last executing test programs: 16m29.889014702s ago: executing program 0 (id=1669): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x200, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10043, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0xfffffffffffffe04) io_uring_enter(0xffffffffffffffff, 0x1, 0x1, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$inet(0x2, 0x80001, 0x84) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt(r1, 0x84, 0x81, &(0x7f0000000280)="5a00000002000000", 0x8) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, 0x0, &(0x7f0000000080)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x2, 0x300) sendmsg$nl_generic(r2, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a0000000600"], 0x1c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x400c090) syz_genetlink_get_family_id$team(&(0x7f0000000480), r2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67200000000000140600000fff07006706000020000000350200000ee60000bf25000000000000bd350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad53010000000000840400000000000014000000000000009500000000000000db13d5d8b740f2cdaabc8383c8f56b8c2b84a800ea6553f3ef4392b3815dcf00c3eebc52267b042d19d6e31e25e589d5f2692c75a547d6f186641ae8c557ccff3878a93b51a0389749df734f49ed5078b10f1e7f2b37626a3ace1ea89f7d2c570720a86853e26168761f0a53358f7ee2baa0e6a67a98a0d57ac09f36cfefbbc7492bbe7cdf64971a57fd64efd46c26"], &(0x7f0000000380)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x6, 0x10, 0x0, 0x57}, 0x48) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x304}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", '\x00F\x00', "3d8efa05fdffffff"}, 0x28) 16m26.610246677s ago: executing program 0 (id=1675): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0x7, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20b02, 0x0) ioctl$TIOCSSOFTCAR(r2, 0x5453, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) write$uinput_user_dev(r3, 0x0, 0x0) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) ioctl$UI_DEV_CREATE(r3, 0x5501) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x2181) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000100900010073797a30000000000900030073797a320000000014"], 0x7c}}, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000100), 0x2, 0x862b01) write$char_usb(r4, &(0x7f0000000040)="e2", 0x2250) ioctl$EVIOCGKEY(r4, 0x80404518, &(0x7f0000001300)=""/115) 16m25.685685146s ago: executing program 0 (id=1677): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="0100230100003402000002000000", @ANYRES32=r1, @ANYBLOB="90767872fba1e0eb1f76d8d01b70f010a83ca6cc8150e111281af3e42d1301cfa1355a1a6e33"], 0x1c}}, 0x0) read$nci(r0, &(0x7f0000000200)=""/100, 0x64) read$nci(r0, &(0x7f00000002c0)=""/100, 0x64) write$nci(r0, &(0x7f0000000900)=@NCI_OP_CORE_INIT_RSP={0x0, 0x0, 0x2, 0x1, 0x1, {{0x2, 0x80000000, 0xbe, "0090b5a31416f45705ab523a9e7cf7b10ac207a43862246407c527b847d464fb727c64c56deb34e1d6e4e747a5140157253e8106fa83816f55371e4e0ad73827b0459c3d3554e68243742e06fb744c518d56b6de751e1109a35fb166773f86b4acfdd742c5a9d2bf6856e4f898132ab086a69a403a7b4a577aa63429f1f0fd43d73a023ff23d6fa95b7246c6ffe862060f0529558f7a2c0eaaf51e79d20460b289f5ca209656dfb9913c9ff301918b63141accb0fbef1450393afe554afa"}, {0x0, 0x0, 0x0, 0xffff, 0x0, 0x5}}}, 0xd2) read$nci(r0, &(0x7f0000000380)=""/100, 0x64) write$nci(r0, &(0x7f0000000400)=@NCI_OP_RF_DISCOVER_MAP_RSP, 0x4) sendmsg$NFC_CMD_START_POLL(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x24, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0xffffffff}]}, 0x24}}, 0x0) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x48, r4, 0x5eae78d9c54e9d3f, 0x2, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_SEC_KEY={0x2c, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "acc8ef65b6c1020aa28bf8fad4a69fd9"}, @NL802154_KEY_ATTR_ID={0xc, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x4}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r2, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000a00)={0x28c, 0x0, 0x300, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_SEC_DEVKEY={0x114, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x800}, @NL802154_DEVKEY_ATTR_ID={0x74, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x48, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x7}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xffffffff}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}]}, @NL802154_DEVKEY_ATTR_ID={0x28, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x1c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xfffffffffffe0606}}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0002}}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5}]}, @NL802154_DEVKEY_ATTR_ID={0x60, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x28, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x4}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x1}]}]}, @NL802154_ATTR_SEC_DEVKEY={0x94, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x800}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x6b1}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x80}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_ID={0x58, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x4}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x1d08}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xa}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0xbe42}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x6}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x7}]}, @NL802154_ATTR_SEC_DEVKEY={0xb4, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x33c3fd58}, @NL802154_DEVKEY_ATTR_ID={0x30, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x2d}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x4}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x401}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0002}}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_ID={0x30, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x6}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}]}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x4}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x5}]}, @NL802154_DEVKEY_ATTR_ID={0x1c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x5}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x28c}, 0x1, 0x0, 0x0, 0x20000040}, 0x24000814) read$nci(r0, &(0x7f0000000500)=""/100, 0x64) read$nci(r0, &(0x7f00000005c0)=""/100, 0x64) write$nci(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000003b12"], 0x5) read$nci(r0, &(0x7f0000000680)=""/100, 0x64) write$nci(r0, &(0x7f0000000700)=@NCI_OP_RF_DISCOVER_RSP, 0x4) sendmsg$NFC_CMD_ACTIVATE_TARGET(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_TARGET_INDEX={0x8}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x1}]}, 0x2c}}, 0x0) write$nci(r0, &(0x7f00000008c0)=@NCI_OP_CORE_CONN_CREATE_RSP={0x0, 0x0, 0x2, 0x4, 0x0, {0x0, 0x0, 0x0, 0x1}}, 0x7) 16m21.355633294s ago: executing program 0 (id=1687): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x2) write(r1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x100140a, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') timer_create(0x1, &(0x7f0000000240)={0x0, 0x21, 0x4, @thr={0x0, 0x0}}, &(0x7f0000000300)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x2, &(0x7f0000002280)=[{0xa, 0xf0, 0x5d, 0x9}, {0xfffa, 0x7f, 0x6, 0x9}]}) open_tree(0xffffffffffffffff, &(0x7f00000022c0)='./cgroup/../file0\x00', 0x1800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 16m20.381263047s ago: executing program 0 (id=1688): syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = syz_open_dev$dri(0x0, 0x202, 0x521941) ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000300)={0x28, 0x3, 0x0, 0x0, &(0x7f000000d000/0x1000)=nil, 0x1000, 0x662c}) setns(0xc9, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="6c0000001000010428bd700000000000000000", @ANYRES32=0x0, @ANYBLOB="03920000004000003c0012800800010067747000300002", @ANYRES32, @ANYBLOB="080002", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYBLOB], 0x6c}, 0x1, 0x0, 0x0, 0x240008c4}, 0x480c4) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0xffffff, 0x0, 0x0, 0x4}, 0x10) write(r4, &(0x7f0000000000)="240000001a00590214f9f407000904101f00000000000000000200000800040001000000", 0x24) 16m19.497310419s ago: executing program 0 (id=1692): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0x8, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000"], &(0x7f0000000140)='GPL\x00'}, 0x94) r2 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r1}, 0x8) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="01"], 0x40) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) recvmsg(0xffffffffffffffff, 0x0, 0x22) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r5}, &(0x7f0000000000), &(0x7f0000000040)=r6}, 0x20) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r6, r4}, 0x14) syz_emit_ethernet(0xfe4f, &(0x7f0000000240)=ANY=[], 0x0) getsockopt$CAN_RAW_LOOPBACK(r0, 0x65, 0x3, 0x0, &(0x7f0000000040)) 16m19.17568866s ago: executing program 32 (id=1692): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0x8, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000"], &(0x7f0000000140)='GPL\x00'}, 0x94) r2 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r1}, 0x8) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="01"], 0x40) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) recvmsg(0xffffffffffffffff, 0x0, 0x22) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r5}, &(0x7f0000000000), &(0x7f0000000040)=r6}, 0x20) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r6, r4}, 0x14) syz_emit_ethernet(0xfe4f, &(0x7f0000000240)=ANY=[], 0x0) getsockopt$CAN_RAW_LOOPBACK(r0, 0x65, 0x3, 0x0, &(0x7f0000000040)) 15.705256283s ago: executing program 2 (id=4741): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="0100230100003402000002000000", @ANYRES32=r1, @ANYBLOB="90767872fba1e0eb1f76d8d01b70f010a83ca6cc8150e111281af3e42d1301cfa1355a1a6e33"], 0x1c}}, 0x0) read$nci(r0, &(0x7f0000000200)=""/100, 0x64) read$nci(r0, &(0x7f00000002c0)=""/100, 0x64) write$nci(r0, &(0x7f0000000900)=@NCI_OP_CORE_INIT_RSP={0x0, 0x0, 0x2, 0x1, 0x1, {{0x2, 0x80000000, 0xbe, "0090b5a31416f45705ab523a9e7cf7b10ac207a43862246407c527b847d464fb727c64c56deb34e1d6e4e747a5140157253e8106fa83816f55371e4e0ad73827b0459c3d3554e68243742e06fb744c518d56b6de751e1109a35fb166773f86b4acfdd742c5a9d2bf6856e4f898132ab086a69a403a7b4a577aa63429f1f0fd43d73a023ff23d6fa95b7246c6ffe862060f0529558f7a2c0eaaf51e79d20460b289f5ca209656dfb9913c9ff301918b63141accb0fbef1450393afe554afa"}, {0x0, 0x0, 0x0, 0xffff, 0x0, 0x5}}}, 0xd2) read$nci(r0, &(0x7f0000000380)=""/100, 0x64) write$nci(r0, &(0x7f0000000400)=@NCI_OP_RF_DISCOVER_MAP_RSP, 0x4) sendmsg$NFC_CMD_START_POLL(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x24, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0xffffffff}]}, 0x24}}, 0x0) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x48, r4, 0x5eae78d9c54e9d3f, 0x2, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_SEC_KEY={0x2c, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "acc8ef65b6c1020aa28bf8fad4a69fd9"}, @NL802154_KEY_ATTR_ID={0xc, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x4}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r2, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000a00)={0x290, 0x0, 0x300, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_SEC_DEVKEY={0x10c, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x800}, @NL802154_DEVKEY_ATTR_ID={0x6c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x40, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x7}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xffffffff}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}]}, @NL802154_DEVKEY_ATTR_ID={0x28, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x1c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xfffffffffffe0606}}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0002}}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5}]}, @NL802154_DEVKEY_ATTR_ID={0x60, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x28, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x4}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x1}]}]}, @NL802154_ATTR_SEC_DEVKEY={0x94, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x800}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x6b1}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x80}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_ID={0x58, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x4}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x1d08}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xa}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0xbe42}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x6}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x7}]}, @NL802154_ATTR_SEC_DEVKEY={0xc0, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x33c3fd58}, @NL802154_DEVKEY_ATTR_ID={0x30, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x2d}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x4}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x401}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0002}}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_ID={0x30, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x6}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}]}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x4}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x5}]}, @NL802154_DEVKEY_ATTR_ID={0x28, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x7}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x5}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x290}, 0x1, 0x0, 0x0, 0x20000040}, 0x24000814) read$nci(r0, &(0x7f0000000500)=""/100, 0x64) read$nci(r0, &(0x7f00000005c0)=""/100, 0x64) write$nci(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000003b12"], 0x5) read$nci(r0, &(0x7f0000000680)=""/100, 0x64) write$nci(r0, &(0x7f0000000700)=@NCI_OP_RF_DISCOVER_RSP, 0x4) sendmsg$NFC_CMD_ACTIVATE_TARGET(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_TARGET_INDEX={0x8}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x1}]}, 0x2c}}, 0x0) write$nci(r0, &(0x7f00000008c0)=@NCI_OP_CORE_CONN_CREATE_RSP={0x0, 0x0, 0x2, 0x4, 0x0, {0x0, 0x0, 0x0, 0x1}}, 0x7) 15.082743678s ago: executing program 1 (id=4744): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001200)=ANY=[@ANYBLOB="61124c00000000006113300000000000bf300000000000002500070007ffffffbd2001000000000095002000000000006916320000000000bf6700000000000004070000b964b01a4607feff00200000540700000ee60090bf050000000000000c5700000000000065070000d23700002c030000000000001f75000000000000bf54000000000000070000000400f9ffad430100000000007c000000000000000500000000000000950000000000000032ed3c5be95e5db67754bb12dc8c4ed68ecf264e0f84f9f17d3c30e3c7bdd2d17f2f175455000078af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd390700000500000000f18c30907d7bee45a0100000fe9de56c9d05000000c6c60bef0d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cac3f055af65727546e7c955ccefa1f6ab689ffffff7f63ede202fa4e0a2127b8b83c71a51445dc8dfd13ff15f852a39e5b2ab7bcb8f512036a5ba6d04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6901fcecc8158f0200000000c8fb735fd552bdc268694aeb0763f65e439ec1120843e326c819b6cf5c8ac86f8a297dff0445a13d0045fb3cda30a673a6037ed8c85f21ec2c081bdce431e56723888fb126a19bc1172b84b3ebe174aba210d739a018f9bbec63222d20cecac4d03723f1c921b5bbf7949632cacfdd32b3a6aa57f1ad2e99e0e67a993716dbf580469f0f53acbb400001e3abd5dedd3f7d2cf5834f2af97787f696649a46e17e090000000000000045eac1720e83b7838e3eede14308d582685e1becd6f35154bcb400000000000000000000008129277dc467148670ad3e2b26539cebca8f4ddc211bc3ccf0bd9d42ca019dd5d022cf74686e9fbe2562979eaed840a7afaab43176e65ec1118d46d1e827f3472f4445d353887a5ad103649afa1769080584f800031e03a651bb04000000ab04871bc47287cd31cc43ea0ffb567b4040c1458d0320ce7d0000413a0000000000000000005f37983f84e98a523d80bd56a57fa82b82f639601ae899a559944cb9a62a29ab028acfc1cb26a0f6a5480a55d624a0c544ba0dc828c22fe30000aa391598000000437d57fcf8295f63a70837f5cd4e5e77964522dc7ca3aa3476b7f2d851d27fd4de6eabb43e0799dc8d9fb7dc6c523ffbd74a6a40e4acb1ac872ade9d1f2ab779b8dbe843aeeda0426c767c00327b8c95b2bb6ddb55117669d9598c0f3598073f3a921c76beceff7e4fbfea5011db9020823b83abe54346c7af0a99fa077ffe7000feb9e44023a1749eb1d0d572b77d6e0d0fcd74031c8ef2629f5ecff4626746d6abe98a255e92c3c4f79bfcd0d91741380000cfeb73dec68ed56b5d3dfdf0cb8b71ad79000000000000000000000000000000dd434a25e95d0ec29d3adaccf89d0888031ecdfdb4dfbe444673be099ece7e4009c76c7108ef0a7e59fd6d906fbc3c9b412e0478cfee4485f423c63f49db43833c92eeeb647cebd4d7a93a17bcbb6bae5ff876375d4fe39cc2d292691672cc18ca372104ceb83a35ecedd97fc191d8f64d2b1d60c6d12911aada66c26aa4802c3514c3d92ec905000000b13f14c3f2ed6c64ec90000022d600000000000000000000028026b80c3899543223a6079ee96198b9a326db3be3a48af415ca28ca51c502550044ed8e29af8d763ef9b1f31befcad2ce5394601c7cdc233ba3d4ce26ed703dcb9fb3ad650f77e339768924dfdbeead13b88371154d743544a6091ec93e0d3fd5b4dc42911c17d51f964727bfd5cc5ba15370f6e1141d2271eded0b15e4316a1e4623272beb249a0928c417720be14c898f397411c88a7bcf3df46ab3efe7cd5e160c2afd3cc945f75011a102d952c7ad17a58d9be6910023a26faea764fae160cc2260bd028162917807ce89e11b5f261052ee0dde18efa1d802af2b7beecaaa61e7a726571df5cf6f8af41933cea0d0343261bccf64ca1c81045153eafbefdb91fbdff9ee3307d4a1837963b2dc2a3698d90e7915b098f19392e792adaea86052f4e948184001b6494e906925a092483adc7e9c8f7a29d226763c100aecae7f00619c36bceb9fb6dd7e55487d8485e498fdfc377fd3d266d21d46ab2f6b2ce22cd0aebba9b0ffbfe8ec3143c3734967c90b16ebbeeae1ce2baaae05aed6bf0f40c8a323f9235dc99698bd0b800067a901a79daada03cc77e74feb98b1586946b452764ff917a8ecc10e529c5bea49cad70e22df522c2803b6ef65df70223c6e22c3433e322d8dbd6e9b040065a9d6b3d5ae276cffe935d559bea88e1aa36b4e6c19e78457904297e77370e013b705a96548d47c609a93c45f4d1382b39c05dcc07d5b49ad75ddb3ce5b5b9416e03995da046c7aa5e6fc1a6f5d663380967ccef9de49a90ced031335e3219ebd9d06c257a50497ec523f5ff7361261ccfe239d603364a42e2e81fc068fcbb9792b673827fe7018a988fbce55bb74cdb327ce27e134548032a307871cea4c89d4b77b8743fb3cb72cc280b9f62e4f92f46a19600b802cba88b7d0a938d9e0e6cfe5d66b8748d004179e5b6025c0e1050faec7ecd9de190a975db2f8c06a551236278c4766d7e22e3b85168c9851de6266c791252f919b4f8b25055e786734e5142e4666c67aef5b7b2f88c6640995434aa8636993089c73f196c54ae829ad4307132655b075ae534fa7f1ea9a17e62357b0bd2bd1d62d34bfc136464025013665b1cf26a863a5cb3e8acc806611792add8254e705fefd2a44d5b15e3b36f6b75c97c9c04c511d8cf9e24c61c8284a913a381cb1a56c4f3f265a09628878040000000000000017b68afd95d4abd79286692439ee7acca2adc3d83d72b1b778e30c2bf2efbbcd054cf51f5705eb0faa8a0d9f18135cb1d8d567c3436fa697b72c5035d98b9e4f7f3379c0b3339debc78352b2e65299223d7ef2bd540e78167a3ac92a4c4f826f6d0e5c4ebf4f7a70c03e2f5ddbebf168586331eb5995d2288a167b7c6b20b32116b0c528dab6d0c4fe2ee402348104bc5d4012babedee898c6d3e1017be2e9bc759d3ab4d615f5000000000000000000000000000000000000000000007fff0000000000e693e314adf7dc9f517d04f1e6ca367d30d31d3647c6059db6e1e9529eb1623ef99e2d9ac2ab4872f8e784b07a31110bef6d000000a6f9e89e6d50ee06ce716f94da60f1f22db669560d296287c13c92070000ee7553eb2df17a39542fa88d09f000e88a90cf4406b9000000000000000000000000f441d6a6f516c235c6f5863e7f454ee0e16b9aa2593eb31fa3836703e7765aaeb77a8770e518efaa6d3dd85e03b3b133eb749057cea9af75a0e6f633532f2891b8e263cb6eecea691842827bc7c887081c8d320642389f5f0c42dba0ff75a257310f2d92cb1d1e16468949f5675262ee6609cf26ae4a8f5eac0ebf318e735930b01d8f586e34537bcff7d6196f494cdcf3a712078d745db0f5687a78ee6d000b3d171a0f08299b52d207f32e9da311ca090000003a42732808515eec574f892622c5be497fc3d9ca122d7c18b9e54637812c8debc61f0e42d838e44a819b74bce1a56108bb0f72c4a02475920532309c55b2c9ae9f281391ec5cc72a5e94cca1cbf1a706ec201eedfa5fbdb537a0c52bd45a9f966c25616cec30c3ea3246cb8e6aac7cf273638e6656a3e4ccadc348f0172028c99cc5f6d5c6d09ed65aa54549e73c28b7c8ad06ad3c5e3c27eec0eff1a6c84f1189919eefcee8072d1f88cb781e4cdb04af00ac92f1080211c4bee74381a0e31021918f27863fdbafb50f70857d52a1f7df51935a80b1980a4778d35f183ea517f55a98c5a471f3521956f8da6a4ccf2071095305701ab3f3ae43f06e91bc7d85e3800b46926944fba9805a985e63e53a62232fcd3f01dbe1728f300e247a7ebe344f9749818ff3961b2a42664ccd680a90bbb6ab400e286acc8f9febef64594777f848ed1cf980a3da2f0f7745760a05887d0c28060d613dd6539d392fc21fee0b5131609664b821d7a994e6c5965a4fa1ec1790c54e54586907dcc5a071ba22251e2de8bac16e79da9c2444d52facb7ab49420900000000000000f888a94365b99b72796fde1b922fc9ae09b526efca65faf1546c17cbb1d2d2fd12cb1a49cad501a3ca218c595b667b634606c57987ebfb0783a4948e4561d5cda158fe74453ff4a837be14d6a483842c57d6005b544b4f80003386edfd3d4a88a667bd41eefe0d808abed08a29e6bc370a80cc0366fb4080bfbaaa946fd47ab662c79c846e403910bbc3a48bb276cbb08a8eab145c06221ef16a238e3d50ad18aea9a2cec97d3c2d0569caabe2bffe02506bc9cb7294c5d020536dd5e7a6351642112df3b55d0215aaec7e45598995e79699e47567e353e68b03f82be860b188554b734e1192f9c1a867b815ef52cdc3307c0cc9be0000fdde69c350e59f11f1d26a4d04d8c8b2c4a4d23ee931d14bc7807db773a614b670acf46f83f7c65a0f8d43c5f647e1f0d27c46d4b686e867e9b0be76a7978a8f962bb5a070df97f2bf7612115cfe5ebdc7ad0bc5a5f3ace25347d0e5c347279d55aa67a967380000000000000000000000000000000000000000000000ed0942d980c754c6c69ef65c375ad018824f78b260d5f51bc3feba504408a8c8141d84f3f417603b5081680faa8cf38dbe4ae19e936511966965ce268b6345a0001c0f26a32e0a999fc869292e939dcf89b9bfd794f9c12d41959a00688cca43015a9eec58f647796adea520cd2abeb0b55c22949d10e5a05fee4543fdc1e02554a55b5fef2427a6e5708edc38fac53c2f961945a3f83cdf01979939b49bc6b1aef8c733401bbe473de8d64efbe0d123739f387d1c0d9e74f2175c174ada1678c7db79492e8dd0f34e2ccf419cf7f14ffa408b50a52685b36aed14aa22ad928191d5a2697646edc52a1c0c5d720ae690add2b34aed161f51cc1cb424f76098e1e1921e5a405f9d298a8461f2da30e47b7c6ed7c95c84c745f58723e4cddffae3b53b5b947f9435e589f9ae55b30ecd3827b2de5df31976870823da8058c2538c04e397f3d0ef90c11c74da984fa558697ecb57224ce8fa6f79aadbd7dbf3678e74d790bc2ee72769a3ada1dd504f8e4133ce1effd446bc9a2f139e65cc4bd83912af3122352506c7c2191b3705113a5ce1c99193886d6008d3565b00000000000000000000000000000000001c260fc175785ca04e31790f542c0f17b6599e93134792eae9878638b299e1d2b38d367be0d5c99d179c6bde265caebbae48bae74338f9d4f12f"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe50}, 0x48) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x0, 0x4, 0x70bd25, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x40088}, 0x40) 14.148195331s ago: executing program 5 (id=4750): userfaultfd(0x80801) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$tty1(0xc, 0x4, 0x1) ioprio_set$uid(0x3, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000280)='net/route\x00') r2 