last executing test programs: 4m44.059085233s ago: executing program 2 (id=132): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x40000000, &(0x7f00000005c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000280)={@fd={0x73682a85, 0x0, r2}, @fd, @fda={0x66646185, 0x5, 0x1, 0x1a}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}, 0x40}], 0x0, 0x0, 0x0}) 4m43.894334302s ago: executing program 2 (id=134): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000000, 0x5d032, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000000000000000000020000000000000000000000080000006b00000000000000000000000000000000000000000000000000000081faa4995669aaab54a0b408347881fa213671390bced31ffd733331b87cbb564fe728af6eee732dccbb236117cb4dea28709e416c5c65d74a7e4d3b9336c21b2794c2859d8000c144d78b2225d3cc3f69384dc6123e4adbae79a194f25aeee7960a139a8f4c202356bbe2972606a1f66a67a4d05eb1bd1a03425d6efa827a0621"]) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000000314230c2abd7000ff05df250900020073797a310000000008004100727865001400330073797a5f74756e"], 0x38}, 0x1, 0x0, 0x0, 0x48845}, 0x24004000) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xb635773f06ebbeee, 0x13, r0, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e25, 0x10001, @local, 0xb}}}, 0x30) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000400)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @rand_addr=' \x01\x00', 0x204}, {0xa, 0x4e20, 0x0, @empty, 0x10001}, 0xffffffffffffffff, 0x403}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f00000002c0)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x5}}, 0x10) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r2, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e25, 0x10001, @local, 0xb}, r3}}, 0x30) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000300)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x711, @rand_addr=' \x01\x00', 0x6}, {0xa, 0x4e1f, 0x0, @rand_addr=' \x01\x00', 0x7}, r3, 0x402}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f00000002c0)={0x4, 0x8, 0xfa00, {r3, 0x5}}, 0x10) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000240)={0x2, 0x0, 0x80000001, 0x6, 0x0, "7f1227f7adf97affe4ffff7d1800"}) r4 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r4, 0xc0287c02, &(0x7f0000000340)={0x80000000, 0x0, &(0x7f0000000200)=[{}, {{0x80000000, 0x0}, {0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r4, 0xc0347c03, &(0x7f00000001c0)={{r6, r5, 0x1, [0x0, 0xf7df]}, {r6, r7, 0x7, [0x6]}, 0x1, [0x8, 0x3df]}) r8 = userfaultfd(0x80801) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r8, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mbind(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4006, &(0x7f0000000000)=0x4, 0x5, 0x2) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r9, &(0x7f0000000d00)=[{{&(0x7f0000000480)=@x25, 0x0, &(0x7f0000000800)=[{&(0x7f0000000d80)=""/202}, {&(0x7f0000000600)=""/71}, {&(0x7f0000001180)=""/4096}, {&(0x7f0000000680)=""/192}, {&(0x7f0000000740)=""/167}], 0x0, &(0x7f00000000c0)=""/61}, 0xfd3a}, {{&(0x7f0000000880)=@hci, 0x0, &(0x7f0000000c40)=[{&(0x7f0000000900)=""/255}, {&(0x7f0000000140)=""/5}, {&(0x7f00000003c0)=""/16}, {&(0x7f0000000a00)=""/118}, {&(0x7f0000000a80)=""/34}, {&(0x7f0000000ac0)=""/153}, {&(0x7f0000000b80)=""/57}, {&(0x7f0000000bc0)=""/127}], 0x0, &(0x7f0000000cc0)=""/26}, 0x10001}], 0x4000000000001a2, 0x12000, 0x0) r10 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r10, 0x45809000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 4m40.169986218s ago: executing program 2 (id=173): sendmsg$RDMA_NLDEV_CMD_GET(0xffffffffffffffff, 0x0, 0x10) r0 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) syz_usb_connect$uac1(0x2, 0x71, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x4, 0xc0, 0x2, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x101, 0xbb}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x93, 0x1, 0x9, {0x7, 0x25, 0x1, 0x3, 0x3, 0xf48}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0xd, 0x2, 0x4, {0x7, 0x25, 0x1, 0x91e8570469aa5526, 0x8, 0x3}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x5d, &(0x7f0000000340)=@string={0x5d, 0x3, "b176477e4ee146428d4c6aeb9e54a80bb13cb15e04e3425d09ce89279edbd2d97b57966f1f36f40db0996546facc4d83c9dfa0d6304cab4356348593439ad1cfd4d4dcaf6c003b801a0cc20b81149c51f697b11d5b1527724399ea"}}, {0x0, 0x0}, {0x0, 0x0}]}) close(0xffffffffffffffff) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000000)=0x200, 0x4) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000027c0), 0x0, 0x800) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b18, &(0x7f0000000000)={'wlan1\x00', @random="010000000700"}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/image_size', 0x0, 0x0) read$FUSE(r3, &(0x7f0000002100)={0x2020}, 0x2020) modify_ldt$write2(0x11, &(0x7f0000000400)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) r4 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x0) preadv(r4, &(0x7f0000000540)=[{&(0x7f00000020c0)=""/4083, 0xff3}], 0x1, 0x200020, 0x0) modify_ldt$read(0x0, &(0x7f0000000840)=""/4096, 0x1000) r5 = memfd_create(&(0x7f00000007c0)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b \x00\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\xfe\xe6\xd2SLR\xa1\x00\x00\x17\x1f$^\xe1\x00\x00\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xbf>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\x00\x00\x00\x00\x00\x00\r\x17\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\xfd\xc7\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\x02\x00\x00\x00\xb5\x82q\x1f37\x02\xb9\xb2\x9a3\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xddW\xe6}\xc5\xa4\x8f\x98\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\x826`M\xab\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8\xac\x00P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\x9b\xcc\x9b\f\xa7\x8f9\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\x01\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x1b\xbb\x04\xd7\xd1\x06\xa0m\xc9\x82<\xa9\xdc\xddRU\t\xe9\xbah\xb6\xb2\xea-{Q\xca\x14\x13\x9ajWt\xc9\xecd\r\xd5)\x1d\xaf\n\xc0\xc1\x1d}DL\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~A\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9dn\x06\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I\xfa\x12\xfc\x96\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96\xb71~2{@:\x97^\xbfcu9\x8c<^ll\x97\xe7\xc7a\tm\xe8\x01\x00j\xf8\x98\x81\xe7\xf7\xab3F\xf4u\xdaav\xd21\v\x99HG\xd8\x84\n\x13\x9a\x85&\v\xfeU\x18\x17o6m\x84\xdfx\x1cPl\t#\xc1\x8e\xddW\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\"\xd7\x99\x19pn\xbe\xb8\f#\xe2\x8f\x02\xedk\x10\x1b\x9c\x10\xd5\xab\x95Yn\xe9\x00\xb5\xa29\xd7\xd1\bs\xd0x0\xf2F\xaam\xd8\\\x16\x98\x86\xbe\xbc|h+\t.\x0f\x1b?\xbf5\x9fW\xa7\x02\x14J\x16|TV\x1bW\xd6r\nR\x82\xe0\x88%\xfa\x1f\xae\xcb\xb5g\xd5\x9a\x17\xd2F3A\x03-\xe22\x1b\xb4\xb5\b\x8b\xe79\xbew#2\xbd`', 0x7) fcntl$addseals(r5, 0x409, 0xc) ioctl$FS_IOC_RESVSP(r5, 0x40305829, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x80}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="3b9601000000000000003b00000008000300", @ANYRES32=r7, @ANYBLOB="e36053ff3300400000000802110000010802110000010802110000000000001415cf71f493df25daf104dd2b0c1648dbff3e39342d1a02881b0600000018c721d73953784e1c0000000100ce950000097206030303030303"], 0x74}, 0x1, 0x0, 0x0, 0x8011}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/mem_sleep', 0x101a02, 0x0) r8 = socket(0x40000000015, 0x5, 0x0) connect$inet(r8, 0x0, 0x0) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000", 0x2b}], 0x1}, 0x0) mount(0x0, 0x0, 0x0, 0x808000, 0x0) 4m38.710602297s ago: executing program 2 (id=186): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000001000000002100000008000300", @ANYRES32=r2, @ANYBLOB="10007d8005", @ANYRES8=0x0, @ANYRES32=r0], 0x2c}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 4m38.634705028s ago: executing program 2 (id=187): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYRES32=r1, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) creat(&(0x7f0000000100)='./file0\x00', 0x22) syz_fuse_handle_req(r1, &(0x7f00000041c0)="6930d8697c97a65b36159a023034632628cd4474514a1368f1e71dd9b7c48436c2ea07f3bd58a6bbc0f065ddba346122dff6ad81d21cea72e7d951c5c5b21a9f0ba768cd18ddcc7de78e2ba9ac88654a1d99806fb236617ff138f15994a6259de4f933ae62cdc98b2e33514066dd1b9ae1546df8db973d467507b2ecb6a4ece57b2ba7b9df20a0d6817b9fc2ee34e709a8bdef99624ab97472db298354edf3c072c710b9ba9d9a0ae44928172ce6a0d2695a17057255ec6e0b09c684a7f808e38302eb375390ae65d665da7f176a45ed0144a762fc666931f1a4c0ed03fb42e8f7ed4439add1a96b90904330d8e3c91527b405f36e89e44599c5ba4e742f1a281f0dab5fc2dc8855a78e1812ba99ce71fbabef429e87295d941c555c0fdacfa1f3256b70c1fc84b2d0df2c589dac34698d8d108474f84dce58efcbe580b8f348c550c6ca9abe230330d05dffea89475391015c707ddc45a3958a68ea44b5f7d81a84b9064111954da3b5c832df657efd5f0849b32834a053f4a052d7fd7d4db17be80879bf6859bc9605664557eceeb74753416e41b92fb84b572b3c78b6aab6f0bdfcfd7d3a830f12d1b3046e615889ae554db34d35775c6272243d7132426dfc9027ea50d62b91f356c58093933ad75013f9470ec90bfe1d9376002dbbcba9b7e7a1e023f878bfa4d88a9421c035951fd3169c5508ecf28c3a8691605242cc858fb56af44956bb5e677d1d90f0a3b97ad30c74adfc2f22232f7f1fa022c1f0492619cf98381039f26c784ca4d4706f67013bf457fe927aad53c1aa0da90d2730155664d84e41792f3f461840e41135c5b82c87834156b9d6403b7001e5ebb1846a6ad80723387bb92f8d991fa8db1fa65ef90a5054798635c18e7ff7649c41e867fb070bcfef61445a7d0c0c5fa02da82969db96aada4095e8cb2bf7728bf95eb020594c0d3617467701d8c4dd01c750712dae33dfba7548032b48ab93ff3c82e104b08116c1a68fb3b28a1b8ccc23c2698803828d1da099a5437b248078b502f7ccd867af9f8c79bc55643414c57466a781032bdd6dea9acd5cde821480a85c308dd03af012d03cb552b3770124ac279c9427c0e1b761c525eb251598d326bc650b5f055b610688fdaf9789e60fc234f1881536016901ddb2597b47e7bc675cac3ae8c50169230af084998dd6be35dc3609c5edbc93da3fe98ebb475a0d30437017ef640b96fd48ef52f509cf57e65c73ac09603081cd980e8b9d73ef4acf4511cfbb07d5074a6561192c2b2bce29cef8ec70ff599d4751103ffec500a8657d6ef30499b9ad0b10f3e7b6b53fc61dfbbb209e3691b1cba1af62468ebcb61c4c0a776fbfc92c5d2a10350bad29915e44cc952de4226ab646e28ab008683e470ccae3486bdb4ab4a6ffea9a671237bf0943660d929667ebe4a5f9cd1bdecbb53262a4fe3eaeed7fbb4ed1ca40da9e2efdaae4da05b14c754360f3c3e5b96f203c4f87e5feeb73abb88aa57fb850702339b5ac192810597e99fefedd52558fc6aad5d2ac0eaec00dda68467a3c7c7cdc3b724990f1b2f4f65e9181e5ebd0a343c491a1fe0e4378f241bd071fabeb1487044fe5c5eb942eb92dc80ff317cabfa10c75434441716a7339115a3071e45eb2d0800627b99a4fb59e260b26d53953ff3f255dc4bf40d3cc8797287fe3d6356d1eaaf67745ef73844b4c64e89ca0f04a87659427c26f0d6bfa2f4881ef69dc5c7b4515c7c4394f621fb98f2c6f496b7ac640d3a1fcd483ae10c4ee9710a896e67175a679f2461be09c722be20df30c9670299db21bc8aeae63e57ebeab1ca61c265f10d8def8243583e6967c5e40162110025a65f0c658db29f5eb0e50b2dd318ac55209721c8c0d51fb05c9ff3106731b058e14c8c89dd33bef6333f218c9f66e2bd9fd897b985bda3747c88fbd24d90cc8428380048330abb044f9e7107ccae059b961e0c6a53d182de21cb77e12d1ed0faeeb214c9ab6b7dd5f99d9278df393958a7a46aa734726938ca2172e4cba5f0a68cc2823bd5aa622c099fd936e303549ea4a80521b12b616526fdaf00779de369a5a83dcedbb739d426eb7f3864cbe346ff458433ca67a86ccbc703939216e4a001d9ccc84b4c438e5bb583e733973b3b0d2fa9a1bd4be4fc2b497b80e1455657a3f339f512cd38428e022d311075190c8d443cd94505dc52b0c7b6138f2279dcfd0a20a564e45b8f144a6f09e5beda5303f885a7d9fbdb4a6f3778ff9e9fc6e0dbee5bdd0330c3c956ddc36f10fb6811320ab30b4817934bd7e11bdcefb58132a17ac76fb54aaab0188a32eec2284f1a24835cc79c6909f742ab35631b919673eb84d53715dc8bdac9b6d28a24b869929d7fb7bcb34b5b5bab1ee69ee38c86541982806b84db06d0dc81e940a872ca89a5a7e1c191bec2808ac6aa0d733c1d647f88df8455ccfbd35fd5bef780bc8c4fb86efb1951b8382915939779493c20279b165c2b775b7d5b63ea0ceec09a17472bab7ec8122dbcf5ebaf4ac3db25fd0776f13cd67a36ce6cfa58acd262cbf4bdcbf2fa7239c79386dc580121e986de5b78a4351388e7fa6461a7657bdb4383c659409f16c7508d5e5618d116a659bc0462c130b088d63ac4bb69c0d756b5fa2e80004019d6ca5371ea361e8cc613954332ee959de1766f8f3689ab8daf45b69ec0810d0ab7e3b402860c8b94ffc25de57920f8da7a3bc7badc4dc9088bc7f6c71b1d4d960c258cd87abcd739bbd5115aef29f994f062318e8accab85f5c64a263ca14c1629284f7369d86436d174f6f2b1a5e014dc5cc3021efbce66bb88d7b3827be33365d8ab2daed7c6dc0651b77af1dd289684df8e21b6a81c66a27294c7cbf5cd90add094477cd6dec894b140a409add754727459c695c4e63dc73fb491af8c22edf1dbabe56a9969146056259a65f9c1c62973abba625b8065fdcccddda10cd7ff7b2144c63b754af792cfe395902608da630aeed913e9f014bdd184c9341c62fe0c7dd2660e26eab22cbd0d9e21ba0552e71f1ce17407672f01ef1012877fb7da93cdc92056ecad3ab01922b3a8e13661ef1372d84ce5167153ca2551edfed8c2c6557626f2554d67a852a8d2b566fa40c6dfeee3b63e2be83523f64365922531ac93ae196fa6a98b3b8708eb90f410f150c3e8680d9cb7265f108f2b860e7d8c7dd64405bd545eea08520cb33857b3090fe1b364e47151eb847ff444fab989dbe1e03b29409d46fff338d6ae5a4c61426ba4b170d96617774b6f3ae64beb7f791334f4d48d3fd26969d4a4342a8f1088bafdbefbcb1990e9d0fc95edf96113137e619cb15df9c4d9a21de468e40d284f5af88cb8b038540b91ba070f311efe1b081000da886eaddb3aaad90bca70e2ed34dadacccebb095d8e116ac9911c2c4f2a7a95e939853950b5e04a98b6bc9340b28e323ad7cc58888e33ef8bf438080dc26c71c8e12e0bbccb1fde98231ebf61a9011a2190b33c941d927128d30570c11b2a51d919d4caf1fbca673931fb2016b81c12e4a31b3458d0f215c97c9dfec8d514d66e748931b6e8bd06085c7ee8e7b845912053766ceaa20f1917d075fdcf2e9cca3e21bbbb1dc0a5cad36ee44e7a4e136ec5e5fc233cb63d5f035f96628a7abb281b493d9cf8fc4251fc9c3c004bd5d64713c05ba68de2318826b01db27661561b6dd381e5973b887797bb21f7a7f30c9343696a60775c36e5b05eb19dc62fef3ff99f8f00e8ccd25e00bd1863609f51e6a69f7e9c650aff3c8897ed6ee4c8d0b0356627cf69a3a3abd0c352e255b2c6250834c9fb272d83bdeb959ebc1e7207546da012b3eb4861c98fa1fd126b18a14585a2e142b98e5fe902a4961ccbdf7b7728588b7559511b30a2d2e86857d0281bd5e08103dcd11becfeb8e9c5b3e4813c79c14055e46203a5cebaa30fedec57ed23538afa85711e0ef3f72541af4d3e6c938590ee053d4ad1de8ecac6c49f1d70707c4d93e031b6f930658425fb0dfc3cde7c9f775eb3cf28fff76097c35e532335a80053fc198b6de7fb09b87e2219ec04782f35bedffef4c08e6316b25824caffef257d7a072fcd6251450dd9882e25e3e0a05a63b022e53ffcbff4097ad150095fb7065c47f7b8a9fc2c8186a5942663e661d80649af235707a87619d277dc8b5ef70190663991a531d67660c74f778301f9939d4511eca1f8bdee0706fec004a6042e45954f710a9e90081a8b297bcde440bc8d54676ba38397734196aa3835d361d8f36acbe4c1bf0f2782d27611555b19d1b9bd1ba493ab4c3a884216bc143629d8d418518f9a06b2b0d25a5e10ce515f47c5a54fa63212a686eab067600d56b234fba7be63b4d40f8be1fef0e69a55373f8faaa8f02b2b85aaee0720d0dff9a0e84850d998959df6397cd824c1a7bed9b73ca92f83ba66e3f170c3b34a3f7ad509d7bdf916d5367c22454f2252ecbb9a334e2fd2032c569fbf4bfcf6f41bd003ed10911f2644d66f4a6ec4a2eca936fcaff29ea9f454d5fc68575cfcb7e6cf8cffca37d1c5d374ca1ed77ffde5a01d349e4d18ddd15cc7397e696d6a92e0ed7260efd42ac23b5396840df636f85f83b6fcfb27f3503e130200a77c61c01b3c80a5b77c90eff390e27c3c1256efae5da2cb7ca7169cb824a164da49078e461f4640ff4d7b074a32676aac9f96746c36fa151145e1d13187191dc9739fe3c3af9418d6258e525ac82f626666278fc888cc0b8616d851469d3c676c1a0ac6c71b5914009b9797a914f1498f6f439a92205f855a4bf69843489dd425c4b5482522b96f385ab8138aefa8833eaf2056cfd068da37229fc7a5900d30c152cf92cf2a4f7a7505190268b08c9acd3839d560ab5762a0dfca0f2db56e2298c1f7d894b98ae8c98dfc81ef6e8e7a8a7138f12005f54bcfb93c9244468b7c76fc3afdc4c59abea57ce6302291c5130697834e838147d62112c96acefb57900eef463048068a0344f2e09d4c5a9488b63b92c5a67d1486ef56aff7f79c06fc5eb3eed23ea56f4331a638bbde8e9b022c29c08a803fb2e386012a1cf008106e619b5fab2a60653fba60c6ec7fd19f33a8e2ff6dc8046c117d3d8131d5f23b70f900ae5d632a51bf76420b9a1055c4bf49e22b5011e0fd12c12c403b42f54f799ba61b57c0bc0933adabdb909f0609602e73e583a9747a8f0477f0ea3621669343960f2dad82056471f596449ba52bef2fb24959f80659df251df5443dfe6b6a91fe0919cf0193afb37a786f9d13eeeafacd839f876e70c791e911b6e8c35fff3e4dbb787bf50fdcf9c8d001d8c078c0cb994f17a95f08d8de87700286c251011ffd8baf2e976e587730390e412e35b664a1dbff7744b68c91eee7356348c2fbe5a2e38985337cdeceb12c836cb1bade7c4c999eff6333bc5c0f779573080d046f96cca17802a0a2b7b0d36560868c2e54a883bf3ed16d5067adb0f4ff81d246b00ab30aaa58ba139e0e2d84c2b86e77934ff04cbb05f5ce568ceeb3ceb1baaf084160617f6821fc503c238a6daa5ffc19321a878ebad11a898f8d0d27b823c2e3ce57a9333d9d40a492da5ba26593ccf97b25c7b6698d9b8b4a46dce1c81c98093a790075411a6a7abca59e592f37eac9d588ab3a2e86edfbba12bbb83af804afb015a8c240dda9124a0c9c9691569eae6e948b48d4cf470f898075a1d5f13a239b3c1e31e8d98ddde799d8c3035d1e3949c2ec5a760a0f38314f66b3bf40de785c7a60a8f22d701a9e70d6a3f1b35d6d1e94038f8a7f4c97fb5370c9f83e31daa73a6e648a21e929324faa27482b039bf2d55032bfd8d1b5712b9250c8269b0daae8dbb5c8d4a243484b0d5f941a987242d06987bedfa97a3e062510c9b4cd3b82222ef22a4927749f38bd4259c3e6c8d8cbf0a1224bb80d8a5923827e18b18778dd44e7e3fa8b8b407c0cdec6fbccb5e33c2fbd9f5f0a7e35c4a04dedd69cdda7d888f2082903dd86e45732a687568a248a9af16253db86bae7e893a8a8c380e53d596733523499c74ab1c1b1ab26888533bf2d3ccfe221033442ce0d34aa34bd9c420d4e39413c95de2c2acdc520fc6ce524149bc80e9bd32bc7d72e7def1c425391fdee15cd89a090ec7aa29a4b9c0bfc01df19b9bf692c4569a9f3e0e19b288710089f677905780d2c3132c909cb29bee3bd6d62f060a944d66c78493b01279203e7a1185001ee8f6cb0967e8b3ce9aa50106c5576912a7dae46229ff03b65cc659cf49dae6aa6b162d6dba82119c511119225d6a536fc24bbc55f6e237d957a43f351c50378d0efc9ba1eac7d6a1b280c16454452294c457b8eb10dabc768edd67877b2ed08abba8768bc6579eccde4839ee7d68f80cc4aa318fd458f97ea9609f3135ea417aa455592e394b1f5ab6ccc14385ddbb416d47279e5748ee4e02e76ecba7d7474fb6ed6a851da3e156a7542bb9ad9b48b8362bff43755ce5b657d5a752ef632bb416184e70f1937c494ed9db084cc1177ac6c491772b739fba1b4be52acc2cc0975c8dc0b00929f503fb3cfe4c7e6670295edaef2327cec950737f0cc96eb30e7fa8217d9b9968274c413ec79e1b050814145432bf164f6e7b75a43424dec600502011190097ffd1edf795be01c4135a9be178b6b050d82d8542375abb40f0fe776965bf3f0630a2652e5bcf3dc237a84a4634081d0a9ba1842e6ddd4faf787aa6449a50fa9498ffe97c2759558112d1b0ec0db512d7990fc0efce6bde80f4b1ec9799d0cdcd41e6863eb473c3edb5c2e70ddc7d3aba52c2ad2e054b01eb3d92c2023b33975b23a72211fec063bb4fbaa49abacc47efea7d5ede3675ad49eb74b7fdaa5667b9ddff2e6007eccc90a7cfda32a053d9fd2aa1d01fe54c112b955d8c26e3e0ac2994fcf3f50d1fb129ee3df3db886d93faad74cec81c11e2e0922fcd0b2187cb75369598a3b5c8c8495870403b2593647a8a2d4d86601da9fbf49f1222dcfe5b64d0102d3c9296d0c0d459c5a7bab1580fb0b25a5ef71eb579546bda6ea58be241ec8ac9737e0e30ea47fa93c4cf2d44d2b6421c856dd5e1c2c3569040113d7006be693b293074a2a6188b228129fc79f9984f5bafd6f7a32f68bd3dc7197a7094e93561d208f0c948d364743854efc6af051a3e2a7eea8f132442d1e3a87e670190f3752ef0699f470ed15719ba274371179935ff79853b928cda754d1045929f8db75ca71825f21642f738622e392bc0b35ca98eff3821b7d122732f8ccf8d251d84589ce028d2efe7d7cbd34e8137f518e2feda64d9c788713df3e1450e8a36dc031c22f3d5bf7d294a66f90b64fd285aeded6e4a07b82c740c87598a9684f8f6d47b266169696b126e66d7b4532ace038a2b7921bd62fc806bb552676abb8204b4ad975d449d1be97ec9b55dc8b2b10a3dfe4880487de3f8c6a3b4426ac6adfa03845b4d0cf1e6cbd86be473d154bf7439dee05d555268a769ab339b299379cb8546f16ed8bbb789049eb57dcaca48c26e78982cc331ba474bcdd9f893f5f6526b4999fabcadc7bc6e8805ecc68902a31522e20b3f1817c1b516f16ab5bcdc7101165d59ce074e633dc68202221d2bae4ea62a13f6a5e7c82e8fd232fc076ca7399b5d01c325d67ab82f50acc789dfe8cab35de7e2131081a9d90606e5dc5a9c3af3fc9bc895174215d8aeae8dfe75b33be25298a11eabf2e0481050731edb27894df45a17985ffb4f3f27ad6393af9ac6f461737394ffc89f9549b7607dbecbf7803899d2e6513a74473ec0fb6569f6d27cc9a83f242f4ab78aea3c293ee846a2e0b3114991d5543902c848a7e451da4789e478f707e585defb47e3ce3525cfa17571772e1526c16c1065e5f438442c25e43e1023511022647244415f0bb7d28be2f7a75dae78b5da0f9d063c66ac396ef0b66fdb7e701e4caf9a435ccc476cdf3e5356ade531a3e33640ede4af542bcdb1ec54fcfe6f0ba105e0fd72b707611020ae1adc3f794b3c66e3c1f9ab0c87e5641a4891d74a194b9cd8ce14c81ad35df9a3c7862921e2d8c3942d4a57f4f4d13a6d82d75a21f1b862e8f4402c8b2c0fe2fb788ab761a22a4377497b34d137d0184d2d7bce69826e7ecbf63a89b133f263d58945627bd79472e3cbef5595a0c9d2e512605b578f2e558d4c4b31416c12f5709f68bd4e7ab1b0954f395299d634102bbbc97506e2dc938c5ecd9fdb26566eeb4de1621954ecb5af9b0d9d39b0fb1b972fd92b959277bf78d0a1763df9d9bc4182ad3f3b8eeb19d00cf41016f4d0d4623f2541a73f588f5108cde960b0bdc93ec260c14a498931226c981b41804bc09ca8a9168d9a4e17d269815e7ada71be1fc410b38874aa5782abc7ba7976daa94d724c9687c419165e77b7effe77d07e5fd6f55993b8a151889e57166c2ff63f04e3e09eead6f8c92e49e926c8f60a2f933c8926be5fb83b650b126cdbd9d239f6f11d717f8f32fd757350e7db0bd32e191052524922b2bf2b92801a717be7504ab79d55e425b09a79c8a84af1cf94c66dada7789e6d67dc041b4ac0e57c4e658d11be13af2fc3c200086e147a2223296a4253297155210440f0f17c3aa21ab7e15fe2e12bb9e9356d1018cc68313034b469152b650adab57f73350a6c0f76a36580a7dd8af218d656fa4bdd57b9d584e5acd1fa95e14120d7f9ed1fc3a83aa24135ca45472844d115f0a1bdebe2f6bc37cabdd0d7f9aab4fdc6a2c58aa0beb0ce431620d5ede6ef98e2b77e8d0558d250aa20c54c62d4b61d9bdd63286c6887ee3a556677e0673c94e46b9f834c6e4996b1c91141cd0d39b712f93e5195a7f7838f3af8325f649938d8c319ceebfa8154d23197bcbcf616be6f1f5d6fc070ed76abe89d6b94bf8a8d3f5b9bedce758b17d1e0be38bce845c8c3209d3fc30901494408c96956d050d14548d6edf55f4add18c91fb6da723a0c7c3c3f4c4b3a7056e611bdabdfd4edfb7a79a2b02c05ef4027c15db8bf2bcd015c66ae6d3203164615c56dba94606702caa577777e05e642ce3df5573ba3ae268f4ce4b38cc9013faf21d7dd7174ce7ea498c9451a1626f02398e49a33def46d228edb6de6fe8dec11f553634fb923849e3cdfbe645cff327b8251afc107b7fb8cf3cd735ed9bb1275ecc804a4f126bfeb853e13e636a74a4efc9faf01118aa82d00ac20ce0c0af140c756ab90e5dfa238707318c353c7bc9342c36ddcb6e74400933c8fa99448f3a169b95cd6d2558d755e1dd53f3fcfc46b057c550de64829e556c8cae40e796ef76fcb953086168fb2eae89349f29d3dd26ac6282292355be3b123b0c02e553bfb8948afe8d7e8ae5d63184b20795481a9385be05e9eff807b94eb1e977d50a7dd7da582695aa496a9a7587d01f970c3ed8d63db217164824d8b8bf4c5e493f801e1ed241afda4b695a4c606d6b5344493d9922dff76b4be7021d26b60d1f785d205c39d83694b0585eff60c9e1bb2f7023c5b5d3d043897baa9a9ef3507c280d9580d43c7985db146694b8649e2bf67e37081a945c4c81fad0a48e64d8877dd149443c8f4d2267b4aeaec8f168b44d5af109f505644e2a545fefb13d673210bd2b418b054cb4fc9fb7f2041e87be5f31466b51b308deff16bd9878a3ec72d0a1ad27c5cbd497b2c9585d914392da52b3708b198a3693d2988f03c7d3a41762c78cb9c268dbbcb0d1efc800fab4183286d924604a5fe9657cebad2d8bb0ef0006a46a4ef9fe92c3fdc1682b993239421879cb5626bae2368b646e61c870342b5cbb7f7baab7142a9ca2378805310c1abc12098c796550a20f3d5f01141470c1b5550857202ec712e3813d1ff7150111f4730bd83c8516aa86b345c280fb461c7bc6ff6f0bea507033d312027f51b4a90becfb048e676bfecfe2b1cd7504a226e89bb4df31d13436db7765062fc74789b75f82e77a6e83f49092558d38da47755ca0373ee0979c880e224bd5f70d6a69d8e2463d9b70bc7dbbdc9f27e1ba38d5adfdd6a5a0c564cda76a9ed6dc0e5117b06b9817d6d47f2a82d41a5a821431fe5f38eb3417d820c769afc09ffd001fd0a6f3c3879dc74ffcba15b8b29a4f435249226ee1cd7fb8c0bb6ec9012178bd25c05e69cb1d6e7121295a4e166c80d918b915232e6e8823ed6529eda300f2541142092df194de0cc255beed438afa94cbd350acf809e7f0467830b20108b95c9b653b030e311026cecc32332697cc2f8ef9cecb227de6de7144fc4b25e2180784f55204b17612228548fc825e60c88144c72abf3cb468a2d5491c431f38d858fb5471ce84c69d1d2b38e8ae2b134f4f94aa03996b2e0f1edc538ff32f7ee409b79922660b0f3421083298b14f26733577ff59b672b7214bd0e4508503c61da0b70cb6186b01ed575f9e5bf8f3bf538c2260f4a82755094c33c931ad0bb346518cff593de0985602852749610e073f20dd0be87ec8c452c3dfb4ac19d73a489e74a8a48411faac7ecf7e53d76ced94495ec2e814259fb5114a7986fb81a936d38c99443ebd55026acc6c78e1b14728551bae0bdb86cd518eeeb22dbfd7f7a32d2b94f7b0f757f34d6d22156e4dc1e7b9533fcf7a0d0cc3e41480345ddc68c11e47f8c514f1ed601d69e5b36e03962643544064ddbf689a3cbf378074879f6cd33d56c0a728a2050ab202981d6723b99a0e505cd8fea39da000bc7608a53024614407a5ebd5e034b9a59fa952841ab4f0758e988161e56fb454db449b3090eb1c4154ea6e34ea13101bb3a62dfa1878448952b1955a3c462432d7035228caf6ed4381e3ec1295e90decc62ebed5e60acbae3d26982e7834ee00a7632f581b6198f9bf42161a4980d08fac53d40b81731e4c727f5a24e75f6a262a1d2ab37b3ebc09ca6b0ffb0a1edf942e93d17d95eb3532b57488469575d9d47c2d08eec166f8fc1f6183795e1d5e48f46ae05a173af5765e03e98e6710b408cbeb169fb67f1d79a1999a977b7df51d7ede5aca5d31e9d75d2be3838a014d8283c3566ef5ea37955d6e66628d755c927e14d40f723428a69e03c8b100924b72e2c49926208044ff49536b0a1eca6c7c42ff9c90716fa35b02d2d869bcceb60e91dacf34ac1249f5d7934a078417e4fd416da2fbf9122fd37c042712ad9ce8592806b556d26163990b11466bf759615d2b852e75681a8b87571b5f0a21a4b5617cb94e2dc9efb264c0a331a752994d10a958b245cb40d9985365c4dd3b9551c4d03157aa29222a2af29ada6c123eaf08722310da16f7611cfe729255044642a8c5cb9f94c3f778248bf35520ac980af12ddd3b001df23404e49e3a57cc11fd12e51e422a92b5bf9e2ad225d42ad5d0325ca35804340fdde061c5bf2a4c8cc86e946a60040130ce831b9be93885f4ddb9fb7584ad875b05d59128f533c40c541ec03dfccba2af6fbdae4efb10a45e0f7d9851126b1dd9d374cec36067cdf2eefcb0a0cbf5619fa7ac2027d4b5c9da389bc1ffee655aef769a5aa542b291c0d71c8dc5e54268dc5f86a4133cc917a84efaf1456de9106c6fb3f5d41ff9f9a76a1dd3243a5e99c95e933d32e13f3eeb5a550", 