9698c328fad68959065e25d421f73aba1fa4267d3c335c5411e536503b5ae0da05225bffc16fdbfd5e25be2e8764f3c846f563d94fe7dedd8dc9d2de6546db49e81977d87b3c2b3505763e1519f4c07d6c24c4472d481e6bacc7f4394e0ad07c836ab270e339b219ef8909965f94342ded7d2cfac0fe6d3de07e8ceaae13c99227ab1e80c04a25bcdc2c4e6cddb5dbabc607fa3c85b5009cd5662040b2b85fe26af431eb2ca06f204e0e839f3d788b9c00069520e9374dbfe96b238145fab467abac1a9ae9cc1ee0cc1486f7e1917e3ceacf48406d54c6f83a27284a8f2fb180f71fa891b3f224326f6b328a567912d0eb1cc5f726c3d3a4a694eb010c560aaedd774edceaf21e1835e04dd56b9660cfff2570ecd364018a17e76d8d89dbf85a2519dfc6aac94232fc18fb774589d620e9b3d18c1359a4c6f6104f12581626f53303146e6b52e0cb629af4d651777f5c7cf69e0daf5d619b7a685cb0b32f54cace7fc9ad407b08f44c47afdec3555ff72a0c5b44d59447f553828300212cad8ae2c5a5b5037a6008bcf2b44c944bbd55d5b4d2d475c39103f98df0e029ebf3cb12b1dc53188419037968092e60e11f6a8d29427c9c6f6a94039a36d154a5ee8d63c9e91d22066621800b836645090f96ca9b6d80368f6e22905a4c6311d147eda80e6380269b959ea75c51457d08185309e8b4c042e496f3ef3aaa5d09b55d81165fc7ebac6c0e7e6c5a1f7ca654efd97740908b8c1ae37ea2193e433d1b1715179bdf02e4f6333e2db9caab3a91b5c10abdc2e6b68851db40b74ea8bf2375c33cbc906a552ac41840dd63a3c31effe3490bbb04eb2f1a06d79543d874a75305f5301f98d438a677f9904c7ea7ede9746ef4ed05e09cdf2ae98297db39b43f6529760c2cb4a191a62b11a10a6514e4e47046aef59ce247edc28fc129937f85957f4d8d5e0090f8967a37931ad4fa695fffd6f9099b36ffc5db7d914729416d92c53f9a35a65e894a2d1d20967598c3dc0a90b4ba0b9f4446a01ce6217a1e9b2731d92c2dca5c3c3a5eeeb72a28ed7d1df5a23af94537286af4d79d13fdccfa73573bd3e170a204e4f272d9e7c595515d97bb80a112fa1be7e99feb65675acc9b8591db8a579afbbf8339112fd4bb4801d46fdc3c57abfe6d65560449cafc22bce0b35f86e8eacab14683319521d1f450e002a3c73e28df7aad2bee6009ddbddd5a97d895f6f9374ff7156aaf7ee577423b661cf2fce5b2ce5f672dc64aa0480e9e4ecb97cf22dfcb43e4f9dd550fd51918faf21f76697897b66a23f9109c1a27f784a50a488dadaa88b76622a112dc029c0d5b2cab723c630ec6e8564a39b527cfb9843984a43b3c0d7b4c64ac7948879f20847fd9fe43ecdca01d41c31313b691a045c8247b97f13964598a7d376470ec04bd91e15b5035c85fdee1161ca89fcfd1f5537d6e4aa1d30e060e050d3777ac99b87040db46187f39443e8db412b52770c8b2b7792babe36cf6307e76e18736e3120209c5cd9c09df9c22f12ca8e00047e002c7fd3aa5c9b69b7151e34f2c959573a26b7fdea9fbe0d04b5a7f531ab0a7ee50233c973bd4cca884b4f9a7251dfb2354a0ea67e9592568a7ba85fa8eee0a68f1f92013d0781a026868006142bc5125721010fe1072829db900dad301c5b955574a4a71b9751a1df708107f6323a29990295284854fcc9feac9f418c132aba62f5551ea26035b45903423be242cbcbf64d653df24bea5468618dbde61fd9b4d39216b947efe7daa8266a80793fd4095e2ba7c696a810a8dfcfa02ccd3ce6952be32e9f1ca7d6b6aa3db7f7ca876b8db909a6d24161f74552f5f629ffcb746cf5eceda2573259fdfc9d751802d55ec2ad451fbcfcbb8d99e704f19ae23505310ec6e46001c7ac109c5007e3a9e924b312539f0583f8d66da894e4c6696687976f4547054d11cc5d895d0abdceac64158f14a4f2480dbb0321fdf71952cc6f9757affac99fb126a454d530297defeba46c0ade79d89368c63cd548abd41f61bd80e6cdad23493b427bf8b053bb3147970937019c52ee5538a27d4c5edd9fb0c48809960a27b9aaa6c1ec0414654275fae93151810498d211180307c224c62e8547e87b61f1309b872ab95fde4f76cffbab3a299f35ae92276cb1e80d00f18a25aee606816e221f72d2f0fd60568e119960e306f5d009155b1b4ed90974c51faf25034c5a931816bd8f198a7ea2f1d4bb6a95d12b7021332e192dcfb0821cdabb45f5fe9fcf92012640ba7a38a8a380de50237be8bd86c49a21fd1b91dfa6087aebe8384922b3d8374df8675c4033010e9c7df9a88c40a61046649f361046b9ef4007a65fb17fdc1e0a086c108cc0fd90b8f30bd38a3dabe8d4669fbe29816debd1ebde88d574fc1fdb5b0a3b752e779be438e3b84de25640f722ede1ffc6af2c9a3d0175599fb8dd84f217bfb0bc51e60f97af159fba0f34226a4cad0245e90519", 0x800}, {&(0x7f0000001780)="8f6385ebd12c83ee89c630488cdd7f5364bf14a34cec38a4a8a50f52c1e294d3aa63adebad04a12317ebc8d4a3f2dc4d69f91e9dc4c7d82a05c158c8e2e57932d644d74cd64e396a1208179dfa566f03fc3a66ee7bfd8eaeb9a3383dc34bdfae976cdcb8e209f5aaa9aaae26d0533c2a5a2bbad1d57f19ebc01a6c14d0122cdfa6c5ed1ab52225ea46debafa84bc1eff63c01fd357e5ada9f3c2e75aba081287c2be15f5404fdf4bdad2", 0xaa}, {&(0x7f0000001840)="3fd6ee5126", 0x5}, {&(0x7f0000001880)="67d071c5aca7d29c815eb720f4d88a9c0bcd66dbe94c5020f34212714860d004fcac1765ab617f8aea87cd46e57ad674eef16cf7e40f7c08d7c69f037447d00b39fb34e541be0c975ce731d999afde94e4d8d27c734e3115393ebcbb078668248a739a3a72b1fa8af14b3bb8afdd300e7172c6329fbe1baa50c40200c504a0631c4efbe76b6533e5643f9a4c45bebc64922c5fc74e92257c401f7a63517a3cfa58e4ab897ca04def0a179e48bdfe836648c42aaa3b9048c8ee210aff71150e51c6195416daf00508209f38589f8b8c692f83c58634", 0xd5}, {&(0x7f0000001980)="2b8551e9aae87ba0bf6002510c09fab2b788f02dbb9673330c1a4ec7beaa667615dc61f9a70e6d2fff4611ec9702a80210f8690a3f306281fa51072641a24c0ca280b76fe257f80d2e96c3b8ec678003671d3afca3b54a792f021750b58630abff51baebb8dd75784de2587b919dc4513af4d37333d82f907b1e062ea0810cfbd47b14052767d464481c876ce779e15ebb3950aaa3", 0x95}, {&(0x7f0000001a40)="1e6a2d4f46291f9e9597ab746fbdc03900e24f7699be5b3d1daed9e901e138d398c7509d99f8e9b0", 0x28}, {&(0x7f0000001a80)="eaaedee93d4b697e476e72b9c52c2a6f5e7b5e5d604b6f9fec6cd0ba8e522a5cc2cc6eac5cc313f3ea303fdeaf93f7e56d0932763d5053425a8886dffc8f74e604d803b8799833c15d3ae921018f81f454e5e44e691bbceeb10ab041387603679fc427722c15150ff87069598c4769198b53d3c93f047e60fdacb26ebdd3222449b0041e7d361d77f26c1f5c46905f9eb6d3a377cc6414436cacae4edbbe6f2fc1be61ca40ba7ee1622a8868bcb13e28a83cde17a55bb4b3c9413d4497eebb528a9327b1ba2c87ec6c0a8acd5d1bc8bd277770c7a46844c99fd292db61e8a6c01df18955be9c0d5c9a472a389ba76c5e", 0xf0}, {&(0x7f0000001b80)="04914539dd835bdb7c67d579960bc39b9016677d9f221a0c471ac5d835ada6b5655261d6dc1981e023b44f1e76aa162b3b8d6fbce2661f0c8ed538a3ef5ec291724dc0e061eed19ca51294f7367fba4ef033a2e37fa121d6190479cf9361682a7df574f1186de7b7896ff19998939da3e3d1d06481195c454189006424729e353d807ddc2e630e4b5a5e95670951e4f25f55a934012583e15ffe2aa525e42addc603052a4459fcd1b488cbe248489e4e43372c67655075a7610663ae9cea573194d65a0845a00d90ff7e991237d0b7aa0e16ec6ca14bcce940558f58c592bbf6a9ac0c34ae2d0e569770ddd338a07f707df53b2bfdb5065296427e23a263d33b0385c1b45e122177d637ed62581628ed5b51749db56e21202db65ca9edcae4f32b0c356dac40a427071b96dade5d147a1aad6fe942c492623edfee9fc81986ff535af89d0b288f3eaa236de4175e1c83ca732f0f56fbad2cdac2c06ee13861f22289faf28119990b86b8fa6aba423f5167c95ef33886e0a17cb69a61f714f1fa042e417051ede916d493b45d27f0e04b92009470c65fa3edfaed567bd512835a2fafa9eb8f8aac62deee7311a9fde7e3575f37c7877f431ed34309c0362e2dedb85ff41a186f00b6dfd709cb4d6112ca5eaaec6a01b60a671d46e7b39e8aa380e913954c694efd3aa71478b4a17697d973dfc983271b4d6a9c27cf7b8a0b43f73ce2097e97aa64542e55b2aee561c59d7cbd03a317889a89348775150b94f44092b7052767f6ac66b71b72ae3381f295ad589422dab6ca728423e4540155cedc1f82f2398814576ec42786aebdbaa3dbbef06854385253c8d95290cb308e4220150fac0c93b2d62994b03c5779a5d3f109890799159b25e0254c90301761f7a5a3c99f3b0cba670456ccd4100b0e3f2d8774ea23d770fa78ec0d36a4bbe982539952e0f65f98fb48ff8fe58cfb8f60748dd192298cb161c66658be0672122865d9cc5050356e36cd8dc4dda254d3d110be89c3753374b54140e03c2e3eec974f4bdb861bce100164c5b3adf004827d02d692489772ed2f5c38d2b99d98cc545ddd79090edc23ec02f2680917c42959872e68496fcf0d51c65b92034e983d935a74d7c6494324199908cd99ace5c23f03567f24a77233e0edbb47733840ef779b41b98d4250e80d61e262f61cf481c54bd15aaef0ef8f67eeb0424a291290f6a6607fa4c66759ca29ffc7b4e8e2587b9e7189ac627bb5d203e0f0592a215d98fefe3ff7b3dabac22dfcbc266e8e2cdb125213b2e2009f1da6e3446c9d2a910e93887f11f54c67aea59b59f24e03d86d4cc6c86237f20cc5d60bc0fdc7c45c8282fe88c4144226bce77e61c27849b163902f37bf89d71510b3832826d5b746cdd53efff914631d8b89d5f53d631f1f382950df4c4c7a71fdfc521c2e820288dcacb1807ed7211f4f0d4aabe3639b80b0abbd1540918e2041bf46fc294045f21612e7228262decfc4319e655d51afab07f1046141c7ff4e8c37dfef81373789432816eccc8df56f6d880134fb14afd8c8ea7b0b3cb45d9d53aa89b2dd80273878012edbd8469a53e4954363f1308ad72e72636422bb4f01e3feb075dcbf7dd7980e5577b11358281b8a1f539f8cab14f345579261d26aa52c4650e01128c45c08fa94444c3bf7570ee1cd6af22957cd6dcc84f1d44a489f2f88f72c2422dd45f8825b73d5f6eac9365a864818766d984d8b0c0521d9af6807e2330e92dad941560759cf73cc433e196680583832e4f77354492923d1855d9577970c99f94da172d17b31d6abe576bafd8b38a8291263fd6a7e44a90a8882e5b66509b25575c3e689770d657500c4edcf84249f7d141702d49bab98b6d793110411db939b3e46fb52cd8a7c0fd701b352ea8de085b9b48b1abb5e833e7b25cca65abbd194e10336a563851919d74aa0461293c9a2aa81c0a66a774aa753ec1a3f2747b1896d1d31a34929ad66e0699bebcc4a22c282bcdaef8d791f23463916d7d1928be07b22af35ffe4d5b1bb77060fa847fd06a98aa8da5443343bca5f45bf24189304ba4d74ce4b28b73ba312c92f4fac14077a59e36a0c08d551abbccd174adf723ad405964ccb04b9fc937195039e5a7d2006b553a91a0bb1736c60e5fdaaecf563c3f28afcd45b1e6f38330231d1895a9cd1baee399add68c8b8aa4cc6bd89006d8594e6fcf24358ec31446a63182881fb07d95415c137963d8b107871f7aaf956c3e1ec41d495c0fbd4621de7fa4e3eb3bb766f4b3219d7f681d5fe066e1810e20e96613d9a3936a55ecb3217523d1e6c1491aff3baa416a7391909e6423cd40f94c093a7c9ecda2977171db8a485996135740f35048af1adb46ca07bda4d82594cc6e5f0db59071493b4c1180bcda73ab8440d2a403b98334f0e2190c186c8253e218bd6b62d89cf8faef4892215481ddbe9c0d7326de4073c86107aa42b6b91de136739e2bd1c2e79c747ec6aea6c1d4ec74beede2cd723a1c0b8e6e4b082417d0eafe7ed6646a9ca7a42b2679c164d3131be0eeda8a5670f68bbfa5df6ab37e2c93d4aac6fd45291ee05d30ed6006d05d320f302141c085438269e72ab025b3c5ee0ade53403da7ba576f8c930dcde4d3736366af86645596adab4f393478c552d48eb7d08c5bc6d3bd28a3e164223460c00e0824444be284481982005939430fb1b2600201a176c27e88e0ae2b9e82697952f5261a3b1bd891c2e933821d7a730c7dcc0809ac8af68be8a08bbd33c0ed7e0a14f5f9882395f5b1cd3dd61883deeea70b05a556f7def5534248b2972a6fec7f64e00d5dcbba9ee1cd0d39fb53b0d8c0901e0d4c570d772ddc4c6eeee4eb803f5b201e06267909f187ef5cae840fdfc4ad2b4de929ba7d0612ee2b62bcb25e8042a22a21108103966cafaa1d19ba5ff0a37a5e3497ad9970ba672fd2690c534495282c07f0f5e054fb38010d4729c1febf8bb10b079ea3cc5f8efcc08108f07fbb997a7703b61a221e4bf93a0d0d8330a9289689e795b9bab3d4e3019474367e2c9e5d17d67ba0190133e84c7b82c08f323db30760392a89ac0a2009a6d8410dc5e975da527e598e03804397dca13d869c4135c7714da70167dd2ebdc4e177cf9f697771b9ead6e2ca3199ee2d270157bdb8504f74e6c77ad59f24a761aece1a515c6028f8987d69870f89bbe323aa691e2292a4df4d86192a26934d4294a439094f28e893110534d2a47203ab434a9df4eba15741729a8abe5262f832d4d283c866ae72da1bd3892e8f707f44d57fc9e32b4f131bffd995b7b12187dba5b7d32781bac1fcf8a533b371104db39f8fe16066eb13a47564a6f3a209e5e9cbe8afd18cfdfb17132d121757b314917c077f562004072ea7d130abdfb0cc5d18fe621b238f077063555f9a1e88512e2848e14519d38636b6d8e106613ac8a9ad8200a0740e385ae2a311a45c2fd3df84e32f6106272d94a9edd611015e386b4004a43612a58b5e1ee8f63aac55e410a9602f902bc54e4577137ad43e53ce4eed35198bf20442c3bd00497b2ec867a713613e2c52fdd6eb67116e17a2ae0c255c769f9f286dae7d61007f5cbc341dc05f12703112ebb3df1f09b5b08fd832f1295d5f93ee73d4fd372457c8847ae6d7117bed897dcda651df6f15c1d1269aef3154d4b9f0890acdaae1a6a2f1bc8538a47657e134ce01df742671802250052933cedb117e7d118cbe66fc9640509de5c98095db2f6617b594194ff032ca6fc6f00c5a2170411488324e3de055fcca76ad19a1ec695816a519e40fb6b9f0e16d816cee096121d48c171bd419177e81f27b9c418c617f15d6febf02a0a12cb0ecdff49eb8db8d2ad3aedc0c220a4b5b45fe80bdccccac9d1117d9accb1dbdea6857179ccdfd339bc9e58014aecc8acf411f7c67573f09647bfe36ac539b387f4ff8212727a22d505544e514ee6b3a7aad52e312d0c4efeefc1462784c7b6a08ff381ea1e9a884a5aeb601d3f75a6df55a02810b07e42de8bbb4b209f6ed2bdc95a53bcd39f996b63edf48e6255b9d09ce89aa63074c95585843b41bcd363f0f29ecdd8f971a1d6122e4a8f925f2360b4863c1c3c6c2c5be942739255ef9488362c85d58fc89a24033891d37cf60b20f3536c9ff8560836d1461d805ff01ddc8603e704133a73b551f5a4da770d707a480fd72cd44f474d649f0ce0f7622fd584ddb1b7dde7a5c96390410c65a53b5be3cf45f4acebcd2abd2a4ef87ebd2d698743460abd14bd41cf0666763cb537eec12a1385cb691736a5292c68685e985247cd3102ceb657754571f0feb08837f17f42317823d4ecfc20a432b06264c93a5cab1f7193576404dfde50aad24a26f8aa26f67becdaef6da1cb230e6024b18bce29f1c0d0d0c36f195bc0e2d38cf54d2e006e3682037d0721d503d5088c367b2664529398b64fb02b958c300c801540f5e3c6d0e9282ddfc702caa6978fe25372495c355a24a97c2f5c88ef1b9c9e02fa4eea5d6c6ba3ff42f929eef18f60b91409a1b73f00e7b5107f6087af7bb97167cd6866175f1a91ad935dbcdc9c0dc20d85fc8844bb2160184b0ed645fc6b0e321ce60f69d3492122a4244010924c38cbe394e70cb1fc16aee10e2cfddd89d5d359de64d0539628936e4662e2dbc44ec6d7f9f41cde8760f816e66ef9df46b87901924ac8e6a7b4e530621a08c25445bf7f8c1c05dba799360d64f4d0071a7d9945b6fc3e5d2036155d781d5cad28cc7d1ca0c25bc013ab0cfacc6efb29d1a69cc5ef6734c0670a2efdc6861c8713e94cb012e0b0a4d8835c702752bbbc34e15154967fa0e7b43e7272bd11f8c321a43377cde46b727287ca281f091b3d6f38f39b590cb49c0235387a7c275eee5a685d4d0abefd05d707ed36888b44ab5ffda2afafd12c09556c3a4cc01d5b136bab1034a562d7b9362dbff722f01c00fdc1494aa139f571170aa38cde64c6da84a23ab7f276d704f84c59b478a1371bb2408b37838c3e15e7cd5ccb616e1d1bb910d8bb5ef19e4409e71e3748be7053560d5d9d04cd44642bebff05f7ddd029b5cb952bb86f316eaf0a44263dc8c0441e371404743808d20664c48506e2b2fd70a2c1e04f7410fb9ff03d7cd4b5d3939be9f690a16b2c73f6b9d4396335cc947b1973cec8be1d8b35ac7c1efb760e5378932b7e2935b59ca1f8278e208ab784f6918c71c629d704eb941dc31c8f5b1ebbcbcb29f2babf5adf1352ed37802eccc83e61e55c2add770c1c91f95d50b3533b8868cb838cc17a0df9dcf00b91187a268561f44247877bba8102c67dcc9d7053608ed7058f8a0598fd30899eb980fe53700ba580fc5d9fed46672b7cf90164dd7ef025145ee27b033a4682a36a3098d5c7492cefc28d25caf84dbd5311e9d68c20de41217551b9d6b67b7bf4245b7d1563935a26488965c544370ddb3cda3c37e7e77c3b22427b8fd2af69664e5a0d7ce91aa9ec80ea04e9b446d2b103c03cd244fb9f4420c8a623325e84dfb69198e262c1f085be49b3d3efcfbba75c15134cf51a051890a4c5401addde39033962983713b79b2e115c36d8068c83f191d10290d6436d0487f83b01f196e1783c83ea38e76bec4e7ad205eb0d1f5b32a9ff736504514c90ea44823a19577f79d7c73c88397bac333199fd69690443c74d4d5c78daf873e22e3cba2cf3bfd7758fbe1587d75cbb7001fc8c63264f93b9f7ef37470b65b235985fd425c0e352dae75bcd3accfbe31263b982f171ce0ee71590957776f8fd1ccb", 0x1000}], 0x8}}], 0x3, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000003100)={0x2020}, 0x2020) 2m49.003137614s ago: executing program 1 (id=853): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) prlimit64(0x0, 0xe, &(0x7f0000000740)={0x8, 0x8b}, 0x0) r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0}) r1 = socket(0xa, 0x2400000001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x10000000000030, 0x0, &(0x7f0000000100)) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000140)='hello', 0x5, 0x0, 0x0, 0x0) ptrace(0x10, 0x1) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, 0x0, 0x0}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$sock_ifreq(r3, 0x8918, &(0x7f0000000240)={'veth0_to_hsr\x00', @ifru_hwaddr}) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, 0x0, &(0x7f00000002c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000300)={0x2c, &(0x7f0000000340)={0x40, 0x8, 0x8, "003cb3a4aa50323f"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000780)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000007c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000800)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f0000000900), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000940), 0x10106, 0x2, 0x0) 2m44.334586477s ago: executing program 1 (id=861): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000080)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd77c7000) r3 = syz_clone(0x200c8100, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000000540)=""/102392, 0x18ff8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x10) sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000019540)={&(0x7f0000019580)={0x10, 0x0, 0x0, 0x2000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48001}, 0x2000c801) shutdown(r5, 0x1) connect$inet6(r5, &(0x7f00000195c0)={0xa, 0x5e24, 0xfffffff2, @ipv4={'\x00', '\xff\xff', @remote}, 0x9}, 0x1c) syz_open_procfs$pagemap(r2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019600)={{}, 0x0, 0x0}, 0x20) write$binfmt_script(0xffffffffffffffff, &(0x7f0000019640), 0x3af4701e) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000019680)=@bpf_tracing={0x1a, 0x1a, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x41100, 0x9, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000019740)={0x1, 0xf, 0x3, 0xb}, 0x10, 0x2e6dc, 0xffffffffffffffff, 0x0, &(0x7f0000019780)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f00000197c0), 0x10, 0x9}, 0x94) r6 = dup(r0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/vmcoreinfo', 0x660603, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e23, 0xdb, @empty}}, 0xffb, 0x203, 0xffff18b6, 0x6, 0x330, 0x80000001, 0xdb}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x4c24, @empty}}, 0x6, 0x6}, 0x90) sendmsg$inet6(r6, &(0x7f0000000300)={&(0x7f0000000340)={0xa, 0x4e24, 0x8004, @ipv4={'\x00', '\xff\xff', @local}, 0x6}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000003c0)="f0", 0x1}], 0x1}, 0x40054) 2m42.945628181s ago: executing program 1 (id=862): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e02000000000000000000000000000005"], 0x0, 0x37}, 0x28) 2m40.209823599s ago: executing program 1 (id=868): r0 = syz_open_dev$vbi(&(0x7f0000000140), 0x2, 0x2) r1 = syz_io_uring_complete(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f00000001c0)={0x0, @reserved}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) r3 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r4, &(0x7f00000006c0)='3', 0x4e) mkdirat(0xffffffffffffff9c, 0x0, 0x1e6) write(r4, 0x0, 0x46) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0) sendmsg$netlink(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000003c0)={0x114, 0x11, 0x509, 0x2000, 0x0, "", [@nested={0x101, 0x77, 0x0, 0x1, [@generic="933d15c78539c092f350a7fcca2e220f1a4480bc2aad0b580511084e0440ee4ed805beb6ab8764e74ffac60d28ae543ad86e3b8f2a587465e3a5a376299223928d4faeeec84c2c445e71254f475aaa56bd54865d2902821faa6c198d1c72d162facfa6b1df534e74ee2513e6f0a30d883607b90821f421a132ed7e0cecc6c219546ad1f8f0c7a59d4ad58dbf61c811bf15f356a944d9e28c77c5a7c18138f190abfffd144238dbba187d1f4698a7e781ab35d70c67567d6d1ef564f867324e40738583a46a349ac85995fb7bdf2fbf5e700cffdb7cbcae373117db93a528aa21473b27e39258f86fc7164ee63e38ee7199ff02021e2309ea52265f9f66"]}]}, 0x114}], 0x1}, 0x8014) openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/locks\x00', 0x0, 0x0) write(r2, &(0x7f00000000c0)='tcp 2', 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x2, 0x0) write(r5, 0x0, 0x0) 2m24.116935839s ago: executing program 32 (id=868): r0 = syz_open_dev$vbi(&(0x7f0000000140), 0x2, 0x2) r1 = syz_io_uring_complete(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f00000001c0)={0x0, @reserved}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) r3 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r4, &(0x7f00000006c0)='3', 0x4e) mkdirat(0xffffffffffffff9c, 0x0, 0x1e6) write(r4, 0x0, 0x46) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0) sendmsg$netlink(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000003c0)={0x114, 0x11, 0x509, 0x2000, 0x0, "", [@nested={0x101, 0x77, 0x0, 0x1, [@generic="933d15c78539c092f350a7fcca2e220f1a4480bc2aad0b580511084e0440ee4ed805beb6ab8764e74ffac60d28ae543ad86e3b8f2a587465e3a5a376299223928d4faeeec84c2c445e71254f475aaa56bd54865d2902821faa6c198d1c72d162facfa6b1df534e74ee2513e6f0a30d883607b90821f421a132ed7e0cecc6c219546ad1f8f0c7a59d4ad58dbf61c811bf15f356a944d9e28c77c5a7c18138f190abfffd144238dbba187d1f4698a7e781ab35d70c67567d6d1ef564f867324e40738583a46a349ac85995fb7bdf2fbf5e700cffdb7cbcae373117db93a528aa21473b27e39258f86fc7164ee63e38ee7199ff02021e2309ea52265f9f66"]}]}, 0x114}], 0x1}, 0x8014) openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/locks\x00', 0x0, 0x0) write(r2, &(0x7f00000000c0)='tcp 2', 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x2, 0x0) write(r5, 0x0, 0x0) 1m46.696651499s ago: executing program 5 (id=952): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000080)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd77c7000) r3 = syz_clone(0x200c8100, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000000540)=""/102392, 0x18ff8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x10) sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000019540)={&(0x7f0000019580)={0x10, 0x0, 0x0, 0x2000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48001}, 0x2000c801) shutdown(r5, 0x1) connect$inet6(r5, &(0x7f00000195c0)={0xa, 0x5e24, 0xfffffff2, @ipv4={'\x00', '\xff\xff', @remote}, 0x9}, 0x1c) syz_open_procfs$pagemap(r2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019600)={{}, 0x0, 0x0}, 0x20) write$binfmt_script(0xffffffffffffffff, &(0x7f0000019640), 0x3af4701e) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000019680)=@bpf_tracing={0x1a, 0x1a, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x41100, 0x9, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000019740)={0x1, 0xf, 0x3, 0xb}, 0x10, 0x2e6dc, 0xffffffffffffffff, 0x0, &(0x7f0000019780)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f00000197c0), 0x10, 0x9}, 0x94) r6 = dup(r0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/vmcoreinfo', 0x660603, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x4c24, @empty}}, 0x6, 0x6}, 0x90) sendmsg$inet6(r6, &(0x7f0000000300)={&(0x7f0000000340)={0xa, 0x4e24, 0x8004, @ipv4={'\x00', '\xff\xff', @local}, 0x6}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000003c0)="f0", 0x1}], 0x1}, 0x40054) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000480)={0x0, @in={{0x2, 0x4e24, @local}}, 0xabb8, 0x67, 0xa4f, 0xc4, 0x28, 0xffffff89, 0xa9}, 0x9c) 1m43.273075426s ago: executing program 5 (id=955): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="230000002300000002001200ff19010005"], 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000380)={r0, &(0x7f00000003c0), 0x0}, 0x20) (fail_nth: 4) 1m40.8779579s ago: executing program 5 (id=960): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x40080, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getdents64(0xffffffffffffffff, &(0x7f0000001140)=""/4096, 0x1000) mmap$xdp(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4, 0x12, 0xffffffffffffffff, 0x80000000) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x63) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'netdevsim0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000003c0)=ANY=[@ANYBLOB="440000001000030500000000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="07030500e3a20200140012800c0001006d616376746170000400028008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r3, @ANYBLOB="df5ec2fd2d6d5cb35c4311581aa9ed222c2ad954773574a1fd8de9ee57b85e448da1b8faf23afd6a669c96f4ab404b79350352101c52ed6885cc1e32a6da01953d27a6ea2b972b840cd8993319464471224791b804a7a5b7ed0447"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) setns(0xc9, 0x0) r4 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNADDRESOURCE(r4, 0x89ee, &(0x7f0000000700)=0x1) unshare(0x40400) syz_emit_ethernet(0x75, &(0x7f0000000740)={@broadcast, @remote, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x67, 0x61, 0x0, 0x0, 0x2f, 0x0, @private, @multicast1}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x8100, 0x1, 0x10, [], "7f"}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [], "0bfd6839a23946ffc0355582ffd7"}, {0x8, 0x88be, 0x0, {{0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x1, {0xfffffffe}}}, {0x8, 0x22eb, 0x0, {{}, 0x2, {0x5}}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 1m39.279972184s ago: executing program 5 (id=962): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x1808000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="04000000000000000000000038010000380100000000000000000000000000000000000000000000000000000000000074") mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000140)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000180)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f00000001c0)={0x0, 0x0, 0x10001, 0x5}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000002400)={'ip_vti0\x00'}) sendmsg$nl_route(r2, &(0x7f0000002440)={0x0, 0x0, &(0x7f0000002480)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c00000070000100000000000000000007000000", @ANYRES16=r0, @ANYRESOCT=r2], 0x2c}}, 0x50) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) getrandom(&(0x7f0000002500)=""/286, 0xffffff9a, 0x0) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x16) r4 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000300), 0x102, 0x0) read$FUSE(r4, &(0x7f0000000340)={0x2020}, 0x2020) writev(r4, &(0x7f0000002380)=[{&(0x7f00000023c0)='7', 0x1}], 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000200)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) map_shadow_stack(&(0x7f0000011000/0x2000)=nil, 0x2000, 0x1) close(r5) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f0000000240)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r6, 0x0) 1m31.871833626s ago: executing program 5 (id=976): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@delqdisc={0x24, 0x25, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0xa}, {0xffff, 