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/card0/oss_mixer\x00', 0x2, 0x0) write$proc_mixer(r2, &(0x7f0000000340)=ANY=[@ANYBLOB='LI'], 0x8c) close(r2) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBENT(r5, 0x4b47, 0x0) write$tun(r0, 0x0, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000abe92710b1134200fe76010203010902240001040000000904090202c91802000905040210"], 0x0) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f00000001c0)="ee64", 0x2}], 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000002c0)={0x1, &(0x7f0000000280)=[{0x1, 0x8, 0x2, 0x8}]}) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000002082057d004000010203010902600003010048f30904000000010100000a240106000a0002010209040080000002000009040101010102000009050109080000037f0725010c000200090402", @ANYRES64=r6], 0x0) syz_usb_connect$uac1(0x5, 0x87, &(0x7f0000000180)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0xe41, 0x424a, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x75, 0x3, 0x1, 0xff, 0x80, 0x0, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x1ff, 0x1f}, [@output_terminal={0x9, 0x24, 0x3, 0x6, 0x403, 0x5, 0x5, 0xf}, @processing_unit={0xc, 0x24, 0x7, 0x5, 0x1, 0x0, "aab364c35b"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0xfa, 0x40, 0x7, {0x7, 0x25, 0x1, 0x4, 0x0, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x4, 0x8, 0x1, {0x7, 0x25, 0x1, 0x4, 0xa, 0x5}}}}}}}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0}) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000006c0)=ANY=[@ANYBLOB="e00000000002010300000000000000000700001078000a8008000140000000016c00020006000340000100000c00028056000100060000000c0002800500010011000000060003400000000006000340000200000c00028005000100110000000c00028005000100110000000c000280050001000000000014000180080001007f00000108000200ffffffff540002800c000280050001003a000000060003400004000014000180080001000000000008000200ac1e000114000180080001000a010100080002007f0000010c000280050001003a0000000600034000010000"], 0xe0}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) socket(0x10, 0x803, 0x0) 14.065870112s ago: executing program 1 (id=4751): r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, 0x0, 0x0) 14.063407533s ago: executing program 2 (id=4752): setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) socket(0x10, 0x803, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) close(r1) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) sendmsg$unix(r2, &(0x7f00000000c0)={&(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4040801}, 0x20008840) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SOUND_MIXER_READ_DEVMASK(r3, 0x80044dfe, &(0x7f0000000080)) r4 = syz_open_dev$vim2m(&(0x7f0000000100), 0x4001005, 0x2) ioctl$vim2m_VIDIOC_QUERYCAP(r4, 0x80685600, &(0x7f00000001c0)) 11.61771202s ago: executing program 1 (id=4754): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = open(&(0x7f0000000140)='./file0\x00', 0x2a5c0, 0x113) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e23}, 0x6e) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r3 = semget$private(0x0, 0x1, 0x430) semop(r3, 0x0, 0x0) chroot(&(0x7f0000000180)='./file0\x00') semtimedop(0x0, &(0x7f0000000340)=[{0x0, 0x1, 0x1000}], 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)=@generic={&(0x7f0000000080)='./file0\x00', 0x0, 0x18}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) mknod$loop(0x0, 0xfff, 0x1) syz_open_dev$sndctrl(0x0, 0x22a8, 0x4a0000) socket$alg(0x26, 0x5, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000280)=@gcm_256={{0x505}, "9183dc5242900e66", "1171129190cdb869484ee930e0ad4545c2b95ca1052cb36300da884c5120b3f7", '\x00', "f35f2f158955eda7"}, 0x38) recvfrom(0xffffffffffffffff, &(0x7f0000000440)=""/4070, 0xfe6, 0x117, 0x0, 0x0) 9.689360158s ago: executing program 1 (id=4756): r0 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x1b}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000000)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, &(0x7f0000000380)={0x0}, 0x1) close(r0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x82, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x3c, 0x3, 0xa, 0x3, 0x0, 0x0, {0x0, 0x0, 0x2}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_COUNTERS={0x4}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x84}}, 0x20008844) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="200000005200010000000000000000000a0000000c000100feffffff0800000033df0bb41afeffc6c4b569be858442c6f7a2589ae318dc74516a990e9ac46d514deb30449a930e5ac67b5d2a12e40cc8d6fdd638af6fd78e8261e2e6e28941ed06c5527bf7fe8e33a0e6439d2df3b15d3238d634456164403e0fcc0fdde38decd5496f03f56b502381a18a2f3add50ed84ace019ade252800286588222c656c50a29cc0928641678289d4b1fd182f253e9fc209367"], 0x20}}, 0x0) r5 = socket$inet6(0xa, 0x1, 0x84) bind$inet6(r5, &(0x7f0000ed3fe4)={0xa, 0x4e20, 0xfffffffd, @loopback}, 0x1c) setsockopt$sock_linger(r5, 0x1, 0xd, &(0x7f0000000040)={0x1, 0xffffffff}, 0x8) syz_io_uring_modify_offsets$generic(r1, r2, 0x34, 0x1) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f0000000040)={0xf0f004, 0x20000000}) sendto$inet6(r5, &(0x7f00000001c0)="bc", 0x1, 0x4, &(0x7f00000000c0)={0xa, 0x4e20, 0x8, @loopback, 0xfffffffe}, 0x1c) mount(&(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='squashfs\x00', 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, 0x0, 0x4000000) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0x10, 0x1, 'BATMAN_V'}]}}}]}, 0xfd12}}, 0x0) 9.516608438s ago: executing program 2 (id=4757): r0 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x1b}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000000)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, &(0x7f0000000200)={0x0, 0x0, 0x4}, 0x1) close(r0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x82, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000030a03000000000000000000000000020900030073797a3000000000040008800c00024000000000000032000000001400000010f1e3e72700010000000000000080000084000a51ee1ea1d83bc58292fa9e4939bf998b9603f61b50648336892262e6c422856d24827deb86978227cc9b390777f01bec"], 0x84}}, 0x20008844) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="200000005200010000000000000000000a0000000c000100feffffff0800000033df0bb41afeffc6c4b569be858442c6f7a2589ae318dc74516a990e9ac46d514deb30449a930e5ac67b5d2a12e40cc8d6fdd638af6fd78e8261e2e6e28941ed06c5527bf7fe8e33a0e6439d2df3b15d3238d634456164403e0fcc0fdde38decd5496f03f56b502381a18a2f3add50ed84ace019ade252800286588222c656c50a29cc0928641678289d4b1fd182f253e9fc209367"], 0x20}}, 0x0) r5 = socket$inet6(0xa, 0x1, 0x84) syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) r6 = syz_io_uring_setup(0x3acd, &(0x7f0000000540)={0x0, 0xcf0b, 0x0, 0x3, 0x11}, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0x8, 0x0, 0x0, 0x4, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r6, 0x101, 0x11, 0x5, 0x0, 0x0) bind$inet6(r5, &(0x7f0000ed3fe4)={0xa, 0x4e20, 0xfffffffd, @loopback}, 0x1c) r10 = syz_io_uring_setup(0x737b, &(0x7f0000000380)={0x0, 0xd867, 0x100, 0x1, 0x4d, 0x0, r0}, &(0x7f0000000400), &(0x7f0000000440), &(0x7f0000000480)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r10, 0x10, &(0x7f0000000700)={0x3, 0x0, &(0x7f0000000680)=[{&(0x7f00000004c0)=""/181, 0xb5}, {&(0x7f0000000580)=""/44, 0x2c}, {&(0x7f00000005c0)=""/10, 0xa}, {&(0x7f0000000600)=""/69, 0x45}], &(0x7f00000006c0)=[0x2], 0x4}, 0x20) setsockopt$sock_linger(r5, 0x1, 0xd, &(0x7f0000000040)={0x1, 0xffffffff}, 0x8) syz_io_uring_modify_offsets$generic(r1, r2, 0x34, 0x1) r11 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r11, 0xc008561c, &(0x7f0000000040)={0xf0f004, 0x20000000}) sendto$inet6(r5, &(0x7f00000001c0)="bc", 0x1, 0x4, &(0x7f00000000c0)={0xa, 0x4e20, 0x8, @loopback, 0xfffffffe}, 0x1c) ioctl$KVM_CAP_DISABLE_QUIRKS(0xffffffffffffffff, 0x4068aea3, &(0x7f00000000c0)={0x74, 0x0, 0x13}) r12 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000001700), 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r12, 0xc0105702, &(0x7f00000000c0)) mount(&(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000740)='squashfs\x00', 0x0, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) getrlimit(0xf, &(0x7f0000000180)) sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, 0x0, 0x4000000) sendmsg$nl_route(r13, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002400000000000000086174616476000014000280100001004241544d414e5f56"], 0xfd12}}, 0x0) 9.009480993s ago: executing program 5 (id=4758): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48080}, 0x40010) 8.613930293s ago: executing program 4 (id=4760): r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x15, 0x0, 0x0) 8.389853236s ago: executing program 5 (id=4761): r0 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000200)={0x0, [[0x6, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x3], [0xffffffff, 0x3, 0xffffffff, 0x1, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x0, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) ppoll(&(0x7f0000000000)=[{r1, 0x1000}], 0x1, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001980)={0x1f, 0x13, &(0x7f0000000580)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1, 0x10, 0x0, 0xfff3}, 0x90) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = socket(0x10, 0x803, 0x0) r7 = epoll_create(0x7) r8 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000140)={0x60000000}) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1f4, r6, &(0x7f0000000040)={0x40000016}) ioctl$XFS_IOC_BULKSTAT(r8, 0x8040587f, &(0x7f0000000900)={{0x2, 0x7, 0xfffffffe, 0xf584, 0x7}, &(0x7f0000000480)=[{}, {}, {}, {}, {}, {}]}) setrlimit(0x40000000000008, &(0x7f0000000000)={0x4848, 0xfffffffffffff006}) capset(&(0x7f0000a31000)={0x20080522}, &(0x7f0000000080)) mlock2(&(0x7f0000006000/0x4000)=nil, 0x4000, 0x0) mlock(&(0x7f0000007000/0x2000)=nil, 0x2000) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r5, 0x4018aee3, &(0x7f0000000140)=@attr_pmu_init) setxattr$security_capability(&(0x7f0000000140)='./file0/file1\x00', &(0x7f0000000040), 0x0, 0x0, 0x1) 8.310407268s ago: executing program 4 (id=4762): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r3}, &(0x7f0000000000), &(0x7f00000002c0)=r0}, 0x20) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvmsg$unix(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000800)=""/229, 0xec0}], 0x1}, 0x2002) (fail_nth: 2) 8.141170105s ago: executing program 1 (id=4763): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0xc0000101}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000038c0)=@newlink={0x3c, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x1d, 0x0, 0x0, 0x1}]}}]}]}, 0x3c}}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3800a5223c0099ee1220d91f270cc794f4f010459a175e50bf6836d1fde03c64e15800ca62e2f754ad3d9bba6aea5a3f9b4e9e8e27662d302b289b8648dd3678c0f4ce9c26fc762f4e2cf21e80503b550ac788547e0a", @ANYRES16, @ANYBLOB="010025bd7002fddbdf25210000000c0005000201aaaaaaaaaaaa0c00050040c3fa000000000009001f007068793000000000"], 0x38}, 0x1, 0x0, 0x0, 0x84}, 0x4040814) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001f7ff04b7050000240000006a0a00fe00000000850000000b000000b70000000000000095000000000000009cc6b3fcd62c061c6238975d43a4505f80e39c9f3c530cf08e467b592f868ee3b0a435df0a0e8c1bf176db2a6b2feb4b77d3d5707bfd2d84aaa3b1d4e984c46ea7e2b347a36f5662403e1b2be4284322a4988a0d411a9872971c7c56f0979bd10b97163c066d0e196bf0fb04e500b0c0502df9de9ca3c00cb9a323d9b401bf4e418d07fa22f0610a70f2bdf4000200000000b0c2c125080963f6324bb7b80197aa3161f45346b100000000000000000089e399f6609876b588743794298b79dc192dff048fc207c81f28bdd3e26a1a8a0481e9f0da43bb6ca66e2f55a9ff19ffcafe3e64be06000000000000005064caec04a367c23d9fb6a6991ddb737d527d6acb15426406991c3b404984dfa2c6e94bd0339454c13ad3c328a182c15dc760a313e3b3ca5d3393404029e98fa883c71949a34d84030323e3d54fc5b29d27643453ad9226e3550ee5520211d9370175fba303f003073afd1ec9f7c6133f260c6882a146880b9387f1beb5418618bc83a3becf9bb5d80eff7da7ba8b913c685fc6700848dc6665d73248c1f74e08ad04ce905faf32706e0000249a028044ede964362cfb2f30a246c3b2f60000fc4deb91da1368b0960b8d69bd99c64893d44f962524429dc0584b8e7e541c903869d96989b9a986620cb2c95c83f2a082c52764f49e51188f9418b01bcd8ae164acdac95318ec8b2c6feacdcf4b528e5e58219bc54f6ad5679e7f430e6960ed048c46e1dccca05bfa1d67c83795eae2d31968c055d325a9c794ef88b30c2de4a274878b73c05ffa88b7073be648b12bb1fee58958d6a6f31bfe568215dfbde59dad00008a73b40f09cf018cd496b36050d7fd45e3620c28f76749262e33e16429a6da35ceb1a989de81c3f8b8bc348ef2ac3789b847611fcb0a26acafdd6d9a1b17dcb9f7c493d8f8cd344a1d470ca0d6f16ab0293774b5509fb0e7113936d59d5a60dbd84a938476adeebab9ff44f531bb0200000000000000cc1fbc455a64fd449284f71761092a0302000000000000008a05d36fd9b814b4292745418c92d944763a4bf5e138d810e29a31f08f7dea7762d2d8f7e1d24cabe17ad4135d8872935ceac6eb4f046f2acc1b0efb4438abddcabb4e4e72a450aab72b589bec83bbb688e659fb426cd43d0ee993516fd4e867232cde69b6ffad447dcd92e0ef8234ff850ec3948dd1fa7afb77d951fe4abf618121b7894c106beb49a71c62df5544ef221973432ccc7e62b151eb898a01010a7ec5acd0a5dcb2de443880c8a682515d1da9a3048744acb44384d1591df789883c0560495cb0cb32283529926d25e5c7f481112ab8a82247e927fb6f256830dab3671f00500d36a17790bab7d0e89e6c15314f2b963bfc867953476b0505c7d728326d666f39e82cfcf7e7a85df288d75df24c5e4d529c349923f9a4fb882310391dd58b4cbd8def239a227724d39c3e6c40e20e07e68a22888a5c3941b7a765b92bcb37f302487bcbd93ccf3a104021ff34ddf7ffcca1a04eae963e25516a114573779b24a341dfb2e80f1f345c6d96493ffc2a18478b5bf3aab2ea59c51cf0678e1a57d0ea042d911548ff612002ddb2d54d42fbdde42b56887003d27468225b2594a0500200f314113e889468cf13dd92aa0d7744db6b56557a5adad95cb9a69d4de50642b4b9d6d3ba7eb534b00d0fea62f0a61535dfc4da06e7f8695be614c557caed7eb0120516e1351fed7d8ffa31c8f4be364185469cfc5f25c90d71bce745dd2d58a30e0844f12c4cbbdd7a08465e665c2620d78673dfb6d9263e44f59fae487c62c98a3534f1a3eac9ee9f18a18106ba3d7c7a62330f5c0e98cb7982dd7bad02c8dba9c13894185bfc4bd2520b6e2043fcb3fc5eb55ecf9e6e363ea2ac40a14a6f00f0ffffa0fdb6487c51ef12c2e88beeb5aa6f6a4151cfb90644e50630ed474df7d1635afcb1ea3f6c47b5acbba2ce5099a9387f74d1ffbd1da497613174f76a656ba5bacccbb58dddaf9a3510d65383829a51e0f41e661fa80ca1eaaa6cf0824305ba4ec80400c50ffe83ccb0e6fef321190c58aca8c7c8c6d26ff5cbc2cadebda8e1219e04f8dacffd33db1a0a2e74c9eb978d80a12d0b5327bfd053000000000000000000be0d02a14708504412fa93d335992b2983c5addc191b4a21c7b340d0536b01958e15315eb5f3f9f4992c18f666359f40295fa73284c4b607669bae01bd68c3e2b770c324a0ab26b6065d7e95a7bd80052db57506ec7cc861bf3998d07484c66630ca8173fea3f06ed1dfc70a8b90418e2dc76137e0f68cb1c8a908aef9f009f85647dba54e05028c33d94d463fb20d2e7547184b8d3611e45dff02144387f342ef9b9bf650e9d049bf65258a7bc094a6965e24611c077e1ca0891362a9d68f3ec7610c0449ac59110500a09b75885cd79ba32776e4a511c8a4ad922b000000000002ef507ec6fc7f5dc431b9d8cbd9003972bf1dc6a71bedad8e19efc3edd2a7a7e555d5f3176af69920471e6e5bcb8966c813c132d65e2b99d3015e06b372e1aefaae14ee3fbc6349af362c19b59c214de66912d1a9a98d92dc030000009443de62caca334c46d110e50896fe50d0477771d387f40c8ef05750ca651e6e69a237dcf78666d6ab2bda1f853525494e4efdd93be38bb5fc671f8794002d7a951fd336aaf4ed1166cb459df70218c571ba1c40b028234505e5477effff26af8812c2fbb8785a223fce0a0601c2a3b58bea8c6216eadabcabe86ab46e4cd3d58ef7ce8d3c4b0bc5952e81dfc0a490d8568db6f9c51fe703c6864fae0053d2f91f49e977cdc1962dbc28c29471a72199862bc8fc6e211d13d8579cab4fba94b2b613c9b8148d05e0690a4c4ab35aabc45801d2b82081e62b23a01b58b1ffb624f63ad2246796796160cd3682374364edac52f1becb7c6eff50823b75fb2ef516ec4ec1cb20a2535b504502d744f2099674e58f2c117c980cf0d041c8e45c4f166bab4aa5ed200ef4dcff96f7c9c1ab8c22db0f439b23b04bcd41ffc3a0e01976ca1cf43e12d7d72f3faa4979faabd62e2dc54a980eae4d5e8c6498de331c3aba1144ef1190ea6cda641d9416c4560cab2d819eac7b04c70f141754c3ffd79da363fe8859afee531710caf1b2bf5a51142f4755cbb700c28083525a9093790096cb93417f1216000000000000000000000000000040ceb244e4cae2b65a36d41793aabccd3d0c50486eae6793e1f54814a8ee2779c14ca94759266200229b58c12279817869e831cade7b09ddffffff9d93e2ad25eed43c0b9ee4fd209b5b919a42f676b9d7236fc8dd5040899d0676291407ce9ac8101dd3512f5b3ac8cf8179d1749de324000030d0f942ec4604c28d5c287d1435956784003a53eb5f0436ead88d7acf0166dbd9f30a9b259c8a9b9faf1356faf269cded935b07863e4fdad8aab52686c81babd1c08f6700a2fadd413443022ea5c774ffefdd426abed08d437a4db48611fc82a18ab9f54758a1aad86d95cd186ceb55fafa3930090467b8b7bb8ae7e1c8b4b4106a381cb67fdb86def4de2076dc538bb97502b4b4350e633dc0a53c2fc9a01bc5cfae0245f1fab843c633446f5f3a43226109b7dafe7815773bd6969f04cbe15236b90000000000000000000000000000000000000000000000000000ff0779b9c0057addb2efe11b8b3a706569f1522b57d71bb0beccab7c8fe9e1330b2f501b2ac3cfe9e2f505e833217557abb257d61a73a758543651b250f8d8ef9c8481bb28a137d15040b0181c28dfad7c17b30c452a64c43a117cb948247c33abc765a6ba695c3cea5e32a4d11c9b4be91c60932bae2dcbec2ff4268e03aad15efc6004e6b3d7f0edf8b5d4ae7846a6d43c16c90b7c5dc13ac2ff0439ab693498964cad2bb533bcd240778b7e49145c48efde42b44c01517f1a7c7707b4c4fc0900e7086ec40354504590696282286db9030f0320e2fcba8723939005347b3c99e3f1310d41ab328c1f351b3f744ff1973431000000000000000000000000000000000000003495d69aaf9a1d83e83511a3bf44fe753b8ad83bc34ea4d46b397e000fd267c50122aa5aaf8474ec2e57d960d963900bef84a4b3c7dd01ae4d6b5522aa8a35ae7996e298bcfe3f31a34e3e12c58cf172a4d3677a67b52041ec21ae8003aa1c9969178b1b00e4d12ac9741fd788fb6260ec043c013907523c77f8acc20b9e2fd224ca8f21fab2b10991881e0a12f4e1c4f54b9ca7c9a0c8298d60b8b6eaa023418992d6d62b0e9faca4a3b3a845e859137cd933ef5eb8db16f159f32505725da51414562d064b551246dacd58023fed3c087bb52ae4bc09f3846c785d1b278e661ed01fbc2415288bc9c808c4aef648d431b3029da0dec8886c3ee9cad996843d00a3b5eb54e270dd2e96c8f2fdb4c27c2d1bd467f2a14867dec67730d8a68329839d9feff688dfbe25c73f936338e7b057980da58a6303d95f17712d667d5a1066ae457ae32925ce658b559c1182a74e267da57fe25b19153f1cdebaddf3f7a3479c09f2303dff449c0513b152a75ed48215cc31264a6ff648a95daa0d599dbce303b3b5307572df30429a3b4b115cab0a018f2501272048dd9e69877535e20078e7c28a98f26ace7a266bdc15ce904f25ec7fb2434ee7b5b69bed702ba1e7ed72942f452f1a98a2d949450091075efa823b11f5f5eccd921c04c7c15a5a05750cd85b1300fc00ce275de7559e117f87cb6c3c9a4b9f96149e3fcffa44d7000000000000000000d43d07d546acb7009c0c4f6e57b8577d2113bfca1939b9bf757265e175c1863a7c8d7640675830dc11d5d59546daf2385a7074f770c8333b21e2fb660141bc4f1ed45f703da6ac2557ab6952bd0c300000000000000000005b44bff4e3966fdfc9b720412bec09936b08e440c774e222dbd9a323a889f295e5d3bae64fc48ba123668e6a0be1e732aa5e2a0d4373a0b76d84f018d45bdf6f12d6d5d23a0331c3ae5e99a2bcdb52386135ea15890007e1cba5e52a04971139272012ae5542ba109a9d2f49798ce2fc6f639735e0222cd08075418239042bfe47c363973d3245ce507e838dfd90ae442a96fa1343029be56de31c2eff226c05f0ae3dbe2281e7bc02db39342d5b54ad3616733a5aa7753613423a0c4d2844a6e08fa5b76e18f7e24e967f6f83c546718d0f20959376427cdd449a4be3d75fd3e51e1b7f8690855af8eddbd3fd556b4460d0091e3623933f1a11db14aea54af6c49725bfa51fed222dc379995f48b1aab94441767c8bccbfd966d814715203bd8f549cd57d6a87295bf16aa25fb4e7fcaa8cec5e5c03b0095861bf2fed70ffb46bbb78ba90ca272ead9b3d2959fd9dbaabd1d51a60b474cef4c700faf718b810e4d3527a4663ee9fbc0000000000000000000000000000000000000000000000000061abf7a66b7b3f57ff830000"], &(0x7f0000000340)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r9, 0x18000000000002a0, 0xcc0, 0x0, &(0x7f00000000c0)="5aee41dea43e63a3f7fb7f11c72b", 0x0, 0xf000, 0x2f, 0x0, 0x0, 0x0, 0x0}, 0x50) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7, 0x972, &(0x7f0000006680)=0x4) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) 6.57746051s ago: executing program 4 (id=4764): r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, 0x0, 0x0) 6.027770236s ago: executing program 4 (id=4766): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0xc0000101}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000038c0)=@newlink={0x3c, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x1d, 0x0, 0x0, 0x1}]}}]}]}, 0x3c}}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3800a5223c0099ee1220d91f270cc794f4f010459a175e50bf6836d1fde03c64e15800ca62e2f754ad3d9bba6aea5a3f9b4e9e8e27662d302b289b8648dd3678c0f4ce9c26fc762f4e2cf21e80503b550ac788547e0a", @ANYRES16, @ANYBLOB="010025bd7002fddbdf25210000000c0005000201aaaaaaaaaaaa0c00050040c3fa000000000009001f007068793000000000"], 0x38}, 0x1, 0x0, 0x0, 0x84}, 