0x2000, &(0x7f0000001180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={0x20, 0x0, 0xffffffffffffff80, {0x0, 0x4}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) r4 = dup2(r3, r1) r5 = epoll_create(0x80) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f00000001c0)={0x8}) write$tun(r4, &(0x7f00000000c0)={@val={0x0, 0x10}, @void, @arp=@generic={0x30b, 0x8914, 0x6, 0x1, 0x2, @remote, 'q', @broadcast, "189eb8d93aa222a4db818c15e0e1"}}, 0x27) chdir(&(0x7f0000000080)='./file1\x00') r6 = open(&(0x7f0000000000)='.\x00', 0x4440, 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x1a0) link(&(0x7f0000000180)='./file0/file0\x00', &(0x7f0000000300)='./file1\x00') mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='tmpfs\x00', 0x8, 0x0) chdir(&(0x7f0000000280)='./file1\x00') ioctl$AUTOFS_IOC_PROTOSUBVER(r6, 0x40049366, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00006a2000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00004a6000/0x2000)=nil) 4m38.474356683s ago: executing program 2 (id=189): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000680), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0f0026bd7000fddbdf251500000008000300", @ANYRES32, @ANYBLOB="0500290020000000084b6af14382277c7e171644188452fcc8343c81bde0891f06b0141d03df2da603245195a9b3a69428c3e5461b2aa5a5cb458bfb062dc2592f0229e8817cae2d6983a33b7ae523ce481aecf7826ce70c1d90f883ee8f37b06c963ff981ec897cd6933ba49f297ef0c8eb10d0ff141f927b4e691a"], 0x24}, 0x1, 0x0, 0x0, 0x4040000}, 0x40000) 4m23.32036469s ago: executing program 32 (id=189): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000680), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0f0026bd7000fddbdf251500000008000300", @ANYRES32, @ANYBLOB="0500290020000000084b6af14382277c7e171644188452fcc8343c81bde0891f06b0141d03df2da603245195a9b3a69428c3e5461b2aa5a5cb458bfb062dc2592f0229e8817cae2d6983a33b7ae523ce481aecf7826ce70c1d90f883ee8f37b06c963ff981ec897cd6933ba49f297ef0c8eb10d0ff141f927b4e691a"], 0x24}, 0x1, 0x0, 0x0, 0x4040000}, 0x40000) 40.235077562s ago: executing program 3 (id=2608): pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000100)=ANY=[@ANYRES8=r0, @ANYBLOB="05"], 0x0) 37.194438579s ago: executing program 3 (id=2628): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x81, @loopback, 0x401}, 0x1c) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r2, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140003"], 0x4c}, 0x1, 0x0, 0x400000000000000}, 0x0) 37.08303112s ago: executing program 3 (id=2629): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x400, 0x800, 0x2000, 0x4b0, 0xbbba, 0x4, 0x3e000000, 0x4, {0x0, 0x8}, {0x0, 0x192}, {0x2}, {0x0, 0xfffffffd, 0x1}, 0x0, 0x3f0, 0x0, 0xd614, 0x0, 0x3, 0x0, 0x2000, 0x0, 0x8, 0x8, 0x0, 0x0, 0x0, 0x0, 0x2}) 37.04180291s ago: executing program 3 (id=2631): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x40ac0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) write$eventfd(r1, &(0x7f00000002c0)=0x7ff, 0x8) r2 = creat(0x0, 0xecf86c37d53049cc) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000280)) setsockopt$inet6_tcp_int(r2, 0x6, 0xa, &(0x7f0000000240)=0x5e94, 0x4) ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000040)=0x1) r5 = dup2(r4, r4) readv(r5, &(0x7f0000000200)=[{&(0x7f0000000100)=""/248, 0xf8}], 0x1) close_range(r3, 0xffffffffffffffff, 0x0) syz_clone(0x40020000, &(0x7f0000000000)="304a127387550c6870e4cc000000", 0xe, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)="b3259e3cd22b3c39132514a9424c8f720eed327a3626176d4a16b422fd7c374f7417e7884466d2daea1dfc691b4d4ae08b1c9928228f6bbfb33e45312ec9d13b1f7c97f582c48c14740c1071bc68f3a96e298df1872e") syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYBLOB="043e110b07"], 0xec) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) lsm_list_modules(0x0, &(0x7f0000000040), 0x0) 36.696093806s ago: executing program 3 (id=2635): openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0xebff) 36.166897267s ago: executing program 3 (id=2637): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) r1 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="f0000000120003"], 0xf0}}, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x101a02, 0x0) pwritev(r2, &(0x7f00000011c0)=[{&(0x7f0000000580)="8897fda0e01796f6", 0x8}, {&(0x7f00000010c0)="fd559ade", 0x4}], 0x2, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)={0x2, 0x5, 0x20, 0x0, 0x4, 0x0, 0x0, 0x0, [@sadb_sa={0x2}]}, 0x20}}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r4 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r4, 0x107, 0x7, &(0x7f0000000000)=0x4e6f, 0x4) syz_open_dev$sndctrl(&(0x7f0000000040), 0x1ff, 0x604000) mremap(&(0x7f0000011000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000009000/0x2000)=nil) 35.977085927s ago: executing program 33 (id=2637): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) r1 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="f0000000120003"], 0xf0}}, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x101a02, 0x0) pwritev(r2, &(0x7f00000011c0)=[{&(0x7f0000000580)="8897fda0e01796f6", 0x8}, {&(0x7f00000010c0)="fd559ade", 0x4}], 0x2, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)={0x2, 0x5, 0x20, 0x0, 0x4, 0x0, 0x0, 0x0, [@sadb_sa={0x2}]}, 0x20}}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r4 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r4, 0x107, 0x7, &(0x7f0000000000)=0x4e6f, 0x4) syz_open_dev$sndctrl(&(0x7f0000000040), 0x1ff, 0x604000) mremap(&(0x7f0000011000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000009000/0x2000)=nil) 2.982691939s ago: executing program 5 (id=2911): r0 = socket$packet(0x11, 0x3, 0x300) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x200000000000000, &(0x7f00000001c0)="d6"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) (async) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000003480)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000000480)={0x2020}, 0x2020) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x1}, 0x4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x89b1, &(0x7f0000000580)={'veth1_macvtap\x00', @remote}) (async) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) r6 = socket(0x28, 0x5, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f00000001c0), r6) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r8, 0xc018aec0, &(0x7f00000000c0)={0xfe7f}) (async) bind$vsock_stream(r6, 0x0, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000100)={0x0, 0x1c, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x400c801}, 0x0) sendto$packet(r0, &(0x7f0000000180)='\v', 0x1, 0x8080, &(0x7f0000000140)={0x11, 0x1c, r5, 0x1, 0x2, 0x6, @local}, 0x14) r10 = socket$alg(0x26, 0x5, 0x0) bind$alg(r10, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-blowfish-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r10, 0x117, 0x1, &(0x7f0000000300)="ad56b6c582", 0x5) r11 = accept4(r10, 0x0, 0x0, 0x800) sendmmsg$alg(r11, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async) recvmsg(r11, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) mount(&(0x7f00000000c0)=@filename='./cgroup\x00', &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x30000c1, 0x0) (async) memfd_create(&(0x7f0000000280)='\x00', 0x2) 2.707016898s ago: executing program 5 (id=2916): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/asound/seq/clients\x00', 0x0, 0x0) read$hiddev(r0, &(0x7f00000000c0)=""/4078, 0xfee) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83c00fe8000000000000000000000000000aaff02000000120000000000000000000106"], 0xffe) 2.174913133s ago: executing program 5 (id=2923): pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000100)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff09", @ANYRES8=r0, @ANYBLOB="05"], 0x0) 1.733042347s ago: executing program 0 (id=2932): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = socket$inet(0xa, 0x801, 0x84) listen(r1, 0xfffffffd) r2 = socket$inet(0xa, 0x801, 0x84) listen(r2, 0x8) r3 = socket$inet(0xa, 0x801, 0x84) listen(r3, 0x8) r4 = socket$inet6(0xa, 0x1, 0x8010000000000084) listen(r4, 0x7) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e0000000000000e", 0x40b}], 0x1) 1.542842374s ago: executing program 0 (id=2935): ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x800) set_mempolicy(0x1, &(0x7f0000000000)=0x3, 0x3) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = memfd_create(0x0, 0x7) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000003180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf84, 0x3}, 0x1c) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x2d, 0x0) socket$kcm(0x10, 0x2, 0x4) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x80}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16, @ANYBLOB="3b9601000000000000003b00000008000300", @ANYRES32, @ANYBLOB="000802110000000002500000001515cf71f493df25daf104dd2b0c1648dbff3e393401002d1a02881b06000000000000000d00c0001c0000000100ce9500000972060303230303030000000000000000007f520d83dd6fc6bcf84e0259ddb798f2166c6d517945f9e04b7ec55988cc1e601f7986ecaf706482a03f6631016f55a4027bdf8fd02809a63e58770e94edd91ef0bade6660efc2e06e418aa193eb01d7c761c4ecda20eb292c3fb51a4272fdfa09b3e9cf8388eb9e7dc9cb07f4b6150fd7f2ca967039029da8b7d5f49439f1c7f908c5b3f346f4a29a480235acf6a3c6589021b12351ffdf6d2076384a6d54177f5fc7e4fa156fb2407932c807b17eefc2ba9a24d6f905347d3b854d41b8fe0e2a1242dc6a0ad72c81fb5c046bff34ecc356b37db3770bb98ca0f66a4602"], 0x74}, 0x1, 0x0, 0x0, 0x8011}, 0x0) 1.444180125s ago: executing program 0 (id=2937): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x81, @loopback, 0x401}, 0x1c) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r2, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140003"], 0x4c}, 0x1, 0x0, 0x0, 0xe703}, 0x0) 1.224860356s ago: executing program 0 (id=2941): r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r3, 0x6) accept4$inet6(r3, 0x0, 0x0, 0x0) shutdown(r3, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e06060f08"], 0x9) r4 = syz_io_uring_setup(0x3aca, &(0x7f0000000140)={0x0, 0x45bf, 0x0, 0x1, 0x1c3}, &(0x7f00000001c0), &(0x7f0000000280)) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x400000b, 0x4010, r4, 0x0) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r5, 0xc020aa08, &(0x7f00000000c0)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000200)={0x60, 0x0, &(0x7f0000245000/0x2000)=nil, &(0x7f00004c7000/0x1000)=nil, 0x0, 0x0, 0x0, 0x1bb, 0x0, 0x0, 0x0, 0x55}) getgroups(0x2, &(0x7f0000000000)=[0x0, 0xee00]) setfsgid(r6) r7 = add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc4}, &(0x7f0000000080)={0x0, "feea60341ee0d624a0dadbf89196a36a29319a9926164ea4358679d40460e6f2c5f2ef7451f32fa58d3cef648cbe84f345127b3d85fc7081c54148b79e780b40", 0x12}, 0x48, 0xfffffffffffffffc) keyctl$unlink(0x9, r7, r7) r8 = request_key(&(0x7f0000000100)='rxrpc\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f00000001c0)='@(^\x00', 0x0) keyctl$setperm(0x5, r7, 0x110000) keyctl$KEYCTL_MOVE(0x1e, r7, r8, 0x0, 0x0) ioctl$sock_ifreq(r2, 0x8918, &(0x7f00000002c0)={'bond_slave_1\x00', @ifru_flags=0x400}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x48, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x5, 0x1878d3, 0x2ca795}) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f00000000c0)={0x48, 0x6, r9, 0x0, r10}) 979.038373ms ago: executing program 4 (id=2943): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x3, 'sh\x00', 0x1, 0x4, 0x6d}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x3200, 0x485, 0x0, 0x0) 890.228519ms ago: executing program 4 (id=2944): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) inotify_init() inotify_add_watch(0xffffffffffffffff, 0x0, 0x80000000) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000040), 0x20000007d, 0x0) ioctl$MON_IOCX_GET(r1, 0x40189206, &(0x7f0000000140)={&(0x7f0000000100), 0x0, 0x83}) r3 = dup3(r1, r2, 0x0) ioctl$MON_IOCX_GETX(r3, 0x4018920a, &(0x7f00000001c0)={&(0x7f0000000440), &(0x7f0000002a80)=""/4115, 0x1013}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x2000) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x2) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) 873.064321ms ago: executing program 1 (id=2945): ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x800) set_mempolicy(0x1, &(0x7f0000000000)=0x3, 0x3) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = memfd_create(0x0, 0x7) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000003180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf84, 0x3}, 0x1c) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x2d, 0x0) socket$kcm(0x10, 0x2, 0x4) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x80}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16, @ANYBLOB="3b9601000000000000003b00000008000300", @ANYRES32, @ANYBLOB="000802110000000002500000001515cf71f493df25daf104dd2b0c1648dbff3e393401002d1a02881b06000000000000000d00c0001c0000000100ce9500000972060303230303030000000000000000007f520d83dd6fc6bcf84e0259ddb798f2166c6d517945f9e04b7ec55988cc1e601f7986ecaf706482a03f6631016f55a4027bdf8fd02809a63e58770e94edd91ef0bade6660efc2e06e418aa193eb01d7c761c4ecda20eb292c3fb51a4272fdfa09b3e9cf8388eb9e7dc9cb07f4b6150fd7f2ca967039029da8b7d5f49439f1c7f908c5b3f346f4a29a480235acf6a3c6589021b12351ffdf6d2076384a6d54177f5fc7e4fa156fb2407932c807b17eefc2ba9a24d6f905347d3b854d41b8fe0e2a1242dc6a0ad72c81fb5c046bff34ecc356b37db3770bb98ca0f66a4602"], 0x74}, 0x1, 0x0, 0x0, 0x8011}, 0x0) 760.246628ms ago: executing program 4 (id=2946): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="000086dd000411000400000000006eec00be10a42f01fe8000000000000000020000000000aaff020000000000000000000000000001330022eb"], 0x10da) 758.90326ms ago: executing program 5 (id=2947): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)="180c4552", 0x4) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x204, 0x0, 0x22000000, 0x0, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00", [0x18]}}) 699.792701ms ago: executing program 1 (id=2948): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) r1 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x18) setsockopt$inet6_opts(r1, 0x29, 0x36, 0x0, 0x0) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/212, 0xfffffed3}], 0x1, 0xffeffffb, 0x1007) 550.894144ms ago: executing program 1 (id=2949): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000100), r0) sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000400000014000600776c616e31000000000000000000000014000300fe8000000000000700000000020000aa08000400ac141400100002"], 0x58}}, 0x0) 550.747631ms ago: executing program 5 (id=2950): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000005000000000a20000000000a01030000000000000000010000000900010073797a310000000040000000030a01020800000000000000010000000900030073797a320000000014000480080002400000000008000140000000050900010073797a310000000038000000050a01020000000000000000010020000c00024000000000000000010900010073797a310000000004000480080007006e6174"], 0xc0}}, 0x0) 481.034499ms ago: executing program 1 (id=2951): r0 = creat(&(0x7f0000001380)='./file0\x00', 0x4) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='esdfs\x00', 0x0, 0x0) close(r0) 467.102776ms ago: executing program 4 (id=2952): r0 = fanotify_init(0x200, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_mark(r0, 0x455, 0x8000003, r1, 0x0) fanotify_mark(r0, 0x41, 0x8000038, r1, 0x0) r2 = signalfd(r0, &(0x7f0000000000)={[0xc5d]}, 0x8) r3 = socket$inet_udp(0x2, 0x2, 0x0) mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x1, 0x21e, [0x200000002300, 0x0, 0x0, 0x2000000024be, 0x2000000024ee], 0x0, 0x0, &(0x7f0000002300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000001f0000006b0000000016636169663000000000000000e3ff00007665746831000000000000000000000073797a5f74756e0039da0000f8ff0000000076657468310000000000000000001000aaaaaaaaaa3d000000ff00000180c2000003ff00ffffff00ae000000560100008e0100006f776e6572000000000000000000000000000000000000000000000000000000180000000000", @ANYRES32, @ANYRES32, @ANYRES32=0xee00, @ANYRES32, @ANYBLOB="02040000000000004e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000100000007000300000000005cae641872319dfae5a988272763a36abcf1f74cfd4bf988531a30a528c1c044813d8205fd8b1fdf1c2ccd79b5fb7f9e096fbd1c7eeee4b6646c0b2fc39d3fe20000000072656469726563740000000000000000000000000000000000000000000000000800000000000000feffffff00000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x296) getsockopt$inet_udp_int(r2, 0x11, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r2, 0x800442d4, &(0x7f0000000040)=0x1) r4 = socket(0x10, 0x80003, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000080)={'sit0\x00'}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000340)={'tunl0\x00', 0x0, 0x80, 0x700, 0x8, 0x2, {{0x28, 0x4, 0x1, 0xf, 0xa0, 0x68, 0x0, 0x1, 0x4, 0x0, @loopback, @multicast1, {[@generic={0x7, 0x2}, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x54, 0xb8, 0x3, 0x7, [{@remote, 0x1}, {@rand_addr=0x64010100, 0x6}, {@empty, 0x7}, {@loopback}, {@broadcast, 0x10001}, {@broadcast, 0x1}, {@multicast1, 0x5}, {@broadcast, 0x8000}, {@dev={0xac, 0x14, 0x14, 0x20}, 0x8}, {@multicast2, 0xc}]}, @lsrr={0x83, 0x17, 0xcf, [@dev={0xac, 0x14, 0x14, 0x22}, @empty, @remote, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @rr={0x7, 0xf, 0xb3, [@local, @multicast2, @multicast2]}, @timestamp_prespec={0x44, 0xc, 0x2b, 0x3, 0x4, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3ff}]}]}}}}}) r6 = syz_open_dev$video(&(0x7f0000000080), 0x7, 0x0) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r6, 0xc034564b, &(0x7f0000000100)={0x0, 0x59455247, 0x640, 0x4b0, 0x0, @discrete={0x5, 0x6}}) sendmsg$can_raw(r4, &(0x7f0000000300)={&(0x7f0000000240)={0x1d, r5}, 0x10, &(0x7f00000002c0)={&(0x7f0000000280)=@can={{0x2, 0x1, 0x0, 0x1}, 0x4, 0x3, 0x0, 0x0, "f456cd05865dfab1"}, 0x10}, 0x1, 0x0, 0x0, 0x800}, 0x880) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) 406.647348ms ago: executing program 5 (id=2953): r0 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f0000000580)={0x0, 0xc1, 0x80, 0x20203843, 0x0, [0x2], [0x800], [], [0x8]}) r1 = fsopen(&(0x7f0000000200)='ntfs3\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000005b574e69622bf85eda07b3"], 0x0}, 0x0) r3 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGFIELDINFO(r3, 0xc038480a, &(0x7f0000001140)={0x3, 0x100, 0xb, 0x8, 0x4424, 0x5, 0x0, 0x82, 0x0, 0x0, 0x8001, 0x7fffffff, 0x8, 0x9564}) r4 = fsmount(r1, 0x0, 0xa) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000080), 0x6, 