0xffff}, {0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0xc004) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)}, 0x0) r1 = add_key$user(&(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240), 0xc9, 0xfffffffffffffffd) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)) keyctl$dh_compute(0x17, &(0x7f0000000280)={r1, r1, r1}, 0x0, 0x0, &(0x7f00000002c0)={0x0}) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000340)={{0x2, 0x4e23, @multicast1}, {0x0, @remote}, 0x2, {0x2, 0x4e23, @empty}, 'ip6gre0\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000003c0), 0x80) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r3, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_MCAST_MSFILTER(r4, 0x0, 0x30, &(0x7f0000000a00)=ANY=[@ANYBLOB="040000000000000002004e237f00000100000000000000000000000000000000000000000018dc7d353cbef14d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000400000002004e23e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001002004e22ac1e010100"/328], 0x290) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(0x0, r5) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000840), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000880)={0x38, 0x6, 0x8, 0x3, 0x0, 0x81, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r6, r6, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f00000008c0)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r7 = syz_open_dev$media(&(0x7f0000000180), 0x2, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r7, 0x80047c05, &(0x7f0000000240)=0xffffffffffffffff) dup3(r4, r2, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r8, 0x7c81, 0x0) r9 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x2e, &(0x7f0000000100)=0x79, 0x4) bind$inet(r9, &(0x7f0000000940)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x1a, 0x0, 0x0) 1m30.285578093s ago: executing program 5 (id=981): r0 = syz_open_dev$vbi(&(0x7f0000000140), 0x2, 0x2) r1 = syz_io_uring_complete(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f00000001c0)={0x0, @reserved}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) r3 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r4, &(0x7f00000006c0)='3', 0x4e) mkdirat(0xffffffffffffff9c, 0x0, 0x1e6) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0) sendmsg$netlink(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000003c0)={0x114, 0x11, 0x509, 0x2000, 0x0, "", [@nested={0x101, 0x77, 0x0, 0x1, [@generic="933d15c78539c092f350a7fcca2e220f1a4480bc2aad0b580511084e0440ee4ed805beb6ab8764e74ffac60d28ae543ad86e3b8f2a587465e3a5a376299223928d4faeeec84c2c445e71254f475aaa56bd54865d2902821faa6c198d1c72d162facfa6b1df534e74ee2513e6f0a30d883607b90821f421a132ed7e0cecc6c219546ad1f8f0c7a59d4ad58dbf61c811bf15f356a944d9e28c77c5a7c18138f190abfffd144238dbba187d1f4698a7e781ab35d70c67567d6d1ef564f867324e40738583a46a349ac85995fb7bdf2fbf5e700cffdb7cbcae373117db93a528aa21473b27e39258f86fc7164ee63e38ee7199ff02021e2309ea52265f9f66"]}]}, 0x114}], 0x1}, 0x8014) pread64(0xffffffffffffffff, &(0x7f00000002c0)=""/124, 0x7c, 0x7) write(r2, &(0x7f00000000c0)='tcp 2', 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x2, 0x0) write(r5, 0x0, 0x0) 1m13.779271675s ago: executing program 33 (id=981): r0 = syz_open_dev$vbi(&(0x7f0000000140), 0x2, 0x2) r1 = syz_io_uring_complete(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f00000001c0)={0x0, @reserved}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) r3 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r4, &(0x7f00000006c0)='3', 0x4e) mkdirat(0xffffffffffffff9c, 0x0, 0x1e6) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0) sendmsg$netlink(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000003c0)={0x114, 0x11, 0x509, 0x2000, 0x0, "", [@nested={0x101, 0x77, 0x0, 0x1, [@generic="933d15c78539c092f350a7fcca2e220f1a4480bc2aad0b580511084e0440ee4ed805beb6ab8764e74ffac60d28ae543ad86e3b8f2a587465e3a5a376299223928d4faeeec84c2c445e71254f475aaa56bd54865d2902821faa6c198d1c72d162facfa6b1df534e74ee2513e6f0a30d883607b90821f421a132ed7e0cecc6c219546ad1f8f0c7a59d4ad58dbf61c811bf15f356a944d9e28c77c5a7c18138f190abfffd144238dbba187d1f4698a7e781ab35d70c67567d6d1ef564f867324e40738583a46a349ac85995fb7bdf2fbf5e700cffdb7cbcae373117db93a528aa21473b27e39258f86fc7164ee63e38ee7199ff02021e2309ea52265f9f66"]}]}, 0x114}], 0x1}, 0x8014) pread64(0xffffffffffffffff, &(0x7f00000002c0)=""/124, 0x7c, 0x7) write(r2, &(0x7f00000000c0)='tcp 2', 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x2, 0x0) write(r5, 0x0, 0x0) 16.178383759s ago: executing program 6 (id=1129): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001440)=0x7) r0 = getpgrp(0x0) openat$mice(0xffffff9c, &(0x7f0000000100), 0x2) r1 = syz_io_uring_setup(0x40df, &(0x7f0000000340)={0x0, 0x69ec, 0xc00, 0x5, 0x50}, &(0x7f0000000400)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000480)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000004c0)=@IORING_OP_WRITE={0x17, 0x0, 0x2004, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0xfffffffffffffff2, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x521c, 0x1, 0x61, 0x0, 0x18) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r5, 0x89f3, &(0x7f0000000040)={'sit0\x00', &(0x7f00000000c0)={'tunl0\x00', 0x0, 0x7800, 0x40, 0x7, 0x1, {{0x5, 0x4, 0x1, 0x7, 0x14, 0xe5, 0x4, 0x40, 0x29, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}) sched_setaffinity(r0, 0x8, &(0x7f0000001480)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f00000014c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r7 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r7, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f0000001500), 0x0, 0x0) read$msr(r8, &(0x7f0000001540)=""/102392, 0x18ff8) r9 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000140)={0x2, 0x2, 0x6ac, 0x100001, 0x80000001, 0xfffffffb}) ioctl$SG_IO(r9, 0x2285, &(0x7f0000000180)={0x53, 0xffffffffffffffff, 0x6, 0x0, @scatter={0x0, 0x3, 0x0}, &(0x7f0000000200)="b6b0d0f8b4b5", 0x0, 0x3ff, 0x0, 0x0, 0x0}) sched_setaffinity(r7, 0x0, 0x0) futex(0x0, 0xd, 0x2, 0x0, 0x0, 0x400000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280), 0x404000, 0x0) ioctl$TIOCMSET(r10, 0x5418, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000300), 0x107020) 14.903609888s ago: executing program 6 (id=1131): r0 = fsopen(&(0x7f0000000000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000014c0)={'wpan1\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(r1, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000001540)={&(0x7f0000001580)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x16}, 0x20040000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) getsockopt$inet_mptcp_buf(0xffffffffffffffff, 0x11c, 0x2, &(0x7f0000001600)=""/200, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000001700)={0x84, @broadcast, 0x4e21, 0x3, 'nq\x00', 0x1, 0x10000004, 0x8}, 0x2c) r3 = socket$kcm(0xa, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000001740), r4) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000001780)={{0x62, @private=0xa010100, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81}, {@dev={0xac, 0x14, 0x14, 0x3c}, 0x4e23, 0x0, 0x1cb, 0x12d61, 0x12d58}}, 0x44) sendmsg$sock(r3, &(0x7f0000001800)={&(0x7f0000001840)=@in6={0x2, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x1}, 0xfffffeec}, 0x80, 0x0, 0x0, &(0x7f00000018c0)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x20000840) r5 = fsmount(r0, 0x1, 0x8) unlinkat(r5, &(0x7f0000000040)='./bus\x00', 0x200) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x8040, 0x0) ioctl$TCSETS(r6, 0x40045431, &(0x7f00000000c0)={0x0, 0xffffffff, 0x400001, 0x0, 0x90, "ff00050000000000000000e100e300"}) r7 = getpid() sched_setscheduler(r7, 0x1, &(0x7f0000001580)=0x7) syz_clone3(&(0x7f00000013c0)={0x81000000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)=0x0, {0x3d}, &(0x7f0000000300)=""/4096, 0x1000, &(0x7f0000001300)=""/93, &(0x7f0000001380)=[r7, 0xffffffffffffffff, 0xffffffffffffffff], 0x3, {r5}}, 0x58) sched_setattr(r8, &(0x7f0000001440)={0x38, 0x0, 0x12, 0x4005, 0x7, 0xd3c, 0x7, 0x10001, 0xe3, 0x4000}, 0x0) sched_getattr(r7, &(0x7f0000001900)={0x38}, 0xffffffffffffffad, 0x0) r9 = syz_open_pts(r6, 0x2001) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x18, 0x1404, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}}, 0x0) write(r9, &(0x7f00000001c0)="d5", 0xfffffedf) ioctl$TCSETSW2(r9, 0x402c542c, &(0x7f0000000200)={0x1, 0x72f3, 0x9, 0xaf, 0x36, "668787fe4150caf251a42dcbffe468fb06bc47", 0x7f, 0x2}) close_range(r4, 0xffffffffffffffff, 0x0) pipe2$watch_queue(0x0, 0x80) 12.653024121s ago: executing program 6 (id=1146): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000500)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f00000006c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000700)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x1, 0x4}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) socket$unix(0x1, 0x5, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, &(0x7f00000016c0), 0x56) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001700)={&(0x7f0000001740)=@xdp={0x2c, 0x60, 0x0, 0x3e}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001800)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 10.189282309s ago: executing program 4 (id=1152): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="23000000d584fbff0100d2f44e72ef2779"], 0x48) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setns(0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001200)=""/4112, 0x1010}], 0x1, 0x800, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000240)=@file={0x0, './file1\x00'}, 0x6e) listen(r4, 0x2) connect$unix(r3, &(0x7f00000002c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) sendmmsg$unix(r3, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000003c0)='A', 0x1}], 0x1, &(0x7f0000000400)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r4], 0x18, 0x40001}}], 0x47f, 0x0) accept(r4, 0x0, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMSET(r5, 0x5418, &(0x7f0000000000)=0x8001) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001480), 0x42003, 0x0) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) fcntl$setpipe(r6, 0x407, 0x2000000) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) sendfile(r7, r7, 0x0, 0x0) 9.844855246s ago: executing program 6 (id=1153): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8937, &(0x7f00000004c0)={'batadv_slave_1\x00', @random="010000201000"}) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x1c, 0x1, 0x4, 0x401, 0x0, 0x0, {0x5}, [@NFULA_CFG_CMD={0x5, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000835}, 0x2002889c) sendmsg$key(0xffffffffffffffff, &(0x7f0000000500)={0x4000000, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x2, 0xe, 0x0, 0x0, 0x2}, 0x10}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[@ANYBLOB="380000005600010000000000000000000700c6c9", @ANYRES32=r2, @ANYBLOB="200001"], 0x38}}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000e7cc6120c4108a81ad7d0102030109021b00010000c005090423000103000000090585"], 0x0) socket$inet6(0x10, 0x2, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY_LEVEL(r3, 0x0, 0x2, &(0x7f0000000200)=0x2, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000700)={0x8, 0x8b}, 0x0) syz_io_uring_setup(0x5b0f, 0x0, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000740)=0x7) r4 = getpid() mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setns(0xc9, 0x0) r5 = socket(0x2a, 0x2, 0x9) connect(r5, &(0x7f0000000780)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80) write$nbd(r5, 0x0, 0x14) sched_setscheduler(r4, 0x1, &(0x7f0000000800)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000880)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000900), 0x400000000000041, 0x0) recvmmsg(r6, &(0x7f0000000940), 0x10106, 0x2, 0x0) r8 = syz_open_dev$video(&(0x7f0000000980), 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r8, 0xc0145608, &(0x7f00000009c0)={0x1, 0x2, 0x2}) 8.017484294s ago: executing program 2 (id=1158): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) ioctl(r0, 0x3b8e, &(0x7f00000001c0)="10") write$FUSE_LSEEK(r1, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 7.9797872s ago: executing program 2 (id=1159): r0 = syz_open_dev$ndb(&(0x7f00000003c0), 0x0, 0x2080) ioctl$BLKDISCARD(r0, 0x1277, &(0x7f0000000400)=0xffffffffffffffff) (fail_nth: 1) 7.648999973s ago: executing program 2 (id=1161): r0 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r0, &(0x7f0000000240)={&(0x7f0000000280)={0xa, 0xa, 0x7, @mcast2}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000300)="671723d7c6012c", 0x7}, {&(0x7f0000000340)="9e91d91a92dc7c8f2bc24fbe79d9284d0c66c92c658bb539e2ffb332c99223a7df", 0x21}], 0x2}, 0x24008b88) (fail_nth: 4) 7.604291991s ago: executing program 3 (id=1162): socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$vim2m(0x0, 0x7fff, 0x2) r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f00000003c0), r1) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) mkdirat(0xffffff9c, &(0x7f0000000240)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x810004, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=ANY=[], 0x10b8}, 0xff48) r4 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r4, &(0x7f0000000540)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r7 = epoll_create1(0x80000) r8 = fcntl$dupfd(r6, 0x406, r7) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r8, &(0x7f0000000600)={0x30000000}) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r9, 0x84, 0x71, &(0x7f0000000180), 0x8) bind$inet(r9, &(0x7f00000001c0)={0x2, 0x4e22, @remote}, 0x10) sendmsg$inet_sctp(r9, &(0x7f0000000200)={&(0x7f00000002c0)=@in={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000400)=[{&(0x7f0000000440)="16", 0x1}], 0x1, 0x0, 0x0, 0xc0}, 0x10) close_range(r5, 0xffffffffffffffff, 0x0) r10 = openat(0xffffff9c, &(0x7f0000000340)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0) write(r10, &(0x7f0000000380)='zstd', 0x4) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000040)='mem\x00\xffEev\xf2r\xf1\x18\x1d\xb9\x00y_hug$\bo-\x03Q`]o\x8cr\x9d_etl\xf9\xdd\a\xad\\H\xe94\b,H\xbf', 0x0, 0x0) r11 = syz_open_procfs(0x0, &(0x7f0000000080)) sendfile(r11, r11, &(0x7f00000000c0)=0x7ffffffffffffffe, 0x7) 7.38689236s ago: executing program 2 (id=1163): r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000ffdbdf253b00000008000300", @ANYRES32=r3, @ANYBLOB="2e003300d0000000ffffffffffff08021100000050505050505020000004"], 0x4c}, 0x1, 0x0, 0x0, 0x20028805}, 0x24000846) write(r1, &(0x7f0000000180)='1 0 0', 0x5) landlock_restrict_self(r1, 0x17) capset(&(0x7f0000000200)={0x20080522}, &(0x7f0000000240)={0x200002, 0x200003, 0x801, 0x4, 0x7}) r5 = gettid() timer_create(0x0, &(0x7f0000000280)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f00000002c0)) socket(0x1a, 0x80805, 0x20000) r6 = syz_genetlink_get_family_id$fou(&(0x7f0000000300), r0) sendmsg$FOU_CMD_GET(r0, &(0x7f0000001fc0)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES64=r6, @ANYBLOB="015f2cbd7000fddbdf2503"], 0x1c}, 0x1, 0x0, 0x0, 0x20008001}, 0x4008840) 6.576679071s ago: executing program 3 (id=1164): socket$rds(0x15, 0x5, 0x0) prlimit64(0x0, 0x5, &(0x7f0000000100)={0x2000000000000008, 0x9}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) sendmsg$IPSET_CMD_DESTROY(r0, 0x0, 0x200480d0) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x8, 0x8b}, 0x0) r2 = gettid() timer_create(0x1, &(0x7f0000000300)={0x0, 0x21, 0x2, @tid=r2}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000340)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000380)=0x2) r4 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r4, 0x0, 0xd1, 0x0, 0x0) sched_setscheduler(r3, 0x2, &(0x7f00000003c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000d, 0x13, r1, 0x6641d000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000440)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000540), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000580), 0x10106, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x8910, 0x0) r7 = gettid() r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@newtaction={0xf0, 0x30, 0x1, 0x0, 0x25dfdbfc, {}, [{0xdc, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x2, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0xd170}}}]]}, {0x4}, {0xc}, {0xc}}}, @m_police={0x6c, 0x2, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x0, 0x0, 0x0, 0xfffffff9, {}, {}, 0x1}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xf0}}, 0x0) fcntl$setown(r5, 0x8, r7) r9 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r9, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000800)=@newqdisc={0x68, 0x14, 0x70b, 0x0, 0x25dfdbfd, {0x2, 0x0, 0x0, 0x0, {0xfff3}, {0x10, 0xc}, {0xa}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x10, 0xfc, 0x200, 0xc, 0x1, 0x0, 0x100005}}, {0x4}}, {{0x1c, 0x1, {0x1, 0xc, 0x8, 0xd, 0x2, 0xa, 0x2}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x40081}, 0x0) recvmmsg(r1, &(0x7f0000000880)=[{{0x0, 0xffffffffffffffa1, 0x0}, 0x3}], 0x1, 0x12002, 0x0) sendmsg$802154_raw(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)="c1e8d3e4dffd2aece18a02b031000000", 0x10}, 0x1, 0x0, 0x0, 0x40040c4}, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000040)={0x0, 0xffff, 0xfffffffd, 0x7fff}, &(0x7f00000000c0)=0x10) 6.553792149s ago: executing program 2 (id=1165): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000080)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd77c7000) r3 = syz_clone(0x200c8100, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000000540)=""/102392, 0x18ff8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x10) sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000019540)={&(0x7f0000019580)={0x10, 0x0, 0x0, 0x2000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48001}, 0x2000c801) shutdown(r5, 0x1) connect$inet6(r5, &(0x7f00000195c0)={0xa, 0x5e24, 0xfffffff2, @ipv4={'\x00', '\xff\xff', @remote}, 0x9}, 0x1c) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019600)={{}, 0x0, 0x0}, 0x20) write$binfmt_script(0xffffffffffffffff, &(0x7f0000019640), 0x3af4701e) r6 = dup(r0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/vmcoreinfo', 0x660603, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e23, 0xdb, @empty}}, 0xffb, 0x203, 0xffff18b6, 0x6, 0x330, 0x80000001, 0xdb}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x4c24, @empty}}, 0x6, 0x6}, 0x90) sendmsg$inet6(r6, &(0x7f0000000300)={&(0x7f0000000340)={0xa, 0x4e24, 0x8004, @ipv4={'\x00', '\xff\xff', @local}, 0x6}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000003c0)="f0", 0x1}], 0x1}, 0x40054) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000480)={0x0, @in={{0x2, 0x4e24, @local}}, 0xabb8, 0x67, 0xa4f, 0xc4, 0x28, 0xffffff89, 0xa9}, 0x9c) 6.533446469s ago: executing program 0 (id=1166): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x98) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/devices/usb2/power/level\x00', 0x2, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0xa) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r2, &(0x7f00000000c0)=0x1f00, 0x12) connect$rxrpc(r2, &(0x7f0000000200)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e20, @private=0xa010102}}, 0x24) connect$rxrpc(r1, &(0x7f0000000040)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e21, @broadcast}}, 0x24) write(r0, &(0x7f0000000340)="6f6ec6564281bdcb83fe76ee13669821561956d3e4ed48440a58993e262e69c0ff5a3f00300628171399fe7d2e9efd6e2665f99292c1159f0150d34c3d769caf2f3fe9a2d25ef7e121e4e31202c39ca7459a09bea34ae5e0066e3396c182ff38bea4fee7da4b67f353f7f9763bb7525a233bf8a9f8a3b64c1421d4c2672551a0ae5397e1d6227a748b97fd01d5323512e95a7120bb7e739b08ca9732d4e5ba6555432bfc106521469ba289974de295799fde468570212df18fc7007e07115581cb860200c558", 0x2) 5.770655217s ago: executing program 4 (id=1167): r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) r1 = socket(0x1e, 0x4, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f00000000c0)="0a000000010001", 0x7) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000100)={{{@in=@multicast1, @in=@multicast1, 0x0, 0x8001, 0x0, 0x3, 0xa, 0x0, 0x0, 0x4f}, {0x0, 0x0, 0x2, 0x800, 0x7, 0x0, 0x3}, {0x0, 0x8, 0xe6, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d4, 0x2b}, 0x0, @in=@private=0xa010100, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xf}}, 0xe8) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000200), 0x4) sendmsg$key(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) pipe(0x0) sendmsg$key(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x6, 0x17, &(0x7f0000000a00)=ANY=[@ANYBLOB="1800000000000000000000000000000218110000", @ANYBLOB="0000000000000000b70000000000008500000083000000bf0900000000000055090100000000009500000000000000181100"/60, @ANYRES32=r1, @ANYRES32=r5, @ANYRESOCT=r6, @ANYRESOCT], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2d, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000006c0)={r7, 0xfca804a0, 0xe, 0x0, &(0x7f0000000740)="0400000098d1db1ba91d3305a782", 0x0, 0x975, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x5}, 0x50) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000780), 0x40241, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f00000007c0)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000800)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) write$tun(r9, &(0x7f0000000840)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) recvmmsg(r8, &(0x7f0000000880)=[{{0x0, 0x0, 0x0}, 0xee}], 0x591, 0x10062, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) write$cgroup_int(r0, &(0x7f0000000040)=0x3, 0x12) 4.713148444s ago: executing program 2 (id=1168): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./debug\x00', 0x1ff) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x105001, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000200)={0x2020, 0x0, 0x0}, 0x2020) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000002240)={{{@in6=@mcast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}}}, &(0x7f0000002340)=0xe8) read$FUSE(0xffffffffffffffff, &(0x7f0000002380)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) openat$kvm(0xffffffffffffff9c, 0x0, 0x8401, 0x0) r4 = userfaultfd(0x80801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa08, &(0x7f0000000140)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0x1}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004480), 0x2, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) r7 = epoll_create1(0x80000) r8 = socket$unix(0x1, 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r8, &(0x7f0000004500)={0x40000006}) epoll_ctl$EPOLL_CTL_ADD(r7, 0x20, r6, &(0x7f0000004540)={0x10000014}) r9 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000004580), 0x1c3902, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f00000044c0)={0x2, 0x0, 0xffffe000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x2) ioctl$KVM_RUN(r10, 0xae80, 0x0) write$FUSE_CREATE_OPEN(r0, &(0x7f00000043c0)={0xa0, 0x0, r1, {{0x1, 0x1, 0x8001, 0x4, 0xfff, 0x849, {0x3, 0x2, 0x1000, 0x3, 0x8, 0x6, 0xc, 0x57c8, 0xd1c5, 0x8000, 0xffffffff, r2, r3, 0x5, 0x17}}, {0x0, 0x10}}}, 0xa0) mount(0x0, &(0x7f0000000000)='./debug/tracing/events/kvm/enable\x00', &(0x7f0000000180)='debugfs\x00', 0x1000000, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/tracing/events/kvm/enable\x00', 0x80201, 0x8) 4.708901386s ago: executing program 3 (id=1169): getsockopt$inet_sctp_SCTP_PLPMTUD_PROBE_INTERVAL(0xffffffffffffffff, 0x84, 0x85, &(0x7f0000000000)={0x2, @in={{0x2, 0x4e24, @multicast2}}, 0x7}, &(0x7f00000000c0)=0x90) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000100)={r0, 0x1, 0xc}, 0x10) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e22, 0x200, @mcast2, 0x8}, 0x1c) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='blkio.bfq.io_serviced_recursive\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_ASCONF_SUPPORTED(r1, 0x84, 0x80, &(0x7f00000001c0)={r0}, 0x8) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000200)=0xfffffffb, 0x4) (async) setsockopt$inet_sctp_SCTP_ASCONF_SUPPORTED(r1, 0x84, 0x80, &(0x7f0000000240)={r0, 0x9}, 0x8) (async) ioctl$DVB_DVR_DMX_EXPBUF(r1, 0xc00c6f3e, &(0x7f0000000280)={0x3dad, 0x0, r1}) ioctl$DVB_DVR_DMX_QUERYBUF(r2, 0xc0186f3d, &(0x7f00000002c0)={0x3ff, 0x4cd, 0x5078, 0x2, 0x12, 0x2}) (async) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS_V2(r2, 0x84, 0x25, &(0x7f0000000300)={r0, @in={{0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x200, 0xff}, &(0x7f00000003c0)=0x90) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000000400)={r3, @in={{0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x84) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000580)={'syztnl1\x00', &(0x7f00000004c0)={'ip_vti0\x00', 0x0, 0x8, 0x1, 0x8, 0x39b, {{0x28, 