0x4040814) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001f7ff04b7050000240000006a0a00fe00000000850000000b000000b70000000000000095000000000000009cc6b3fcd62c061c6238975d43a4505f80e39c9f3c530cf08e467b592f868ee3b0a435df0a0e8c1bf176db2a6b2feb4b77d3d5707bfd2d84aaa3b1d4e984c46ea7e2b347a36f5662403e1b2be4284322a4988a0d411a9872971c7c56f0979bd10b97163c066d0e196bf0fb04e500b0c0502df9de9ca3c00cb9a323d9b401bf4e418d07fa22f0610a70f2bdf4000200000000b0c2c125080963f6324bb7b80197aa3161f45346b100000000000000000089e399f6609876b588743794298b79dc192dff048fc207c81f28bdd3e26a1a8a0481e9f0da43bb6ca66e2f55a9ff19ffcafe3e64be06000000000000005064caec04a367c23d9fb6a6991ddb737d527d6acb15426406991c3b404984dfa2c6e94bd0339454c13ad3c328a182c15dc760a313e3b3ca5d3393404029e98fa883c71949a34d84030323e3d54fc5b29d27643453ad9226e3550ee5520211d9370175fba303f003073afd1ec9f7c6133f260c6882a146880b9387f1beb5418618bc83a3becf9bb5d80eff7da7ba8b913c685fc6700848dc6665d73248c1f74e08ad04ce905faf32706e0000249a028044ede964362cfb2f30a246c3b2f60000fc4deb91da1368b0960b8d69bd99c64893d44f962524429dc0584b8e7e541c903869d96989b9a986620cb2c95c83f2a082c52764f49e51188f9418b01bcd8ae164acdac95318ec8b2c6feacdcf4b528e5e58219bc54f6ad5679e7f430e6960ed048c46e1dccca05bfa1d67c83795eae2d31968c055d325a9c794ef88b30c2de4a274878b73c05ffa88b7073be648b12bb1fee58958d6a6f31bfe568215dfbde59dad00008a73b40f09cf018cd496b36050d7fd45e3620c28f76749262e33e16429a6da35ceb1a989de81c3f8b8bc348ef2ac3789b847611fcb0a26acafdd6d9a1b17dcb9f7c493d8f8cd344a1d470ca0d6f16ab0293774b5509fb0e7113936d59d5a60dbd84a938476adeebab9ff44f531bb0200000000000000cc1fbc455a64fd449284f71761092a0302000000000000008a05d36fd9b814b4292745418c92d944763a4bf5e138d810e29a31f08f7dea7762d2d8f7e1d24cabe17ad4135d8872935ceac6eb4f046f2acc1b0efb4438abddcabb4e4e72a450aab72b589bec83bbb688e659fb426cd43d0ee993516fd4e867232cde69b6ffad447dcd92e0ef8234ff850ec3948dd1fa7afb77d951fe4abf618121b7894c106beb49a71c62df5544ef221973432ccc7e62b151eb898a01010a7ec5acd0a5dcb2de443880c8a682515d1da9a3048744acb44384d1591df789883c0560495cb0cb32283529926d25e5c7f481112ab8a82247e927fb6f256830dab3671f00500d36a17790bab7d0e89e6c15314f2b963bfc867953476b0505c7d728326d666f39e82cfcf7e7a85df288d75df24c5e4d529c349923f9a4fb882310391dd58b4cbd8def239a227724d39c3e6c40e20e07e68a22888a5c3941b7a765b92bcb37f302487bcbd93ccf3a104021ff34ddf7ffcca1a04eae963e25516a114573779b24a341dfb2e80f1f345c6d96493ffc2a18478b5bf3aab2ea59c51cf0678e1a57d0ea042d911548ff612002ddb2d54d42fbdde42b56887003d27468225b2594a0500200f314113e889468cf13dd92aa0d7744db6b56557a5adad95cb9a69d4de50642b4b9d6d3ba7eb534b00d0fea62f0a61535dfc4da06e7f8695be614c557caed7eb0120516e1351fed7d8ffa31c8f4be364185469cfc5f25c90d71bce745dd2d58a30e0844f12c4cbbdd7a08465e665c2620d78673dfb6d9263e44f59fae487c62c98a3534f1a3eac9ee9f18a18106ba3d7c7a62330f5c0e98cb7982dd7bad02c8dba9c13894185bfc4bd2520b6e2043fcb3fc5eb55ecf9e6e363ea2ac40a14a6f00f0ffffa0fdb6487c51ef12c2e88beeb5aa6f6a4151cfb90644e50630ed474df7d1635afcb1ea3f6c47b5acbba2ce5099a9387f74d1ffbd1da497613174f76a656ba5bacccbb58dddaf9a3510d65383829a51e0f41e661fa80ca1eaaa6cf0824305ba4ec80400c50ffe83ccb0e6fef321190c58aca8c7c8c6d26ff5cbc2cadebda8e1219e04f8dacffd33db1a0a2e74c9eb978d80a12d0b5327bfd053000000000000000000be0d02a14708504412fa93d335992b2983c5addc191b4a21c7b340d0536b01958e15315eb5f3f9f4992c18f666359f40295fa73284c4b607669bae01bd68c3e2b770c324a0ab26b6065d7e95a7bd80052db57506ec7cc861bf3998d07484c66630ca8173fea3f06ed1dfc70a8b90418e2dc76137e0f68cb1c8a908aef9f009f85647dba54e05028c33d94d463fb20d2e7547184b8d3611e45dff02144387f342ef9b9bf650e9d049bf65258a7bc094a6965e24611c077e1ca0891362a9d68f3ec7610c0449ac59110500a09b75885cd79ba32776e4a511c8a4ad922b000000000002ef507ec6fc7f5dc431b9d8cbd9003972bf1dc6a71bedad8e19efc3edd2a7a7e555d5f3176af69920471e6e5bcb8966c813c132d65e2b99d3015e06b372e1aefaae14ee3fbc6349af362c19b59c214de66912d1a9a98d92dc030000009443de62caca334c46d110e50896fe50d0477771d387f40c8ef05750ca651e6e69a237dcf78666d6ab2bda1f853525494e4efdd93be38bb5fc671f8794002d7a951fd336aaf4ed1166cb459df70218c571ba1c40b028234505e5477effff26af8812c2fbb8785a223fce0a0601c2a3b58bea8c6216eadabcabe86ab46e4cd3d58ef7ce8d3c4b0bc5952e81dfc0a490d8568db6f9c51fe703c6864fae0053d2f91f49e977cdc1962dbc28c29471a72199862bc8fc6e211d13d8579cab4fba94b2b613c9b8148d05e0690a4c4ab35aabc45801d2b82081e62b23a01b58b1ffb624f63ad2246796796160cd3682374364edac52f1becb7c6eff50823b75fb2ef516ec4ec1cb20a2535b504502d744f2099674e58f2c117c980cf0d041c8e45c4f166bab4aa5ed200ef4dcff96f7c9c1ab8c22db0f439b23b04bcd41ffc3a0e01976ca1cf43e12d7d72f3faa4979faabd62e2dc54a980eae4d5e8c6498de331c3aba1144ef1190ea6cda641d9416c4560cab2d819eac7b04c70f141754c3ffd79da363fe8859afee531710caf1b2bf5a51142f4755cbb700c28083525a9093790096cb93417f1216000000000000000000000000000040ceb244e4cae2b65a36d41793aabccd3d0c50486eae6793e1f54814a8ee2779c14ca94759266200229b58c12279817869e831cade7b09ddffffff9d93e2ad25eed43c0b9ee4fd209b5b919a42f676b9d7236fc8dd5040899d0676291407ce9ac8101dd3512f5b3ac8cf8179d1749de324000030d0f942ec4604c28d5c287d1435956784003a53eb5f0436ead88d7acf0166dbd9f30a9b259c8a9b9faf1356faf269cded935b07863e4fdad8aab52686c81babd1c08f6700a2fadd413443022ea5c774ffefdd426abed08d437a4db48611fc82a18ab9f54758a1aad86d95cd186ceb55fafa3930090467b8b7bb8ae7e1c8b4b4106a381cb67fdb86def4de2076dc538bb97502b4b4350e633dc0a53c2fc9a01bc5cfae0245f1fab843c633446f5f3a43226109b7dafe7815773bd6969f04cbe15236b90000000000000000000000000000000000000000000000000000ff0779b9c0057addb2efe11b8b3a706569f1522b57d71bb0beccab7c8fe9e1330b2f501b2ac3cfe9e2f505e833217557abb257d61a73a758543651b250f8d8ef9c8481bb28a137d15040b0181c28dfad7c17b30c452a64c43a117cb948247c33abc765a6ba695c3cea5e32a4d11c9b4be91c60932bae2dcbec2ff4268e03aad15efc6004e6b3d7f0edf8b5d4ae7846a6d43c16c90b7c5dc13ac2ff0439ab693498964cad2bb533bcd240778b7e49145c48efde42b44c01517f1a7c7707b4c4fc0900e7086ec40354504590696282286db9030f0320e2fcba8723939005347b3c99e3f1310d41ab328c1f351b3f744ff1973431000000000000000000000000000000000000003495d69aaf9a1d83e83511a3bf44fe753b8ad83bc34ea4d46b397e000fd267c50122aa5aaf8474ec2e57d960d963900bef84a4b3c7dd01ae4d6b5522aa8a35ae7996e298bcfe3f31a34e3e12c58cf172a4d3677a67b52041ec21ae8003aa1c9969178b1b00e4d12ac9741fd788fb6260ec043c013907523c77f8acc20b9e2fd224ca8f21fab2b10991881e0a12f4e1c4f54b9ca7c9a0c8298d60b8b6eaa023418992d6d62b0e9faca4a3b3a845e859137cd933ef5eb8db16f159f32505725da51414562d064b551246dacd58023fed3c087bb52ae4bc09f3846c785d1b278e661ed01fbc2415288bc9c808c4aef648d431b3029da0dec8886c3ee9cad996843d00a3b5eb54e270dd2e96c8f2fdb4c27c2d1bd467f2a14867dec67730d8a68329839d9feff688dfbe25c73f936338e7b057980da58a6303d95f17712d667d5a1066ae457ae32925ce658b559c1182a74e267da57fe25b19153f1cdebaddf3f7a3479c09f2303dff449c0513b152a75ed48215cc31264a6ff648a95daa0d599dbce303b3b5307572df30429a3b4b115cab0a018f2501272048dd9e69877535e20078e7c28a98f26ace7a266bdc15ce904f25ec7fb2434ee7b5b69bed702ba1e7ed72942f452f1a98a2d949450091075efa823b11f5f5eccd921c04c7c15a5a05750cd85b1300fc00ce275de7559e117f87cb6c3c9a4b9f96149e3fcffa44d7000000000000000000d43d07d546acb7009c0c4f6e57b8577d2113bfca1939b9bf757265e175c1863a7c8d7640675830dc11d5d59546daf2385a7074f770c8333b21e2fb660141bc4f1ed45f703da6ac2557ab6952bd0c300000000000000000005b44bff4e3966fdfc9b720412bec09936b08e440c774e222dbd9a323a889f295e5d3bae64fc48ba123668e6a0be1e732aa5e2a0d4373a0b76d84f018d45bdf6f12d6d5d23a0331c3ae5e99a2bcdb52386135ea15890007e1cba5e52a04971139272012ae5542ba109a9d2f49798ce2fc6f639735e0222cd08075418239042bfe47c363973d3245ce507e838dfd90ae442a96fa1343029be56de31c2eff226c05f0ae3dbe2281e7bc02db39342d5b54ad3616733a5aa7753613423a0c4d2844a6e08fa5b76e18f7e24e967f6f83c546718d0f20959376427cdd449a4be3d75fd3e51e1b7f8690855af8eddbd3fd556b4460d0091e3623933f1a11db14aea54af6c49725bfa51fed222dc379995f48b1aab94441767c8bccbfd966d814715203bd8f549cd57d6a87295bf16aa25fb4e7fcaa8cec5e5c03b0095861bf2fed70ffb46bbb78ba90ca272ead9b3d2959fd9dbaabd1d51a60b474cef4c700faf718b810e4d3527a4663ee9fbc0000000000000000000000000000000000000000000000000061abf7a66b7b3f57ff830000"], &(0x7f0000000340)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r9, 0x18000000000002a0, 0xcc0, 0x0, &(0x7f00000000c0)="5aee41dea43e63a3f7fb7f11c72b", 0x0, 0xf000, 0x2f, 0x0, 0x0, 0x0, 0x0}, 0x50) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7, 0x972, &(0x7f0000006680)=0x4) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 4.400815218s ago: executing program 2 (id=4767): mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '', @void}}}]}) r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)) 4.099167034s ago: executing program 5 (id=4769): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000017c0)={0x90, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x51, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @random=0x3, 0x4400, @void, @void, @void, @void, @void, @val={0x5, 0x3, {0x4, 0x6e, 0xff}}, @void, @void, @void, @val={0x2d, 0x1a, {0xc, 0x0, 0x4, 0x0, {0x7, 0x1f81, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2}, 0x1, 0xfff, 0x8}}, @void, @void, @val={0x76, 0x6, {0x7, 0x8, 0x4, 0xe}}}}, @NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0xbc}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x90}}, 0x4880) 3.778366558s ago: executing program 3 (id=4770): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)={0x1}) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000000200)) close(r1) socket$l2tp6(0xa, 0x2, 0x73) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x3, [@datasec={0x1, 0x1, 0x0, 0xf, 0x2, [{0x3, 0x3, 0x3}], '+\x00'}, @datasec={0x0, 0x0, 0x0, 0xf, 0x2, [], "f015"}]}, {0x0, [0x5f]}}, 0x0, 0x43, 0x0, 0x1}, 0x28) socket$key(0xf, 0x3, 0x2) setns(0xc9, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x20, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf0}}, 0x0) 3.72931324s ago: executing program 2 (id=4771): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x10) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r3 = getpid() openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) write$sndseq(r4, 0x0, 0x0) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000880)={0x0, 0xfffffffe, 0x0, 0x4, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x8000, 0x3, 0xbaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8684, 0x2, 0x40040001, 0x334, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 3.497008853s ago: executing program 4 (id=4772): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48080}, 0x40010) 3.406659921s ago: executing program 1 (id=4773): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) getrlimit(0x7, &(0x7f00000000c0)) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000500)=""/102400, 0x19000) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) r4 = add_key(&(0x7f0000000300)='rxrpc\x00', &(0x7f0000000000)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$read(0xb, r4, &(0x7f0000000480)=""/138, 0x1001) pread64(0xffffffffffffffff, &(0x7f0000000100)=""/253, 0xfd, 0x20001) 3.26016803s ago: executing program 3 (id=4774): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000300)={0x1f, 0xffff, 0x3}, 0x6) (async) write(r0, &(0x7f0000000400)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007e3dc410cd0621013ddd0102030109021b000100094000090485000189fe1f0009058202", @ANYRESOCT], 0x0) (async) connect$bt_l2cap(r2, &(0x7f0000000080)={0x1f, 0x0, @any, 0x3}, 0xe) socket$unix(0x1, 0x5, 0x0) (async) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x1, 0x8, 0x7e, 0x8, 0x3, 0x80000000, 0x20000006, 0x4f, 0x6, 0x5d, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x8000024, 0xd, 0x7, 0xfffffffc, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x88, 0x6, 0xffff, 0x0, 0x5, 0x4, 0x8008, 0x400, 0x80, 0x0, 0x5, 0x1006, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e6, 0x3, 0xf9, 0xe, 0x2bc, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x2000, 0xd, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x400, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f2e, 0xd, 0x4e2, 0x2, 0x4, 0xb, 0xc, 0x9, 0x8, 0x9, 0x6, 0x43, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x9, 0x3, 0x9, 0x1, 0x3, 0x3, 0x81, 0x48c93690, 0x42, 0x3], [0x7, 0x63fa0f21, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0x100b, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xce, 0x2, 0x3, 0x27ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x3c484551], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x93a, 0x5, 0x6, 0x0, 0x100, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x2000004, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x5, 0x4, 0xc8, 0xfffffff9, 0xfffff000, 0x10000, 0x0, 0x7b, 0x100, 0x9602, 0x7, 0xaf, 0x5, 0x6, 0x223, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0xfffffffe, 0x4, 0x5, 0xb1e, 0xd7, 0xdd3, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r3, &(0x7f0000000100)={0xa, 0xfffe, 0x3, @mcast2={0xff, 0x3}}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r3, 0x29, 0x36, &(0x7f0000000340)=ANY=[], 0x8) (async) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000080)='batadv0\x00', 0x10) (async) setsockopt$inet6_IPV6_DSTOPTS(r3, 0x29, 0x3b, &(0x7f0000000280)=ANY=[], 0x68) (async) sendto$inet6(r3, 0x0, 0x0, 0x0, 0x0, 0x0) (async) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) (async) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x80000) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) (async) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0) pwrite64(r6, &(0x7f00000001c0)='n', 0x1, 0xb) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000fff626bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="715a0300231a05002400128009000100626f6e640000000001000080050001000500000005001b0000000000"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) (async) tgkill(r4, r4, 0x2e) (async) r7 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r7, 0xe) (async) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [@IFLA_MASTER={0x8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) 3.24890252s ago: executing program 5 (id=4775): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x100000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000008c0)='./sys\x00', &(0x7f0000000900)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/block/nvme0n1/wwid\x00', 0x0, 0x0) read(r1, &(0x7f00000009c0), 0x100) openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/block/nvme0n1/wwid\x00', 0x0, 0x0) 2.66490684s ago: executing program 3 (id=4776): r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, 0x0, 0x0) 2.546338035s ago: executing program 5 (id=4777): bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0xf, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1ffffc}, {{}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0x6, 0x9, 0x0, 0x6, 0xfffffff7}, {0x4, 0x0, 0x0, 0x6}}, [], {{0x5, 0x1, 0x5, 0x3}, {0x5, 0x0, 0xb, 0x3, 0x0, 0x2, 0xfffffff7}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40f30c749308010102030109024a0001010080fa0904"], 0x0) 2.434570406s ago: executing program 3 (id=4778): bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010"], 0x48}}, 0x0) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x3f) 2.152833621s ago: executing program 2 (id=4779): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf64(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="7f454c46020007ac42000000000000000300d9db3b6cffffd801000000000000400000000040000080000000000000003800010078001f00090000000070010100000700d7e75f15ba5bb48433606599000000000000ffff0010deecfb19c0cf0000000000050000000000400008000000000000008a4a0000000000003b06000000000000755a11f9c68ae300"/161], 0xa1) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f00000025c0), 0x0, 0x0, 0x0) close(r1) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="687f6d54e308ca40ad3cf91322914fbae3c55458c0e4f76c167e4941aef24d81d10738ab0bc71ac57b54aba0b95c88124d56d59ec69dd163ce693d72a5acb60bbd12a2aebb343cebacbc07c4c478d8ce6cd22f384bd289e8b9eca4e34663f1b6b298dbef99a16acfd38295f2ef8e4c0cbab369a914dbb9beece0bcf07d6f13f7c140540d4f3db73d7aa7b494572965b3c72a", 0x92) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000010000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d83923dd29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e1a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080e71113610e10d858e8327edb1fb6c86adac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18c65ae1bd4f4390af9a9ceafd07ed00b0000002cab154ad029a1090000002780870014f51c3c975d5aec84222fff0d7216fdb0d3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a2a71bc85018e5ff2c910496f18afc9ffc2cc788bee1b47683db01a469398685211bbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2acb72c7ead0509d380578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9624d37c10223fdae7ed04935c3c9068000000bc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b40000000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f3ca1664fe2f3ced8416dc180604b60c2499d16d7d9158ffffffff00000000ef069dc42749289f854797f2f900c2a12d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a9e90d7676074a0bde4471414c99d4894ee7f8139dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8070000001fa83ee830548f11e1038debd64cbe359454a3f2239cfe35f81b7aded448859968ff0e90500d0b07c0dd00490f167e6d5c1109681739dc33f75b2042b8ff8c21ad702cca54728acad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd20785f653b621491d04aaee0d409731091f4fb94c06006e3c1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e1590bab105b0cb578af7dc7d5e87d48d376444e2de02f47c61e8e84ff828de453f34c2b08660b080efc707e676e1fb4d5865c0ca177a4c7fbb4e829ab0894a1062b445c00f576b2b5cc7f819abd0f885cc4806f47ffb966fcf1e54f5a2d38708194cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d3676329bb8cda690d192a070886df42b2708398773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169cdfaa4252d4ea6b8f6216ff202b5b5a182cb5e8380100632d03a7ca6f6d0339f9953c30930804fdc3690d10ecb65dc5b47481edbf1eee2e8893e903054d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026def743f1213bf817becd9e5a225d67521d1128eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979030000007081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f324661351df747aa6a65872dfdcfa68f65bd06b4082d43e121861b5cc09b986bf56c747d9a1cc5b506892c3a16ff10feea20bdac89bfb758cf35"], 0x0}, 0x94) r2 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='pids.events\x00', 0x275a, 0x0) write$binfmt_misc(r3, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000002c0)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd00ac6700000000000000000000c2888e7d52164ec480e79200000100", [0x0, 0x2000000000001]}}) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$getregs(0xc, r4, 0xd7d, &(0x7f0000000580)=""/190) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SOUND_MIXER_WRITE_RECSRC(r5, 0xc0044dff, &(0x7f0000000200)=0xb) readlinkat(0xffffffffffffffff, 0x0, 0x0, 0x0) memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) getpid() read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39dcdb) 2.101371804s ago: executing program 3 (id=4780): bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1, 0x4, 0x2, 0x7}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getpeername$netlink(r0, &(0x7f0000000340), &(0x7f0000000540)=0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x10000}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x48) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1.800593312s ago: executing program 3 (id=4781): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x10) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x81, 0x0, 'queue0\x00'}) write$sndseq(r4, 0x0, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) write$sndseq(r5, 0x0, 0x0) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000880)={0x0, 0xfffffffe, 0x0, 0x4, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x8000, 0x3, 0xbaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8684, 0x2, 0x40040001, 0x334, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 0s ago: executing program 4 (id=4782): r0 = openat$sndtimer(0xffffff9c, &(0x7f0000000080), 0x8040) shmget(0x1, 0x1000, 0x2, &(0x7f00003ae000/0x1000)=nil) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) syz_open_dev$sndpcmp(0x0, 0xfffffffffffffff1, 0x402000) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) landlock_create_ruleset(&(0x7f00000001c0)={0xa019, 0x1, 0x3}, 0x18, 0x0) r3 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$ARCH_MAP_VDSO_64(0x1e, r4, 0x2, 0x2003) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$NILFS_IOCTL_GET_VINFO(r7, 0xc0186e86, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x48, 0x2, 0x48, 0x6}, {0x28, 0xc, 0x85, 0xdffff038}]}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r5, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0xfffbffff, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) move_pages(r4, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000440)={{0x3, 0x3, 0xfffffffd, 0x1, 0x12}, 0x101, 0xdf, 'id1\x00', 'timer1\x00', 0x0, 0xdf46, 0x4000000000000001, 0x6602, 0x1}) kernel console output (not intermixed with test programs): 4967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23511 comm="syz.1.3875" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f214dd9de42 code=0x7fc00000 [ 1167.869678][ T29] audit: type=1326 audit(1786967828.973:12609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23511 comm="syz.1.3875" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f214dd9de42 code=0x7fc00000 [ 1168.020119][ T29] audit: type=1326 audit(1786967829.013:12610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23511 comm="syz.1.3875" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f214dd9de42 code=0x7fc00000 [ 1168.141633][T23557] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3887'. [ 1169.264908][T23575] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3891'. [ 1169.901485][T23590] SQUASHFS error: Failed to read block 0x0: -5 [ 1169.934037][T23590] unable to read squashfs_super_block [ 1170.353881][T23214] Bluetooth: hci1: unexpected event for opcode 0x3905 [ 1172.551072][T23613] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3902'. [ 1172.614978][T23390] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 1172.807253][T23390] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1172.835481][T23390] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1172.859588][T23390] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1172.875801][T23621] fuse: fd is not a fuse device [ 1172.899104][T23390] usb 3-1: config 0 descriptor?? [ 1173.580591][T23390] usbhid 3-1:0.0: can't add hid device: -71 [ 1173.644714][T23390] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1174.056114][ T29] audit: type=1326 audit(1786967836.986:12611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23620 comm="syz.3.3904" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7f6c3bac5cba code=0x7fc00000 [ 1174.268396][T23390] usb 3-1: USB disconnect, device number 55 [ 1174.773722][T23390] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 1174.983532][T23390] usb 3-1: Using ep0 maxpacket: 32 [ 1175.740219][T23390] usb 3-1: device descriptor read/all, error -71 [ 1176.084157][T23651] SQUASHFS error: Failed to read block 0x0: -5 [ 1176.125842][T23651] unable to read squashfs_super_block [ 1176.234007][T23657] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3914'. [ 1176.533004][T23214] Bluetooth: hci3: unexpected event for opcode 0x3905 [ 1176.638057][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1183.218162][T23712] SQUASHFS error: Failed to read block 0x0: -5 [ 1183.224820][T23712] unable to read squashfs_super_block [ 1184.098117][ T5696] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 1184.320700][ T5696] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1184.341758][ T5696] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1184.362770][ T5696] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1184.408713][ T5696] usb 6-1: config 0 descriptor?? [ 1184.427887][ T5788] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 1184.543589][T23724] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3933'. [ 1184.583442][ T5788] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1184.597748][ T5788] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1184.661257][ T5788] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1184.703652][ T5788] usb 5-1: config 0 descriptor?? [ 1184.720837][ T5696] usbhid 6-1:0.0: can't add hid device: -71 [ 1184.747091][ T5696] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1184.793139][ T5696] usb 6-1: USB disconnect, device number 28 [ 1184.955875][ T5788] usbhid 5-1:0.0: can't add hid device: -71 [ 1184.981696][ T5788] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1185.022435][ T5788] usb 5-1: USB disconnect, device number 58 [ 1185.327286][ T5696] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1185.467269][ T5788] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 1185.497201][ T5696] usb 6-1: Using ep0 maxpacket: 32 [ 1185.516317][ T5696] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1185.543288][ T5696] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1185.570065][ T5696] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1185.602580][ T5696] usb 6-1: config 0 descriptor?? [ 1185.633682][ T5696] ldusb 6-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1185.637085][ T5788] usb 5-1: Using ep0 maxpacket: 32 [ 1185.688506][ T5788] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1185.699986][ T5696] ldusb 6-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1185.731969][ T5788] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1185.772138][ T5788] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1185.822301][ T5788] usb 5-1: config 0 descriptor?? [ 1185.859624][ T5788] ldusb 5-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1185.920136][ T5788] ldusb 5-1:0.0: LD USB Device #1 now attached to major 180 minor 1 [ 1186.293456][ T5788] usb 6-1: USB disconnect, device number 29 [ 1186.315634][ T5788] ldusb 6-1:0.0: LD USB Device #0 now disconnected [ 1186.335992][ T5696] usb 5-1: USB disconnect, device number 59 [ 1186.375687][ T5696] ldusb 5-1:0.0: LD USB Device #1 now disconnected [ 1189.302900][T23214] Bluetooth: hci3: unexpected event for opcode 0x3905 [ 1190.317978][T16727] Bluetooth: hci3: unexpected event for opcode 0x3905 [ 1190.734560][T16727] Bluetooth: hci1: unexpected event for opcode 0x3905 [ 1192.114209][T23805] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3954'. [ 1193.231807][ T29] audit: type=1326 audit(1786967856.356:12612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23803 comm="syz.4.3953" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7f76d9072cba code=0x7fc00000 [ 1194.632746][T23214] Bluetooth: hci3: unexpected event for opcode 0x3905 [ 1195.250145][T16727] Bluetooth: hci1: unexpected event for opcode 0x3905 [ 1196.110812][T16727] Bluetooth: hci4: unexpected event for opcode 0x3905 [ 1196.564749][T16727] Bluetooth: hci3: unexpected event for opcode 0x3905 [ 1196.927609][T23855] nvmet: disable ns before setting buffered_io value. [ 1196.990660][T23855] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 1197.209703][T23855] nvme_fabrics: missing parameter 'transport=%s' [ 1197.330411][T23855] nvme_fabrics: missing parameter 'nqn=%s' [ 1197.480477][T23214] Bluetooth: hci4: unexpected event for opcode 0x3905 [ 1201.592253][T16727] Bluetooth: hci3: unexpected event for opcode 0x3905 [ 1204.615977][ T5703] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 1204.796319][ T5703] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1204.887998][ T5703] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1204.969393][ T5703] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1205.170535][ T5703] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1205.260033][T16727] Bluetooth: hci1: unexpected event for opcode 0x3905 [ 1205.644441][ T5703] usb 6-1: config 0 descriptor?? [ 1205.935279][T23390] usb 6-1: USB disconnect, device number 30 [ 1206.020892][T23930] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3982'. [ 1206.454522][T23390] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 1206.644366][T23390] usb 6-1: Using ep0 maxpacket: 32 [ 1206.673741][T23390] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1206.722573][T23390] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1206.798882][T23390] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1206.852487][T23390] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1206.906812][T23390] usb 6-1: config 0 descriptor?? [ 1207.782317][ T5725] usb 6-1: USB disconnect, device number 31 [ 1209.731219][T16727] Bluetooth: hci3: unexpected event for opcode 0x3905 [ 1214.742028][T11058] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 1214.996817][T11058] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1215.020969][T11058] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1215.052902][T11058] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1215.467806][T11058] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1215.481762][T11058] usb 6-1: config 0 descriptor?? [ 1215.499788][T11058] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1215.717467][T11058] usb 6-1: USB disconnect, device number 32 [ 1216.796964][T11058] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 1217.088091][T11058] usb 6-1: Using ep0 maxpacket: 32 [ 1217.093895][T11058] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1217.122573][T11058] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1217.175481][T11058] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1217.255050][T11058] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1217.310012][T11058] usb 6-1: config 0 descriptor?? [ 1217.409541][T11058] ldusb 6-1:0.0: Interrupt in endpoint not found [ 1217.531086][T11058] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1218.604778][ T5788] usb 6-1: USB disconnect, device number 33 [ 1218.975922][T23214] Bluetooth: hci3: unexpected event for opcode 0x3905 [ 1222.091845][T24075] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4014'. [ 1225.030054][T24113] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4020'. [ 1226.285778][T24124] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4022'. [ 1226.648626][T24134] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4023'. [ 1227.587336][T24156] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4027'. [ 1228.431304][ T5594] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 1228.691937][ T5594] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1228.731501][ T5594] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1229.140822][ T5594] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1229.165205][ T5594] usb 3-1: config 0 descriptor?? [ 1229.454613][ T5594] usbhid 3-1:0.0: can't add hid device: -71 [ 1229.477327][ T5594] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1229.526574][ T5594] usb 3-1: USB disconnect, device number 58 [ 1235.682699][T24230] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4046'. [ 1236.663364][T24255] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4049'. [ 1238.079603][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1243.132380][T23214] Bluetooth: hci1: unexpected event for opcode 0x3905 [ 1248.112109][T11058] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 1248.339911][T11058] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1248.361840][T11058] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1248.420631][T11058] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1248.508342][T11058] usb 5-1: config 0 descriptor?? [ 1248.749464][T11058] usbhid 5-1:0.0: can't add hid device: -71 [ 1248.779314][T11058] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1248.865373][T11058] usb 5-1: USB disconnect, device number 60 [ 1249.281639][T11058] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 1249.500739][T11058] usb 5-1: Using ep0 maxpacket: 32 [ 1249.520678][T11058] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1249.559341][T11058] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1249.598024][T11058] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1249.635564][T11058] usb 5-1: config 0 descriptor?? [ 1249.688648][T11058] ldusb 5-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1249.791377][T11058] ldusb 5-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1250.129551][ T5725] usb 5-1: USB disconnect, device number 61 [ 1250.184026][ T5725] ldusb 5-1:0.0: LD USB Device #0 now disconnected [ 1251.058366][T16727] Bluetooth: hci4: unexpected event for opcode 0x3905 [ 1251.897156][T11058] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 1252.088620][T11058] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1252.132551][T11058] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1252.176897][T11058] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1252.226928][T11058] usb 5-1: config 0 descriptor?? [ 1252.488593][T11058] usbhid 5-1:0.0: can't add hid device: -71 [ 1252.520631][T11058] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1252.573246][T11058] usb 5-1: USB disconnect, device number 62 [ 1253.486087][T11058] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 1254.027278][T11058] usb 5-1: Using ep0 maxpacket: 32 [ 1254.033252][T11058] usb 5-1: New USB device found, idVendor=0911, idProduct=3333, bcdDevice= 0.40 [ 1254.044239][T11058] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1254.055880][T11058] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1254.178141][T11058] usb 5-1: config 0 descriptor?? [ 1254.989377][T11058] usbhid 5-1:0.0: can't add hid device: -71 [ 1255.029067][T11058] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1255.057749][T11058] usb 5-1: USB disconnect, device number 63 [ 1256.475059][ T3359] nvmet: connect request for invalid subsystem test! [ 1256.577198][T24403] nvme nvme77: Connect Invalid Data Parameter, subsysnqn "test" [ 1257.284078][T24407] nvme_fabrics: missing parameter 'nqn=%s' [ 1258.200948][ T3359] nvmet: connect request for invalid subsystem test! [ 1258.240411][T24418] nvme nvme77: Connect Invalid Data Parameter, subsysnqn "test" [ 1258.854138][ T4914] Bluetooth: hci1: unexpected event for opcode 0x3905 [ 1260.638782][T24442] SQUASHFS error: Failed to read block 0x0: -5 [ 1260.675204][T24442] unable to read squashfs_super_block [ 1261.097822][ T3359] nvmet: Created nvm controller 78 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:1fddafc3-3ef5-4828-9083-380ea0558069. [ 1261.233962][T24445] nvme nvme77: creating 2 I/O queues. [ 1261.400295][T24445] nvme nvme77: new ctrl: "testsubsys" [ 1262.099919][ T99] nvmet: connect request for invalid subsystem test! [ 1262.182388][T24459] nvme nvme78: Connect Invalid Data Parameter, subsysnqn "test" [ 1263.579597][T16727] Bluetooth: hci1: unexpected event for opcode 0x3905 [ 1264.132353][T23214] Bluetooth: hci4: unexpected event for opcode 0x3905 [ 1269.472776][T24552] syzkaller0: entered promiscuous mode [ 1269.513600][T24552] syzkaller0: entered allmulticast mode [ 1273.241681][T24579] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4133'. [ 1275.736893][T16727] Bluetooth: hci1: unexpected event for opcode 0x3905 [ 1280.373007][T24652] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4151'. [ 1281.991182][T11058] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 1282.171952][T11058] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1282.212275][T11058] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1282.246753][T11058] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1282.345720][T11058] usb 5-1: config 0 descriptor?? [ 1282.352733][T24683] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4157'. [ 1282.585309][T11058] usbhid 5-1:0.0: can't add hid device: -71 [ 1282.615130][T11058] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1282.707191][T11058] usb 5-1: USB disconnect, device number 64 [ 1282.824532][T16727] Bluetooth: hci4: unexpected event for opcode 0x3905 [ 1283.537894][T11058] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 1283.747769][T11058] usb 5-1: Using ep0 maxpacket: 32 [ 1283.847443][T11058] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1283.873772][T11058] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1283.914431][T11058] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1284.373947][T11058] usb 5-1: config 0 descriptor?? [ 1284.528259][T11058] usb 5-1: can't set config #0, error -71 [ 1284.544395][T11058] usb 5-1: USB disconnect, device number 65 [ 1284.882544][T24719] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4168'. [ 1291.751983][T24775] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4184'. [ 1299.446615][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1303.445993][T11058] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 1303.646377][T11058] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1303.708497][T11058] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1303.935937][T11058] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1304.645810][T11058] usb 6-1: config 0 descriptor?? [ 1304.901383][T11058] usbhid 6-1:0.0: can't add hid device: -71 [ 1304.929738][T11058] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1304.962534][T11058] usb 6-1: USB disconnect, device number 34 [ 1305.064880][ T5696] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 1305.237352][ T5696] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1305.276314][ T5696] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1305.315181][ T5696] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1305.368880][ T5696] usb 3-1: config 0 descriptor?? [ 1305.424651][T11058] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 1305.613483][ T5696] usbhid 3-1:0.0: can't add hid device: -71 [ 1305.626147][T11058] usb 6-1: Using ep0 maxpacket: 32 [ 1305.647320][ T5696] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1305.665875][T11058] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1305.716416][T11058] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1305.757638][T11058] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1305.772114][ T5696] usb 3-1: USB disconnect, device number 59 [ 1305.827588][T11058] usb 6-1: config 0 descriptor?? [ 1305.889647][T11058] ldusb 6-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1305.966174][T11058] ldusb 6-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1306.350398][T11058] usb 6-1: USB disconnect, device number 35 [ 1306.354144][ T5696] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 1306.838498][T11058] ldusb 6-1:0.0: LD USB Device #0 now disconnected [ 1306.966709][ T5696] usb 3-1: Using ep0 maxpacket: 32 [ 1306.989019][ T5696] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1307.026617][ T5696] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1307.064925][ T5696] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1307.107750][ T5696] usb 3-1: config 0 descriptor?? [ 1307.180308][ T5696] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1307.244525][ T5696] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1308.850292][ T5725] usb 3-1: USB disconnect, device number 60 [ 1309.271106][ T5725] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 1310.255079][T24929] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4224'. [ 1314.437942][T16727] Bluetooth: hci1: unexpected event for opcode 0x3905 [ 1315.130596][T24998] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4241'. [ 1321.554921][ T5594] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 1321.726565][ T5594] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1321.765647][ T5594] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1321.824830][ T5594] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1321.947365][ T5594] usb 6-1: config 0 descriptor?? [ 1322.589286][ T5594] usbhid 6-1:0.0: can't add hid device: -71 [ 1323.437081][ T5594] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1323.447991][ T5594] usb 6-1: USB disconnect, device number 36 [ 1324.243671][ T5594] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 1324.622084][T25091] nvmet: disable ns before setting buffered_io value. [ 1324.655291][T25091] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 1324.953654][ T6764] nvmet: Created nvm controller 79 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:1fddafc3-3ef5-4828-9083-380ea0558069. [ 1325.518058][T25091] nvme nvme78: creating 2 I/O queues. [ 1325.526993][T25091] nvme nvme78: new ctrl: "testsubsys" [ 1326.640170][T25119] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4274'. [ 1327.252219][ T5788] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 1327.857497][ T5788] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1327.924192][ T5788] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1327.975201][ T5788] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1328.007036][T25140] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4282'. [ 1328.078887][T25150] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4283'. [ 1328.146213][ T5788] usb 5-1: config 0 descriptor?? [ 1328.387670][ T5788] usbhid 5-1:0.0: can't add hid device: -71 [ 1328.410879][ T5788] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1328.470132][ T5788] usb 5-1: USB disconnect, device number 66 [ 1328.940919][ T5788] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 1329.138238][ T5788] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1329.182085][ T5788] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1329.227635][T25169] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4285'. [ 1329.253901][ T5788] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1329.290691][ T5788] usb 5-1: config 0 descriptor?? [ 1329.292937][T25178] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4286'. [ 1329.801095][ T5788] usbhid 5-1:0.0: can't add hid device: -71 [ 1329.817530][ T5788] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1329.847245][ T5788] usb 5-1: USB disconnect, device number 67 [ 1331.948383][T25216] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4295'. [ 1333.545328][T16727] Bluetooth: hci1: unexpected event for opcode 0x3905 [ 1334.426756][T25242] SQUASHFS error: Failed to read block 0x0: -5 [ 1334.457511][T25242] unable to read squashfs_super_block [ 1335.370466][T25255] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4303'. [ 1335.515718][T25262] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4305'. [ 1335.656912][ T5725] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 1335.857480][ T5725] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1335.889106][ T5725] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1335.928708][ T5725] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1335.960037][ T5725] usb 6-1: config 0 descriptor?? [ 1336.213256][ T5725] usbhid 6-1:0.0: can't add hid device: -71 [ 1336.239343][ T5725] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1336.313127][ T5725] usb 6-1: USB disconnect, device number 38 [ 1336.745758][ T5725] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 1341.718547][T25327] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4318'. [ 1342.037584][T25334] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4319'. [ 1342.712133][ T5788] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 1343.322563][ T5788] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1343.339456][ T5788] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1343.391990][ T5594] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 1343.401089][ T5788] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1343.465605][ T5788] usb 6-1: config 0 descriptor?? [ 1343.761256][ T5594] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1343.778596][ T5788] usbhid 6-1:0.0: can't add hid device: -71 [ 1343.798115][ T5788] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1343.888772][T23214] Bluetooth: hci4: unexpected event for opcode 0x3905 [ 1344.234152][ T5594] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1344.278385][ T5594] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1344.293267][ T5788] usb 6-1: USB disconnect, device number 40 [ 1344.326737][ T5594] usb 5-1: config 0 descriptor?? [ 1345.160357][ T5594] usbhid 5-1:0.0: can't add hid device: -71 [ 1345.182669][ T5594] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1345.213122][ T5594] usb 5-1: USB disconnect, device number 68 [ 1345.250649][ T5788] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 1345.431970][ T5788] usb 6-1: Using ep0 maxpacket: 32 [ 1345.513030][ T5788] usb 6-1: device descriptor read/all, error -71 [ 1345.642790][T25386] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4334'. [ 1345.690494][ T5594] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 1346.052568][ T5594] usb 5-1: Using ep0 maxpacket: 32 [ 1346.079659][ T5594] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1346.118433][ T5594] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1346.159808][ T5594] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1346.198260][ T5594] usb 5-1: config 0 descriptor?? [ 1346.224058][ T5594] ldusb 5-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1346.317871][ T5594] ldusb 5-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1346.958503][ T5696] usb 5-1: USB disconnect, device number 69 [ 1347.003701][ T5696] ldusb 5-1:0.0: LD USB Device #0 now disconnected [ 1350.817314][ T5788] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 1350.998227][ T5788] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1351.133232][T25453] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4352'. [ 1351.173462][ T5788] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1351.200473][ T5788] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1351.776409][ T5788] usb 5-1: config 0 descriptor?? [ 1352.008811][ T5788] usbhid 5-1:0.0: can't add hid device: -71 [ 1352.026271][ T5788] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1352.065119][ T5788] usb 5-1: USB disconnect, device number 70 [ 1352.169238][T25460] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4353'. [ 1353.115858][ T5788] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 1353.797145][ T5788] usb 5-1: Using ep0 maxpacket: 32 [ 1353.831342][ T5788] usb 5-1: New USB device found, idVendor=0911, idProduct=3333, bcdDevice= 0.40 [ 1354.029758][ T5788] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1354.063083][ T5788] usb 5-1: can't read configurations, error -71 [ 1356.101576][T25534] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4371'. [ 1356.366819][T25546] FAULT_INJECTION: forcing a failure. [ 1356.366819][T25546] name failslab, interval 1, probability 0, space 0, times 1 [ 1356.426791][T25546] CPU: 0 UID: 0 PID: 25546 Comm: syz.2.4373 Tainted: G L syzkaller #0 PREEMPT(full) [ 1356.426825][T25546] Tainted: [L]=SOFTLOCKUP [ 1356.426832][T25546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1356.426845][T25546] Call Trace: [ 1356.426852][T25546] [ 1356.426861][T25546] dump_stack_lvl+0x100/0x190 [ 1356.426885][T25546] should_fail_ex.cold+0x5/0xa [ 1356.426901][T25546] should_failslab+0xc2/0x120 [ 1356.426918][T25546] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1356.426934][T25546] ? vm_area_dup+0x27/0x8e0 [ 1356.426948][T25546] vm_area_dup+0x27/0x8e0 [ 1356.426959][T25546] __split_vma+0x18c/0xda0 [ 1356.426973][T25546] ? __pfx___split_vma+0x10/0x10 [ 1356.426992][T25546] vma_modify+0x12ad/0x25c0 [ 1356.427010][T25546] ? __pfx_vma_modify+0x10/0x10 [ 