last executing test programs: 3m1.319441751s ago: executing program 0 (id=2758): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) listen(r0, 0x5) 3m1.151018636s ago: executing program 0 (id=2759): setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)={0x3c, r1, 0x5, 0x0, 0xfffffffc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x1}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x1}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x4}]}, 0x3c}}, 0x0) 3m0.812660666s ago: executing program 0 (id=2761): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002bbd7000000000003a000000", @ANYRES32=r2, @ANYBLOB="04005b"], 0x28}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) 3m0.405014018s ago: executing program 0 (id=2764): r0 = openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f00000000c0)={0x0, 0x0, 0x400}, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000300)=@ublk_get_queue_affinity_sqe={0x2e, 0x0, 0x0, r0, 0x80207501, 0x0, 0x0, 0x0, 0x1, 0xb, 0x0, 0x0, '\x00', {0x0, 0xffff, 0x0, 0x0}}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000380)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000580)=@new_dev={0x4, 0x4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x168}}}, &(0x7f00000005c0)) 3m0.146394205s ago: executing program 0 (id=2765): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="12000000040000000400000008"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0600000004000000040000000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4002000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2m59.991202449s ago: executing program 0 (id=2767): socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='0', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='3', 0x1d) 2m44.878159446s ago: executing program 32 (id=2767): socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='0', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='3', 0x1d) 1m15.712153067s ago: executing program 5 (id=3265): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000240)={0x2, 0x4e23, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=' \x00'], 0x40}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000001140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000018000100"], 0x30}}, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000005c0)={[0x5836, 0x1000000000000008, 0x2, 0x4000000000000e52, 0x1, 0xf, 0x1043, 0x200000000006, 0x10, 0x1, 0xfffffffffffffffe, 0x100000000, 0x9ca6, 0x1, 0x8000000000005, 0x5c], 0x8080000, 0x42590}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m15.477864283s ago: executing program 5 (id=3267): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1a3240, 0x0) r0 = syz_usb_connect(0x0, 0x371, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2379c"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x8020000) r4 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) move_mount(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x64) write$char_usb(r1, &(0x7f0000000080)="10", 0x20) r6 = socket(0x1e, 0x1, 0x0) connect$tipc(r6, &(0x7f00000000c0)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) r7 = landlock_create_ruleset(&(0x7f0000000100)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r7, 0xe) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x4, 0x10010, 0xffffffffffffffff, 0xe0d94000) mremap(&(0x7f00005b4000/0x3000)=nil, 0x3000, 0x2000, 0x3, &(0x7f00007ea000/0x2000)=nil) ioctl$TIOCGSERIAL(0xffffffffffffffff, 0x541e, 0x0) 1m14.569675813s ago: executing program 5 (id=3274): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x300, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000440)=0x10000000000002) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000540), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000580)=0x2) recvmmsg(r2, &(0x7f00000005c0), 0x10106, 0x2, 0x0) setgroups(0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='net_prio.prioidx\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xb, 0x10012, 0xffffffffffffffff, 0x3000) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x20223000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_dev$cec(&(0x7f0000000640), 0x0, 0x0) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f00000006c0)=0x32) epoll_create1(0x0) execve(&(0x7f0000000740)='./file2\x00', 0x0, 0x0) mount$9p_virtio(&(0x7f0000000000), &(0x7f0000000240)='./file0\x00', &(0x7f0000000280), 0x1100802, &(0x7f0000000840)={'trans=virtio,', {[{@afid={'afid', 0x3d, 0x400}}, {@dfltgid}, {@cache_fscache}, {@msize={'msize', 0x3d, 0x8}}, {@cachetag={'cachetag', 0x3d, 'e\x89.@%'}}, {@nodevmap}, {@afid={'afid', 0x3d, 0xfff}}, {@msize={'msize', 0x3d, 0x7}}, {@cachetag={'cachetag', 0x3d, 'net_prio.prioidx\x00'}}], [{@func={'func', 0x3d, 'MODULE_CHECK'}}]}}) mount(0x0, 0x0, &(0x7f0000000800)='gadgetfs\x00', 0x2200892, 0x0) fanotify_init(0x20, 0x0) 1m12.173970056s ago: executing program 5 (id=3290): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1e) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='tracefs\x00', 0x4000, 0x0) mount$bpf(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x40020, 0x0) 1m12.104844406s ago: executing program 5 (id=3292): r0 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc4}, &(0x7f0000000300)={0x0, "00379bce195566778899aabbccddfcff00112233445566778899aabbccddeeff000011688e0346d524b29db701e5ddeeff8000", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000400)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000480), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x38, 0x30, 0x30, 0x35, 0x30, 0x64]}, &(0x7f0000000500)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x20}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000580), &(0x7f00000005c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x65, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000600)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x3f}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000780), &(0x7f00000007c0)={'fscrypt:', @auto=[0x62, 0x30, 0x30, 0x35, 0x30, 0x64, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000800)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000880), &(0x7f00000008c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x39, 0x37, 0x30, 0xab729eba4819dab1, 0x38, 0x30, 0x33, 0x30, 0x30, 0x35, 0x30, 0x0, 0x38]}, &(0x7f0000000900)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000980), &(0x7f00000009c0)={'fscrypt:', @desc2}, &(0x7f0000000a00)={0x0, "41aaa6461c7d9cdfe002a4fdf77ac6a6b897264411411eb3e0e991467601fa7590931ab1575e497fa2974dbe559c8f95118b6680568af90fbd32a6fd249117c5", 0x29}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000a80), &(0x7f0000000ac0)={'fscrypt:', @auto=[0x30, 0x39, 0x3a, 0x63, 0x34, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x66, 0x36, 0x30, 0x30]}, &(0x7f0000000b00)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566a945d7e924cc9136ff00112233445575778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000b80), &(0x7f0000000bc0)={'fscrypt:', @auto=[0x38, 0x30, 0x62, 0x30, 0x30, 0x30, 0x30, 0x63, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, 0x0, 0x0, r0) add_key$keyring(&(0x7f0000000c80), &(0x7f0000000cc0)={'syz', 0x0}, 0x0, 0x0, r0) add_key$fscrypt_v1(&(0x7f0000000d00), &(0x7f0000000d40)={'fscrypt:', @auto=[0x30, 0x62, 0x31, 0x30, 0x39, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x66, 0x33, 0x30, 0x62]}, &(0x7f0000000d80)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000e00), &(0x7f0000000e40)={'fscrypt:', @desc3}, &(0x7f0000000e80)={0x0, "00112233444d66778899aabbccddefff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff0011223344556677889c69bbccddeeff", 0x40}, 0x48, r0) add_key$keyring(&(0x7f0000000f00), &(0x7f0000000f40)={'syz', 0x2}, 0x0, 0x0, r0) add_key$fscrypt_v1(&(0x7f0000000f80), &(0x7f0000000fc0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x33, 0x30, 0x30, 0x30, 0x30, 0x33, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x66]}, &(0x7f0000001000)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000001080), &(0x7f00000010c0)={'fscrypt:', @auto=[0x39, 0x63, 0x65, 0x36, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32, 0x38, 0x31, 0x31]}, &(0x7f0000001100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff0011223344556c778899aabbccddeeff", 0x3d}, 0x48, r0) add_key$fscrypt_provisioning(&(0x7f0000001180), &(0x7f00000011c0)={'syz', 0x3}, &(0x7f0000001200)=ANY=[@ANYBLOB="01"], 0x18, r0) add_key$fscrypt_provisioning(&(0x7f0000001240), &(0x7f0000001280)={'syz', 0x2}, &(0x7f00000012c0)=ANY=[@ANYBLOB="0200"], 0x48, r0) 1m12.025128113s ago: executing program 5 (id=3293): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='tcp 2', 0x5) 56.780917673s ago: executing program 33 (id=3293): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='tcp 2', 0x5) 9.2911665s ago: executing program 3 (id=3737): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1a3240, 0x0) r0 = syz_usb_connect(0x0, 0x371, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2379c"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x8020000) r4 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) move_mount(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x64) write$char_usb(r1, &(0x7f0000000080)="10", 0x20) connect$tipc(0xffffffffffffffff, &(0x7f00000000c0)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) r6 = landlock_create_ruleset(&(0x7f0000000100)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r6, 0xe) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x4, 0x10010, 0xffffffffffffffff, 0xe0d94000) mremap(&(0x7f00005b4000/0x3000)=nil, 0x3000, 0x2000, 0x3, &(0x7f00007ea000/0x2000)=nil) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCGSERIAL(r7, 0x541e, 0x0) 8.625738711s ago: executing program 4 (id=3746): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180), 0x1c0002, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0xe9503, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xe, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f00000006c0)='GPL\x00', 0x4, 0xfd90, &(0x7f0000000700)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000800), 0x366, 0x10, &(0x7f0000000840), 0x1dd}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000008c0)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='&'], 0x10) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000900)={@map=r4, 0x5, 0x0, 0x467b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./debug/lru_gen\x00', 0x2, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000002000), 0x0, 0x0) read$FUSE(r6, &(0x7f0000002040)={0x2020, 0x0, 0x0, 0x0}, 0xfffffec1) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000004080)=ANY=[@ANYBLOB="930012f97ecb08046be4b7615f44c3325a8ba2d340bdce19ab8b41bf6b4dd6f143b4ddfbec97d7bca05c21453a63c19cf7a2f4c241da3573498b5bd900d4d481670fd53dfb447a7a0395fe84848e4a565c77e8d52f9e857593fbd8f680a55fba14950b5907c13a9d4d7fdd648c433134c6146baf722315acde4dac1093d5d97f80f815cd", @ANYRES32, @ANYRES8, @ANYRES32=0x0, @ANYRES32, @ANYRESDEC, @ANYRESHEX, @ANYRES32=r7], 0x50) setresuid(0x0, 0x0, r7) memfd_secret(0x0) write$binfmt_aout(r5, 0x0, 0xff2e) write$vga_arbiter(r0, &(0x7f0000000280)=ANY=[@ANYBLOB='lock io'], 0xc) write$vga_arbiter(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB='unlock io'], 0xe) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a010400000000000000000200000a0900010073797a300000000040000000030a010200000000000000000200000a0900010073797a30000000000900030073797a300000000014000480080001400000000408000240fffffffe74000000060a010400000000000000000200000a0900010073797a30000000000900020073797a300000000048000480440001800a000100717565756500000034000280060001400000000006000340000200000600034000010000060002"], 0xfc}}, 0x4000) ioctl$XFS_IOC_START_COMMIT(r2, 0x80585882, &(0x7f0000000000)={0xffffffffffffffff}) r10 = openat$userio(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r10, &(0x7f0000000980)={0x3, 0xfa}, 0x2) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="f001000000010104200000000000000002000000240001801400018008000100e0"], 0x1f0}}, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) gettid() ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000003c0)={'bridge0\x00'}) sendmsg$nl_route(r11, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[], 0x24}}, 0xc0) setsockopt$inet_sctp6_SCTP_INITMSG(r9, 0x84, 0x2, &(0x7f0000000080)={0xfbff, 0x0, 0xfffa, 0x1ff}, 0x8) 8.549262431s ago: executing program 3 (id=3747): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080), 0x0) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000140)=[{&(0x7f0000000180)="e6", 0xffe0}], 0x1, &(0x7f0000000300)=[@dstaddrv4={0x18, 0x84, 0x7, @local}, @dstaddrv6={0x20, 0x84, 0x8, @rand_addr=' \x01\x00'}, @dstaddrv6={0x20, 0x84, 0x8, @ipv4={'\x00', '\xff\xff', @private=0xa010100}}], 0x58, 0x4855}, 0x24000052) 8.397440817s ago: executing program 3 (id=3749): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)}, 0x0) 8.331795994s ago: executing program 4 (id=3750): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000480)=0x2, 0x4) connect$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000500)=[@window={0x3, 0x7, 0x40}, @timestamp, @mss={0x2, 0x9}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @window={0x3, 0xfffc}, @sack_perm], 0x7) writev(r0, &(0x7f0000000540)=[{&(0x7f0000000580)="1a875a821132417d9ef0e60ee12e62edd85d2a688d19cf491498dd06d4eae3", 0x1f}, {&(0x7f00000005c0)="896b39ba0064b334ffafc05ec105ef47c30cf14b49ecb1ae8b8eb4a569edacd8104197bba63a1dc138d2d3db6d41ecabf5568957b3bf62e456aa344684fe7e69eefa730a19e1f5ffbca0453499bd74910dc5aaec7ea2d26cab8cab5ccd5f2ef2c84216c2b74a1d427564134bc19ca6bc99ae56a47f5dca3491e29dd3b218d11c7b678bc4929cd023caafedd3188b0e1d700a39dc8bf46f4148ac440cd2a8832ad0a4be0c8aacbdbbcde7c5f263ed82b1523106b18fd61c73e90186ebe0f607d5468f49678fd00d12f509e25e5fd2355d1f6640656c0bf3ee5a6d3743f189f9d2ea0b5421e6e2c8e7d525b5fd2d2411faf6dd9117", 0xf4}, {&(0x7f00000006c0)}, {&(0x7f00000007c0)="fdc0a4a92c421b65ff7a4122f3c5794c7230b25ba2b0473640f3c1509f", 0x1d}, {&(0x7f0000000800)="15f4c15f95ad05225792b05129b08853741458", 0x13}, {&(0x7f0000000840)="5242b33156b2d47d", 0x8}], 0x6) r1 = openat$kvm(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x40000023, 0x0, 0x4}]}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r3, 0x4068aea3, &(0x7f0000000100)) socket(0x15, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000a40)='./binderfs/binder0\x00', 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000a80)={0x2, 0x0, @rand_addr=0x64010102}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000000ac0)=[{{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x40}], 0x1, 0x60010000, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000b00)={0x2, 0x0, @loopback}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000b40)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b80)=0x8) r4 = syz_open_dev$sndmidi(&(0x7f0000000c00), 0x2, 0x141102) writev(r4, 0x0, 0x0) syslog(0x3, &(0x7f0000000cc0)=""/112, 0x70) 8.199393651s ago: executing program 3 (id=3751): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x300, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000440)=0x10000000000002) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000540), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000580)=0x2) recvmmsg(r2, &(0x7f00000005c0), 0x10106, 0x2, 0x0) setgroups(0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='net_prio.prioidx\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xb, 0x10012, 0xffffffffffffffff, 0x3000) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x20223000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_dev$cec(&(0x7f0000000640), 0x0, 0x0) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f00000006c0)=0x32) epoll_create1(0x0) execve(&(0x7f0000000740)='./file2\x00', 0x0, 0x0) mount$9p_virtio(&(0x7f0000000000), &(0x7f0000000240)='./file0\x00', &(0x7f0000000280), 0x1100802, &(0x7f0000000840)={'trans=virtio,', {[{@afid={'afid', 0x3d, 0x400}}, {@dfltgid}, {@cache_fscache}, {@msize={'msize', 0x3d, 0x8}}, {@cachetag={'cachetag', 0x3d, 'e\x89.@%'}}, {@nodevmap}, {@afid={'afid', 0x3d, 0xfff}}, {@msize={'msize', 0x3d, 0x7}}, {@cachetag={'cachetag', 0x3d, 'net_prio.prioidx\x00'}}], [{@func={'func', 0x3d, 'MODULE_CHECK'}}]}}) mount(0x0, 0x0, &(0x7f0000000800)='gadgetfs\x00', 0x2200892, 0x0) fanotify_init(0x20, 0x0) 8.161017677s ago: executing program 4 (id=3752): bind$netlink(0xffffffffffffffff, 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, 0x0, 0x0) socket$tipc(0x1e, 0x5, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x173) mount(0x0, 0x0, &(0x7f0000000dc0)='proc\x00', 0x4000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000380)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nullb/nullb1\x00', 0x1ff) 8.009490543s ago: executing program 4 (id=3753): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(0x3) r1 = socket$inet_tcp(0x2, 0x1, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_buf(r1, 0x6, 0x1f, &(0x7f0000000100)='espintcp', 0x8) ioctl$int_in(r0, 0x5421, 0x0) writev(r0, &(0x7f0000000dc0)=[{0x0}], 0x1) 7.696294493s ago: executing program 4 (id=3754): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000780)={'syzkaller0\x00', 0x1}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000007c0)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x4}, @val={0x0, 0x80, 0x6, 0x9, 0x9, 0x7d}, @mpls={[], @ipv6=@generic={0x7, 0x6, "3dc7be", 0x0, 0x67, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}, @empty}}}, 0x36) 6.744677349s ago: executing program 2 (id=3756): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x1, 0x0) write(r1, &(0x7f0000000680)='1', 0x1) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000240), r0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='fd/3\x00') r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) r5 = socket(0x2000000015, 0x80005, 0x0) bind$inet6(r5, &(0x7f00000004c0)={0xa, 0x0, 0x0, @loopback, 0x4}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x0, &(0x7f0000000500)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg$can_bcm(r5, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x10002) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x9, 0x50, r2, 0x671eb000) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002dbd7000fedbdf25120000000800080001010000180001801400020076657468315f746f5f626f1ad3e1b980f16e640000000800afaa67090093839b2a619bc28d9561"], 0x3c}, 0x1, 0x0, 0x0, 0x20040051}, 0x4000000) mount(0x0, &(0x7f0000000200)='.