0x4, 0x0, 0x3f, 0xa0, 0x66, 0x0, 0x0, 0x2f, 0x0, @broadcast, @loopback, {[@end, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0x7, 0x80, [@multicast2]}, @generic={0x86, 0x5, "03093f"}, @generic={0x82, 0xb, "b1f2ff6dfe411e10e0"}, @ssrr={0x89, 0xf, 0x28, [@initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010100, @multicast1]}, @cipso={0x86, 0x22, 0x2, [{0x7, 0xf, "fd19cef391d9de16c0f2a1e32d"}, {0x0, 0xd, "625188eca52e00939e45ca"}]}, @cipso={0x86, 0x3d, 0x0, [{0x5, 0xd, "4eed91d3afbf78a035ddac"}, {0x1, 0xb, "d193cc1c0a98bd6a8a"}, {0x3, 0x12, "e482ad72b3aef77954a1bd6c0f5014b4"}, {0x1, 0xd, "3a50dc35aef3267a190074"}]}]}}}}}) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f00000005c0)={@broadcast, @loopback, r4}, 0xc) (async, rerun: 64) r5 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) (rerun: 64) bind$inet6(r5, &(0x7f0000000640)={0xa, 0x4e23, 0xfffffffb, @private2, 0xc}, 0x1c) (async) setsockopt$inet_sctp_SCTP_REMOTE_UDP_ENCAPS_PORT(r1, 0x84, 0x84, &(0x7f0000000680)={r3, @in={{0x2, 0x4e24, @multicast2}}, 0x4e22}, 0x90) setsockopt$MRT6_ADD_MFC(r2, 0x29, 0xcc, &(0x7f0000000740)={{0xa, 0x4e20, 0x3, @private0, 0x9}, {0xa, 0x4e20, 0x80, @private2, 0x10000}, 0x0, {[0x3f, 0x7fff, 0x9, 0x4, 0x161, 0x3, 0x80000000, 0xa]}}, 0x5c) (async) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000800), r2) sendmsg$MPTCP_PM_CMD_GET_ADDR(r2, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000840)={0xd0, r6, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x3}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x30, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x80}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x2c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0x4040040}, 0x4000) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), r2) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000a40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ABORT_SCAN(r7, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x1c, r8, 0x400, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x3, r9}, @void}}, ["", "", "", "", ""]}, 0x1c}}, 0x4) (async) ioctl$NS_GET_OWNER_UID(r1, 0xb704, &(0x7f0000000b40)=0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000b80)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x20}, @in6=@private0, 0x4e24, 0x4, 0x4e21, 0xfffe, 0xa, 0x0, 0x20, 0x2f, 0x0, r10}, {0x2, 0x2, 0x32, 0x3ff, 0x184f, 0x2, 0x0, 0xfffffffffffffffc}, {0x0, 0xf, 0xfb5a, 0x8}, 0x6, 0x6e6bb5, 0x0, 0x0, 0x3, 0x2}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x4d5, 0xff}, 0x2, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x3504, 0x0, 0x1, 0x9, 0x8f87, 0x6, 0x5}}, 0xe8) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000f80)={r2, 0xe0, &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000cc0)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x5, &(0x7f0000000d00)=[0x0, 0x0, 0x0], &(0x7f0000000d40)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xc5, &(0x7f0000000d80)=[{}], 0x8, 0x10, &(0x7f0000000dc0), &(0x7f0000000e00), 0x8, 0x9b, 0x8, 0x8, &(0x7f0000000e40)}}, 0x10) sendmsg$nl_route(r5, &(0x7f0000001040)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001000)={&(0x7f0000000fc0)=@mpls_getnetconf={0x34, 0x52, 0x200, 0x70bd27, 0x25dfdbfc, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r11}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x40804}, 0x4000015) (async) r12 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000001080)={r1, r5, 0x12, 0x0, @void}, 0x10) ioctl$LOOP_CHANGE_FD(r5, 0x4c06, r12) (async) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f00000016c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001680)={&(0x7f0000001200)={0x47c, 0x0, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [{{0x8, 0x1, r4}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r11}, {0xf0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xfff}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r4}}, {0x8}}}]}}, {{0x8, 0x1, r11}, {0x26c, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x7c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x4c, 0x4, [{0x401, 0x1, 0x7, 0x144}, {0x0, 0x4, 0x9, 0x71a}, {0xe6c, 0x7, 0x3, 0x5e7}, {0x402c, 0x9, 0xfd, 0x8}, {0x5, 0x0, 0xfe}, {0xfff9, 0x7, 0x7, 0x5}, {0xcec, 0x81, 0x1, 0x5}, {0xec, 0x6, 0xf, 0x44}, {0xfc01, 0x4, 0x5, 0x2}]}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x10000}}, {0x8, 0x6, r11}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r4}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r11}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r11}}}]}}, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r11}}}]}}]}, 0x47c}, 0x1, 0x0, 0x0, 0x880}, 0x4008001) 4.633387629s ago: executing program 0 (id=1170): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x5, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000040)={0x11, 0x1, 0x0, "ad2896b02ca8b044d00dc81345c4b935bab32cecd875596364ab192cb8b873aa"}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0xa82, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) chdir(&(0x7f0000000100)='./file0\x00') setresuid(0x0, 0xee00, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) 3.748789559s ago: executing program 4 (id=1171): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="23000000d584fbff0100d2f44e72ef2779"], 0x48) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setns(0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001200)=""/4112, 0x1010}], 0x1, 0x800, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000240)=@file={0x0, './file1\x00'}, 0x6e) listen(r4, 0x2) connect$unix(r3, &(0x7f00000002c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) sendmmsg$unix(r3, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000003c0)='A', 0x1}], 0x1, &(0x7f0000000400)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r4], 0x18, 0x40001}}], 0x47f, 0x0) accept(r4, 0x0, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r5, 0x5407, &(0x7f0000000100)={0x800, 0x7, 0x80, 0x40e0, 0xa, '\x00\x00\x00\x00\x00 \x00'}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001480), 0x42003, 0x0) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) fcntl$setpipe(r6, 0x407, 0x2000000) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) sendfile(r7, r7, 0x0, 0x0) 3.378283042s ago: executing program 0 (id=1172): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) ioctl$XFS_IOC_SCRUBV_METADATA(0xffffffffffffffff, 0xc0285840, &(0x7f0000000040)={0x81, 0x0, 0x5, 0x0, 0xd, 0x3, 0x0, &(0x7f0000000000)=[{0xe, 0x1ff}, {0x4, 0x1ff, 0x8}, {0xc, 0xfe, 0x4}]}) (async) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) (async) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000100)={0x2, 0x4e21, @empty}, 0x10) (async) r2 = openat$cgroup_devices(r0, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) write(r2, &(0x7f0000000080)="360d000000000000565f5048fd8ef7e96c740c2dc85463", 0x17) 3.243075849s ago: executing program 3 (id=1173): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x1f, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="600000000206050a00000000000000000000000005000400000000000900020073797a3200000000140007800800064000006a000800084000005fdc050005000a000000050001000600000011000300686173683a6970"], 0x60}}, 0x0) 2.557066526s ago: executing program 3 (id=1174): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$sock(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)}, 0x2204c040) 2.542446282s ago: executing program 0 (id=1175): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000001ec0), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f0000001fc0)={0x0, 0xf0, &(0x7f0000002000)={&(0x7f0000002040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="015f2cbd7000fddbdf2503"], 0x1c}, 0x1, 0x0, 0x0, 0x20008001}, 0x4008840) 2.413105138s ago: executing program 4 (id=1176): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = eventfd2(0x0, 0x0) ppoll(&(0x7f00000000c0)=[{r2, 0xa424}], 0x1, 0x0, 0x0, 0x0) (async) ppoll(&(0x7f00000000c0)=[{r2, 0xa424}], 0x1, 0x0, 0x0, 0x0) syz_emit_ethernet(0x10f, &(0x7f00000001c0)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa86dd606410a700d93c00fc020000000000000000000000000001ff02000000000000000000000000000129"], 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42}, 0x10) sendmsg$tipc(r1, &(0x7f0000000040)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x43, 0x2}}}, 0x10, 0x0}, 0x80) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000010000100000000000000000002000a0020000000000a0100000000000000000002000a000900010073797a300000000060000000120a0100000000000000000002000a000900010073797a30000000000900020073797a30000000000800030000000009280004800500020006000000060003001f900000080004"], 0xbc}, 0x1, 0x0, 0x0, 0x40481c0}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000010000100000000000000000002000a0020000000000a0100000000000000000002000a000900010073797a300000000060000000120a0100000000000000000002000a000900010073797a30000000000900020073797a30000000000800030000000009280004800500020006000000060003001f900000080004"], 0xbc}, 0x1, 0x0, 0x0, 0x40481c0}, 0x0) 2.237162459s ago: executing program 3 (id=1177): syz_usb_connect(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}]}}]}}]}}, 0x0) (async) syz_usb_connect$cdc_ncm(0x2, 0x82, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x70, 0x2, 0x1, 0x4, 0x20, 0x5, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x8, 0x24, 0x6, 0x0, 0x1, "10b572"}, {0x5, 0x24, 0x0, 0xb3}, {0xd, 0x24, 0xf, 0x1, 0xe119, 0xf3, 0xfff9, 0xf4}, {0x6, 0x24, 0x1a, 0xf}, [@call_mgmt={0x5, 0x24, 0x1, 0x3}, @country_functional={0xc, 0x24, 0x7, 0x7, 0x3ff, [0x0, 0x8, 0x6]}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0xf9, 0x4, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0x5, 0x0, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0xc0, 0xff, 0x1}}}}}}}]}}, &(0x7f0000000340)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x251, 0x2, 0x3, 0x6, 0xff, 0x40}, 0x85, &(0x7f0000000180)={0x5, 0xf, 0x85, 0x3, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x6, 0x4, 0x0, 0x80}, @generic={0x73, 0x10, 0xec506460f227ef47, "97e17e90a5d7dbcb3924fb0dcf2dff48a82d57caeb4e20d70be18e6055d109b23f02cba22f802f9a525f3d4069784cc2f13c71390fad532453e59da78c985d606a1b5e6e71adb9e6d4db4c95ea83fe455a721b3233f2a4a4772ab68ac0d15309968090448aeb333cfb568389a864adfa"}]}, 0x3, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x83e}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x43e}}, {0x66, &(0x7f00000002c0)=@string={0x66, 0x3, "1a593d200ca6be5926a89c8222f95d435af69583ac9b3b972c9d408202ee5c115e07a2a2d88db795358526710e39c583c8c82743d331cc7cf3641bd911e82b7681c0217a249007723e417068bb5801599c8f357a4ed453ec0a115eb99828e9aa5623054c"}}]}) 2.20581565s ago: executing program 4 (id=1178): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000080)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd77c7000) r3 = syz_clone(0x200c8100, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000000540)=""/102392, 0x18ff8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x10) sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000019540)={&(0x7f0000019580)={0x10, 0x0, 0x0, 0x2000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48001}, 0x2000c801) shutdown(r5, 0x1) connect$inet6(r5, &(0x7f00000195c0)={0xa, 0x5e24, 0xfffffff2, @ipv4={'\x00', '\xff\xff', @remote}, 0x9}, 0x1c) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019600)={{}, 0x0, 0x0}, 0x20) write$binfmt_script(0xffffffffffffffff, &(0x7f0000019640), 0x3af4701e) r6 = dup(r0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/vmcoreinfo', 0x660603, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e23, 0xdb, @empty}}, 0xffb, 0x203, 0xffff18b6, 0x6, 0x330, 0x80000001, 0xdb}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x4c24, @empty}}, 0x6, 0x6}, 0x90) sendmsg$inet6(r6, &(0x7f0000000300)={&(0x7f0000000340)={0xa, 0x4e24, 0x8004, @ipv4={'\x00', '\xff\xff', @local}, 0x6}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000003c0)="f0", 0x1}], 0x1}, 0x40054) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000480)={0x0, @in={{0x2, 0x4e24, @local}}, 0xabb8, 0x67, 0xa4f, 0xc4, 0x28, 0xffffff89, 0xa9}, 0x9c) 2.202617552s ago: executing program 6 (id=1179): r0 = socket$kcm(0x1e, 0x4, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x16, 0xc, &(0x7f0000000340)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x24, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x2000002, 0x3a, 0x0, &(0x7f0000000440)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'hsr0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r3, @ANYBLOB="0500060001000000050007000000000005000300df00000008000200", @ANYRES32=r2], 0x68}}, 0x0) setsockopt$sock_attach_bpf(r0, 0x10f, 0x87, &(0x7f0000000240)=r1, 0x4) socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f00000000c0), 0xffffffffffffffd3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./debug/split_huge_pages\x00', 0x1, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) r6 = fsopen(&(0x7f0000000140)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000180)='crush_location\x00', &(0x7f00000001c0)='rack:foo\x00', 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000540), 0x100, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000580)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000fea000/0x1000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) r7 = io_uring_setup(0x786b, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = socket$kcm(0x23, 0x5, 0x0) listen(r8, 0x8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x24004045) r9 = io_uring_setup(0x197b, &(0x7f0000000640)={0x0, 0xca72, 0x1cc90, 0x2, 0x20002f8, 0x0, r7}) r10 = socket$inet(0x2, 0x80001, 0x84) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8890}, 0x20004450) getsockopt$inet_sctp_SCTP_MAX_BURST(r10, 0x84, 0x14, &(0x7f0000000700)=@assoc_value, &(0x7f0000000740)=0x8) fchmodat(0xffffffffffffff9c, &(0x7f0000000780)='.\x00', 0xfffffffb) io_uring_enter(r9, 0x2219, 0x7721, 0x16, 0x0, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) write(r4, &(0x7f0000000080)='/,0x-', 0x5) 2.065100882s ago: executing program 0 (id=1180): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000180), 0x651, 0x0) recvmmsg(r1, &(0x7f00000001c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000280), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc2604111, &(0x7f00000002c0)={0x0, [[0xffffffff, 0xffffffdf, 0xffffffff, 0xffffffff, 0xffffffff, 0x719e, 0xffffffff, 0x3], [0xfffffbfc, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x2, 0xffffffff], [0xffdfffff, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]], '\x00', [{0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x2, 0xffffffff}, {0x0, 0xfffffffb}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x10000, 0xffffffff}]}) (fail_nth: 4) 1.075769105s ago: executing program 4 (id=1181): r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) r1 = socket(0x1e, 0x4, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f00000000c0)="0a000000010001", 0x7) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000100)={{{@in=@multicast1, @in=@multicast1, 0x0, 0x8001, 0x0, 0x3, 0xa, 0x0, 0x0, 0x4f}, {0x0, 0x0, 0x2, 0x800, 0x7, 0x0, 0x3}, {0x0, 0x8, 0xe6, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d4, 0x2b}, 0x0, @in=@private=0xa010100, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xf}}, 0xe8) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000200), 0x4) sendmsg$key(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) pipe(0x0) sendmsg$key(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x6, 0x17, &(0x7f0000000a00)=ANY=[@ANYBLOB="1800000000000000000000000000000218110000", @ANYBLOB="0000000000000000b70000000000008500000083000000bf0900000000000055090100000000009500000000000000181100"/60, @ANYRES32=r1, @ANYRES32=r5, @ANYRESOCT=r6, @ANYRESOCT], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2d, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000006c0)={r7, 0xfca804a0, 0xe, 0x0, &(0x7f0000000740)="0400000098d1db1ba91d3305a782", 0x0, 0x975, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x5}, 0x50) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000780), 0x40241, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f00000007c0)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000800)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) write$tun(r9, &(0x7f0000000840)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) recvmmsg(r8, &(0x7f0000000880)=[{{0x0, 0x0, 0x0}, 0xee}], 0x591, 0x10062, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) write$cgroup_int(r0, &(0x7f0000000040)=0x3, 0x12) 826.506887ms ago: executing program 6 (id=1182): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x5, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000040)={0x11, 0x1, 0x0, "ad2896b02ca8b044d00dc81345c4b935bab32cecd875596364ab192cb8b873aa"}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0xa82, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) chdir(&(0x7f0000000100)='./file0\x00') setresuid(0x0, 0xee00, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) 0s ago: executing program 0 (id=1183): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0xf00, 0x0, &(0x7f0000000980), &(0x7f00000009c0), &(0x7f0000000a00)) syz_open_dev$vbi(&(0x7f0000000280), 0x1, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x3, &(0x7f0000000480)=ANY=[], &(0x7f0000000640)='GPL\x00', 0x2, 0xba, &(0x7f0000000680)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000740)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000780)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000007c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000800)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000008c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000940), 0x400000000000041, 0x0) ioctl$TIOCGICOUNT(0xffffffffffffffff, 0x545d, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000ac0)=0x2) recvmmsg(r2, &(0x7f0000000b00), 0x10106, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000b40)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000000bc0)={0x0, 0x0, 0x0, &(0x7f0000000c00)}}}) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, 0x0, 0x8000) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000c40)={'netdevsim0\x00', &(0x7f0000000c80)=@ethtool_regs={0x4, 0x1002, 0x37, "72f46f341bda97077776dbc79e4fe814968eb85a7bad7e42a9d85d5eda493af416012e6008de03887422d5e8d80d7747341e2b11ab2874"}}) bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) mknodat(0xffffffffffffff9c, &(0x7f0000000e40)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000e80)='./file2\x00', 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000ec0), 0xffffffffffffffff) kernel console output (not intermixed with test programs): 0000001 [ 742.737250][ T9452] R13: 00007fb414626218 R14: 00007fb414626180 R15: 00007ffe7fcd9fb8 [ 742.737280][ T9452] [ 743.578410][ T9442] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 744.471896][ T5641] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 744.484052][ T5641] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 744.487163][ T5641] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 744.499536][ T5641] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 744.501752][ T5641] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 744.680890][ T30] audit: type=1400 audit(1792354125.695:571): avc: denied { mounton } for pid=9468 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 746.359244][ T30] audit: type=1400 audit(1792354127.266:572): avc: denied { lock } for pid=9483 comm="syz.4.897" path="socket:[25464]" dev="sockfs" ino=25464 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 746.366676][ T30] audit: type=1400 audit(1792354127.266:573): avc: denied { map } for pid=9483 comm="syz.4.897" path="socket:[25469]" dev="sockfs" ino=25469 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 746.366847][ T30] audit: type=1400 audit(1792354127.266:574): avc: denied { read } for pid=9483 comm="syz.4.897" path="socket:[25469]" dev="sockfs" ino=25469 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 746.405417][ T5753] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 746.551786][ T9489] FAULT_INJECTION: forcing a failure. [ 746.551786][ T9489] name failslab, interval 1, probability 0, space 0, times 0 [ 746.551820][ T9489] CPU: 1 UID: 0 PID: 9489 Comm: syz.4.899 Not tainted syzkaller #0 PREEMPT(full) [ 746.551846][ T9489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 746.551860][ T9489] Call Trace: [ 746.551868][ T9489] [ 746.551877][ T9489] dump_stack_lvl+0x100/0x190 [ 746.551922][ T9489] should_fail_ex.cold+0x5/0xa [ 746.551955][ T9489] should_failslab+0xc2/0x120 [ 746.551990][ T9489] __kmalloc_noprof+0xfc/0x840 [ 746.552019][ T9489] ? __pfx_from_kuid+0x10/0x10 [ 746.552046][ T9489] ? tomoyo_init_log+0x1224/0x20c0 [ 746.552089][ T9489] tomoyo_init_log+0x1224/0x20c0 [ 746.552127][ T9489] ? vsnprintf+0x4c5/0x1300 [ 746.552169][ T9489] ? __pfx_tomoyo_init_log+0x10/0x10 [ 746.552201][ T9489] ? tomoyo_profile+0x47/0x60 [ 746.552224][ T9489] ? tomoyo_domain_quota_is_ok+0x367/0x580 [ 746.552256][ T9489] tomoyo_supervisor+0x506/0x1340 [ 746.552286][ T9489] ? __pfx_tomoyo_supervisor+0x10/0x10 [ 746.552326][ T9489] ? tomoyo_realpath_from_path+0x19c/0x690 [ 746.552353][ T9489] ? tomoyo_check_path_number_acl+0x1e6/0x2f0 [ 746.552395][ T9489] tomoyo_path_number_perm+0x445/0x580 [ 746.552428][ T9489] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 746.552462][ T9489] ? __pfx_futex_wait+0x10/0x10 [ 746.552495][ T9489] ? __lock_acquire+0x5c0/0x1f40 [ 746.552536][ T9489] ? __fget_files+0x34/0x3d0 [ 746.552570][ T9489] ? find_held_lock+0x2b/0x80 [ 746.552600][ T9489] ? hook_file_ioctl_common+0x140/0x440 [ 746.552631][ T9489] ? __fget_files+0x21f/0x3d0 [ 746.552667][ T9489] security_file_ioctl+0xd3/0x230 [ 746.552701][ T9489] __x64_sys_ioctl+0xb7/0x210 [ 746.552732][ T9489] do_syscall_64+0x123/0x790 [ 746.552768][ T9489] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 746.552790][ T9489] RIP: 0033:0x7f79d6f9e559 [ 746.552809][ T9489] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 746.552831][ T9489] RSP: 002b:00007f79d7ddb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 746.552854][ T9489] RAX: ffffffffffffffda RBX: 00007f79d7225fa0 RCX: 00007f79d6f9e559 [ 746.552870][ T9489] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 000000000000000a [ 746.552883][ T9489] RBP: 00007f79d7035ab8 R08: 0000000000000000 R09: 0000000000000000 [ 746.552898][ T9489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 746.552911][ T9489] R13: 00007f79d7226038 R14: 00007f79d7225fa0 R15: 00007fff22691fe8 [ 746.552953][ T9489] [ 746.581662][ T5753] usb 4-1: Using ep0 maxpacket: 32 [ 746.583927][ T5753] usb 4-1: unable to get BOS descriptor or descriptor too short [ 746.583969][ T5753] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 746.586503][ T5753] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 746.586528][ T5753] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 746.586549][ T5753] usb 4-1: config 14 has no interface number 0 [ 746.586567][ T5753] usb 4-1: config 14 has no interface number 1 [ 746.586620][ T5753] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 746.586644][ T5753] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 746.586669][ T5753] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 746.586696][ T5753] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 746.586724][ T5753] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 746.586752][ T5753] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 746.586780][ T5753] usb 4-1: config 14 interface 57 has no altsetting 0 [ 746.586798][ T5753] usb 4-1: config 14 interface 228 has no altsetting 0 [ 746.593405][ T5753] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 746.593438][ T5753] usb 4-1: Product: syz [ 746.593452][ T5753] usb 4-1: Manufacturer: syz [ 746.593466][ T5753] usb 4-1: SerialNumber: syz [ 746.776212][ T9489] netlink: 28 bytes leftover after parsing attributes in process `syz.4.899'. [ 746.799108][ T4916] Bluetooth: hci5: command tx timeout [ 747.099439][ T9477] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5639] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[9477] [ 747.598447][ T5753] legousbtower 4-1:14.57: interrupt endpoints not found [ 747.995669][ T5753] legousbtower 4-1:14.228: get version request failed: -71 [ 747.995822][ T5753] legousbtower 4-1:14.228: probe with driver legousbtower failed with error -71 [ 748.033871][ T9502] netlink: 20 bytes leftover after parsing attributes in process `syz.2.900'. [ 748.056075][ T5753] usb 4-1: USB disconnect, device number 31 [ 748.333844][ T9507] netlink: 'syz.4.901': attribute type 