1356.427022][T25546] ? find_held_lock+0x2b/0x80 [ 1356.427034][T25546] ? is_bpf_text_address+0x8a/0x1a0 [ 1356.427051][T25546] ? bpf_ksym_find+0x128/0x1c0 [ 1356.427076][T25546] vma_modify_flags+0x257/0x3d0 [ 1356.427088][T25546] ? __pfx_vma_modify_flags+0x10/0x10 [ 1356.427108][T25546] ? __pfx_ima_file_mprotect+0x10/0x10 [ 1356.427121][T25546] ? __pfx__kstrtoull+0x10/0x10 [ 1356.427132][T25546] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1356.427149][T25546] mprotect_fixup+0x27a/0xe30 [ 1356.427164][T25546] ? __pfx_mprotect_fixup+0x10/0x10 [ 1356.427184][T25546] ? selinux_file_mprotect+0x155/0x5f0 [ 1356.427197][T25546] ? __pfx_mas_prev+0x10/0x10 [ 1356.427217][T25546] do_mprotect_pkey+0xa4b/0xef0 [ 1356.427233][T25546] ? __pfx_do_mprotect_pkey+0x10/0x10 [ 1356.427250][T25546] ? trace_buffer_unlock_commit_regs+0x375/0x540 [ 1356.427275][T25546] ? trace_syscall_enter+0xd9/0x110 [ 1356.427291][T25546] ? trace_syscall_enter+0xd9/0x110 [ 1356.427309][T25546] __x64_sys_mprotect+0x78/0xc0 [ 1356.427321][T25546] do_syscall_64+0x115/0x870 [ 1356.427334][T25546] ? clear_bhb_loop+0x70/0xc0 [ 1356.427349][T25546] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1356.427361][T25546] RIP: 0033:0x7f389659e0d9 [ 1356.427375][T25546] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1356.427386][T25546] RSP: 002b:00007f3897381028 EFLAGS: 00000246 ORIG_RAX: 000000000000000a [ 1356.427401][T25546] RAX: ffffffffffffffda RBX: 00007f3896825fa0 RCX: 00007f389659e0d9 [ 1356.427409][T25546] RDX: 0000000000000001 RSI: 000000000000f000 RDI: 0000200000000000 [ 1356.427416][T25546] RBP: 00007f3897381090 R08: 0000000000000000 R09: 0000000000000000 [ 1356.427423][T25546] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1356.427429][T25546] R13: 00007f3896826038 R14: 00007f3896825fa0 R15: 00007ffe6052a6e8 [ 1356.427445][T25546] [ 1357.311504][T11058] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 1357.517566][T11058] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1357.569701][T11058] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1357.590930][T25565] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4378'. [ 1357.630177][T11058] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1357.672736][T11058] usb 6-1: config 0 descriptor?? [ 1357.743215][ T5788] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 1357.912999][ T5788] usb 3-1: Using ep0 maxpacket: 16 [ 1357.925284][T11058] usbhid 6-1:0.0: can't add hid device: -71 [ 1357.943483][ T5788] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1357.951237][T11058] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1357.968758][ T5788] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1357.987873][T11058] usb 6-1: USB disconnect, device number 43 [ 1358.013244][ T5788] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1358.048296][ T5788] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1358.074673][ T5788] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 112, changing to 7 [ 1358.136422][ T5788] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 25967, setting to 1024 [ 1358.176282][ T5788] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1358.195396][ T5788] usb 3-1: Product: syz [ 1358.205655][ T5788] usb 3-1: Manufacturer: syz [ 1358.217182][ T5788] usb 3-1: SerialNumber: syz [ 1358.443992][T11058] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 1358.652553][T11058] usb 6-1: Using ep0 maxpacket: 32 [ 1358.680805][T11058] usb 6-1: New USB device found, idVendor=0f11, idProduct=3321, bcdDevice= 0.40 [ 1358.718193][T11058] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1358.753853][T11058] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1358.831843][T11058] usb 6-1: config 0 descriptor?? [ 1359.312946][T11058] usbhid 6-1:0.0: can't add hid device: -71 [ 1359.337664][T11058] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1359.396669][T11058] usb 6-1: USB disconnect, device number 44 [ 1360.218481][T25599] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=31 sclass=netlink_route_socket pid=25599 comm=syz.4.4386 [ 1360.290400][T25602] 9p: Bad value for 'rfdno' [ 1360.474886][ T5788] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 1360.883085][ T5788] cdc_ncm 3-1:1.0: bind() failure [ 1360.918755][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.015647][ T5788] usb 3-1: USB disconnect, device number 61 [ 1361.057511][T25608] No source specified [ 1361.086694][ T29] audit: type=1400 audit(1786968024.318:12613): avc: denied { mount } for pid=25607 comm="syz.4.4389" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 1362.150433][T25618] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 1362.176809][ T29] audit: type=1326 audit(1786968025.408:12614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=25617 comm="syz.2.4393" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=228 compat=0 ip=0x7f3897388cba code=0x0 [ 1362.244198][T25625] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1545 sclass=netlink_route_socket pid=25625 comm=syz.2.4393 [ 1362.308853][T25625] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4393'. [ 1362.345036][T25625] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4393'. [ 1362.398068][T25625] geneve2: entered promiscuous mode [ 1362.405633][T25625] geneve2: entered allmulticast mode [ 1362.425390][ T29] audit: type=1400 audit(1786968025.658:12615): avc: denied { listen } for pid=25628 comm="syz.5.4397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1362.758299][ T5788] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 1362.950331][ T5788] usb 5-1: device descriptor read/64, error -71 [ 1363.393009][ T5788] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 1363.454546][T25639] openvswitch: netlink: Message has 8 unknown bytes. [ 1363.549668][ T5788] usb 5-1: device descriptor read/64, error -71 [ 1363.690999][ T5788] usb usb5-port1: attempt power cycle [ 1364.511560][ T5788] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1365.385844][ T5788] usb 5-1: device not accepting address 75, error -71 [ 1365.406339][ T29] audit: type=1400 audit(1786968028.640:12616): avc: denied { unmount } for pid=5593 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 1365.502230][T25661] netlink: 'syz.2.4406': attribute type 21 has an invalid length. [ 1365.551964][T25664] netlink: 'syz.2.4406': attribute type 21 has an invalid length. [ 1365.567906][T25661] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4406'. [ 1366.133373][T25667] FAULT_INJECTION: forcing a failure. [ 1366.133373][T25667] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 1366.146743][T25667] CPU: 0 UID: 0 PID: 25667 Comm: syz.4.4407 Tainted: G L syzkaller #0 PREEMPT(full) [ 1366.146776][T25667] Tainted: [L]=SOFTLOCKUP [ 1366.146784][T25667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1366.146797][T25667] Call Trace: [ 1366.146804][T25667] [ 1366.146813][T25667] dump_stack_lvl+0x100/0x190 [ 1366.146846][T25667] should_fail_ex.cold+0x5/0xa [ 1366.146873][T25667] strncpy_from_user+0x3b/0x2d0 [ 1366.146905][T25667] __do_sys_add_key+0xd4/0x460 [ 1366.146932][T25667] ? __pfx___do_sys_add_key+0x10/0x10 [ 1366.146955][T25667] ? find_held_lock+0x2b/0x80 [ 1366.146986][T25667] do_syscall_64+0x115/0x870 [ 1366.147009][T25667] ? clear_bhb_loop+0x70/0xc0 [ 1366.147035][T25667] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1366.147057][T25667] RIP: 0033:0x7f76d819e0d9 [ 1366.147075][T25667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1366.147095][T25667] RSP: 002b:00007f76d904a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 1366.147116][T25667] RAX: ffffffffffffffda RBX: 00007f76d8426090 RCX: 00007f76d819e0d9 [ 1366.147130][T25667] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000200000000300 [ 1366.147144][T25667] RBP: 00007f76d904a090 R08: ffffffffffffffff R09: 0000000000000000 [ 1366.147157][T25667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1366.147170][T25667] R13: 00007f76d8426128 R14: 00007f76d8426090 R15: 00007ffff4da5d98 [ 1366.147198][T25667] [ 1366.623751][T25664] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4406'. [ 1366.658531][T25661] netlink: 3 bytes leftover after parsing attributes in process `syz.2.4406'. [ 1366.742377][T25664] netlink: 3 bytes leftover after parsing attributes in process `syz.2.4406'. [ 1366.981743][ T29] audit: type=1400 audit(1786968030.221:12617): avc: denied { execute } for pid=25671 comm="syz.2.4411" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1367.112722][T25672] Trying to write to read-only block-device nullb0 [ 1368.076599][T25683] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4409'. [ 1369.394426][T25713] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1369.408506][T25713] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1369.506311][T25713] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1369.552540][T25713] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1369.628895][ T5788] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 1369.794119][ T5788] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice= 1.08 [ 1369.961440][ T5788] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1370.113372][ T5788] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 8 [ 1370.203657][ T5788] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1370.244852][ T5788] usb 6-1: Product: syz [ 1370.258823][ T5788] usb 6-1: Manufacturer: syz [ 1370.363122][ T5788] usb 6-1: SerialNumber: syz [ 1370.664073][ T5788] ath6kl: Failed to submit usb control message: -71 [ 1371.021128][ T5788] ath6kl: unable to send the bmi data to the device: -71 [ 1371.140516][ T5788] ath6kl: Unable to send get target info: -71 [ 1371.141957][ T29] audit: type=1400 audit(1786968290.379:12618): avc: denied { connect } for pid=25725 comm="syz.3.4426" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1371.236483][ T5788] ath6kl: Failed to init ath6kl core: -71 [ 1371.258036][ T5788] ath6kl_usb 6-1:1.0: probe with driver ath6kl_usb failed with error -71 [ 1371.336543][ T5788] usb 6-1: USB disconnect, device number 45 [ 1371.779010][T25752] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4434'. [ 1371.865751][T25752] tmpfs: Unknown parameter 'usrquota1:/' [ 1372.146403][ T5788] usb 6-1: new full-speed USB device number 46 using dummy_hcd [ 1372.309712][ T5788] usb 6-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 1372.328908][ T5788] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1372.352795][ T5788] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1372.380820][ T5788] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 9 [ 1372.405611][T25756] nvmet: disable ns before setting buffered_io value. [ 1372.416375][ T5788] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1372.432408][ T5788] usb 6-1: config 0 descriptor?? [ 1372.454739][T25756] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 1372.560402][ T6766] nvmet: Created nvm controller 80 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:1fddafc3-3ef5-4828-9083-380ea0558069. [ 1372.578395][T25756] nvme nvme79: creating 2 I/O queues. [ 1372.591704][T25756] nvme nvme79: new ctrl: "testsubsys" [ 1372.704861][ T5788] usb 6-1: string descriptor 0 read error: -71 [ 1372.754939][ T5788] usbhid 6-1:0.0: can't add hid device: -22 [ 1372.779911][ T5788] usbhid 6-1:0.0: probe with driver usbhid failed with error -22 [ 1372.822473][ T5788] usb 6-1: USB disconnect, device number 46 [ 1374.530904][T25742] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1374.697404][T25783] overlayfs: failed to clone upperpath [ 1375.398929][T25803] FAULT_INJECTION: forcing a failure. [ 1375.398929][T25803] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1375.413092][T25803] CPU: 0 UID: 0 PID: 25803 Comm: syz.5.4450 Tainted: G L syzkaller #0 PREEMPT(full) [ 1375.413128][T25803] Tainted: [L]=SOFTLOCKUP [ 1375.413135][T25803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1375.413149][T25803] Call Trace: [ 1375.413156][T25803] [ 1375.413164][T25803] dump_stack_lvl+0x100/0x190 [ 1375.413197][T25803] should_fail_ex.cold+0x5/0xa [ 1375.413224][T25803] _copy_to_user+0x32/0xd0 [ 1375.413256][T25803] simple_read_from_buffer+0xcb/0x170 [ 1375.413283][T25803] proc_fail_nth_read+0x1af/0x230 [ 1375.413317][T25803] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1375.413352][T25803] ? rw_verify_area+0xce/0x6d0 [ 1375.413381][T25803] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1375.413414][T25803] vfs_read+0x1e4/0xb40 [ 1375.413448][T25803] ? __pfx_vfs_read+0x10/0x10 [ 1375.413479][T25803] ? __fget_files+0x215/0x3d0 [ 1375.413508][T25803] ? __fget_files+0x21f/0x3d0 [ 1375.413545][T25803] ksys_read+0x12a/0x250 [ 1375.413565][T25803] ? __pfx_ksys_read+0x10/0x10 [ 1375.413584][T25803] ? trace_syscall_enter+0xd9/0x110 [ 1375.413621][T25803] do_syscall_64+0x115/0x870 [ 1375.413646][T25803] ? clear_bhb_loop+0x70/0xc0 [ 1375.413673][T25803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1375.413695][T25803] RIP: 0033:0x7f7df0d5e90e [ 1375.413714][T25803] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1375.413733][T25803] RSP: 002b:00007f7deeff5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1375.413755][T25803] RAX: ffffffffffffffda RBX: 00007f7deeff66c0 RCX: 00007f7df0d5e90e [ 1375.413770][T25803] RDX: 000000000000000f RSI: 00007f7deeff60a0 RDI: 0000000000000007 [ 1375.413783][T25803] RBP: 00007f7deeff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1375.413796][T25803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1375.413809][T25803] R13: 00007f7df1026128 R14: 00007f7df1026090 R15: 00007ffca5d69b98 [ 1375.413839][T25803] [ 1377.390666][T25824] nvmet: disable ns before setting buffered_io value. [ 1377.429249][T25824] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 1378.076836][T25835] FAULT_INJECTION: forcing a failure. [ 1378.076836][T25835] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1378.415896][T25835] CPU: 1 UID: 0 PID: 25835 Comm: syz.5.4463 Tainted: G L syzkaller #0 PREEMPT(full) [ 1378.415932][T25835] Tainted: [L]=SOFTLOCKUP [ 1378.415941][T25835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1378.415954][T25835] Call Trace: [ 1378.415963][T25835] [ 1378.415973][T25835] dump_stack_lvl+0x100/0x190 [ 1378.416005][T25835] should_fail_ex.cold+0x5/0xa [ 1378.416033][T25835] _copy_to_user+0x32/0xd0 [ 1378.416065][T25835] simple_read_from_buffer+0xcb/0x170 [ 1378.416092][T25835] proc_fail_nth_read+0x1af/0x230 [ 1378.416126][T25835] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1378.416177][T25835] ? rw_verify_area+0xce/0x6d0 [ 1378.416210][T25835] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1378.416243][T25835] vfs_read+0x1e4/0xb40 [ 1378.416278][T25835] ? __pfx_vfs_read+0x10/0x10 [ 1378.416308][T25835] ? __fget_files+0x215/0x3d0 [ 1378.416338][T25835] ? __fget_files+0x21f/0x3d0 [ 1378.416369][T25835] ksys_read+0x12a/0x250 [ 1378.416389][T25835] ? __pfx_ksys_read+0x10/0x10 [ 1378.416407][T25835] ? trace_syscall_enter+0xd9/0x110 [ 1378.416445][T25835] do_syscall_64+0x115/0x870 [ 1378.416469][T25835] ? clear_bhb_loop+0x70/0xc0 [ 1378.416496][T25835] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1378.416519][T25835] RIP: 0033:0x7f7df0d5e90e [ 1378.416538][T25835] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1378.416558][T25835] RSP: 002b:00007f7df1b87fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1378.416578][T25835] RAX: ffffffffffffffda RBX: 00007f7df1b886c0 RCX: 00007f7df0d5e90e [ 1378.416593][T25835] RDX: 000000000000000f RSI: 00007f7df1b880a0 RDI: 0000000000000004 [ 1378.416606][T25835] RBP: 00007f7df1b88090 R08: 0000000000000000 R09: 0000000000000000 [ 1378.416619][T25835] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1378.416631][T25835] R13: 00007f7df1026038 R14: 00007f7df1025fa0 R15: 00007ffca5d69b98 [ 1378.416662][T25835] [ 1378.913466][T25838] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4464'. [ 1381.383989][ T5788] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 1381.573998][ T5788] usb 6-1: Using ep0 maxpacket: 32 [ 1381.584752][ T5788] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1382.541190][ T5788] usb 6-1: config index 0 descriptor too short (expected 27632, got 27) [ 1384.089253][ T5788] usb 6-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 1384.358988][ T5788] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 1384.368337][ T5788] usb 6-1: config 1 has no interface number 0 [ 1384.374522][ T5788] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1384.385460][ T5788] usb 6-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 1384.398405][ T5788] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1384.503963][T25897] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 1384.643616][ T5788] usb 6-1: can't set config #1, error -71 [ 1384.834685][ T5788] usb 6-1: USB disconnect, device number 47 [ 1386.086209][T25922] SQUASHFS error: Failed to read block 0x0: -5 [ 1386.148538][T25922] unable to read squashfs_super_block [ 1386.724485][T25888] syz.2.4474 (25888): drop_caches: 2 [ 1386.753002][ T5725] usb 6-1: new full-speed USB device number 48 using dummy_hcd [ 1386.882368][T25933] netlink: 'syz.3.4493': attribute type 10 has an invalid length. [ 1386.924921][T25933] batadv0: left promiscuous mode [ 1386.934912][ T5725] usb 6-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 1386.956532][T25933] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:17 [ 1387.000721][ T5725] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1387.042461][ T5725] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1387.054318][T25933] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:17 [ 1387.094089][T25938] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4494'. [ 1387.128801][ T5725] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1387.128932][T25933] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1387.158025][ T6764] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1387.168178][ T5725] usb 6-1: config 0 descriptor?? [ 1387.206356][T25933] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 1387.264012][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:17 [ 1387.702565][ T6764] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1388.119299][ T29] audit: type=1400 audit(1786968307.361:12619): avc: denied { getopt } for pid=25960 comm="syz.4.4499" lport=48229 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 1388.222457][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1388.644003][T25971] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4501'. [ 1388.684167][T25971] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4501'. [ 1388.690065][T25972] FAULT_INJECTION: forcing a failure. [ 1388.690065][T25972] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1388.764301][T25972] CPU: 1 UID: 0 PID: 25972 Comm: syz.2.4503 Tainted: G L syzkaller #0 PREEMPT(full) [ 1388.764336][T25972] Tainted: [L]=SOFTLOCKUP [ 1388.764343][T25972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1388.764355][T25972] Call Trace: [ 1388.764362][T25972] [ 1388.764371][T25972] dump_stack_lvl+0x100/0x190 [ 1388.764401][T25972] should_fail_ex.cold+0x5/0xa [ 1388.764426][T25972] strncpy_from_user+0x3b/0x2d0 [ 1388.764455][T25972] do_getname+0x78/0x390 [ 1388.764485][T25972] do_sys_openat2+0xc7/0x1e0 [ 1388.764511][T25972] ? __pfx_do_sys_openat2+0x10/0x10 [ 1388.764537][T25972] ? trace_buffer_unlock_commit_regs+0x375/0x540 [ 1388.764572][T25972] __x64_sys_openat+0x12d/0x210 [ 1388.764597][T25972] ? __pfx___x64_sys_openat+0x10/0x10 [ 1388.764627][T25972] ? find_held_lock+0x2b/0x80 [ 1388.764647][T25972] ? trace_syscall_enter+0xd9/0x110 [ 1388.764680][T25972] do_syscall_64+0x115/0x870 [ 1388.764704][T25972] ? clear_bhb_loop+0x70/0xc0 [ 1388.764728][T25972] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1388.764748][T25972] RIP: 0033:0x7f389655e90e [ 1388.764764][T25972] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1388.764784][T25972] RSP: 002b:00007f38947f5f18 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1388.764806][T25972] RAX: ffffffffffffffda RBX: 00007f38947f66c0 RCX: 00007f389655e90e [ 1388.764820][T25972] RDX: 0000000000000000 RSI: 00007f389663475f RDI: ffffffffffffff9c [ 1388.764834][T25972] RBP: 00007f38947f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1388.764846][T25972] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1388.764859][T25972] R13: 00007f3896826128 R14: 00007f3896826090 R15: 00007ffe6052a6e8 [ 1388.764887][T25972] [ 1388.832471][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1389.238967][T25957] XFS (nbd5): SB validate failed with error -5. [ 1389.272170][ T5788] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 1389.337543][T25986] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4506'. [ 1389.372408][T25986] bridge0: port 1(bridge_slave_0) entered disabled state [ 1389.404687][T25988] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4506'. [ 1389.446900][ T5788] usb 5-1: Using ep0 maxpacket: 32 [ 1389.453322][ T5788] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1389.478347][ T5788] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1389.506454][ T5788] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1389.515115][ T5788] usb 5-1: Product: syz [ 1389.527342][ T5788] usb 5-1: Manufacturer: syz [ 1389.544291][ T5788] usb 5-1: SerialNumber: syz [ 1389.573630][ T5788] usb 5-1: config 0 descriptor?? [ 1389.682280][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1389.819598][ T5788] smsc75xx 5-1:0.0 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 1389.889802][ T5788] smsc75xx 5-1:0.0: probe with driver smsc75xx failed with error -22 [ 1390.084347][ T5725] usbhid 6-1:0.0: can't add hid device: -71 [ 1390.093472][ T5725] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1390.125341][ T5725] usb 6-1: USB disconnect, device number 48 [ 1390.212266][ T4305] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1391.009692][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1391.201059][T26004] xt_l2tp: wrong L2TP version: 0 [ 1391.210658][T26007] dummy0: entered allmulticast mode [ 1391.613363][T26011] FAULT_INJECTION: forcing a failure. [ 1391.613363][T26011] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1391.728780][T26011] CPU: 1 UID: 0 PID: 26011 Comm: syz.5.4515 Tainted: G L syzkaller #0 PREEMPT(full) [ 1391.728814][T26011] Tainted: [L]=SOFTLOCKUP [ 1391.728822][T26011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1391.728837][T26011] Call