last executing test programs: 1m48.679990589s ago: executing program 3 (id=762): write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x19, &(0x7f00000005c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x32, 0x0, &(0x7f0000000400)=[@increfs], 0xfffffcb0, 0x0, 0x0}) 1m47.322502171s ago: executing program 3 (id=765): r0 = socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ptrace$ARCH_GET_UNTAG_MASK(0x1e, 0x0, &(0x7f0000003340), 0x4001) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_vhci(0x0, 0xe) syz_emit_ethernet(0x3e, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xa}, {0xffff, 0xffff}, {0x3, 0xd}}}, 0x24}}, 0x20040084) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000940)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, 0x0, {0xb}, {0xffff, 0xffff}, {0x9, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x24004084}, 0x20000010) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip_vti0\x00'}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, 0x0, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r4, 0x0, 0x0) listen(r4, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c900"], 0x16) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="18000000160001ea"], 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 1m46.177665709s ago: executing program 3 (id=768): openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10a600, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r0, 0xc2604110, 0x0) syz_open_dev$radio(&(0x7f0000000000), 0x1, 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) 1m45.989562042s ago: executing program 3 (id=769): socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0xa2040, 0x0) read$FUSE(r3, &(0x7f00000024c0)={0x2020}, 0xfffffec1) 1m44.578199958s ago: executing program 3 (id=775): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20008844) r1 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x401, 0x181, 0x2, 0xa, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x3, 0x723, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3fd, 0x4000009, 0x200, 0xe2df, 0x9, 0x1, 0x4, 0x40000, 0x7, 0xf58, 0x6]}) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x92, 0x0, 0x1, 0x80000000}) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000900)={'bridge0\x00', @remote}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0}, 0x28) bpf$MAP_CREATE(0x0, 0x0, 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 1m43.08613572s ago: executing program 3 (id=778): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x4, 0x2, 0x0, 0x1, @void}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1m27.460729862s ago: executing program 32 (id=778): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x4, 0x2, 0x0, 0x1, @void}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1m22.184995531s ago: executing program 4 (id=818): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r1) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)={0x20, r3, 0x9a2ea8ba8fb8e27f, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x44001}, 0x8c0) 1m21.783210979s ago: executing program 4 (id=819): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f00000007c0)={0x44, &(0x7f00000005c0)={0x20, 0x11}, 0x0, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000680)={0x20, 0x80, 0x1c, {0x1, 0x0, 0x4bd, 0x7, 0x7b, 0x8, 0x3f, 0x6, 0x0, 0x7, 0x6, 0x8}}, &(0x7f00000006c0)={0x20, 0x85, 0x4, 0xb703}, 0x0, 0x0, 0x0}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x2c, r4, 0x1, 0x0, 0x0, {}, [@SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x1}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}]}, 0x2c}}, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{0x0}], 0x1}, 0x60044084) mmap$snddsp_control(&(0x7f0000000000/0x3000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x82000000) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(0xffffffffffffffff, 