\x00', &(0x7f0000000300)='hugetlbfs\x00', 0x0, &(0x7f0000000340)='gid=1\x00nk]e') setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000006c0)='veth1_vlan\x00', 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001500), r0) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000740)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000e00000001000000000000010400000020000001000000000000000d01000000050000000000000c020000000a0000000000000c0200000000696e74006d61696e00"], 0x0, 0x5a, 0x0, 0x0, 0x4}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0x6, 0xf, &(0x7f0000000880)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xce9}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000900)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0xd, '\x00', 0x0, 0x25, r7, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000940)=[{0x0, 0x3, 0x9, 0x1}], 0x10, 0xfffffffc}, 0x94) syz_io_uring_setup(0x6caa, &(0x7f0000000380)={0x0, 0xa453, 0x4000, 0x1, 0x29d, 0x0, r3}, &(0x7f0000000400), &(0x7f0000000440), &(0x7f0000000480)) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000001600)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001540)=ANY=[@ANYBLOB="14000000", @ANYRES16=r6, @ANYBLOB="010025bd700700dbdf2528000000"], 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x800) 6.655770997s ago: executing program 4 (id=3757): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000000)=""/75, 0x4b, 0x7984e2f5) set_mempolicy(0x4005, &(0x7f0000000580)=0x7, 0x8) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = getpid() mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) syz_usb_connect(0x3, 0x51, &(0x7f0000000200)=ANY=[@ANYBLOB="120101024cf1c50863070210845f0102030109023f0001000000000904000005ff87"], &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0}) write(r1, &(0x7f00000001c0)='270', 0x3) r2 = syz_pidfd_open(r0, 0x0) setns(r2, 0x24020000) syz_clone(0xf8024100, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000005c0), 0x400502, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, &(0x7f0000000600)=0xc) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDCTL_MIDI_PRETIME(0xffffffffffffffff, 0xc0046d00, &(0x7f0000000080)=0xc00000) pipe(&(0x7f0000000040)) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r4, 0x0, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r5, 0x40045b0a, &(0x7f0000000440)={0xffffffff, 0xfffffffe, 0x10007, 0xff, 0xd92}) read(r5, 0x0, 0x0) 6.10980827s ago: executing program 2 (id=3760): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180), 0x1c0002, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0xe9503, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xe, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f00000006c0)='GPL\x00', 0x4, 0xfd90, &(0x7f0000000700)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000800), 0x366, 0x10, &(0x7f0000000840), 0x1dd}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000008c0)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='&'], 0x10) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000900)={@map=r4, 0x5, 0x0, 0x467b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./debug/lru_gen\x00', 0x2, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000002000), 0x0, 0x0) read$FUSE(r6, &(0x7f0000002040)={0x2020, 0x0, 0x0, 0x0}, 0xfffffec1) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000004080)=ANY=[@ANYBLOB="930012f97ecb08046be4b7615f44c3325a8ba2d340bdce19ab8b41bf6b4dd6f143b4ddfbec97d7bca05c21453a63c19cf7a2f4c241da3573498b5bd900d4d481670fd53dfb447a7a0395fe84848e4a565c77e8d52f9e857593fbd8f680a55fba14950b5907c13a9d4d7fdd648c433134c6146baf722315acde4dac1093d5d97f80f815cd", @ANYRES32, @ANYRES8, @ANYRES32=0x0, @ANYRES32, @ANYRESDEC, @ANYRESHEX, @ANYRES32=r7], 0x50) setresuid(0x0, 0x0, r7) memfd_secret(0x0) write$binfmt_aout(r5, 0x0, 0xff2e) write$vga_arbiter(r0, &(0x7f0000000280)=ANY=[@ANYBLOB='lock io'], 0xc) write$vga_arbiter(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB='unlock io'], 0xe) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a010400000000000000000200000a0900010073797a300000000040000000030a010200000000000000000200000a0900010073797a30000000000900030073797a300000000014000480080001400000000408000240fffffffe74000000060a010400000000000000000200000a0900010073797a30000000000900020073797a300000000048000480440001800a000100717565756500000034000280060001400000000006000340000200000600034000010000060002"], 0xfc}}, 0x4000) ioctl$XFS_IOC_START_COMMIT(r2, 0x80585882, &(0x7f0000000000)={0xffffffffffffffff}) r10 = openat$userio(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r10, &(0x7f0000000980)={0x3, 0xfa}, 0x2) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="f001000000010104200000000000000002000000240001801400018008000100e0"], 0x1f0}}, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) gettid() ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000003c0)={'bridge0\x00'}) sendmsg$nl_route(r11, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[], 0x24}}, 0xc0) setsockopt$inet_sctp6_SCTP_INITMSG(r9, 0x84, 0x2, &(0x7f0000000080)={0xfbff, 0x0, 0xfffa, 0x1ff}, 0x8) 4.764136189s ago: executing program 2 (id=3765): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000006c0)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, &(0x7f0000000700)={0x2c, &(0x7f0000000740)=ANY=[@ANYBLOB="20b52c02000006"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000780), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f00000007c0)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000840)={0x0, &(0x7f0000000900)=[0x0], 0x0, 0x0, 0x0, 0x3ffffffffffffee4}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000880)={0x0, 0x1, &(0x7f00000008c0)=[r2], &(0x7f0000000900), 0x0, 0x0, 0x0, 0x800000000000c}) 4.427306747s ago: executing program 1 (id=3769): syz_usb_connect(0x5, 0x4e, &(0x7f0000000480)=ANY=[@ANYBLOB="1201000200000040cd06350100010000000109023c0001010080320904000006ff0000000705810240000007050102"], 0x0) mkdir(&(0x7f00000004c0)='mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='mnt\x00', &(0x7f0000000540)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000ac0)='mnt/ttyUSB0\x00', 0x2, 0x0) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f0000000b00)={0xffffffff, 0x0, 0x1c, 0xf058, 0x89, "e8a872c03d775900", 0x81, 0x7}) 2.871070057s ago: executing program 6 (id=3770): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000380)=[@in6={0xa, 0x4e24, 0x10006, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, 0x0, 0x4048043) r1 = dup(r0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000600)='bond_slave_1\x00', 0x10) shutdown(r1, 0x1) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x1c, 0x0, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) 2.475770042s ago: executing program 6 (id=3771): r0 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x14, r0, 0x70b, 0x70bd2b, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0xc000}, 0x2000004) 2.220673844s ago: executing program 3 (id=3772): mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='./sec\x00', &(0x7f0000000640)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000019c0)={0x1, &(0x7f0000001a00)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001a40)='io.stat\x00', 0x275a, 0x0) readahead(r1, 0xa282, 0x3) write(r0, &(0x7f00000006c0)='address_group grp1 0.0.0.0-655.255.255.255\n', 0x2b) openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x222480, 0x4) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys_mnt\x00', 0x0, 0x0, 0x0) r2 = openat(r1, &(0x7f0000000140)='./sec\x00', 0x1, 0x84) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_buf(r3, 0x6, 0x23, &(0x7f0000000980)=""/4096, &(0x7f0000001980)=0x1000) close(0x3) r4 = socket$inet_tcp(0x2, 0x1, 0x6) close(0x3) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_tcp_buf(r4, 0x6, 0x1f, &(0x7f0000000280)='espintcp', 0x8) write(0xffffffffffffffff, &(0x7f0000000580)='&\x00\x00', 0x3) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000850000005000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7020000000400008500000086000000bf91000000000000b7020000020000008500000084000000b70000000000000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000840)={0x0, 0x0}, 0x8) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000880)=r7, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x1, 0xf, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000510000000000000000d0000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000002000000850000000600000085000000d000000018120000", @ANYRES32=r0, @ANYBLOB="00000000000000001429c0ff01000000950000000000f0a9"], &(0x7f0000000780)='syzkaller\x00', 0x3, 0x2, &(0x7f00000007c0)=""/2, 0x41100, 0x54, '\x00', 0x0, @fallback=0x2e, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000800)={0x4, 0xa, 0x8, 0xfffffff9}, 0x10, r7, r0, 0x0, 0x0, 0x0, 0x10, 0xd0b}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r6, r5}, 0xc) 2.187821992s ago: executing program 6 (id=3773): setns(0xc9, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900010000000000000000000a0101000000000000000000000000000000000000000000000061ffe000000100000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000007000000000000000000000000000000ffffff7f000000000000000000000000020000000000000000000000000000000000000000000000feffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000010001030000000044000500fe800000000000000000000000000008000000022b"], 0xfc}}, 0x64) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000080)=0x10) 2.09223343s ago: executing program 1 (id=3774): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000101050005000a000000050001000700000005000400000000000900020073797a310000000016000300686173683a6e65742c706f72742c6e65740000000c00078008000640"], 0x5c}}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc00007522dcbb000000000000000000060004404e1f000005000700840000000600054056c2da854bdb527d69b56e0b1e8e6a468802"], 0x74}, 0x1, 0x0, 0x0, 0x1692a43a0ee73c12}, 0x20000040) 1.807876721s ago: executing program 6 (id=3775): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000001480)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f00000014c0)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r0, 0x7af, &(0x7f0000001540)={@local, 0x2}) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000001580), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f00000015c0)=0x90000) 1.755546316s ago: executing program 1 (id=3776): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000240)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(0xffffffffffffffff, 0x0, 0x30, &(0x7f0000000300)=ANY=[@ANYBLOB="02000000000000000200fffce00000020000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000"], 0x90) 1.603638966s ago: executing program 2 (id=3777): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x120}}}, &(0x7f0000000100)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f00000001c0)={0x0, 0xfffffffe, 0x0, 0x4, 0x1f3}, &(0x7f0000000240)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x20, 0x0, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x8000, 0x3, 0xbab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8684, 0x0, 0x40040005, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) 1.545017949s ago: executing program 1 (id=3778): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) 1.476351549s ago: executing program 6 (id=3779): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x2c, r0, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xcb}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 1.225695012s ago: executing program 1 (id=3780): r0 = msgget$private(0x0, 0x41) msgctl$IPC_STAT(r0, 0x2, &(0x7f0000000600)=""/118) 1.222177715s ago: executing program 2 (id=3781): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2803, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000003c0)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fd7000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000000)="f00fc7494d36f08266060266b9800000c00f326635000400000f30eade780066b9aa0200000fb266b9ab0900000f30f2b031b3e759dc2c", 0x37}], 0x1, 0x9f6a364b3fac2a47, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4008}, 0x20040000) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.202421648s ago: executing program 6 (id=3782): pipe(&(0x7f0000001c80)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000001cc0)=0x1, 0x4) connect$inet(r1, &(0x7f0000001d40)={0x2, 0x0, @remote}, 0x10) sendto$inet(r1, &(0x7f0000001d80)="e1", 0xfea8, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0xffa8, 0xa) 1.023338773s ago: executing program 1 (id=3783): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x300, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000440)=0x10000000000002) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000540), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000580)=0x2) recvmmsg(r2, &(0x7f00000005c0), 0x10106, 0x2, 0x0) setgroups(0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='net_prio.prioidx\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xb, 0x10012, 0xffffffffffffffff, 0x3000) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x20223000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_dev$cec(&(0x7f0000000640), 0x0, 0x0) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f00000006c0)=0x32) epoll_create1(0x0) execve(&(0x7f0000000740)='./file2\x00', 0x0, 0x0) mount$9p_virtio(&(0x7f0000000000), &(0x7f0000000240)='./file0\x00', &(0x7f0000000280), 0x1100802, &(0x7f0000000840)={'trans=virtio,', {[{@afid={'afid', 0x3d, 0x400}}, {@dfltgid}, {@cache_fscache}, {@msize={'msize', 0x3d, 0x8}}, {@cachetag={'cachetag', 0x3d, 'e\x89.@%'}}, {@nodevmap}, {@afid={'afid', 0x3d, 0xfff}}, {@msize={'msize', 0x3d, 0x7}}, {@cachetag={'cachetag', 0x3d, 'net_prio.prioidx\x00'}}], [{@func={'func', 0x3d, 'MODULE_CHECK'}}]}}) mount(0x0, 0x0, &(0x7f0000000800)='gadgetfs\x00', 0x2200892, 0x0) fanotify_init(0x20, 0x0) 175.351834ms ago: executing program 3 (id=3784): syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = gettid() timer_create(0x2, &(0x7f0000000180)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f00000001c0)) readv(r0, &(0x7f0000000200)=[{&(0x7f0000000240)=""/18, 0x12}], 0x1) read$char_usb(r0, &(0x7f0000000280)=""/142, 0x8e) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 0s ago: executing program 2 (id=3785): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000580)=0x1, 0x4) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0xe00, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) connect(r0, &(0x7f00000004c0)=@rc={0x1f, @none, 0x7}, 0x80) r2 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) listen(r2, 0x5) r3 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): er 8 using dummy_hcd [ 883.822643][T13610] udevd[13610]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 883.898931][T14748] usb 6-1: device descriptor read/64, error -71 [ 883.915742][ T5610] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 884.009581][T14748] usb usb6-port1: attempt power cycle [ 884.045880][T14803] bridge0: port 1(bridge_slave_0) entered blocking state [ 884.046134][T14803] bridge0: port 1(bridge_slave_0) entered disabled state [ 884.046332][T14803] bridge_slave_0: entered allmulticast mode [ 884.069456][T14803] bridge_slave_0: entered promiscuous mode [ 884.073553][T14803] bridge0: port 2(bridge_slave_1) entered blocking state [ 884.073787][T14803] bridge0: port 2(bridge_slave_1) entered disabled state [ 884.074003][T14803] bridge_slave_1: entered allmulticast mode [ 884.076938][T14803] bridge_slave_1: entered promiscuous mode [ 884.098850][ T5610] usb 5-1: device descriptor read/64, error -71 [ 884.168384][T14803] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 884.191480][T14803] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 884.209302][ T5610] usb usb5-port1: attempt power cycle [ 884.256432][T14803] team0: Port device team_slave_0 added [ 884.266444][T14803] team0: Port device team_slave_1 added [ 884.322757][T14803] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 884.322777][T14803] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 884.322807][T14803] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 884.325776][T14803] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 884.325791][T14803] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 884.325817][T14803] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 884.349060][T14748] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 884.369840][T14748] usb 6-1: device descriptor read/8, error -71 [ 884.548992][ T5610] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 884.573520][ T5610] usb 5-1: device descriptor read/8, error -71 [ 884.608975][T14748] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 884.633051][T14748] usb 6-1: device descriptor read/8, error -71 [ 884.650939][T14877] 9p: Bad value for 'version' [ 884.681434][T14876] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2978'. [ 884.702779][T14803] hsr_slave_0: entered promiscuous mode [ 884.703845][T14803] hsr_slave_1: entered promiscuous mode [ 884.704421][T14803] debugfs: 'hsr0' already exists in 'hsr' [ 884.704448][T14803] Cannot create hsr debugfs directory [ 884.744732][T14748] usb usb6-port1: unable to enumerate USB device [ 884.822155][ T5610] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 884.841792][ T5610] usb 5-1: device descriptor read/8, error -71 [ 884.943518][T14879] FAULT_INJECTION: forcing a failure. [ 884.943518][T14879] name failslab, interval 1, probability 0, space 0, times 0 [ 884.943545][T14879] CPU: 0 UID: 0 PID: 14879 Comm: syz.3.2979 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 884.943564][T14879] Tainted: [L]=SOFTLOCKUP [ 884.943568][T14879] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 884.943575][T14879] Call Trace: [ 884.943581][T14879] [ 884.943587][T14879] dump_stack_lvl+0xe8/0x150 [ 884.943614][T14879] should_fail_ex+0x46b/0x600 [ 884.943636][T14879] should_failslab+0xa8/0x100 [ 884.943650][T14879] __kmalloc_cache_noprof+0x9c/0x670 [ 884.943668][T14879] ? loopback_open+0x2bc/0xad0 [ 884.943745][T14879] ? loopback_open+0x2bc/0xad0 [ 884.943761][T14879] loopback_open+0x2bc/0xad0 [ 884.943780][T14879] snd_pcm_open_substream+0xff1/0x24f0 [ 884.943796][T14879] ? pv_queued_spin_unlock_traced+0x5a/0x1b0 [ 884.943818][T14879] ? __pfx_snd_pcm_open_substream+0x10/0x10 [ 884.943834][T14879] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 884.943848][T14879] ? mutex_lock_nested+0x14d/0x1d0 [ 884.943863][T14879] ? snd_pcm_open+0x180/0x620 [ 884.943880][T14879] snd_pcm_open+0x1e2/0x620 [ 884.943900][T14879] ? __pfx_snd_pcm_open+0x10/0x10 [ 884.943915][T14879] ? __pfx_default_wake_function+0x10/0x10 [ 884.943933][T14879] ? snd_lookup_minor_data+0x11e/0x150 [ 884.943956][T14879] snd_pcm_playback_open+0x5f/0xc0 [ 884.943976][T14879] chrdev_open+0x4dc/0x600 [ 884.943991][T14879] ? __pfx_chrdev_open+0x10/0x10 [ 884.944002][T14879] ? fsnotify_open_perm_and_set_mode+0x13b/0x6c0 [ 884.944024][T14879] ? __pfx_chrdev_open+0x10/0x10 [ 884.944035][T14879] do_dentry_open+0x841/0x1410 [ 884.944055][T14879] vfs_open_consume+0x4a/0x360 [ 884.944066][T14879] ? path_openat+0x16e6/0x2100 [ 884.944084][T14879] path_openat+0x1701/0x2100 [ 884.944112][T14879] do_file_open+0x23e/0x4a0 [ 884.944128][T14879] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 884.944144][T14879] ? __pfx_do_file_open+0x10/0x10 [ 884.944174][T14879] ? alloc_fd+0x6b2/0x760 [ 884.944195][T14879] do_sys_openat2+0x115/0x200 [ 884.944209][T14879] ? __pfx_do_sys_openat2+0x10/0x10 [ 884.944226][T14879] ? do_user_addr_fault+0xd3f/0x1480 [ 884.944251][T14879] __x64_sys_openat+0x138/0x170 [ 884.944279][T14879] do_syscall_64+0x166/0x520 [ 884.944301][T14879] ? trace_irq_disable+0x3b/0x140 [ 884.944322][T14879] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 884.944343][T14879] ? clear_bhb_loop+0x70/0xc0 [ 884.944370][T14879] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 884.944388][T14879] RIP: 0033:0x7f6c1859fd8e [ 884.944401][T14879] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 884.944412][T14879] RSP: 002b:00007f6c16835b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 884.944427][T14879] RAX: ffffffffffffffda RBX: 00007f6c168366c0 RCX: 00007f6c1859fd8e [ 884.944436][T14879] RDX: 0000000000000002 RSI: 00007f6c16835c00 RDI: ffffffffffffff9c [ 884.944445][T14879] RBP: 00007f6c16835c00 R08: 0000000000000000 R09: 0000000000000000 [ 884.944453][T14879] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 884.944468][T14879] R13: 00007f6c18866038 R14: 00007f6c18865fa0 R15: 00007ffd5c0a3c18 [ 884.944488][T14879] [ 884.970757][ T5610] usb usb5-port1: unable to enumerate USB device [ 885.519244][T11540] Bluetooth: hci6: command tx timeout [ 885.738923][ T5610] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 885.891229][ T5610] usb 4-1: New USB device found: idVendor=0c4b, idProduct=0100, bcdDevice=1.00 [ 885.892881][ T5610] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 885.892911][ T5610] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 885.892932][ T5610] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 885.892968][ T5610] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 885.957288][T14889] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 885.977055][ T5610] cyberjack 4-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 885.991432][T14895] netlink: 192 bytes leftover after parsing attributes in process `syz.2.2987'. [ 885.992342][T14895] netlink: 192 bytes leftover after parsing attributes in process `syz.2.2987'. [ 885.994527][T14803] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 886.291657][ T5610] usb 4-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 886.459878][T14898] 9p: Bad value for 'version' [ 886.558593][ T5610] usb 4-1: USB disconnect, device number 27 [ 886.632803][ T5610] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 886.657378][ T5610] cyberjack 4-1:1.0: device disconnected [ 886.694292][T14897] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2988'. [ 887.063740][T14915] netlink: 'syz.4.2992': attribute type 10 has an invalid length. [ 887.063759][T14915] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2992'. [ 887.212342][T14803] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 887.356649][T14915] batadv0: entered promiscuous mode [ 887.356681][T14915] batadv0: entered allmulticast mode [ 887.357597][T14915] bridge0: port 1(batadv0) entered blocking state [ 887.357729][T14915] bridge0: port 1(batadv0) entered disabled state [ 887.407586][T14915] bridge0: port 1(batadv0) entered blocking state [ 887.407756][T14915] bridge0: port 1(batadv0) entered forwarding state [ 887.601861][T11540] Bluetooth: hci6: command tx timeout [ 887.689440][ T3408] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 887.689465][ T3408] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 887.768895][T14748] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 887.909251][T14748] usb 4-1: device descriptor read/64, error -71 [ 887.954043][T14938] 9p: Bad value for 'version' [ 887.991453][T14803] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.039588][T14935] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3002'. [ 888.159380][T14748] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 888.159958][ T4835] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 888.289002][T14748] usb 4-1: device descriptor read/64, error -71 [ 888.308980][ T4835] usb 3-1: Using ep0 maxpacket: 8 [ 888.309771][ T4835] usb 3-1: New USB device found: idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 888.313991][ T4835] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 888.314019][ T4835] usb 3-1: Product: syz [ 888.314033][ T4835] usb 3-1: Manufacturer: syz [ 888.314048][ T4835] usb 3-1: SerialNumber: syz [ 888.367684][ T4835] usb 3-1: config 0 descriptor?? [ 888.409796][T14748] usb usb4-port1: attempt power cycle [ 888.552762][T14803] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.586876][ T4835] usb 3-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 888.768977][T14748] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 888.790289][T14748] usb 4-1: device descriptor read/8, error -71 [ 888.938079][T11600] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 889.052605][T14947] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3007'. [ 889.080544][ T4835] usb write operation failed. (-71) [ 889.126979][T11600] usb 5-1: unable to get BOS descriptor or descriptor too short [ 889.127036][T11600] usb 5-1: New USB device found: idVendor=1235, idProduct=0010, bcdDevice=0.40 [ 889.132206][T14748] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 889.139610][T11600] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 889.139640][T11600] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 889.143063][T11600] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 889.143090][T11600] usb 5-1: Product: syz [ 889.143106][T11600] usb 5-1: Manufacturer: syz [ 889.143121][T11600] usb 5-1: SerialNumber: syz [ 889.149913][T14748] usb 4-1: device descriptor read/8, error -71 [ 889.236598][ T4835] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 889.243147][ T4835] dvbdev: DVB: registering new adapter (Terratec H7) [ 889.243205][ T4835] usb 3-1: media controller created [ 889.243655][ T4835] usb read operation failed. (-71) [ 889.244902][ T4835] usb write operation failed. (-71) [ 889.259375][T14748] usb usb4-port1: unable to enumerate USB device [ 889.313803][T11600] usb 5-1: selecting invalid altsetting 1 [ 889.314825][T11600] usb 5-1: unit 6 not found! [ 889.379951][ T4835] dvb_usb_az6007 3-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 889.527622][ T4835] usb 3-1: USB disconnect, device number 28 [ 889.850556][T14942] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 889.854521][T14942] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 890.064767][T11600] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 890.084082][T11600] usb 5-1: USB disconnect, device number 43 [ 890.186306][T14803] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 890.214620][T13610] udevd[13610]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 890.245696][T14803] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 890.247621][T14803] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 890.282091][T14803] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 890.283256][T14803] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 890.367378][T14803] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 890.368051][T14957] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 890.371953][T14803] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 890.399039][T14743] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 890.414510][T14803] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 890.578918][T14743] usb 3-1: Using ep0 maxpacket: 32 [ 890.579828][T14743] usb 3-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 890.581438][T14743] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 890.594382][T14743] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 890.594432][T14743] usb 3-1: Product: syz [ 890.594445][T14743] usb 3-1: Manufacturer: syz [ 890.594459][T14743] usb 3-1: SerialNumber: syz [ 890.621731][T14743] usb 3-1: config 0 descriptor?? [ 890.627390][T14954] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 890.698005][T14803] 8021q: adding VLAN 0 to HW filter on device bond0 [ 890.833040][T14803] 8021q: adding VLAN 0 to HW filter on device team0 [ 890.853346][ T2212] bridge0: port 1(bridge_slave_0) entered blocking state [ 890.853612][ T2212] bridge0: port 1(bridge_slave_0) entered forwarding state [ 890.894530][ T4835] usb 3-1: USB disconnect, device number 29 [ 890.894616][ T2212] bridge0: port 2(bridge_slave_1) entered blocking state [ 890.894808][ T2212] bridge0: port 2(bridge_slave_1) entered forwarding state [ 890.932586][T14968] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3013'. [ 890.937755][T14968] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3013'. [ 890.937995][T14968] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3013'. [ 890.938196][T14968] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3013'. [ 890.941123][T14968] 9p: Bad value for 'version' [ 891.204754][T14973] FAULT_INJECTION: forcing a failure. [ 891.204754][T14973] name failslab, interval 1, probability 0, space 0, times 0 [ 891.204796][T14973] CPU: 0 UID: 0 PID: 14973 Comm: syz.5.3015 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 891.204827][T14973] Tainted: [L]=SOFTLOCKUP [ 891.204835][T14973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 891.204848][T14973] Call Trace: [ 891.204857][T14973] [ 891.204867][T14973] dump_stack_lvl+0xe8/0x150 [ 891.204908][T14973] should_fail_ex+0x46b/0x600 [ 891.204947][T14973] should_failslab+0xa8/0x100 [ 891.204969][T14973] ? proc_net_ns_init+0x4e/0x380 [ 891.204997][T14973] kmem_cache_alloc_noprof+0x99/0x680 [ 891.205027][T14973] ? proc_net_ns_init+0x4e/0x380 [ 891.205060][T14973] proc_net_ns_init+0x4e/0x380 [ 891.205099][T14973] ops_init+0x35d/0x5d0 [ 891.205140][T14973] setup_net+0x118/0x350 [ 891.205169][T14973] ? __pfx_setup_net+0x10/0x10 [ 891.205200][T14973] ? __ns_common_init+0x384/0x590 [ 891.205227][T14973] copy_net_ns+0x536/0x770 [ 891.205262][T14973] create_new_namespaces+0x3f0/0x6b0 [ 891.205297][T14973] ? security_capable+0x7e/0x2c0 [ 891.205332][T14973] unshare_nsproxy_namespaces+0x144/0x190 [ 891.205369][T14973] ksys_unshare+0x532/0x890 [ 891.205405][T14973] ? __pfx_ksys_unshare+0x10/0x10 [ 891.205435][T14973] ? ksys_write+0x248/0x270 [ 891.205464][T14973] ? __pfx___se_sys_futex+0x10/0x10 [ 891.205493][T14973] ? __pfx_ksys_write+0x10/0x10 [ 891.205531][T14973] __x64_sys_unshare+0x38/0x50 [ 891.205562][T14973] do_syscall_64+0x166/0x520 [ 891.205590][T14973] ? trace_irq_disable+0x3b/0x140 [ 891.205611][T14973] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 891.205634][T14973] ? clear_bhb_loop+0x70/0xc0 [ 891.205663][T14973] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 891.205684][T14973] RIP: 0033:0x7ffb106cf559 [ 891.205706][T14973] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 891.205721][T14973] RSP: 002b:00007ffb0e91e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 891.205743][T14973] RAX: ffffffffffffffda RBX: 00007ffb10955fa0 RCX: 00007ffb106cf559 [ 891.205757][T14973] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000060020000 [ 891.205770][T14973] RBP: 00007ffb10766b20 R08: 0000000000000000 R09: 0000000000000000 [ 891.205784][T14973] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 891.205798][T14973] R13: 00007ffb10956038 R14: 00007ffb10955fa0 R15: 00007ffc147de008 [ 891.205833][T14973] [ 893.260672][T15004] device-mapper: ioctl: name not supplied when creating device [ 893.385894][T15004] FAULT_INJECTION: forcing a failure. [ 893.385894][T15004] name failslab, interval 1, probability 0, space 0, times 0 [ 893.385951][T15004] CPU: 0 UID: 0 PID: 15004 Comm: syz.3.3023 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 893.385982][T15004] Tainted: [L]=SOFTLOCKUP [ 893.385991][T15004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 893.386004][T15004] Call Trace: [ 893.386013][T15004] [ 893.386023][T15004] dump_stack_lvl+0xe8/0x150 [ 893.386067][T15004] should_fail_ex+0x46b/0x600 [ 893.386107][T15004] should_failslab+0xa8/0x100 [ 893.386134][T15004] __kmalloc_node_noprof+0xf8/0x7b0 [ 893.386166][T15004] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 893.386197][T15004] ? mempool_init_node+0x145/0x510 [ 893.386222][T15004] ? mempool_init_node+0x145/0x510 [ 893.386250][T15004] ? __init_waitqueue_head+0xad/0x160 [ 893.386283][T15004] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 893.386308][T15004] mempool_init_node+0x145/0x510 [ 893.386336][T15004] ? __pfx_mempool_free_slab+0x10/0x10 [ 893.386371][T15004] ? __pfx_mempool_free_slab+0x10/0x10 [ 893.386396][T15004] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 893.386422][T15004] mempool_init_noprof+0x3a/0x50 [ 893.386452][T15004] bioset_init+0x2f6/0x7e0 [ 893.386485][T15004] ? __pfx_bioset_init+0x10/0x10 [ 893.386512][T15004] ? __kasan_kmalloc+0x93/0xb0 [ 893.386548][T15004] ? __kmalloc_cache_node_noprof+0x45c/0x670 [ 893.386582][T15004] ? dm_table_complete+0x19a3/0x22d0 [ 893.386609][T15004] ? dm_table_complete+0x19a3/0x22d0 [ 893.386644][T15004] dm_table_complete+0x1d40/0x22d0 [ 893.386679][T15004] ? kfree+0x1c5/0x6d0 [ 893.386705][T15004] ? dm_table_add_target+0x598/0xc70 [ 893.386736][T15004] ? dm_table_add_target+0x735/0xc70 [ 893.386763][T15004] ? __pfx_dm_table_complete+0x10/0x10 [ 893.386802][T15004] table_load+0x3b4/0x8a0 [ 893.386837][T15004] ? __pfx_table_load+0x10/0x10 [ 893.386880][T15004] dm_ctl_ioctl+0x9ec/0xe10 [ 893.386933][T15004] ? __pfx_table_load+0x10/0x10 [ 893.386956][T15004] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 893.387028][T15004] ? __fget_files+0x2a/0x420 [ 893.387061][T15004] ? bpf_lsm_file_ioctl+0x9/0x20 [ 893.387086][T15004] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 893.387120][T15004] __se_sys_ioctl+0xff/0x170 [ 893.387155][T15004] do_syscall_64+0x166/0x520 [ 893.387178][T15004] ? trace_irq_disable+0x3b/0x140 [ 893.387200][T15004] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 893.387224][T15004] ? clear_bhb_loop+0x70/0xc0 [ 893.387252][T15004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 893.387274][T15004] RIP: 0033:0x7f6c185df559 [ 893.387297][T15004] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 893.387317][T15004] RSP: 002b:00007f6c16836028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 893.387343][T15004] RAX: ffffffffffffffda RBX: 00007f6c18865fa0 RCX: 00007f6c185df559 [ 893.387359][T15004] RDX: 0000200000001000 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 893.387374][T15004] RBP: 00007f6c18676b20 R08: 0000000000000000 R09: 0000000000000000 [ 893.387389][T15004] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 893.387403][T15004] R13: 00007f6c18866038 R14: 00007f6c18865fa0 R15: 00007ffd5c0a3c18 [ 893.387439][T15004] [ 893.411236][T15004] device-mapper: table: unable to allocate mempools [ 893.549670][T14803] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 893.668488][T14803] veth0_vlan: entered promiscuous mode [ 893.685505][T14803] veth1_vlan: entered promiscuous mode [ 893.740891][T14803] veth0_macvtap: entered promiscuous mode [ 893.747305][T14803] veth1_macvtap: entered promiscuous mode [ 893.962510][T14803] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 894.095519][T14803] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 894.490310][T14748] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 894.592300][ T9218] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 894.738794][T14748] usb 3-1: Using ep0 maxpacket: 32 [ 894.739269][ T9218] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 894.739743][T14748] usb 3-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 894.739838][ T9218] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 894.740280][ T9218] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 894.741375][T14748] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 894.841448][T14748] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 894.841481][T14748] usb 3-1: Product: syz [ 894.841497][T14748] usb 3-1: Manufacturer: syz [ 894.841512][T14748] usb 3-1: SerialNumber: syz [ 894.955021][T14748] usb 3-1: config 0 descriptor?? [ 894.968292][T15018] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 895.323127][ T35] usb 3-1: USB disconnect, device number 30 [ 895.344947][T15029] device-mapper: ioctl: name not supplied when creating device [ 895.390912][T15029] FAULT_INJECTION: forcing a failure. [ 895.390912][T15029] name failslab, interval 1, probability 0, space 0, times 0 [ 895.390957][T15029] CPU: 0 UID: 0 PID: 15029 Comm: syz.3.3034 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 895.390999][T15029] Tainted: [L]=SOFTLOCKUP [ 895.391008][T15029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 895.391022][T15029] Call Trace: [ 895.391031][T15029] [ 895.391041][T15029] dump_stack_lvl+0xe8/0x150 [ 895.391085][T15029] should_fail_ex+0x46b/0x600 [ 895.391126][T15029] should_failslab+0xa8/0x100 [ 895.391155][T15029] __kmalloc_node_noprof+0xf8/0x7b0 [ 895.391188][T15029] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 895.391215][T15029] ? mempool_init_node+0x145/0x510 [ 895.391240][T15029] ? mempool_init_node+0x145/0x510 [ 895.391266][T15029] ? __init_waitqueue_head+0xad/0x160 [ 895.391300][T15029] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 895.391326][T15029] mempool_init_node+0x145/0x510 [ 895.391354][T15029] ? __pfx_mempool_free_slab+0x10/0x10 [ 895.391389][T15029] ? __pfx_mempool_free_slab+0x10/0x10 [ 895.391416][T15029] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 895.391443][T15029] mempool_init_noprof+0x3a/0x50 [ 895.391473][T15029] bioset_init+0x2f6/0x7e0 [ 895.391507][T15029] ? __pfx_bioset_init+0x10/0x10 [ 895.391534][T15029] ? __kasan_kmalloc+0x93/0xb0 [ 895.391568][T15029] ? __kmalloc_cache_node_noprof+0x45c/0x670 [ 895.391602][T15029] ? dm_table_complete+0x19a3/0x22d0 [ 895.391627][T15029] ? dm_table_complete+0x19a3/0x22d0 [ 895.391659][T15029] dm_table_complete+0x1d40/0x22d0 [ 895.391694][T15029] ? kfree+0x1c5/0x6d0 [ 895.391720][T15029] ? dm_table_add_target+0x598/0xc70 [ 895.391750][T15029] ? dm_table_add_target+0x735/0xc70 [ 895.391776][T15029] ? __pfx_dm_table_complete+0x10/0x10 [ 895.391814][T15029] table_load+0x3b4/0x8a0 [ 895.391847][T15029] ? __pfx_table_load+0x10/0x10 [ 895.391889][T15029] dm_ctl_ioctl+0x9ec/0xe10 [ 895.391933][T15029] ? __pfx_table_load+0x10/0x10 [ 895.391956][T15029] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 895.392037][T15029] ? __fget_files+0x2a/0x420 [ 895.392069][T15029] ? bpf_lsm_file_ioctl+0x9/0x20 [ 895.392091][T15029] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 895.392122][T15029] __se_sys_ioctl+0xff/0x170 [ 895.392155][T15029] do_syscall_64+0x166/0x520 [ 895.392178][T15029] ? trace_irq_disable+0x3b/0x140 [ 895.392200][T15029] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 895.392220][T15029] ? clear_bhb_loop+0x70/0xc0 [ 895.392245][T15029] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 895.392265][T15029] RIP: 0033:0x7f6c185df559 [ 895.392286][T15029] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 895.392303][T15029] RSP: 002b:00007f6c16836028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 895.392329][T15029] RAX: ffffffffffffffda RBX: 00007f6c18865fa0 RCX: 00007f6c185df559 [ 895.392344][T15029] RDX: 0000200000001000 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 895.392358][T15029] RBP: 00007f6c18676b20 R08: 0000000000000000 R09: 0000000000000000 [ 895.392372][T15029] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 895.392385][T15029] R13: 00007f6c18866038 R14: 00007f6c18865fa0 R15: 00007ffd5c0a3c18 [ 895.392421][T15029] [ 895.398201][T15029] device-mapper: table: unable to allocate mempools [ 895.729393][ T2212] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 895.729423][ T2212] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 896.133583][ T1013] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 896.133611][ T1013] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 896.468974][ T35] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 896.583655][T14748] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 896.619013][ T35] usb 5-1: Using ep0 maxpacket: 8 [ 896.619997][ T35] usb 5-1: New USB device found: idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 896.621407][ T35] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 896.621464][ T35] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 896.621507][ T35] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 896.626229][ T35] usb 5-1: config 0 descriptor?? [ 896.687141][ T35] iowarrior 5-1:0.0: no interrupt-in endpoint found [ 896.751895][T14748] usb 4-1: unable to get BOS descriptor or descriptor too short [ 896.751935][T14748] usb 4-1: New USB device found: idVendor=1235, idProduct=0010, bcdDevice=0.40 [ 896.753338][T14748] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 896.753353][T14748] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 896.755561][T14748] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 896.755587][T14748] usb 4-1: Product: syz [ 896.755596][T14748] usb 4-1: Manufacturer: syz [ 896.755605][T14748] usb 4-1: SerialNumber: syz [ 896.856557][T14748] usb 4-1: selecting invalid altsetting 1 [ 896.857130][T14748] usb 4-1: unit 6 not found! [ 897.136109][T15064] fuse: Bad value for 'fd' [ 897.268943][ T35] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 897.419928][ T35] usb 3-1: New USB device found: idVendor=0424, idProduct=7850, bcdDevice=0.00 [ 897.427483][ T35] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 897.427515][ T35] usb 3-1: Product: syz [ 897.427532][ T35] usb 3-1: Manufacturer: syz [ 897.427555][ T35] usb 3-1: SerialNumber: syz [ 897.473687][T15047] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 897.475008][T15047] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 897.692760][T14748] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 897.701696][T14748] usb 4-1: USB disconnect, device number 32 [ 897.777959][T13610] udevd[13610]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 897.987792][ T35] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 897.987870][ T35] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 898.023839][T15077] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3053'. [ 898.024635][T15077] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3053'. [ 898.024962][T15077] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3053'. [ 898.025676][T15077] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3053'. [ 898.027227][T15077] 9pnet_virtio: no channels available for device syz [ 898.610925][ T35] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 898.610992][ T35] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 898.714021][ T35] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 898.751865][ T35] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 898.777915][ T35] usb 3-1: USB disconnect, device number 31 [ 898.798171][T14755] udevd[14755]: setting mode of /dev/bus/usb/003/031 to 020664 failed: No such file or directory [ 898.799175][T14755] udevd[14755]: setting owner of /dev/bus/usb/003/031 to uid=0, gid=0 failed: No such file or directory [ 898.970994][ T5644] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 899.020339][ T5644] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 899.029838][ T5644] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 899.041281][ T5644] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 899.043424][ T5644] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 899.311663][ T35] usb 5-1: USB disconnect, device number 44 [ 899.419917][T15091] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3059'. [ 899.834033][T15104] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3062'. [ 899.926252][T15103] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3064'. [ 899.927510][T15103] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3064'. [ 899.927708][T15103] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3064'. [ 899.928142][T15103] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3064'. [ 900.005769][T15103] 9pnet_virtio: no channels available for device syz [ 900.257143][T15116] fuse: Bad value for 'fd' [ 900.710906][ T35] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 900.785884][T15083] rxe_eth0 speed is unknown, defaulting to 1000 [ 900.824246][T11540] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci6/hci6:201' [ 900.824280][T11540] CPU: 0 UID: 0 PID: 11540 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 900.824314][T11540] Tainted: [L]=SOFTLOCKUP [ 900.824322][T11540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 900.824336][T11540] Workqueue: hci6 hci_rx_work [ 900.824455][T11540] Call Trace: [ 900.824465][T11540] [ 900.824475][T11540] dump_stack_lvl+0xe8/0x150 [ 900.824516][T11540] sysfs_create_dir_ns+0x271/0x2a0 [ 900.824555][T11540] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 900.824596][T11540] ? rt_spin_unlock+0x165/0x200 [ 900.824637][T11540] kobject_add_internal+0x62c/0xce0 [ 900.824676][T11540] kobject_add+0x163/0x240 [ 900.824703][T11540] ? rt_spin_unlock+0x159/0x200 [ 900.824741][T11540] ? __pfx_kobject_add+0x10/0x10 [ 900.824778][T11540] ? get_device_parent+0x370/0x3a0 [ 900.824811][T11540] device_add+0x3fa/0xb80 [ 900.824848][T11540] hci_conn_add_sysfs+0xd5/0x210 [ 900.824910][T11540] le_conn_complete_evt+0x1094/0x1780 [ 900.824990][T11540] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 900.825023][T11540] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 900.825047][T11540] ? rt_mutex_slowunlock+0x219/0x460 [ 900.825079][T11540] ? skb_pull_data+0xf0/0x200 [ 900.825146][T11540] hci_le_conn_complete_evt+0x187/0x470 [ 900.825184][T11540] hci_event_packet+0x67a/0xf10 [ 900.825229][T11540] ? reacquire_held_locks+0x117/0x1a0 [ 900.825260][T11540] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 900.825286][T11540] ? __pfx_hci_event_packet+0x10/0x10 [ 900.825308][T11540] ? rt_spin_unlock+0x159/0x200 [ 900.825348][T11540] ? hci_send_to_monitor+0xdf/0x600 [ 900.825405][T11540] hci_rx_work+0x2b4/0x1110 [ 900.825439][T11540] ? process_scheduled_works+0x97a/0x1630 [ 900.825473][T11540] process_scheduled_works+0xc3d/0x1630 [ 900.825546][T11540] ? __pfx_process_scheduled_works+0x10/0x10 [ 900.825589][T11540] ? assign_work+0x3cf/0x5d0 [ 900.825629][T11540] worker_thread+0xa47/0xfb0 [ 900.825662][T11540] ? pv_queued_spin_unlock_traced+0x5a/0x1b0 [ 900.825705][T11540] ? __kthread_parkme+0x71/0x1f0 [ 900.825742][T11540] kthread+0x38b/0x470 [ 900.825769][T11540] ? __pfx_worker_thread+0x10/0x10 [ 900.825800][T11540] ? __pfx_kthread+0x10/0x10 [ 900.825828][T11540] ret_from_fork+0x514/0xb70 [ 900.825882][T11540] ? __pfx_ret_from_fork+0x10/0x10 [ 900.825908][T11540] ? __switch_to+0xc78/0x1410 [ 900.825934][T11540] ? __pfx_kthread+0x10/0x10 [ 900.825961][T11540] ret_from_fork_asm+0x1a/0x30 [ 900.826007][T11540] [ 900.826183][T11540] kobject: kobject_add_internal failed for hci6:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 900.826230][T11540] Bluetooth: hci6: failed to register connection device [ 900.879012][ T35] usb 3-1: Using ep0 maxpacket: 8 [ 900.879936][ T35] usb 3-1: New USB device found: idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 900.899441][ T35] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 900.899502][ T35] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 900.899546][ T35] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 901.162712][ T35] usb 3-1: config 0 descriptor?? [ 901.188029][ T35] iowarrior 3-1:0.0: no interrupt-in endpoint found [ 901.288986][T11540] Bluetooth: hci4: command tx timeout [ 901.364433][T15083] lo speed is unknown, defaulting to 1000 [ 901.365901][T15083] vcan0 speed is unknown, defaulting to 1000 [ 901.538887][ T35] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 901.689773][ T35] usb 5-1: New USB device found: idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 901.694349][ T35] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 901.737539][ T35] usb 5-1: config 0 descriptor?? [ 901.765790][ T35] cp210x 5-1:0.0: cp210x converter detected [ 902.179276][ T35] cp210x 5-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 902.308114][ T35] usb 5-1: cp210x converter now attached to ttyUSB0 [ 902.389969][ T35] usb 5-1: USB disconnect, device number 45 [ 902.533596][ T35] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 902.536596][ T35] cp210x 5-1:0.0: device disconnected [ 902.759797][T15083] bridge0: port 1(bridge_slave_0) entered blocking state [ 902.760005][T15083] bridge0: port 1(bridge_slave_0) entered disabled state [ 902.760174][T15083] bridge_slave_0: entered allmulticast mode [ 902.761860][T15083] bridge_slave_0: entered promiscuous mode [ 902.764696][T15083] bridge0: port 2(bridge_slave_1) entered blocking state [ 902.764905][T15083] bridge0: port 2(bridge_slave_1) entered disabled state [ 902.765073][T15083] bridge_slave_1: entered allmulticast mode [ 902.766782][T15083] bridge_slave_1: entered promiscuous mode [ 902.861698][T15083] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 902.866704][T15083] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 902.920599][T15083] team0: Port device team_slave_0 added [ 902.923921][T15083] team0: Port device team_slave_1 added [ 903.069553][T15083] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 903.069573][T15083] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 903.069603][T15083] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 903.086307][T15083] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 903.086324][T15083] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 903.086350][T15083] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 903.360688][T11540] Bluetooth: hci4: command tx timeout [ 903.496084][ T6431] usb 3-1: USB disconnect, device number 32 [ 903.573910][T15083] hsr_slave_0: entered promiscuous mode [ 903.575578][T15083] hsr_slave_1: entered promiscuous mode [ 903.576806][T15083] debugfs: 'hsr0' already exists in 'hsr' [ 903.576834][T15083] Cannot create hsr debugfs directory [ 903.750265][T15181] __nla_validate_parse: 1 callbacks suppressed [ 903.750291][T15181] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3086'. [ 904.377238][T15190] FAULT_INJECTION: forcing a failure. [ 904.377238][T15190] name failslab, interval 1, probability 0, space 0, times 0 [ 904.377283][T15190] CPU: 0 UID: 0 PID: 15190 Comm: syz.4.3089 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 904.377313][T15190] Tainted: [L]=SOFTLOCKUP [ 904.377322][T15190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 904.377334][T15190] Call Trace: [ 904.377343][T15190] [ 904.377353][T15190] dump_stack_lvl+0xe8/0x150 [ 904.377397][T15190] should_fail_ex+0x46b/0x600 [ 904.377439][T15190] should_failslab+0xa8/0x100 [ 904.377465][T15190] __kmalloc_cache_noprof+0x9c/0x670 [ 904.377500][T15190] ? x509_cert_parse+0x16a/0x7a0 [ 904.377531][T15190] ? x509_cert_parse+0x16a/0x7a0 [ 904.377570][T15190] x509_cert_parse+0x16a/0x7a0 [ 904.377597][T15190] ? __pfx_down_read+0x10/0x10 [ 904.377628][T15190] x509_key_preparse+0x64/0x6d0 [ 904.377657][T15190] asymmetric_key_preparse+0xb9/0x1b0 [ 904.377687][T15190] __key_create_or_update+0x360/0xa90 [ 904.377727][T15190] ? __pfx___key_create_or_update+0x10/0x10 [ 904.377752][T15190] ? lookup_user_key+0x1101/0x1230 [ 904.377797][T15190] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 904.377869][T15190] key_create_or_update+0x42/0x60 [ 904.377905][T15190] __se_sys_add_key+0x349/0x420 [ 904.377945][T15190] ? __pfx___se_sys_add_key+0x10/0x10 [ 904.377993][T15190] ? __x64_sys_add_key+0x20/0xc0 [ 904.378031][T15190] do_syscall_64+0x166/0x520 [ 904.378054][T15190] ? trace_irq_disable+0x3b/0x140 [ 904.378081][T15190] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 904.378102][T15190] ? clear_bhb_loop+0x70/0xc0 [ 904.378131][T15190] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 904.378153][T15190] RIP: 0033:0x7fcd7a36f559 [ 904.378175][T15190] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 904.378194][T15190] RSP: 002b:00007fcd785c6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 904.378220][T15190] RAX: ffffffffffffffda RBX: 00007fcd7a5f5fa0 RCX: 00007fcd7a36f559 [ 904.378237][T15190] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 904.378253][T15190] RBP: 00007fcd7a406b20 R08: ffffffffffffffff R09: 0000000000000000 [ 904.378268][T15190] R10: 00000000000004ae R11: 0000000000000246 R12: 0000000000000000 [ 904.378282][T15190] R13: 00007fcd7a5f6038 R14: 00007fcd7a5f5fa0 R15: 00007fff924bdd68 [ 904.378321][T15190] [ 905.089024][ T5745] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 905.238838][ T5745] usb 5-1: Using ep0 maxpacket: 8 [ 905.239903][ T5745] usb 5-1: New USB device found: idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 905.242420][ T5745] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 905.242465][ T5745] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 905.306580][ T5745] usb 5-1: config 0 descriptor?? [ 905.330783][ T5745] iowarrior 5-1:0.0: no interrupt-in endpoint found [ 905.439471][T11540] Bluetooth: hci4: command tx timeout [ 905.572448][T15083] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.015412][T15223] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3102'. [ 906.255497][T15083] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.905665][T15083] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 907.025050][T15234] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3108'. [ 907.064435][T15234] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3108'. [ 907.278864][ T5644] Bluetooth: hci6: command 0x0406 tx timeout [ 907.288944][ T5610] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 907.451489][ T5610] usb 3-1: Using ep0 maxpacket: 8 [ 907.452583][ T5610] usb 3-1: New USB device found: idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 907.455830][ T5610] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 907.455856][ T5610] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 907.493319][ T5610] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=3 [ 907.493348][ T5610] usb 3-1: Manufacturer: syz [ 907.493372][ T5610] usb 3-1: SerialNumber: syz [ 907.519444][ T5644] Bluetooth: hci4: command tx timeout [ 907.521336][ T5610] usb 3-1: rejected 1 configuration due to insufficient available bus power [ 907.521373][ T5610] usb 3-1: no configuration chosen from 1 choice [ 907.595487][T15083] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 907.909111][ T5610] usb 5-1: USB disconnect, device number 46 [ 908.779162][ T5610] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 908.882031][ T5765] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 908.935152][ T5610] usb 5-1: New USB device found: idVendor=0471, idProduct=081e, bcdDevice=1.00 [ 908.938273][ T5610] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 908.938304][ T5610] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 908.938344][ T5610] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 909.009727][ T5610] spcp8x5 5-1:1.0: SPCP8x5 converter detected [ 909.029752][ T5765] usb 2-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 909.029819][ T5765] usb 2-1: no configurations [ 909.029833][ T5765] usb 2-1: can't read configurations, error -22 [ 909.038020][ T5610] usb 5-1: SPCP8x5 converter now attached to ttyUSB0 [ 909.158893][ T5765] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 909.192357][T15083] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 909.278485][T15083] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 909.287530][T15083] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 909.313846][ T5765] usb 2-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 909.313887][ T5765] usb 2-1: no configurations [ 909.313939][ T5765] usb 2-1: can't read configurations, error -22 [ 909.314193][ T5765] usb usb2-port1: attempt power cycle [ 909.355996][T15083] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 909.369121][T15256] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 909.369525][T15256] SPCP8x5 ttyUSB0: Set UART format 0x30b failed (error = -32) [ 909.395259][T15083] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 909.409956][T15256] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 909.452762][T15083] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 909.456405][T15083] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 909.470440][T15256] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 909.512038][T15083] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 909.591546][T15255] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 909.628190][ T6431] usb 5-1: USB disconnect, device number 47 [ 909.689282][ T5765] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 909.693578][ T6431] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 909.702095][ T6431] spcp8x5 5-1:1.0: device disconnected [ 909.734343][ T5765] usb 2-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 909.734410][ T5765] usb 2-1: no configurations [ 909.734424][ T5765] usb 2-1: can't read configurations, error -22 [ 909.825925][T15083] 8021q: adding VLAN 0 to HW filter on device bond0 [ 909.843561][T15083] 8021q: adding VLAN 0 to HW filter on device team0 [ 909.857157][ T9218] bridge0: port 1(bridge_slave_0) entered blocking state [ 909.857316][ T9218] bridge0: port 1(bridge_slave_0) entered forwarding state [ 909.858870][ T5765] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 909.880277][ T5765] usb 2-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 909.880362][ T5765] usb 2-1: no configurations [ 909.880371][ T5765] usb 2-1: can't read configurations, error -22 [ 909.890511][ T5765] usb usb2-port1: unable to enumerate USB device [ 909.919655][ T9218] bridge0: port 2(bridge_slave_1) entered blocking state [ 909.919786][ T9218] bridge0: port 2(bridge_slave_1) entered forwarding state [ 910.062497][ T6431] usb 3-1: USB disconnect, device number 33 [ 910.738824][ T6431] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 910.889218][ T6431] usb 3-1: Using ep0 maxpacket: 32 [ 910.890005][ T6431] usb 3-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 910.893264][ T6431] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 910.897826][ T6431] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 910.897856][ T6431] usb 3-1: Product: syz [ 910.897872][ T6431] usb 3-1: Manufacturer: syz [ 910.897888][ T6431] usb 3-1: SerialNumber: syz [ 910.965147][ T6431] usb 3-1: config 0 descriptor?? [ 910.967724][T15292] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 911.135299][T15083] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 911.261527][T15083] veth0_vlan: entered promiscuous mode [ 911.304808][T15083] veth1_vlan: entered promiscuous mode [ 911.319125][ T5765] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 911.437668][T15083] veth0_macvtap: entered promiscuous mode [ 911.473801][T15083] veth1_macvtap: entered promiscuous mode [ 911.480903][ T5765] usb 5-1: Using ep0 