0x200100) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r5, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r6, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r5, 0x3b89, &(0x7f0000000380)={0x28, 0x0, r7, r6, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r8, 0x84, 0x6b, &(0x7f0000000180)=[@in6={0xa, 0x4e23, 0x37e, @private2={0xfc, 0x2, '\x00', 0x1}, 0x13}], 0x1c) setsockopt(r8, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) ioctl$sock_TIOCINQ(r8, 0x541b, &(0x7f0000000000)) r9 = getpid() syz_pidfd_open(r9, 0x0) setns(r4, 0x80) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x0, &(0x7f00000005c0)={0x8, 0x70, 0x80000}, 0x20) ioctl$IOMMU_HWPT_ALLOC$NONE(r5, 0x3b89, &(0x7f00000002c0)={0x28, 0x0, r7, r6, 0x0, 0x0, 0x0, 0x0, 0x0}) r10 = openat$cgroup_subtree(r4, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r10, &(0x7f00000003c0)=ANY=[@ANYBLOB="80a4696473208c4f5c2238330dd091129b0fd186c88b2296d64c1e47d3369306f24b6d41b656cc7aa0fd963d50b5d02cbd031a8f06018262fbf079901c3544701e6e7bdfd72e21007b95d2edddffc0102b93a748ab08cb72e027ae2ee8b3537b285b165e6ab5b15180070000006cb2a392c3f8c8eb839acbabfc6f3967abbe53dbf7178e5d749045777c6d89066b581ccc1afc1de0e12705b792907a796dd8691258ca1c1f78d95bdcc58b9d23d50e00000000000000442600ad2b7deb00000000"], 0x1f) fallocate(0xffffffffffffffff, 0x28, 0x0, 0x3) add_key$fscrypt_v1(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) io_setup(0x4, 0x0) 297.42613ms ago: executing program 4 (id=2954): mount(&(0x7f00000000c0)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='exfat\x00', 0x200000, 0x0) 257.384966ms ago: executing program 1 (id=2955): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010040000000000000008100000008000300", @ANYRES32=r3, @ANYBLOB="0a0006000802110000010000060066008e8800002a0033"], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x30000) 154.820139ms ago: executing program 0 (id=2956): ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x800) set_mempolicy(0x1, &(0x7f0000000000)=0x3, 0x3) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = memfd_create(&(0x7f00000007c0)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b \x00\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\xfe\xe6\xd2SLR\xa1\x00\x00\x17\x1f$^\xe1\x00\x00\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xbf>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\x00\x00\x00\x00\x00\x00\r\x17\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\xfd\xc7\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\x02\x00\x00\x00\xb5\x82q\x1f37\x02\xb9\xb2\x9a3\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xddW\xe6}\xc5\xa4\x8f\x98\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\x826`M\xab\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8\xac\x00P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\x9b\xcc\x9b\f\xa7\x8f9\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\x01\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x1b\xbb\x04\xd7\xd1\x06\xa0m\xc9\x82<\xa9\xdc\xddRU\t\xe9\xbah\xb6\xb2\xea-{Q\xca\x14\x13\x9ajWt\xc9\xecd\r\xd5)\x1d\xaf\n\xc0\xc1\x1d}DL\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~A\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9dn\x06\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I\xfa\x12\xfc\x96\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96\xb71~2{@:\x97^\xbfcu9\x8c<^ll\x97\xe7\xc7a\tm\xe8\x01\x00j\xf8\x98\x81\xe7\xf7\xab3F\xf4u\xdaav\xd21\v\x99HG\xd8\x84\n\x13\x9a\x85&\v\xfeU\x18\x17o6m\x84\xdfx\x1cPl\t#\xc1\x8e\xddW\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\"\xd7\x99\x19pn\xbe\xb8\f#\xe2\x8f\x02\xedk\x10\x1b\x9c\x10\xd5\xab\x95Yn\xe9\x00\xb5\xa29\xd7\xd1\bs\xd0x0\xf2F\xaam\xd8\\\x16\x98\x86\xbe\xbc|h+\t.\x0f\x1b?\xbf5\x9fW\xa7\x02\x14J\x16|TV\x1bW\xd6r\nR\x82\xe0\x88%\xfa\x1f\xae\xcb\xb5g\xd5\x9a\x17\xd2F3A\x03-\xe22\x1b\xb4\xb5\b\x8b\xe79\xbew#2\xbd`', 0x7) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x2d, 0x0) socket$kcm(0x10, 0x2, 0x4) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x80}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16, @ANYBLOB="3b9601000000000000003b00000008000300", @ANYRES32, @ANYBLOB="000802110000000002500000001515cf71f493df25daf104dd2b0c1648dbff3e393401002d1a02881b06000000000000000d00c0001c0000000100ce9500000972060303230303030000000000000000007f520d83dd6fc6bcf84e0259ddb798f2166c6d517945f9e04b7ec55988cc1e601f7986ecaf706482a03f6631016f55a4027bdf8fd02809a63e58770e94edd91ef0bade6660efc2e06e418aa193eb01d7c761c4ecda20eb292c3fb51a4272fdfa09b3e9cf8388eb9e7dc9cb07f4b6150fd7f2ca967039029da8b7d5f49439f1c7f908c5b3f346f4a29a480235acf6a3c6589021b12351ffdf6d2076384a6d54177f5fc7e4fa156fb2407932c807b17eefc2ba9a24d6f905347d3b854d41b8fe0e2a1242dc6a0ad72c81fb5c046bff34ecc356b37db3770bb98ca0f66a4602"], 0x74}, 0x1, 0x0, 0x0, 0x8011}, 0x0) 150.527926ms ago: executing program 4 (id=2957): pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000100)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff09", @ANYRES8=r0, @ANYBLOB="05"], 0x0) 138.064304ms ago: executing program 1 (id=2958): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) getpeername(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) openat$snapshot(0xffffffffffffff9c, 0x0, 0x143200, 0x0) rt_sigtimedwait(0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x2) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_subtree(r2, &(0x7f0000000040), 0x2, 0x0) openat$cgroup_subtree(r2, &(0x7f0000000080), 0x2, 0x0) rmdir(&(0x7f0000000140)='./cgroup/../file0\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="0f020000390005", 0x7}], 0x1}, 0x0) r5 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="180000006a"], 0xfe33) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') recvmsg(0xffffffffffffffff, &(0x7f000000c000)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}, {&(0x7f000000c040)=""/4139, 0x102b}, {&(0x7f0000000340)=""/198, 0xc6}], 0x3}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0xc0686611, &(0x7f0000000180)={0x68, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x98000, 0x0) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r4, 0xf50f, 0x0) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYRES64=r0, @ANYRES16=r6, @ANYBLOB="010040000000000000008100000008000300", @ANYRES32=r7, @ANYBLOB="0a0006000802110000010000060066608e8800002a0033"], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 0s ago: executing program 0 (id=2959): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000080)={'syz1\x00', {0x1b10, 0x0, 0x1, 0x2}, 0x2f, [0x2, 0x1, 0x704d, 0x1, 0x9, 0x1, 0x2, 0x7db, 0x40004, 0xfffffc01, 0xfffffffb, 0x8, 0x1, 0x100, 0xfe, 0x48, 0x7, 0x5, 0x7ff, 0x8, 0x76, 0x8, 0x0, 0x81, 0x40, 0x19b9, 0x8000, 0x7, 0x7fff, 0x4000000, 0x7, 0x3, 0xe, 0x7, 0x1, 0x1, 0x5, 0xf, 0x7, 0x10001, 0x9, 0x7f, 0x8, 0x6, 0xb, 0x5, 0x6, 0x40, 0x7f, 0x9, 0x1, 0x6, 0x3, 0x2284919, 0x4, 0x5643fa73, 0xfffeffff, 0x6, 0x800, 0x2, 0x8a, 0x6, 0x1, 0x6], [0xffffffd2, 0x7fffffff, 0xffff, 0x8, 0xe62, 0x3, 0x0, 0x9, 0xc33, 0x3, 0x7, 0x800, 0x6c368000, 0x4, 0x7, 0x0, 0x10, 0x5, 0x8, 0x8001, 0x3, 0x7fff, 0x9, 0x0, 0x5, 0x4, 0x7, 0x8, 0x40, 0xc10, 0x80000001, 0x3, 0x3, 0x3, 0x7, 0x8, 0x8, 0x7, 0x4, 0x9, 0x5, 0x3, 0x2, 0x0, 0x0, 0x11e, 0xa4, 0x4, 0x5, 0xd69, 0x9, 0xf404, 0xf1, 0x3, 0x3, 0x1, 0x6, 0x6, 0x0, 0x6, 0x8, 0x6, 0x4, 0x6a], [0x3, 0x1, 0x4, 0xfffffffc, 0x0, 0x7fff, 0x401, 0x9, 0x2, 0xffc, 0x7, 0x4, 0xc, 0x7, 0x6, 0xa, 0x6, 0x4, 0x5, 0x5, 0x2, 0x30000000, 0x3, 0x2, 0xfffffffd, 0x7, 0x5, 0x7f, 0x7ff, 0xd, 0x3fc, 0xf, 0x41, 0x81, 0xc99, 0x25a, 0x2, 0x0, 0x2, 0x5d9fffa, 0x3ff, 0xff, 0x1, 0x8, 0x10000, 0xe7, 0x200, 0x7af5, 0x2, 0xb, 0x0, 0xffff, 0x7, 0x6, 0x2, 0x81, 0x8, 0x2, 0xfffffffd, 0x100, 0x8, 0x0, 0x6, 0x10], [0xffffff80, 0xd5800000, 0x0, 0x4, 0x2, 0x62a, 0x3, 0x407, 0xb343, 0x4, 0x1, 0x8, 0x8000, 0x8, 0xffffff81, 0x80000000, 0x5, 0x3, 0x200, 0xfff, 0x3, 0xfffffffd, 0x3c63, 0x7, 0x6, 0xe6, 0xffffffff, 0x3, 0x2, 0x7, 0x1, 0x7, 0x7, 0x8, 0x1, 0xf, 0x9, 0x17ce, 0x0, 0x3, 0x6fe, 0xe, 0x7, 0x13a, 0x7, 0x0, 0xb757, 0x5, 0x11b, 0x996, 0x50, 0x8c1, 0x0, 0x5, 0x4, 0xf, 0x100, 0x10000400, 0x9, 0x7fff, 0x3, 0xfffffffb, 0xc, 0x2]}, 0x45c) socket$vsock_stream(0x28, 0x1, 0x0) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="2800000014001901000000000000000228"], 0x28}}, 0x48c0) creat(&(0x7f0000001380)='./file0\x00', 0x12c) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r1, 0x5411, &(0x7f0000000000)={0x0, @bcast, @bpq0, 0x6, 'syz1\x00', @null, 0xb4, 0x5, [@bcast, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='omfs\x00', 0x8002, 0x0) kernel console output (not intermixed with test programs): 6081 - 0 [ 330.519444][T12653] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2398'. [ 330.558351][T12627] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 330.599806][ T153] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.616214][T12655] qrtr: Invalid version 43 [ 330.618729][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 330.641472][T12627] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 330.660508][ T9] usb 2-1: not running at top speed; connect to a high speed hub [ 330.669790][ T9] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 330.696851][ T9] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 330.708980][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 330.756738][ T9] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 330.768243][ T153] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.770716][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.797916][T12627] team0: Port device team_slave_0 added [ 330.803596][ T9] usb 2-1: SerialNumber: syz [ 330.816007][T12627] team0: Port device team_slave_1 added [ 330.879508][T12627] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 330.887232][T12627] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 330.913812][T12627] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 330.927339][T12627] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 330.937817][T12627] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 330.964255][T12627] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 331.061909][ T9] usb 2-1: 0:2 : does not exist [ 331.079038][T12627] hsr_slave_0: entered promiscuous mode [ 331.088430][T12627] hsr_slave_1: entered promiscuous mode [ 331.097500][ T9] usb 2-1: USB disconnect, device number 69 [ 331.101070][T12627] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 331.116773][T12627] Cannot create hsr debugfs directory [ 331.177163][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 331.444240][T12670] /dev/rnullb0: Can't lookup blockdev [ 331.487606][ T153] bridge_slave_1: left allmulticast mode [ 331.494893][ T153] bridge_slave_1: left promiscuous mode [ 331.502055][ T153] bridge0: port 2(bridge_slave_1) entered disabled state [ 331.516212][ T153] bridge_slave_0: left allmulticast mode [ 331.523951][ T153] bridge_slave_0: left promiscuous mode [ 331.530949][ T153] bridge0: port 1(bridge_slave_0) entered disabled state [ 331.620598][ T51] Bluetooth: hci3: command tx timeout [ 331.792481][T12679] qrtr: Invalid version 43 [ 332.001070][T12686] /dev/rnullb0: Can't lookup blockdev [ 332.402783][T12700] /dev/rnullb0: Can't lookup blockdev [ 332.461027][T12261] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 332.504808][ T153] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 332.534145][ T153] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 332.555941][ T153] bond0 (unregistering): Released all slaves [ 332.639065][T12261] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 332.665272][T12261] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 332.682136][T12261] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 332.699748][T12261] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 332.728282][T12261] usb 1-1: SerialNumber: syz [ 332.776602][T12708] qrtr: Invalid version 43 [ 333.002194][T12261] usb 1-1: 0:2 : does not exist [ 333.007202][T12261] usb 1-1: unit 5 not found! [ 333.057482][T12261] usb 1-1: USB disconnect, device number 61 [ 333.158830][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 333.300720][ T153] hsr_slave_0: left promiscuous mode [ 333.316836][ T153] hsr_slave_1: left promiscuous mode [ 333.332671][ T153] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 333.340136][ T153] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 333.368104][ T153] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 333.385597][ T153] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 333.415832][T12721] /dev/rnullb0: Can't lookup blockdev [ 333.441810][ T153] veth1_macvtap: left promiscuous mode [ 333.447734][ T153] veth0_macvtap: left promiscuous mode [ 333.482743][ T153] veth1_vlan: left promiscuous mode [ 333.488146][ T153] @: left promiscuous mode [ 333.701032][ T51] Bluetooth: hci3: command tx timeout [ 333.840299][T12732] qrtr: Invalid version 43 [ 333.868353][T12734] /dev/rnullb0: Can't lookup blockdev [ 334.580926][T12261] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 334.699310][ T153] team0 (unregistering): Port device team_slave_1 removed [ 334.742898][T12261] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 334.753429][T12261] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 334.763021][ T153] team0 (unregistering): Port device team_slave_0 removed [ 334.764969][T12261] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 334.782568][T12261] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 334.790716][T12261] usb 1-1: SerialNumber: syz [ 335.009238][T12261] usb 1-1: 0:2 : does not exist [ 335.020127][T12261] usb 1-1: unit 5 not found! [ 335.059313][T12261] usb 1-1: USB disconnect, device number 62 [ 335.119969][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 335.695830][T12766] qrtr: Invalid version 43 [ 335.781417][ T51] Bluetooth: hci3: command tx timeout [ 335.912584][T12772] binder: 12771:12772 ioctl 4018620d 0 returned -22 [ 335.943876][ T5834] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 335.993762][T12627] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 336.041427][T12627] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 336.084740][T12627] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 336.092453][ T153] IPVS: stop unused estimator thread 0... [ 336.111248][ T5834] usb 1-1: Using ep0 maxpacket: 32 [ 336.118896][ T5834] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 336.133049][T12627] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 336.139867][ T5834] usb 1-1: config 0 has no interface number 0 [ 336.158558][ T5834] usb 1-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 336.172565][T12783] FAULT_INJECTION: forcing a failure. [ 336.172565][T12783] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 336.199348][ T5834] usb 1-1: config 0 interface 1 has no altsetting 0 [ 336.210243][T12783] CPU: 1 UID: 0 PID: 12783 Comm: syz.4.2438 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 336.210271][T12783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 336.210284][T12783] Call Trace: [ 336.210292][T12783] [ 336.210301][T12783] dump_stack_lvl+0x189/0x250 [ 336.210329][T12783] ? __pfx____ratelimit+0x10/0x10 [ 336.210355][T12783] ? __pfx_dump_stack_lvl+0x10/0x10 [ 336.210377][T12783] ? __pfx__printk+0x10/0x10 [ 336.210413][T12783] should_fail_ex+0x414/0x560 [ 336.210450][T12783] strncpy_from_user+0x36/0x290 [ 336.210485][T12783] getname_flags+0xf3/0x540 [ 336.210520][T12783] do_sys_openat2+0xbc/0x1c0 [ 336.210543][T12783] ? __pfx_do_sys_openat2+0x10/0x10 [ 336.210564][T12783] ? ksys_write+0x22a/0x250 [ 336.210591][T12783] ? __pfx_ksys_write+0x10/0x10 [ 336.210619][T12783] __x64_sys_openat+0x138/0x170 [ 336.210644][T12783] do_syscall_64+0xfa/0x3b0 [ 336.210670][T12783] ? lockdep_hardirqs_on+0x9c/0x150 [ 336.210694][T12783] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.210722][T12783] ? clear_bhb_loop+0x60/0xb0 [ 336.210747][T12783] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.210767][T12783] RIP: 0033:0x7fb6bfb8e929 [ 336.210786][T12783] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 336.210803][T12783] RSP: 002b:00007fb6c0a86038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 336.210824][T12783] RAX: ffffffffffffffda RBX: 00007fb6bfdb5fa0 RCX: 00007fb6bfb8e929 [ 336.210838][T12783] RDX: 0000000000000001 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 336.210852][T12783] RBP: 00007fb6c0a86090 R08: 0000000000000000 R09: 0000000000000000 [ 336.210864][T12783] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 336.210876][T12783] R13: 0000000000000001 R14: 00007fb6bfdb5fa0 R15: 00007ffdecb9d368 [ 336.210905][T12783] [ 336.419279][ T5834] usb 1-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 336.428777][ T5834] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 336.437003][ T5834] usb 1-1: Product: syz [ 336.441266][ T5834] usb 1-1: Manufacturer: syz [ 336.445897][ T5834] usb 1-1: SerialNumber: syz [ 336.460929][ T5834] usb 1-1: config 0 descriptor?? [ 336.572920][T12627] 8021q: adding VLAN 0 to HW filter on device bond0 [ 336.659643][T12627] 8021q: adding VLAN 0 to HW filter on device team0 [ 336.702268][ T5834] cx231xx 1-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 336.720525][ T5834] cx231xx 1-1:0.1: Failed to read PCB config [ 336.744551][ T1149] bridge0: port 1(bridge_slave_0) entered blocking state [ 336.746872][ T5834] cx231xx 1-1:0.1: probe with driver cx231xx failed with error -71 [ 336.751806][ T1149] bridge0: port 1(bridge_slave_0) entered forwarding state [ 336.773198][T12799] ptrace attach of "./syz-executor exec"[6906] was attempted by "./syz-executor exec"[12799] [ 336.801958][ T1161] bridge0: port 2(bridge_slave_1) entered blocking state [ 336.806570][ T5834] usb 1-1: USB disconnect, device number 63 [ 336.809157][ T1161] bridge0: port 2(bridge_slave_1) entered forwarding state [ 336.912372][T12799] fuseblk: Unknown parameter '2 Ofd' [ 336.917542][T12627] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 337.032219][ T3083] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 337.112947][ T5834] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 337.193506][ T3083] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 337.209908][T12627] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 337.210607][ T3083] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 337.234001][ T3083] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 337.251460][ T3083] usb 2-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 337.260739][ T3083] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 337.281531][ T5834] usb 1-1: Using ep0 maxpacket: 32 [ 337.292828][ T5834] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 337.300873][ T5834] usb 1-1: config 0 has no interface number 0 [ 337.311896][ T3083] usb 2-1: config 0 descriptor?? [ 337.336315][ T5834] usb 1-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 337.350427][T12627] veth0_vlan: entered promiscuous mode [ 337.357208][ T5834] usb 1-1: config 0 interface 1 has no altsetting 0 [ 337.370412][T12627] veth1_vlan: entered promiscuous mode [ 337.378924][ T5834] usb 1-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 337.400627][ T5834] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.411635][ T5834] usb 1-1: Product: syz [ 337.416202][ T5834] usb 1-1: Manufacturer: syz [ 337.420913][ T5834] usb 1-1: SerialNumber: syz [ 337.434150][ T5834] usb 1-1: config 0 descriptor?? [ 337.449622][T12627] veth0_macvtap: entered promiscuous mode [ 337.473957][T12627] veth1_macvtap: entered promiscuous mode [ 337.523999][T12798] netlink: 108 bytes leftover after parsing attributes in process `syz.1.2439'. [ 337.534670][T12627] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 337.538290][ T24] usb 2-1: USB disconnect, device number 70 [ 337.590423][T12627] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 337.618536][ T1161] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.629913][ T1161] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.643222][ T59] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.657008][ T59] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.680146][ T5834] cx231xx 1-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 337.692173][ T5834] cx231xx 1-1:0.1: bad scenario!!!!! [ 337.692173][ T5834] config_info=0 [ 337.700822][ T5834] cx231xx 1-1:0.1: Failed to read PCB config [ 337.818746][T12261] usb 1-1: USB disconnect, device number 64 [ 337.868818][ T51] Bluetooth: hci3: command tx timeout [ 337.991045][ T1002] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 338.031524][ T1002] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 338.098591][ T1161] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 338.127269][ T1161] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 338.208179][T12834] binder: 12833:12834 ioctl 4018620d 0 returned -22 [ 338.311574][ T5834] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 338.324475][ T9] IPVS: starting estimator thread 0... [ 338.453188][T12839] IPVS: using max 25 ests per chain, 60000 per kthread [ 338.477838][ T5834] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 338.480599][T12843] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2446'. [ 338.501041][ T5834] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 338.517974][T12845] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2447'. [ 338.529056][ T5834] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 338.544927][ T5834] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 338.568509][ T5834] usb 1-1: SerialNumber: syz [ 338.794847][ T5834] usb 1-1: 0:2 : does not exist [ 338.799849][ T5834] usb 1-1: unit 5 not found! [ 338.883261][ T5834] usb 1-1: USB disconnect, device number 65 [ 338.974579][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 338.990691][T12862] netlink: 'syz.1.2451': attribute type 58 has an invalid length. [ 339.214822][T12871] binder: 12870:12871 ioctl 4018620d 0 returned -22 [ 339.581739][ T24] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 339.673908][T12890] FAULT_INJECTION: forcing a failure. [ 339.673908][T12890] name failslab, interval 1, probability 0, space 0, times 0 [ 339.701818][T12890] CPU: 0 UID: 0 PID: 12890 Comm: syz.0.2459 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 339.701850][T12890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 339.701863][T12890] Call Trace: [ 339.701872][T12890] [ 339.701881][T12890] dump_stack_lvl+0x189/0x250 [ 339.701909][T12890] ? __pfx____ratelimit+0x10/0x10 [ 339.701935][T12890] ? __pfx_dump_stack_lvl+0x10/0x10 [ 339.701957][T12890] ? __pfx__printk+0x10/0x10 [ 339.701983][T12890] ? __pfx___might_resched+0x10/0x10 [ 339.702003][T12890] ? fs_reclaim_acquire+0x7d/0x100 [ 339.702034][T12890] should_fail_ex+0x414/0x560 [ 339.702068][T12890] ? __nf_hook_entries_try_shrink+0x316/0x6e0 [ 339.702093][T12890] should_failslab+0xa8/0x100 [ 339.702131][T12890] __kvmalloc_node_noprof+0x161/0x5f0 [ 339.702156][T12890] ? __nf_hook_entries_try_shrink+0x316/0x6e0 [ 339.702186][T12890] __nf_hook_entries_try_shrink+0x316/0x6e0 [ 339.702224][T12890] __nf_unregister_net_hook+0x4f6/0x700 [ 339.702259][T12890] nf_unregister_net_hooks+0xcb/0x140 [ 339.702288][T12890] ip_vs_unregister_hooks+0xbc/0x120 [ 339.702318][T12890] ip_vs_unlink_service+0x40d/0xa30 [ 339.702359][T12890] ip_vs_flush+0x169/0x1c0 [ 339.702388][T12890] do_ip_vs_set_ctl+0x470/0xa60 [ 339.702412][T12890] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 339.702427][T12890] ? rcu_is_watching+0x15/0xb0 [ 339.702463][T12890] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 339.702502][T12890] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 339.702526][T12890] ? aa_sk_perm+0x81e/0x950 [ 339.702549][T12890] ? __pfx_aa_sk_perm+0x10/0x10 [ 339.702576][T12890] nf_setsockopt+0x26c/0x290 [ 339.702605][T12890] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 339.702631][T12890] do_sock_setsockopt+0x25a/0x3e0 [ 339.702663][T12890] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 339.702698][T12890] ? __fget_files+0x2a/0x420 [ 339.702735][T12890] __x64_sys_setsockopt+0x18b/0x220 [ 339.702769][T12890] do_syscall_64+0xfa/0x3b0 [ 339.702792][T12890] ? lockdep_hardirqs_on+0x9c/0x150 [ 339.702814][T12890] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.702833][T12890] ? clear_bhb_loop+0x60/0xb0 [ 339.702856][T12890] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.702875][T12890] RIP: 0033:0x7f74ce58e929 [ 339.702892][T12890] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 339.702909][T12890] RSP: 002b:00007f74cf330038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 339.702929][T12890] RAX: ffffffffffffffda RBX: 00007f74ce7b5fa0 RCX: 00007f74ce58e929 [ 339.702943][T12890] RDX: 0000000000000485 RSI: 0000000000000000 RDI: 0000000000000003 [ 339.702956][T12890] RBP: 00007f74cf330090 R08: 0000000000000000 R09: 0000000000000000 [ 339.702968][T12890] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 339.702978][T12890] R13: 0000000000000000 R14: 00007f74ce7b5fa0 R15: 00007ffd5987aa08 [ 339.703008][T12890] [ 339.754269][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 340.025712][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 340.035628][ T24] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 340.044765][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 340.063426][ T24] usb 2-1: config 0 descriptor?? [ 340.089583][T12899] binder: BINDER_SET_CONTEXT_MGR already set [ 340.095846][T12899] binder: 12898:12899 ioctl 4018620d 200000000040 returned -16 [ 340.432239][ T9] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 340.444543][T12910] netlink: 'syz.0.2468': attribute type 3 has an invalid length. [ 340.454156][T12910] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2468'. [ 340.472648][ T24] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 340.496433][ T24] cp2112 0003:10C4:EA90.0009: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 340.606614][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 340.621689][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 340.630767][T12916] /dev/rnullb0: Can't lookup blockdev [ 340.654525][ T9] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 340.685718][ T24] cp2112 0003:10C4:EA90.0009: Part Number: 0x82 Device Version: 0xFE [ 340.694943][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 340.709677][ T9] usb 4-1: SerialNumber: syz [ 340.889867][T12923] binder: BINDER_SET_CONTEXT_MGR already set [ 340.896548][T12923] binder: 12921:12923 ioctl 4018620d 200000000040 returned -16 [ 340.960369][ T9] usb 4-1: 0:2 : does not exist [ 340.970934][ T9] usb 4-1: unit 5 not found! [ 341.016867][ T9] usb 4-1: USB disconnect, device number 89 [ 341.069787][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 341.289099][T12875] cp2112 0003:10C4:EA90.0009: Error starting transaction: -38 [ 341.325014][T12875] /dev/rnullb0: Can't lookup blockdev [ 341.340740][ T24] cp2112 0003:10C4:EA90.0009: error reading lock byte: -71 [ 341.380485][ T24] usb 2-1: USB disconnect, device number 71 [ 341.703790][T12948] binder: BINDER_SET_CONTEXT_MGR already set [ 341.709851][T12948] binder: 12947:12948 ioctl 4018620d 200000000040 returned -16 [ 341.963329][T12955] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2487'. [ 342.246691][T12969] binder: 12968:12969 ioctl c0306201 0 returned -14 [ 342.402560][T12261] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 342.584891][T12261] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 342.595200][T12261] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 342.605576][T12261] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 342.615285][T12261] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 342.623556][T12261] usb 2-1: SerialNumber: syz [ 342.815729][ T24] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 342.836797][T12261] usb 2-1: 0:2 : does not exist [ 342.846003][T12261] usb 2-1: unit 5 not found! [ 342.862493][T12261] usb 2-1: USB disconnect, device number 72 [ 342.900887][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 342.976809][ T24] usb 4-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 342.986769][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 342.999006][ T24] usb 4-1: config 0 descriptor?? [ 343.010753][ T24] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 343.495669][T12986] /dev/rnullb0: Can't lookup blockdev [ 343.852544][T12994] binder: 12993:12994 ioctl c0306201 0 returned -14 [ 344.003893][T12999] FAULT_INJECTION: forcing a failure. [ 344.003893][T12999] name failslab, interval 1, probability 0, space 0, times 0 [ 344.043750][ T24] gspca_cpia1: usb_control_msg 05, error -110 [ 344.062456][T12999] CPU: 1 UID: 0 PID: 12999 Comm: syz.0.2505 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 344.062489][T12999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 344.062502][T12999] Call Trace: [ 344.062510][T12999] [ 344.062532][T12999] dump_stack_lvl+0x189/0x250 [ 344.062558][T12999] ? __pfx____ratelimit+0x10/0x10 [ 344.062580][T12999] ? __pfx_dump_stack_lvl+0x10/0x10 [ 344.062601][T12999] ? __pfx__printk+0x10/0x10 [ 344.062629][T12999] ? __pfx___might_resched+0x10/0x10 [ 344.062647][T12999] ? fs_reclaim_acquire+0x7d/0x100 [ 344.062677][T12999] should_fail_ex+0x414/0x560 [ 344.062712][T12999] should_failslab+0xa8/0x100 [ 344.062746][T12999] kmem_cache_alloc_noprof+0x73/0x3c0 [ 344.062769][T12999] ? alloc_empty_file+0x55/0x1d0 [ 344.062803][T12999] alloc_empty_file+0x55/0x1d0 [ 344.062834][T12999] path_openat+0x107/0x3830 [ 344.062854][T12999] ? arch_stack_walk+0xfc/0x150 [ 344.062904][T12999] ? kasan_save_track+0x4f/0x80 [ 344.062923][T12999] ? kasan_save_track+0x3e/0x80 [ 344.062940][T12999] ? __kasan_slab_alloc+0x6c/0x80 [ 344.062960][T12999] ? getname_flags+0xb8/0x540 [ 344.062988][T12999] ? __pfx_path_openat+0x10/0x10 [ 344.063007][T12999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.063047][T12999] do_filp_open+0x1fa/0x410 [ 344.063066][T12999] ? __lock_acquire+0xab9/0xd20 [ 344.063098][T12999] ? __pfx_do_filp_open+0x10/0x10 [ 344.063142][T12999] ? _raw_spin_unlock+0x28/0x50 [ 344.063161][T12999] ? alloc_fd+0x64c/0x6c0 [ 344.063199][T12999] do_sys_openat2+0x121/0x1c0 [ 344.063222][T12999] ? __pfx_do_sys_openat2+0x10/0x10 [ 344.063241][T12999] ? ksys_write+0x22a/0x250 [ 344.063267][T12999] ? __pfx_ksys_write+0x10/0x10 [ 344.063300][T12999] __x64_sys_openat+0x138/0x170 [ 344.063325][T12999] do_syscall_64+0xfa/0x3b0 [ 344.063350][T12999] ? lockdep_hardirqs_on+0x9c/0x150 [ 344.063373][T12999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.063392][T12999] ? clear_bhb_loop+0x60/0xb0 [ 344.063416][T12999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.063436][T12999] RIP: 0033:0x7f74ce58e929 [ 344.063453][T12999] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 344.063470][T12999] RSP: 002b:00007f74cf330038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 344.063492][T12999] RAX: ffffffffffffffda RBX: 00007f74ce7b5fa0 RCX: 00007f74ce58e929 [ 344.063516][T12999] RDX: 0000000000000001 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 344.063529][T12999] RBP: 00007f74cf330090 R08: 0000000000000000 R09: 0000000000000000 [ 344.063542][T12999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 344.063553][T12999] R13: 0000000000000001 R14: 00007f74ce7b5fa0 R15: 00007ffd5987aa08 [ 344.063588][T12999] [ 344.065111][ T24] gspca_cpia1: usb_control_msg 01, error -32 [ 344.442632][T13006] mkiss: ax0: crc mode is auto. [ 344.478164][ T24] gspca_cpia1: usb_control_msg 01, error -32 [ 344.490661][ T24] gspca_cpia1: usb_control_msg 01, error -32 [ 344.502410][ T24] gspca_cpia1: usb_control_msg 01, error -32 [ 344.522050][ T24] cpia1 4-1:0.0: only firmware version 1 is supported (got: 0) [ 344.572998][T13009] /dev/rnullb0: Can't lookup blockdev [ 344.632405][ T30] audit: type=1800 audit(1751303766.637:23): pid=13004 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=set_data cause=unavailable-hash-algorithm comm="syz.0.2507" name="/syz0" dev="cgroup2" ino=67 res=0 errno=0 [ 345.222406][T13018] binder: 13017:13018 ioctl c0306201 0 returned -14 [ 345.266627][T13020] /dev/rnullb0: Can't lookup blockdev [ 345.363531][T13023] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2514'. [ 345.505243][ T5839] usb 4-1: USB disconnect, device number 90 [ 345.783294][ T24] usb 1-1: new full-speed USB device number 66 using dummy_hcd [ 345.825030][T13043] MTD: Couldn't look up '/dev/rnullb0': -15 [ 345.831326][T13044] MTD: Couldn't look up '/dev/rnullb0': -15 [ 345.976106][ T24] usb 1-1: unable to get BOS descriptor or descriptor too short [ 345.985748][ T24] usb 1-1: not running at top speed; connect to a high speed hub [ 345.999893][ T24] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 346.013105][ T24] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 346.062212][ T24] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 346.103766][ T24] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 346.119428][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 346.129647][ T24] usb 1-1: SerialNumber: syz [ 346.162502][T13054] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2525'. [ 346.178202][T13054] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2525'. [ 346.396451][ T24] usb 1-1: 0:2 : does not exist [ 346.440664][T13064] FAULT_INJECTION: forcing a failure. [ 346.440664][T13064] name failslab, interval 1, probability 0, space 0, times 0 [ 346.441606][ T24] usb 1-1: USB disconnect, device number 66 [ 346.492341][T13064] CPU: 0 UID: 0 PID: 13064 Comm: syz.3.2527 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 346.492371][T13064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 346.492384][T13064] Call Trace: [ 346.492393][T13064] [ 346.492402][T13064] dump_stack_lvl+0x189/0x250 [ 346.492431][T13064] ? __pfx____ratelimit+0x10/0x10 [ 346.492458][T13064] ? __pfx_dump_stack_lvl+0x10/0x10 [ 346.492480][T13064] ? __pfx__printk+0x10/0x10 [ 346.492507][T13064] ? __pfx___might_resched+0x10/0x10 [ 346.492528][T13064] ? fs_reclaim_acquire+0x7d/0x100 [ 346.492571][T13064] should_fail_ex+0x414/0x560 [ 346.492607][T13064] ? __nf_hook_entries_try_shrink+0x316/0x6e0 [ 346.492632][T13064] should_failslab+0xa8/0x100 [ 346.492658][T13064] __kvmalloc_node_noprof+0x161/0x5f0 [ 346.492684][T13064] ? __nf_hook_entries_try_shrink+0x316/0x6e0 [ 346.492717][T13064] __nf_hook_entries_try_shrink+0x316/0x6e0 [ 346.492760][T13064] __nf_unregister_net_hook+0x4f6/0x700 [ 346.492798][T13064] nf_unregister_net_hooks+0xcb/0x140 [ 346.492827][T13064] ip_vs_unregister_hooks+0xbc/0x120 [ 346.492858][T13064] ip_vs_unlink_service+0x40d/0xa30 [ 346.492901][T13064] ip_vs_flush+0x169/0x1c0 [ 346.492933][T13064] do_ip_vs_set_ctl+0x470/0xa60 [ 346.492960][T13064] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 346.492977][T13064] ? rcu_is_watching+0x15/0xb0 [ 346.493015][T13064] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 346.493049][T13064] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 346.493074][T13064] ? aa_sk_perm+0x81e/0x950 [ 346.493100][T13064] ? __pfx_aa_sk_perm+0x10/0x10 [ 346.493127][T13064] nf_setsockopt+0x26c/0x290 [ 346.493159][T13064] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 346.493187][T13064] do_sock_setsockopt+0x25a/0x3e0 [ 346.493221][T13064] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 346.493256][T13064] ? __fget_files+0x2a/0x420 [ 346.493294][T13064] __x64_sys_setsockopt+0x18b/0x220 [ 346.493330][T13064] do_syscall_64+0xfa/0x3b0 [ 346.493355][T13064] ? lockdep_hardirqs_on+0x9c/0x150 [ 346.493379][T13064] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.493400][T13064] ? clear_bhb_loop+0x60/0xb0 [ 346.493426][T13064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.493446][T13064] RIP: 0033:0x7f268878e929 [ 346.493465][T13064] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 346.493480][T13064] RSP: 002b:00007f268953c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 346.493502][T13064] RAX: ffffffffffffffda RBX: 00007f26889b5fa0 RCX: 00007f268878e929 [ 346.493517][T13064] RDX: 0000000000000485 RSI: 0000000000000000 RDI: 0000000000000003 [ 346.493529][T13064] RBP: 00007f268953c090 R08: 0000000000000000 R09: 0000000000000000 [ 346.493541][T13064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 346.493554][T13064] R13: 0000000000000000 R14: 00007f26889b5fa0 R15: 00007fffff297718 [ 346.493597][T13064] [ 346.515043][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 346.773454][ T9] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 346.773736][ C0] raw-gadget.1 gadget.1: ignoring, device is not running [ 346.903397][ T9] usb 2-1: device descriptor read/64, error -32 [ 347.035766][T13076] netlink: 'syz.0.2532': attribute type 29 has an invalid length. [ 347.153980][ T9] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 347.207929][T13083] netlink: 'syz.0.2535': attribute type 3 has an invalid length. [ 347.216896][T13083] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2535'. [ 347.312718][T13087] /dev/rnullb0: Can't lookup blockdev [ 347.323004][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 347.330672][ T9] usb 2-1: config 1 has an invalid interface number: 5 but max is 2 [ 347.349203][ T9] usb 2-1: config 1 has 4 interfaces, different from the descriptor's value: 3 [ 347.373775][ T9] usb 2-1: config 1 has no interface number 3 [ 347.394285][ T9] usb 2-1: too many endpoints for config 1 interface 5 altsetting 107: 220, using maximum allowed: 30 [ 347.409735][ T9] usb 2-1: config 1 interface 5 altsetting 107 has 0 endpoint descriptors, different from the interface descriptor's value: 220 [ 347.424333][ T9] usb 2-1: config 1 interface 5 has no altsetting 0 [ 347.434325][ T9] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 347.444510][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.454515][ T9] usb 2-1: Product: Д [ 347.458720][ T9] usb 2-1: Manufacturer: ⁕聭 [ 347.467079][ T9] usb 2-1: SerialNumber: ⊍㫞玱졿䙜㤘쒑椌脎⛾⬾䇏ꚺꦭ犸띻啵씂ě꿕墲焈柺㱣ꠋ嗩짡쨚刻냏⛦偕䗚ෆ࠳ፅ镢㧝㪯彲쁔৴谾謗焌楢䋩妌أ됸䋞嶟闔됌䤦솾蚣✆匋秵㺨玫⚚㮑쒮싻퟈䈛⛮麚燨舧꒷認⎢ᚄ홛璲ปἺ㝨 [ 347.779871][ T9] usb 2-1: 2:1 : unknown format tag 0x2 is detected. processed as MPEG. [ 347.803015][ T9] usb 2-1: found format II with max.bitrate = 8, frame size=6 [ 347.821483][ T9] usb 2-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 347.902354][ T9] usb 2-1: USB disconnect, device number 74 [ 347.962082][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 348.207728][T13120] tipc: Started in network mode [ 348.212628][T13120] tipc: Node identity ac1414aa, cluster identity 4711 [ 348.219989][T13120] tipc: Enabling of bearer rejected, failed to enable media [ 348.414185][ T24] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 348.588136][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 348.601404][ T24] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 348.623891][ T24] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 348.633602][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 348.641793][ T24] usb 4-1: SerialNumber: syz [ 348.858655][ T24] usb 4-1: 0:2 : does not exist [ 348.867988][ T24] usb 4-1: unit 5 not found! [ 348.885947][ T24] usb 4-1: USB disconnect, device number 91 [ 348.931807][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 349.664080][ T5838] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 349.674493][ T5838] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 349.682292][ T5838] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 349.692453][ T5838] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 349.700926][ T5838] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 349.712574][T13153] /dev/rnullb0: Can't lookup blockdev [ 349.845733][ T1002] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 349.946902][ T1002] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.047394][ T1002] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.166451][ T1002] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.250959][T13177] FAULT_INJECTION: forcing a failure. [ 350.250959][T13177] name failslab, interval 1, probability 0, space 0, times 0 [ 350.268723][T13177] CPU: 1 UID: 0 PID: 13177 Comm: syz.0.2572 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 350.268752][T13177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 350.268765][T13177] Call Trace: [ 350.268773][T13177] [ 350.268781][T13177] dump_stack_lvl+0x189/0x250 [ 350.268808][T13177] ? __pfx____ratelimit+0x10/0x10 [ 350.268833][T13177] ? __pfx_dump_stack_lvl+0x10/0x10 [ 350.268855][T13177] ? __pfx__printk+0x10/0x10 [ 350.268880][T13177] ? __pfx___might_resched+0x10/0x10 [ 350.268900][T13177] ? fs_reclaim_acquire+0x7d/0x100 [ 350.268931][T13177] should_fail_ex+0x414/0x560 [ 350.268967][T13177] should_failslab+0xa8/0x100 [ 350.268992][T13177] kmem_cache_alloc_noprof+0x73/0x3c0 [ 350.269013][T13177] ? security_file_alloc+0x34/0x330 [ 350.269057][T13177] security_file_alloc+0x34/0x330 [ 350.269088][T13177] init_file+0x93/0x2f0 [ 350.269129][T13177] alloc_empty_file+0x6e/0x1d0 [ 350.269161][T13177] path_openat+0x107/0x3830 [ 350.269181][T13177] ? arch_stack_walk+0xfc/0x150 [ 350.269224][T13177] ? __lock_acquire+0xab9/0xd20 [ 350.269258][T13177] ? kasan_save_track+0x4f/0x80 [ 350.269275][T13177] ? kasan_save_track+0x3e/0x80 [ 350.269292][T13177] ? __kasan_slab_alloc+0x6c/0x80 [ 350.269312][T13177] ? getname_flags+0xb8/0x540 [ 350.269339][T13177] ? __pfx_path_openat+0x10/0x10 [ 350.269357][T13177] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.269398][T13177] do_filp_open+0x1fa/0x410 [ 350.269417][T13177] ? __lock_acquire+0xab9/0xd20 [ 350.269447][T13177] ? __pfx_do_filp_open+0x10/0x10 [ 350.269500][T13177] ? _raw_spin_unlock+0x28/0x50 [ 350.269519][T13177] ? alloc_fd+0x64c/0x6c0 [ 350.269558][T13177] do_sys_openat2+0x121/0x1c0 [ 350.269579][T13177] ? __pfx_do_sys_openat2+0x10/0x10 [ 350.269599][T13177] ? ksys_write+0x22a/0x250 [ 350.269625][T13177] ? __pfx_ksys_write+0x10/0x10 [ 350.269652][T13177] __x64_sys_openat+0x138/0x170 [ 350.269676][T13177] do_syscall_64+0xfa/0x3b0 [ 350.269701][T13177] ? lockdep_hardirqs_on+0x9c/0x150 [ 350.269724][T13177] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.269744][T13177] ? clear_bhb_loop+0x60/0xb0 [ 350.269775][T13177] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.269794][T13177] RIP: 0033:0x7f74ce58e929 [ 350.269811][T13177] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 350.269829][T13177] RSP: 002b:00007f74cf330038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 350.269850][T13177] RAX: ffffffffffffffda RBX: 00007f74ce7b5fa0 RCX: 00007f74ce58e929 [ 350.269865][T13177] RDX: 0000000000000001 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 350.269878][T13177] RBP: 00007f74cf330090 R08: 0000000000000000 R09: 0000000000000000 [ 350.269891][T13177] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 350.269903][T13177] R13: 0000000000000001 R14: 00007f74ce7b5fa0 R15: 00007ffd5987aa08 [ 350.269933][T13177] [ 350.563652][ T9] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 350.657400][T13151] chnl_net:caif_netlink_parms(): no params data found [ 350.745578][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 