0x84, 0x74, 0x0, &(0x7f00000002c0)) newfstatat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', &(0x7f00000002c0), 0x6800) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000140)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514001ac004000202080002000300010004000200eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bb", 0x57}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x58}, 0x1, 0x2, 0x0, 0x800}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) 1m14.781650164s ago: executing program 4 (id=827): readlinkat(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000000)="8907", 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x7, 0x4, 0x0, 0x0, 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x40000000}, 0x94) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYRES32=0x0, @ANYRES32=0x0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0xa, 0x0, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg$inet6(r0, &(0x7f0000000e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000003bc0)=ANY=[], 0x110}}], 0x1, 0x931766f6719c6d41) keyctl$session_to_parent(0x12) keyctl$session_to_parent(0x12) r4 = inotify_init1(0x80800) inotify_add_watch(r4, &(0x7f00000000c0)='./cgroup\x00', 0x80000001) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_STATION(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000280)={0x1c, r5, 0x303, 0x0, 0xfffffffc, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) 1m13.117771508s ago: executing program 4 (id=831): r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0xa2040, 0x0) read$FUSE(r0, &(0x7f00000024c0)={0x2020}, 0xfffffec1) 1m10.219059574s ago: executing program 4 (id=834): unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112f74247aa000000010902"], 0x0) r0 = socket$inet(0xa, 0x801, 0x84) getsockopt$IPT_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000640)={'security\x00', 0x0, [0x6, 0x3, 0x20000003, 0x1, 0x8b37]}, &(0x7f0000000600)=0x54) 1m6.76232486s ago: executing program 4 (id=839): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x4000) r0 = epoll_create(0x8) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) preadv(r2, 0x0, 0x0, 0x80000000, 0x9) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @empty}, 0xc) getsockopt$inet_buf(r3, 0x0, 0x29, &(0x7f0000000000)=""/145, &(0x7f0000695ffc)=0x24b) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x400) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000fff000/0x1000)=nil) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'geneve0\x00'}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001840), r4) sendmsg$TIPC_NL_MEDIA_SET(r4, &(0x7f0000001a40)={0x0, 0x0, &(0x7f0000001a00)={&(0x7f0000001880)={0x34, r5, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xdbe}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048080}, 0x8094) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x9000001c}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f00001c1000/0x3000)=nil, 0x40000, 0x9) 51.577819282s ago: executing program 33 (id=839): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x4000) r0 = epoll_create(0x8) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) preadv(r2, 0x0, 0x0, 0x80000000, 0x9) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @empty}, 0xc) getsockopt$inet_buf(r3, 0x0, 0x29, &(0x7f0000000000)=""/145, &(0x7f0000695ffc)=0x24b) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x400) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000fff000/0x1000)=nil) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'geneve0\x00'}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001840), r4) sendmsg$TIPC_NL_MEDIA_SET(r4, &(0x7f0000001a40)={0x0, 0x0, &(0x7f0000001a00)={&(0x7f0000001880)={0x34, r5, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xdbe}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048080}, 