Trace: [ 1391.728844][T26011] [ 1391.728853][T26011] dump_stack_lvl+0x100/0x190 [ 1391.728885][T26011] should_fail_ex.cold+0x5/0xa [ 1391.728913][T26011] _copy_to_user+0x32/0xd0 [ 1391.728945][T26011] simple_read_from_buffer+0xcb/0x170 [ 1391.728972][T26011] proc_fail_nth_read+0x1af/0x230 [ 1391.729007][T26011] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1391.729041][T26011] ? rw_verify_area+0xce/0x6d0 [ 1391.729070][T26011] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1391.729103][T26011] vfs_read+0x1e4/0xb40 [ 1391.729138][T26011] ? __pfx_vfs_read+0x10/0x10 [ 1391.729168][T26011] ? __fget_files+0x215/0x3d0 [ 1391.729198][T26011] ? __fget_files+0x21f/0x3d0 [ 1391.729229][T26011] ksys_read+0x12a/0x250 [ 1391.729248][T26011] ? __pfx_ksys_read+0x10/0x10 [ 1391.729266][T26011] ? trace_syscall_enter+0xd9/0x110 [ 1391.729304][T26011] do_syscall_64+0x115/0x870 [ 1391.729328][T26011] ? clear_bhb_loop+0x70/0xc0 [ 1391.729355][T26011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1391.729376][T26011] RIP: 0033:0x7f7df0d5e90e [ 1391.729394][T26011] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1391.729414][T26011] RSP: 002b:00007f7df1b87fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1391.729435][T26011] RAX: ffffffffffffffda RBX: 00007f7df1b886c0 RCX: 00007f7df0d5e90e [ 1391.729450][T26011] RDX: 000000000000000f RSI: 00007f7df1b880a0 RDI: 0000000000000005 [ 1391.729463][T26011] RBP: 00007f7df1b88090 R08: 0000000000000000 R09: 0000000000000000 [ 1391.729475][T26011] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1391.729488][T26011] R13: 00007f7df1026038 R14: 00007f7df1025fa0 R15: 00007ffca5d69b98 [ 1391.729525][T26011] [ 1392.176233][ T99] net_ratelimit: 1 callbacks suppressed [ 1392.176250][ T99] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1392.379013][ T5725] usb 5-1: USB disconnect, device number 77 [ 1393.301374][ T5725] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 1393.362589][ T4305] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1393.462155][ T5788] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 1393.483914][ T5725] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1393.524766][ T5725] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1393.570671][ T5725] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1393.617320][ T5725] usb 5-1: config 0 descriptor?? [ 1393.635342][ T5788] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1393.669269][ T5788] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1393.710392][ T5788] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1393.756578][ T5788] usb 6-1: config 0 descriptor?? [ 1393.883712][ T5725] usbhid 5-1:0.0: can't add hid device: -71 [ 1393.909138][ T5725] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1393.912329][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1393.947325][ T5725] usb 5-1: USB disconnect, device number 78 [ 1394.809481][ T5788] usbhid 6-1:0.0: can't add hid device: -71 [ 1394.848502][ T5788] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1394.860399][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1394.910701][ T5788] usb 6-1: USB disconnect, device number 49 [ 1395.140885][ T5725] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 1395.241764][ T5788] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 1395.312358][ T5725] usb 5-1: Using ep0 maxpacket: 32 [ 1395.332593][ T5725] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1395.354653][ T5725] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1395.402887][ T5725] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1395.483465][ T5725] usb 5-1: config 0 descriptor?? [ 1395.501778][ T99] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1395.503352][ T5725] ldusb 5-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1395.530747][ T5788] usb 6-1: Using ep0 maxpacket: 32 [ 1395.537145][ T5788] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1395.548121][ T5788] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1395.559957][ T5788] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1395.585076][ T5725] ldusb 5-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1396.431592][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1396.458912][ T5788] usb 6-1: config 0 descriptor?? [ 1396.464730][ T5788] usb 6-1: can't set config #0, error -71 [ 1396.499280][T23390] usb 5-1: USB disconnect, device number 79 [ 1396.524419][ T5788] usb 6-1: USB disconnect, device number 50 [ 1396.532574][T23390] ldusb 5-1:0.0: LD USB Device #0 now disconnected [ 1396.686068][ T29] audit: type=1400 audit(1786968315.932:12620): avc: denied { write } for pid=26052 comm="syz.2.4528" name="subsystems" dev="configfs" ino=3580 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1396.717324][ T29] audit: type=1800 audit(1786968315.952:12621): pid=26055 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.4528" name="attr_allow_any_host" dev="configfs" ino=75057 res=0 errno=0 [ 1396.717922][T26053] xt_nfacct: accounting object `' does not exist [ 1396.772542][T26062] 9p: Bad value for 'rfdno' [ 1396.778404][T26058] erspan1: entered promiscuous mode [ 1396.778432][T26058] erspan1: entered allmulticast mode [ 1396.952087][ T4305] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1397.280362][T23390] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 1397.539686][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1398.260972][T23390] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1398.271786][T23390] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1398.287156][T23390] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1398.314594][ T99] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1398.336420][T23390] usb 3-1: config 0 descriptor?? [ 1398.585941][T23390] usbhid 3-1:0.0: can't add hid device: -71 [ 1398.602596][T23390] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1398.623373][T23390] usb 3-1: USB disconnect, device number 62 [ 1398.797596][ T29] audit: type=1400 audit(1786968318.032:12622): avc: denied { bind } for pid=26093 comm="syz.1.4542" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1398.939959][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1399.113392][ T29] audit: type=1400 audit(1786968318.352:12623): avc: denied { map } for pid=26103 comm="syz.3.4545" path="socket:[74445]" dev="sockfs" ino=74445 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 1399.145016][T23390] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1399.202441][ T6769] nvmet: Created nvm controller 81 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:1fddafc3-3ef5-4828-9083-380ea0558069. [ 1399.291372][T26100] nvme nvme80: creating 2 I/O queues. [ 1399.342975][T26100] nvme nvme80: new ctrl: "testsubsys" [ 1399.350772][T23390] usb 3-1: Using ep0 maxpacket: 32 [ 1399.375706][T23390] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1399.430227][T23390] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1399.499943][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1399.524974][T23390] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1399.596252][T26115] xt_cgroup: invalid path, errno=-2 [ 1399.617967][T23390] usb 3-1: config 0 descriptor?? [ 1399.667565][T23390] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1399.733541][T23390] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1399.782078][T26117] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4549'. [ 1400.099814][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1400.171491][T23390] usb 3-1: USB disconnect, device number 63 [ 1400.210726][T23390] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 1401.001855][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1401.321656][T23390] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 1401.450722][T26144] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4554'. [ 1401.531025][T26148] FAULT_INJECTION: forcing a failure. [ 1401.531025][T26148] name failslab, interval 1, probability 0, space 0, times 0 [ 1401.554552][T23390] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1401.586100][T26146] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4555'. [ 1401.611650][T23390] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 1401.637561][T26148] CPU: 1 UID: 0 PID: 26148 Comm: syz.2.4556 Tainted: G L syzkaller #0 PREEMPT(full) [ 1401.637596][T26148] Tainted: [L]=SOFTLOCKUP [ 1401.637603][T26148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1401.637616][T26148] Call Trace: [ 1401.637624][T26148] [ 1401.637633][T26148] dump_stack_lvl+0x100/0x190 [ 1401.637662][T26148] should_fail_ex.cold+0x5/0xa [ 1401.637687][T26148] should_failslab+0xc2/0x120 [ 1401.637714][T26148] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 1401.637738][T26148] ? __alloc_skb+0x5b7/0x710 [ 1401.637761][T26148] ? __alloc_skb+0x140/0x710 [ 1401.637797][T26148] __alloc_skb+0x140/0x710 [ 1401.637819][T26148] ? __alloc_skb+0x5b7/0x710 [ 1401.637842][T26148] ? __pfx___alloc_skb+0x10/0x10 [ 1401.637873][T26148] netlink_alloc_large_skb+0x69/0x150 [ 1401.637899][T26148] netlink_sendmsg+0x680/0xda0 [ 1401.637926][T26148] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1401.637950][T26148] ? selinux_socket_sendmsg+0x198/0x2f0 [ 1401.637981][T26148] ____sys_sendmsg+0xa4d/0xbe0 [ 1401.637999][T26148] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1401.638024][T26148] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1401.638050][T26148] ? __pfx_trace_clock_local+0x10/0x10 [ 1401.638079][T26148] ___sys_sendmsg+0x190/0x1e0 [ 1401.638102][T26148] ? __pfx____sys_sendmsg+0x10/0x10 [ 1401.638119][T26148] ? __lock_acquire+0x49f/0x1a40 [ 1401.638174][T26148] __sys_sendmsg+0x160/0x210 [ 1401.638201][T26148] ? __pfx___sys_sendmsg+0x10/0x10 [ 1401.638240][T26148] do_syscall_64+0x115/0x870 [ 1401.638262][T26148] ? clear_bhb_loop+0x70/0xc0 [ 1401.638287][T26148] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1401.638308][T26148] RIP: 0033:0x7f389659e0d9 [ 1401.638326][T26148] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1401.638346][T26148] RSP: 002b:00007f3897381028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1401.638366][T26148] RAX: ffffffffffffffda RBX: 00007f3896825fa0 RCX: 00007f389659e0d9 [ 1401.638381][T26148] RDX: 000000000000c844 RSI: 0000200000001ac0 RDI: 0000000000000004 [ 1401.638392][T26148] RBP: 00007f3897381090 R08: 0000000000000000 R09: 0000000000000000 [ 1401.638405][T26148] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1401.638417][T26148] R13: 00007f3896826038 R14: 00007f3896825fa0 R15: 00007ffe6052a6e8 [ 1401.638445][T26148] [ 1401.872150][T23390] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1401.881793][T23390] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1401.890100][T23390] usb 5-1: Product: syz [ 1401.894548][T23390] usb 5-1: Manufacturer: syz [ 1401.899226][T23390] usb 5-1: SerialNumber: syz [ 1402.255231][T23390] usb 5-1: config 0 descriptor?? [ 1403.010777][T23390] usb 5-1: selecting invalid altsetting 0 [ 1403.040417][ T6766] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1403.457181][T26161] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4559'. [ 1403.524540][T26136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1403.676730][T26146] hsr_slave_1 (unregistering): left promiscuous mode [ 1403.691906][T26136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1403.786688][T26136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1403.845029][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1403.960755][T26136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1404.113983][T26146] tipc: Enabling of bearer rejected, already enabled [ 1404.213016][ T29] audit: type=1400 audit(1786968323.452:12624): avc: denied { read } for pid=26168 comm="syz.1.4561" name="file1" dev="tmpfs" ino=5733 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1404.311681][T23390] usb 5-1: USB disconnect, device number 80 [ 1404.362371][ T29] audit: type=1400 audit(1786968323.452:12625): avc: denied { watch watch_reads } for pid=26168 comm="syz.1.4561" path="/1066/file1" dev="tmpfs" ino=5733 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1404.444594][T26173] trusted_key: encrypted_key: insufficient parameters specified [ 1404.453986][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1404.581328][ T29] audit: type=1400 audit(1786968323.652:12626): avc: denied { map } for pid=26169 comm="syz.5.4560" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1404.637150][T19314] udevd[19314]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1404.875022][ T29] audit: type=1400 audit(1786968323.652:12627): avc: denied { execute } for pid=26169 comm="syz.5.4560" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1405.550343][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1405.761068][T26187] tipc: Enabling of bearer rejected, already enabled [ 1405.823500][T26189] tipc: Enabling of bearer rejected, already enabled [ 1405.864309][T26195] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4567'. [ 1405.915694][T26193] tipc: Enabling of bearer rejected, failed to enable media [ 1406.192891][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1406.211053][T26209] xt_hashlimit: size too large, truncated to 1048576 [ 1407.067253][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1407.350623][ T29] audit: type=1400 audit(1786968326.583:12628): avc: denied { write } for pid=26226 comm="syz.1.4577" path="socket:[75259]" dev="sockfs" ino=75259 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1407.632567][T26231] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[11537] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[26231] [ 1407.740999][T26235] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4579'. [ 1407.750193][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1407.860007][T26237] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4580'. [ 1408.340010][ T6766] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1408.958718][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1409.549864][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1410.457484][T23390] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 1410.608840][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1410.718113][T23390] usb 3-1: Using ep0 maxpacket: 16 [ 1410.774084][T23390] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 1410.848262][T23390] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=222 [ 1410.962237][T23390] usb 3-1: SerialNumber: syz [ 1411.015885][T23390] usb 3-1: config 0 descriptor?? [ 1411.055017][T23390] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 1411.123365][T23390] usb 3-1: Detected FT232A [ 1411.151442][T26303] trusted_key: encrypted_key: insufficient parameters specified [ 1411.186661][T23390] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1411.250817][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1411.440939][T26304] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1411.579692][T26303] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1411.847793][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1411.869852][T23390] usb 3-1: USB disconnect, device number 64 [ 1412.026165][T23390] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1412.075127][T23390] ftdi_sio 3-1:0.0: device disconnected [ 1412.337011][ T5696] usb 5-1: new low-speed USB device number 81 using dummy_hcd [ 1412.507761][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1412.640817][ T5696] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1412.666249][ T5696] usb 5-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 1412.729231][ T5696] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1412.822909][ T5696] usb 5-1: string descriptor 0 read error: -22 [ 1412.866992][ T5696] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1413.171644][T23390] usb 5-1: USB disconnect, device number 81 [ 1413.251500][T12429] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 1413.313187][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1413.848189][T12429] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1413.884153][T12429] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1413.915026][T12429] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1414.044251][T12429] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1414.076524][T12429] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1414.141658][T12429] usb 6-1: config 0 descriptor?? [ 1414.316835][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1415.502250][T12429] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 1415.524287][T12429] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 1415.553257][T12429] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 1415.555940][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1415.646642][T12429] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 1415.705929][T12429] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 1415.736610][T12429] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 1415.795509][T12429] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 1415.916326][T12429] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 1416.030464][T12429] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 1416.106018][T12429] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 1416.256587][T12429] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 1416.283658][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1416.393257][T12429] usb 6-1: USB disconnect, device number 51 [ 1416.727384][T26355] fido_id[26355]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 1416.916657][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1417.315806][T23390] usb 6-1: new full-speed USB device number 52 using dummy_hcd [ 1417.440666][T26365] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4614'. [ 1417.515752][T23390] usb 6-1: device descriptor read/64, error -71 [ 1417.566982][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1417.786462][T23390] usb 6-1: new full-speed USB device number 53 using dummy_hcd [ 1417.945869][T23390] usb 6-1: device descriptor read/64, error -71 [ 1418.087905][T23390] usb usb6-port1: attempt power cycle [ 1418.425683][ C1] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:17 [ 1418.607067][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1418.975383][T23390] usb 6-1: new full-speed USB device number 54 using dummy_hcd [ 1419.016914][T23390] usb 6-1: device descriptor read/8, error -71 [ 1419.405516][T23390] usb 6-1: new full-speed USB device number 55 using dummy_hcd [ 1419.639645][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1419.943153][T23390] usb 6-1: device descriptor read/8, error -71 [ 1420.267322][T23390] usb usb6-port1: unable to enumerate USB device [ 1420.469571][ T99] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1420.605401][T26408] FAULT_INJECTION: forcing a failure. [ 1420.605401][T26408] name failslab, interval 1, probability 0, space 0, times 0 [ 1420.655138][T26408] CPU: 1 UID: 0 PID: 26408 Comm: syz.2.4625 Tainted: G L syzkaller #0 PREEMPT(full) [ 1420.655166][T26408] Tainted: [L]=SOFTLOCKUP [ 1420.655172][T26408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1420.655181][T26408] Call Trace: [ 1420.655188][T26408] [ 1420.655195][T26408] dump_stack_lvl+0x100/0x190 [ 1420.655221][T26408] should_fail_ex.cold+0x5/0xa [ 1420.655243][T26408] should_failslab+0xc2/0x120 [ 1420.655264][T26408] __kmalloc_noprof+0xfc/0x820 [ 1420.655283][T26408] ? io_alloc_file_tables+0x60/0xb0 [ 1420.655307][T26408] io_alloc_file_tables+0x60/0xb0 [ 1420.655329][T26408] io_sqe_files_register+0x186/0x970 [ 1420.655357][T26408] ? find_held_lock+0x2b/0x80 [ 1420.655373][T26408] ? __might_fault+0xc5/0x140 [ 1420.655391][T26408] ? __pfx_io_sqe_files_register+0x10/0x10 [ 1420.655419][T26408] io_register_rsrc+0x18a/0x215 [ 1420.655443][T26408] ? __pfx_io_register_rsrc+0x10/0x10 [ 1420.655473][T26408] __do_sys_io_uring_register+0x1148/0x1bc0 [ 1420.655493][T26408] ? trace_buffer_unlock_commit_regs+0x375/0x540 [ 1420.655517][T26408] ? __pfx___do_sys_io_uring_register+0x10/0x10 [ 1420.655536][T26408] ? trace_event_buffer_commit+0x20a/0xa80 [ 1420.655561][T26408] ? find_held_lock+0x2b/0x80 [ 1420.655575][T26408] ? trace_syscall_enter+0xd9/0x110 [ 1420.655595][T26408] ? trace_syscall_enter+0xd9/0x110 [ 1420.655621][T26408] do_syscall_64+0x115/0x870 [ 1420.655639][T26408] ? clear_bhb_loop+0x70/0xc0 [ 1420.655657][T26408] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1420.655673][T26408] RIP: 0033:0x7f389659e0d9 [ 1420.655688][T26408] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1420.655702][T26408] RSP: 002b:00007f3897381028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 1420.655717][T26408] RAX: ffffffffffffffda RBX: 00007f3896825fa0 RCX: 00007f389659e0d9 [ 1420.655728][T26408] RDX: 0000200000000800 RSI: 000000000000000d RDI: 0000000000000003 [ 1420.655737][T26408] RBP: 00007f3897381090 R08: 0000000000000000 R09: 0000000000000000 [ 1420.655745][T26408] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000001 [ 1420.655755][T26408] R13: 00007f3896826038 R14: 00007f3896825fa0 R15: 00007ffe6052a6e8 [ 1420.655776][T26408] [ 1421.075744][ T4305] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1421.115998][T26413] netlink: zone id is out of range [ 1421.150699][T26413] netlink: zone id is out of range [ 1421.173547][T26413] netlink: zone id is out of range [ 1421.193612][T26415] netlink: 91 bytes leftover after parsing attributes in process `syz.5.4627'. [ 1421.208131][T26413] netlink: zone id is out of range [ 1421.657456][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1421.900082][T26433] macsec1: entered promiscuous mode [ 1421.915594][T26433] macsec1: entered allmulticast mode [ 1422.317965][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1422.439599][ T7508] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1422.534721][ T5696] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 1422.715596][ T5696] usb 6-1: Using ep0 maxpacket: 32 [ 1422.735186][ T5696] usb 6-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 1422.755707][ T5696] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1422.774593][ T5696] usb 6-1: config 0 interface 0 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1422.804579][ T5696] usb 6-1: config 0 interface 0 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1422.824541][ T5696] usb 6-1: config 0 interface 0 