350.768635][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 350.791668][T13182] /dev/rnullb0: Can't lookup blockdev [ 350.837732][ T9] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 350.858811][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 350.887717][ T9] usb 4-1: SerialNumber: syz [ 351.097684][T13192] x_tables: duplicate underflow at hook 1 [ 351.114480][ T9] usb 4-1: 0:2 : does not exist [ 351.121198][ T9] usb 4-1: unit 5 not found! [ 351.170947][ T1002] bridge_slave_1: left allmulticast mode [ 351.181186][ T9] usb 4-1: USB disconnect, device number 92 [ 351.190732][ T1002] bridge_slave_1: left promiscuous mode [ 351.211172][ T1002] bridge0: port 2(bridge_slave_1) entered disabled state [ 351.260513][ T1002] bridge_slave_0: left allmulticast mode [ 351.283624][ T1002] bridge_slave_0: left promiscuous mode [ 351.299663][ T1002] bridge0: port 1(bridge_slave_0) entered disabled state [ 351.455892][T13204] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2579'. [ 351.527429][T13208] /dev/rnullb0: Can't lookup blockdev [ 351.783966][ T5838] Bluetooth: hci1: command tx timeout [ 352.089992][ T1002] dvmrp0 (unregistering): left allmulticast mode [ 352.263509][ T1002] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 352.278289][ T1002] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 352.288684][ T1002] bond0 (unregistering): Released all slaves [ 352.304282][T13151] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.311461][T13151] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.319195][T13151] bridge_slave_0: entered allmulticast mode [ 352.327199][T13151] bridge_slave_0: entered promiscuous mode [ 352.341052][T13151] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.352105][T13151] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.359803][T13151] bridge_slave_1: entered allmulticast mode [ 352.389942][T13151] bridge_slave_1: entered promiscuous mode [ 352.398235][T13222] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 352.448237][ T1002] tipc: Disabling bearer [ 352.459237][ T1002] tipc: Left network mode [ 352.558099][T13151] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 352.636624][T13151] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 352.721290][T13151] team0: Port device team_slave_0 added [ 352.746958][T13151] team0: Port device team_slave_1 added [ 352.831735][ T1002] hsr_slave_0: left promiscuous mode [ 352.844209][ T24] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 352.852225][ T1002] hsr_slave_1: left promiscuous mode [ 352.865696][ T1002] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 352.873278][ T1002] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 352.882560][ T1002] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 352.892003][ T1002] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 352.924917][ T1002] veth1_macvtap: left promiscuous mode [ 352.930532][ T1002] veth0_macvtap: left promiscuous mode [ 352.936887][ T1002] veth1_vlan: left promiscuous mode [ 352.942282][ T1002] veth0_vlan: left promiscuous mode [ 352.966612][ T5838] block nbd0: Receive control failed (result -32) [ 353.014523][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 353.046738][ T24] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 353.073875][ T24] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 353.082818][ T24] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 353.131280][ T24] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 353.159277][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 353.199442][ T24] hub 1-1:1.0: bad descriptor, ignoring hub [ 353.213965][ T24] hub 1-1:1.0: probe with driver hub failed with error -5 [ 353.231916][ T24] cdc_wdm 1-1:1.0: probe with driver cdc_wdm failed with error -22 [ 353.380241][ T9] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 353.516558][ T24] usb 1-1: USB disconnect, device number 67 [ 353.529268][ T9] usb 4-1: device descriptor read/64, error -71 [ 353.711768][T13259] /dev/rnullb0: Can't lookup blockdev [ 353.720640][ T1002] team0 (unregistering): Port device team_slave_1 removed [ 353.768673][ T1002] team0 (unregistering): Port device team_slave_0 removed [ 353.774056][ T9] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 353.866537][ T5838] Bluetooth: hci1: command tx timeout [ 353.914080][ T9] usb 4-1: device descriptor read/64, error -71 [ 354.024819][ T9] usb usb4-port1: attempt power cycle [ 354.248321][T13151] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 354.258560][T13151] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 354.284705][T13151] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 354.304590][T13151] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 354.313559][T13151] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 354.343970][T13151] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 354.364510][ T9] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 354.400620][ T9] usb 4-1: device descriptor read/8, error -71 [ 354.454596][T13151] hsr_slave_0: entered promiscuous mode [ 354.466013][T13151] hsr_slave_1: entered promiscuous mode [ 354.472490][T13151] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 354.485906][T13151] Cannot create hsr debugfs directory [ 354.601822][ T1002] IPVS: stop unused estimator thread 0... [ 354.645763][ T9] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 354.694739][ T9] usb 4-1: device descriptor read/8, error -71 [ 354.821763][ T9] usb usb4-port1: unable to enumerate USB device [ 354.931991][T13274] FAULT_INJECTION: forcing a failure. [ 354.931991][T13274] name failslab, interval 1, probability 0, space 0, times 0 [ 355.022148][T13274] CPU: 0 UID: 0 PID: 13274 Comm: syz.0.2593 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 355.022179][T13274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 355.022192][T13274] Call Trace: [ 355.022201][T13274] [ 355.022210][T13274] dump_stack_lvl+0x189/0x250 [ 355.022240][T13274] ? __pfx____ratelimit+0x10/0x10 [ 355.022267][T13274] ? __pfx_dump_stack_lvl+0x10/0x10 [ 355.022290][T13274] ? __pfx__printk+0x10/0x10 [ 355.022317][T13274] ? __pfx___might_resched+0x10/0x10 [ 355.022338][T13274] ? fs_reclaim_acquire+0x7d/0x100 [ 355.022370][T13274] should_fail_ex+0x414/0x560 [ 355.022406][T13274] ? __nf_hook_entries_try_shrink+0x316/0x6e0 [ 355.022432][T13274] should_failslab+0xa8/0x100 [ 355.022459][T13274] __kvmalloc_node_noprof+0x161/0x5f0 [ 355.022484][T13274] ? __nf_hook_entries_try_shrink+0x316/0x6e0 [ 355.022517][T13274] __nf_hook_entries_try_shrink+0x316/0x6e0 [ 355.022558][T13274] __nf_unregister_net_hook+0x4f6/0x700 [ 355.022602][T13274] nf_unregister_net_hooks+0xcb/0x140 [ 355.022633][T13274] ip_vs_unregister_hooks+0xbc/0x120 [ 355.022669][T13274] ip_vs_unlink_service+0x40d/0xa30 [ 355.022713][T13274] ip_vs_flush+0x169/0x1c0 [ 355.022747][T13274] do_ip_vs_set_ctl+0x470/0xa60 [ 355.022774][T13274] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 355.022791][T13274] ? rcu_is_watching+0x15/0xb0 [ 355.022831][T13274] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 355.022865][T13274] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 355.022890][T13274] ? aa_sk_perm+0x81e/0x950 [ 355.022923][T13274] ? __pfx_aa_sk_perm+0x10/0x10 [ 355.022951][T13274] nf_setsockopt+0x26c/0x290 [ 355.022982][T13274] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 355.023011][T13274] do_sock_setsockopt+0x25a/0x3e0 [ 355.023045][T13274] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 355.023080][T13274] ? __fget_files+0x2a/0x420 [ 355.023117][T13274] __x64_sys_setsockopt+0x18b/0x220 [ 355.023153][T13274] do_syscall_64+0xfa/0x3b0 [ 355.023178][T13274] ? lockdep_hardirqs_on+0x9c/0x150 [ 355.023202][T13274] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.023222][T13274] ? clear_bhb_loop+0x60/0xb0 [ 355.023248][T13274] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.023268][T13274] RIP: 0033:0x7f74ce58e929 [ 355.023286][T13274] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 355.023303][T13274] RSP: 002b:00007f74cf330038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 355.023325][T13274] RAX: ffffffffffffffda RBX: 00007f74ce7b5fa0 RCX: 00007f74ce58e929 [ 355.023340][T13274] RDX: 0000000000000485 RSI: 0000000000000000 RDI: 0000000000000003 [ 355.023352][T13274] RBP: 00007f74cf330090 R08: 0000000000000000 R09: 0000000000000000 [ 355.023364][T13274] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 355.023376][T13274] R13: 0000000000000000 R14: 00007f74ce7b5fa0 R15: 00007ffd5987aa08 [ 355.023408][T13274] [ 355.421590][T13282] syz.4.2595: attempt to access beyond end of device [ 355.421590][T13282] loop4: rw=0, sector=0, nr_sectors = 1 limit=0 [ 355.439359][T13282] hpfs: hpfs_map_sector(): read error [ 355.585958][T13287] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2598'. [ 355.909229][T13151] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 355.922060][T13151] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 355.937070][T13151] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 355.944999][ T5838] Bluetooth: hci1: command tx timeout [ 355.955514][T13151] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 355.974666][ T24] usb 1-1: new full-speed USB device number 68 using dummy_hcd [ 356.071343][T13151] 8021q: adding VLAN 0 to HW filter on device bond0 [ 356.095478][T13151] 8021q: adding VLAN 0 to HW filter on device team0 [ 356.133228][ T153] bridge0: port 1(bridge_slave_0) entered blocking state [ 356.140398][ T153] bridge0: port 1(bridge_slave_0) entered forwarding state [ 356.159986][ T24] usb 1-1: unable to get BOS descriptor or descriptor too short [ 356.180112][ T24] usb 1-1: not running at top speed; connect to a high speed hub [ 356.192428][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 356.199641][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 356.227813][ T24] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 356.256957][ T24] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 356.277629][ T24] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 356.296882][ T24] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 356.307702][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.320081][ T24] usb 1-1: SerialNumber: syz [ 356.563472][ T24] usb 1-1: 0:2 : does not exist [ 356.633162][ T24] usb 1-1: USB disconnect, device number 68 [ 356.909708][T13151] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 357.009790][T13332] binder: 13331:13332 ioctl 4018620d 0 returned -22 [ 357.014166][T13151] veth0_vlan: entered promiscuous mode [ 357.039091][T13151] veth1_vlan: entered promiscuous mode [ 357.072976][T13151] veth0_macvtap: entered promiscuous mode [ 357.103712][T13151] veth1_macvtap: entered promiscuous mode [ 357.176517][T13151] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 357.209987][T13151] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 357.254456][ T153] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.304083][ T153] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.344865][ T153] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.372967][ T153] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.527921][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 357.557164][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 357.575202][ T24] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 357.632034][ T1149] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 357.643623][ T1149] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 357.724735][ T24] usb 4-1: device descriptor read/64, error -71 [ 357.964720][ T24] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 358.005267][T13369] binder: 13366:13369 ioctl 4018620d 0 returned -22 [ 358.025446][ T51] Bluetooth: hci1: command tx timeout [ 358.134692][ T24] usb 4-1: device descriptor read/64, error -71 [ 358.269052][ T24] usb usb4-port1: attempt power cycle [ 358.354970][ T3083] usb 1-1: new full-speed USB device number 69 using dummy_hcd [ 358.526540][ T3083] usb 1-1: unable to get BOS descriptor or descriptor too short [ 358.545409][ T3083] usb 1-1: not running at top speed; connect to a high speed hub [ 358.575524][ T3083] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 358.584279][ T3083] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 358.610367][ T3083] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 358.624645][ T24] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 358.646422][ T3083] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 358.661584][ T24] usb 4-1: device descriptor read/8, error -71 [ 358.693369][ T3083] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.720217][ T3083] usb 1-1: SerialNumber: syz [ 358.944687][ T24] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 358.996039][ T24] usb 4-1: device descriptor read/8, error -71 [ 359.002511][ T3083] usb 1-1: 0:2 : does not exist [ 359.020495][ T5905] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 359.047723][ T3083] usb 1-1: USB disconnect, device number 69 [ 359.106868][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 359.149321][ T24] usb usb4-port1: unable to enumerate USB device [ 359.180224][ T5905] usb 2-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 359.210678][ T5905] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.223087][ T5905] usb 2-1: config 0 descriptor?? [ 359.328060][T13413] /dev/rnullb0: Can't lookup blockdev [ 359.432229][T13416] binder: 13415:13416 ioctl 4018620d 0 returned -22 [ 359.955046][ T3083] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 360.124892][ T3083] usb 1-1: Using ep0 maxpacket: 16 [ 360.158426][T13426] /dev/rnullb0: Can't lookup blockdev [ 360.169659][ T3083] usb 1-1: unable to get BOS descriptor or descriptor too short [ 360.195713][ T3083] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 360.214807][ T3083] usb 1-1: can't read configurations, error -71 [ 360.239700][T13396] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 360.254456][T13396] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 360.715662][T13452] evm: overlay not supported [ 360.789865][T13454] binder: 13453:13454 ioctl c0306201 0 returned -14 [ 360.876501][ T5905] pegasus 2-1:0.0: setup Pegasus II specific registers [ 361.007839][ T5905] pegasus 2-1:0.0: can't locate MII phy, using default [ 361.092699][ T5905] pegasus 2-1:0.0: eth5, ELECOM USB Ethernet LD-USB20, d2:c4:0d:62:ac:c7 [ 361.108689][ T5905] usb 2-1: USB disconnect, device number 75 [ 361.265315][ T3083] usb 1-1: new full-speed USB device number 71 using dummy_hcd [ 361.440627][ T3083] usb 1-1: unable to get BOS descriptor or descriptor too short [ 361.456856][ T3083] usb 1-1: not running at top speed; connect to a high speed hub [ 361.474897][ T3083] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 361.483679][ T3083] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 361.494744][ T3083] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 361.514617][ T3083] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 361.523970][ T3083] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.533102][ T3083] usb 1-1: SerialNumber: syz [ 361.585560][ T5905] IPVS: starting estimator thread 0... [ 361.705800][T13465] IPVS: using max 27 ests per chain, 64800 per kthread [ 361.797116][ T3083] usb 1-1: 0:2 : does not exist [ 361.822648][ T3083] usb 1-1: USB disconnect, device number 71 [ 361.859821][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 361.944010][T13470] [ 361.971845][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 361.984115][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 361.993147][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 362.001753][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 362.009757][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 362.201527][T13472] chnl_net:caif_netlink_parms(): no params data found [ 362.293522][T13472] bridge0: port 1(bridge_slave_0) entered blocking state [ 362.300830][T13472] bridge0: port 1(bridge_slave_0) entered disabled state [ 362.308178][T13472] bridge_slave_0: entered allmulticast mode [ 362.316214][T13472] bridge_slave_0: entered promiscuous mode [ 362.326594][T13472] bridge0: port 2(bridge_slave_1) entered blocking state [ 362.336532][T13472] bridge0: port 2(bridge_slave_1) entered disabled state [ 362.343766][T13472] bridge_slave_1: entered allmulticast mode [ 362.353634][T13472] bridge_slave_1: entered promiscuous mode [ 362.414273][T13472] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 362.433180][T13472] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 362.492260][T13472] team0: Port device team_slave_0 added [ 362.502431][T13472] team0: Port device team_slave_1 added [ 362.548293][T13483] tipc: Enabling of bearer rejected, failed to enable media [ 362.558226][T13472] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 362.568820][T13472] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 362.606374][T13472] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 362.619754][T13472] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 362.627094][T13472] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 362.660986][T13472] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 362.781005][T13487] binder: 13484:13487 ioctl c0306201 0 returned -14 [ 362.789705][T13472] hsr_slave_0: entered promiscuous mode [ 362.801568][T13472] hsr_slave_1: entered promiscuous mode [ 362.809425][T13472] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 362.819744][T13472] Cannot create hsr debugfs directory [ 362.872904][T13489] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2646'. [ 362.985961][ T5905] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 363.082606][T13472] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 363.102905][T13472] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 363.114653][T13472] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 363.127804][T13472] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 363.157686][ T5905] usb 2-1: config 0 has an invalid interface number: 25 but max is 0 [ 363.175696][ T5905] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 363.197320][ T5905] usb 2-1: config 0 has no interface number 0 [ 363.203525][ T5905] usb 2-1: config 0 interface 25 altsetting 205 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 363.221309][ T5905] usb 2-1: config 0 interface 25 has no altsetting 0 [ 363.241838][ T5905] usb 2-1: New USB device found, idVendor=1b3b, idProduct=2951, bcdDevice=9e.ee [ 363.265294][ T5905] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.273332][ T5905] usb 2-1: Product: syz [ 363.279540][ T5905] usb 2-1: Manufacturer: syz [ 363.284204][ T5905] usb 2-1: SerialNumber: syz [ 363.293631][ T5905] usb 2-1: config 0 descriptor?? [ 363.352635][T13472] 8021q: adding VLAN 0 to HW filter on device bond0 [ 363.379539][T13472] 8021q: adding VLAN 0 to HW filter on device team0 [ 363.393768][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 363.400967][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 363.418655][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 363.426054][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 363.438265][ T5904] usb 1-1: new full-speed USB device number 72 using dummy_hcd [ 363.510043][T13486] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 363.522835][T13486] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 363.532814][ T5905] usb 2-1: Found UVC 0.00 device syz (1b3b:2951) [ 363.545793][ T5905] usb 2-1: No valid video chain found. [ 363.567221][ T5905] usb 2-1: USB disconnect, device number 76 [ 363.612016][ T5904] usb 1-1: unable to get BOS descriptor or descriptor too short [ 363.622407][ T5904] usb 1-1: not running at top speed; connect to a high speed hub [ 363.633019][ T5904] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 363.644526][ T5904] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 363.656863][ T5904] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 363.679964][ T5904] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 363.693238][ T5904] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.702622][ T5904] usb 1-1: SerialNumber: syz [ 363.772636][T13472] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 363.982413][ T5904] usb 1-1: 0:2 : does not exist [ 364.092976][T13516] /dev/rnullb0: Can't lookup blockdev [ 364.098550][ T5904] usb 1-1: USB disconnect, device number 72 [ 364.111840][ T5838] Bluetooth: hci2: command tx timeout [ 364.170288][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 364.251069][T13518] netlink: 'syz.1.2651': attribute type 1 has an invalid length. [ 364.261937][T13472] veth0_vlan: entered promiscuous mode [ 364.291860][T13472] veth1_vlan: entered promiscuous mode [ 364.389379][T13472] veth0_macvtap: entered promiscuous mode [ 364.404535][T13472] veth1_macvtap: entered promiscuous mode [ 364.443118][T13472] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 364.474463][T13472] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 364.500703][ T153] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 364.539763][ T153] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 364.574483][ T153] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 364.609516][T13526] binder: 13525:13526 ioctl c0306201 0 returned -14 [ 364.646529][ T153] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 364.805060][ T153] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 364.829714][ T153] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 