0x8094) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x9000001c}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f00001c1000/0x3000)=nil, 0x40000, 0x9) 16.90948964s ago: executing program 1 (id=925): socket$l2tp(0x2, 0x2, 0x73) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10167, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000019100)={{{@in=@empty, @in6=@initdev}}, {{@in=@multicast2}, 0x0, @in=@initdev}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000a88000/0x1000)=nil, 0x1000) mremap(&(0x7f000046b000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f0000769000/0x1000)=nil) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') pread64(r2, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes192\x00'}, 0x58) open(&(0x7f0000000300)='.\x00', 0x0, 0x0) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x2710, @host}, 0x10, 0x800) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000), &(0x7f00000002c0), 0xb, r4}, 0x38) bpf$MAP_LOOKUP_BATCH(0x1b, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x3, r4}, 0x38) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r5 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x8, &(0x7f00000000c0), &(0x7f0000002140)=0x4) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) socket$can_raw(0x1d, 0x3, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x4000010) r6 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x5, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r6, 0xc0585605, &(0x7f00000000c0)={0x1, 0x0, {0x1, 0x0, 0x3009, 0x4, 0xc, 0x0, 0x5, 0x4}}) socket$l2tp(0x2, 0x2, 0x73) 14.401368901s ago: executing program 0 (id=934): syz_open_dev$dvb_dvr(&(0x7f0000000000), 0x0, 0x8257f) openat$mixer(0xffffffffffffff9c, 0x0, 0x121100, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="0600"], 0x50) mmap(&(0x7f0000a06000/0x2000)=nil, 0x2000, 0x200000c, 0x100030, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x4) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x4, &(0x7f0000001800)={{r1}, &(0x7f0000001780)=0x4, 0x0}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0a000000060000000800d0e3", @ANYBLOB='\x00'/19, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$uinput_user_dev(r2, &(0x7f0000000a80)={'syz1\x00', {0x5, 0x1, 0x173, 0x1004}, 0x4, [0xd, 0x2, 0x0, 0x0, 0x0, 0x1, 0x7, 0x5, 0x6c, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x6, 0xd127, 0x67c4, 0x0, 0x0, 0x3fffffd, 0xfffffffd, 0x0, 0x3, 0x0, 0x37eb, 0x0, 0x0, 0x81, 0x8, 0x0, 0x0, 0xab4, 0x0, 0xfffffffc, 0xfffffff0, 0x7fff, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xffffffff, 0x0, 0xc4], [0x5, 0x4, 0x1, 0x2, 0x0, 0x6, 0x0, 0x6, 0x0, 0x4, 0x1, 0x3fbc, 0x1, 0x4, 0x0, 0x0, 0x0, 0x42ac, 0x0, 0x3, 0x8000002, 0x1ab, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x200000, 0x4, 0x2, 0x0, 0x9, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x6, 0xe43, 0xbb, 0xfffffffd, 0x2, 0x24001, 0x6, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7, 0x5, 0x10000, 0x0, 0x3, 0x0, 0x0, 0x2, 0x4, 0x2], [0xfffffffe, 0xfffffffd, 0xfffffffd, 0x2, 0x6, 0x8, 0x322d, 0x8, 0x0, 0x0, 0x4, 0x2, 0xb, 0xcc5, 0x8, 0x0, 0x0, 0x2, 0xd38, 0x0, 0x0, 0x9fc7adae, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffe, 0x0, 0x1, 0x3, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1, 0x5, 0x0, 0x0, 0x2000000, 0x0, 0xffffffff, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8000, 0x0, 0xffffffff, 0x7fff], [0x0, 0x0, 0x40000001, 0x0, 0xab47, 0x0, 0x400526b, 0x4, 0x0, 0x80000000, 0x9, 0x0, 0x0, 0x7652fc9f, 0x0, 0x0, 0x2, 0x0, 0xfffffff9, 0x0, 0xffffffff, 0x6, 0xffffffff, 0x400, 0xfffffffd, 0x0, 0x100, 0x81, 0x1, 0xfffffffd, 0xe1a, 0x10004, 0x0, 0xff, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, 0x1000, 0x0, 0x7, 0x0, 0x1]}, 0x45c) syz_emit_vhci(0x0, 0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r5, &(0x7f0000002140)={0x2020}, 