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1422.857322][ T5696] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1422.876333][ T5696] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1422.916012][ T5696] usb 6-1: config 0 descriptor?? [ 1423.035479][ T7508] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1423.358984][ T5696] corsair-cpro 0003:1B1C:0C10.0006: item fetching failed at offset 2/5 [ 1423.395123][ T5696] corsair-cpro 0003:1B1C:0C10.0006: probe with driver corsair-cpro failed with error -22 [ 1423.573549][ T5696] usb 6-1: USB disconnect, device number 56 [ 1424.421161][ T29] audit: type=1400 audit(1786968599.668:12629): avc: denied { getopt } for pid=26456 comm="syz.5.4640" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1424.694230][T23390] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 1424.774152][ T5718] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 1424.866663][T23390] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1424.897084][T23390] usb 6-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 1424.948685][T23390] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1424.963268][ T5718] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1424.998977][T23390] usb 6-1: Product: syz [ 1425.026025][T23390] usb 6-1: Manufacturer: syz [ 1425.117435][ T7508] net_ratelimit: 3 callbacks suppressed [ 1425.117455][ T7508] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1425.155915][ T5718] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1425.181233][T23390] usb 6-1: SerialNumber: syz [ 1425.212638][ T5718] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1425.226318][T23390] usb 6-1: selecting invalid altsetting 1 [ 1425.252978][T23390] usb 6-1: unit 6 not found! [ 1425.279201][ T5718] usb 3-1: config 0 descriptor?? [ 1425.530671][ T5718] usbhid 3-1:0.0: can't add hid device: -71 [ 1425.562292][ T5718] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1425.618746][ T5718] usb 3-1: USB disconnect, device number 65 [ 1425.759670][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1426.052268][T23390] usb 6-1: 2:0: sticky mixer values (0/123/1 => 0), disabling [ 1426.069759][T26481] CIFS mount error: No usable UNC path provided in device string! [ 1426.069759][T26481] [ 1426.081812][T23390] usb 6-1: check MIXER_GET_CUR_BROKEN if you believe the mixer is non-sticky [ 1426.123934][ T5696] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1426.147457][T23390] usb 6-1: selecting invalid altsetting 1 [ 1426.159864][T26481] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 1426.179036][T23390] usb 6-1: unit 6 not found! [ 1426.263078][T23390] usb 6-1: 2:0: cannot get min/max values for control 1 (id 2) [ 1426.293140][T23390] snd-usb-audio 6-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 1426.334804][ T5696] usb 3-1: Using ep0 maxpacket: 32 [ 1426.350198][ T5696] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1426.356474][T23390] usb 6-1: selecting invalid altsetting 1 [ 1426.396117][ T5696] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1426.414117][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1426.437322][T23390] usb 6-1: unit 6 not found! [ 1426.470249][T23390] usb 6-1: 2:0: cannot get min/max values for control 1 (id 2) [ 1426.560698][ T5696] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1426.676090][ T5696] usb 3-1: config 0 descriptor?? [ 1426.707143][ T5696] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1426.781890][ T5696] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1426.979080][T26491] FAULT_INJECTION: forcing a failure. [ 1426.979080][T26491] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1427.047933][T23390] snd-usb-audio 6-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 1427.051602][T26491] CPU: 1 UID: 0 PID: 26491 Comm: syz.4.4649 Tainted: G L syzkaller #0 PREEMPT(full) [ 1427.051640][T26491] Tainted: [L]=SOFTLOCKUP [ 1427.051648][T26491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1427.051660][T26491] Call Trace: [ 1427.051667][T26491] [ 1427.051676][T26491] dump_stack_lvl+0x100/0x190 [ 1427.051708][T26491] should_fail_ex.cold+0x5/0xa [ 1427.051734][T26491] _copy_from_user+0x2e/0xd0 [ 1427.051763][T26491] copy_msghdr_from_user+0x9f/0x4c0 [ 1427.051787][T26491] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1427.051815][T26491] ? __lock_acquire+0x49f/0x1a40 [ 1427.051845][T26491] ___sys_recvmsg+0xdd/0x1a0 [ 1427.051866][T26491] ? __pfx____sys_recvmsg+0x10/0x10 [ 1427.051891][T26491] ? find_held_lock+0x2b/0x80 [ 1427.051927][T26491] __x64_sys_recvmsg+0x19a/0x260 [ 1427.051956][T26491] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1427.051999][T26491] do_syscall_64+0x115/0x870 [ 1427.052023][T26491] ? clear_bhb_loop+0x70/0xc0 [ 1427.052047][T26491] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1427.052068][T26491] RIP: 0033:0x7f76d819e0d9 [ 1427.052086][T26491] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1427.052105][T26491] RSP: 002b:00007f76d906b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1427.052124][T26491] RAX: ffffffffffffffda RBX: 00007f76d8425fa0 RCX: 00007f76d819e0d9 [ 1427.052138][T26491] RDX: 0000000000002002 RSI: 0000200000000480 RDI: 0000000000000003 [ 1427.052150][T26491] RBP: 00007f76d906b090 R08: 0000000000000000 R09: 0000000000000000 [ 1427.052163][T26491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1427.052175][T26491] R13: 00007f76d8426038 R14: 00007f76d8425fa0 R15: 00007ffff4da5d98 [ 1427.052202][T26491] [ 1427.109892][ T3359] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1427.452852][ T5718] usb 3-1: USB disconnect, device number 66 [ 1427.482886][ T5718] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 1427.570777][T23390] usb 6-1: USB disconnect, device number 57 [ 1427.766965][T26034] udevd[26034]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1428.043891][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1428.248121][ T3359] nvmet: Created discovery controller 82 for subsystem nqn.2014-08.org.nvmexpress.discovery for NQN nqn.2014-08.org.nvmexpress:uuid:1fddafc3-3ef5-4828-9083-380ea0558069. [ 1428.364821][T26500] nvme nvme81: new ctrl: "nqn.2014-08.org.nvmexpress.discovery" [ 1428.728109][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1428.754212][T26510] FAULT_INJECTION: forcing a failure. [ 1428.754212][T26510] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1428.891403][T26510] CPU: 0 UID: 0 PID: 26510 Comm: syz.4.4655 Tainted: G L syzkaller #0 PREEMPT(full) [ 1428.891438][T26510] Tainted: [L]=SOFTLOCKUP [ 1428.891446][T26510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1428.891459][T26510] Call Trace: [ 1428.891467][T26510] [ 1428.891475][T26510] dump_stack_lvl+0x100/0x190 [ 1428.891509][T26510] should_fail_ex.cold+0x5/0xa [ 1428.891536][T26510] _copy_from_user+0x2e/0xd0 [ 1428.891566][T26510] kstrtouint_from_user+0xd6/0x1d0 [ 1428.891588][T26510] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1428.891610][T26510] ? __lock_acquire+0x49f/0x1a40 [ 1428.891649][T26510] proc_fail_nth_write+0x83/0x220 [ 1428.891670][T26510] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1428.891699][T26510] vfs_write+0x2aa/0x1050 [ 1428.891719][T26510] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1428.891742][T26510] ? __pfx_vfs_write+0x10/0x10 [ 1428.891761][T26510] ? __fget_files+0x215/0x3d0 [ 1428.891788][T26510] ? __fget_files+0x21f/0x3d0 [ 1428.891818][T26510] ksys_write+0x12a/0x250 [ 1428.891838][T26510] ? __pfx_ksys_write+0x10/0x10 [ 1428.891856][T26510] ? trace_syscall_enter+0xd9/0x110 [ 1428.891892][T26510] do_syscall_64+0x115/0x870 [ 1428.891916][T26510] ? clear_bhb_loop+0x70/0xc0 [ 1428.891941][T26510] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1428.891963][T26510] RIP: 0033:0x7f76d815e90e [ 1428.891986][T26510] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1428.892005][T26510] RSP: 002b:00007f76d9049fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1428.892025][T26510] RAX: ffffffffffffffda RBX: 00007f76d904a6c0 RCX: 00007f76d815e90e [ 1428.892039][T26510] RDX: 0000000000000001 RSI: 00007f76d904a0a0 RDI: 0000000000000006 [ 1428.892052][T26510] RBP: 00007f76d904a090 R08: 0000000000000000 R09: 0000000000000000 [ 1428.892064][T26510] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1428.892076][T26510] R13: 00007f76d8426128 R14: 00007f76d8426090 R15: 00007ffff4da5d98 [ 1428.892104][T26510] [ 1430.021838][ T7508] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1430.417883][T26522] FAULT_INJECTION: forcing a failure. [ 1430.417883][T26522] name failslab, interval 1, probability 0, space 0, times 0 [ 1430.595804][T26522] CPU: 1 UID: 0 PID: 26522 Comm: syz.4.4658 Tainted: G L syzkaller #0 PREEMPT(full) [ 1430.595838][T26522] Tainted: [L]=SOFTLOCKUP [ 1430.595847][T26522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1430.595860][T26522] Call Trace: [ 1430.595867][T26522] [ 1430.595875][T26522] dump_stack_lvl+0x100/0x190 [ 1430.595909][T26522] should_fail_ex.cold+0x5/0xa [ 1430.595936][T26522] should_failslab+0xc2/0x120 [ 1430.595966][T26522] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1430.595992][T26522] ? trace_kmem_cache_alloc+0xdd/0x100 [ 1430.596020][T26522] ? security_file_alloc+0x34/0x2c0 [ 1430.596046][T26522] security_file_alloc+0x34/0x2c0 [ 1430.596067][T26522] init_file+0x95/0x480 [ 1430.596093][T26522] alloc_empty_file+0x79/0x1c0 [ 1430.596122][T26522] path_openat+0xe7/0x4280 [ 1430.596143][T26522] ? __kasan_slab_alloc+0x89/0x90 [ 1430.596169][T26522] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 1430.596192][T26522] ? do_getname+0x35/0x390 [ 1430.596217][T26522] ? do_sys_openat2+0xc7/0x1e0 [ 1430.596241][T26522] ? __x64_sys_openat+0x12d/0x210 [ 1430.596273][T26522] ? do_syscall_64+0x115/0x870 [ 1430.596297][T26522] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1430.596328][T26522] ? __pfx_path_openat+0x10/0x10 [ 1430.596359][T26522] do_file_open+0x20e/0x430 [ 1430.596385][T26522] ? __pfx_do_file_open+0x10/0x10 [ 1430.596429][T26522] ? alloc_fd+0x471/0x7a0 [ 1430.596455][T26522] ? do_getname+0x191/0x390 [ 1430.596485][T26522] do_sys_openat2+0x10f/0x1e0 [ 1430.596512][T26522] ? __pfx_do_sys_openat2+0x10/0x10 [ 1430.596539][T26522] ? trace_buffer_unlock_commit_regs+0x375/0x540 [ 1430.596579][T26522] __x64_sys_openat+0x12d/0x210 [ 1430.596606][T26522] ? __pfx___x64_sys_openat+0x10/0x10 [ 1430.596632][T26522] ? find_held_lock+0x2b/0x80 [ 1430.596654][T26522] ? trace_syscall_enter+0xd9/0x110 [ 1430.596690][T26522] do_syscall_64+0x115/0x870 [ 1430.596712][T26522] ? clear_bhb_loop+0x70/0xc0 [ 1430.596739][T26522] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1430.596760][T26522] RIP: 0033:0x7f76d815e90e [ 1430.596778][T26522] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1430.596798][T26522] RSP: 002b:00007f76d906af28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1430.596819][T26522] RAX: ffffffffffffffda RBX: 00007f76d906b6c0 RCX: 00007f76d815e90e [ 1430.596834][T26522] RDX: 0000000000000000 RSI: 00007f76d823475f RDI: ffffffffffffff9c [ 1430.596848][T26522] RBP: 00007f76d906b090 R08: 0000000000000000 R09: 0000000000000000 [ 1430.596861][T26522] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1430.596873][T26522] R13: 00007f76d8426038 R14: 00007f76d8425fa0 R15: 00007ffff4da5d98 [ 1430.596902][T26522] [ 1430.872597][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1431.377976][ T29] audit: type=1400 audit(1786968606.159:12630): avc: denied { setopt } for pid=26526 comm="syz.1.4660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1431.600655][ T29] audit: type=1400 audit(1786968606.169:12631): avc: denied { write } for pid=26526 comm="syz.1.4660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1432.185246][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1432.589146][T26539] kernel profiling enabled (shift: 63) [ 1432.709667][T26539] profiling shift: 63 too large [ 1432.717306][T26543] FAULT_INJECTION: forcing a failure. [ 1432.717306][T26543] name failslab, interval 1, probability 0, space 0, times 0 [ 1432.752549][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1432.837903][T26543] CPU: 0 UID: 0 PID: 26543 Comm: syz.2.4667 Tainted: G L syzkaller #0 PREEMPT(full) [ 1432.837938][T26543] Tainted: [L]=SOFTLOCKUP [ 1432.837946][T26543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1432.837958][T26543] Call Trace: [ 1432.837966][T26543] [ 1432.837974][T26543] dump_stack_lvl+0x100/0x190 [ 1432.838008][T26543] should_fail_ex.cold+0x5/0xa [ 1432.838036][T26543] should_failslab+0xc2/0x120 [ 1432.838065][T26543] __kmalloc_noprof+0xfc/0x820 [ 1432.838091][T26543] ? trace_kmem_cache_alloc+0xdd/0x100 [ 1432.838118][T26543] ? lsm_blob_alloc+0x68/0x90 [ 1432.838148][T26543] lsm_blob_alloc+0x68/0x90 [ 1432.838173][T26543] security_sk_alloc+0x2d/0x290 [ 1432.838203][T26543] sk_prot_alloc+0x1d1/0x2a0 [ 1432.838238][T26543] sk_alloc+0x36/0xe80 [ 1432.838265][T26543] inet_create+0x3a0/0x1060 [ 1432.838294][T26543] ? inet_create+0x94/0x1060 [ 1432.838328][T26543] __sock_create+0x339/0x860 [ 1432.838355][T26543] __sys_socket+0x14d/0x260 [ 1432.838378][T26543] ? __pfx___sys_socket+0x10/0x10 [ 1432.838399][T26543] ? find_held_lock+0x2b/0x80 [ 1432.838419][T26543] ? trace_syscall_enter+0xd9/0x110 [ 1432.838448][T26543] ? trace_syscall_enter+0xd9/0x110 [ 1432.838481][T26543] __x64_sys_socket+0x72/0xb0 [ 1432.838504][T26543] do_syscall_64+0x115/0x870 [ 1432.838535][T26543] ? clear_bhb_loop+0x70/0xc0 [ 1432.838561][T26543] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1432.838584][T26543] RIP: 0033:0x7f389659e0d9 [ 1432.838604][T26543] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1432.838625][T26543] RSP: 002b:00007f3897381028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 1432.838646][T26543] RAX: ffffffffffffffda RBX: 00007f3896825fa0 RCX: 00007f389659e0d9 [ 1432.838661][T26543] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 1432.838674][T26543] RBP: 00007f3897381090 R08: 0000000000000000 R09: 0000000000000000 [ 1432.838687][T26543] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1432.838699][T26543] R13: 00007f3896826038 R14: 00007f3896825fa0 R15: 00007ffe6052a6e8 [ 1432.838727][T26543] [ 1433.625358][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1433.809484][T26554] FAULT_INJECTION: forcing a failure. [ 1433.809484][T26554] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1433.954651][T26554] CPU: 0 UID: 0 PID: 26554 Comm: syz.4.4670 Tainted: G L syzkaller #0 PREEMPT(full) [ 1433.954694][T26554] Tainted: [L]=SOFTLOCKUP [ 1433.954701][T26554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1433.954714][T26554] Call Trace: [ 1433.954722][T26554] [ 1433.954731][T26554] dump_stack_lvl+0x100/0x190 [ 1433.954763][T26554] should_fail_ex.cold+0x5/0xa [ 1433.954791][T26554] _copy_from_iter+0x1f4/0x1690 [ 1433.954822][T26554] ? __asan_memset+0x23/0x50 [ 1433.954846][T26554] ? __pfx__copy_from_iter+0x10/0x10 [ 1433.954874][T26554] ? __pfx___alloc_skb+0x10/0x10 [ 1433.954898][T26554] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 1433.954937][T26554] ? sock_has_perm+0x25a/0x2f0 [ 1433.954964][T26554] ? __pfx_sock_has_perm+0x10/0x10 [ 1433.954996][T26554] netlink_sendmsg+0x808/0xda0 [ 1433.955028][T26554] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1433.955054][T26554] ? selinux_socket_sendmsg+0x198/0x2f0 [ 1433.955088][T26554] ____sys_sendmsg+0xa4d/0xbe0 [ 1433.955109][T26554] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1433.955135][T26554] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1433.955163][T26554] ? __pfx_trace_clock_local+0x10/0x10 [ 1433.955195][T26554] ___sys_sendmsg+0x190/0x1e0 [ 1433.955219][T26554] ? __pfx____sys_sendmsg+0x10/0x10 [ 1433.955239][T26554] ? __lock_acquire+0x49f/0x1a40 [ 1433.955297][T26554] __sys_sendmsg+0x160/0x210 [ 1433.955325][T26554] ? __pfx___sys_sendmsg+0x10/0x10 [ 1433.955367][T26554] do_syscall_64+0x115/0x870 [ 1433.955390][T26554] ? clear_bhb_loop+0x70/0xc0 [ 1433.955415][T26554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1433.955437][T26554] RIP: 0033:0x7f76d819e0d9 [ 1433.955456][T26554] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1433.955476][T26554] RSP: 002b:00007f76d906b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1433.955498][T26554] RAX: ffffffffffffffda RBX: 00007f76d8425fa0 RCX: 00007f76d819e0d9 [ 1433.955512][T26554] RDX: 0000000020008004 RSI: 0000200000000d40 RDI: 0000000000000003 [ 1433.955525][T26554] RBP: 00007f76d906b090 R08: 0000000000000000 R09: 0000000000000000 [ 1433.955537][T26554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1433.955550][T26554] R13: 00007f76d8426038 R14: 00007f76d8425fa0 R15: 00007ffff4da5d98 [ 1433.955578][T26554] [ 1434.485768][T22580] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1434.669070][T26560] 9p: Bad value for 'rfdno' [ 1434.774507][T26566] FAULT_INJECTION: forcing a failure. [ 1434.774507][T26566] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1434.843978][T26566] CPU: 0 UID: 0 PID: 26566 Comm: syz.4.4675 Tainted: G L syzkaller #0 PREEMPT(full) [ 1434.844012][T26566] Tainted: [L]=SOFTLOCKUP [ 1434.844020][T26566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1434.844032][T26566] Call Trace: [ 1434.844040][T26566] [ 1434.844048][T26566] dump_stack_lvl+0x100/0x190 [ 1434.844081][T26566] should_fail_ex.cold+0x5/0xa [ 1434.844107][T26566] _copy_from_iter+0x1f4/0x1690 [ 1434.844139][T26566] ? __asan_memset+0x23/0x50 [ 1434.844163][T26566] ? __pfx__copy_from_iter+0x10/0x10 [ 1434.844191][T26566] ? __pfx___alloc_skb+0x10/0x10 [ 1434.844216][T26566] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 1434.844247][T26566] ? sock_has_perm+0x25a/0x2f0 [ 1434.844273][T26566] ? __pfx_sock_has_perm+0x10/0x10 [ 1434.844305][T26566] netlink_sendmsg+0x808/0xda0 [ 1434.844333][T26566] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1434.844359][T26566] ? selinux_socket_sendmsg+0x198/0x2f0 [ 1434.844392][T26566] ____sys_sendmsg+0xa4d/0xbe0 [ 1434.844412][T26566] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1434.844437][T26566] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1434.844464][T26566] ? __pfx_trace_clock_local+0x10/0x10 [ 1434.844496][T26566] ___sys_sendmsg+0x190/0x1e0 [ 1434.844520][T26566] ? __pfx____sys_sendmsg+0x10/0x10 [ 1434.844539][T26566] ? __lock_acquire+0x49f/0x1a40 [ 1434.844596][T26566] __sys_sendmsg+0x160/0x210 [ 1434.844624][T26566] ? __pfx___sys_sendmsg+0x10/0x10 [ 1434.844665][T26566] do_syscall_64+0x115/0x870 [ 1434.844689][T26566] ? clear_bhb_loop+0x70/0xc0 [ 1434.844714][T26566] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1434.844735][T26566] RIP: 0033:0x7f76d819e0d9 [ 1434.844752][T26566] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1434.844772][T26566] RSP: 002b:00007f76d906b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1434.844793][T26566] RAX: ffffffffffffffda RBX: 00007f76d8425fa0 RCX: 00007f76d819e0d9 [ 1434.844807][T26566] RDX: 0000000000000000 RSI: 0000200000000380 RDI: 0000000000000003 [ 1434.844820][T26566] RBP: 00007f76d906b090 R08: 0000000000000000 R09: 0000000000000000 [ 1434.844833][T26566] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1434.844845][T26566] R13: 00007f76d8426038 R14: 00007f76d8425fa0 R15: 00007ffff4da5d98 [ 1434.844874][T26566] [ 1436.364511][T22580] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1436.721698][T26574] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1436.983261][T22580] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1437.152878][ T5725] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 1437.341548][ T5725] usb 5-1: Using ep0 maxpacket: 16 [ 1437.368677][ T5725] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1437.392284][ T5725] usb 5-1: New USB device found, idVendor=1410, idProduct=7004, bcdDevice= 6.a2 [ 1437.431005][ T5725] usb 5-1: config 1 has an invalid interface number: 232 but max is 0 [ 1437.661168][ T5725] usb 5-1: config 1 has no interface number 0 [ 1437.667402][ T5725] usb 5-1: config 1 interface 232 has no altsetting 0 [ 1438.116288][ T6226] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1438.167440][ T5725] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1438.272447][ T5725] usb 5-1: Product: syz [ 1438.445001][T26608] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4688'. [ 1438.494033][ T5725] usb 5-1: Manufacturer: syz [ 1438.498650][ T5725] usb 5-1: SerialNumber: syz [ 1438.539661][T26609] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4688'. [ 1438.711050][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1438.971335][ T5696] usb 3-1: new full-speed USB device number 67 using dummy_hcd [ 1439.181122][ T5725] hub 5-1:1.232: bad descriptor, ignoring hub [ 1439.198538][ T5725] hub 5-1:1.232: probe with driver hub failed with error -5 [ 1439.213031][ T5696] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 1439.241730][ T5725] option 5-1:1.232: GSM modem (1-port) converter detected [ 1439.265488][ T5696] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 1439.293251][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1439.296241][ T5696] usb 3-1: config 0 has no interface number 0 [ 1439.338102][ T5725] usb 5-1: USB disconnect, device number 82 [ 1439.380588][ T5725] option 5-1:1.232: device disconnected [ 1439.400183][ T5696] usb 3-1: config 0 interface 41 has no altsetting 0 [ 1439.431708][ T5696] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1439.449053][ T29] audit: type=1400 audit(1786968614.700:12632): avc: denied { append } for pid=26622 comm="syz.5.4692" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1439.455940][ T5696] usb 3-1: Product: syz [ 1439.549170][ T5696] usb 3-1: Manufacturer: syz [ 1439.569925][ T5696] usb 3-1: SerialNumber: syz [ 1439.618583][ T5696] usb 3-1: config 0 descriptor?? [ 1439.900871][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1440.042579][ T29] audit: type=1400 audit(1786968615.300:12633): avc: denied { lock } for pid=26635 comm="syz.4.4696" path="socket:[79974]" dev="sockfs" ino=79974 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 1440.481743][ T6766] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1440.593406][ T5696] CoreChips 3-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 1441.184708][T26608] netlink: 'syz.2.4688': attribute type 32 has an invalid length. [ 1441.257817][T26608] netlink: 500 bytes leftover after parsing attributes in process `syz.2.4688'. [ 1441.363327][ T5696] CoreChips 3-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 