364.894843][ T1002] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 364.903539][ T1002] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 364.942757][T13538] syz.1.2658: attempt to access beyond end of device [ 364.942757][T13538] nbd1: rw=0, sector=2, nr_sectors = 2 limit=0 [ 364.962260][T13538] vxfs: unable to read disk superblock at 1 [ 364.994686][T13538] syz.1.2658: attempt to access beyond end of device [ 364.994686][T13538] nbd1: rw=0, sector=16, nr_sectors = 2 limit=0 [ 365.036371][ T3083] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 365.063354][T13538] vxfs: unable to read disk superblock at 8 [ 365.085516][T13538] vxfs: can't find superblock. [ 365.208896][ T3083] usb 1-1: device descriptor read/64, error -71 [ 365.475631][ T3083] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 365.491596][T13557] FAULT_INJECTION: forcing a failure. [ 365.491596][T13557] name failslab, interval 1, probability 0, space 0, times 0 [ 365.505891][T13557] CPU: 1 UID: 0 PID: 13557 Comm: syz.4.2664 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 365.505921][T13557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 365.505934][T13557] Call Trace: [ 365.505942][T13557] [ 365.505951][T13557] dump_stack_lvl+0x189/0x250 [ 365.505979][T13557] ? __pfx____ratelimit+0x10/0x10 [ 365.506005][T13557] ? __pfx_dump_stack_lvl+0x10/0x10 [ 365.506028][T13557] ? __pfx__printk+0x10/0x10 [ 365.506054][T13557] ? __pfx___might_resched+0x10/0x10 [ 365.506074][T13557] ? fs_reclaim_acquire+0x7d/0x100 [ 365.506106][T13557] should_fail_ex+0x414/0x560 [ 365.506142][T13557] ? __nf_hook_entries_try_shrink+0x316/0x6e0 [ 365.506169][T13557] should_failslab+0xa8/0x100 [ 365.506195][T13557] __kvmalloc_node_noprof+0x161/0x5f0 [ 365.506220][T13557] ? __nf_hook_entries_try_shrink+0x316/0x6e0 [ 365.506252][T13557] __nf_hook_entries_try_shrink+0x316/0x6e0 [ 365.506292][T13557] __nf_unregister_net_hook+0x4f6/0x700 [ 365.506329][T13557] nf_unregister_net_hooks+0xcb/0x140 [ 365.506360][T13557] ip_vs_unregister_hooks+0xbc/0x120 [ 365.506390][T13557] ip_vs_unlink_service+0x40d/0xa30 [ 365.506433][T13557] ip_vs_flush+0x169/0x1c0 [ 365.506465][T13557] do_ip_vs_set_ctl+0x470/0xa60 [ 365.506491][T13557] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 365.506508][T13557] ? rcu_is_watching+0x15/0xb0 [ 365.506547][T13557] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 365.506582][T13557] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 365.506607][T13557] ? aa_sk_perm+0x81e/0x950 [ 365.506633][T13557] ? __pfx_aa_sk_perm+0x10/0x10 [ 365.506670][T13557] nf_setsockopt+0x26c/0x290 [ 365.506703][T13557] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 365.506732][T13557] do_sock_setsockopt+0x25a/0x3e0 [ 365.506766][T13557] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 365.506802][T13557] ? __fget_files+0x2a/0x420 [ 365.506841][T13557] __x64_sys_setsockopt+0x18b/0x220 [ 365.506879][T13557] do_syscall_64+0xfa/0x3b0 [ 365.506904][T13557] ? lockdep_hardirqs_on+0x9c/0x150 [ 365.506928][T13557] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.506949][T13557] ? clear_bhb_loop+0x60/0xb0 [ 365.506974][T13557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.506994][T13557] RIP: 0033:0x7fb6bfb8e929 [ 365.507012][T13557] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 365.507030][T13557] RSP: 002b:00007fb6c0a86038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 365.507051][T13557] RAX: ffffffffffffffda RBX: 00007fb6bfdb5fa0 RCX: 00007fb6bfb8e929 [ 365.507067][T13557] RDX: 0000000000000485 RSI: 0000000000000000 RDI: 0000000000000003 [ 365.507079][T13557] RBP: 00007fb6c0a86090 R08: 0000000000000000 R09: 0000000000000000 [ 365.507092][T13557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 365.507104][T13557] R13: 0000000000000000 R14: 00007fb6bfdb5fa0 R15: 00007ffdecb9d368 [ 365.507137][T13557] [ 365.859132][T13559] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2665'. [ 365.906128][ T24] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 365.915307][ T3083] usb 1-1: device descriptor read/64, error -71 [ 365.955718][ T5834] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 366.036403][ T3083] usb usb1-port1: attempt power cycle [ 366.077491][ T24] usb 6-1: unable to get BOS descriptor or descriptor too short [ 366.086459][ T24] usb 6-1: not running at top speed; connect to a high speed hub [ 366.095524][ T24] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 366.104763][ T24] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 366.118426][ T24] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 366.138431][ T24] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 366.148356][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.157065][ T24] usb 6-1: SerialNumber: syz [ 366.162908][ T5834] usb 2-1: config 6 has an invalid interface number: 223 but max is 1 [ 366.171193][ T5834] usb 2-1: config 6 has an invalid interface number: 168 but max is 1 [ 366.181003][ T5834] usb 2-1: config 6 has no interface number 0 [ 366.191741][ T5838] Bluetooth: hci2: command tx timeout [ 366.210696][ T5834] usb 2-1: config 6 has no interface number 1 [ 366.217206][ T5834] usb 2-1: config 6 interface 223 has no altsetting 0 [ 366.225319][ T5834] usb 2-1: config 6 interface 168 has no altsetting 0 [ 366.234871][ T5834] usb 2-1: New USB device found, idVendor=04c8, idProduct=0720, bcdDevice=93.a4 [ 366.244174][ T5834] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.252273][ T5834] usb 2-1: Product: syz [ 366.257198][ T5834] usb 2-1: Manufacturer: syz [ 366.261860][ T5834] usb 2-1: SerialNumber: syz [ 366.385533][ T3083] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 366.407899][ T3083] usb 1-1: device descriptor read/8, error -71 [ 366.438443][ T24] usb 6-1: 0:2 : does not exist [ 366.480430][T13546] /dev/rnullb0: Can't lookup blockdev [ 366.481666][ T24] usb 6-1: USB disconnect, device number 2 [ 366.521531][ T5834] usb 2-1: USB disconnect, device number 77 [ 366.686029][ T3083] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 366.716687][ T3083] usb 1-1: device descriptor read/8, error -71 [ 366.827019][ T3083] usb usb1-port1: unable to enumerate USB device [ 367.116967][ T30] audit: type=1804 audit(1751303789.114:24): pid=13585 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.2676" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=3051 res=1 errno=0 [ 367.347001][T13592] /dev/rnullb0: Can't lookup blockdev [ 367.916936][ T24] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 368.091718][ T24] usb 6-1: unable to get BOS descriptor or descriptor too short [ 368.104134][ T24] usb 6-1: not running at top speed; connect to a high speed hub [ 368.121040][ T24] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 368.140191][ T24] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 368.163789][ T24] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 368.210892][ T24] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 368.220288][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.243940][ T24] usb 6-1: SerialNumber: syz [ 368.273225][ T51] Bluetooth: hci2: command tx timeout [ 368.293930][T13630] MTD: Couldn't look up '/dev/rnullb0': -15 [ 368.488666][ T24] usb 6-1: 0:2 : does not exist [ 368.505580][ T24] usb 6-1: USB disconnect, device number 3 [ 368.706196][ T5905] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 368.848553][ T5905] usb 2-1: device descriptor read/64, error -71 [ 369.085844][ T5905] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 369.216113][ T5905] usb 2-1: device descriptor read/64, error -71 [ 369.326563][ T5905] usb usb2-port1: attempt power cycle [ 369.481934][T13657] /dev/rnullb0: Can't lookup blockdev [ 369.596189][ T10] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 369.676106][ T5905] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 369.696991][ T5905] usb 2-1: device descriptor read/8, error -71 [ 369.756028][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 369.765405][ T10] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 369.776519][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 369.784560][ T10] usb 6-1: Product: syz [ 369.789503][ T10] usb 6-1: Manufacturer: syz [ 369.794156][ T10] usb 6-1: SerialNumber: syz [ 369.806047][ T10] usb 6-1: config 0 descriptor?? [ 369.835977][T12261] usb 1-1: new full-speed USB device number 77 using dummy_hcd [ 369.919624][T13664] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2707'. [ 369.936157][ T5905] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 369.956592][ T5905] usb 2-1: device descriptor read/8, error -71 [ 369.999589][T12261] usb 1-1: unable to get BOS descriptor or descriptor too short [ 370.010052][T12261] usb 1-1: not running at top speed; connect to a high speed hub [ 370.021024][ T10] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 370.031644][T12261] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 370.042349][T12261] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 370.053852][T12261] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 370.066226][ T5905] usb usb2-port1: unable to enumerate USB device [ 370.097731][T12261] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 370.108567][T12261] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 370.119183][T12261] usb 1-1: SerialNumber: syz [ 370.348948][ T51] Bluetooth: hci2: command tx timeout [ 370.382867][T12261] usb 1-1: 0:2 : does not exist [ 370.428859][T13672] FAULT_INJECTION: forcing a failure. [ 370.428859][T13672] name failslab, interval 1, probability 0, space 0, times 0 [ 370.443953][T12261] usb 1-1: USB disconnect, device number 77 [ 370.444975][T13672] CPU: 1 UID: 0 PID: 13672 Comm: syz.4.2711 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 370.445007][T13672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 370.445028][T13672] Call Trace: [ 370.445038][T13672] [ 370.445048][T13672] dump_stack_lvl+0x189/0x250 [ 370.445082][T13672] ? __pfx____ratelimit+0x10/0x10 [ 370.445111][T13672] ? __pfx_dump_stack_lvl+0x10/0x10 [ 370.445138][T13672] ? __pfx__printk+0x10/0x10 [ 370.445170][T13672] ? __pfx___might_resched+0x10/0x10 [ 370.445207][T13672] ? fs_reclaim_acquire+0x7d/0x100 [ 370.445243][T13672] should_fail_ex+0x414/0x560 [ 370.445285][T13672] should_failslab+0xa8/0x100 [ 370.445315][T13672] __kmalloc_noprof+0xcb/0x4f0 [ 370.445340][T13672] ? kernfs_fop_write_iter+0x158/0x4f0 [ 370.445372][T13672] kernfs_fop_write_iter+0x158/0x4f0 [ 370.445408][T13672] vfs_write+0x548/0xa90 [ 370.445441][T13672] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 370.445470][T13672] ? __pfx_vfs_write+0x10/0x10 [ 370.445511][T13672] ? __fget_files+0x2a/0x420 [ 370.445555][T13672] ksys_write+0x145/0x250 [ 370.445585][T13672] ? __pfx_ksys_write+0x10/0x10 [ 370.445609][T13672] ? rcu_is_watching+0x15/0xb0 [ 370.445639][T13672] ? do_syscall_64+0xbe/0x3b0 [ 370.445674][T13672] do_syscall_64+0xfa/0x3b0 [ 370.445701][T13672] ? lockdep_hardirqs_on+0x9c/0x150 [ 370.445728][T13672] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.445750][T13672] ? clear_bhb_loop+0x60/0xb0 [ 370.445778][T13672] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.445807][T13672] RIP: 0033:0x7fb6bfb8e929 [ 370.445834][T13672] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 370.445854][T13672] RSP: 002b:00007fb6c0a86038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 370.445878][T13672] RAX: ffffffffffffffda RBX: 00007fb6bfdb5fa0 RCX: 00007fb6bfb8e929 [ 370.445895][T13672] RDX: 000000000000001f RSI: 0000200000000980 RDI: 0000000000000005 [ 370.445909][T13672] RBP: 00007fb6c0a86090 R08: 0000000000000000 R09: 0000000000000000 [ 370.445924][T13672] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 370.445936][T13672] R13: 0000000000000000 R14: 00007fb6bfdb5fa0 R15: 00007ffdecb9d368 [ 370.445972][T13672] [ 370.916653][ T10] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 370.926185][T13678] input: syz1 as /devices/virtual/input/input16 [ 370.945035][ T10] dvbdev: DVB: registering new adapter (TerraTec NOXON DAB Stick) [ 370.954949][ T10] usb 6-1: media controller created [ 371.015781][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 371.162366][ T10] i2c i2c-1: Added multiplexed i2c bus 2 [ 371.176829][ T10] rtl2830 1-0010: Realtek RTL2830 successfully attached [ 371.192027][ T10] usb 6-1: DVB: registering adapter 1 frontend 0 (Realtek RTL2830 (DVB-T))... [ 371.211658][ T10] dvbdev: dvb_create_media_entity: media entity 'Realtek RTL2830 (DVB-T)' registered. [ 371.271585][ T10] DVB: Unable to find symbol mxl5005s_attach() [ 371.590536][T13703] binder: 13702:13703 ioctl c0306201 0 returned -14 [ 371.906186][ T24] usb 2-1: new full-speed USB device number 82 using dummy_hcd [ 371.965172][T13717] FAULT_INJECTION: forcing a failure. [ 371.965172][T13717] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 372.004250][T13717] CPU: 1 UID: 0 PID: 13717 Comm: syz.0.2725 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 372.004303][T13717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 372.004316][T13717] Call Trace: [ 372.004323][T13717] [ 372.004332][T13717] dump_stack_lvl+0x189/0x250 [ 372.004360][T13717] ? __pfx____ratelimit+0x10/0x10 [ 372.004385][T13717] ? __pfx_dump_stack_lvl+0x10/0x10 [ 372.004407][T13717] ? __pfx__printk+0x10/0x10 [ 372.004443][T13717] should_fail_ex+0x414/0x560 [ 372.004478][T13717] _copy_to_user+0x31/0xb0 [ 372.004498][T13717] simple_read_from_buffer+0xe1/0x170 [ 372.004529][T13717] proc_fail_nth_read+0x1df/0x250 [ 372.004561][T13717] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 372.004594][T13717] ? rw_verify_area+0x258/0x650 [ 372.004615][T13717] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 372.004647][T13717] vfs_read+0x1fd/0x980 [ 372.004674][T13717] ? __pfx___mutex_lock+0x10/0x10 [ 372.004701][T13717] ? __pfx_vfs_read+0x10/0x10 [ 372.004725][T13717] ? __fget_files+0x2a/0x420 [ 372.004757][T13717] ? __fget_files+0x3a0/0x420 [ 372.004783][T13717] ? __fget_files+0x2a/0x420 [ 372.004819][T13717] ksys_read+0x145/0x250 [ 372.004845][T13717] ? __pfx_ksys_read+0x10/0x10 [ 372.004874][T13717] ? do_syscall_64+0xbe/0x3b0 [ 372.004903][T13717] do_syscall_64+0xfa/0x3b0 [ 372.004927][T13717] ? lockdep_hardirqs_on+0x9c/0x150 [ 372.004950][T13717] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.004970][T13717] ? clear_bhb_loop+0x60/0xb0 [ 372.004994][T13717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.005013][T13717] RIP: 0033:0x7f74ce58d33c [ 372.005031][T13717] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 372.005048][T13717] RSP: 002b:00007f74cf330030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 372.005068][T13717] RAX: ffffffffffffffda RBX: 00007f74ce7b5fa0 RCX: 00007f74ce58d33c [ 372.005083][T13717] RDX: 000000000000000f RSI: 00007f74cf3300a0 RDI: 0000000000000003 [ 372.005095][T13717] RBP: 00007f74cf330090 R08: 0000000000000000 R09: 0000000000000000 [ 372.005107][T13717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 372.005118][T13717] R13: 0000000000000001 R14: 00007f74ce7b5fa0 R15: 00007ffd5987aa08 [ 372.005149][T13717] [ 372.330274][T12261] usb 6-1: USB disconnect, device number 4 [ 372.331925][ T24] usb 2-1: unable to get BOS descriptor or descriptor too short [ 372.351000][ T24] usb 2-1: not running at top speed; connect to a high speed hub [ 372.361790][ T24] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 372.372365][ T24] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 372.382562][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 372.400811][ T24] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 372.410103][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.418181][ T24] usb 2-1: SerialNumber: syz [ 372.446622][T13721] /dev/rnullb0: Can't lookup blockdev [ 372.502374][T13723] FAULT_INJECTION: forcing a failure. [ 372.502374][T13723] name failslab, interval 1, probability 0, space 0, times 0 [ 372.517509][T13723] CPU: 0 UID: 0 PID: 13723 Comm: syz.0.2728 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 372.517539][T13723] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 372.517551][T13723] Call Trace: [ 372.517559][T13723] [ 372.517568][T13723] dump_stack_lvl+0x189/0x250 [ 372.517597][T13723] ? __pfx____ratelimit+0x10/0x10 [ 372.517623][T13723] ? __pfx_dump_stack_lvl+0x10/0x10 [ 372.517647][T13723] ? __pfx__printk+0x10/0x10 [ 372.517673][T13723] ? __pfx___might_resched+0x10/0x10 [ 372.517694][T13723] ? fs_reclaim_acquire+0x7d/0x100 [ 372.517727][T13723] should_fail_ex+0x414/0x560 [ 372.517762][T13723] ? __nf_hook_entries_try_shrink+0x316/0x6e0 [ 372.517789][T13723] should_failslab+0xa8/0x100 [ 372.517816][T13723] __kvmalloc_node_noprof+0x161/0x5f0 [ 372.517841][T13723] ? __nf_hook_entries_try_shrink+0x316/0x6e0 [ 372.517875][T13723] __nf_hook_entries_try_shrink+0x316/0x6e0 [ 372.517915][T13723] __nf_unregister_net_hook+0x4f6/0x700 [ 372.517953][T13723] nf_unregister_net_hooks+0xcb/0x140 [ 372.517984][T13723] ip_vs_unregister_hooks+0xbc/0x120 [ 372.518032][T13723] ip_vs_unlink_service+0x40d/0xa30 [ 372.518075][T13723] ip_vs_flush+0x169/0x1c0 [ 372.518107][T13723] do_ip_vs_set_ctl+0x470/0xa60 [ 372.518133][T13723] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 372.518150][T13723] ? rcu_is_watching+0x15/0xb0 [ 372.518187][T13723] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 372.518220][T13723] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 372.518245][T13723] ? aa_sk_perm+0x81e/0x950 [ 372.518270][T13723] ? __pfx_aa_sk_perm+0x10/0x10 [ 372.518298][T13723] nf_setsockopt+0x26c/0x290 [ 372.518329][T13723] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 372.518356][T13723] do_sock_setsockopt+0x25a/0x3e0 [ 372.518387][T13723] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 372.518421][T13723] ? __fget_files+0x2a/0x420 [ 372.518457][T13723] __x64_sys_setsockopt+0x18b/0x220 [ 372.518493][T13723] do_syscall_64+0xfa/0x3b0 [ 372.518520][T13723] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.518539][T13723] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 372.518558][T13723] ? clear_bhb_loop+0x60/0xb0 [ 372.518582][T13723] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.518601][T13723] RIP: 0033:0x7f74ce58e929 [ 372.518619][T13723] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 372.518636][T13723] RSP: 002b:00007f74cf330038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 372.518658][T13723] RAX: ffffffffffffffda RBX: 00007f74ce7b5fa0 RCX: 00007f74ce58e929 [ 372.518673][T13723] RDX: 0000000000000485 RSI: 0000000000000000 RDI: 0000000000000003 [ 372.518685][T13723] RBP: 00007f74cf330090 R08: 0000000000000000 R09: 0000000000000000 [ 372.518697][T13723] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 372.518707][T13723] R13: 0000000000000000 R14: 00007f74ce7b5fa0 R15: 00007ffd5987aa08 [ 372.518738][T13723] [ 372.841831][ T24] usb 2-1: 0:2 : does not exist [ 372.879940][ T24] usb 2-1: USB disconnect, device number 82 [ 372.900765][T13725] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2729'. [ 373.182158][T13729] binder: 13728:13729 ioctl c0306201 0 returned -14 [ 373.206424][ T5905] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 373.253557][T13731] MTD: Couldn't look up '/dev/rnullb0': -15 [ 373.361266][ T5905] usb 1-1: device descriptor read/64, error -71 [ 373.443562][T13738] /dev/rnullb0: Can't lookup blockdev [ 373.454225][T13739] /dev/rnullb0: Can't lookup blockdev [ 373.606877][ T5905] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 373.766327][ T5905] usb 1-1: device descriptor read/64, error -71 [ 373.794315][T13750] binder: 13749:13750 ioctl c0306201 0 returned -14 [ 373.876675][ T5905] usb usb1-port1: attempt power cycle [ 374.029410][ T5891] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 374.047339][ T5891] dvb_usb_az6027 5-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 374.059778][ T5891] usb 5-1: USB disconnect, device number 43 [ 374.257053][ T5905] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 374.308494][T13768] /dev/rnullb0: Can't lookup blockdev [ 374.313626][ T5905] usb 1-1: device descriptor read/8, error -71 [ 374.406616][ T10] usb 2-1: new full-speed USB device number 83 using dummy_hcd [ 374.427864][ T5891] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 374.576808][ T5905] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 374.597552][ T5891] usb 5-1: Using ep0 maxpacket: 16 [ 374.605025][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 374.614476][ T5905] usb 1-1: device descriptor read/8, error -71 [ 374.627439][ T5891] usb 5-1: config 1 interface 0 altsetting 11 bulk endpoint 0x1 has invalid maxpacket 1024 [ 374.645430][ T5891] usb 5-1: config 1 interface 0 altsetting 11 bulk endpoint 0x82 has invalid maxpacket 32 [ 374.655769][ T10] usb 2-1: not running at top speed; connect to a high speed hub [ 374.667995][ T5891] usb 5-1: config 1 interface 0 has no altsetting 0 [ 374.676557][ T10] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 374.686718][ T10] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 374.698413][ T5891] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 374.708456][ T10] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 374.717422][ T5891] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.756773][ T5905] usb usb1-port1: unable to enumerate USB device [ 374.782413][ T5891] usb 5-1: Product: ࿫戆迠둶䟞劏䈜뻴폟뀔ἒ瀊樱眶㢌ⲳ튪ꪃ㵽㞳ꅤ쀚੮⭷涍鉖哹邱츏ᚅ䘀좮ᷙ䕭ኄꐫ轆ꗐ醹㫹뮾ꬁﲈ悔죃⿹ጕূ쯲㔔慢ᠢ帮䳖ૣ૤㆐땢푸ᦡ㓾瞘ェ뉫ꐭ￳ở퍳쌥柦빩ꡫ癍 [ 374.879540][ T10] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 