0x2020) 12.343741651s ago: executing program 2 (id=935): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000100)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000140)={@hyper}) socket$nl_generic(0x10, 0x3, 0x10) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/mnt\x00') bpf$MAP_CREATE(0x0, 0x0, 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2, 0x2}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$evdev(0x0, 0x8, 0x321501) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 11.608431341s ago: executing program 0 (id=936): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x44, 0x4, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000011}, 0x20000084) 11.368582237s ago: executing program 2 (id=938): sched_setscheduler(0x0, 0x2, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) ioctl$RTC_ALM_SET(r0, 0x40247007, 0x0) ioctl$RTC_PIE_OFF(r0, 0x7006) 11.134780363s ago: executing program 0 (id=939): syz_open_dev$cec(0x0, 0x0, 0x0) r0 = openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) 11.065564588s ago: executing program 2 (id=940): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f00000000c0)) 9.26589075s ago: executing program 2 (id=941): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x71, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f0000000680)={0x1, 0x0, {0x4, 0x0, 0x3008, 0x3, 0xb, 0x4, 0xe7}}) 8.97765719s ago: executing program 2 (id=943): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) poll(&(0x7f0000000100)=[{r1, 0x412}], 0x1, 0x66) 7.986943817s ago: executing program 1 (id=945): keyctl$clear(0x3, 0xffffffffffffffff) r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r1, 0xc2604110, &(0x7f0000000040)={0x0, [[0x9efc, 0x0, 0x0, 0x0, 0x3, 0x0, 0x390, 0x7fffffff], [0x10000, 0x1, 0x0, 0x0, 0x8001], [0x6, 0x0, 0x18, 0x0, 0x0, 0x0, 0x0, 0xffffffff]], '\x00', [{}, {0xfffffffd}, {0x200}, {0x2, 0xfffffffc, 0x0, 0x1, 0x1}, {0x80000009, 0x0, 0x0, 0x1, 0x1}, {0x7fff, 0xfffffffa}, {}, {0x8000000, 0x8f96}, {}, {0x0, 0x1}], '\x00', 0x1000}) bind$alg(r0, &(0x7f00000025c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x60) setsockopt$ALG_SET_KEY(r0, 0x117, 0x7, &(0x7f0000000100)="fbffffff", 0x4) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp6\x00') openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x341001, 0x0) preadv(r3, &(0x7f00000000c0)=[{&(0x7f0000002140)=""/4096, 0x1000}], 0x1, 0x141, 0x0) io_uring_register$IORING_REGISTER_MEM_REGION(r3, 0x22, &(0x7f0000000540)={&(0x7f0000000500)={&(0x7f0000000440)="f7b8da219b6209bd34fb0710fffafb8b6a3173b05dd688d7e26021de318c99211541dec4889c703491535e911f0997584bd075f46de0c5e1f6fe8ad8b6a0f7eb704ad8260769b31a11ee1fc1bb92ecbacf27ce7571add10142bad1df8f32ab9491a45254c4df65ab25d197cb08063f0968b8761a5c953d1c4b2a4e7400b6e65923837c24878e89c6d9cd54e4b389640349701dae2840a0dadfd4f96c1468d4bf15dc137b22a1b562d0d1316a78d916", 0xaf, 0x0, 0x2, 0x4}, 0x1}, 0x1) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) r4 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r4, 0x81044804, &(0x7f0000000400)={0x1, 0x2}) r5 = socket$alg(0x26, 0x5, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x10}, {0xf}, {0xe, 0x8}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x80200000, 0xe, 0x3ffffffc, 0x0, 0x9, 0x40, 0xc022, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040098}, 0x4000) bind$alg(r5, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x45) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="3d985d1b9858", 0x187c737b6f2748e3) syz_usb_control_io$hid(r2, &(0x7f0000000900)={0x24, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0003040006000403"], 0x0, 0x0}, 0x0) epoll_create(0x800) 7.94295483s ago: executing program 0 (id=946): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000007c0)=@file={0x0, './file1/file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet(0xa, 