4 has an invalid length. [ 748.425716][ T9508] netlink: 'syz.4.901': attribute type 4 has an invalid length. [ 749.018951][ T4916] Bluetooth: hci5: command tx timeout [ 749.620229][ T9515] netlink: 12 bytes leftover after parsing attributes in process `syz.0.898'. [ 750.195051][ T5778] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 750.380240][ T5778] usb 4-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice=29.00 [ 750.408304][ T5778] usb 4-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 750.408694][ T5778] usb 4-1: Product: syz [ 750.521378][ T5778] ftdi_sio 4-1:5.0: FTDI USB Serial Device converter detected [ 750.566174][ T5778] usb 4-1: Detected FT4233HP [ 750.705100][ T9515] veth1_macvtap: left promiscuous mode [ 750.811391][ T9518] netlink: 20 bytes leftover after parsing attributes in process `syz.3.902'. [ 750.829931][ T5778] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 750.835370][ T5778] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 750.855090][ T5778] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 750.869666][ T5778] usb 4-1: USB disconnect, device number 32 [ 750.887896][ T5778] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 750.888686][ T5778] ftdi_sio 4-1:5.0: device disconnected [ 751.204108][ T9530] netlink: 12 bytes leftover after parsing attributes in process `syz.4.904'. [ 751.204132][ T9530] netlink: 12 bytes leftover after parsing attributes in process `syz.4.904'. [ 751.242432][ T4916] Bluetooth: hci5: command tx timeout [ 751.560625][ T9468] bridge0: port 1(bridge_slave_0) entered blocking state [ 751.560710][ T9468] bridge0: port 1(bridge_slave_0) entered disabled state [ 751.560802][ T9468] bridge_slave_0: entered allmulticast mode [ 751.566949][ T9468] bridge_slave_0: entered promiscuous mode [ 751.585241][ T9468] bridge0: port 2(bridge_slave_1) entered blocking state [ 751.587425][ T9468] bridge0: port 2(bridge_slave_1) entered disabled state [ 751.587644][ T9468] bridge_slave_1: entered allmulticast mode [ 752.198516][ T9468] bridge_slave_1: entered promiscuous mode [ 753.466821][ T4916] Bluetooth: hci5: command tx timeout [ 753.559242][ T9468] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 753.568519][ T9468] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 754.496260][ T9548] ceph: No mds server is up or the cluster is laggy [ 754.539161][ T5795] libceph: connect (1)[c::]:6789 error -101 [ 754.539434][ T5795] libceph: mon0 (1)[c::]:6789 connect error [ 754.652986][ T9468] team0: Port device team_slave_0 added [ 754.673544][ T9468] team0: Port device team_slave_1 added [ 754.847776][ T9468] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 754.847801][ T9468] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 754.847826][ T9468] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 754.855355][ T9468] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 754.855365][ T9468] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 754.855380][ T9468] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 754.934975][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 754.935029][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 755.001630][ T9468] hsr_slave_0: entered promiscuous mode [ 755.002182][ T9468] hsr_slave_1: entered promiscuous mode [ 755.002664][ T9468] debugfs: 'hsr0' already exists in 'hsr' [ 755.002694][ T9468] Cannot create hsr debugfs directory [ 755.101759][ T29] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 755.267453][ T29] usb 1-1: Using ep0 maxpacket: 32 [ 755.269562][ T29] usb 1-1: unable to get BOS descriptor or descriptor too short [ 755.269606][ T29] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 755.270689][ T29] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 755.270716][ T29] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 755.270739][ T29] usb 1-1: config 14 has no interface number 0 [ 755.270756][ T29] usb 1-1: config 14 has no interface number 1 [ 755.270812][ T29] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 755.270837][ T29] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 755.270864][ T29] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 755.270892][ T29] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 755.270920][ T29] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 755.270948][ T29] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 755.270975][ T29] usb 1-1: config 14 interface 57 has no altsetting 0 [ 755.271016][ T29] usb 1-1: config 14 interface 228 has no altsetting 0 [ 755.412715][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 755.412743][ T29] usb 1-1: Product: syz [ 755.412759][ T29] usb 1-1: Manufacturer: syz [ 755.412774][ T29] usb 1-1: SerialNumber: syz [ 756.037249][ T9562] FAULT_INJECTION: forcing a failure. [ 756.037249][ T9562] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 756.037398][ T9562] CPU: 0 UID: 0 PID: 9562 Comm: syz.2.913 Not tainted syzkaller #0 PREEMPT(full) [ 756.037425][ T9562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 756.037438][ T9562] Call Trace: [ 756.037446][ T9562] [ 756.037455][ T9562] dump_stack_lvl+0x100/0x190 [ 756.037492][ T9562] should_fail_ex.cold+0x5/0xa [ 756.037519][ T9562] ? prepare_alloc_pages+0x16d/0x5b0 [ 756.037553][ T9562] should_fail_alloc_page+0xeb/0x140 [ 756.037588][ T9562] prepare_alloc_pages+0x1f0/0x5b0 [ 756.037625][ T9562] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 756.037653][ T9562] ? __pfx_get_page_from_freelist+0x10/0x10 [ 756.037681][ T9562] ? prepare_alloc_pages+0x1f0/0x5b0 [ 756.037713][ T9562] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 756.037745][ T9562] ? rcu_is_watching+0x13/0xc0 [ 756.037778][ T9562] ? __alloc_frozen_pages_noprof+0x56b/0x3300 [ 756.037809][ T9562] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 756.037837][ T9562] ? find_held_lock+0x2b/0x80 [ 756.037869][ T9562] ? is_bpf_text_address+0x8a/0x1a0 [ 756.037901][ T9562] ? is_bpf_text_address+0x8a/0x1a0 [ 756.037932][ T9562] ? bpf_ksym_find+0x128/0x1c0 [ 756.037954][ T9562] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 756.037979][ T9562] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 756.038005][ T9562] ? is_bpf_text_address+0x94/0x1a0 [ 756.038038][ T9562] ? kvm_sched_clock_read+0x11/0x20 [ 756.038067][ T9562] ? __kernel_text_address+0xd/0x30 [ 756.038117][ T9562] alloc_pages_bulk_noprof+0x5e1/0x13c0 [ 756.038144][ T9562] ? __schedule+0x126b/0x6920 [ 756.038177][ T9562] ? policy_nodemask+0xed/0x4f0 [ 756.038212][ T9562] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 756.038256][ T9562] __kasan_populate_vmalloc+0xf0/0x210 [ 756.038292][ T9562] alloc_vmap_area+0x95d/0x2bb0 [ 756.038330][ T9562] ? kasan_save_track+0x14/0x30 [ 756.038359][ T9562] ? __kasan_kmalloc+0xaa/0xb0 [ 756.038387][ T9562] ? __pfx_alloc_vmap_area+0x10/0x10 [ 756.038419][ T9562] ? __get_vm_area_node+0x124/0x350 [ 756.038453][ T9562] __get_vm_area_node+0x1ed/0x350 [ 756.038490][ T9562] __vmalloc_node_range_noprof+0x268/0x1420 [ 756.038525][ T9562] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 756.038556][ T9562] ? __lock_acquire+0x5c0/0x1f40 [ 756.038588][ T9562] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 756.038617][ T9562] ? lock_acquire+0x1d1/0x380 [ 756.038644][ T9562] ? find_held_lock+0x2b/0x80 [ 756.038676][ T9562] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 756.038709][ T9562] ? avc_has_perm_noaudit+0x11e/0x470 [ 756.038741][ T9562] ? avc_has_perm_noaudit+0x145/0x470 [ 756.038767][ T9562] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 756.038796][ T9562] __vmalloc_node_noprof+0xad/0xf0 [ 756.038829][ T9562] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 756.038863][ T9562] __vmalloc_noprof+0xa3/0x120 [ 756.038895][ T9562] ? __pfx___vmalloc_noprof+0x10/0x10 [ 756.038931][ T9562] ? rcu_is_watching+0x13/0xc0 [ 756.038962][ T9562] ? cap_capable+0x107/0x430 [ 756.038992][ T9562] bpf_prog_alloc_no_stats+0x59/0x690 [ 756.039021][ T9562] ? security_capable+0x80/0x260 [ 756.039050][ T9562] bpf_prog_alloc+0x3b/0x200 [ 756.039084][ T9562] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 756.039115][ T9562] bpf_prog_load+0x49e/0x2ab0 [ 756.039154][ T9562] ? __pfx_bpf_prog_load+0x10/0x10 [ 756.039212][ T9562] __sys_bpf+0x1f46/0x4a30 [ 756.039246][ T9562] ? __pfx___sys_bpf+0x10/0x10 [ 756.039269][ T9562] ? find_held_lock+0x2b/0x80 [ 756.039300][ T9562] ? get_pid_task+0xfc/0x250 [ 756.039328][ T9562] ? get_pid_task+0xfc/0x250 [ 756.039367][ T9562] ? find_held_lock+0x2b/0x80 [ 756.039406][ T9562] ? rcu_read_lock_any_held+0x6a/0x90 [ 756.039426][ T9562] ? find_held_lock+0x2b/0x80 [ 756.039457][ T9562] ? ksys_write+0x190/0x250 [ 756.039482][ T9562] ? ksys_write+0x190/0x250 [ 756.039508][ T9562] ? lock_acquire+0x1d1/0x380 [ 756.039555][ T9562] ? fput+0x7c/0x100 [ 756.039586][ T9562] ? ksys_write+0x1ac/0x250 [ 756.039616][ T9562] ? __x64_sys_bpf+0xce/0x140 [ 756.039639][ T9562] __x64_sys_bpf+0xce/0x140 [ 756.039665][ T9562] ? do_syscall_64+0xae/0x790 [ 756.039698][ T9562] do_syscall_64+0x123/0x790 [ 756.039732][ T9562] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.039755][ T9562] RIP: 0033:0x7fb41439e559 [ 756.039774][ T9562] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 756.039795][ T9562] RSP: 002b:00007fb4152c9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 756.039817][ T9562] RAX: ffffffffffffffda RBX: 00007fb414626090 RCX: 00007fb41439e559 [ 756.039831][ T9562] RDX: 0000000000000094 RSI: 0000200000000440 RDI: 0000000000000005 [ 756.039844][ T9562] RBP: 00007fb4152c9090 R08: 0000000000000000 R09: 0000000000000000 [ 756.039857][ T9562] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 756.039870][ T9562] R13: 00007fb414626128 R14: 00007fb414626090 R15: 00007ffe7fcd9fb8 [ 756.039900][ T9562] [ 756.040280][ T9562] syz.2.913: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 756.040575][ T9562] CPU: 0 UID: 0 PID: 9562 Comm: syz.2.913 Not tainted syzkaller #0 PREEMPT(full) [ 756.040599][ T9562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 756.040611][ T9562] Call Trace: [ 756.040619][ T9562] [ 756.040626][ T9562] dump_stack_lvl+0x100/0x190 [ 756.040661][ T9562] warn_alloc.cold+0x9e/0xb2 [ 756.040687][ T9562] ? __pfx_warn_alloc+0x10/0x10 [ 756.040710][ T9562] ? lockdep_hardirqs_on+0x7d/0x110 [ 756.040744][ T9562] ? __get_vm_area_node+0x2f0/0x350 [ 756.040781][ T9562] ? __get_vm_area_node+0x22b/0x350 [ 756.040817][ T9562] __vmalloc_node_range_noprof+0xfa2/0x1420 [ 756.040854][ T9562] ? __lock_acquire+0x5c0/0x1f40 [ 756.040886][ T9562] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 756.040917][ T9562] ? lock_acquire+0x1d1/0x380 [ 756.040944][ T9562] ? find_held_lock+0x2b/0x80 [ 756.040976][ T9562] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 756.041009][ T9562] ? avc_has_perm_noaudit+0x11e/0x470 [ 756.041040][ T9562] ? avc_has_perm_noaudit+0x145/0x470 [ 756.041065][ T9562] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 756.041102][ T9562] __vmalloc_node_noprof+0xad/0xf0 [ 756.041135][ T9562] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 756.041168][ T9562] __vmalloc_noprof+0xa3/0x120 [ 756.041201][ T9562] ? __pfx___vmalloc_noprof+0x10/0x10 [ 756.041236][ T9562] ? rcu_is_watching+0x13/0xc0 [ 756.041267][ T9562] ? cap_capable+0x107/0x430 [ 756.041296][ T9562] bpf_prog_alloc_no_stats+0x59/0x690 [ 756.041326][ T9562] ? security_capable+0x80/0x260 [ 756.041354][ T9562] bpf_prog_alloc+0x3b/0x200 [ 756.041382][ T9562] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 756.041412][ T9562] bpf_prog_load+0x49e/0x2ab0 [ 756.041450][ T9562] ? __pfx_bpf_prog_load+0x10/0x10 [ 756.041507][ T9562] __sys_bpf+0x1f46/0x4a30 [ 756.041539][ T9562] ? __pfx___sys_bpf+0x10/0x10 [ 756.041563][ T9562] ? find_held_lock+0x2b/0x80 [ 756.041594][ T9562] ? get_pid_task+0xfc/0x250 [ 756.041622][ T9562] ? get_pid_task+0xfc/0x250 [ 756.041661][ T9562] ? find_held_lock+0x2b/0x80 [ 756.041700][ T9562] ? rcu_read_lock_any_held+0x6a/0x90 [ 756.041720][ T9562] ? find_held_lock+0x2b/0x80 [ 756.041754][ T9562] ? ksys_write+0x190/0x250 [ 756.041780][ T9562] ? ksys_write+0x190/0x250 [ 756.041806][ T9562] ? lock_acquire+0x1d1/0x380 [ 756.041851][ T9562] ? fput+0x7c/0x100 [ 756.041882][ T9562] ? ksys_write+0x1ac/0x250 [ 756.041912][ T9562] ? __x64_sys_bpf+0xce/0x140 [ 756.041936][ T9562] __x64_sys_bpf+0xce/0x140 [ 756.041963][ T9562] ? do_syscall_64+0xae/0x790 [ 756.041996][ T9562] do_syscall_64+0x123/0x790 [ 756.042030][ T9562] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.042053][ T9562] RIP: 0033:0x7fb41439e559 [ 756.042070][ T9562] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 756.042095][ T9562] RSP: 002b:00007fb4152c9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 756.042115][ T9562] RAX: ffffffffffffffda RBX: 00007fb414626090 RCX: 00007fb41439e559 [ 756.042130][ T9562] RDX: 0000000000000094 RSI: 0000200000000440 RDI: 0000000000000005 [ 756.042143][ T9562] RBP: 00007fb4152c9090 R08: 0000000000000000 R09: 0000000000000000 [ 756.042157][ T9562] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 756.042169][ T9562] R13: 00007fb414626128 R14: 00007fb414626090 R15: 00007ffe7fcd9fb8 [ 756.042200][ T9562] [ 756.042259][ T9562] Mem-Info: [ 756.042614][ T9562] active_anon:37445 inactive_anon:0 isolated_anon:0 [ 756.042614][ T9562] active_file:17 inactive_file:65605 isolated_file:0 [ 756.042614][ T9562] unevictable:0 dirty:311 writeback:0 [ 756.042614][ T9562] slab_reclaimable:12789 slab_unreclaimable:106752 [ 756.042614][ T9562] mapped:47401 shmem:30238 pagetables:1241 [ 756.042614][ T9562] sec_pagetables:0 bounce:0 [ 756.042614][ T9562] kernel_misc_reclaimable:0 [ 756.042614][ T9562] free:1144101 free_pcp:32300 free_cma:0 [ 756.042773][ T9562] Node 0 active_anon:149780kB inactive_anon:0kB active_file:68kB inactive_file:262220kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:189604kB dirty:1244kB writeback:0kB shmem:120952kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:2048kB kernel_stack:12656kB pagetables:4804kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 756.042905][ T9562] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:160kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 756.043072][ T9562] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 756.043291][ T9562] lowmem_reserve[]: 0 2452 2452 2452 2452 [ 756.043366][ T9562] Node 0 DMA32 free:628164kB boost:0kB min:33836kB low:42292kB high:50748kB reserved_highatomic:0kB free_highatomic:0kB active_anon:149780kB inactive_anon:0kB active_file:68kB inactive_file:262220kB unevictable:0kB writepending:1244kB zspages:0kB present:3129332kB managed:2510920kB mlocked:0kB bounce:0kB free_pcp:129172kB local_pcp:89256kB free_cma:0kB [ 756.043464][ T9562] lowmem_reserve[]: 0 0 0 0 0 [ 756.043499][ T9562] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:60kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 756.043592][ T9562] lowmem_reserve[]: 0 0 0 0 0 [ 756.043665][ T9562] Node 1 Normal free:3932880kB boost:0kB min:56064kB low:70080kB high:84096kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 756.043885][ T9562] lowmem_reserve[]: 0 0 0 0 0 [ 756.044092][ T9562] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 756.044606][ T9562] Node 0 DMA32: 34*4kB (UME) 25*8kB (UM) 136*16kB (UME) 44*32kB (UME) 125*64kB (UME) 305*128kB (UM) 199*256kB (UME) 36*512kB (UM) 26*1024kB (UM) 9*2048kB (UME) 113*4096kB (M) = 628240kB [ 756.045434][ T9562] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 756.045854][ T9562] Node 1 Normal: 2*4kB (M) 5*8kB (UME) 6*16kB (UME) 10*32kB (UME) 6*64kB (UME) 7*128kB (UME) 4*256kB (UME) 6*512kB (UME) 3*1024kB (UME) 2*2048kB (UE) 957*4096kB (M) = 3932880kB [ 756.046363][ T9562] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 756.046380][ T9562] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 756.046449][ T9562] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 756.046466][ T9562] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 756.046534][ T9562] 95881 total pagecache pages [ 756.046598][ T9562] 0 pages in swap cache [ 756.046607][ T9562] Free swap = 124996kB [ 756.046614][ T9562] Total swap = 124996kB [ 756.046622][ T9562] 2097051 pages RAM [ 756.046651][ T9562] 0 pages HighMem/MovableOnly [ 756.046659][ T9562] 437690 pages reserved [ 756.046666][ T9562] 0 pages cma reserved [ 756.867985][ T9557] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5645] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[9557] [ 757.113868][ T29] legousbtower 1-1:14.57: interrupt endpoints not found [ 758.267094][ T9571] netlink: 12 bytes leftover after parsing attributes in process `syz.3.910'. [ 758.823265][ T9468] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 758.905450][ T9468] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 758.906705][ T9468] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 758.959608][ T9468] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 758.971998][ T9468] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 758.995999][ T9468] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 759.012025][ T9468] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 759.029057][ T9468] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 759.280326][ T9586] cgroup: No subsys list or none specified [ 759.301920][ T9586] device-mapper: table: 248:0: raid: Cannot understand number of raid devices parameters (-EINVAL) [ 759.301947][ T9586] device-mapper: ioctl: error adding target to table [ 759.333795][ T9468] 8021q: adding VLAN 0 to HW filter on device bond0 [ 759.385571][ T9468] 8021q: adding VLAN 0 to HW filter on device team0 [ 759.405697][ T7740] bridge0: port 1(bridge_slave_0) entered blocking state [ 759.405800][ T7740] bridge0: port 1(bridge_slave_0) entered forwarding state [ 759.427013][ T7740] bridge0: port 2(bridge_slave_1) entered blocking state [ 759.427127][ T7740] bridge0: port 2(bridge_slave_1) entered forwarding state [ 759.597304][ T29] legousbtower 1-1:14.228: get version request failed: -71 [ 759.600323][ T29] legousbtower 1-1:14.228: probe with driver legousbtower failed with error -71 [ 759.767883][ T29] usb 1-1: USB disconnect, device number 24 [ 762.999562][ T9612] fuse: Bad value for 'group_id' [ 762.999584][ T9612] fuse: Bad value for 'group_id' [ 763.062822][ T9612] ipip0: entered promiscuous mode [ 763.062845][ T9612] ipip0: entered allmulticast mode [ 763.067864][ T9612] team0: Device ipip0 is of different type [ 763.835399][ T9468] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 764.017791][ T9628] netlink: 36 bytes leftover after parsing attributes in process `syz.2.926'. [ 764.094911][ T9634] netlink: 48 bytes leftover after parsing attributes in process `syz.2.926'. [ 765.982043][ T9232] IPVS: starting estimator thread 0... [ 766.117043][ T9641] IPVS: using max 46 ests per chain, 110400 per kthread [ 767.544814][ T9653] sctp: [Deprecated]: syz.3.928 (pid 9653) Use of int in max_burst socket option. [ 767.544814][ T9653] Use struct sctp_assoc_value instead [ 767.546397][ T9468] veth0_vlan: entered promiscuous mode [ 767.586081][ T9468] veth1_vlan: entered promiscuous mode [ 768.160908][ T9660] FAULT_INJECTION: forcing a failure. [ 768.160908][ T9660] name failslab, interval 1, probability 0, space 0, times 0 [ 768.160964][ T9660] CPU: 0 UID: 0 PID: 9660 Comm: syz.4.932 Not tainted syzkaller #0 PREEMPT(full) [ 768.160991][ T9660] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 768.161005][ T9660] Call Trace: [ 768.161012][ T9660] [ 768.161020][ T9660] dump_stack_lvl+0x100/0x190 [ 768.161045][ T9660] should_fail_ex.cold+0x5/0xa [ 768.161063][ T9660] should_failslab+0xc2/0x120 [ 768.161081][ T9660] kmem_cache_alloc_noprof+0x92/0x6a0 [ 768.161098][ T9660] ? security_file_alloc+0x34/0x2c0 [ 768.161119][ T9660] security_file_alloc+0x34/0x2c0 [ 768.161137][ T9660] init_file+0x95/0x480 [ 768.161155][ T9660] alloc_empty_file+0x79/0x1c0 [ 768.161167][ T9660] path_openat+0xdb/0x2450 [ 768.161191][ T9660] ? __pfx_path_openat+0x10/0x10 [ 768.161208][ T9660] ? __pfx___schedule+0x10/0x10 [ 768.161228][ T9660] do_file_open+0x20e/0x430 [ 768.161245][ T9660] ? __pfx_do_file_open+0x10/0x10 [ 768.161273][ T9660] ? _raw_spin_unlock+0x28/0x50 [ 768.161288][ T9660] ? alloc_fd+0x471/0x7a0 [ 768.161310][ T9660] do_sys_openat2+0x10f/0x1e0 [ 768.161321][ T9660] ? __pfx_do_sys_openat2+0x10/0x10 [ 768.161335][ T9660] ? irqentry_exit+0x24d/0xa10 [ 768.161351][ T9660] ? lockdep_hardirqs_on+0x7d/0x110 [ 768.161368][ T9660] __x64_sys_openat+0x12d/0x210 [ 768.161380][ T9660] ? __pfx___x64_sys_openat+0x10/0x10 [ 768.161398][ T9660] do_syscall_64+0x123/0x790 [ 768.161416][ T9660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 768.161429][ T9660] RIP: 0033:0x7f79d6f9e559 [ 768.161439][ T9660] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 768.161450][ T9660] RSP: 002b:00007f79d7dba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 768.161461][ T9660] RAX: ffffffffffffffda RBX: 00007f79d7226090 RCX: 00007f79d6f9e559 [ 768.161469][ T9660] RDX: 0000000000004000 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 768.161476][ T9660] RBP: 00007f79d7dba090 R08: 0000000000000000 R09: 0000000000000000 [ 768.161483][ T9660] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 768.161490][ T9660] R13: 00007f79d7226128 R14: 00007f79d7226090 R15: 00007fff22691fe8 [ 768.161507][ T9660] [ 768.830409][ T9468] veth0_macvtap: entered promiscuous mode [ 768.856572][ T9468] veth1_macvtap: entered promiscuous mode [ 768.974837][ T9468] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 769.009912][ T9468] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 769.559098][ T9664] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 770.186370][ T7738] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.186416][ T7738] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.186450][ T7738] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.225112][ T9232] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.441558][ T7740] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 770.441579][ T7740] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 770.556730][ T7740] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 770.556752][ T7740] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 770.648051][ T30] audit: type=1400 audit(1792354149.987:575): avc: denied { mounton } for pid=9468 comm="syz-executor" path="/root/syzkaller.kdkp7X/syz-tmp" dev="sda1" ino=2051 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 770.648621][ T30] audit: type=1400 audit(1792354149.987:576): avc: denied { mount } for pid=9468 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 770.729543][ T30] audit: type=1400 audit(1792354150.052:577): avc: denied { mounton } for pid=9468 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 773.714161][ T5778] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 773.739235][ T5642] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 773.899247][ T5778] usb 5-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 773.902672][ T5778] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 773.902690][ T5778] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 773.902712][ T5778] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 773.907107][ T5642] usb 1-1: Using ep0 maxpacket: 32 [ 773.916677][ T5642] usb 1-1: unable to get BOS descriptor or descriptor too short [ 773.916740][ T5642] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 773.918631][ T5642] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 773.918656][ T5642] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 773.918677][ T5642] usb 1-1: config 14 has no interface number 0 [ 773.918695][ T5642] usb 1-1: config 14 has no interface number 1 [ 773.918774][ T5642] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 773.918799][ T5642] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 773.918824][ T5642] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 773.918853][ T5642] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 773.918902][ T5642] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 773.918929][ T5642] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 773.918956][ T5642] usb 1-1: config 14 interface 57 has no altsetting 0 [ 773.918975][ T5642] usb 1-1: config 14 interface 228 has no altsetting 0 [ 773.926991][ T5642] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 773.927016][ T5642] usb 1-1: Product: syz [ 773.927031][ T5642] usb 1-1: Manufacturer: syz [ 773.927047][ T5642] usb 1-1: SerialNumber: syz [ 774.315541][ T9676] netlink: 8 bytes leftover after parsing attributes in process `syz.4.933'. [ 774.315729][ T9676] veth1_macvtap: left promiscuous mode [ 774.315752][ T9676] macsec0: entered allmulticast mode [ 774.338404][ T9680] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5645] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[9680] [ 774.354890][ T9676] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 774.389064][ T9676] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 774.390552][ T9676] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 774.418335][ T5852] usb 5-1: USB disconnect, device number 20 [ 774.432334][ T5853] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 774.516811][ T5642] legousbtower 1-1:14.57: interrupt endpoints not found [ 774.590769][ T5853] usb 4-1: Using ep0 maxpacket: 8 [ 774.592699][ T5853] usb 4-1: New USB device found, idVendor=0b57, idProduct=852a, bcdDevice=6d.39 [ 774.595864][ T5853] usb 4-1: config index 0 descriptor too short (expected 2075, got 27) [ 774.595932][ T5853] usb 4-1: config 0 has an invalid interface number: 200 but max is 0 [ 774.595953][ T5853] usb 4-1: config 0 has no interface number 0 [ 774.596219][ T5853] usb 4-1: config 0 interface 200 altsetting 2 endpoint 0x4 has invalid maxpacket 14129, setting to 64 [ 774.596421][ T5853] usb 4-1: config 0 interface 200 has no altsetting 0 [ 774.661185][ T5853] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 774.661246][ T5853] usb 4-1: Product: syz [ 774.661318][ T5853] usb 4-1: Manufacturer: syz [ 774.661367][ T5853] usb 4-1: SerialNumber: syz [ 774.690349][ T5853] usb 4-1: config 0 descriptor?? [ 774.942064][ T5853] input: Hanwang Art Master III 1308 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.200/input/input28 [ 774.976376][ T5853] usb 4-1: USB disconnect, device number 33 [ 776.572450][ T5642] legousbtower 1-1:14.228: get version request failed: -71 [ 776.574377][ T5642] legousbtower 1-1:14.228: probe with driver legousbtower failed with error -71 [ 776.590946][ T5642] usb 1-1: USB disconnect, device number 25 [ 778.875985][ T9721] FAULT_INJECTION: forcing a failure. [ 778.875985][ T9721] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 778.876007][ T9721] CPU: 0 UID: 0 PID: 9721 Comm: syz.2.946 Not tainted syzkaller #0 PREEMPT(full) [ 778.876021][ T9721] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 778.876028][ T9721] Call Trace: [ 778.876032][ T9721] [ 778.876037][ T9721] dump_stack_lvl+0x100/0x190 [ 778.876059][ T9721] should_fail_ex.cold+0x5/0xa [ 778.876078][ T9721] _copy_from_iter+0x1f4/0x1690 [ 778.876097][ T9721] ? __asan_memset+0x23/0x50 [ 778.876112][ T9721] ? __pfx__copy_from_iter+0x10/0x10 [ 778.876128][ T9721] ? __pfx___alloc_skb+0x10/0x10 [ 778.876147][ T9721] netlink_sendmsg+0x808/0xda0 [ 778.876162][ T9721] ? __pfx_netlink_sendmsg+0x10/0x10 [ 778.876175][ T9721] ? selinux_socket_sendmsg+0x198/0x2f0 [ 778.876194][ T9721] ____sys_sendmsg+0xa4d/0xbe0 [ 778.876208][ T9721] ? __pfx_netlink_sendmsg+0x10/0x10 [ 778.876221][ T9721] ? __pfx_____sys_sendmsg+0x10/0x10 [ 778.876239][ T9721] ? lock_acquire+0x1d1/0x380 [ 778.876253][ T9721] ? get_pid_task+0x2a/0x250 [ 778.876276][ T9721] ___sys_sendmsg+0x190/0x1e0 [ 778.876293][ T9721] ? __pfx____sys_sendmsg+0x10/0x10 [ 778.876317][ T9721] ? get_pid_task+0x106/0x250 [ 778.876351][ T9721] ? find_held_lock+0x2b/0x80 [ 778.876379][ T9721] __sys_sendmsg+0x160/0x210 [ 778.876392][ T9721] ? __pfx___sys_sendmsg+0x10/0x10 [ 778.876414][ T9721] do_syscall_64+0x123/0x790 [ 778.876432][ T9721] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 778.876445][ T9721] RIP: 0033:0x7fb41439e559 [ 778.876455][ T9721] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 778.876466][ T9721] RSP: 002b:00007fb4152ea028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 778.876478][ T9721] RAX: ffffffffffffffda RBX: 00007fb414625fa0 RCX: 00007fb41439e559 [ 778.876485][ T9721] RDX: 0000000000000080 RSI: 0000200000019340 RDI: 0000000000000006 [ 778.876493][ T9721] RBP: 00007fb4152ea090 R08: 0000000000000000 R09: 0000000000000000 [ 778.876499][ T9721] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 778.876506][ T9721] R13: 00007fb414626038 R14: 00007fb414625fa0 R15: 00007ffe7fcd9fb8 [ 778.876523][ T9721] [ 780.438504][ T29] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 780.508654][ T30] audit: type=1400 audit(1792354159.201:578): avc: denied { mount } for pid=9731 comm="syz.5.951" name="/" dev="rpc_pipefs" ino=26565 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 780.529536][ T9732] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 780.614187][ T29] usb 1-1: unable to get BOS descriptor or descriptor too short [ 780.614235][ T29] usb 1-1: New USB device found, idVendor=1235, idProduct=0401, bcdDevice= 0.40 [ 780.615324][ T29] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 780.615431][ T29] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 780.619826][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.619853][ T29] usb 1-1: Product: syz [ 780.619869][ T29] usb 1-1: Manufacturer: syz [ 780.619887][ T29] usb 1-1: SerialNumber: syz [ 780.637687][ T9733] netlink: 14 bytes leftover after parsing attributes in process `syz.5.951'. [ 780.742615][ T9733] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 780.776708][ T9733] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 780.786394][ T9733] bond0 (unregistering): Released all slaves [ 781.500936][ T9742] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 782.054049][ T9744] FAULT_INJECTION: forcing a failure. [ 782.054049][ T9744] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 782.054081][ T9744] CPU: 0 UID: 0 PID: 9744 Comm: syz.3.953 Not tainted syzkaller #0 PREEMPT(full) [ 782.054106][ T9744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 782.054119][ T9744] Call Trace: [ 782.054127][ T9744] [ 782.054135][ T9744] dump_stack_lvl+0x100/0x190 [ 782.054173][ T9744] should_fail_ex.cold+0x5/0xa [ 782.054204][ T9744] _copy_to_user+0x32/0xd0 [ 782.054239][ T9744] simple_read_from_buffer+0xcb/0x170 [ 782.054275][ T9744] proc_fail_nth_read+0x1af/0x230 [ 782.054309][ T9744] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 782.054351][ T9744] ? rw_verify_area+0xce/0x6d0 [ 782.054376][ T9744] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 782.054408][ T9744] vfs_read+0x1e4/0xb40 [ 782.054435][ T9744] ? lock_acquire+0x1d1/0x380 [ 782.054460][ T9744] ? __fget_files+0x34/0x3d0 [ 782.054493][ T9744] ? __pfx_vfs_read+0x10/0x10 [ 782.054517][ T9744] ? find_held_lock+0x2b/0x80 [ 782.054550][ T9744] ? __fget_files+0x215/0x3d0 [ 782.054587][ T9744] ? __fget_files+0x21f/0x3d0 [ 782.054627][ T9744] ksys_read+0x12a/0x250 [ 782.054653][ T9744] ? __pfx_ksys_read+0x10/0x10 [ 782.054687][ T9744] do_syscall_64+0x123/0x790 [ 782.054722][ T9744] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.054745][ T9744] RIP: 0033:0x7fa88755ed8e [ 782.054764][ T9744] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 782.054784][ T9744] RSP: 002b:00007fa8857f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 782.054805][ T9744] RAX: ffffffffffffffda RBX: 00007fa8857f66c0 RCX: 00007fa88755ed8e [ 782.054820][ T9744] RDX: 000000000000000f RSI: 00007fa8857f60a0 RDI: 0000000000000004 [ 782.054833][ T9744] RBP: 00007fa8857f6090 R08: 0000000000000000 R09: 0000000000000000 [ 782.054846][ T9744] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 782.054860][ T9744] R13: 00007fa887826038 R14: 00007fa887825fa0 R15: 00007ffc70b70648 [ 782.054892][ T9744] [ 782.086725][ T9741] ip_tables: iptables: counters copy to user failed while replacing table [ 782.106089][ T9741] netlink: 8 bytes leftover after parsing attributes in process `syz.4.942'. [ 784.397667][ T29] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 784.397737][ T29] usb 1-1: MIDIStreaming interface descriptor not found [ 784.516919][ T29] usb 1-1: USB disconnect, device number 26 [ 784.647183][ T9694] udevd[9694]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 784.679999][ T9757] overlay: Bad value for 'workdir' [ 784.832408][ T5614] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 784.939308][ T29] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 785.003800][ T5614] usb 4-1: Using ep0 maxpacket: 32 [ 785.023031][ T5614] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 785.053954][ T5614] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 785.054020][ T5614] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 785.054125][ T5614] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 785.126261][ T5614] usb 4-1: config 0 descriptor?? [ 785.129749][ T29] usb 1-1: Using ep0 maxpacket: 32 [ 785.186941][ T29] usb 1-1: unable to get BOS descriptor or descriptor too short [ 785.187110][ T29] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 785.204243][ T29] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 785.204297][ T29] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 785.204330][ T29] usb 1-1: config 14 has no interface number 0 [ 785.204420][ T29] usb 1-1: config 14 has no interface number 1 [ 785.204641][ T29] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 785.204727][ T29] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 785.204764][ T29] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 785.204862][ T29] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 785.204945][ T29] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 785.205029][ T29] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 785.205064][ T29] usb 1-1: config 14 interface 57 has no altsetting 0 [ 785.205148][ T29] usb 1-1: config 14 interface 228 has no altsetting 0 [ 785.388312][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 785.388347][ T29] usb 1-1: Product: syz [ 785.388434][ T29] usb 1-1: Manufacturer: syz [ 785.388478][ T29] usb 1-1: SerialNumber: syz [ 785.897186][ T30] audit: type=1400 audit(1792354164.233:579): avc: denied { listen } for pid=9753 comm="syz.3.956" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 786.234888][ T9754] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5645] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[9754] [ 786.410189][ T29] legousbtower 1-1:14.57: interrupt endpoints not found [ 787.113308][ T9774] macvtap1: entered allmulticast mode [ 787.113414][ T9774] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 787.136704][ T9774] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 787.153580][ T9774] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 787.251900][ T9774] netdevsim netdevsim5 netdevsim0: left allmulticast mode [ 788.178342][ T9778] openvswitch: netlink: Port 196609 exceeds max allowable 65535 [ 788.252356][ T5778] netdevsim netdevsim5 netdevsim0: left promiscuous mode [ 788.359758][ T5614] usbhid 4-1:0.0: can't add hid device: -71 [ 788.359819][ T5614] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 788.382168][ T5614] usb 4-1: USB disconnect, device number 34 [ 788.567891][ T29] legousbtower 1-1:14.228: get version request failed: -71 [ 788.568700][ T29] legousbtower 1-1:14.228: probe with driver legousbtower failed with error -71 [ 788.750233][ T29] usb 1-1: USB disconnect, device number 27 [ 788.799405][ T30] audit: type=1400 audit(1792354166.964:580): avc: denied { write } for pid=9782 comm="syz.5.962" name="control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 789.267995][ T9784] netlink: 20 bytes leftover after parsing attributes in process `syz.5.962'. [ 789.430524][ T30] audit: type=1400 audit(1792354167.554:581): avc: denied { shutdown } for pid=9782 comm="syz.5.962" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 792.445090][ T5614] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 793.316135][ T5614] usb 4-1: unable to get BOS descriptor or descriptor too short [ 793.316185][ T5614] usb 4-1: New USB device found, idVendor=1235, idProduct=0401, bcdDevice= 0.40 [ 793.317286][ T5614] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 793.317332][ T5614] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 793.442911][ T5614] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 793.442937][ T5614] usb 4-1: Product: syz [ 793.442950][ T5614] usb 4-1: Manufacturer: syz [ 793.445730][ T5614] usb 4-1: can't set config #1, error -71 [ 793.447128][ T5614] usb 4-1: USB disconnect, device number 35 [ 793.560362][ T30] audit: type=1400 audit(1792354171.417:582): avc: denied { mounton } for pid=9811 comm="syz.0.970" path="/proc/720/ns/cgroup" dev="proc" ino=27737 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=lnk_file permissive=1 [ 793.612865][ T9814] netlink: 52 bytes leftover after parsing attributes in process `syz.3.971'. [ 793.620008][ T9814] bridge0: port 3(dummy0) entered disabled state [ 793.620197][ T9814] bridge0: port 2(bridge_slave_1) entered disabled state [ 793.620534][ T9814] bridge0: port 1(bridge_slave_0) entered disabled state [ 793.665764][ T9814] netlink: 76 bytes leftover after parsing attributes in process `syz.3.971'. [ 793.665955][ T9814] bridge0: port 3(dummy0) entered blocking state [ 793.666044][ T9814] bridge0: port 3(dummy0) entered forwarding state [ 793.666403][ T9814] bridge0: port 2(bridge_slave_1) entered blocking state [ 793.666493][ T9814] bridge0: port 2(bridge_slave_1) entered forwarding state [ 793.666678][ T9814] bridge0: port 1(bridge_slave_0) entered blocking state [ 793.666761][ T9814] bridge0: port 1(bridge_slave_0) entered forwarding state [ 793.672135][ T9814] netlink: 52 bytes leftover after parsing attributes in process `syz.3.971'. [ 793.760311][ T9814] bridge0: port 3(dummy0) entered disabled state [ 793.760416][ T9814] bridge0: port 2(bridge_slave_1) entered disabled state [ 793.760495][ T9814] bridge0: port 1(bridge_slave_0) entered disabled state [ 794.031065][ T9817] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 795.101876][ T9824] macvtap1: entered allmulticast mode [ 795.113982][ T9824] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 795.114129][ T9824] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 795.137110][ T9824] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 795.930321][ T9824] netdevsim netdevsim2 netdevsim0: left allmulticast mode [ 796.014492][ T5614] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 797.921181][ T9847] netlink: 52 bytes leftover after parsing attributes in process `syz.5.981'. [ 798.112897][ T5614] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 798.284771][ T5614] usb 5-1: unable to get BOS descriptor or descriptor too short [ 798.284820][ T5614] usb 5-1: New USB device found, idVendor=1235, idProduct=0401, bcdDevice= 0.40 [ 798.285938][ T5614] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 798.285982][ T5614] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 798.289903][ T5614] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 798.289929][ T5614] usb 5-1: Product: syz [ 798.289946][ T5614] usb 5-1: Manufacturer: syz [ 798.289963][ T5614] usb 5-1: SerialNumber: syz [ 798.805384][ T5778] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 798.873525][ T30] audit: type=1400 audit(1792354176.384:583): avc: denied { read } for pid=9856 comm="syz.3.983" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 798.873964][ T30] audit: type=1400 audit(1792354176.384:584): avc: denied { open } for pid=9856 comm="syz.3.983" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 798.874869][ T30] audit: type=1400 audit(1792354176.384:585): avc: denied { ioctl } for pid=9856 comm="syz.3.983" path="/dev/cachefiles" dev="devtmpfs" ino=4 ioctlcmd=0x5602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 799.008116][ T5778] usb 1-1: Using ep0 maxpacket: 16 [ 799.254571][ T5778] usb 1-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 799.288148][ T5778] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 799.288176][ T5778] usb 1-1: Product: syz [ 799.288192][ T5778] usb 1-1: Manufacturer: syz [ 799.288208][ T5778] usb 1-1: SerialNumber: syz [ 799.293921][ T5778] usb 1-1: config 0 descriptor?? [ 799.374728][ T30] audit: type=1400 audit(1792354176.852:586): avc: denied { read } for pid=9864 comm="syz.3.985" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 799.375079][ T30] audit: type=1400 audit(1792354176.852:587): avc: denied { open } for pid=9864 comm="syz.3.985" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 799.438417][ T30] audit: type=1400 audit(1792354176.917:588): avc: denied { ioctl } for pid=9864 comm="syz.3.985" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x5404 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 799.521616][ T5778] speedtch 1-1:0.0: speedtch_bind: data interface not found! [ 799.521646][ T5778] speedtch 1-1:0.0: usbatm_usb_probe: bind failed: -19! [ 799.529029][ T5778] usb 1-1: USB disconnect, device number 28 [ 799.751439][ T9870] FAULT_INJECTION: forcing a failure. [ 799.751439][ T9870] name failslab, interval 1, probability 0, space 0, times 0 [ 799.751463][ T9870] CPU: 0 UID: 0 PID: 9870 Comm: syz.3.986 Not tainted syzkaller #0 PREEMPT(full) [ 799.751477][ T9870] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 799.751485][ T9870] Call Trace: [ 799.751489][ T9870] [ 799.751494][ T9870] dump_stack_lvl+0x100/0x190 [ 799.751527][ T9870] should_fail_ex.cold+0x5/0xa [ 799.751561][ T9870] should_failslab+0xc2/0x120 [ 799.751593][ T9870] kmem_cache_alloc_noprof+0x92/0x6a0 [ 799.751609][ T9870] ? do_getname+0x35/0x390 [ 799.751624][ T9870] do_getname+0x35/0x390 [ 799.751638][ T9870] __x64_sys_execve+0x76/0xd0 [ 799.751655][ T9870] do_syscall_64+0x123/0x790 [ 799.751690][ T9870] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 799.751714][ T9870] RIP: 0033:0x7fa88759e559 [ 799.751731][ T9870] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 799.751751][ T9870] RSP: 002b:00007fa8857f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000003b [ 799.751763][ T9870] RAX: ffffffffffffffda RBX: 00007fa887825fa0 RCX: 00007fa88759e559 [ 799.751771][ T9870] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000019680 [ 799.751778][ T9870] RBP: 00007fa8857f6090 R08: 0000000000000000 R09: 0000000000000000 [ 799.751785][ T9870] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 799.751791][ T9870] R13: 00007fa887826038 R14: 00007fa887825fa0 R15: 00007ffc70b70648 [ 799.751808][ T9870] [ 800.802739][ T5614] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 800.802771][ T5614] usb 5-1: MIDIStreaming interface descriptor not found [ 800.998597][ T5614] usb 5-1: USB disconnect, device number 21 [ 801.055201][ T9683] udevd[9683]: setting owner of /dev/bus/usb/005/021 to uid=0, gid=0 failed: No such file or directory [ 801.100647][ T9694] udevd[9694]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 801.620871][ T9890] macvtap1: entered allmulticast mode [ 801.621019][ T9890] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 801.621173][ T9890] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 801.626695][ T9890] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 801.672671][ T9890] netdevsim netdevsim3 netdevsim0: left allmulticast mode [ 801.767470][ T5614] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 802.875764][ T30] audit: type=1400 audit(1792354180.125:589): avc: denied { lock } for pid=9903 comm="syz.3.998" path="socket:[28703]" dev="sockfs" ino=28703 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 802.876625][ T9909] netlink: 24 bytes leftover after parsing attributes in process `syz.3.998'. [ 802.876657][ T9909] netlink: 16 bytes leftover after parsing attributes in process `syz.3.998'. [ 802.943100][ T30] audit: type=1400 audit(1792354180.182:590): avc: denied { unmount } for pid=5637 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 804.045542][ T9923] netlink: 'syz.2.1003': attribute type 4 has an invalid length. [ 805.514031][ T5853] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 806.096190][ T5614] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 806.248078][ T5853] usb 5-1: unable to get BOS descriptor or descriptor too short [ 806.248129][ T5853] usb 5-1: New USB device found, idVendor=1235, idProduct=0401, bcdDevice= 0.40 [ 806.249259][ T5853] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 806.249309][ T5853] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 806.262986][ T5853] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 806.263014][ T5853] usb 5-1: Product: syz [ 806.263030][ T5853] usb 5-1: Manufacturer: syz [ 806.263046][ T5853] usb 5-1: SerialNumber: syz [ 806.330841][ T5614] usb 1-1: unable to get BOS descriptor or descriptor too short [ 806.330890][ T5614] usb 1-1: New USB device found, idVendor=1235, idProduct=0401, bcdDevice= 0.40 [ 806.351186][ T5614] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 806.351234][ T5614] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 806.378580][ T5614] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 806.378609][ T5614] usb 1-1: Product: syz [ 806.378625][ T5614] usb 1-1: Manufacturer: syz [ 806.378641][ T5614] usb 1-1: SerialNumber: syz [ 806.466696][ T5853] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 806.466743][ T5853] usb 5-1: MIDIStreaming interface descriptor not found [ 806.489403][ T9939] ipip0: entered promiscuous mode [ 806.489424][ T9939] ipip0: entered allmulticast mode [ 806.504513][ T9939] team0: Device ipip0 is of different type [ 806.608023][ T5853] usb 5-1: USB disconnect, device number 22 [ 806.721313][ T9758] udevd[9758]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 807.913554][ T5795] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 808.041861][ T5853] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 808.088088][ T5795] usb 3-1: New USB device found, idVendor=413c, idProduct=8218, bcdDevice=ca.32 [ 808.089947][ T5795] usb 3-1: config 127 has an invalid interface number: 136 but max is 0 [ 808.089974][ T5795] usb 3-1: config 127 has an invalid interface number: 89 but max is 0 [ 808.089995][ T5795] usb 3-1: config 127 has 2 interfaces, different from the descriptor's value: 1 [ 808.090017][ T5795] usb 3-1: config 127 has no interface number 0 [ 808.090034][ T5795] usb 3-1: config 127 has no interface number 1 [ 808.090063][ T5795] usb 3-1: too many endpoints for config 127 interface 89 altsetting 231: 126, using maximum allowed: 30 [ 808.090081][ T5795] usb 3-1: config 127 interface 89 altsetting 231 has 0 endpoint descriptors, different from the interface descriptor's value: 126 [ 808.090101][ T5795] usb 3-1: config 127 interface 136 has no altsetting 0 [ 808.090120][ T5795] usb 3-1: config 127 interface 89 has no altsetting 0 [ 808.092024][ T5795] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 808.092050][ T5795] usb 3-1: Product: syz [ 808.092067][ T5795] usb 3-1: Manufacturer: syz [ 808.092131][ T5795] usb 3-1: SerialNumber: syz [ 808.216028][ T5853] usb 5-1: Using ep0 maxpacket: 16 [ 808.218620][ T5853] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 808.219811][ T5853] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 808.219836][ T5853] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 808.222880][ T5853] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 808.222906][ T5853] usb 5-1: Product: syz [ 808.222922][ T5853] usb 5-1: Manufacturer: syz [ 808.222959][ T5853] usb 5-1: SerialNumber: syz [ 808.269066][ T5853] usb 5-1: 0:2 : does not exist [ 808.269178][ T5853] usb 5-1: unit 9 not found! [ 808.339731][ T9941] FAULT_INJECTION: forcing a failure. [ 808.339731][ T9941] name failslab, interval 1, probability 0, space 0, times 0 [ 808.339771][ T9941] CPU: 1 UID: 0 PID: 9941 Comm: syz.2.1007 Not tainted syzkaller #0 PREEMPT(full) [ 808.339804][ T9941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 808.339820][ T9941] Call Trace: [ 808.339828][ T9941] [ 808.339837][ T9941] dump_stack_lvl+0x100/0x190 [ 808.339879][ T9941] should_fail_ex.cold+0x5/0xa [ 808.339914][ T9941] should_failslab+0xc2/0x120 [ 808.339960][ T9941] kmem_cache_alloc_noprof+0x92/0x6a0 [ 808.339992][ T9941] ? avtab_insert_node+0x2a/0x3c0 [ 808.340022][ T9941] avtab_insert_node+0x2a/0x3c0 [ 808.340047][ T9941] avtab_insert_nonunique+0x3ad/0x570 [ 808.340078][ T9941] cond_dup_av_list+0x19d/0x2b0 [ 808.340118][ T9941] cond_policydb_dup+0x444/0x750 [ 808.340158][ T9941] security_set_bools+0x13f/0x6c0 [ 808.340194][ T9941] sel_commit_bools_write+0x36d/0x420 [ 808.340223][ T9941] ? __pfx_sel_commit_bools_write+0x10/0x10 [ 808.340270][ T9941] ? __pfx_sel_commit_bools_write+0x10/0x10 [ 808.340300][ T9941] vfs_writev+0x5ed/0xdd0 [ 808.340337][ T9941] ? __pfx_vfs_writev+0x10/0x10 [ 808.340370][ T9941] ? lock_acquire+0x1d1/0x380 [ 808.340397][ T9941] ? __fget_files+0x34/0x3d0 [ 808.340441][ T9941] ? __fget_files+0x21f/0x3d0 [ 808.340482][ T9941] ? do_writev+0x13e/0x340 [ 808.340504][ T9941] do_writev+0x13e/0x340 [ 808.340532][ T9941] ? __pfx_do_writev+0x10/0x10 [ 808.340569][ T9941] do_syscall_64+0x123/0x790 [ 808.340607][ T9941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.340632][ T9941] RIP: 0033:0x7fb41439e559 [ 808.340653][ T9941] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 808.340677][ T9941] RSP: 002b:00007fb4152ea028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 808.340700][ T9941] RAX: ffffffffffffffda RBX: 00007fb414625fa0 RCX: 00007fb41439e559 [ 808.340724][ T9941] RDX: 0000000000000002 RSI: 0000200000000540 RDI: 0000000000000006 [ 808.340739][ T9941] RBP: 00007fb414435ab8 R08: 0000000000000000 R09: 0000000000000000 [ 808.340754][ T9941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 808.340769][ T9941] R13: 00007fb414626038 R14: 00007fb414625fa0 R15: 00007ffe7fcd9fb8 [ 808.340803][ T9941] [ 808.505689][ T30] audit: type=1400 audit(1792354185.392:591): avc: denied { create } for pid=9948 comm="syz.4.1009" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 808.510829][ T30] audit: type=1400 audit(1792354185.392:592): avc: denied { write } for pid=9948 comm="syz.4.1009" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 808.538802][ T5853] usb 5-1: 4:0: cannot get min/max values for control 1 (id 4) [ 808.558859][ T5853] usb 5-1: 4:0: cannot get min/max values for control 2 (id 4) [ 808.577417][ T5853] usb 5-1: 4:0: cannot get min/max values for control 4 (id 4) [ 808.585163][ T5853] usb 5-1: 4:0: cannot get min/max values for control 5 (id 4) [ 808.591194][ T5853] usb 5-1: 4:0: cannot get min/max values for control 6 (id 4) [ 808.754070][ T5853] usb 5-1: USB disconnect, device number 23 [ 808.913842][ T5795] usb 3-1: USB disconnect, device number 23 [ 808.915489][ T5614] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 808.915533][ T5614] usb 1-1: MIDIStreaming interface descriptor not found [ 808.977208][ T9961] FAULT_INJECTION: forcing a failure. [ 808.977208][ T9961] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 808.977237][ T9961] CPU: 0 UID: 0 PID: 9961 Comm: syz.0.1012 Not tainted syzkaller #0 PREEMPT(full) [ 808.977261][ T9961] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 808.977276][ T9961] Call Trace: [ 808.977283][ T9961] [ 808.977291][ T9961] dump_stack_lvl+0x100/0x190 [ 808.977319][ T9961] should_fail_ex.cold+0x5/0xa [ 808.977341][ T9961] _copy_to_user+0x32/0xd0 [ 808.977365][ T9961] generic_map_lookup_batch+0x55a/0xd10 [ 808.977392][ T9961] ? __pfx_generic_map_lookup_batch+0x10/0x10 [ 808.977414][ T9961] ? __pfx_generic_map_lookup_batch+0x10/0x10 [ 808.977431][ T9961] bpf_map_do_batch+0x5b2/0x6d0 [ 808.977452][ T9961] ? bpf_lsm_bpf+0x9/0x10 [ 808.977471][ T9961] __sys_bpf+0xa79/0x4a30 [ 808.977494][ T9961] ? __pfx___sys_bpf+0x10/0x10 [ 808.977511][ T9961] ? find_held_lock+0x2b/0x80 [ 808.977535][ T9961] ? get_pid_task+0xfc/0x250 [ 808.977557][ T9961] ? get_pid_task+0xfc/0x250 [ 808.977586][ T9961] ? find_held_lock+0x2b/0x80 [ 808.977617][ T9961] ? rcu_read_lock_any_held+0x6a/0x90 [ 808.977635][ T9961] ? find_held_lock+0x2b/0x80 [ 808.977656][ T9961] ? ksys_write+0x190/0x250 [ 808.977675][ T9961] ? ksys_write+0x190/0x250 [ 808.977693][ T9961] ? lock_acquire+0x1d1/0x380 [ 808.977726][ T9961] ? fput+0x7c/0x100 [ 808.977749][ T9961] ? ksys_write+0x1ac/0x250 [ 808.977771][ T9961] ? __x64_sys_bpf+0xce/0x140 [ 808.977788][ T9961] __x64_sys_bpf+0xce/0x140 [ 808.977809][ T9961] ? do_syscall_64+0xae/0x790 [ 808.977835][ T9961] do_syscall_64+0x123/0x790 [ 808.977861][ T9961] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.977880][ T9961] RIP: 0033:0x7f18de99e559 [ 808.977896][ T9961] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 808.977914][ T9961] RSP: 002b:00007f18df7d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 808.977931][ T9961] RAX: ffffffffffffffda RBX: 00007f18dec25fa0 RCX: 00007f18de99e559 [ 808.977942][ T9961] RDX: 0000000000000038 RSI: 0000200000000140 RDI: 0000000000000018 [ 808.977952][ T9961] RBP: 00007f18df7d6090 R08: 0000000000000000 R09: 0000000000000000 [ 808.977962][ T9961] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 808.977971][ T9961] R13: 00007f18dec26038 R14: 00007f18dec25fa0 R15: 00007fffdaf149e8 [ 808.977994][ T9961] [ 809.082799][ T9963] PKCS7: Unknown OID: [4] 1.2.840.113549.17.7.2 [ 809.082824][ T9963] PKCS7: Only support pkcs7_signedData type [ 809.135310][ T30] audit: type=1400 audit(1792354185.981:593): avc: denied { getopt } for pid=9964 comm="syz.0.1014" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 809.195921][ T9967] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=63 sclass=netlink_route_socket pid=9967 comm=syz.0.1015 [ 809.204045][ T9969] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=63 sclass=netlink_route_socket pid=9969 comm=syz.0.1015 [ 809.359399][ T5614] usb 1-1: USB disconnect, device number 29 [ 810.470288][ T9950] udevd[9950]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 810.654528][ T30] audit: type=1400 audit(1792354187.403:594): avc: denied { setopt } for pid=9978 comm="syz.3.1019" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 810.666200][ T9983] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1019'. [ 810.713379][ T9981] ipip0: entered promiscuous mode [ 810.713403][ T9981] ipip0: entered allmulticast mode [ 810.725892][ T9981] team0: Device ipip0 is of different type [ 810.833460][ T30] audit: type=1400 audit(1792354187.571:595): avc: denied { setattr } for pid=9984 comm="syz.0.1021" path="socket:[29026]" dev="sockfs" ino=29026 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 810.874654][ T9986] IPVS: set_ctl: invalid protocol: 135 255.255.255.255:20001 [ 811.173972][ T5778] usb 4-1: new full-speed USB device number 36 using dummy_hcd [ 811.467571][ T5778] usb 4-1: not running at top speed; connect to a high speed hub [ 811.467607][ T5778] usb 4-1: New USB device found, idVendor=045e, idProduct=02ae, bcdDevice=bc.66 [ 811.958105][ T5778] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.958135][ T5778] usb 4-1: Product: syz [ 811.958152][ T5778] usb 4-1: Manufacturer: syz [ 811.958168][ T5778] usb 4-1: SerialNumber: syz [ 812.281170][ T30] audit: type=1400 audit(1792354188.928:596): avc: denied { watch } for pid=9999 comm="syz.2.1024" path="/201/file1" dev="tmpfs" ino=1148 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 812.346801][ T9998] netlink: 144 bytes leftover after parsing attributes in process `syz.0.1021'. [ 812.456191][ T5778] gspca_main: 045e:02ae too many config [ 812.471043][ T5778] usb 4-1: USB disconnect, device number 36 [ 814.046999][ T5641] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 814.051158][ T5641] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 814.060290][ T5641] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 814.067310][ T5641] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 814.067857][ T5641] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 814.428156][T10026] netlink: 'syz.4.1031': attribute type 4 has an invalid length. [ 814.454766][T10026] netlink: 'syz.4.1031': attribute type 4 has an invalid length. [ 816.214802][ T30] audit: type=1400 audit(1792354192.604:597): avc: denied { bind } for pid=10030 comm="syz.4.1034" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 816.252093][ T4916] Bluetooth: hci6: command tx timeout [ 816.360890][ T30] audit: type=1400 audit(1792354192.725:598): avc: denied { listen } for pid=10030 comm="syz.4.1034" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 816.556233][T10029] ipip0: entered promiscuous mode [ 816.556264][T10029] ipip0: entered allmulticast mode [ 816.672727][T10029] team0: Device ipip0 is of different type [ 817.006003][T10039] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1035'. [ 817.006034][T10039] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1035'. [ 817.048442][ T30] audit: type=1400 audit(1792354193.380:599): avc: denied { setopt } for pid=10038 comm="syz.4.1035" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 817.104099][T10044] netlink: 288 bytes leftover after parsing attributes in process `syz.4.1035'. [ 819.376357][ T4916] Bluetooth: hci6: command tx timeout [ 820.770776][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 820.770849][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 820.926561][T10066] netlink: 'syz.4.1040': attribute type 4 has an invalid length. [ 821.006612][T10066] netlink: 'syz.4.1040': attribute type 4 has an invalid length. [ 821.552137][ T4916] Bluetooth: hci6: command tx timeout [ 823.662174][T10017] bridge0: port 1(bridge_slave_0) entered blocking state [ 823.671419][T10017] bridge0: port 1(bridge_slave_0) entered disabled state [ 823.671575][T10017] bridge_slave_0: entered allmulticast mode [ 823.685704][T10017] bridge_slave_0: entered promiscuous mode [ 823.696631][T10017] bridge0: port 2(bridge_slave_1) entered blocking state [ 823.696715][T10017] bridge0: port 2(bridge_slave_1) entered disabled state [ 823.708588][T10017] bridge_slave_1: entered allmulticast mode [ 823.720480][T10017] bridge_slave_1: entered promiscuous mode [ 823.767568][ T4916] Bluetooth: hci6: command tx timeout [ 823.826434][T10088] IPVS: set_ctl: invalid protocol: 58 224.0.0.2:20000 [ 823.918139][T10017] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 823.939361][T10017] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 824.078327][T10017] team0: Port device team_slave_0 added [ 824.118709][T10017] team0: Port device team_slave_1 added [ 824.208280][T10098] netlink: 134780 bytes leftover after parsing attributes in process `syz.4.1044'. [ 824.211284][T10017] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 824.211299][T10017] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 824.211324][T10017] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 824.222245][T10017] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 824.222262][T10017] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 824.222285][T10017] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 824.337556][ T30] audit: type=1400 audit(1792354200.199:600): avc: denied { accept } for pid=10100 comm="syz.2.1039" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 824.380878][T10017] hsr_slave_0: entered promiscuous mode [ 824.381805][T10017] hsr_slave_1: entered promiscuous mode [ 824.382406][T10017] debugfs: 'hsr0' already exists in 'hsr' [ 824.382424][T10017] Cannot create hsr debugfs directory [ 824.755509][T10017] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 825.421408][T10017] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 825.446809][T10017] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 825.454487][T10017] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 825.478780][T10017] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 825.641420][T10111] netlink: 'syz.0.1043': attribute type 4 has an invalid length. [ 825.709141][T10112] netlink: 'syz.0.1043': attribute type 4 has an invalid length. [ 825.887023][T10017] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 825.892382][T10017] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 825.915029][T10017] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 827.973845][T10017] 8021q: adding VLAN 0 to HW filter on device bond0 [ 828.030499][T10017] 8021q: adding VLAN 0 to HW filter on device team0 [ 828.042415][ T5661] bridge0: port 1(bridge_slave_0) entered blocking state [ 828.042511][ T5661] bridge0: port 1(bridge_slave_0) entered forwarding state [ 828.061734][ T7740] bridge0: port 2(bridge_slave_1) entered blocking state [ 828.061840][ T7740] bridge0: port 2(bridge_slave_1) entered forwarding state [ 828.429966][ T5614] usb 4-1: new full-speed USB device number 37 using dummy_hcd [ 828.532582][T10138] FAULT_INJECTION: forcing a failure. [ 828.532582][T10138] name failslab, interval 1, probability 0, space 0, times 0 [ 828.532619][T10138] CPU: 0 UID: 0 PID: 10138 Comm: syz.0.1050 Not tainted syzkaller #0 PREEMPT(full) [ 828.532648][T10138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 828.532663][T10138] Call Trace: [ 828.532671][T10138] [ 828.532680][T10138] dump_stack_lvl+0x100/0x190 [ 828.532721][T10138] should_fail_ex.cold+0x5/0xa [ 828.532756][T10138] should_failslab+0xc2/0x120 [ 828.532794][T10138] __kmalloc_node_noprof+0xff/0x880 [ 828.532828][T10138] ? crypto_create_tfm_node+0x8d/0x3b0 [ 828.532861][T10138] crypto_create_tfm_node+0x8d/0x3b0 [ 828.532889][T10138] crypto_alloc_tfm_node+0x102/0x260 [ 828.532929][T10138] x509_get_sig_params+0x2bb/0x6c0 [ 828.532963][T10138] ? __asan_memcpy+0x3c/0x60 [ 828.532995][T10138] x509_cert_parse+0x4e9/0x910 [ 828.533031][T10138] x509_key_preparse+0x65/0x9c0 [ 828.533070][T10138] asymmetric_key_preparse+0xce/0x1d0 [ 828.533096][T10138] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 828.533125][T10138] __key_create_or_update+0x413/0xe30 [ 828.533167][T10138] ? __pfx___key_create_or_update+0x10/0x10 [ 828.533206][T10138] ? lookup_user_key+0x3f3/0x1300 [ 828.533255][T10138] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 828.533296][T10138] key_create_or_update+0x42/0x60 [ 828.533337][T10138] __do_sys_add_key+0x2e8/0x460 [ 828.533367][T10138] ? __pfx___do_sys_add_key+0x10/0x10 [ 828.533404][T10138] do_syscall_64+0x123/0x790 [ 828.533442][T10138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.533469][T10138] RIP: 0033:0x7f18de99e559 [ 828.533489][T10138] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 828.533510][T10138] RSP: 002b:00007f18df7b5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 828.533532][T10138] RAX: ffffffffffffffda RBX: 00007f18dec26090 RCX: 00007f18de99e559 [ 828.533549][T10138] RDX: 0000200000000180 RSI: 0000000000000000 RDI: 0000200000000140 [ 828.533564][T10138] RBP: 00007f18dea35ab8 R08: ffffffffffffffff R09: 0000000000000000 [ 828.533579][T10138] R10: 00000000000000da R11: 0000000000000246 R12: 0000000000000000 [ 828.533593][T10138] R13: 00007f18dec26128 R14: 00007f18dec26090 R15: 00007fffdaf149e8 [ 828.533627][T10138] [ 828.662015][ T5614] usb 4-1: not running at top speed; connect to a high speed hub [ 828.662048][ T5614] usb 4-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 828.665074][ T5614] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 828.665098][ T5614] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 828.665145][ T5614] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 828.706758][ T5614] uvcvideo 4-1:1.0: probe with driver uvcvideo failed with error -22 [ 828.893394][T10150] FAULT_INJECTION: forcing a failure. [ 828.893394][T10150] name failslab, interval 1, probability 0, space 0, times 0 [ 828.893426][T10150] CPU: 1 UID: 0 PID: 10150 Comm: syz.0.1052 Not tainted syzkaller #0 PREEMPT(full) [ 828.893452][T10150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 828.893463][T10150] Call Trace: [ 828.893470][T10150] [ 828.893478][T10150] dump_stack_lvl+0x100/0x190 [ 828.893515][T10150] should_fail_ex.cold+0x5/0xa [ 828.893547][T10150] should_failslab+0xc2/0x120 [ 828.893579][T10150] kmem_cache_alloc_noprof+0x92/0x6a0 [ 828.893608][T10150] ? security_file_alloc+0x34/0x2c0 [ 828.893648][T10150] security_file_alloc+0x34/0x2c0 [ 828.893682][T10150] init_file+0x95/0x480 [ 828.893716][T10150] alloc_empty_file+0x79/0x1c0 [ 828.893738][T10150] path_openat+0xdb/0x2450 [ 828.893774][T10150] ? __pfx_path_openat+0x10/0x10 [ 828.893815][T10150] do_file_open+0x20e/0x430 [ 828.893849][T10150] ? __pfx_do_file_open+0x10/0x10 [ 828.893903][T10150] ? _raw_spin_unlock+0x28/0x50 [ 828.893933][T10150] ? alloc_fd+0x471/0x7a0 [ 828.893974][T10150] do_sys_openat2+0x10f/0x1e0 [ 828.893996][T10150] ? __pfx_do_sys_openat2+0x10/0x10 [ 828.894018][T10150] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 828.894052][T10150] ? __fget_files+0x21f/0x3d0 [ 828.894087][T10150] __x64_sys_openat+0x12d/0x210 [ 828.894110][T10150] ? __pfx___x64_sys_openat+0x10/0x10 [ 828.894129][T10150] ? ksys_write+0x1ac/0x250 [ 828.894166][T10150] do_syscall_64+0x123/0x790 [ 828.894199][T10150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.894221][T10150] RIP: 0033:0x7f18de99e559 [ 828.894239][T10150] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 828.894259][T10150] RSP: 002b:00007f18df7d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 828.894281][T10150] RAX: ffffffffffffffda RBX: 00007f18dec25fa0 RCX: 00007f18de99e559 [ 828.894295][T10150] RDX: 0000000000000001 RSI: 0000200000000340 RDI: ffffffffffffff9c [ 828.894309][T10150] RBP: 00007f18df7d6090 R08: 0000000000000000 R09: 0000000000000000 [ 828.894322][T10150] R10: 0000000000000150 R11: 0000000000000246 R12: 0000000000000001 [ 828.894335][T10150] R13: 00007f18dec26038 R14: 00007f18dec25fa0 R15: 00007fffdaf149e8 [ 828.894367][T10150] [ 829.005958][ T5614] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 829.182778][ T5614] usb 5-1: Using ep0 maxpacket: 32 [ 829.194305][ T5614] usb 5-1: unable to get BOS descriptor or descriptor too short [ 829.194355][ T5614] usb 5-1: New USB device found, idVendor=1415, idProduct=2000, bcdDevice=2b.98 [ 829.195357][ T5614] usb 5-1: config 12 has an invalid interface number: 183 but max is 1 [ 829.195384][ T5614] usb 5-1: config 12 has an invalid interface number: 229 but max is 1 [ 829.195407][ T5614] usb 5-1: config 12 has no interface number 0 [ 829.195425][ T5614] usb 5-1: config 12 has no interface number 1 [ 829.195474][ T5614] usb 5-1: config 12 interface 183 has no altsetting 0 [ 829.195494][ T5614] usb 5-1: config 12 interface 229 has no altsetting 0 [ 829.198197][ T5614] usb 5-1: string descriptor 0 read error: -22 [ 829.198396][ T5614] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 832.073753][ T5795] usb 4-1: USB disconnect, device number 37 [ 832.101308][ T5778] usb 5-1: USB disconnect, device number 24 [ 832.206623][T10017] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 832.495261][T10017] veth0_vlan: entered promiscuous mode [ 832.537691][T10017] veth1_vlan: entered promiscuous mode [ 832.648703][T10184] macvtap1: entered allmulticast mode [ 832.648757][T10184] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 832.648909][T10184] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 832.675870][T10184] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 832.732269][T10184] netdevsim netdevsim0 netdevsim0: left allmulticast mode [ 832.935769][ T5795] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 833.435301][T10017] veth0_macvtap: entered promiscuous mode [ 833.458245][T10017] veth1_macvtap: entered promiscuous mode [ 833.525642][T10017] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 833.558171][T10017] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 833.677919][ T82] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 833.679330][ T9233] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 833.679428][ T9233] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 833.679538][ T9233] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 834.115439][ T8631] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 834.115489][ T8631] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 834.184373][ T30] audit: type=1800 audit(1792354209.357:601): pid=10197 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.1060" name="file0" dev="overlay" ino=1225 res=0 errno=0 [ 834.225794][T10197] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1060'. [ 834.369137][T10197] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 834.394531][ T5778] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 834.435160][T10197] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 834.471254][T10197] bond0 (unregistering): Released all slaves [ 834.722825][ T5852] infiniband syz1: ib_query_port failed (-19) [ 834.944200][ T5778] usb 1-1: New USB device found, idVendor=413c, idProduct=8218, bcdDevice=ca.32 [ 834.958807][ T5778] usb 1-1: config 127 has an invalid interface number: 136 but max is 0 [ 834.958837][ T5778] usb 1-1: config 127 has an invalid interface number: 89 but max is 0 [ 834.958869][ T5778] usb 1-1: config 127 has 2 interfaces, different from the descriptor's value: 1 [ 834.958892][ T5778] usb 1-1: config 127 has no interface number 0 [ 834.958911][ T5778] usb 1-1: config 127 has no interface number 1 [ 834.958958][ T5778] usb 1-1: too many endpoints for config 127 interface 89 altsetting 231: 126, using maximum allowed: 30 [ 834.958994][ T5778] usb 1-1: config 127 interface 89 altsetting 231 has 0 endpoint descriptors, different from the interface descriptor's value: 126 [ 834.959025][ T5778] usb 1-1: config 127 interface 136 has no altsetting 0 [ 834.959046][ T5778] usb 1-1: config 127 interface 89 has no altsetting 0 [ 835.242171][ T5778] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 835.242200][ T5778] usb 1-1: Product: syz [ 835.242215][ T5778] usb 1-1: Manufacturer: syz [ 835.242230][ T5778] usb 1-1: SerialNumber: syz [ 835.296688][ T9233] smbdirect: ib_dev[syz1] removed [ 835.359002][T10202] FAULT_INJECTION: forcing a failure. [ 835.359002][T10202] name failslab, interval 1, probability 0, space 0, times 0 [ 835.359036][T10202] CPU: 0 UID: 0 PID: 10202 Comm: syz.2.1061 Not tainted syzkaller #0 PREEMPT(full) [ 835.359062][T10202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 835.359076][T10202] Call Trace: [ 835.359084][T10202] [ 835.359093][T10202] dump_stack_lvl+0x100/0x190 [ 835.359130][T10202] should_fail_ex.cold+0x5/0xa [ 835.359162][T10202] should_failslab+0xc2/0x120 [ 835.359195][T10202] __kmalloc_cache_noprof+0x91/0x6d0 [ 835.359221][T10202] ? iommufd_test+0x994/0x6600 [ 835.359261][T10202] iommufd_test+0x994/0x6600 [ 835.359297][T10202] ? __lock_acquire+0x5c0/0x1f40 [ 835.359324][T10202] ? __lock_acquire+0x5c0/0x1f40 [ 835.359349][T10202] ? __pfx_iommufd_test+0x10/0x10 [ 835.359379][T10202] ? tomoyo_path_number_perm+0x188/0x580 [ 835.359413][T10202] ? lock_acquire+0x1d1/0x380 [ 835.359437][T10202] ? __might_fault+0xc5/0x140 [ 835.359461][T10202] ? find_held_lock+0x2b/0x80 [ 835.359493][T10202] ? __might_fault+0xc5/0x140 [ 835.359515][T10202] ? __might_fault+0xc5/0x140 [ 835.359549][T10202] iommufd_fops_ioctl+0x358/0x520 [ 835.359573][T10202] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 835.359594][T10202] ? __fget_files+0x34/0x3d0 [ 835.359638][T10202] ? selinux_file_ioctl+0x13b/0x290 [ 835.359669][T10202] ? selinux_file_ioctl+0xb6/0x290 [ 835.359702][T10202] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 835.359728][T10202] __x64_sys_ioctl+0x18e/0x210 [ 835.359758][T10202] do_syscall_64+0x123/0x790 [ 835.359794][T10202] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 835.359824][T10202] RIP: 0033:0x7fb41439e559 [ 835.359843][T10202] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 835.359863][T10202] RSP: 002b:00007fb4152ea028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 835.359884][T10202] RAX: ffffffffffffffda RBX: 00007fb414625fa0 RCX: 00007fb41439e559 [ 835.359898][T10202] RDX: 0000200000000780 RSI: 0000000000003ba0 RDI: 0000000000000003 [ 835.359911][T10202] RBP: 00007fb4152ea090 R08: 0000000000000000 R09: 0000000000000000 [ 835.359924][T10202] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 835.359937][T10202] R13: 00007fb414626038 R14: 00007fb414625fa0 R15: 00007ffe7fcd9fb8 [ 835.359967][T10202] [ 835.360299][ T8631] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 835.360316][ T8631] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 835.649221][T10195] FAULT_INJECTION: forcing a failure. [ 835.649221][T10195] name failslab, interval 1, probability 0, space 0, times 0 [ 835.649258][T10195] CPU: 0 UID: 0 PID: 10195 Comm: syz.0.1059 Not tainted syzkaller #0 PREEMPT(full) [ 835.649292][T10195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 835.649308][T10195] Call Trace: [ 835.649316][T10195] [ 835.649326][T10195] dump_stack_lvl+0x100/0x190 [ 835.649369][T10195] should_fail_ex.cold+0x5/0xa [ 835.649403][T10195] should_failslab+0xc2/0x120 [ 835.649438][T10195] kmem_cache_alloc_noprof+0x92/0x6a0 [ 835.649470][T10195] ? avtab_insert_node+0x2a/0x3c0 [ 835.649500][T10195] avtab_insert_node+0x2a/0x3c0 [ 835.649526][T10195] avtab_insert_nonunique+0x3ad/0x570 [ 835.649557][T10195] cond_dup_av_list+0x19d/0x2b0 [ 835.649592][T10195] cond_policydb_dup+0x444/0x750 [ 835.649633][T10195] security_set_bools+0x13f/0x6c0 [ 835.649671][T10195] sel_commit_bools_write+0x36d/0x420 [ 835.649701][T10195] ? __pfx_sel_commit_bools_write+0x10/0x10 [ 835.649742][T10195] ? __pfx_sel_commit_bools_write+0x10/0x10 [ 835.649772][T10195] vfs_writev+0x5ed/0xdd0 [ 835.649808][T10195] ? __pfx_vfs_writev+0x10/0x10 [ 835.649842][T10195] ? lock_acquire+0x1d1/0x380 [ 835.649870][T10195] ? __fget_files+0x34/0x3d0 [ 835.649916][T10195] ? __fget_files+0x21f/0x3d0 [ 835.649958][T10195] ? do_writev+0x13e/0x340 [ 835.649982][T10195] do_writev+0x13e/0x340 [ 835.650011][T10195] ? __pfx_do_writev+0x10/0x10 [ 835.650047][T10195] do_syscall_64+0x123/0x790 [ 835.650085][T10195] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 