374.890692][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.909815][ T5891] usb 5-1: Manufacturer: 㰊 [ 374.914544][ T5891] usb 5-1: SerialNumber: 㰊 [ 374.921984][ T10] usb 2-1: SerialNumber: syz [ 374.932360][ T5891] usb 5-1: can't set config #1, error -71 [ 374.956551][ T5891] usb 5-1: USB disconnect, device number 44 [ 375.003460][ T24] IPVS: starting estimator thread 0... [ 375.092237][ T30] audit: type=1800 audit(1751303797.093:25): pid=13790 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2756" name="SYSV00000000" dev="hugetlbfs" ino=1 res=0 errno=0 [ 375.123147][T13790] cgroup: Invalid name [ 375.136817][T13787] IPVS: using max 26 ests per chain, 62400 per kthread [ 375.167010][ T10] usb 2-1: 0:2 : does not exist [ 375.186678][ T10] usb 2-1: USB disconnect, device number 83 [ 375.220195][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 375.307503][ T24] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 375.469189][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 375.486461][ T24] usb 6-1: New USB device found, idVendor=11c0, idProduct=5506, bcdDevice= 0.00 [ 375.505975][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 375.530485][ T24] usb 6-1: config 0 descriptor?? [ 375.984415][ T24] betop 0003:11C0:5506.000A: collection stack underflow [ 376.031226][ T24] betop 0003:11C0:5506.000A: item 0 4 0 12 parsing failed [ 376.049998][ T24] betop 0003:11C0:5506.000A: parse failed [ 376.072207][ T24] betop 0003:11C0:5506.000A: probe with driver betop failed with error -22 [ 376.113755][ T8118] bond0: (slave syz_tun): Releasing backup interface [ 376.124406][ T5838] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 376.134794][ T5838] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 376.144945][ T5838] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 376.158739][ T5838] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 376.169758][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 376.190984][ T10] usb 6-1: USB disconnect, device number 5 [ 376.267293][ T5891] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 376.294984][ T1161] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.403275][ T1161] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.436750][ T5891] usb 2-1: Using ep0 maxpacket: 16 [ 376.451609][ T5891] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 376.475388][ T5891] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 376.494188][ T5891] usb 2-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice=7a.5a [ 376.503841][ T5891] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.513148][ T5891] usb 2-1: Product: syz [ 376.515406][ T1161] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.522914][ T5891] usb 2-1: Manufacturer: syz [ 376.532366][ T5891] usb 2-1: SerialNumber: syz [ 376.544317][ T5891] usb 2-1: config 0 descriptor?? [ 376.620750][ T1161] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.753390][T13798] chnl_net:caif_netlink_parms(): no params data found [ 376.926912][ T1161] bridge_slave_1: left allmulticast mode [ 376.946710][ T1161] bridge_slave_1: left promiscuous mode [ 376.954051][T13809] /dev/rnullb0: Can't lookup blockdev [ 376.960667][ T1161] bridge0: port 2(bridge_slave_1) entered disabled state [ 377.001437][ T1161] bridge_slave_0: left allmulticast mode [ 377.007300][ T1161] bridge_slave_0: left promiscuous mode [ 377.016634][ T1161] bridge0: port 1(bridge_slave_0) entered disabled state [ 377.182405][ T5891] input: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input17 [ 377.214978][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.222467][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.231517][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.242038][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.249852][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.257436][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.264998][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.272596][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.282784][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.290720][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.298088][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.305437][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.312880][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.320228][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.327706][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.335523][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.342938][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.350288][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.357662][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.365019][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.372364][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.379843][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.380107][ T5189] usb 2-1: control msg error: -71 [ 377.388061][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.388791][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.408074][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.415493][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.422811][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.430197][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.437550][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.444917][ C0] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.452136][ C0] usb 2-1: pegasus_irq - usb_submit_urb failed with result -1 [ 377.479626][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.488099][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.495785][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.497360][ T5189] usb 2-1: control msg error: -71 [ 377.513826][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.526645][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 377.531713][ T5891] usb 2-1: USB disconnect, device number 84 [ 377.533810][ C1] usb 2-1: pegasus_irq - usb_submit_urb failed with result -19 [ 377.896785][ T10] usb 1-1: new full-speed USB device number 82 using dummy_hcd [ 378.016260][ T1161] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 378.034935][ T1161] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 378.045353][ T1161] bond0 (unregistering): Released all slaves [ 378.054283][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 378.063229][ T10] usb 1-1: not running at top speed; connect to a high speed hub [ 378.067091][ T5834] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 378.083908][ T10] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 378.093576][ T10] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 378.114205][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 378.132519][ T10] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 378.145886][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.154529][ T10] usb 1-1: SerialNumber: syz [ 378.267560][ T51] Bluetooth: hci0: command tx timeout [ 378.289583][ T5834] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 378.341565][ T5834] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 378.399334][ T10] usb 1-1: 0:2 : does not exist [ 378.402288][ T5834] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 378.432228][ T5834] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 378.467158][ T10] usb 1-1: USB disconnect, device number 82 [ 378.484790][ T5834] usb 2-1: SerialNumber: syz [ 378.567179][T13835] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2770'. [ 378.660081][T13798] bridge0: port 1(bridge_slave_0) entered blocking state [ 378.698113][T13798] bridge0: port 1(bridge_slave_0) entered disabled state [ 378.716056][T13798] bridge_slave_0: entered allmulticast mode [ 378.734493][ T5834] usb 2-1: skipping empty audio interface (v1) [ 378.744699][T13798] bridge_slave_0: entered promiscuous mode [ 378.808964][ T5834] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 378.857989][ T5834] usb 2-1: USB disconnect, device number 85 [ 378.906126][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 378.937139][T13798] bridge0: port 2(bridge_slave_1) entered blocking state [ 378.956914][T13798] bridge0: port 2(bridge_slave_1) entered disabled state [ 378.964202][T13798] bridge_slave_1: entered allmulticast mode [ 378.970921][T13844] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2772'. [ 378.998150][T13798] bridge_slave_1: entered promiscuous mode [ 379.154956][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.197102][T13850] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2774'. [ 379.267603][ T1161] hsr_slave_0: left promiscuous mode [ 379.309999][ T1161] hsr_slave_1: left promiscuous mode [ 379.316113][ T1161] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 379.351340][ T1161] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 379.380480][T13855] /dev/rnullb0: Can't lookup blockdev [ 379.397710][T13858] FAULT_INJECTION: forcing a failure. [ 379.397710][T13858] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 379.417302][ T1161] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 379.433856][ T1161] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 379.437556][T13860] MTD: Couldn't look up '/dev/rnullb0': -15 [ 379.442468][T13858] CPU: 0 UID: 0 PID: 13858 Comm: syz.1.2776 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 379.442500][T13858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 379.442516][T13858] Call Trace: [ 379.442527][T13858] [ 379.442537][T13858] dump_stack_lvl+0x189/0x250 [ 379.442571][T13858] ? __pfx____ratelimit+0x10/0x10 [ 379.442612][T13858] ? __pfx_dump_stack_lvl+0x10/0x10 [ 379.442638][T13858] ? __pfx__printk+0x10/0x10 [ 379.442681][T13858] ? __might_fault+0xb0/0x130 [ 379.442722][T13858] should_fail_ex+0x414/0x560 [ 379.442763][T13858] _copy_from_iter+0x1db/0x16f0 [ 379.442813][T13858] ? __pfx__copy_from_iter+0x10/0x10 [ 379.442849][T13858] ? rcu_is_watching+0x15/0xb0 [ 379.442871][T13858] ? trace_kmalloc+0x1f/0xd0 [ 379.442896][T13858] ? kernfs_fop_write_iter+0x158/0x4f0 [ 379.442928][T13858] kernfs_fop_write_iter+0x19f/0x4f0 [ 379.442964][T13858] vfs_write+0x548/0xa90 [ 379.442999][T13858] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 379.443028][T13858] ? __pfx_vfs_write+0x10/0x10 [ 379.443069][T13858] ? __fget_files+0x2a/0x420 [ 379.443112][T13858] ksys_write+0x145/0x250 [ 379.443143][T13858] ? __pfx_ksys_write+0x10/0x10 [ 379.443167][T13858] ? rcu_is_watching+0x15/0xb0 [ 379.443196][T13858] ? do_syscall_64+0xbe/0x3b0 [ 379.443229][T13858] do_syscall_64+0xfa/0x3b0 [ 379.443258][T13858] ? lockdep_hardirqs_on+0x9c/0x150 [ 379.443285][T13858] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.443307][T13858] ? clear_bhb_loop+0x60/0xb0 [ 379.443344][T13858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.443366][T13858] RIP: 0033:0x7f4d10f8e929 [ 379.443387][T13858] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 379.443406][T13858] RSP: 002b:00007f4d11ea8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 379.443436][T13858] RAX: ffffffffffffffda RBX: 00007f4d111b5fa0 RCX: 00007f4d10f8e929 [ 379.443453][T13858] RDX: 000000000000001f RSI: 0000200000000980 RDI: 0000000000000005 [ 379.443475][T13858] RBP: 00007f4d11ea8090 R08: 0000000000000000 R09: 0000000000000000 [ 379.443491][T13858] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 379.443503][T13858] R13: 0000000000000000 R14: 00007f4d111b5fa0 R15: 00007ffec1b393d8 [ 379.443539][T13858] [ 379.679383][T13860] /dev/rnullb0: Can't lookup blockdev [ 379.733609][ T1161] veth1_macvtap: left promiscuous mode [ 379.751986][ T1161] veth0_macvtap: left promiscuous mode [ 379.759185][ T1161] veth1_vlan: left promiscuous mode [ 379.764551][ T1161] veth0_vlan: left promiscuous mode [ 379.871504][ T9] hid-generic 01FF:0004:0400.000B: unknown main item tag 0x0 [ 379.911047][ T9] hid-generic 01FF:0004:0400.000B: unknown main item tag 0x0 [ 379.932689][ T9] hid-generic 01FF:0004:0400.000B: unknown main item tag 0x0 [ 379.973150][ T9] hid-generic 01FF:0004:0400.000B: unknown main item tag 0x0 [ 379.984786][ T9] hid-generic 01FF:0004:0400.000B: unknown main item tag 0x0 [ 379.993733][ T9] hid-generic 01FF:0004:0400.000B: unknown main item tag 0x0 [ 380.005742][ T9] hid-generic 01FF:0004:0400.000B: unknown main item tag 0x0 [ 380.016659][ T9] hid-generic 01FF:0004:0400.000B: unknown main item tag 0x0 [ 380.029216][ T9] hid-generic 01FF:0004:0400.000B: unknown main item tag 0x0 [ 380.036725][ T9] hid-generic 01FF:0004:0400.000B: unknown main item tag 0x0 [ 380.081011][ T9] hid-generic 01FF:0004:0400.000B: hidraw0: HID v0.05 Device [syz0] on syz1 [ 380.183514][ T5834] usb 6-1: new full-speed USB device number 6 using dummy_hcd [ 380.208122][T13871] fido_id[13871]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 380.347184][ T51] Bluetooth: hci0: command tx timeout [ 380.357615][ T5834] usb 6-1: unable to get BOS descriptor or descriptor too short [ 380.365972][ T5834] usb 6-1: not running at top speed; connect to a high speed hub [ 380.393239][ T5834] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 380.410930][ T5834] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 380.421576][ T5834] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 380.438514][ T5834] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 380.449944][ T5834] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.459077][ T5834] usb 6-1: SerialNumber: syz [ 380.664712][ T1161] team0 (unregistering): Port device team_slave_1 removed [ 380.710567][ T1161] team0 (unregistering): Port device team_slave_0 removed [ 381.212726][T13798] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 381.293329][T13798] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 381.315196][ T5834] usb 6-1: 0:2 : does not exist [ 381.393583][ T5834] usb 6-1: USB disconnect, device number 6 [ 381.481205][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 381.565722][T13798] team0: Port device team_slave_0 added [ 381.590758][T13798] team0: Port device team_slave_1 added [ 381.700205][T13798] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 381.731205][T13798] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 381.764376][T13798] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 381.787729][T13798] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 381.794718][T13798] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 381.836806][T13798] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 381.927555][ T5905] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 382.043707][ T1161] IPVS: stop unused estimator thread 0... [ 382.052539][T13798] hsr_slave_0: entered promiscuous mode [ 382.057493][ T9] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 382.074174][T13798] hsr_slave_1: entered promiscuous mode [ 382.095449][T13798] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 382.099602][ T5905] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 382.103275][T13798] Cannot create hsr debugfs directory [ 382.123637][ T5905] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 382.148508][ T5905] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 382.162481][ T5905] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 382.181466][ T5905] usb 1-1: SerialNumber: syz [ 382.220949][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 382.236751][ T9] usb 2-1: config 0 has an invalid descriptor of length 46, skipping remainder of the config [ 382.260301][ T9] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 382.281793][ T9] usb 2-1: New USB device found, idVendor=10c4, idProduct=00cf, bcdDevice= 0.00 [ 382.327378][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 382.362909][ T9] usb 2-1: config 0 descriptor?? [ 382.419627][ T5905] usb 1-1: skipping empty audio interface (v1) [ 382.431121][ T51] Bluetooth: hci0: command tx timeout [ 382.541018][ T5905] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 382.595455][ T5905] usb 1-1: USB disconnect, device number 83 [ 382.659864][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 382.703410][T13911] FAULT_INJECTION: forcing a failure. [ 382.703410][T13911] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 382.741871][T13911] CPU: 1 UID: 0 PID: 13911 Comm: syz.5.2789 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 382.741902][T13911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 382.741916][T13911] Call Trace: [ 382.741925][T13911] [ 382.741935][T13911] dump_stack_lvl+0x189/0x250 [ 382.741965][T13911] ? __pfx____ratelimit+0x10/0x10 [ 382.741992][T13911] ? __pfx_dump_stack_lvl+0x10/0x10 [ 382.742026][T13911] ? __pfx__printk+0x10/0x10 [ 382.742063][T13911] should_fail_ex+0x414/0x560 [ 382.742101][T13911] _copy_to_user+0x31/0xb0 [ 382.742123][T13911] simple_read_from_buffer+0xe1/0x170 [ 382.742157][T13911] proc_fail_nth_read+0x1df/0x250 [ 382.742191][T13911] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 382.742226][T13911] ? rw_verify_area+0x258/0x650 [ 382.742249][T13911] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 382.742282][T13911] vfs_read+0x1fd/0x980 [ 382.742312][T13911] ? __pfx___mutex_lock+0x10/0x10 [ 382.742340][T13911] ? __pfx_vfs_read+0x10/0x10 [ 382.742365][T13911] ? __fget_files+0x2a/0x420 [ 382.742399][T13911] ? __fget_files+0x3a0/0x420 [ 382.742425][T13911] ? __fget_files+0x2a/0x420 [ 382.742462][T13911] ksys_read+0x145/0x250 [ 382.742482][T13911] ? __fget_files+0x2a/0x420 [ 382.742513][T13911] ? __pfx_ksys_read+0x10/0x10 [ 382.742542][T13911] ? do_syscall_64+0xbe/0x3b0 [ 382.742573][T13911] do_syscall_64+0xfa/0x3b0 [ 382.742596][T13911] ? lockdep_hardirqs_on+0x9c/0x150 [ 382.742620][T13911] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.742640][T13911] ? clear_bhb_loop+0x60/0xb0 [ 382.742666][T13911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.742686][T13911] RIP: 0033:0x7fecfd58d33c [ 382.742704][T13911] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 382.742723][T13911] RSP: 002b:00007fecfe3d7030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 382.742745][T13911] RAX: ffffffffffffffda RBX: 00007fecfd7b5fa0 RCX: 00007fecfd58d33c [ 382.742761][T13911] RDX: 000000000000000f RSI: 00007fecfe3d70a0 RDI: 0000000000000004 [ 382.742774][T13911] RBP: 00007fecfe3d7090 R08: 0000000000000000 R09: 0000000000000000 [ 382.742787][T13911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 382.742799][T13911] R13: 0000000000000000 R14: 00007fecfd7b5fa0 R15: 00007fffacf378f8 [ 382.742831][T13911] [ 383.112172][T13914] netlink: 72 bytes leftover after parsing attributes in process `syz.5.2790'. [ 383.372726][ T9] usb 2-1: USB disconnect, device number 86 [ 383.778436][T13798] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 383.818069][T13798] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 383.837250][ T9] usb 2-1: new full-speed USB device number 87 using dummy_hcd [ 383.862501][T13798] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 383.899932][T13798] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 384.012035][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 384.042654][ T9] usb 2-1: not running at top speed; connect to a high speed hub [ 384.063166][ T9] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 384.083281][ T9] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 384.119711][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 384.178039][ T9] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 384.200064][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 384.223220][ T5905] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 384.233968][ T9] usb 2-1: SerialNumber: syz [ 384.275404][T13798] 8021q: adding VLAN 0 to HW filter on device bond0 [ 384.306217][T13798] 8021q: adding VLAN 0 to HW filter on device team0 [ 384.332871][ T1161] bridge0: port 1(bridge_slave_0) entered blocking state [ 384.340180][ T1161] bridge0: port 1(bridge_slave_0) entered forwarding state [ 384.389068][ T5905] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 384.399495][ T5905] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 384.409428][ T1161] bridge0: port 2(bridge_slave_1) entered blocking state [ 384.411060][ T5905] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 384.416670][ T1161] bridge0: port 2(bridge_slave_1) entered forwarding state [ 384.447073][ T5905] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 384.477056][ T5905] usb 1-1: SerialNumber: syz [ 384.512801][ T51] Bluetooth: hci0: command tx timeout [ 384.591942][ T9] usb 2-1: 0:2 : does not exist [ 384.701781][ T9] usb 2-1: USB disconnect, device number 87 [ 384.734140][ T5905] usb 1-1: skipping empty audio interface (v1) [ 384.838671][ T5905] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 384.886226][ T5905] usb 1-1: USB disconnect, device number 84 [ 384.969043][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 385.321613][T13798] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 385.507349][ T5904] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 385.696724][ T5904] usb 2-1: Using ep0 maxpacket: 16 [ 385.792845][T14000] /dev/rnullb0: Can't lookup blockdev [ 385.822752][ T5904] usb 2-1: unable to get BOS descriptor or descriptor too short [ 385.833427][ T5904] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 385.850648][ T44] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 385.867076][ T5904] usb 2-1: can't read configurations, error -71 [ 386.044227][ T44] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 386.071874][ T44] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 