1441.757355][T26656] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1441.780495][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1441.836487][ T5696] CoreChips 3-1:0.41 (unnamed net_device) (uninitialized): Failed to reset PHY: -71 [ 1441.860490][ T5696] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -71 [ 1441.887913][ T5696] usb 3-1: USB disconnect, device number 67 [ 1441.919708][T26660] netlink: 'syz.5.4705': attribute type 15 has an invalid length. [ 1441.989560][T26660] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4705'. [ 1442.390352][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1442.810199][T23390] usb 6-1: new full-speed USB device number 58 using dummy_hcd [ 1443.004605][T23390] usb 6-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 1443.028909][ T6766] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1443.076089][T23390] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1443.117542][T26681] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1443.128551][T23390] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1443.164132][T23390] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1443.235190][T23390] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1443.288271][T23390] usb 6-1: config 0 descriptor?? [ 1443.535183][T23390] usb 6-1: string descriptor 0 read error: -71 [ 1443.573944][T23390] usbhid 6-1:0.0: can't add hid device: -22 [ 1443.596977][T23390] usbhid 6-1:0.0: probe with driver usbhid failed with error -22 [ 1443.609116][ T6766] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1443.653360][T23390] usb 6-1: USB disconnect, device number 58 [ 1444.179921][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1444.759854][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1444.952680][ T29] audit: type=1400 audit(1786968876.202:12634): avc: denied { remount } for pid=26705 comm="syz.1.4720" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1445.274319][ T29] audit: type=1400 audit(1786968876.522:12635): avc: denied { read } for pid=26699 comm="syz.4.4719" path="socket:[79209]" dev="sockfs" ino=79209 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1445.380269][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1446.614056][T22580] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1448.627400][T22580] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1450.034307][T26751] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4735'. [ 1450.041739][T22580] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1450.192560][T23390] libceph: connect (1)[c::]:6789 error -101 [ 1450.213890][T23390] libceph: mon0 (1)[c::]:6789 connect error [ 1450.413063][T26761] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4739'. [ 1450.477469][T26761] nbd: must specify a size in bytes for the device [ 1450.503952][ T5718] libceph: connect (1)[c::]:6789 error -101 [ 1450.525105][ T5718] libceph: mon0 (1)[c::]:6789 connect error [ 1450.746877][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1451.165298][ T5718] libceph: connect (1)[c::]:6789 error -101 [ 1451.204072][ T5718] libceph: mon0 (1)[c::]:6789 connect error [ 1451.329488][ T6766] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1451.530991][T26773] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4741'. [ 1451.911039][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1452.003051][T26747] ceph: No mds server is up or the cluster is laggy [ 1452.338082][ C1] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:17 [ 1452.496270][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1453.664657][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1454.097130][T26810] ALSA: mixer_oss: invalid OSS volume 'LI' [ 1454.307780][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1454.479013][ T5718] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 1454.758216][ T5718] usb 6-1: Using ep0 maxpacket: 16 [ 1454.879324][ T5718] usb 6-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=76.fe [ 1455.090869][ T5718] usb 6-1: config 4 has an invalid interface number: 9 but max is 0 [ 1455.119942][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1455.229534][ T5718] usb 6-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1455.383717][ T5718] usb 6-1: config 4 has no interface number 0 [ 1455.486161][ T5718] usb 6-1: config 4 interface 9 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1455.653173][ T5718] usb 6-1: config 4 interface 9 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1455.896839][ T5718] usb 6-1: config 4 interface 9 has no altsetting 0 [ 1455.948002][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1456.056235][ T5718] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1456.206276][ T5718] usb 6-1: Product: syz [ 1456.290066][ T5718] usb 6-1: Manufacturer: syz [ 1456.363953][ T5718] usb 6-1: SerialNumber: syz [ 1456.644432][T26810] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1456.753923][ T7508] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1457.018566][ T5718] usb 6-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1457.178760][ T5718] usb 6-1: USB disconnect, device number 59 [ 1457.357363][ T7508] usb 6-1: Failed to submit usb control message: -19 [ 1457.401636][ T7508] usb 6-1: unable to send the bmi data to the device: -19 [ 1457.438541][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1457.453321][ T7508] usb 6-1: unable to get target info from device [ 1457.555892][ T7508] usb 6-1: could not get target info (-19) [ 1457.573924][ T7508] usb 6-1: could not probe fw (-19) [ 1457.736316][T26823] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4757'. [ 1458.052667][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1458.106745][ T29] audit: type=1800 audit(1786968889.353:12636): pid=26827 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.4759" name="attr_allow_any_host" dev="configfs" ino=79543 res=0 errno=0 [ 1458.136718][ T5788] usb 3-1: new low-speed USB device number 68 using dummy_hcd [ 1458.322759][ T5788] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1458.377590][ T5788] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1458.419816][ T5788] usb 3-1: config 0 has no interface number 0 [ 1458.466525][ T5788] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1458.544435][ T5788] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1458.615625][ T5788] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1458.637976][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1458.682704][ T5788] usb 3-1: config 0 descriptor?? [ 1458.719189][T26824] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1458.800420][T26834] FAULT_INJECTION: forcing a failure. [ 1458.800420][T26834] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1458.803230][ T5788] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1458.906686][T26834] CPU: 1 UID: 0 PID: 26834 Comm: syz.4.4762 Tainted: G L syzkaller #0 PREEMPT(full) [ 1458.906720][T26834] Tainted: [L]=SOFTLOCKUP [ 1458.906728][T26834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1458.906741][T26834] Call Trace: [ 1458.906748][T26834] [ 1458.906756][T26834] dump_stack_lvl+0x100/0x190 [ 1458.906796][T26834] should_fail_ex.cold+0x5/0xa [ 1458.906824][T26834] _copy_to_iter+0x1f3/0x1720 [ 1458.906858][T26834] ? __pfx__copy_to_iter+0x10/0x10 [ 1458.906886][T26834] ? rcu_is_watching+0x12/0xc0 [ 1458.906918][T26834] ? trace_contention_end+0x126/0x160 [ 1458.906954][T26834] simple_copy_to_iter+0x46/0x90 [ 1458.906978][T26834] __skb_datagram_iter+0x129/0x900 [ 1458.907000][T26834] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 1458.907033][T26834] skb_copy_datagram_iter+0xa1/0x250 [ 1458.907059][T26834] unix_stream_read_actor+0x7b/0xc0 [ 1458.907093][T26834] unix_stream_read_generic+0xd6c/0x2c00 [ 1458.907135][T26834] ? __pfx_unix_stream_read_generic+0x10/0x10 [ 1458.907158][T26834] ? rcu_is_watching+0x12/0xc0 [ 1458.907190][T26834] ? __mutex_lock+0x26d/0x1bd0 [ 1458.907215][T26834] ? unix_bpf_recvmsg+0x240/0x1090 [ 1458.907244][T26834] ? find_held_lock+0x2b/0x80 [ 1458.907263][T26834] ? unix_bpf_recvmsg+0xc69/0x1090 [ 1458.907286][T26834] ? unix_bpf_recvmsg+0xc69/0x1090 [ 1458.907317][T26834] __unix_stream_recvmsg+0xde/0x130 [ 1458.907340][T26834] ? __pfx___unix_stream_recvmsg+0x10/0x10 [ 1458.907365][T26834] ? __pfx_unix_stream_read_actor+0x10/0x10 [ 1458.907398][T26834] ? unix_bpf_recvmsg+0x212/0x1090 [ 1458.907421][T26834] ? unix_bpf_recvmsg+0x212/0x1090 [ 1458.907449][T26834] unix_bpf_recvmsg+0x6e2/0x1090 [ 1458.907475][T26834] ? __pfx_avc_has_perm+0x10/0x10 [ 1458.907496][T26834] ? is_bpf_text_address+0x94/0x1a0 [ 1458.907528][T26834] ? __kernel_text_address+0xd/0x30 [ 1458.907552][T26834] ? __pfx_unix_bpf_recvmsg+0x10/0x10 [ 1458.907576][T26834] ? arch_stack_walk+0xa6/0xf0 [ 1458.907598][T26834] ? sock_has_perm+0x25a/0x2f0 [ 1458.907621][T26834] ? __pfx_sock_has_perm+0x10/0x10 [ 1458.907650][T26834] unix_stream_recvmsg+0x12d/0x1c0 [ 1458.907672][T26834] ? __pfx_unix_stream_recvmsg+0x10/0x10 [ 1458.907694][T26834] ? __pfx_unix_stream_read_actor+0x10/0x10 [ 1458.907729][T26834] ? __pfx_unix_stream_recvmsg+0x10/0x10 [ 1458.907753][T26834] sock_recvmsg+0x1d5/0x220 [ 1458.907815][T26834] ____sys_recvmsg+0x21e/0x670 [ 1458.907841][T26834] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1458.907870][T26834] ? __lock_acquire+0x49f/0x1a40 [ 1458.907896][T26834] ___sys_recvmsg+0x16a/0x1a0 [ 1458.907916][T26834] ? __pfx____sys_recvmsg+0x10/0x10 [ 1458.907939][T26834] ? find_held_lock+0x2b/0x80 [ 1458.907975][T26834] __x64_sys_recvmsg+0x19a/0x260 [ 1458.908002][T26834] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1458.908041][T26834] do_syscall_64+0x115/0x870 [ 1458.908061][T26834] ? clear_bhb_loop+0x70/0xc0 [ 1458.908088][T26834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1458.908107][T26834] RIP: 0033:0x7f76d819e0d9 [ 1458.908126][T26834] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1458.908144][T26834] RSP: 002b:00007f76d906b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1458.908164][T26834] RAX: ffffffffffffffda RBX: 00007f76d8425fa0 RCX: 00007f76d819e0d9 [ 1458.908177][T26834] RDX: 0000000000002002 RSI: 0000200000000480 RDI: 0000000000000003 [ 1458.908189][T26834] RBP: 00007f76d906b090 R08: 0000000000000000 R09: 0000000000000000 [ 1458.908200][T26834] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1458.908210][T26834] R13: 00007f76d8426038 R14: 00007f76d8425fa0 R15: 00007ffff4da5d98 [ 1458.908236][T26834] [ 1459.373059][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1459.877852][T26823] SQUASHFS error: Failed to read block 0x0: -5 [ 1459.920174][ T7508] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1460.282414][T26823] unable to read squashfs_super_block [ 1460.529753][ T7508] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1460.784206][T23390] usb 3-1: USB disconnect, device number 68 [ 1461.654567][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1462.455759][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1463.068467][ T6766] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1463.761276][ T5804] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1464.366623][ T7508] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1464.965171][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1465.045258][ T5725] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 1465.146048][T26891] loop5: detected capacity change from 0 to 7 [ 1465.191759][T26891] loop5: [CUMANA/ADFS] p1 [ADFS] p1 [ 1465.227676][T26891] loop5: partition table partially beyond EOD, truncated [ 1465.258833][ T5725] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice= 1.08 [ 1465.487735][ T5725] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1465.523813][ T5725] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1466.044168][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1466.054801][ T5725] usb 6-1: Product: syz [ 1466.074790][ T5725] usb 6-1: Manufacturer: syz [ 1466.081239][ T5725] usb 6-1: SerialNumber: syz [ 1466.316161][T26891] loop5: p1 size 487441168 extends beyond EOD, truncated [ 1466.337540][ T5725] ath6kl: Failed to submit usb control message: -71 [ 1466.369933][ T5725] ath6kl: unable to send the bmi data to the device: -71 [ 1466.544675][ T5725] ath6kl: Unable to send get target info: -71 [ 1466.666549][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1466.816221][ T5725] ath6kl: Failed to init ath6kl core: -71 [ 1466.921505][T26902] [ 1466.923869][T26902] ====================================================== [ 1466.930878][T26902] WARNING: possible circular locking dependency detected [ 1466.937893][T26902] syzkaller #0 Tainted: G L [ 1466.943842][T26902] ------------------------------------------------------ [ 1466.950832][T26902] syz.2.4779/26902 is trying to acquire lock: [ 1466.956868][T26902] ffff8880761ed8a0 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_file_truncate+0xe6/0x190 [ 1466.967103][T26902] [ 1466.967103][T26902] but task is already holding lock: [ 1466.974447][T26902] ffff888035130450 (sb_writers#6){.+.+}-{0:0}, at: path_openat+0x2929/0x4280 [ 1466.983224][T26902] [ 1466.983224][T26902] which lock already depends on the new lock. [ 1466.983224][T26902] [ 1466.988940][ T5725] ath6kl_usb 6-1:1.0: probe with driver ath6kl_usb failed with error -71 [ 1466.993622][T26902] [ 1466.993622][T26902] the existing dependency chain (in reverse order) is: [ 1466.993636][T26902] [ 1466.993636][T26902] -> #4 (sb_writers#6){.+.+}-{0:0}: [ 1466.993686][T26902] lock_acquire+0x1b9/0x370 [ 1467.023530][T26902] mnt_want_write+0x6f/0x410 [ 1467.028660][T26902] path_openat+0xad9/0x4280 [ 1467.033695][T26902] do_file_open+0x20e/0x430 [ 1467.038744][T26902] file_open_name+0x1c3/0x3e0 [ 1467.043983][T26902] filp_open+0x2e/0x50 [ 1467.048572][T26902] nvmet_file_ns_enable+0x95/0x420 [ 1467.054207][T26902] nvmet_ns_enable+0x35f/0x5d0 [ 1467.059499][T26902] nvmet_ns_enable_store+0x11e/0x160 [ 1467.065318][T26902] configfs_write_iter+0x302/0x4e0 [ 1467.070950][T26902] vfs_write+0x6ac/0x1050 [ 1467.075787][T26902] ksys_write+0x12a/0x250 [ 1467.080623][T26902] do_syscall_64+0x115/0x870 [ 1467.085724][T26902] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1467.092131][T26902] [ 1467.092131][T26902] -> #3 (&subsys->lock){+.+.}-{4:4}: [ 1467.099596][T26902] lock_acquire+0x1b9/0x370 [ 1467.104614][T26902] __mutex_lock+0x1a4/0x1bd0 [ 1467.109718][T26902] nvmet_ns_buffered_io_store+0xc0/0x1e0 [ 1467.115870][T26902] configfs_write_iter+0x302/0x4e0 [ 1467.121518][T26902] vfs_write+0x6ac/0x1050 [ 1467.126355][T26902] ksys_write+0x12a/0x250 [ 1467.131187][T26902] do_syscall_64+0x115/0x870 [ 1467.136290][T26902] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1467.142694][T26902] [ 1467.142694][T26902] -> #2 (&p->frag_sem){.+.+}-{4:4}: [ 1467.150064][T26902] lock_acquire+0x1b9/0x370 [ 1467.155079][T26902] down_read+0x99/0x4c0 [ 1467.159746][T26902] configfs_read_iter+0x346/0x6f0 [ 1467.165279][T26902] __kernel_read+0x397/0xad0 [ 1467.170387][T26902] integrity_kernel_read+0x7e/0xb0 [ 1467.176011][T26902] ima_calc_file_hash_tfm+0x25e/0x350 [ 1467.181891][T26902] ima_calc_file_hash+0x1e3/0x380 [ 1467.187428][T26902] ima_collect_measurement+0x94f/0xb30 [ 1467.193396][T26902] process_measurement+0xdfe/0x2350 [ 1467.199102][T26902] ima_file_check+0xc3/0x110 [ 1467.204198][T26902] security_file_post_open+0xc4/0x210 [ 1467.210086][T26902] path_openat+0x985/0x4280 [ 1467.215106][T26902] do_file_open+0x20e/0x430 [ 1467.220116][T26902] do_sys_openat2+0x10f/0x1e0 [ 1467.225302][T26902] __x64_sys_openat+0x12d/0x210 [ 1467.230661][T26902] do_syscall_64+0x115/0x870 [ 1467.235759][T26902] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1467.242158][T26902] [ 1467.242158][T26902] -> #1 (&buffer->mutex){+.+.}-{4:4}: [ 1467.249712][T26902] lock_acquire+0x1b9/0x370 [ 1467.254728][T26902] __mutex_lock+0x1a4/0x1bd0 [ 1467.259826][T26902] configfs_read_iter+0x79/0x6f0 [ 1467.265273][T26902] __kernel_read+0x397/0xad0 [ 1467.270376][T26902] integrity_kernel_read+0x7e/0xb0 [ 1467.275997][T26902] ima_calc_file_hash_tfm+0x25e/0x350 [ 1467.281874][T26902] ima_calc_file_hash+0x1e3/0x380 [ 1467.287408][T26902] ima_collect_measurement+0x94f/0xb30 [ 1467.293379][T26902] process_measurement+0xdfe/0x2350 [ 1467.299084][T26902] ima_file_check+0xc3/0x110 [ 1467.304180][T26902] security_file_post_open+0xc4/0x210 [ 1467.310065][T26902] path_openat+0x985/0x4280 [ 1467.315077][T26902] do_file_open+0x20e/0x430 [ 1467.320085][T26902] do_sys_openat2+0x10f/0x1e0 [ 1467.325277][T26902] __x64_sys_openat+0x12d/0x210 [ 1467.330637][T26902] do_syscall_64+0x115/0x870 [ 1467.335737][T26902] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1467.342140][T26902] [ 1467.342140][T26902] -> #0 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 1467.350726][T26902] check_prev_add+0xeb/0xe60 [ 1467.355828][T26902] __lock_acquire+0x136c/0x1a40 [ 1467.361187][T26902] lock_acquire+0x1b9/0x370 [ 1467.366197][T26902] __mutex_lock+0x1a4/0x1bd0 [ 1467.371292][T26902] ima_file_truncate+0xe6/0x190 [ 1467.376646][T26902] security_file_truncate+0xf9/0x1e0 [ 1467.382438][T26902] path_openat+0x3584/0x4280 [ 1467.387530][T26902] do_file_open+0x20e/0x430 [ 1467.392537][T26902] do_sys_openat2+0x10f/0x1e0 [ 1467.397720][T26902] __x64_sys_creat+0xcc/0x120 [ 1467.402910][T26902] do_syscall_64+0x115/0x870 [ 1467.408007][T26902] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1467.414407][T26902] [ 1467.414407][T26902] other info that might help us debug this: [ 1467.414407][T26902] [ 1467.424613][T26902] Chain exists of: [ 1467.424613][T26902] &ima_iint_mutex_key[depth] --> &subsys->lock --> sb_writers#6 [ 1467.424613][T26902] [ 1467.438164][T26902] Possible unsafe locking scenario: [ 1467.438164][T26902] [ 1467.445591][T26902] CPU0 CPU1 [ 1467.450935][T26902] ---- ---- [ 1467.456276][T26902] rlock(sb_writers#6); [ 1467.460511][T26902] lock(&subsys->lock); [ 1467.467258][T26902] lock(sb_writers#6); [ 1467.473922][T26902] lock(&ima_iint_mutex_key[depth]); [ 1467.479277][T26902] [ 1467.479277][T26902] *** DEADLOCK *** [ 1467.479277][T26902] [ 1467.487398][T26902] 1 lock held by syz.2.4779/26902: [ 1467.492487][T26902] #0: ffff888035130450 (sb_writers#6){.+.+}-{0:0}, at: path_openat+0x2929/0x4280 [ 1467.501728][T26902] [ 1467.501728][T26902] stack backtrace: [ 1467.507601][T26902] CPU: 0 UID: 0 PID: 26902 Comm: syz.2.4779 Tainted: G L syzkaller #0 PREEMPT(full) [ 1467.507630][T26902] Tainted: [L]=SOFTLOCKUP [ 1467.507638][T26902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1467.507650][T26902] Call Trace: [ 1467.507657][T26902] [ 1467.507665][T26902] dump_stack_lvl+0x100/0x190 [ 1467.507691][T26902] print_circular_bug.cold+0x178/0x1c7 [ 1467.507722][T26902] check_noncircular+0x146/0x160 [ 1467.507749][T26902] check_prev_add+0xeb/0xe60 [ 1467.507772][T26902] __lock_acquire+0x136c/0x1a40 [ 1467.507798][T26902] ? tomoyo_path_perm+0x2db/0x460 [ 1467.507826][T26902] lock_acquire+0x1b9/0x370 [ 1467.507848][T26902] ? ima_file_truncate+0xe6/0x190 [ 1467.507868][T26902] ? __pfx___might_resched+0x10/0x10 [ 1467.507894][T26902] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 1467.507922][T26902] __mutex_lock+0x1a4/0x1bd0 [ 1467.507945][T26902] ? ima_file_truncate+0xe6/0x190 [ 1467.507963][T26902] ? ima_file_truncate+0xe6/0x190 [ 1467.507984][T26902] ? __pfx___mutex_lock+0x10/0x10 [ 1467.508011][T26902] ? __pfx_ima_file_check+0x10/0x10 [ 1467.508029][T26902] ? hook_file_truncate+0xba/0x280 [ 1467.508052][T26902] ? ima_file_truncate+0xe6/0x190 [ 1467.508071][T26902] ima_file_truncate+0xe6/0x190 [ 1467.508089][T26902] security_file_truncate+0xf9/0x1e0 [ 1467.508109][T26902] path_openat+0x3584/0x4280 [ 1467.508135][T26902] ? __pfx_path_openat+0x10/0x10 [ 1467.508155][T26902] ? irqentry_exit+0x24d/0xa10 [ 1467.508176][T26902] ? lockdep_hardirqs_on+0x78/0x100 [ 1467.508198][T26902] do_file_open+0x20e/0x430 [ 1467.508219][T26902] ? __pfx_do_file_open+0x10/0x10 [ 1467.508248][T26902] ? alloc_fd+0x471/0x7a0 [ 1467.508269][T26902] ? do_getname+0x191/0x390 [ 1467.508295][T26902] do_sys_openat2+0x10f/0x1e0 [ 1467.508318][T26902] ? __pfx_do_sys_openat2+0x10/0x10 [ 1467.508342][T26902] ? trace_buffer_unlock_commit_regs+0x375/0x540 [ 1467.508372][T26902] ? trace_event_buffer_commit+0x20a/0xa80 [ 1467.508401][T26902] __x64_sys_creat+0xcc/0x120 [ 1467.508425][T26902] ? __pfx___x64_sys_creat+0x10/0x10 [ 1467.508452][T26902] ? rcu_is_watching+0x12/0xc0 [ 1467.508481][T26902] do_syscall_64+0x115/0x870 [ 1467.508502][T26902] ? clear_bhb_loop+0x70/0xc0 [ 1467.508523][T26902] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1467.508543][T26902] RIP: 0033:0x7f389659e0d9 [ 1467.508560][T26902] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1467.508579][T26902] RSP: 002b:00007f38947d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 1467.508598][T26902] RAX: ffffffffffffffda RBX: 00007f3896826180 RCX: 00007f389659e0d9 [ 1467.508611][T26902] RDX: 0000000000000000 RSI: d931d3864d39dcdb RDI: 0000200000000000 [ 1467.508624][T26902] RBP: 00007f3896635024 R08: 0000000000000000 R09: 0000000000000000 [ 1467.508637][T26902] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1467.508648][T26902] R13: 00007f3896826218 R14: 00007f3896826180 R15: 00007ffe6052a6e8 [ 1467.508668][T26902] [ 1468.057120][ T3359] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1468.465463][ T5725] usb 6-1: USB disconnect, device number 60 [ 1468.575748][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1468.707744][ T4963] loop5: [CUMANA/ADFS] p1 [ADFS] p1 [ 1468.728190][ T4963] loop5: partition table partially beyond EOD, truncated [ 1468.770655][ T4963] loop5: p1 size 487441168 extends beyond EOD, truncated [ 1469.244850][ T3359] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1470.249058][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1471.163195][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1471.705204][ T7508] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1472.273496][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1472.865558][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1474.024214][ T6769] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1474.562951][ T13] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1475.497257][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1476.042664][ T6764] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1476.602495][ T7508] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01