835.650109][T10195] RIP: 0033:0x7f18de99e559 [ 835.650129][T10195] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 835.650152][T10195] RSP: 002b:00007f18df7d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 835.650174][T10195] RAX: ffffffffffffffda RBX: 00007f18dec25fa0 RCX: 00007f18de99e559 [ 835.650190][T10195] RDX: 0000000000000002 RSI: 0000200000000540 RDI: 0000000000000006 [ 835.650204][T10195] RBP: 00007f18dea35ab8 R08: 0000000000000000 R09: 0000000000000000 [ 835.650218][T10195] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 835.650233][T10195] R13: 00007f18dec26038 R14: 00007f18dec25fa0 R15: 00007fffdaf149e8 [ 835.650267][T10195] [ 836.197861][T10211] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1029'. [ 836.198510][T10211] veth1_macvtap: left promiscuous mode [ 836.397161][ T5853] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 836.575416][ T5853] usb 5-1: Using ep0 maxpacket: 32 [ 836.583622][ T5853] usb 5-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 836.616454][ T5853] usb 5-1: config 0 has an invalid interface number: 35 but max is 0 [ 836.617306][ T5853] usb 5-1: config 0 has no interface number 0 [ 836.626796][ T5853] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 836.668777][ T5853] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.668808][ T5853] usb 5-1: Product: syz [ 836.668826][ T5853] usb 5-1: Manufacturer: syz [ 836.668843][ T5853] usb 5-1: SerialNumber: syz [ 836.703895][ T5853] usb 5-1: config 0 descriptor?? [ 836.710090][ T5853] radio-si470x 5-1:0.35: could not find interrupt in endpoint [ 836.710156][ T5853] radio-si470x 5-1:0.35: probe with driver radio-si470x failed with error -5 [ 837.283259][ T5853] radio-raremono 5-1:0.35: this is not Thanko's Raremono. [ 837.299532][ T5853] usbhid 5-1:0.35: couldn't find an input interrupt endpoint [ 837.689312][ T5778] usb 1-1: USB disconnect, device number 30 [ 839.191161][T10235] jffs2: notice: (10235) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 839.763947][ T5778] usb 5-1: USB disconnect, device number 25 [ 839.862032][T10241] FAULT_INJECTION: forcing a failure. [ 839.862032][T10241] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 839.862066][T10241] CPU: 0 UID: 0 PID: 10241 Comm: syz.6.1069 Not tainted syzkaller #0 PREEMPT(full) [ 839.862092][T10241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 839.862106][T10241] Call Trace: [ 839.862115][T10241] [ 839.862124][T10241] dump_stack_lvl+0x100/0x190 [ 839.862161][T10241] should_fail_ex.cold+0x5/0xa [ 839.862193][T10241] _copy_from_iter+0x1f4/0x1690 [ 839.862229][T10241] ? __asan_memset+0x23/0x50 [ 839.862257][T10241] ? __pfx__copy_from_iter+0x10/0x10 [ 839.862289][T10241] ? __pfx___alloc_skb+0x10/0x10 [ 839.862324][T10241] netlink_sendmsg+0x808/0xda0 [ 839.862352][T10241] ? __pfx_netlink_sendmsg+0x10/0x10 [ 839.862376][T10241] ? selinux_socket_sendmsg+0x198/0x2f0 [ 839.862418][T10241] ____sys_sendmsg+0xa4d/0xbe0 [ 839.862445][T10241] ? __pfx_netlink_sendmsg+0x10/0x10 [ 839.862470][T10241] ? __pfx_____sys_sendmsg+0x10/0x10 [ 839.862506][T10241] ? lock_acquire+0x1d1/0x380 [ 839.862532][T10241] ? get_pid_task+0x2a/0x250 [ 839.862568][T10241] ___sys_sendmsg+0x190/0x1e0 [ 839.862600][T10241] ? __pfx____sys_sendmsg+0x10/0x10 [ 839.862631][T10241] ? get_pid_task+0x106/0x250 [ 839.862674][T10241] ? find_held_lock+0x2b/0x80 [ 839.862725][T10241] __sys_sendmsg+0x160/0x210 [ 839.862750][T10241] ? __pfx___sys_sendmsg+0x10/0x10 [ 839.862791][T10241] do_syscall_64+0x123/0x790 [ 839.862826][T10241] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 839.862849][T10241] RIP: 0033:0x7fb2bab9e559 [ 839.862867][T10241] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 839.862887][T10241] RSP: 002b:00007fb2bbb21028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 839.862908][T10241] RAX: ffffffffffffffda RBX: 00007fb2bae25fa0 RCX: 00007fb2bab9e559 [ 839.862923][T10241] RDX: 0000000002000800 RSI: 00002000000001c0 RDI: 0000000000000004 [ 839.862937][T10241] RBP: 00007fb2bbb21090 R08: 0000000000000000 R09: 0000000000000000 [ 839.862951][T10241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 839.862964][T10241] R13: 00007fb2bae26038 R14: 00007fb2bae25fa0 R15: 00007fffcd3301d8 [ 839.862996][T10241] [ 845.885130][T10276] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 845.887218][T10276] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 845.887251][T10276] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 845.887263][T10276] One or more global auth toks could not properly register; rc = [-22] [ 845.887315][T10276] Error validating options; rc = [-22] [ 846.494428][T10282] FAULT_INJECTION: forcing a failure. [ 846.494428][T10282] name failslab, interval 1, probability 0, space 0, times 0 [ 846.494479][T10282] CPU: 0 UID: 0 PID: 10282 Comm: syz.0.1080 Not tainted syzkaller #0 PREEMPT(full) [ 846.494506][T10282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 846.494520][T10282] Call Trace: [ 846.494528][T10282] [ 846.494535][T10282] dump_stack_lvl+0x100/0x190 [ 846.494557][T10282] should_fail_ex.cold+0x5/0xa [ 846.494575][T10282] should_failslab+0xc2/0x120 [ 846.494593][T10282] __kmalloc_noprof+0xfc/0x840 [ 846.494608][T10282] ? kvm_sched_clock_read+0x11/0x20 [ 846.494625][T10282] ? iovec_from_user+0x8d/0x140 [ 846.494645][T10282] iovec_from_user+0x8d/0x140 [ 846.494664][T10282] __import_iovec+0x81/0x640 [ 846.494680][T10282] ? pti_set_user_pgtbl+0x50/0x50 [ 846.494692][T10282] ? __might_fault+0xc5/0x140 [ 846.494707][T10282] import_iovec+0x101/0x130 [ 846.494727][T10282] copy_msghdr_from_user+0x2c6/0x4c0 [ 846.494745][T10282] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 846.494769][T10282] ___sys_sendmsg+0x106/0x1e0 [ 846.494786][T10282] ? __pfx____sys_sendmsg+0x10/0x10 [ 846.494808][T10282] ? __fget_files+0x34/0x3d0 [ 846.494842][T10282] __sys_sendmmsg+0x20c/0x440 [ 846.494858][T10282] ? __pfx___sys_sendmmsg+0x10/0x10 [ 846.494876][T10282] ? preempt_schedule_irq+0x79/0x90 [ 846.494906][T10282] __x64_sys_sendmmsg+0x9c/0x100 [ 846.494918][T10282] ? do_syscall_64+0xb4/0x790 [ 846.494935][T10282] do_syscall_64+0x123/0x790 [ 846.494954][T10282] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 846.494966][T10282] RIP: 0033:0x7f18de99e559 [ 846.494983][T10282] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 846.495005][T10282] RSP: 002b:00007f18df7b5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 846.495018][T10282] RAX: ffffffffffffffda RBX: 00007f18dec26090 RCX: 00007f18de99e559 [ 846.495027][T10282] RDX: 0400000000000172 RSI: 0000200000019940 RDI: 0000000000000006 [ 846.495034][T10282] RBP: 00007f18df7b5090 R08: 0000000000000000 R09: 0000000000000000 [ 846.495041][T10282] R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000001 [ 846.495048][T10282] R13: 00007f18dec26128 R14: 00007f18dec26090 R15: 00007fffdaf149e8 [ 846.495065][T10282] [ 847.007584][ T5778] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 847.141609][T10200] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 847.565262][T10286] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1081'. [ 847.565377][ T5778] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 847.566348][ T5778] usb 3-1: config 0 interface 0 altsetting 255 bulk endpoint 0x4 has invalid maxpacket 61 [ 847.566380][ T5778] usb 3-1: config 0 interface 0 has no altsetting 0 [ 847.568263][ T5778] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 847.568289][ T5778] usb 3-1: Product: syz [ 847.568305][ T5778] usb 3-1: Manufacturer: syz [ 847.568322][ T5778] usb 3-1: SerialNumber: syz [ 847.642641][ T5778] usb 3-1: config 0 descriptor?? [ 847.643442][T10273] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 847.666902][T10200] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 847.667959][T10200] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 847.667993][T10200] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 847.668029][T10200] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 847.728661][ T5778] usb 3-1: selecting invalid altsetting 0 [ 847.734392][T10200] cdc_acm 5-1:1.0: probe with driver cdc_acm failed with error -12 [ 847.783628][ T30] audit: type=1400 audit(1792354222.134:602): avc: denied { connect } for pid=10285 comm="syz.0.1081" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 848.864950][T10200] usb 5-1: USB disconnect, device number 26 [ 848.870545][ T30] audit: type=1400 audit(1792354223.154:603): avc: denied { mount } for pid=10272 comm="syz.2.1073" name="/" dev="ramfs" ino=30194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 849.173507][ T5778] usb 3-1: USB disconnect, device number 24 [ 849.835633][T10292] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 850.800437][ T5765] usb 3-1: new full-speed USB device number 25 using dummy_hcd [ 850.972210][ T5765] usb 3-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 851.022993][ T5765] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 851.023315][ T5765] usb 3-1: Product: syz [ 851.023445][ T5765] usb 3-1: Manufacturer: syz [ 851.023639][ T5765] usb 3-1: SerialNumber: syz [ 852.091327][T10306] macvtap1: entered allmulticast mode [ 852.091400][T10306] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 852.091513][T10306] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 852.097953][T10306] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 852.218574][T10308] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 852.241540][T10308] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 852.327120][ T5765] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 25 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 852.940507][T10306] netdevsim netdevsim3 netdevsim0: left allmulticast mode [ 853.140921][ T30] audit: type=1400 audit(1792354227.139:604): avc: denied { read append } for pid=10314 comm="syz.0.1082" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 853.177755][ T30] audit: type=1400 audit(1792354227.139:605): avc: denied { open } for pid=10314 comm="syz.0.1082" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 853.467752][ T5614] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 854.881074][T10200] usb 3-1: USB disconnect, device number 25 [ 855.264138][T10200] usblp0: removed [ 855.457867][ T30] audit: type=1400 audit(1792354229.309:606): avc: denied { write } for pid=10331 comm="syz.2.1093" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 857.060446][ T30] audit: type=1400 audit(1792354230.815:607): avc: denied { ioctl } for pid=10356 comm="syz.0.1098" path="socket:[30484]" dev="sockfs" ino=30484 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 857.457284][T10366] netlink: 'syz.6.1099': attribute type 4 has an invalid length. [ 857.690537][T10367] netlink: 'syz.6.1099': attribute type 4 has an invalid length. [ 859.297633][T10373] fuse: Bad value for 'fd' [ 859.398717][T10375] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 859.601417][T10380] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1104'. [ 859.899158][ T5765] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 859.916430][T10386] netlink: 'syz.3.1106': attribute type 4 has an invalid length. [ 859.966351][ T5642] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 859.973047][T10388] netlink: 'syz.3.1106': attribute type 4 has an invalid length. [ 860.131141][ T5642] usb 5-1: unable to get BOS descriptor or descriptor too short [ 860.131390][ T5642] usb 5-1: New USB device found, idVendor=1235, idProduct=8212, bcdDevice= 0.40 [ 860.133601][ T5642] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 860.133631][ T5642] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 860.178149][ T5642] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 860.178592][ T5642] usb 5-1: Product: syz [ 860.178707][ T5642] usb 5-1: Manufacturer: syz [ 860.178904][ T5642] usb 5-1: SerialNumber: syz [ 860.380093][ T5765] usb 3-1: Using ep0 maxpacket: 8 [ 860.839295][ T5765] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 860.869628][ T5765] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 860.884564][ T5765] pvrusb2: Hardware description: Terratec Grabster AV400 [ 860.884586][ T5765] pvrusb2: ********** [ 860.884594][ T5765] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 860.884608][ T5765] pvrusb2: Important functionality might not be entirely working. [ 860.884617][ T5765] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 860.884627][ T5765] pvrusb2: ********** [ 860.941801][ T30] audit: type=1400 audit(1792354234.444:608): avc: denied { map } for pid=10383 comm="syz.4.1105" path="/dev/tty3" dev="devtmpfs" ino=22 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 860.942275][ T30] audit: type=1400 audit(1792354234.444:609): avc: denied { execute } for pid=10383 comm="syz.4.1105" path="/dev/tty3" dev="devtmpfs" ino=22 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 861.502755][ T2347] pvrusb2: Invalid write control endpoint [ 861.614951][T10200] usb 3-1: USB disconnect, device number 26 [ 861.743566][T10396] netlink: 'syz.6.1107': attribute type 4 has an invalid length. [ 861.775399][T10396] netlink: 'syz.6.1107': attribute type 4 has an invalid length. [ 862.733006][T10398] input: syz0 as /devices/virtual/input/input30 [ 863.469787][ T5642] usb 5-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8212); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 863.470091][ T5642] usb 5-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 863.987965][ T2347] pvrusb2: Invalid write control endpoint [ 863.987985][ T2347] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 863.987995][ T2347] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 863.988004][ T2347] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 863.988014][ T2347] pvrusb2: Device being rendered inoperable [ 863.988314][ T2347] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 863.988368][ T2347] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 864.160382][ T2347] pvrusb2: Attached sub-driver cx25840 [ 864.160402][ T2347] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 864.160412][ T2347] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 864.361553][T10414] Bluetooth: hci0: unsupported parameter 5134 [ 864.361575][T10414] Bluetooth: hci0: unsupported parameter 8192 [ 864.361591][T10414] Bluetooth: hci0: unsupported parameter 5134 [ 864.361605][T10414] Bluetooth: hci0: unsupported parameter 8192 [ 864.367043][T10415] rdma_op ffff88805425a238 conn xmit_rdma 0000000000000000 [ 864.427296][ T5642] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 864.446043][ T5642] usb 5-1: USB disconnect, device number 27 [ 864.831148][T10200] usb 1-1: new full-speed USB device number 31 using dummy_hcd [ 865.053395][T10136] udevd[10136]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 865.099342][T10200] usb 1-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 865.200887][T10200] usb 1-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 865.200928][T10200] usb 1-1: Product: syz [ 865.200972][T10200] usb 1-1: Manufacturer: syz [ 865.201014][T10200] usb 1-1: SerialNumber: syz [ 865.406415][T10409] syzkaller0: entered promiscuous mode [ 865.406479][T10409] syzkaller0: entered allmulticast mode [ 865.535465][T10200] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 865.676767][T10422] fuse: Bad value for 'group_id' [ 865.676788][T10422] fuse: Bad value for 'group_id' [ 865.866943][T10200] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 865.866982][T10200] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 865.988121][T10427] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1115'. [ 866.182945][T10200] usb 1-1: USB disconnect, device number 31 [ 868.349089][ T5853] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 868.527619][T10440] random: crng reseeded on system resumption [ 868.567635][ T5853] usb 3-1: unable to get BOS descriptor or descriptor too short [ 868.567684][ T5853] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0103, bcdDevice= 0.40 [ 868.568483][ T5853] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 868.568520][ T5853] usb 3-1: can't read configurations, error -71 [ 871.285818][T10422] ipip0: entered promiscuous mode [ 871.285834][T10422] ipip0: entered allmulticast mode [ 871.287125][T10422] team0: Device ipip0 is of different type [ 871.414246][T10454] rdma_op ffff888056484238 conn xmit_rdma 0000000000000000 [ 871.521090][T10459] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1128'. [ 871.521126][T10459] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1128'. [ 871.536114][T10459] gretap0: entered promiscuous mode [ 871.541237][ T5642] usb 3-1: new full-speed USB device number 29 using dummy_hcd [ 871.541449][T10459] gretap0: left promiscuous mode [ 871.590561][ T30] audit: type=1400 audit(1792354244.406:610): avc: denied { mounton } for pid=10456 comm="syz.3.1127" path="/235/rpc_pipefs/gssd/clntXX/gssd" dev="rpc_pipefs" ino=1048742 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=fifo_file permissive=1 [ 871.593472][T10463] mac80211_hwsim hwsim6 wlan0: left promiscuous mode [ 872.757557][ T5642] usb 3-1: device descriptor read/64, error -71 [ 872.965132][ T30] audit: type=1800 audit(1792354245.688:611): pid=10469 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.1130" name="file0" dev="overlay" ino=1309 res=0 errno=0 [ 873.094298][ T5642] usb 3-1: new full-speed USB device number 30 using dummy_hcd [ 873.323673][ T5642] usb 3-1: device descriptor read/64, error -71 [ 873.436630][ T5642] usb usb3-port1: attempt power cycle [ 873.537257][ T30] audit: type=1400 audit(1792354246.221:612): avc: denied { unmount } for pid=5639 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 873.606316][T10472] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1132'. [ 873.611781][T10472] tmpfs: Bad value for 'mpol' [ 873.881540][ T5642] usb 3-1: new full-speed USB device number 31 using dummy_hcd [ 873.906619][ T5642] usb 3-1: device descriptor read/8, error -71 [ 873.958589][ T30] audit: type=1804 audit(1792354246.614:613): pid=10482 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.4.1137" name="/newroot/229/file1" dev="tmpfs" ino=1320 res=1 errno=0 [ 873.993679][ T29] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 874.129115][ T9232] IPVS: starting estimator thread 0... [ 874.129641][T10487] FAULT_INJECTION: forcing a failure. [ 874.129641][T10487] name failslab, interval 1, probability 0, space 0, times 0 [ 874.129670][T10487] CPU: 1 UID: 0 PID: 10487 Comm: syz.3.1138 Not tainted syzkaller #0 PREEMPT(full) [ 874.129696][T10487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 874.129710][T10487] Call Trace: [ 874.129718][T10487] [ 874.129727][T10487] dump_stack_lvl+0x100/0x190 [ 874.129766][T10487] should_fail_ex.cold+0x5/0xa [ 874.129792][T10487] ? stack_depot_save_flags+0x27/0x9f0 [ 874.129820][T10487] should_failslab+0xc2/0x120 [ 874.129853][T10487] kmem_cache_alloc_noprof+0x92/0x6a0 [ 874.129885][T10487] ? kasan_save_stack+0x3f/0x50 [ 874.129913][T10487] ? kasan_save_stack+0x30/0x50 [ 874.129941][T10487] ? radix_tree_node_alloc.constprop.0+0x81/0x360 [ 874.129975][T10487] radix_tree_node_alloc.constprop.0+0x81/0x360 [ 874.130014][T10487] idr_get_free+0x52e/0xa00 [ 874.130053][T10487] idr_alloc_u32+0x1ac/0x320 [ 874.130087][T10487] ? __pfx_idr_alloc_u32+0x10/0x10 [ 874.130117][T10487] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 874.130159][T10487] idr_alloc+0xc0/0x130 [ 874.130191][T10487] ? __pfx_idr_alloc+0x10/0x10 [ 874.130221][T10487] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 874.130261][T10487] tipc_conn_alloc+0x337/0x590 [ 874.130294][T10487] tipc_topsrv_kern_subscr+0x11c/0x3c0 [ 874.130327][T10487] ? __pfx_tipc_topsrv_kern_subscr+0x10/0x10 [ 874.130359][T10487] ? net_generic+0xea/0x2a0 [ 874.130395][T10487] tipc_group_create+0x4ab/0x660 [ 874.130432][T10487] tipc_setsockopt+0x611/0xe30 [ 874.130458][T10487] ? __pfx_tipc_setsockopt+0x10/0x10 [ 874.130484][T10487] ? __fget_files+0x215/0x3d0 [ 874.130519][T10487] ? selinux_socket_setsockopt+0x6a/0x80 [ 874.130548][T10487] ? __pfx_tipc_setsockopt+0x10/0x10 [ 874.130575][T10487] do_sock_setsockopt+0xf3/0x1d0 [ 874.130606][T10487] __sys_setsockopt+0x195/0x220 [ 874.130635][T10487] __x64_sys_setsockopt+0xbd/0x160 [ 874.130657][T10487] ? do_syscall_64+0xae/0x790 [ 874.130688][T10487] ? lockdep_hardirqs_on+0x7d/0x110 [ 874.130717][T10487] do_syscall_64+0x123/0x790 [ 874.130748][T10487] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 874.130771][T10487] RIP: 0033:0x7fa88759e559 [ 874.130789][T10487] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 874.130810][T10487] RSP: 002b:00007fa8857f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 874.130829][T10487] RAX: ffffffffffffffda RBX: 00007fa887825fa0 RCX: 00007fa88759e559 [ 874.130842][T10487] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000003 [ 874.130853][T10487] RBP: 00007fa8857f6090 R08: 0000000000000043 R09: 0000000000000000 [ 874.130865][T10487] R10: 0000200000000a40 R11: 0000000000000246 R12: 0000000000000001 [ 874.130878][T10487] R13: 00007fa887826038 R14: 00007fa887825fa0 R15: 00007ffc70b70648 [ 874.130907][T10487] [ 874.154978][ T29] usb 1-1: Using ep0 maxpacket: 16 [ 874.156462][ T29] usb 1-1: New USB device found, idVendor=fff0, idProduct=fff0, bcdDevice=63.0c [ 874.157396][ T29] usb 1-1: config 0 has an invalid interface number: 99 but max is 0 [ 874.157420][ T29] usb 1-1: config 0 has no interface number 0 [ 874.157456][ T29] usb 1-1: config 0 interface 99 altsetting 0 has an endpoint descriptor with address 0x51, changing to 0x1 [ 874.157482][ T29] usb 1-1: config 0 interface 99 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 874.160479][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.160505][ T29] usb 1-1: Product: syz [ 874.160521][ T29] usb 1-1: Manufacturer: syz [ 874.160538][ T29] usb 1-1: SerialNumber: syz [ 874.165920][ T5642] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 874.167832][ T29] usb 1-1: config 0 descriptor?? [ 874.170133][T10489] rdma_op ffff88802da7da38 conn xmit_rdma 0000000000000000 [ 874.178502][ T29] usbtest 1-1:0.99: usb test device [ 874.178524][ T29] usbtest 1-1:0.99: high-speed {control in/out iso-out} tests (+alt) [ 874.185289][ T5642] usb 3-1: device descriptor read/8, error -71 [ 874.216633][T10488] IPVS: using max 34 ests per chain, 81600 per kthread [ 874.271329][T10484] IPVS: nq: FWM 3 0x00000003 - no destination available [ 874.304200][ T5642] usb usb3-port1: unable to enumerate USB device [ 874.503319][ T5642] usb 1-1: USB disconnect, device number 32 [ 874.639763][T10501] binder: 10500:10501 ioctl c00c6211 0 returned -14 [ 875.860543][T10512] FAULT_INJECTION: forcing a failure. [ 875.860543][T10512] name failslab, interval 1, probability 0, space 0, times 0 [ 875.860574][T10512] CPU: 1 UID: 0 PID: 10512 Comm: syz.2.1147 Not tainted syzkaller #0 PREEMPT(full) [ 875.860596][T10512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 875.860608][T10512] Call Trace: [ 875.860614][T10512] [ 875.860622][T10512] dump_stack_lvl+0x100/0x190 [ 875.860653][T10512] should_fail_ex.cold+0x5/0xa [ 875.860674][T10512] ? __netlink_lookup+0x692/0x950 [ 875.860713][T10512] should_failslab+0xc2/0x120 [ 875.860745][T10512] kmem_cache_alloc_noprof+0x92/0x6a0 [ 875.860774][T10512] ? skb_clone+0x190/0x400 [ 875.860803][T10512] skb_clone+0x190/0x400 [ 875.860828][T10512] netlink_deliver_tap+0xaed/0xcc0 [ 875.860869][T10512] netlink_unicast+0x6ff/0x950 [ 875.860896][T10512] ? __pfx_netlink_unicast+0x10/0x10 [ 875.860934][T10512] netlink_sendmsg+0x8b0/0xda0 [ 875.860962][T10512] ? __pfx_netlink_sendmsg+0x10/0x10 [ 875.860987][T10512] ? selinux_socket_sendmsg+0x198/0x2f0 [ 875.861028][T10512] ____sys_sendmsg+0xa4d/0xbe0 [ 875.861056][T10512] ? __pfx_netlink_sendmsg+0x10/0x10 [ 875.861081][T10512] ? __pfx_____sys_sendmsg+0x10/0x10 [ 875.861118][T10512] ? lock_acquire+0x1d1/0x380 [ 875.861145][T10512] ? get_pid_task+0x2a/0x250 [ 875.861179][T10512] ___sys_sendmsg+0x190/0x1e0 [ 875.861212][T10512] ? __pfx____sys_sendmsg+0x10/0x10 [ 875.861243][T10512] ? get_pid_task+0x106/0x250 [ 875.861286][T10512] ? find_held_lock+0x2b/0x80 [ 875.861341][T10512] __sys_sendmsg+0x160/0x210 [ 875.861366][T10512] ? __pfx___sys_sendmsg+0x10/0x10 [ 875.861407][T10512] do_syscall_64+0x123/0x790 [ 875.861444][T10512] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.861468][T10512] RIP: 0033:0x7fb41439e559 [ 875.861487][T10512] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 875.861508][T10512] RSP: 002b:00007fb4152c9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 875.861530][T10512] RAX: ffffffffffffffda RBX: 00007fb414626090 RCX: 00007fb41439e559 [ 875.861546][T10512] RDX: 0000000020000050 