386.098889][ T44] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 386.128676][ T44] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 386.136817][ T44] usb 1-1: SerialNumber: syz [ 386.170179][T13798] veth0_vlan: entered promiscuous mode [ 386.216516][T13798] veth1_vlan: entered promiscuous mode [ 386.294958][T13798] veth0_macvtap: entered promiscuous mode [ 386.308988][T13798] veth1_macvtap: entered promiscuous mode [ 386.376281][T13798] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 386.421010][ T44] usb 1-1: 0:2 : does not exist [ 386.463290][T13798] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 386.510699][ T44] usb 1-1: USB disconnect, device number 85 [ 386.567816][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.612573][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 386.673237][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.699443][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.734576][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.860648][ T1002] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.892809][ T1002] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.965245][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.985330][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 387.067603][ T5904] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 387.236034][ T5904] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 387.260869][T14039] binder: BINDER_SET_CONTEXT_MGR already set [ 387.265573][ T5904] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 387.266984][T14039] binder: 14038:14039 ioctl 4018620d 200000000040 returned -16 [ 387.302330][ T5904] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 387.313031][ T5904] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 387.321747][ T5904] usb 2-1: SerialNumber: syz [ 387.344017][ T51] block nbd5: Receive control failed (result -107) [ 387.549474][ T5904] usb 2-1: 0:2 : does not exist [ 387.617532][ T5834] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 387.627975][ T5904] usb 2-1: USB disconnect, device number 90 [ 387.684657][ T10] IPVS: starting estimator thread 0... [ 387.702086][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 387.809533][T14053] IPVS: using max 24 ests per chain, 57600 per kthread [ 387.820023][ T5834] usb 6-1: config 201 has an invalid interface number: 179 but max is 0 [ 387.828939][ T5834] usb 6-1: config 201 has an invalid descriptor of length 0, skipping remainder of the config [ 387.864377][ T5834] usb 6-1: config 201 has no interface number 0 [ 387.872262][ T5834] usb 6-1: config 201 interface 179 altsetting 154 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 387.897820][ T5834] usb 6-1: config 201 interface 179 has no altsetting 0 [ 388.287630][ T5904] usb 1-1: new full-speed USB device number 86 using dummy_hcd [ 388.454941][T14075] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2832'. [ 388.478074][ T5904] usb 1-1: config 0 has an invalid interface number: 31 but max is 0 [ 388.491060][ T5904] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 388.522307][ T5904] usb 1-1: config 0 has no interface number 0 [ 388.542773][ T5904] usb 1-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 388.554592][ T5904] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 388.562987][ T5904] usb 1-1: Product: syz [ 388.567360][ T5904] usb 1-1: Manufacturer: syz [ 388.573197][ T5904] usb 1-1: SerialNumber: syz [ 388.582820][ T5904] usb 1-1: config 0 descriptor?? [ 388.592155][ T5904] hub 1-1:0.31: bad descriptor, ignoring hub [ 388.599593][ T5904] hub 1-1:0.31: probe with driver hub failed with error -5 [ 388.618519][ T5904] usb 1-1: Found UVC 0.04 device syz (046d:08c3) [ 388.630575][ T5904] uvcvideo 1-1:0.31: Entity type for entity Output 6 was not initialized! [ 388.658524][ T5904] usb 1-1: Failed to create links for entity 6 [ 388.667304][ T5904] usb 1-1: Failed to register entities (-22). [ 388.847480][T14084] FAULT_INJECTION: forcing a failure. [ 388.847480][T14084] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 388.879473][T14084] CPU: 0 UID: 0 PID: 14084 Comm: syz.4.2836 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 388.879505][T14084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 388.879519][T14084] Call Trace: [ 388.879528][T14084] [ 388.879539][T14084] dump_stack_lvl+0x189/0x250 [ 388.879569][T14084] ? __pfx____ratelimit+0x10/0x10 [ 388.879596][T14084] ? __pfx_dump_stack_lvl+0x10/0x10 [ 388.879620][T14084] ? __pfx__printk+0x10/0x10 [ 388.879658][T14084] should_fail_ex+0x414/0x560 [ 388.879703][T14084] _copy_to_user+0x31/0xb0 [ 388.879725][T14084] simple_read_from_buffer+0xe1/0x170 [ 388.879759][T14084] proc_fail_nth_read+0x1df/0x250 [ 388.879795][T14084] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 388.879828][T14084] ? rw_verify_area+0x258/0x650 [ 388.879851][T14084] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 388.879884][T14084] vfs_read+0x1fd/0x980 [ 388.879914][T14084] ? __pfx___mutex_lock+0x10/0x10 [ 388.879942][T14084] ? __pfx_vfs_read+0x10/0x10 [ 388.879969][T14084] ? __fget_files+0x2a/0x420 [ 388.880001][T14084] ? __fget_files+0x3a0/0x420 [ 388.880029][T14084] ? __fget_files+0x2a/0x420 [ 388.880067][T14084] ksys_read+0x145/0x250 [ 388.880095][T14084] ? __pfx_ksys_read+0x10/0x10 [ 388.880116][T14084] ? rcu_is_watching+0x15/0xb0 [ 388.880143][T14084] ? do_syscall_64+0xbe/0x3b0 [ 388.880181][T14084] do_syscall_64+0xfa/0x3b0 [ 388.880206][T14084] ? lockdep_hardirqs_on+0x9c/0x150 [ 388.880232][T14084] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.880253][T14084] ? clear_bhb_loop+0x60/0xb0 [ 388.880278][T14084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.880299][T14084] RIP: 0033:0x7f416eb8d33c [ 388.880323][T14084] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 388.880341][T14084] RSP: 002b:00007f416f9ac030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 388.880365][T14084] RAX: ffffffffffffffda RBX: 00007f416edb5fa0 RCX: 00007f416eb8d33c [ 388.880381][T14084] RDX: 000000000000000f RSI: 00007f416f9ac0a0 RDI: 0000000000000006 [ 388.880394][T14084] RBP: 00007f416f9ac090 R08: 0000000000000000 R09: 0000000000000000 [ 388.880407][T14084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 388.880419][T14084] R13: 0000000000000000 R14: 00007f416edb5fa0 R15: 00007ffc1982a388 [ 388.880451][T14084] [ 389.132537][ T10] usb 1-1: USB disconnect, device number 86 [ 389.457948][ T24] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 389.619857][ T24] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 389.630675][ T24] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 389.643463][ T24] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 389.653208][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 389.662165][ T24] usb 5-1: SerialNumber: syz [ 389.765691][T14096] netlink: 830 bytes leftover after parsing attributes in process `syz.0.2841'. [ 389.775952][T14096] team0: default FDB implementation only supports local addresses [ 389.887178][ T24] usb 5-1: 0:2 : does not exist [ 389.924504][ T24] usb 5-1: USB disconnect, device number 45 [ 389.960288][ T30] audit: type=1804 audit(1751303811.972:26): pid=14100 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.2843" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=3051 res=1 errno=0 [ 390.362884][ T5834] usb 6-1: New USB device found, idVendor=10c4, idProduct=800a, bcdDevice=c6.ba [ 390.381136][T14042] block nbd5: shutting down sockets [ 390.400744][ T5834] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.467863][ T5834] usb 6-1: can't set config #201, error -71 [ 390.517768][ T5834] usb 6-1: USB disconnect, device number 7 [ 390.609715][T14122] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2852'. [ 390.908429][ T5834] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 391.078543][ T5834] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 391.097953][ T5834] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 391.121458][ T5834] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 391.160709][ T5834] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 391.175202][ T5834] usb 6-1: SerialNumber: syz [ 391.422451][T14151] /dev/rnullb0: Can't lookup blockdev [ 391.498017][ T5905] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 391.632491][ T5834] usb 6-1: 0:2 : does not exist [ 391.671720][ T5905] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 391.685746][ T5834] usb 6-1: USB disconnect, device number 8 [ 391.721735][ T5905] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 391.739043][ T5905] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 391.748985][ T5905] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 391.772534][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 391.788953][ T5905] usb 1-1: SerialNumber: syz [ 392.015182][ T5905] usb 1-1: 0:2 : does not exist [ 392.112197][ T5905] usb 1-1: USB disconnect, device number 87 [ 392.178248][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 393.188704][ T30] audit: type=1804 audit(1751303815.202:27): pid=14212 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2888" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=3051 res=1 errno=0 [ 393.222799][T14215] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2890'. [ 393.510531][T14226] /dev/rnullb0: Can't lookup blockdev [ 393.607861][T14234] /dev/rnullb0: Can't lookup blockdev [ 393.628341][ T5905] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 393.762885][T14240] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2900'. [ 393.775052][T14240] MTD: Couldn't look up '/dev/rnullb0': -15 [ 393.794623][T14240] /dev/rnullb0: Can't lookup blockdev [ 393.802201][ T5905] usb 5-1: config 1 has an invalid interface number: 5 but max is 2 [ 393.812206][ T5905] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 393.830835][ T5905] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 393.844638][ T5905] usb 5-1: config 1 has no interface number 1 [ 393.862112][ T5905] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 393.889161][ T5905] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 393.897295][ T5905] usb 5-1: SerialNumber: syz [ 393.951884][T14244] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2902'. [ 393.982509][T14244] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2902'. [ 394.145579][ T5905] usb 5-1: 0:2 : does not exist [ 394.211516][ T5905] usb 5-1: USB disconnect, device number 46 [ 394.303104][T14258] /dev/rnullb0: Can't lookup blockdev [ 394.303888][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 394.605726][T14266] binder: 14265:14266 ioctl c0306201 0 returned -14 [ 394.690199][T14267] binder: 14265:14267 ioctl c0306201 0 returned -14 [ 394.951588][T14279] /dev/rnullb0: Can't lookup blockdev [ 395.180334][T14286] binder: BINDER_SET_CONTEXT_MGR already set [ 395.190809][T14286] binder: 14285:14286 ioctl 4018620d 200000000040 returned -16 [ 395.658160][ T5834] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 395.811780][ T5834] usb 6-1: config 1 has an invalid interface number: 5 but max is 2 [ 395.829703][ T5834] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 395.858720][ T5834] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 395.867789][ T5834] usb 6-1: config 1 has no interface number 1 [ 395.932709][ T5834] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 395.951384][ T5834] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 395.968464][ T5834] usb 6-1: SerialNumber: syz [ 396.116860][T14323] /dev/rnullb0: Can't lookup blockdev [ 396.215906][ T5834] usb 6-1: 0:2 : does not exist [ 396.275532][ T5834] usb 6-1: USB disconnect, device number 9 [ 396.301417][T14328] sg_write: process 67 (syz.4.2939) changed security contexts after opening file descriptor, this is not allowed. [ 396.351133][ T51] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 396.360968][ T51] Bluetooth: hci1: Injecting HCI hardware error event [ 396.369834][ T51] Bluetooth: hci1: hardware error 0x00 [ 396.400002][ T5847] udevd[5847]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 396.698448][T14333] Bluetooth: hci4: unexpected cc 0x080f length: 3 > 1 [ 396.951719][T14352] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2949'. [ 397.314881][T14364] /dev/rnullb0: Can't lookup blockdev [ 397.428708][ T44] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 397.482932][T14369] BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321 [ 397.497651][T14369] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 14369, name: syz.1.2958 [ 397.511264][T14369] preempt_count: 0, expected: 0 [ 397.516173][T14369] RCU nest depth: 1, expected: 0 [ 397.522466][T14369] 2 locks held by syz.1.2958/14369: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 397.527715][T14369] #0: ffffffff8e33bee0 (rcu_read_lock){....}-{1:3}, at: query_vma_setup+0x18/0x110 [ 397.542590][T14369] #1: ffff8880203fabc8 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 [ 397.564851][T14369] CPU: 0 UID: 0 PID: 14369 Comm: syz.1.2958 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) [ 397.564883][T14369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 397.564897][T14369] Call Trace: [ 397.564907][T14369] [ 397.564916][T14369] dump_stack_lvl+0x189/0x250 [ 397.564953][T14369] ? __pfx_dump_stack_lvl+0x10/0x10 [ 397.564987][T14369] ? print_lock_name+0xde/0x100 [ 397.565018][T14369] __might_resched+0x495/0x610 [ 397.565048][T14369] ? __pfx___might_resched+0x10/0x10 [ 397.565082][T14369] ? __kmalloc_noprof+0xa3/0x4f0 [ 397.565111][T14369] __kmalloc_noprof+0xbc/0x4f0 [ 397.565135][T14369] ? procfs_procmap_ioctl+0x877/0xd10 [ 397.565169][T14369] procfs_procmap_ioctl+0x877/0xd10 [ 397.565204][T14369] ? __pfx_procfs_procmap_ioctl+0x10/0x10 [ 397.565246][T14369] ? __fget_files+0x2a/0x420 [ 397.565279][T14369] ? __fget_files+0x2a/0x420 [ 397.565308][T14369] ? __fget_files+0x3a0/0x420 [ 397.565336][T14369] ? __fget_files+0x2a/0x420 [ 397.565369][T14369] ? bpf_lsm_file_ioctl+0x9/0x20 [ 397.565390][T14369] ? __pfx_procfs_procmap_ioctl+0x10/0x10 [ 397.565419][T14369] __se_sys_ioctl+0xfc/0x170 [ 397.565446][T14369] do_syscall_64+0xfa/0x3b0 [ 397.565472][T14369] ? lockdep_hardirqs_on+0x9c/0x150 [ 397.565498][T14369] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.565520][T14369] ? clear_bhb_loop+0x60/0xb0 [ 397.565547][T14369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.565568][T14369] RIP: 0033:0x7f4d10f8e929 [ 397.565588][T14369] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 397.565614][T14369] RSP: 002b:00007f4d11ea8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 397.565638][T14369] RAX: ffffffffffffffda RBX: 00007f4d111b5fa0 RCX: 00007f4d10f8e929 [ 397.565654][T14369] RDX: 0000200000000180 RSI: 00000000c0686611 RDI: 000000000000000d [ 397.565669][T14369] RBP: 00007f4d11010b39 R08: 0000000000000000 R09: 0000000000000000 [ 397.565683][T14369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 397.565696][T14369] R13: 0000000000000000 R14: 00007f4d111b5fa0 R15: 00007ffec1b393d8 [ 397.565732][T14369] [ 397.586765][T14375] /dev/rnullb0: Can't lookup blockdev [ 397.938350][ T5834] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 398.438537][ T51] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 398.725165][ T44] usb 6-1: device descriptor read/all, error -71 [ 398.792189][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.895235][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.012872][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.110186][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.275215][ T13] bridge_slave_1: left allmulticast mode [ 399.285747][ T13] bridge_slave_1: left promiscuous mode [ 399.293322][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 399.310474][ T13] bridge_slave_0: left allmulticast mode [ 399.316174][ T13] bridge_slave_0: left promiscuous mode [ 399.323088][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 399.863388][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 399.877305][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 399.889036][ T13] bond0 (unregistering): Released all slaves [ 400.176889][ T13] hsr_slave_0: left promiscuous mode [ 400.183122][ T13] hsr_slave_1: left promiscuous mode [ 400.194689][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 400.202463][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 400.212534][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 400.222924][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 400.260524][ T13] veth1_macvtap: left promiscuous mode [ 400.266126][ T13] veth0_macvtap: left promiscuous mode [ 400.282306][ T13] veth1_vlan: left promiscuous mode [ 400.287752][ T13] veth0_vlan: left promiscuous mode [ 400.863550][ T13] team0 (unregistering): Port device team_slave_1 removed [ 400.904190][ T13] team0 (unregistering): Port device team_slave_0 removed [ 401.561814][ T13] IPVS: stop unused estimator thread 0... [ 401.663970][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.735858][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.810654][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.879657][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.134382][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.213683][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.282146][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.340797][ T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.560252][ T13] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.649851][ T13] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.705952][ T13] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.788031][ T13] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.956173][ T13] bridge_slave_1: left allmulticast mode [ 402.966018][ T13] bridge_slave_1: left promiscuous mode [ 402.972765][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 402.987551][ T13] bridge_slave_0: left allmulticast mode [ 402.996634][ T13] bridge_slave_0: left promiscuous mode [ 403.003095][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.016360][ T13] bridge_slave_1: left allmulticast mode [ 403.023330][ T13] bridge_slave_1: left promiscuous mode [ 403.029608][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.043042][ T13] bridge_slave_0: left allmulticast mode [ 403.048925][ T13] bridge_slave_0: left promiscuous mode [ 403.054752][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.067583][ T13] bridge_slave_1: left allmulticast mode [ 403.075139][ T13] bridge_slave_1: left promiscuous mode [ 403.081646][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.093693][ T13] bridge_slave_0: left allmulticast mode [ 403.101862][ T13] bridge_slave_0: left promiscuous mode [ 403.107697][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.643235][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 403.655534][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 403.666449][ T13] bond0 (unregistering): Released all slaves [ 403.961624][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 403.972946][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 403.984150][ T13] bond0 (unregistering): Released all slaves [ 404.313415][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 404.325027][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 404.335261][ T13] bond0 (unregistering): Released all slaves [ 404.451127][ T13] tipc: Left network mode [ 405.135277][ T13] hsr_slave_0: left promiscuous mode [ 405.147068][ T13] hsr_slave_1: left promiscuous mode [ 405.155172][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 405.163017][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 405.172078][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 405.181546][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 405.197155][ T13] hsr_slave_0: left promiscuous mode [ 405.203917][ T13] hsr_slave_1: left promiscuous mode [ 405.212069][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 405.219976][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 405.228976][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 405.237176][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 405.261516][ T13] hsr_slave_0: left promiscuous mode [ 405.267655][ T13] hsr_slave_1: left promiscuous mode [ 405.278466][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 405.287479][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 405.297277][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 405.307421][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 405.383874][ T13] veth1_macvtap: left promiscuous mode [ 405.389951][ T13] veth0_macvtap: left promiscuous mode [ 405.395699][ T13] veth1_vlan: left promiscuous mode [ 405.401270][ T13] veth0_vlan: left promiscuous mode [ 405.408490][ T13] veth1_macvtap: left promiscuous mode [ 405.414329][ T13] veth0_macvtap: left promiscuous mode [ 405.420136][ T13] veth1_vlan: left promiscuous mode [ 405.428881][ T13] veth0_vlan: left promiscuous mode [ 405.435431][ T13] veth1_macvtap: left promiscuous mode [ 405.447822][ T13] veth0_macvtap: left promiscuous mode [ 405.454930][ T13] veth1_vlan: left promiscuous mode [ 405.463046][ T13] veth0_vlan: left promiscuous mode [ 406.164685][ T13] team0 (unregistering): Port device team_slave_1 removed [ 406.202950][ T13] team0 (unregistering): Port device team_slave_0 removed [ 406.896460][ T13] team0 (unregistering): Port device team_slave_1 removed [ 406.937525][ T13] team0 (unregistering): Port device team_slave_0 removed