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x19, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x2d8, 0x98, 0x2d8, 0x98, 0x138, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0x70, 0xb8}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r5, 0x8b2c, &(0x7f0000000040)) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000002fc0)=@ethtool_link_settings={0x4d, 0x20080, 0x3, 0x10, 0xd, 0xf6, 0x4, 0x10, 0x9d, 0x4, [0x1, 0x4, 0x1, 0x468, 0x80, 0x3, 0x9, 0x80]}}) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043ef502"], 0xf8) r7 = openat(r4, &(0x7f00000001c0)='./cgroup\x00', 0x84600, 0x180) ioctl$VIDIOC_S_PARM(r7, 0xc0cc5616, &(0x7f0000000840)={0x3, @output={0x0, 0x1, {0x9, 0xfffffff9}, 0x3, 0x2}}) setsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, &(0x7f0000000180)={0x2}, 0x2) mlock(&(0x7f0000ffa000/0x4000)=nil, 0x4000) r8 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000040)={0x80, 0x0, 0x100, 0x800000}, 0x10) sendmsg$nl_route(r8, 0x0, 0x94) syz_usb_connect(0x1, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000009980708b5192100c7980000000109021b00012000ac000904000001070000090905857d97ba3ec4e139a1cfeef8f7f669d5ca77035dc8466b128f4d8a888f42d59a3e82ac18a878cef48ea92c58ed3b7db15603a6ce44b3643ad37570ce563c8bfe2d817a"], 0x0) 6.517938997s ago: executing program 5 (id=949): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000002900)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x60, 0x2, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x9}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x13}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x60}}, 0x40000010) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x44, 0x4, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000011}, 0x20000084) 6.17761763s ago: executing program 5 (id=950): getdents(0xffffffffffffffff, &(0x7f0000000300)=""/56, 0x38) socket$inet_udp(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x110) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f0000001180)=0x2000000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c00078018000180140002"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) 5.199026927s ago: executing program 5 (id=951): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f00000000c0)) 5.196485967s ago: executing program 2 (id=960): syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e22, @multicast1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/mcfilter6\x00') r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x1, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) preadv(r4, &(0x7f00000001c0)=[{&(0x7f0000000580)=""/118, 0x76}], 0x1, 0x5b, 0x100) 4.601555917s ago: executing program 0 (id=952): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x800) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$NL80211_CMD_VENDOR(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x28, r1, 0x701, 0x0, 0x0, {{}, {@void, @void, @val={0xc, 0x99, {0x1, 0x75}}}}, [@NL80211_ATTR_VENDOR_SUBCMD={0x8}]}, 0x28}}, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004000}, 0x0) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, 0x0, 0x4000000) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x14) mkdir(&(0x7f00000003c0)='./file0\x00', 0x10) 4.383958512s ago: executing program 6 (id=863): madvise(&(0x7f0000e9f000/0x4000)=nil, 0x4000, 0xe) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_BIND_IP(r2, &(0x7f0000000500)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x8, @mcast2, 0x2}}}, 0x30) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r4, 0x0, 0xf3a, 0x0) write$binfmt_misc(r4, &(0x7f0000000980), 0xfdef) timer_settime(r1, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x17) fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$evdev(0x0, 0x2, 0x862b01) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) socket$inet6(0xa, 