maxpacket: 8 [ 911.481830][ T5765] usb 5-1: New USB device found: idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 911.486611][ T5765] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 911.486656][ T5765] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 911.503085][ T5765] usb 5-1: config 0 descriptor?? [ 911.511489][ T5765] iowarrior 5-1:0.0: no interrupt-in endpoint found [ 911.591269][T15083] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 911.772768][T15083] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 912.690288][ T9218] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 912.705543][ T2215] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 912.777763][ T1006] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 912.966931][ T2215] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 913.335933][ T2215] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 913.335956][ T2215] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 913.579111][ T5765] usb 3-1: USB disconnect, device number 34 [ 913.721051][ T2209] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 913.721074][ T2209] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 913.813087][T15333] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3141'. [ 914.116904][ T5765] usb 5-1: USB disconnect, device number 48 [ 914.894244][T11540] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 914.950665][T11540] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 914.961715][T11540] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 914.963945][T11540] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 914.965134][T11540] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 916.714065][T15362] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3150'. [ 916.807070][T15368] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3150'. [ 916.868623][T15370] 9pnet_virtio: no channels available for device syz [ 916.962020][ T6431] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 917.053953][T15366] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3151'. [ 917.141668][ T6431] usb 2-1: New USB device found: idVendor=1781, idProduct=0938, bcdDevice=9f.49 [ 917.143886][ T6431] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 2304, setting to 64 [ 917.143924][ T6431] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 917.143951][ T6431] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 917.143978][ T6431] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 917.151595][ T6431] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 917.151620][ T6431] usb 2-1: Product: syz [ 917.151634][ T6431] usb 2-1: Manufacturer: syz [ 917.151647][ T6431] usb 2-1: SerialNumber: syz [ 917.201928][ T6431] usb 2-1: config 0 descriptor?? [ 917.279167][ T6431] iguanair 2-1:0.0: probe with driver iguanair failed with error -12 [ 917.419890][ T4835] usb 2-1: USB disconnect, device number 38 [ 917.554605][T15353] rxe_eth0 speed is unknown, defaulting to 1000 [ 917.936050][T15353] lo speed is unknown, defaulting to 1000 [ 917.937706][T15353] vcan0 speed is unknown, defaulting to 1000 [ 919.525800][T11540] Bluetooth: hci2: command tx timeout [ 922.351579][T11540] Bluetooth: hci2: command tx timeout [ 923.159423][T15353] bridge0: port 1(bridge_slave_0) entered blocking state [ 923.159891][T15353] bridge0: port 1(bridge_slave_0) entered disabled state [ 923.160104][T15353] bridge_slave_0: entered allmulticast mode [ 923.166721][T15353] bridge_slave_0: entered promiscuous mode [ 923.174523][T15353] bridge0: port 2(bridge_slave_1) entered blocking state [ 923.174760][T15353] bridge0: port 2(bridge_slave_1) entered disabled state [ 923.174985][T15353] bridge_slave_1: entered allmulticast mode [ 923.179530][T15353] bridge_slave_1: entered promiscuous mode [ 923.257222][T15353] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 923.294886][T15353] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 923.426991][T15353] team0: Port device team_slave_0 added [ 923.437025][T15353] team0: Port device team_slave_1 added [ 923.538929][ T4835] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 923.634592][T15353] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 923.634613][T15353] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 923.634641][T15353] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 923.640058][T15353] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 923.640074][T15353] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 923.640099][T15353] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 923.703025][ T4835] usb 4-1: New USB device found: idVendor=0424, idProduct=7850, bcdDevice=0.00 [ 923.736085][ T4835] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 923.736113][ T4835] usb 4-1: Product: syz [ 923.736128][ T4835] usb 4-1: Manufacturer: syz [ 923.736148][ T4835] usb 4-1: SerialNumber: syz [ 923.921974][T15353] hsr_slave_0: entered promiscuous mode [ 923.923782][T15353] hsr_slave_1: entered promiscuous mode [ 923.925005][T15353] debugfs: 'hsr0' already exists in 'hsr' [ 923.925033][T15353] Cannot create hsr debugfs directory [ 924.028198][T15463] kvm: pic: non byte read [ 924.214174][ T4835] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 924.214243][ T4835] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 924.400242][T11540] Bluetooth: hci2: command tx timeout [ 924.629673][ T4835] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 924.629742][ T4835] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 924.710973][ T4835] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 924.741873][ T4835] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 924.809394][ T4835] usb 4-1: USB disconnect, device number 33 [ 926.481091][T11540] Bluetooth: hci2: command tx timeout [ 926.667456][T15353] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 926.801070][T15353] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 926.804704][T15353] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 926.865077][T15353] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 926.868107][T15353] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 927.029587][T15353] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 927.076999][T15353] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 927.132872][T15353] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 927.487478][T15529] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 927.627383][T15353] 8021q: adding VLAN 0 to HW filter on device bond0 [ 927.837698][T15353] 8021q: adding VLAN 0 to HW filter on device team0 [ 927.866615][ T1006] bridge0: port 1(bridge_slave_0) entered blocking state [ 927.866939][ T1006] bridge0: port 1(bridge_slave_0) entered forwarding state [ 927.897839][ T1006] bridge0: port 2(bridge_slave_1) entered blocking state [ 927.898073][ T1006] bridge0: port 2(bridge_slave_1) entered forwarding state [ 928.039157][ T5610] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 928.209316][ T5610] usb 3-1: Using ep0 maxpacket: 8 [ 928.212392][ T5610] usb 3-1: New USB device found: idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 928.214097][ T5610] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 928.214161][ T5610] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 928.261478][ T5610] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=3 [ 928.261520][ T5610] usb 3-1: Manufacturer: syz [ 928.261537][ T5610] usb 3-1: SerialNumber: syz [ 928.294222][ T5610] usb 3-1: config 0 descriptor?? [ 928.620806][ T35] usb 3-1: USB disconnect, device number 35 [ 929.309677][T15573] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3221'. [ 929.309709][T15573] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3221'. [ 929.351746][T15353] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 930.218976][ T35] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 930.374417][ T35] usb 3-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 930.376389][ T35] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 930.407317][ T35] usb 3-1: config 0 descriptor?? [ 930.432831][T15353] veth0_vlan: entered promiscuous mode [ 930.490349][T15353] veth1_vlan: entered promiscuous mode [ 930.626093][T15610] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3236'. [ 930.629018][T15610] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3236'. [ 930.629247][T15610] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3236'. [ 930.629462][T15610] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3236'. [ 930.634505][T15610] 9pnet_virtio: no channels available for device syz [ 930.693753][T15353] veth0_macvtap: entered promiscuous mode [ 930.708182][T15353] veth1_macvtap: entered promiscuous mode [ 930.757146][T15353] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 930.815453][T15353] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 930.851112][ T2211] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 930.851373][ T2211] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 930.851416][ T2211] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 931.141514][T13816] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 931.785650][ T1341] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.785733][ T1341] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.834214][ T71] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 931.834235][ T71] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 932.478195][ T9218] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 932.478220][ T9218] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 932.514187][T15639] device-mapper: table: 248:7: thin-pool: target type may not be included in a read-only table (-EINVAL) [ 932.514216][T15639] device-mapper: ioctl: error adding target to table [ 933.149181][T15642] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3248'. [ 933.150109][T15642] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3248'. [ 933.150372][T15642] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3248'. [ 933.150843][T15642] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3248'. [ 933.152281][T15642] 9pnet_virtio: no channels available for device syz [ 934.796336][T11089] usb 3-1: USB disconnect, device number 36 [ 934.927820][T15653] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3250'. [ 935.279067][T11089] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 935.450568][T11089] usb 3-1: Using ep0 maxpacket: 8 [ 935.451697][T11089] usb 3-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 935.453312][T11089] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 935.453371][T11089] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 935.453395][T11089] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 935.453421][T11089] usb 3-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 935.453443][T11089] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 935.453488][T11089] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 935.481763][T11089] usbtmc 3-1:16.0: bulk endpoints not found [ 935.709184][T15683] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3259'. [ 935.710648][T15683] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3259'. [ 935.711034][T15683] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3259'. [ 935.711411][T15683] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3259'. [ 935.711694][T15681] FAULT_INJECTION: forcing a failure. [ 935.711694][T15681] name failslab, interval 1, probability 0, space 0, times 0 [ 935.711731][T15681] CPU: 0 UID: 0 PID: 15681 Comm: syz.1.3260 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 935.711764][T15681] Tainted: [L]=SOFTLOCKUP [ 935.711772][T15681] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 935.711785][T15681] Call Trace: [ 935.711795][T15681] [ 935.711805][T15681] dump_stack_lvl+0xe8/0x150 [ 935.711847][T15681] should_fail_ex+0x46b/0x600 [ 935.711888][T15681] should_failslab+0xa8/0x100 [ 935.711912][T15681] ? flock_lock_inode+0x22a/0x1310 [ 935.711936][T15681] kmem_cache_alloc_noprof+0x99/0x680 [ 935.711969][T15681] ? flock_lock_inode+0x22a/0x1310 [ 935.712000][T15681] flock_lock_inode+0x22a/0x1310 [ 935.712037][T15681] ? __pfx_flock_lock_inode+0x10/0x10 [ 935.712072][T15681] locks_lock_inode_wait+0x10f/0x450 [ 935.712108][T15681] ? __pfx_locks_lock_inode_wait+0x10/0x10 [ 935.712154][T15681] ? __rt_spin_lock_init+0x3e/0x50 [ 935.712191][T15681] __se_sys_flock+0x4e0/0x680 [ 935.712227][T15681] ? __pfx___se_sys_flock+0x10/0x10 [ 935.712256][T15681] ? do_futex+0x458/0x4e0 [ 935.712318][T15681] ? rcu_is_watching+0x16/0xb0 [ 935.712359][T15681] do_syscall_64+0x166/0x520 [ 935.712383][T15681] ? trace_irq_disable+0x3b/0x140 [ 935.712405][T15681] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 935.712428][T15681] ? clear_bhb_loop+0x70/0xc0 [ 935.712455][T15681] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 935.712477][T15681] RIP: 0033:0x7f788ae2f559 [ 935.712498][T15681] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 935.712517][T15681] RSP: 002b:00007f7889086028 EFLAGS: 00000246 ORIG_RAX: 0000000000000049 [ 935.712542][T15681] RAX: ffffffffffffffda RBX: 00007f788b0b5fa0 RCX: 00007f788ae2f559 [ 935.712559][T15681] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004 [ 935.712573][T15681] RBP: 00007f788aec6b20 R08: 0000000000000000 R09: 0000000000000000 [ 935.712587][T15681] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 935.712601][T15681] R13: 00007f788b0b6038 R14: 00007f788b0b5fa0 R15: 00007ffd1748cda8 [ 935.712646][T15681] [ 935.714165][T15683] 9pnet_virtio: no channels available for device syz [ 938.328882][T14742] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 938.495308][T14742] usb 2-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 938.497071][T14742] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 938.535612][T14742] usb 2-1: config 0 descriptor?? [ 938.643618][T15722] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3275'. [ 938.646786][T15722] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3275'. [ 938.646997][T15722] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3275'. [ 938.647206][T15722] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3275'. [ 938.652620][T15722] 9pnet_virtio: no channels available for device syz [ 938.890740][ T35] usb 3-1: USB disconnect, device number 37 [ 939.884236][ T35] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 940.049175][ T35] usb 3-1: Using ep0 maxpacket: 8 [ 940.050308][ T35] usb 3-1: New USB device found: idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 940.051865][ T35] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 940.051920][ T35] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 940.054248][ T35] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=3 [ 940.054273][ T35] usb 3-1: Manufacturer: syz [ 940.054286][ T35] usb 3-1: SerialNumber: syz [ 940.104721][ T35] usb 3-1: config 0 descriptor?? [ 940.349174][T11089] usb 3-1: USB disconnect, device number 38 [ 940.966773][T15760] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 940.966797][T15760] device-mapper: raid: Choosing default region size of 4MiB [ 940.996502][T15760] device-mapper: raid: Device 0 specified for rebuild; clearing superblock [ 941.009692][T11089] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 941.141022][ T35] usb 2-1: USB disconnect, device number 39 [ 941.154012][T15760] mdX: WARNING: ram5 appears to be on the same physical disk as ram5. [ 941.154052][T15760] True protection against single-disk failure might be compromised. [ 941.173895][T11089] usb 5-1: Using ep0 maxpacket: 16 [ 941.178433][T11089] usb 5-1: New USB device found: idVendor=04f3, idProduct=074d, bcdDevice=0.00 [ 941.205263][T11089] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 941.205294][T11089] usb 5-1: config 0 has no interface number 0 [ 941.205345][T11089] usb 5-1: config 0 interface 1 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 941.205373][T11089] usb 5-1: config 0 interface 1 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 941.205396][T11089] usb 5-1: config 0 interface 1 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 941.205422][T11089] usb 5-1: config 0 interface 1 has no altsetting 0 [ 941.205459][T11089] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 941.253487][T15760] md/raid1:mdX: active with 1 out of 2 mirrors [ 941.254359][T15760] mdX: invalid bitmap file superblock: bad magic [ 941.254646][T15760] md: mdX: invalid bitmap magic 0x0 [ 941.254680][T15760] mdX: failed to create bitmap (-22) [ 941.315797][T11089] usb 5-1: config 0 descriptor?? [ 941.340426][T11089] usbhid 5-1:0.1: fixing wrong optional hid class descriptors count [ 941.441175][T15760] device-mapper: table: 248:8: raid: Failed to run raid array (-EINVAL) [ 941.441205][T15760] device-mapper: ioctl: error adding target to table [ 941.619194][ T4835] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 941.730801][T11089] usbhid 5-1:0.1: can't add hid device: -71 [ 941.730984][T11089] usbhid 5-1:0.1: probe with driver usbhid failed with error -71 [ 941.765760][T11089] usb 5-1: USB disconnect, device number 49 [ 941.789975][ T4835] usb 2-1: New USB device found: idVendor=1199, idProduct=b000, bcdDevice=0.00 [ 941.794992][ T4835] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 941.795064][ T4835] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 941.795113][ T4835] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 942.078299][T11089] usb 2-1: USB disconnect, device number 40 [ 942.616029][T11089] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 942.779345][T11089] usb 5-1: Using ep0 maxpacket: 8 [ 942.781222][T11089] usb 5-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 942.804106][T11089] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 942.804153][T11089] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 942.804167][T11089] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 942.804181][T11089] usb 5-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 942.804193][T11089] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 942.804221][T11089] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 942.886551][T11089] usbtmc 5-1:16.0: bulk endpoints not found [ 943.868963][T11089] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 944.028925][T11089] usb 3-1: Using ep0 maxpacket: 32 [ 944.029792][T11089] usb 3-1: New USB device found: idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 944.032695][T11089] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 944.032713][T11089] usb 3-1: config 0 has no interface number 0 [ 944.076148][T11089] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 944.076179][T11089] usb 3-1: Product: syz [ 944.076194][T11089] usb 3-1: Manufacturer: syz [ 944.076210][T11089] usb 3-1: SerialNumber: syz [ 944.079232][T15786] Bluetooth: hci5: command 0x0406 tx timeout [ 944.159714][T11089] usb 3-1: config 0 descriptor?? [ 944.185906][T11089] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 944.185975][T11089] usb 3-1: selecting invalid altsetting 1 [ 944.185986][T11089] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 944.523472][T11089] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 