RSI: 0000200000000100 RDI: 0000000000000003 [ 875.861560][T10512] RBP: 00007fb4152c9090 R08: 0000000000000000 R09: 0000000000000000 [ 875.861574][T10512] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 875.861587][T10512] R13: 00007fb414626128 R14: 00007fb414626090 R15: 00007ffe7fcd9fb8 [ 875.861620][T10512] [ 875.861679][T10512] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1147'. [ 877.564640][ T4916] Bluetooth: hci5: command 0x0406 tx timeout [ 877.795697][T10524] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1151'. [ 877.808422][T10200] usb 4-1: new full-speed USB device number 38 using dummy_hcd [ 878.998691][T10200] usb 4-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 879.001817][T10200] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 879.001844][T10200] usb 4-1: Product: syz [ 879.001862][T10200] usb 4-1: Manufacturer: syz [ 879.001879][T10200] usb 4-1: SerialNumber: syz [ 879.004477][T10200] usb 4-1: config 0 descriptor?? [ 879.236725][ T30] audit: type=1400 audit(1792354251.553:614): avc: denied { execute } for pid=10534 comm="syz.2.1156" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 879.241834][ T5765] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 879.308914][T10518] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 879.309351][T10518] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 879.311818][ T5853] usb 4-1: USB disconnect, device number 38 [ 879.430923][ T5765] usb 7-1: Using ep0 maxpacket: 32 [ 879.438934][ T5765] usb 7-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 879.445941][ T5765] usb 7-1: config 0 has an invalid interface number: 35 but max is 0 [ 879.445968][ T5765] usb 7-1: config 0 has no interface number 0 [ 879.446005][ T5765] usb 7-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 879.458480][ T5765] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 879.458506][ T5765] usb 7-1: Product: syz [ 879.458531][ T5765] usb 7-1: Manufacturer: syz [ 879.458547][ T5765] usb 7-1: SerialNumber: syz [ 879.475682][ T5765] usb 7-1: config 0 descriptor?? [ 879.497951][ T5765] radio-si470x 7-1:0.35: could not find interrupt in endpoint [ 879.498018][ T5765] radio-si470x 7-1:0.35: probe with driver radio-si470x failed with error -5 [ 879.725988][T10541] FAULT_INJECTION: forcing a failure. [ 879.725988][T10541] name failslab, interval 1, probability 0, space 0, times 0 [ 879.726029][T10541] CPU: 1 UID: 0 PID: 10541 Comm: syz.2.1159 Not tainted syzkaller #0 PREEMPT(full) [ 879.726056][T10541] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 879.726070][T10541] Call Trace: [ 879.726078][T10541] [ 879.726086][T10541] dump_stack_lvl+0x100/0x190 [ 879.726124][T10541] should_fail_ex.cold+0x5/0xa [ 879.726157][T10541] should_failslab+0xc2/0x120 [ 879.726190][T10541] __kmalloc_noprof+0xfc/0x840 [ 879.726217][T10541] ? rcu_is_watching+0x13/0xc0 [ 879.726249][T10541] ? tomoyo_realpath_from_path+0xb6/0x690 [ 879.726279][T10541] tomoyo_realpath_from_path+0xb6/0x690 [ 879.726306][T10541] tomoyo_path_number_perm+0x23c/0x580 [ 879.726333][T10541] ? tomoyo_path_number_perm+0x22e/0x580 [ 879.726363][T10541] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 879.726405][T10541] ? __lock_acquire+0x5c0/0x1f40 [ 879.726446][T10541] ? __fget_files+0x34/0x3d0 [ 879.726478][T10541] ? find_held_lock+0x2b/0x80 [ 879.726510][T10541] ? hook_file_ioctl_common+0x140/0x440 [ 879.726538][T10541] ? __fget_files+0x21f/0x3d0 [ 879.726573][T10541] security_file_ioctl+0xd3/0x230 [ 879.726607][T10541] __x64_sys_ioctl+0xb7/0x210 [ 879.726637][T10541] do_syscall_64+0x123/0x790 [ 879.726673][T10541] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 879.726696][T10541] RIP: 0033:0x7fb41439e559 [ 879.726715][T10541] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 879.726735][T10541] RSP: 002b:00007fb4152ea028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 879.726757][T10541] RAX: ffffffffffffffda RBX: 00007fb414625fa0 RCX: 00007fb41439e559 [ 879.726772][T10541] RDX: 0000200000000400 RSI: 0000000000001277 RDI: 0000000000000003 [ 879.726787][T10541] RBP: 00007fb4152ea090 R08: 0000000000000000 R09: 0000000000000000 [ 879.726801][T10541] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 879.726815][T10541] R13: 00007fb414626038 R14: 00007fb414625fa0 R15: 00007ffe7fcd9fb8 [ 879.726847][T10541] [ 879.727776][T10541] ERROR: Out of memory at tomoyo_realpath_from_path. [ 880.071520][ T5765] radio-raremono 7-1:0.35: this is not Thanko's Raremono. [ 880.071857][ T5765] usbhid 7-1:0.35: couldn't find an input interrupt endpoint [ 880.185337][T10548] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 881.201154][ T30] audit: type=1400 audit(1792354253.395:615): avc: denied { map } for pid=10559 comm="syz.3.1164" path="socket:[31898]" dev="sockfs" ino=31898 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 881.201208][ T30] audit: type=1400 audit(1792354253.395:616): avc: denied { accept } for pid=10559 comm="syz.3.1164" path="socket:[31898]" dev="sockfs" ino=31898 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 881.888611][T10564] WARNING! power/level is deprecated; use power/control instead [ 885.075973][ T5795] usb 7-1: USB disconnect, device number 2 [ 885.362160][T10598] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1176'. [ 885.362204][T10598] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1176'. [ 885.389647][T10600] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1176'. [ 885.389673][T10600] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1176'. [ 885.509778][T10603] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1179'. [ 885.568235][T10606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 885.568598][T10606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 886.589452][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 886.589506][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 886.686627][ T30] audit: type=1400 audit(1792354258.521:617): avc: denied { listen } for pid=10602 comm="syz.6.1179" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 886.735297][ T5795] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 886.906694][ T5795] usb 4-1: New USB device found, idVendor=0cf2, idProduct=6250, bcdDevice= 0.00 [ 886.909037][ T5795] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 886.909058][ T5795] usb 4-1: Product: syz [ 886.909067][ T5795] usb 4-1: Manufacturer: syz [ 886.909079][ T5795] usb 4-1: SerialNumber: syz [ 886.982088][T10616] FAULT_INJECTION: forcing a failure. [ 886.982088][T10616] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 886.982143][T10616] CPU: 1 UID: 0 PID: 10616 Comm: syz.0.1180 Not tainted syzkaller #0 PREEMPT(full) [ 886.982170][T10616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 886.982184][T10616] Call Trace: [ 886.982192][T10616] [ 886.982201][T10616] dump_stack_lvl+0x100/0x190 [ 886.982239][T10616] should_fail_ex.cold+0x5/0xa [ 886.982271][T10616] _copy_from_user+0x2e/0xd0 [ 886.982306][T10616] memdup_user+0x6b/0xe0 [ 886.982332][T10616] snd_pcm_common_ioctl+0x1374/0x3490 [ 886.982369][T10616] ? do_vfs_ioctl+0x226/0x13e0 [ 886.982398][T10616] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 886.982427][T10616] ? __pfx_snd_pcm_common_ioctl+0x10/0x10 [ 886.982464][T10616] ? __fget_files+0x34/0x3d0 [ 886.982515][T10616] snd_pcm_ioctl+0x84/0xc0 [ 886.982545][T10616] ? __pfx_snd_pcm_ioctl+0x10/0x10 [ 886.982580][T10616] __x64_sys_ioctl+0x18e/0x210 [ 886.982610][T10616] do_syscall_64+0x123/0x790 [ 886.982647][T10616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 886.982671][T10616] RIP: 0033:0x7f18de99e559 [ 886.982689][T10616] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 886.982710][T10616] RSP: 002b:00007f18df794028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 886.982733][T10616] RAX: ffffffffffffffda RBX: 00007f18dec26180 RCX: 00007f18de99e559 [ 886.982749][T10616] RDX: 00002000000002c0 RSI: 00000000c2604111 RDI: 0000000000000005 [ 886.982764][T10616] RBP: 00007f18df794090 R08: 0000000000000000 R09: 0000000000000000 [ 886.982778][T10616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 886.982793][T10616] R13: 00007f18dec26218 R14: 00007f18dec26180 R15: 00007fffdaf149e8 [ 886.982826][T10616] [ 887.395081][ T5795] ums_eneub6250 4-1:1.0: USB Mass Storage device detected [ 887.620983][ T5795] scsi host1: usb-storage 4-1:1.0 [ 889.153965][ T32] INFO: task syz.1.868:9352 blocked for more than 144 seconds. [ 889.154003][ T32] Not tainted syzkaller #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 889.154041][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 889.154084][ T32] task:syz.1.868 state:D stack:26824 pid:9352 tgid:9342 ppid:5640 task_flags:0x400140 flags:0x00080002 [ 889.154315][ T32] Call Trace: [ 889.154352][ T32] [ 889.154423][ T32] __schedule+0x1259/0x6920 [ 889.154493][ T32] ? __lock_acquire+0x5c0/0x1f40 [ 889.154599][ T32] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 889.154711][ T32] ? __pfx___schedule+0x10/0x10 [ 889.154744][ T32] ? find_held_lock+0x2b/0x80 [ 889.154814][ T32] ? schedule+0x225/0x2c0 [ 889.154883][ T32] schedule+0xdd/0x2c0 [ 889.154919][ T32] schedule_preempt_disabled+0x13/0x30 [ 889.154955][ T32] __mutex_lock+0xccb/0x1bd0 [ 889.155055][ T32] ? nfsd_nrthreads+0x57/0xd0 [ 889.155162][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 889.155231][ T32] ? irqentry_exit+0x24d/0xa10 [ 889.155334][ T32] ? lock_acquire+0x1d1/0x380 [ 889.155402][ T32] ? net_generic+0xea/0x2a0 [ 889.155437][ T32] ? net_generic+0xea/0x2a0 [ 889.155577][ T32] ? nfsd_nrthreads+0x57/0xd0 [ 889.282459][ T32] nfsd_nrthreads+0x57/0xd0 [ 889.282559][ T32] write_threads+0x34a/0x600 [ 889.282595][ T32] ? __pfx_write_threads+0x10/0x10 [ 889.282624][ T32] ? lockdep_hardirqs_on+0x7d/0x110 [ 889.282663][ T32] ? irqentry_exit+0x24d/0xa10 [ 889.282760][ T32] ? __pfx_write_threads+0x10/0x10 [ 889.283354][ T32] ? __pfx_write_threads+0x10/0x10 [ 889.299647][ T32] nfsctl_transaction_write+0x106/0x1a0 [ 889.299702][ T32] vfs_write+0x2aa/0x1050 [ 889.299732][ T32] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 889.299770][ T32] ? __pfx_vfs_write+0x10/0x10 [ 889.299806][ T32] ? __fget_files+0x21f/0x3d0 [ 889.299846][ T32] ksys_write+0x12a/0x250 [ 889.299873][ T32] ? __pfx_ksys_write+0x10/0x10 [ 889.299910][ T32] do_syscall_64+0x123/0x790 [ 889.299946][ ** replaying previous printk message ** [ 889.299946][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.299970][ T32] RIP: 0033:0x7f8caa79e559 [ 889.299988][ T32] RSP: 002b:00007f8cab671028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 889.300010][ T32] RAX: ffffffffffffffda RBX: 00007f8caaa26090 RCX: 00007f8caa79e559 [ 889.300026][ T32] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009 [ 889.300039][ T32] RBP: 00007f8caa835ab8 R08: 0000000000000000 R09: 0000000000000000 [ 889.300053][ T32] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 889.300068][ T32] R13: 00007f8caaa26128 R14: 00007f8caaa26090 R15: 00007ffe7955b3d8 [ 889.300099][ T32] [ 889.300143][ T32] [ 889.300143][ T32] Showing all locks held in the system: [ 889.300156][ T32] locks held by kworker/0:0/9: 1, last CPU#0: [ 889.300172][ T32] #0: ffffffff8fdec5e0 (rcu_read_lock){....}-{1:3}, at: process_one_work+0x880/0x1b10 [ 889.300223][ T32] locks held by kworker/u8:0/12: 3, last CPU#0: [ 889.300238][ T32] #0: ffff88801d094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 889.300283][ T32] #1: ffffc90000117d08 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 889.300327][ T32] #2: ffff888055c80800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x92/0x550 [ 889.318757][ T32] locks held by pr/ttyS0/31: 1, last CPU#1: [ 889.318775][ T32] #0: ffffffff8fdd88f8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x49/0x60 [ 889.318838][ T32] locks held by khungtaskd/32: 1, last CPU#0: [ 889.318854][ T32] #0: ffffffff8fdec5e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 889.318939][ T32] locks held by dhcpcd/5261: 3, last CPU#0: [ 889.318955][ T32] #0: ffffffff8ff3ded0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x5079/0x8430 [ 889.334584][ T32] #1: ffff88801d07f180 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2370 [ 889.334653][ T32] #2: ffff88807f1b4080 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2370 [ 889.334725][ T32] locks held by getty/5354: 2, on CPU#0: [ 889.334742][ T32] #0: ffff8880369f30a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 889.334800][ T32] #1: ffffc900032432e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 [ 889.334854][ T32] locks held by syz-executor/5626: 2, last CPU#0: [ 889.334873][ T32] #0: ffff888076499bc0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 [ 889.334930][ T32] #1: ffffffff8fdec5e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 [ 889.334986][ T32] locks held by syz-executor/5637: 2, last CPU#0: [ 889.335001][ T32] #0: ffff88802ea8c460 (sb_writers#6){.+.+}-{0:0}, at: filename_unlinkat+0x1ad/0x730 [ 889.335054][ T32] #1: ffffffff8fdec5e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x2090 [ 889.335113][ T32] locks held by syz-executor/5638: 1, last CPU#0: [ 889.335129][ T32] #0: ffff888028320460 (sb_writers#6){.+.+}-{0:0}, at: filename_unlinkat+0x1ad/0x730 [ 889.335187][ T32] locks held by kworker/1:6/5786: 1, last CPU#1: [ 889.335200][ T32] #0: ffff88805678c940 ((wq_completion)wg-crypt-wg0#7){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 889.335254][ T32] locks held by kworker/0:5/5795: 9, last CPU#0: [ 889.335270][ T32] #0: ffff88802528c140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 889.335319][ T32] #1: ffffc90004c8fd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 889.335367][ T32] #2: ffff88802cb551d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420 [ 889.335420][ T32] #3: ffff8880394461d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 [ 889.335467][ T32] #4: ffff8880568221a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 [ 889.335514][ T32] #5: ffff88801e2c72a0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x49/0x120 [ 889.335572][ T32] #6: ffff88801e2c7180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x51/0x120 [ 889.335637][ T32] #7: ffff88801e2c7210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: __kernfs_remove+0x3fe/0xb80 [ 889.335716][ T32] #8: ffffffff8fdec5e0 (rcu_read_lock){....}-{1:3}, at: kernfs_root+0x23/0x2a0 [ 889.335766][ T32] locks held by kworker/u8:9/5982: 1, last CPU#0: [ 889.335781][ T32] #0: ffff88801d094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 889.335831][ T32] locks held by kworker/u8:12/5985: 3, last CPU#0: [ 889.335847][ T32] #0: ffff88801d094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 889.335895][ T32] #1: ffffc90005427d08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 889.335945][ T32] #2: ffff88807e329258 (&devlink->lock_key#4){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 [ 889.336004][ T32] locks held by kworker/u8:13/7626: 3, last CPU#0: [ 889.336020][ T32] #0: ffff88801d094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 889.336068][ T32] #1: ffffc9000bb2fd08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 889.336119][ T32] #2: ffff88807fcdb258 (&devlink->lock_key#6){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 [ 889.336186][ T32] locks held by kworker/u8:14/7738: 3, last CPU#0: [ 889.352280][ T32] #0: ffff8880351bb940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 889.470846][ T32] #1: ffffc90005857d08 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 889.470899][ T32] #2: ffff888027bbe1c8 (&hard_iface->bat_iv.ogm_buff_mutex){+.+.}-{4:4}, at: batadv_iv_send_outstanding_bat_ogm_packet+0x50f/0x7d0 [ 889.470968][ T32] locks held by syz.1.868/9345: 3, on CPU#1: [ 889.470985][ T32] #0: ffff888058f89970 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 889.471034][ T32] #1: ffff888035c26460 (sb_writers#21){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 889.471093][ T32] #2: ffffffff90289d60 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xa5/0xcc0 [ 889.471142][ T32] locks held by syz.1.868/9352: 3, on CPU#0: [ 889.471158][ T32] #0: ffff88802817eef0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 889.471204][ T32] #1: ffff888035c26460 (sb_writers#21){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 889.471263][ T32] #2: ffffffff90289d60 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nrthreads+0x57/0xd0 [ 889.471347][ T32] locks held by syz.5.981/9844: 3, on CPU#1: [ 889.471363][ T32] #0: ffff88807b540630 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 889.471412][ T32] #1: ffff888022b8e460 (sb_writers#21){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 889.471470][ T32] #2: ffffffff90289d60 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xa5/0xcc0 [ 889.471517][ T32] locks held by syz.5.981/9847: 3, on CPU#1: [ 889.471533][ T32] #0: ffff88807715bb30 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 889.471581][ T32] #1: ffff888022b8e460 (sb_writers#21){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 889.471655][ T32] #2: ffffffff90289d60 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nrthreads+0x57/0xd0 [ 889.471719][ T32] locks held by kworker/1:2/10200: 2, last CPU#1: [ 889.471735][ T32] #0: ffff88801d059d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 889.471784][ T32] #1: ffffc9000667fd08 ((gc_work).work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 889.471833][ T32] locks held by syz.2.1151/10526: 2, last CPU#0: [ 889.471848][ T32] #0: ffff888028320460 (sb_writers#6){.+.+}-{0:0}, at: get_signal+0x1f2a/0x21e0 [ 889.471992][ T32] #1: ffff888029a18890 (&sb->s_type->i_mutex_key#16){+.+.}-{4:4}, at: shmem_file_write_iter+0x86/0x140 [ 889.472055][ T32] locks held by udevd/10593: 4, on CPU#1: [ 889.472070][ T32] #0: ffff888027ddef38 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 [ 889.472126][ T32] #1: ffff8880566c5080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 [ 889.472186][ T32] #2: ffff88808016c5a8 (kn->active#28){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 [ 889.472246][ T32] #3: ffff8880394461d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 889.484350][ T32] locks held by syz.3.1177/10604: 2, last CPU#0: [ 889.484371][ T32] #0: ffff888039764080 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 [ 889.484434][ T32] #1: ffffffff8fdec5e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 [ 889.484491][ T32] locks held by syz.6.1182/10619: 1, last CPU#0: [ 889.484507][ T32] #0: ffff88807f1b5900 (&mm->mmap_lock){++++}-{4:4}, at: do_exit+0x736/0x2a60 [ 889.484564][ T32] locks held by syz.6.1182/10621: 2, on CPU#0: [ 889.484579][ T32] #0: ffff888034c32160 (&rmidi->open_mutex){+.+.}-{4:4}, at: snd_rawmidi_release+0x66/0x110 [ 889.484639][ T32] #1: ffffffff8fdf84e8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 889.484699][ T32] locks held by syz.0.1183/10623: 1, on CPU#0: [ 889.484715][ T32] #0: ffff888034c32160 (&rmidi->open_mutex){+.+.}-{4:4}, at: snd_rawmidi_release+0x66/0x110 [ 889.484773][ T32] locks held by dhcpcd/10628: 2, on CPU#0: [ 889.484788][ T32] #0: ffff888036cca260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf50 [ 889.484842][ T32] #1: ffffffff8fdf84e8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 889.484912][ T32] [ 889.484918][ T32] ============================================= [ 889.484918][ T32] [ 889.484947][ T32] NMI backtrace for cpu 0 [ 889.484960][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 889.484985][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 889.484999][ T32] Call Trace: [ 889.485007][ T32] [ 889.485016][ T32] dump_stack_lvl+0x100/0x190 [ 889.485049][ T32] nmi_cpu_backtrace.cold+0x12d/0x151 [ 889.485084][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 889.485111][ T32] nmi_trigger_cpumask_backtrace+0x21f/0x2a0 [ 889.485141][ T32] sys_info+0x141/0x190 [ 889.485164][ T32] watchdog+0xcb1/0x1030 [ 889.485197][ T32] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 889.485227][ T32] ? __pfx_watchdog+0x10/0x10 [ 889.485256][ T32] ? __kthread_parkme+0x18f/0x230 [ 889.485288][ T32] ? kthread+0x13a/0x450 [ 889.485317][ T32] ? __pfx_watchdog+0x10/0x10 [ 889.485341][ T32] kthread+0x373/0x450 [ 889.485371][ T32] ? __pfx_kthread+0x10/0x10 [ 889.485404][ T32] ret_from_fork+0x730/0xd60 [ 889.485430][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 889.485458][ T32] ? __switch_to+0x800/0x10f0 [ 889.485488][ T32] ? __pfx_kthread+0x10/0x10 [ 889.485520][ T32] ret_from_fork_asm+0x1a/0x30 [ 889.485560][ T32] [ 889.485584][ T32] Sending NMI from CPU 0 to CPUs 1: [ 889.485613][ C1] NMI backtrace for cpu 1 [ 889.485625][ C1] CPU: 1 UID: 0 PID: 31 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) [ 889.485648][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 889.485661][ C1] RIP: 0010:delay_tsc+0x32/0xc0 [ 889.485687][ C1] Code: fd bf 01 00 00 00 41 54 55 53 e8 29 16 04 f6 e8 64 7f 01 00 41 89 c4 0f 01 f9 66 90 48 c1 e2 20 48 09 c2 48 89 d5 eb 16 f3 90 01 00 00 00 e8 04 16 04 f6 e8 3f 7f 01 00 44 39 e0 75 36 0f 01 [ 889.485706][ C1] RSP: 0018:ffffc90000a77950 EFLAGS: 00000082 [ 889.485722][ C1] RAX: 8000000000000002 RBX: 000002496db9990e RCX: 0000000000000000 [ 889.485736][ C1] RDX: 0000000000000004 RSI: ffffffff8c625600 RDI: 0000000000000001 [ 889.485749][ C1] RBP: 000002496db99374 R08: 0000000000000005 R09: 0000000000000000 [ 889.485762][ C1] R10: 000000000000072a R11: 205d323354202020 R12: 0000000000000001 [ 889.485776][ C1] R13: 0000000000000af1 R14: fffffbfff398fd29 R15: dffffc0000000000 [ 889.485789][ C1] FS: 0000000000000000(0000) GS:ffff888122a46000(0000) knlGS:0000000000000000 [ 889.485809][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 889.485823][ C1] CR2: 0000001b2f00bff8 CR3: 000000008341e000 CR4: 00000000003526f0 [ 889.485837][ C1] Call Trace: [ 889.485843][ C1] [ 889.485853][ C1] wait_for_lsr+0xf3/0x210 [ 889.485877][ C1] serial8250_fifo_wait_for_lsr_thre+0x5f/0xd0 [ 889.485902][ C1] __serial8250_console_fifo_write+0xa5/0x290 [ 889.485923][ C1] ? __pfx_io_serial_out+0x10/0x10 [ 889.485956][ C1] serial8250_console_write+0x1108/0x14f0 [ 889.485984][ C1] ? __pfx_serial8250_console_write+0x10/0x10 [ 889.486009][ C1] ? __nbcon_context_update_unsafe+0x1b6/0x220 [ 889.486033][ C1] ? __pfx___nbcon_context_update_unsafe+0x10/0x10 [ 889.486061][ C1] nbcon_emit_next_record+0x8f7/0xa70 [ 889.486087][ C1] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 889.486109][ C1] ? nbcon_context_try_acquire+0x3a6/0xc60 [ 889.486130][ C1] ? do_raw_spin_lock+0xf0/0x260 [ 889.486162][ C1] ? __pfx___cant_migrate+0x10/0x10 [ 889.486196][ C1] ? _raw_spin_lock_irqsave+0x42/0x60 [ 889.486224][ C1] nbcon_emit_one+0x1a8/0x2b0 [ 889.486245][ C1] ? __pfx_nbcon_emit_one+0x10/0x10 [ 889.486271][ C1] nbcon_kthread_func+0x613/0x7d0 [ 889.486295][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 889.486324][ C1] ? __kthread_parkme+0x18f/0x230 [ 889.486350][ C1] ? kthread+0x13a/0x450 [ 889.486377][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 889.486399][ C1] kthread+0x373/0x450 [ 889.486426][ C1] ? __pfx_kthread+0x10/0x10 [ 889.486455][ C1] ret_from_fork+0x730/0xd60 [ 889.486479][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 889.486503][ C1] ? __switch_to+0x800/0x10f0 [ 889.486531][ C1] ? __pfx_kthread+0x10/0x10 [ 889.486561][ C1] ret_from_fork_asm+0x1a/0x30 [ 889.486590][ C1] [ 889.495560][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 890.788642][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 890.797763][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 890.807797][ T32] Call Trace: [ 890.811052][ T32] [ 890.813961][ T32] dump_stack_lvl+0x100/0x190 [ 890.818623][ T32] vpanic+0x553/0x970 [ 890.822577][ T32] ? __pfx_vpanic+0x10/0x10 [ 890.827057][ T32] panic+0xd1/0xe0 [ 890.830760][ T32] ? __pfx_panic+0x10/0x10 [ 890.835180][ T32] ? nmi_trigger_cpumask_backtrace+0x263/0x2a0 [ 890.841341][ T32] ? nmi_trigger_cpumask_backtrace+0x26d/0x2a0 [ 890.847474][ T32] ? watchdog.cold+0x1ec/0x234 [ 890.852216][ T32] watchdog.cold+0x1fd/0x234 [ 890.856798][ T32] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 890.862602][ T32] ? __pfx_watchdog+0x10/0x10 [ 890.867258][ T32] ? __kthread_parkme+0x18f/0x230 [ 890.872259][ T32] ? kthread+0x13a/0x450 [ 890.876477][ T32] ? __pfx_watchdog+0x10/0x10 [ 890.881128][ T32] kthread+0x373/0x450 [ 890.885185][ T32] ? __pfx_kthread+0x10/0x10 [ 890.889791][ T32] ret_from_fork+0x730/0xd60 [ 890.894390][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 890.899509][ T32] ? __switch_to+0x800/0x10f0 [ 890.904198][ T32] ? __pfx_kthread+0x10/0x10 [ 890.908798][ T32] ret_from_fork_asm+0x1a/0x30 [ 890.913577][ T32] [ 890.916800][ T32] Kernel Offset: disabled [ 890.921109][ T32] Rebooting in 86400 seconds..