0x2, 0x0) 3.331323374s ago: executing program 5 (id=953): socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0xa2040, 0x0) read$FUSE(r3, &(0x7f00000024c0)={0x2020}, 0xfffffec1) 3.273568347s ago: executing program 0 (id=954): socket$l2tp(0x2, 0x2, 0x73) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10167, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000019100)={{{@in=@empty, @in6=@initdev}}, {{@in=@multicast2}, 0x0, @in=@initdev}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000a88000/0x1000)=nil, 0x1000) mremap(&(0x7f000046b000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f0000769000/0x1000)=nil) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') pread64(r2, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes192\x00'}, 0x58) open(&(0x7f0000000300)='.\x00', 0x0, 0x0) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x2710, @host}, 0x10, 0x800) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000), &(0x7f00000002c0), 0xb, r4}, 0x38) bpf$MAP_LOOKUP_BATCH(0x1b, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x3, r4}, 0x38) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r5 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x8, &(0x7f00000000c0), &(0x7f0000002140)=0x4) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) socket$can_raw(0x1d, 0x3, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x4000010) r6 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x5, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r6, 0xc0585605, &(0x7f00000000c0)={0x1, 0x0, {0x1, 0x0, 0x3009, 0x4, 0xc, 0x0, 0x5, 0x4}}) socket$l2tp(0x2, 0x2, 0x73) 3.273208217s ago: executing program 1 (id=955): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r1, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000028600)=@newtfilter={0x328, 0x2c, 0xd27, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r1, {0xc, 0xa}, {0x0, 0x9}, {0xffff, 0x9}}, [@filter_kind_options=@f_u32={{0x8}, {0x2fc, 0x2, [@TCA_U32_FLAGS={0x8, 0xb, 0x1}, @TCA_U32_INDEV={0x14, 0x8, 'bond_slave_0\x00'}, @TCA_U32_HASH={0x8, 0x2, 0xc}, @TCA_U32_SEL={0x2d4, 0x5, {0x4, 0x9, 0xa, 0x91dc, 0x9, 0x1, 0xfffc, 0x10, [{0x800, 0x0, 0x31ba, 0x7fff}, {0xb29, 0x6c, 0x0, 0x3}, {0x8, 0x7, 0x80000000, 0x7}, {0xd1, 0x1, 0x9b, 0x4}, {0x0, 0x9, 0x7, 0x3}, {0x2, 0x4a5, 0x7, 0x7}, {0x7d, 0x7, 0x9, 0x7fffffff}, {0xce, 0xdea, 0x4, 0x58e}, {0x9, 0x585e, 0x6, 0x4}, {0x80, 0x9, 0x5, 0x2}, {0x2, 0x67f72c9d, 0xfffff800, 0xb}, {0x7, 0x8, 0x8001, 0x1}, {0x7, 0x957, 0xc0000000, 0x8}, {0xff, 0x0, 0x3, 0x9}, {0x4, 0xfffffff8, 0x0, 0xa}, {0x7, 0x0, 0x9, 0x8}, {0x8, 0xfc, 0x9, 0x2}, {0x9, 0x3, 0x0, 0x6}, {0x2, 0x4, 0x3000, 0x1}, {0x6, 0x5, 0x7, 0x69}, {0xbc, 0x2, 0x100000, 0x7379}, {0x2, 0xc, 0xffffffff, 0x7}, {0xf57, 0x0, 0x0, 0x521}, {0xffffffc0, 0x406d, 0xbc9, 0x200}, {0xb, 0x9, 0xffff, 0x400}, {0x10001, 0x3, 0x10, 0x3}, {0x8, 0x8, 0xbb, 0xffffffff}, {0x4, 0x9, 0x1000, 0x8}, {0x8, 0xfffffff6, 0x645, 0xa}, {0x1, 0x1ff, 0x2, 0x1}, {0xfffffffa, 0xce5f, 0x4, 0x80}, {0x6, 0x10000, 0xffffe798}, {0x2, 0x2, 0x100, 0x3ee2}, {0x80000000, 0x9, 0x2, 0x200}, {0x7, 0x0, 0x3, 0x4}, {0x3ff, 0x0, 0x80000000, 0x1}, {0x9, 0x2c, 0xe, 0x6}, {0x9, 0x8, 0xe, 0x5}, {0x1, 0x10, 0xf, 0x6}, {0x3bb1, 0x7, 0x0, 0x7}, {0x8001, 0xffff, 0x2, 0x2}, {0x6, 0x40, 0xd5a4, 0x3ca0}, {0x7fff, 0x6, 0x0, 0x4}, {0x6, 0x1, 0x2, 0x1000}]}}]}}]}, 0x328}, 0x1, 0x0, 0x0, 0x4010}, 0x0) 2.143075905s ago: executing program 5 (id=956): syz_open_dev$cec(0x0, 0x0, 0x0) r0 = openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) 2.06679315s ago: executing program 6 (id=957): r0 = syz_open_dev$evdev(&(0x7f0000000300), 0x2, 0x40) ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000400)=""/125) 1.981712195s ago: executing program 1 (id=958): r0 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$DRM_IOCTL_GET_CAP(r0, 