944.523895][T11089] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 944.523955][T11089] usb 3-1: media controller created [ 944.585869][T15833] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3313'. [ 944.588156][T15833] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3313'. [ 944.588395][T15833] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3313'. [ 944.589028][T15833] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3313'. [ 944.635772][T15833] 9pnet_virtio: no channels available for device syz [ 944.683959][T11089] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 944.801053][T11089] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 944.801135][T11089] zl10353_read_register: readreg error (reg=127, ret==-71) [ 944.802241][T11089] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 945.066458][T11089] usb 3-1: USB disconnect, device number 39 [ 945.376307][T11089] usb 5-1: USB disconnect, device number 50 [ 945.888832][T11089] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 945.998829][T14742] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 946.056636][T11089] usb 3-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 946.072177][T11089] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 946.072205][T11089] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 946.072244][T11089] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 946.078328][T11089] usb 3-1: config 0 descriptor?? [ 946.199537][T14742] usb 5-1: Using ep0 maxpacket: 8 [ 946.205489][T14742] usb 5-1: New USB device found: idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 946.210954][T14742] usb 5-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 946.211081][T14742] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 946.314284][T14742] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=3 [ 946.314315][T14742] usb 5-1: Manufacturer: syz [ 946.314330][T14742] usb 5-1: SerialNumber: syz [ 946.459064][T14742] usb 5-1: config 0 descriptor?? [ 946.589806][T11089] usb 3-1: string descriptor 0 read error: -71 [ 946.693557][T14742] usb 5-1: USB disconnect, device number 51 [ 946.785964][T11089] usb 3-1: USB disconnect, device number 40 [ 947.424650][T15887] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 948.036494][T11540] Bluetooth: hci6: Ignoring HCI_Connection_Complete for existing connection [ 948.061662][T15908] fuse: Bad value for 'fd' [ 948.876611][T15918] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 949.343847][T15936] fuse: Bad value for 'fd' [ 949.428871][T14742] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 949.592852][T11540] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:201' [ 949.592894][T11540] CPU: 1 UID: 0 PID: 11540 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 949.592926][T11540] Tainted: [L]=SOFTLOCKUP [ 949.592933][T11540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 949.592948][T11540] Workqueue: hci5 hci_rx_work [ 949.592980][T11540] Call Trace: [ 949.592989][T11540] [ 949.592999][T11540] dump_stack_lvl+0xe8/0x150 [ 949.593040][T11540] sysfs_create_dir_ns+0x271/0x2a0 [ 949.593078][T11540] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 949.593116][T11540] ? rt_spin_unlock+0x165/0x200 [ 949.593153][T11540] kobject_add_internal+0x62c/0xce0 [ 949.593192][T11540] kobject_add+0x163/0x240 [ 949.593217][T11540] ? rt_spin_unlock+0x159/0x200 [ 949.593253][T11540] ? __pfx_kobject_add+0x10/0x10 [ 949.593290][T11540] ? get_device_parent+0x370/0x3a0 [ 949.593321][T11540] device_add+0x3fa/0xb80 [ 949.593354][T11540] hci_conn_add_sysfs+0xd5/0x210 [ 949.593380][T11540] le_conn_complete_evt+0x1094/0x1780 [ 949.593422][T11540] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 949.593454][T11540] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 949.593478][T11540] ? rt_mutex_slowunlock+0x219/0x460 [ 949.593508][T11540] ? skb_pull_data+0xf0/0x200 [ 949.593542][T11540] hci_le_conn_complete_evt+0x187/0x470 [ 949.593578][T11540] hci_event_packet+0x67a/0xf10 [ 949.593601][T11540] ? reacquire_held_locks+0x117/0x1a0 [ 949.593632][T11540] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 949.593657][T11540] ? __pfx_hci_event_packet+0x10/0x10 [ 949.593678][T11540] ? rt_spin_unlock+0x159/0x200 [ 949.593717][T11540] ? hci_send_to_monitor+0xdf/0x600 [ 949.593752][T11540] hci_rx_work+0x2b4/0x1110 [ 949.593785][T11540] ? process_scheduled_works+0x97a/0x1630 [ 949.593818][T11540] process_scheduled_works+0xc3d/0x1630 [ 949.593914][T11540] ? __pfx_process_scheduled_works+0x10/0x10 [ 949.593957][T11540] ? assign_work+0x3cf/0x5d0 [ 949.593997][T11540] worker_thread+0xa47/0xfb0 [ 949.594029][T11540] ? pv_queued_spin_unlock_traced+0x5a/0x1b0 [ 949.594071][T11540] ? __kthread_parkme+0x71/0x1f0 [ 949.594107][T11540] kthread+0x38b/0x470 [ 949.594134][T11540] ? __pfx_worker_thread+0x10/0x10 [ 949.594165][T11540] ? __pfx_kthread+0x10/0x10 [ 949.594193][T11540] ret_from_fork+0x514/0xb70 [ 949.594224][T11540] ? __pfx_ret_from_fork+0x10/0x10 [ 949.594249][T11540] ? __switch_to+0xc78/0x1410 [ 949.594275][T11540] ? __pfx_kthread+0x10/0x10 [ 949.594302][T11540] ret_from_fork_asm+0x1a/0x30 [ 949.594348][T11540] [ 949.594508][T11540] kobject: kobject_add_internal failed for hci5:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 949.594553][T11540] Bluetooth: hci5: failed to register connection device [ 949.603936][T14742] usb 5-1: New USB device found: idVendor=0424, idProduct=7850, bcdDevice=0.00 [ 949.615215][T14742] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 949.615243][T14742] usb 5-1: Product: syz [ 949.615257][T14742] usb 5-1: Manufacturer: syz [ 949.615271][T14742] usb 5-1: SerialNumber: syz [ 950.347131][T14742] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 950.347200][T14742] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 950.370491][T14742] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 950.395494][T14742] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -32 [ 950.464653][T15956] overlayfs: failed to clone lowerpath [ 950.474392][ T5610] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 950.628858][ T5610] usb 3-1: Using ep0 maxpacket: 32 [ 950.629631][ T5610] usb 3-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 950.630985][ T5610] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 950.633546][ T5610] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 950.633573][ T5610] usb 3-1: Product: syz [ 950.633589][ T5610] usb 3-1: Manufacturer: syz [ 950.633603][ T5610] usb 3-1: SerialNumber: syz [ 950.692710][ T5610] usb 3-1: config 0 descriptor?? [ 950.693626][T15952] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 952.240180][ T35] usb 5-1: USB disconnect, device number 52 [ 952.276573][T15996] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3377'. [ 952.281250][T15996] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3377'. [ 952.281552][T15996] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3377'. [ 952.281812][T15996] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3377'. [ 952.327503][T15996] 9pnet_virtio: no channels available for device syz [ 953.420516][T11089] usb 3-1: USB disconnect, device number 41 [ 953.565064][T16023] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3389'. [ 953.565534][T16023] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3389'. [ 953.565744][T16023] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3389'. [ 953.565956][T16023] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3389'. [ 953.566927][T16023] 9pnet_virtio: no channels available for device syz [ 953.701122][T16027] jffs2: notice: (16027) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 953.738744][T16027] jffs2 filesystem being mounted at /109/dir0 supports timestamps until 2106-02-07 (0xffffffff) [ 954.396223][T16046] fuse: Bad value for 'fd' [ 954.697489][T16050] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 954.907524][T16054] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 954.922169][ T4835] kernel read not supported for file /trace_pipe (pid: 4835 comm: kworker/0:2) [ 955.390842][T16061] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3404'. [ 955.391322][T16061] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3404'. [ 955.394787][T16061] 9pnet_virtio: no channels available for device syz [ 956.119021][ T35] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 956.268961][ T35] usb 5-1: Using ep0 maxpacket: 32 [ 956.270150][ T35] usb 5-1: New USB device found: idVendor=046d, idProduct=c31c, bcdDevice=0.40 [ 956.273214][ T35] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 956.273245][ T35] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 956.273283][ T35] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 956.331157][ T35] usb 5-1: config 0 descriptor?? [ 956.342319][ T35] hub 5-1:0.0: USB hub found [ 956.572943][ T35] hub 5-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 956.774534][T16088] 9pnet_virtio: no channels available for device syz [ 956.889226][T15786] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 957.017878][T15786] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 957.024665][T15786] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 957.054127][ T35] usbhid 5-1:0.0: can't add hid device: -71 [ 957.054268][ T35] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 957.055550][T15786] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 957.091171][T15786] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 957.100119][ T35] usb 5-1: USB disconnect, device number 53 [ 958.055192][T16115] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 958.094666][T14742] kernel read not supported for file /trace_pipe (pid: 14742 comm: kworker/0:3) [ 958.391156][T16086] rxe_eth0 speed is unknown, defaulting to 1000 [ 959.090762][T16130] __nla_validate_parse: 6 callbacks suppressed [ 959.090787][T16130] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3429'. [ 959.091565][T16130] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3429'. [ 959.091759][T16130] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3429'. [ 959.092232][T16130] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3429'. [ 959.094277][T16130] 9pnet_virtio: no channels available for device syz [ 959.225617][T16086] lo speed is unknown, defaulting to 1000 [ 959.228390][T16086] vcan0 speed is unknown, defaulting to 1000 [ 959.280249][T15786] Bluetooth: hci0: command tx timeout [ 961.359106][T15786] Bluetooth: hci0: command tx timeout [ 963.260044][T16086] bridge0: port 1(bridge_slave_0) entered blocking state [ 963.260206][T16086] bridge0: port 1(bridge_slave_0) entered disabled state [ 963.260449][T16086] bridge_slave_0: entered allmulticast mode [ 963.267246][T16086] bridge_slave_0: entered promiscuous mode [ 963.277006][T16086] bridge0: port 2(bridge_slave_1) entered blocking state [ 963.277246][T16086] bridge0: port 2(bridge_slave_1) entered disabled state [ 963.277445][T16086] bridge_slave_1: entered allmulticast mode [ 963.291210][T16086] bridge_slave_1: entered promiscuous mode [ 963.389327][T16086] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 963.395830][T16086] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 963.438843][T15786] Bluetooth: hci0: command tx timeout [ 963.505887][T16086] team0: Port device team_slave_0 added [ 963.545329][T16086] team0: Port device team_slave_1 added [ 963.612425][T16174] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 963.898994][T16086] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 963.899016][T16086] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 963.899046][T16086] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 963.906379][T16086] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 963.906397][T16086] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 963.906424][T16086] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 964.123579][T16086] hsr_slave_0: entered promiscuous mode [ 964.125139][T16086] hsr_slave_1: entered promiscuous mode [ 964.126185][T16086] debugfs: 'hsr0' already exists in 'hsr' [ 964.126212][T16086] Cannot create hsr debugfs directory [ 965.522249][T15786] Bluetooth: hci0: command tx timeout [ 966.284501][T16227] FAULT_INJECTION: forcing a failure. [ 966.284501][T16227] name failslab, interval 1, probability 0, space 0, times 0 [ 966.284541][T16227] CPU: 0 UID: 0 PID: 16227 Comm: syz.4.3465 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 966.284572][T16227] Tainted: [L]=SOFTLOCKUP [ 966.284580][T16227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 966.284592][T16227] Call Trace: [ 966.284601][T16227] [ 966.284611][T16227] dump_stack_lvl+0xe8/0x150 [ 966.284652][T16227] should_fail_ex+0x46b/0x600 [ 966.284691][T16227] should_failslab+0xa8/0x100 [ 966.284716][T16227] __kmalloc_node_track_caller_noprof+0xf6/0x7b0 [ 966.284745][T16227] ? __kasan_kmalloc+0x93/0xb0 [ 966.284774][T16227] ? snd_timer_instance_new+0x6a/0x260 [ 966.284799][T16227] ? snd_timer_instance_new+0x6a/0x260 [ 966.284833][T16227] kstrdup+0x42/0x100 [ 966.284867][T16227] snd_timer_instance_new+0x6a/0x260 [ 966.284897][T16227] snd_seq_timer_open+0x23e/0x620 [ 966.285016][T16227] ? __pfx_snd_seq_timer_open+0x10/0x10 [ 966.285054][T16227] ? rt_spin_unlock+0x159/0x200 [ 966.285092][T16227] ? rt_spin_unlock+0x165/0x200 [ 966.285124][T16227] snd_seq_queue_alloc+0x3c6/0x730 [ 966.285153][T16227] snd_seq_ioctl_create_queue+0x7f/0x3c0 [ 966.285211][T16227] snd_seq_oss_open+0x657/0xf80 [ 966.285247][T16227] ? __pfx_snd_seq_oss_open+0x10/0x10 [ 966.285289][T16227] ? __lock_acquire+0x747/0x2de0 [ 966.285360][T16227] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 966.285405][T16227] ? __raw_callee_save_pv_queued_spin_unlock_traced+0x15/0x40 [ 966.285439][T16227] ? __pfx_snd_seq_oss_event_input+0x10/0x10 [ 966.285469][T16227] ? __pfx_free_devinfo+0x10/0x10 [ 966.285496][T16227] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 966.285519][T16227] ? mutex_lock_nested+0x14d/0x1d0 [ 966.285544][T16227] ? odev_open+0x5c/0xa0 [ 966.285573][T16227] odev_open+0x67/0xa0 [ 966.285599][T16227] chrdev_open+0x4dc/0x600 [ 966.285624][T16227] ? __pfx_chrdev_open+0x10/0x10 [ 966.285642][T16227] ? fsnotify_open_perm_and_set_mode+0x13b/0x6c0 [ 966.285681][T16227] ? __pfx_chrdev_open+0x10/0x10 [ 966.285702][T16227] do_dentry_open+0x841/0x1410 [ 966.285738][T16227] vfs_open_consume+0x4a/0x360 [ 966.285759][T16227] ? path_openat+0x16e6/0x2100 [ 966.285791][T16227] path_openat+0x1701/0x2100 [ 966.285841][T16227] do_file_open+0x23e/0x4a0 [ 966.285868][T16227] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 966.285897][T16227] ? __pfx_do_file_open+0x10/0x10 [ 966.285951][T16227] ? alloc_fd+0x6b2/0x760 [ 966.285991][T16227] do_sys_openat2+0x115/0x200 [ 966.286015][T16227] ? __se_sys_futex+0x3a8/0x450 [ 966.286044][T16227] ? __pfx_do_sys_openat2+0x10/0x10 [ 966.286076][T16227] ? rcu_is_watching+0x16/0xb0 [ 966.286106][T16227] __x64_sys_openat+0x138/0x170 [ 966.286137][T16227] do_syscall_64+0x166/0x520 [ 966.286161][T16227] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 966.286184][T16227] ? clear_bhb_loop+0x70/0xc0 [ 966.286212][T16227] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 966.286234][T16227] RIP: 0033:0x7f9c09ccf559 [ 966.286257][T16227] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 966.286276][T16227] RSP: 002b:00007f9c07f26028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 966.286313][T16227] RAX: ffffffffffffffda RBX: 00007f9c09f55fa0 RCX: 00007f9c09ccf559 [ 966.286330][T16227] RDX: 0000000000080200 RSI: 0000200000003440 RDI: ffffffffffffff9c [ 966.286346][T16227] RBP: 00007f9c09d66b20 R08: 0000000000000000 R09: 0000000000000000 [ 966.286361][T16227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 966.286374][T16227] R13: 00007f9c09f56038 R14: 00007f9c09f55fa0 R15: 00007ffd58da4078 [ 966.286413][T16227] [ 966.780257][T16086] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 966.825632][T16086] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 966.826945][T16086] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 966.892984][T16086] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 966.895495][T16086] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 966.945768][T16086] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 967.023470][T16086] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 967.201944][T16086] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 968.007184][T16086] 8021q: adding VLAN 0 to HW filter on device bond0 [ 968.187488][T16086] 8021q: adding VLAN 0 to HW filter on device team0 [ 968.235830][ T71] bridge0: port 1(bridge_slave_0) entered blocking state [ 968.236908][ T71] bridge0: port 1(bridge_slave_0) entered forwarding state [ 968.386298][ T1013] bridge0: port 2(bridge_slave_1) entered blocking state [ 968.388184][ T1013] bridge0: port 2(bridge_slave_1) entered forwarding state [ 968.522314][T16268] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3477'. [ 968.646388][T16272] syz_tun: entered allmulticast mode [ 968.786659][T16268] nbd0: detected capacity change from 0 to 125 [ 969.108142][T15786] block nbd0: Receive control failed (result -104) [ 969.573967][T16300] syz_tun: entered allmulticast mode [ 969.914311][T16311] netlink: 188 bytes leftover after parsing attributes in process `syz.4.3493'. [ 969.917816][T16311] netlink: 188 bytes leftover after parsing attributes in process `syz.4.3493'. [ 970.447577][T16086] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 970.927112][T16086] veth0_vlan: entered promiscuous mode [ 970.940411][T16086] veth1_vlan: entered promiscuous mode [ 970.997386][T16086] veth0_macvtap: entered promiscuous mode [ 971.004504][T16086] veth1_macvtap: entered promiscuous mode [ 971.020382][T16086] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 971.046676][T16086] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 971.079624][T12527] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 971.079718][T12527] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 971.079760][T12527] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 971.353480][ T2209] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 971.893775][T12527] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 971.893800][T12527] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 972.246080][T12527] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 972.246106][T12527] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 973.293222][ T4835] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 973.341265][T16352] netlink: 164 bytes leftover after parsing attributes in process `syz.3.3504'. [ 973.344414][T16352] netlink: 164 bytes leftover after parsing attributes in process `syz.3.3504'. [ 973.452544][ T4835] usb 3-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 973.459751][ T4835] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 973.532552][ T4835] usb 3-1: config 0 descriptor?? [ 973.762742][ T4835] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 973.763278][ T4835] [drm:udl_init] *ERROR* Selecting channel failed [ 974.024280][ T4835] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 1 [ 974.024312][ T4835] [drm] Initialized udl on minor 1 [ 974.033606][ T4835] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 974.034188][ T4835] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 974.056299][ T4835] usb 3-1: USB disconnect, device number 42 [ 974.497802][T16370] syz_tun: entered allmulticast mode [ 974.739210][T16382] netlink: 164 bytes leftover after parsing attributes in process `syz.1.3516'. [ 974.744602][T16382] netlink: 164 bytes leftover after parsing attributes in process `syz.1.3516'. [ 974.879192][T15786] Bluetooth: hci3: command 0x0406 tx timeout [ 975.008943][ T5745] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 975.158855][ T5745] usb 3-1: Using ep0 maxpacket: 8 [ 975.159928][ T5745] usb 3-1: New USB device found: idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 975.163126][ T5745] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 975.163197][ T5745] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 975.166905][ T5745] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=3 [ 975.166931][ T5745] usb 3-1: Manufacturer: syz [ 975.166948][ T5745] usb 3-1: SerialNumber: syz [ 975.237844][ T5745] usb 3-1: config 0 descriptor?? [ 975.701434][T16405] fuse: Bad value for 'fd' [ 975.884922][T16410] syz_tun: entered allmulticast mode [ 975.903479][ T5610] usb 3-1: USB disconnect, device number 43 [ 977.759535][ T5610] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 977.909399][ T5610] usb 7-1: Using ep0 maxpacket: 8 [ 977.915192][ T5610] usb 7-1: unable to get BOS descriptor or descriptor too short [ 977.915261][ T5610] usb 7-1: New USB device found: idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 977.921504][ T5610] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 977.921561][ T5610] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 977.921587][ T5610] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 977.921608][ T5610] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 65535, setting to 1024 [ 977.921641][ T5610] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1024 [ 977.921663][ T5610] usb 7-1: config 0 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 977.946936][ T5610] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 977.946965][ T5610] usb 7-1: Product: syz [ 977.946979][ T5610] usb 7-1: Manufacturer: syz [ 977.946993][ T5610] usb 7-1: SerialNumber: syz [ 977.975165][ T5610] usb 7-1: config 0 descriptor?? [ 977.979645][T16424] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 978.014261][ T5610] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 978.353811][T16424] FAULT_INJECTION: forcing a failure. [ 978.353811][T16424] name failslab, interval 1, probability 0, space 0, times 0 [ 978.353863][T16424] CPU: 1 UID: 0 PID: 16424 Comm: syz.6.3535 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 978.353897][T16424] Tainted: [L]=SOFTLOCKUP [ 978.353905][T16424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 978.353919][T16424] Call Trace: [ 978.353928][T16424] [ 978.353938][T16424] dump_stack_lvl+0xe8/0x150 [ 978.353983][T16424] should_fail_ex+0x46b/0x600 [ 978.354024][T16424] should_failslab+0xa8/0x100 [ 978.354050][T16424] __kmalloc_cache_noprof+0x9c/0x670 [ 978.354083][T16424] ? fib_net_init+0x165/0x410 [ 978.354220][T16424] ? fib_net_init+0x165/0x410 [ 978.354259][T16424] fib_net_init+0x165/0x410 [ 978.354289][T16424] ? __pfx_fib_net_init+0x10/0x10 [ 978.354319][T16424] ? timer_init_key+0x161/0x2c0 [ 978.354359][T16424] ? devinet_init_net+0x5c8/0x7c0 [ 978.354397][T16424] ops_init+0x35d/0x5d0 [ 978.354443][T16424] setup_net+0x118/0x350 [ 978.354476][T16424] ? __pfx_setup_net+0x10/0x10 [ 978.354507][T16424] ? bpf_lsm_namespace_init+0x9/0x20 [ 978.354541][T16424] ? __ns_common_init+0x384/0x590 [ 978.354570][T16424] copy_net_ns+0x536/0x770 [ 978.354606][T16424] create_new_namespaces+0x3f0/0x6b0 [ 978.354643][T16424] ? security_capable+0x7e/0x2c0 [ 978.354683][T16424] ? copy_namespaces+0x5c/0x4b0 [ 978.354717][T16424] copy_namespaces+0x432/0x4b0 [ 978.354753][T16424] copy_process+0x1f1c/0x44c0 [ 978.354782][T16424] ? update_protect_slice+0x45/0x320 [ 978.354830][T16424] ? copy_process+0xd17/0x44c0 [ 978.354880][T16424] ? __pfx_copy_process+0x10/0x10 [ 978.354915][T16424] ? futex_wait+0x2a2/0x390 [ 978.354955][T16424] kernel_clone+0x2d2/0x8d0 [ 978.354990][T16424] ? __pfx_kernel_clone+0x10/0x10 [ 978.355035][T16424] ? do_futex+0x3e7/0x4e0 [ 978.355070][T16424] __x64_sys_clone+0x1b6/0x230 [ 978.355107][T16424] ? __pfx___x64_sys_clone+0x10/0x10 [ 978.355158][T16424] ? rcu_is_watching+0x16/0xb0 [ 978.355197][T16424] do_syscall_64+0x166/0x520 [ 978.355220][T16424] ? trace_irq_disable+0x3b/0x140 [ 978.355242][T16424] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 978.355265][T16424] ? clear_bhb_loop+0x70/0xc0 [ 978.355293][T16424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 978.355315][T16424] RIP: 0033:0x7f811933f559 [ 978.355337][T16424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 978.355357][T16424] RSP: 002b:00007f8117595fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 978.355383][T16424] RAX: ffffffffffffffda RBX: 00007f81195c5fa0 RCX: 00007f811933f559 [ 978.355400][T16424] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f8024000 [ 978.355415][T16424] RBP: 00007f81193d6b20 R08: 0000000000000000 R09: 0000000000000000 [ 978.355429][T16424] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 978.355443][T16424] R13: 00007f81195c6038 R14: 00007f81195c5fa0 R15: 00007ffd51e59ee8 [ 978.355482][T16424] [ 978.941502][ T5610] snd-usb-audio 7-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 978.967079][ T5610] usb 7-1: USB disconnect, device number 2 [ 980.287339][T16454] udevd[16454]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 981.068852][T14742] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 981.242574][T14742] usb 3-1: unable to get BOS descriptor or descriptor too short [ 981.242641][T14742] usb 3-1: New USB device found: idVendor=1235, idProduct=0010, bcdDevice=0.40 [ 981.245098][T14742] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 981.245123][T14742] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 981.276259][T14742] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 981.276289][T14742] usb 3-1: Product: syz [ 981.276302][T14742] usb 3-1: Manufacturer: syz [ 981.276315][T14742] usb 3-1: SerialNumber: syz [ 981.336339][T14742] usb 3-1: selecting invalid altsetting 1 [ 981.337478][T14742] usb 3-1: unit 6 not found! [ 981.337501][T14742] usb 3-1: unit 2 not found! [ 981.437614][T14742] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 981.527303][T16455] udevd[16455]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 981.543298][T16491] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3562'. [ 981.987857][T16501] br_netfilter no longer supported in user namespaces [ 982.001596][T16501] rxe_eth0 speed is unknown, defaulting to 1000 [ 982.115023][T16506] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 982.123877][ T5610] kernel read not supported for file /trace_pipe (pid: 5610 comm: kworker/1:3) [ 982.297772][T16512] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 982.298539][T16512] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 982.825715][T16521] fuse: Bad value for 'fd' [ 982.981989][T16501] lo speed is unknown, defaulting to 1000 [ 982.988362][T16501] vcan0 speed is unknown, defaulting to 1000 [ 983.068926][ T35] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 983.252026][ T35] usb 7-1: New USB device found: idVendor=0525, idProduct=a4a1, bcdDevice=0.40 [ 983.256710][ T35] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 983.256741][ T35] usb 7-1: config 0 has no interfaces? [ 983.266713][ T35] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 983.272865][ T35] usb 7-1: Product: syz [ 983.272887][ T35] usb 7-1: Manufacturer: syz [ 983.272901][ T35] usb 7-1: SerialNumber: syz [ 983.312318][ T35] usb 7-1: config 0 descriptor?? [ 983.890562][ T35] usb 3-1: USB disconnect, device number 44 [ 983.974679][T16532] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 983.975429][T16532] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 984.359243][ T35] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 984.524908][ T35] usb 3-1: Using ep0 maxpacket: 8 [ 984.535666][ T35] usb 3-1: New USB device found: idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 984.537118][ T35] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 984.537176][ T35] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 984.573909][ T35] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=3 [ 984.573940][ T35] usb 3-1: Manufacturer: syz [ 984.573956][ T35] usb 3-1: SerialNumber: syz [ 984.607781][ T35] usb 3-1: config 0 descriptor?? [ 984.887526][T16552] fuse: Bad value for 'fd' [ 984.915522][T16550] netlink: 164 bytes leftover after parsing attributes in process `syz.4.3586'. [ 984.932682][T14742] usb 3-1: USB disconnect, device number 45 [ 984.968501][T16553] netlink: 164 bytes leftover after parsing attributes in process `syz.4.3586'. [ 985.324011][T16563] fuse: Bad value for 'fd' [ 985.844334][T16576] fuse: Bad value for 'fd' [ 985.947424][ T35] usb 7-1: USB disconnect, device number 3 [ 986.409084][ T35] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 986.445716][T16590] fuse: Bad value for 'fd' [ 986.566070][ T35] usb 7-1: Using ep0 maxpacket: 8 [ 986.578513][ T35] usb 7-1: unable to get BOS descriptor or descriptor too short [ 986.578578][ T35] usb 7-1: New USB device found: idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 986.606536][ T35] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 986.606599][ T35] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 986.606629][ T35] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 986.606653][ T35] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 65535, setting to 1024 [ 986.606681][ T35] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1024 [ 986.606704][ T35] usb 7-1: config 0 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 986.677377][ T35] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 986.677408][ T35] usb 7-1: Product: syz [ 986.677424][ T35] usb 7-1: Manufacturer: syz [ 986.677439][ T35] usb 7-1: SerialNumber: syz [ 986.726736][ T35] usb 7-1: config 0 descriptor?? [ 986.735964][T16579] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 986.762329][ T35] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 986.954261][T16579] FAULT_INJECTION: forcing a failure. [ 986.954261][T16579] name failslab, interval 1, probability 0, space 0, times 0 [ 986.954306][T16579] CPU: 1 UID: 0 PID: 16579 Comm: syz.6.3601 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 986.954338][T16579] Tainted: [L]=SOFTLOCKUP [ 986.954345][T16579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 986.954357][T16579] Call Trace: [ 986.954366][T16579] [ 986.954375][T16579] dump_stack_lvl+0xe8/0x150 [ 986.954416][T16579] should_fail_ex+0x46b/0x600 [ 986.954456][T16579] should_failslab+0xa8/0x100 [ 986.954480][T16579] __kmalloc_noprof+0xf6/0x790 [ 986.954511][T16579] ? security_sk_alloc+0x52/0x360 [ 986.954532][T16579] ? security_sk_alloc+0x52/0x360 [ 986.954560][T16579] security_sk_alloc+0x52/0x360 [ 986.954582][T16579] sk_prot_alloc+0x101/0x210 [ 986.954615][T16579] ? sk_alloc+0x27/0x390 [ 986.954646][T16579] sk_alloc+0x3a/0x390 [ 986.954682][T16579] __netlink_create+0x62/0x260 [ 986.954795][T16579] ? __netlink_kernel_create+0xd4/0x720 [ 986.954826][T16579] __netlink_kernel_create+0x13d/0x720 [ 986.954858][T16579] ? __pfx___netlink_kernel_create+0x10/0x10 [ 986.954890][T16579] ? fib_net_init+0x21d/0x410 [ 986.954928][T16579] fib_net_init+0x22f/0x410 [ 986.954959][T16579] ? __pfx_fib_net_init+0x10/0x10 [ 986.954989][T16579] ? __pfx_nl_fib_input+0x10/0x10 [ 986.955026][T16579] ? devinet_init_net+0x5c8/0x7c0 [ 986.955064][T16579] ops_init+0x35d/0x5d0 [ 986.955118][T16579] setup_net+0x118/0x350 [ 986.955153][T16579] ? __pfx_setup_net+0x10/0x10 [ 986.955183][T16579] ? bpf_lsm_namespace_init+0x9/0x20 [ 986.955219][T16579] ? __ns_common_init+0x384/0x590 [ 986.955248][T16579] copy_net_ns+0x536/0x770 [ 986.955281][T16579] create_new_namespaces+0x3f0/0x6b0 [ 986.955316][T16579] ? security_capable+0x7e/0x2c0 [ 986.955345][T16579] ? copy_namespaces+0x5c/0x4b0 [ 986.955376][T16579] copy_namespaces+0x432/0x4b0 [ 986.955410][T16579] copy_process+0x1f1c/0x44c0 [ 986.955449][T16579] ? copy_process+0xd17/0x44c0 [ 986.955496][T16579] ? __pfx_copy_process+0x10/0x10 [ 986.955524][T16579] ? futex_wait+0x2a2/0x390 [ 986.955560][T16579] kernel_clone+0x2d2/0x8d0 [ 986.955593][T16579] ? __pfx_kernel_clone+0x10/0x10 [ 986.955635][T16579] ? do_futex+0x3e7/0x4e0 [ 986.955666][T16579] __x64_sys_clone+0x1b6/0x230 [ 986.955697][T16579] ? __pfx___x64_sys_clone+0x10/0x10 [ 986.955745][T16579] ? rcu_is_watching+0x16/0xb0 [ 986.955784][T16579] do_syscall_64+0x166/0x520 [ 986.955805][T16579] ? trace_irq_disable+0x3b/0x140 [ 986.955828][T16579] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 986.955851][T16579] ? clear_bhb_loop+0x70/0xc0 [ 986.955876][T16579] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 986.955898][T16579] RIP: 0033:0x7f811933f559 [ 986.955920][T16579] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 986.955939][T16579] RSP: 002b:00007f8117595fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 986.955964][T16579] RAX: ffffffffffffffda RBX: 00007f81195c5fa0 RCX: 00007f811933f559 [ 986.955978][T16579] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f8024000 [ 986.955991][T16579] RBP: 00007f81193d6b20 R08: 0000000000000000 R09: 0000000000000000 [ 986.956004][T16579] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 986.956017][T16579] R13: 00007f81195c6038 R14: 00007f81195c5fa0 R15: 00007ffd51e59ee8 [ 986.956051][T16579] [ 987.108170][T16604] fuse: Bad value for 'fd' [ 987.298817][ T4835] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 987.449808][ T4835] usb 3-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 987.457319][ T4835] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 987.553397][T16610] rxe_eth0 speed is unknown, defaulting to 1000 [ 987.583245][ T4835] usb 3-1: config 0 descriptor?? [ 987.727289][ T35] snd-usb-audio 7-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 987.775640][ T35] usb 7-1: USB disconnect, device number 4 [ 987.905221][T16412] udevd[16412]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 988.094447][ T4835] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 988.095005][ T4835] [drm:udl_init] *ERROR* Selecting channel failed [ 988.405987][ T4835] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 1 [ 988.406017][ T4835] [drm] Initialized udl on minor 1 [ 988.408951][ T4835] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 988.444666][ T4835] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 988.624722][T14742] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 988.672829][ T4835] usb 3-1: USB disconnect, device number 46 [ 988.803011][T16634] fuse: Bad value for 'fd' [ 988.804018][T16633] netlink: 164 bytes leftover after parsing attributes in process `syz.2.3622'. [ 988.807983][T16633] netlink: 164 bytes leftover after parsing attributes in process `syz.2.3622'. [ 989.485378][T16610] lo speed is unknown, defaulting to 1000 [ 989.492445][T16610] vcan0 speed is unknown, defaulting to 1000 [ 989.648272][T16659] device-mapper: table: 248:4: multipath: invalid number of feature args (-EINVAL) [ 989.648290][T16659] device-mapper: ioctl: error adding target to table [ 989.824957][T14742] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 989.975394][T16663] netlink: 164 bytes leftover after parsing attributes in process `syz.2.3634'. [ 989.976883][T16663] netlink: 164 bytes leftover after parsing attributes in process `syz.2.3634'. [ 989.988920][T14742] usb 7-1: Using ep0 maxpacket: 8 [ 989.991475][T14742] usb 7-1: unable to get BOS descriptor or descriptor too short [ 989.991533][T14742] usb 7-1: New USB device found: idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 989.993123][T14742] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 989.993174][T14742] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 989.993200][T14742] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 989.993222][T14742] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 65535, setting to 1024 [ 989.993246][T14742] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1024 [ 989.993268][T14742] usb 7-1: config 0 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 989.996348][T14742] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 989.996371][T14742] usb 7-1: Product: syz [ 989.996385][T14742] usb 7-1: Manufacturer: syz [ 989.996399][T14742] usb 7-1: SerialNumber: syz [ 990.008956][T14742] usb 7-1: config 0 descriptor?? [ 990.010690][T16653] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 990.043654][T14742] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 990.314913][T16653] FAULT_INJECTION: forcing a failure. [ 990.314913][T16653] name failslab, interval 1, probability 0, space 0, times 0 [ 990.314957][T16653] CPU: 1 UID: 0 PID: 16653 Comm: syz.6.3631 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 990.314989][T16653] Tainted: [L]=SOFTLOCKUP [ 990.314997][T16653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 990.315010][T16653] Call Trace: [ 990.315019][T16653] [ 990.315032][T16653] dump_stack_lvl+0xe8/0x150 [ 990.315073][T16653] should_fail_ex+0x46b/0x600 [ 990.315109][T16653] ? sock_alloc_inode+0x2c/0x1a0 [ 990.315137][T16653] should_failslab+0xa8/0x100 [ 990.315161][T16653] kmem_cache_alloc_lru_noprof+0x9d/0x680 [ 990.315193][T16653] ? sock_alloc_inode+0x2c/0x1a0 [ 990.315227][T16653] ? __pfx_sock_alloc_inode+0x10/0x10 [ 990.315253][T16653] sock_alloc_inode+0x2c/0x1a0 [ 990.315279][T16653] ? __pfx_sock_alloc_inode+0x10/0x10 [ 990.315304][T16653] alloc_inode+0x6a/0x1b0 [ 990.315332][T16653] sock_create_lite+0x8b/0x4e0 [ 990.315366][T16653] __netlink_kernel_create+0xc8/0x720 [ 990.315398][T16653] ? __pfx___netlink_kernel_create+0x10/0x10 [ 990.315428][T16653] ? fib_net_init+0x21d/0x410 [ 990.315465][T16653] fib_net_init+0x22f/0x410 [ 990.315494][T16653] ? __pfx_fib_net_init+0x10/0x10 [ 990.315522][T16653] ? __pfx_nl_fib_input+0x10/0x10 [ 990.315566][T16653] ? devinet_init_net+0x5c8/0x7c0 [ 990.315603][T16653] ops_init+0x35d/0x5d0 [ 990.315647][T16653] setup_net+0x118/0x350 [ 990.315681][T16653] ? __pfx_setup_net+0x10/0x10 [ 990.315710][T16653] ? bpf_lsm_namespace_init+0x9/0x20 [ 990.315741][T16653] ? __ns_common_init+0x384/0x590 [ 990.315767][T16653] copy_net_ns+0x536/0x770 [ 990.315800][T16653] create_new_namespaces+0x3f0/0x6b0 [ 990.315836][T16653] ? security_capable+0x7e/0x2c0 [ 990.315869][T16653] ? copy_namespaces+0x5c/0x4b0 [ 990.315901][T16653] copy_namespaces+0x432/0x4b0 [ 990.315939][T16653] copy_process+0x1f1c/0x44c0 [ 990.315987][T16653] ? copy_process+0xd17/0x44c0 [ 990.316037][T16653] ? __pfx_copy_process+0x10/0x10 [ 990.316070][T16653] ? futex_wait+0x2a2/0x390 [ 990.316111][T16653] kernel_clone+0x2d2/0x8d0 [ 990.316147][T16653] ? __pfx_kernel_clone+0x10/0x10 [ 990.316192][T16653] ? do_futex+0x3e7/0x4e0 [ 990.316225][T16653] __x64_sys_clone+0x1b6/0x230 [ 990.316259][T16653] ? __pfx___x64_sys_clone+0x10/0x10 [ 