0xc010640c, &(0x7f0000000180)={0x12}) 1.751083721s ago: executing program 1 (id=959): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000002900)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x60, 0x2, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x9}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x13}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x60}}, 0x40000010) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x44, 0x4, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000011}, 0x20000084) 1.714981254s ago: executing program 6 (id=961): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000180)=0x10000000005) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x400000000001, 0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f000001a400)=""/102384, 0x18ff0) r4 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r4, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@private0, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2}, {0x10000, 0x0, 0x9, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x7, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1, 0x1, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in6=@remote, 0x0, 0x2, 0x2, 0xb7, 0xfffffffe, 0x9}}, 0xe8) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x1c) ioctl$KVM_CAP_EXIT_HYPERCALL(0xffffffffffffffff, 0x4068aea3, &(0x7f00000003c0)={0x79}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x59, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fd7000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r7, 0x4080aebf, &(0x7f0000003680)=@vmx={0x0, 0x0, 0x2080, {0x0, 0x0, {}, 0x0, 0x2}}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000180)="660f388084000072baf80c66b860b4498c66efbafc0c66b80e00000066ef64f30fc7b000100f850100f30fc7b1030066b9800000c00f326635000400000f30d2bc0a000f23c80f21f86635040040000f23f8b8f4008ee0", 0x57}], 0x1, 0x48, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x4000890}, 0x4000) r8 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r8, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) 1.584795712s ago: executing program 5 (id=962): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000001640)=ANY=[@ANYBLOB="18000000000000000000000000000000180500002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff8500000004000000954759ed1fe2d1d95eb67b64bd614bf89df82316ea5cd4db3193a45b61961c7685e022d70760041e62896c735e971e35eaf1e5a331ae04ce6a1407c4acf7d493d0a39b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x31, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b0}, 0x94) r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)=@o_path={&(0x7f0000000000)='./file0\x00'}, 0x18) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x810) r4 = syz_open_dev$vim2m(0x0, 0x10003, 0x2) pwritev(r4, &(0x7f00000002c0)=[{&(0x7f0000000a80)}, {0x0}, {&(0x7f0000000100)}, {0x0}], 0x4, 0x5, 0x1) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0, 0x0) r9 = fanotify_init(0xf00, 0x1000) fanotify_mark(r9, 0x105, 0x5000003a, r8, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) r10 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$sock_timeval(r10, 0x1, 0x15, &(0x7f0000000140)={0x0, 0x2710}, 0x10) connect$llc(r10, &(0x7f0000000000)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, @remote}, 0x10) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x1) sendmsg$RDMA_NLDEV_CMD_DELLINK(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000015c0)=ANY=[@ANYBLOB="18000000041401002dbd7000fedbdf250800010000000000ba30b28e994c1a08786eb807e0000000000000000000009fe70ba83a7a66e67a0bae5cfaccbbb81e28d7b568daf133e50b", @ANYRESHEX, @ANYRESOCT=r0], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@fallback=r3, 0x35, 0x0, 0x6, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000180)=[0x0, 0x0, 0x0], 0x0, &(0x7f0000000300)=[0x0, 0x0, 