990.316306][T16653] ? __pfx___se_sys_futex+0x10/0x10 [ 990.316330][T16653] ? __se_sys_pidfd_open+0x1e3/0x260 [ 990.316372][T16653] do_syscall_64+0x166/0x520 [ 990.316395][T16653] ? trace_irq_disable+0x3b/0x140 [ 990.316415][T16653] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 990.316438][T16653] ? clear_bhb_loop+0x70/0xc0 [ 990.316464][T16653] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 990.316484][T16653] RIP: 0033:0x7f811933f559 [ 990.316505][T16653] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 990.316522][T16653] RSP: 002b:00007f8117595fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 990.316555][T16653] RAX: ffffffffffffffda RBX: 00007f81195c5fa0 RCX: 00007f811933f559 [ 990.316571][T16653] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f8024000 [ 990.316586][T16653] RBP: 00007f81193d6b20 R08: 0000000000000000 R09: 0000000000000000 [ 990.316599][T16653] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 990.316614][T16653] R13: 00007f81195c6038 R14: 00007f81195c5fa0 R15: 00007ffd51e59ee8 [ 990.316653][T16653] [ 991.355199][T16690] netlink: 80 bytes leftover after parsing attributes in process `syz.2.3648'. [ 991.365158][T16689] netlink: 164 bytes leftover after parsing attributes in process `syz.3.3647'. [ 991.375829][T16689] netlink: 164 bytes leftover after parsing attributes in process `syz.3.3647'. [ 991.777485][T14742] snd-usb-audio 7-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 992.081030][T14742] usb 7-1: USB disconnect, device number 5 [ 992.189899][T16412] udevd[16412]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 993.018874][T14742] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 993.064523][T16723] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 993.203163][ T1341] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.203258][ T1341] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.248977][T14742] usb 3-1: Using ep0 maxpacket: 32 [ 993.254302][T14742] usb 3-1: New USB device found: idVendor=046d, idProduct=c31c, bcdDevice=0.40 [ 993.263578][T14742] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 993.263613][T14742] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 993.263651][T14742] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 993.300962][T14742] usb 3-1: config 0 descriptor?? [ 993.336016][T14742] hub 3-1:0.0: USB hub found [ 993.530811][T14742] hub 3-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 993.967719][T14742] hid-generic 0003:046D:C31C.0009: unknown main item tag 0x0 [ 994.104363][T16727] rxe_eth0 speed is unknown, defaulting to 1000 [ 994.148846][T11600] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 994.320463][T11600] usb 7-1: New USB device found: idVendor=0572, idProduct=cafe, bcdDevice=1.00 [ 994.347102][T11600] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 994.347170][T11600] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 994.347218][T11600] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 994.387832][T14742] hid-generic 0003:046D:C31C.0009: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.2-1/input0 [ 994.450114][T11600] cxacru 7-1:1.0: usbatm_usb_probe: bind failed: -19! [ 994.526390][T14742] usb 3-1: USB disconnect, device number 47 [ 994.662320][T16744] fido_id[16744]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 994.997557][T16755] fuse: Bad value for 'fd' [ 995.288932][T11600] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 995.311696][T16727] lo speed is unknown, defaulting to 1000 [ 995.314777][T16727] vcan0 speed is unknown, defaulting to 1000 [ 995.439836][T11600] usb 3-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 995.441345][T11600] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 995.481286][T11600] usb 3-1: config 0 descriptor?? [ 995.919886][T11600] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 995.920757][T11600] [drm:udl_init] *ERROR* Selecting channel failed [ 995.985685][T16773] rxe_eth0 speed is unknown, defaulting to 1000 [ 996.185823][T11600] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 1 [ 996.185855][T11600] [drm] Initialized udl on minor 1 [ 996.270881][T11600] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 996.272466][T11600] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 996.298386][T11600] usb 3-1: USB disconnect, device number 48 [ 996.890441][T14742] usb 7-1: USB disconnect, device number 6 [ 997.719951][T16773] lo speed is unknown, defaulting to 1000 [ 997.723871][T16773] vcan0 speed is unknown, defaulting to 1000 [ 998.728808][T11600] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 998.885159][T11600] usb 7-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 998.886769][T11600] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 998.918488][T11600] usb 7-1: config 0 descriptor?? [ 999.379609][T11600] udl 7-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 999.381930][T11600] [drm:udl_init] *ERROR* Selecting channel failed [ 999.586959][T11600] [drm] Initialized udl 0.0.1 for 7-1:0.0 on minor 1 [ 999.586989][T11600] [drm] Initialized udl on minor 1 [ 999.623843][T11600] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 999.627310][T11600] udl 7-1:0.0: [drm] Cannot find any crtc or sizes [ 999.639206][ T57] block nbd0: Possible stuck request ffff8880276d5080: control (read@0,2048B). Runtime 30 seconds [ 999.645364][ T57] block nbd0: Possible stuck request ffff8880276d5240: control (read@2048,2048B). Runtime 30 seconds [ 999.647125][T11600] usb 7-1: USB disconnect, device number 7 [ 1000.131172][T16828] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1000.134366][ T4835] kernel read not supported for file /trace_pipe (pid: 4835 comm: kworker/0:2) [ 1000.698371][T16836] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3705'. [ 1001.908865][ T5745] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 1002.059066][ T5745] usb 7-1: Using ep0 maxpacket: 16 [ 1002.060128][ T5745] usb 7-1: New USB device found: idVendor=0e41, idProduct=4151, bcdDevice=62.00 [ 1002.060192][ T5745] usb 7-1: too many configurations: 116, using maximum allowed: 8 [ 1002.063012][ T5745] usb 7-1: config 0 has no interfaces? [ 1002.063781][ T5745] usb 7-1: config 0 has no interfaces? [ 1002.064555][ T5745] usb 7-1: config 0 has no interfaces? [ 1002.065298][ T5745] usb 7-1: config 0 has no interfaces? [ 1002.066037][ T5745] usb 7-1: config 0 has no interfaces? [ 1002.066784][ T5745] usb 7-1: config 0 has no interfaces? [ 1002.073626][ T5745] usb 7-1: config 0 has no interfaces? [ 1002.082369][ T5745] usb 7-1: config 0 has no interfaces? [ 1002.087027][ T5745] usb 7-1: New USB device strings: Mfr=240, Product=33, SerialNumber=3 [ 1002.087054][ T5745] usb 7-1: Product: syz [ 1002.087069][ T5745] usb 7-1: Manufacturer: syz [ 1002.087083][ T5745] usb 7-1: SerialNumber: syz [ 1002.088418][T16858] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1002.095071][ T5765] kernel read not supported for file /trace_pipe (pid: 5765 comm: kworker/1:5) [ 1002.372033][ T5745] usb 7-1: config 0 descriptor?? [ 1002.408544][T16866] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3721'. [ 1002.640515][T16848] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1002.641239][T16848] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1002.712792][T16848] FAULT_INJECTION: forcing a failure. [ 1002.712792][T16848] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1002.712837][T16848] CPU: 1 UID: 0 PID: 16848 Comm: syz.6.3712 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1002.712870][T16848] Tainted: [L]=SOFTLOCKUP [ 1002.712879][T16848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1002.712903][T16848] Call Trace: [ 1002.712913][T16848] [ 1002.712924][T16848] dump_stack_lvl+0xe8/0x150 [ 1002.712968][T16848] should_fail_ex+0x46b/0x600 [ 1002.713011][T16848] _copy_to_user+0x31/0xb0 [ 1002.713049][T16848] sync_file_ioctl+0xf6b/0x1170 [ 1002.713144][T16848] ? __pfx_sync_file_ioctl+0x10/0x10 [ 1002.713169][T16848] ? do_futex+0x3e7/0x4e0 [ 1002.713199][T16848] ? __asan_memset+0x22/0x50 [ 1002.713228][T16848] ? smack_file_ioctl+0x335/0x370 [ 1002.713263][T16848] ? __pfx_smack_file_ioctl+0x10/0x10 [ 1002.713314][T16848] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1002.713338][T16848] ? __pfx_sync_file_ioctl+0x10/0x10 [ 1002.713362][T16848] __se_sys_ioctl+0xff/0x170 [ 1002.713419][T16848] do_syscall_64+0x166/0x520 [ 1002.713445][T16848] ? trace_irq_disable+0x3b/0x140 [ 1002.713469][T16848] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1002.713493][T16848] ? clear_bhb_loop+0x70/0xc0 [ 1002.713522][T16848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1002.713545][T16848] RIP: 0033:0x7f811933f559 [ 1002.713568][T16848] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1002.713589][T16848] RSP: 002b:00007f8117596028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1002.713616][T16848] RAX: ffffffffffffffda RBX: 00007f81195c5fa0 RCX: 00007f811933f559 [ 1002.713634][T16848] RDX: 0000200000000180 RSI: 00000000c0303e03 RDI: 0000000000000008 [ 1002.713650][T16848] RBP: 00007f81193d6b20 R08: 0000000000000000 R09: 0000000000000000 [ 1002.713666][T16848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1002.713681][T16848] R13: 00007f81195c6038 R14: 00007f81195c5fa0 R15: 00007ffd51e59ee8 [ 1002.713720][T16848] [ 1003.240873][ T5765] usb 7-1: USB disconnect, device number 8 [ 1003.408932][T14742] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 1003.515746][T16894] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3733'. [ 1003.580045][T14742] usb 3-1: New USB device found: idVendor=0424, idProduct=7850, bcdDevice=0.00 [ 1003.599335][T14742] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1003.599376][T14742] usb 3-1: Product: syz [ 1003.599392][T14742] usb 3-1: Manufacturer: syz [ 1003.599409][T14742] usb 3-1: SerialNumber: syz [ 1004.045297][T14742] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1004.045350][T14742] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1004.047553][T14742] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 1004.047620][T14742] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1004.122614][T14742] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1004.151755][T14742] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -32 [ 1004.550028][T16929] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3746'. [ 1004.688932][ T5765] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 1004.840147][ T5765] usb 7-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1004.843531][ T5765] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1004.867606][ T5765] usb 7-1: config 0 descriptor?? [ 1005.371831][ T5765] udl 7-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1005.386017][ T5765] [drm:udl_init] *ERROR* Selecting channel failed [ 1005.523201][T15786] Bluetooth: hci6: command 0x0406 tx timeout [ 1005.573931][ T5765] [drm] Initialized udl 0.0.1 for 7-1:0.0 on minor 1 [ 1005.573965][ T5765] [drm] Initialized udl on minor 1 [ 1005.665998][ T5765] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1005.666573][ T5765] udl 7-1:0.0: [drm] Cannot find any crtc or sizes [ 1005.781323][ T5610] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1005.920582][ T5765] usb 7-1: USB disconnect, device number 9 [ 1006.265476][ T5745] usb 3-1: USB disconnect, device number 49 [ 1006.467541][ T5610] udl 7-1:0.0: [drm] Cannot find any crtc or sizes [ 1007.090346][T16960] rxe_eth0 speed is unknown, defaulting to 1000 [ 1007.311793][T16968] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3760'. [ 1008.334839][T16960] lo speed is unknown, defaulting to 1000 [ 1008.360159][T16960] vcan0 speed is unknown, defaulting to 1000 [ 1009.763594][T11600] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 1010.181215][T11600] usb 3-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1010.189784][T11600] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1010.230923][T11600] usb 3-1: config 0 descriptor?? [ 1010.692202][T11600] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1010.692630][T11600] [drm:udl_init] *ERROR* Selecting channel failed [ 1010.758000][T11600] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 1 [ 1010.758033][T11600] [drm] Initialized udl on minor 1 [ 1010.823525][T11600] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1010.824079][T11600] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 1010.859296][T11600] usb 3-1: USB disconnect, device number 50 [ 1010.859498][T15125] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 1010.860617][T15125] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 1010.938030][T15125] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 1013.385622][T17029] [ 1013.388025][T17029] ====================================================== [ 1013.395076][T17029] WARNING: possible circular locking dependency detected [ 1013.402170][T17029] syzkaller #0 Tainted: G L [ 1013.408266][T17029] ------------------------------------------------------ [ 1013.415309][T17029] syz.2.3785/17029 is trying to acquire lock: [ 1013.421403][T17029] ffff88803b6b2b78 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}, at: __flush_work+0x101/0xea0 [ 1013.433001][T17029] [ 1013.433001][T17029] but task is already holding lock: [ 1013.440389][T17029] ffff88806657cf98 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x22f/0x580 [ 1013.449466][T17029] [ 1013.449466][T17029] which lock already depends on the new lock. [ 1013.449466][T17029] [ 1013.460070][T17029] [ 1013.460070][T17029] the existing dependency chain (in reverse order) is: [ 1013.469107][T17029] [ 1013.469107][T17029] -> #1 (sk_lock-AF_SMC/1){+.+.}-{0:0}: [ 1013.476965][T17029] lock_sock_nested+0x41/0x120 [ 1013.482290][T17029] smc_listen_out+0xd4/0x3d0 [ 1013.487451][T17029] process_scheduled_works+0xc3d/0x1630 [ 1013.493547][T17029] worker_thread+0xa47/0xfb0 [ 1013.498672][T17029] kthread+0x38b/0x470 [ 1013.503451][T17029] ret_from_fork+0x514/0xb70 [ 1013.508580][T17029] ret_from_fork_asm+0x1a/0x30 [ 1013.513871][T17029] [ 1013.513871][T17029] -> #0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}: [ 1013.524140][T17029] __lock_acquire+0x164c/0x2de0 [ 1013.529544][T17029] lock_acquire+0x115/0x350 [ 1013.534561][T17029] __flush_work+0x7ac/0xea0 [ 1013.539576][T17029] cancel_work_sync+0xb8/0xf0 [ 1013.544781][T17029] smc_clcsock_release+0x60/0xf0 [ 1013.550279][T17029] __smc_release+0x662/0x7d0 [ 1013.555385][T17029] smc_close_non_accepted+0xd5/0x1f0 [ 1013.561193][T17029] smc_close_active+0xc0b/0x1030 [ 1013.566641][T17029] __smc_release+0x9e/0x7d0 [ 1013.571748][T17029] smc_release+0x2cd/0x580 [ 1013.576682][T17029] __sock_release+0xa0/0x1f0 [ 1013.581872][T17029] sock_close+0x1c/0x30 [ 1013.586540][T17029] __fput+0x41a/0xa70 [ 1013.591034][T17029] fput_close_sync+0x11f/0x240 [ 1013.596326][T17029] filp_close_sync+0x6e/0xa0 [ 1013.601451][T17029] __se_sys_close_range+0xa7d/0xef0 [ 1013.607173][T17029] do_syscall_64+0x166/0x520 [ 1013.612465][T17029] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1013.618873][T17029] [ 1013.618873][T17029] other info that might help us debug this: [ 1013.618873][T17029] [ 1013.629092][T17029] Possible unsafe locking scenario: [ 1013.629092][T17029] [ 1013.636575][T17029] CPU0 CPU1 [ 1013.642024][T17029] ---- ---- [ 1013.647406][T17029] lock(sk_lock-AF_SMC/1); [ 1013.651926][T17029] lock((work_completion)(&new_smc->smc_listen_work)); [ 1013.661463][T17029] lock(sk_lock-AF_SMC/1); [ 1013.668502][T17029] lock((work_completion)(&new_smc->smc_listen_work)); [ 1013.675506][T17029] [ 1013.675506][T17029] *** DEADLOCK *** [ 1013.675506][T17029] [ 1013.683650][T17029] locks held by syz.2.3785/17029: 3, last CPU#0: [ 1013.690088][T17029] #0: ffff888063895a78 (&sb->s_type->i_mutex_key#12){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0 [ 1013.700725][T17029] #1: ffff88806657cf98 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x22f/0x580 [ 1013.710144][T17029] #2: ffffffff8f3c1680 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x101/0xea0 [ 1013.719370][T17029] [ 1013.719370][T17029] stack backtrace: [ 1013.725275][T17029] CPU: 0 UID: 0 PID: 17029 Comm: syz.2.3785 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1013.736999][T17029] Tainted: [L]=SOFTLOCKUP [ 1013.741316][T17029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1013.751363][T17029] Call Trace: [ 1013.754648][T17029] [ 1013.757586][T17029] dump_stack_lvl+0xe8/0x150 [ 1013.762179][T17029] print_circular_bug+0x2e2/0x300 [ 1013.767198][T17029] check_noncircular+0x12f/0x150 [ 1013.772140][T17029] __lock_acquire+0x164c/0x2de0 [ 1013.776994][T17029] ? irqentry_exit+0x2a0/0x9b0 [ 1013.781750][T17029] ? lockdep_hardirqs_on+0x7b/0x110 [ 1013.786954][T17029] ? irqentry_exit+0x2a0/0x9b0 [ 1013.791795][T17029] ? trace_irq_disable+0x3b/0x140 [ 1013.796813][T17029] lock_acquire+0x115/0x350 [ 1013.801314][T17029] ? __flush_work+0x101/0xea0 [ 1013.806083][T17029] ? __flush_work+0x101/0xea0 [ 1013.810767][T17029] __flush_work+0x7ac/0xea0 [ 1013.815265][T17029] ? __flush_work+0x101/0xea0 [ 1013.819929][T17029] ? __flush_work+0x101/0xea0 [ 1013.824604][T17029] ? __pfx___flush_work+0x10/0x10 [ 1013.829655][T17029] ? __pfx_wq_barrier_func+0x10/0x10 [ 1013.834940][T17029] ? cancel_work_sync+0x5a/0xf0 [ 1013.839800][T17029] cancel_work_sync+0xb8/0xf0 [ 1013.844470][T17029] smc_clcsock_release+0x60/0xf0 [ 1013.849405][T17029] __smc_release+0x662/0x7d0 [ 1013.853992][T17029] smc_close_non_accepted+0xd5/0x1f0 [ 1013.859276][T17029] smc_close_active+0xc0b/0x1030 [ 1013.864217][T17029] ? smc_close_active+0x4d3/0x1030 [ 1013.869318][T17029] ? __pfx_sock_def_readable+0x10/0x10 [ 1013.874773][T17029] __smc_release+0x9e/0x7d0 [ 1013.879269][T17029] ? lockdep_hardirqs_on+0x7b/0x110 [ 1013.884474][T17029] smc_release+0x2cd/0x580 [ 1013.888989][T17029] __sock_release+0xa0/0x1f0 [ 1013.893574][T17029] ? __pfx_sock_close+0x10/0x10 [ 1013.898416][T17029] sock_close+0x1c/0x30 [ 1013.902564][T17029] __fput+0x41a/0xa70 [ 1013.906542][T17029] fput_close_sync+0x11f/0x240 [ 1013.911309][T17029] ? __pfx_fput_close_sync+0x10/0x10 [ 1013.916850][T17029] filp_close_sync+0x6e/0xa0 [ 1013.921432][T17029] __se_sys_close_range+0xa7d/0xef0 [ 1013.926641][T17029] ? __pfx___se_sys_close_range+0x10/0x10 [ 1013.932384][T17029] do_syscall_64+0x166/0x520 [ 1013.936972][T17029] ? trace_irq_disable+0x3b/0x140 [ 1013.941989][T17029] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1013.948046][T17029] ? clear_bhb_loop+0x70/0xc0 [ 1013.952715][T17029] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1013.958616][T17029] RIP: 0033:0x7fdc5f56f559 [ 1013.963160][T17029] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1013.982771][T17029] RSP: 002b:00007ffdb7bcfef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 1013.991197][T17029] RAX: ffffffffffffffda RBX: 00007fdc5f7f7da0 RCX: 00007fdc5f56f559 [ 1013.999165][T17029] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 1014.007143][T17029] RBP: 00007fdc5f7f7da0 R08: 00007fdc5f7f6038 R09: 0000000000000000 [ 1014.015139][T17029] R10: 00000000003fc908 R11: 0000000000000246 R12: 00000000000f77a4 [ 1014.023140][T17029] R13: 00007fdc5f7f609c R14: 00000000000f7509 R15: 00007fdc5f7f6090 [ 1014.031118][T17029]