0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000580)=ANY=[@ANYRES32=r1, @ANYRES32=r2, @ANYBLOB='7\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00', @ANYBLOB="093f092fa1edc01e09b26f", @ANYRES64=r11], 0x20) 9.30934ms ago: executing program 1 (id=963): socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x87, @private=0xa010101, 0x4e24, 0x1, 'none\x00', 0x5, 0x32bd, 0x9}, {@loopback, 0x4e25, 0x2, 0xfffffffe, 0x8, 0x12d5c}}, 0x44) ioctl$BTRFS_IOC_SUBVOL_CREATE(r0, 0x5000940e, &(0x7f0000001140)={{}, "301a4354020b5a3b5be09b6ac5ab50fc9a2188403970c96669a5fd1d1a03a6d6c99590d40d5fc0332707953a4ba7372e1d6607d3b248c8c7992392129f5c6cf814d6db5a9b81e55485a09db5aaf0c7abcf7e87e85922cf810f6a632c8ed5560e1eb620951e11b81fbe8842637a7a654f5ca69bd15f5662a833e74581926f4285cc87ff7dc9684b7dd1518774cf1da4f5a4f6679875331729d20d3d3bfc9c4234fd334c78141ec6e1909fe4c49a6e560b3a6e6f5f16cded0cc4a6bd918b9848e133b4f1c566201ab33b9c543c84d96824e368587a109fcff5cb9dae558716f7a025ab6de6dcfe84db87584a137210f128f08ed24afa01a2a794b3c61f7a883a955a4d4de1c985fd9aeb9abc540953c628e92ecf9476e8ee4807b7eadddb8e39cb4b33be0dd16198c2ae1185926d040529acecc9792abf641ba21adc9d232e25cd4559f4f55056a0b7bc36816a6c41c96b3615522538219d31429666a05c00c4c26ecb564019bc456ac893ca85273ee18c5bd6bb1500d49c03f061407d0d58065b6d93f30678289bae24b6911a91c37e60092b5e42b57c3e8d715a4447cb0129fd366276e9462b437090c7d551a071309ed26c8ff74254540845039f7c4d59001775e26c4a7503bb361947382b8e091da377457f0f0aab2f3c5edd4d39fd0e3e1c18cbeb68f257a34d8c501245cef1a39580c2167e69fed84cd6c3eee5801da19c482734ee00d04b3f3623b9cd872f467a9abdae4acc5b5b18ff6eb11a2f4f873f7066c4fbe1223e9c7f91588d2b29efff45010e1706fa3409a0b8d908c749812f8688fa7d693888c9f4286d707599cdf3beed2d541c123322d01547f7bb064df98679695431925cf811dd002c4cadfd5fe4f70b8fb1e222ae0fc5b1e489cd14ab21ecabc975c107c30b869b8b24448623c27467a54f40f034d2b6c83077febb9337e485fac49ad1c32e0e10ee3892acf87bbd4bcf0c15ad53daf4f36426f7804e54f301ae09fa74129187661af6b2a85cbd10b3cba1d7abef1e5ec9ca9bd08fea2a77c249775529018de5511c57a204e3128063619b0980755bc98b0fe21026a1c9cd3b2b9c30e068ebba888953d629db0ab8864bbbeedd0fe5f4b54565d0107a2f8b82146be70e97b554aa36f398746ba8c8e1d49ab017093a2de6e0a322c914aab3e7ea158ad6bb61ebcc4c18b87272bd59d3f57e0ce01c7dbb47e8f9af2f27410ccff6d91aad1ebd8c69514b812f3627550ee03d1fda64affcbbdcbb85784893a204dcf149a5d1c095571ee88ef7c197eb66d588d9ddaadee723bfb94a12cb7db66ab8fcf0f8ac6b532035724069f2a8890abe1c61cb135a94ae6ceffc541bc3d1fe648c518075e6a47a1aa20883db250f080282a6fe6474d1057472fd0e16f0b1162bf43d86d0a5af795a8d1930981589b977c6b6e39a5cd12d1d1d809f3a468869aa8ddf7a113c311b2c8112aef90d58c47d80f139256c8b36d5e254ee9ebe7702fb4e7724f6571d1f434e837387bfaf9b8cc09a246d74028da74431b48d369330d32c3dfea4594c73b4d247b749d7c13151e9eed7ac7f50d04c69ba54ba99f247d3c6c94b16403689cf183f2ac9e5ef579c523533ac8c6ea698a1d3c19f9dec50ef027bbc59f50889e605aa85bd4aa1b90bd72553458a999d1f6769bd7d4a9268d00d10a3d1d24c589959873dd1b9ab0b87cb2f13c8c1b34bdc3bbf39ef6c11de3b507859ddf15ac0fb19ed5c3812cf61af47af00903b978903e8b7b3a4c8d0d97ec48a6a09eb105c29b8f821d08a5857666ce47259866edff15849ac677c9b847d12977a11a86cc065afca781af8915875c03b33550530954223016102ed0f07cd77f404cbacd3a52d888bb1acae7143a4d3fa66435420e8ba13dd6d9dfe81f812e2ea9cb152c61fe54a4915c70d9af5ccddadb25a6ee45c55c4f9e8801712edce81c956c26708d9242393965f721f3d03c2a3d9310af57cee9f28ba59556704c28361cce90137a49931153e69687ec1eba01a84f686dbe82d09cebf3070328ccf95ade1b43056e5b6d7dadc7bd61d87e7ddee2d208c1a34514888af7edd88a1e5a2784ed0542b04965e6af661457af21b5b2bdc09daac367c809135efdb17ac53f9ec80c02593b67292df794b902fa56257a13448f10ecf1673cbc39e87f41053576491ddaca7a35132c23b54f18759a0dedeabd4a557d8b06204e63cecf6f6e5c740b019fa804b384aa6dd8612f6128a737659789cb247172a97a1a25dc59c37e15aca0cf2ce7a75d444768327b8f9bec8c584f8827fe33d65e9835b50774582ac57beef8b8a11dd6873f2f6d9db906dc0bbefc34d9edebc79113154d6751b8c7be69a304e2a38cb7212b07909f0f4c55da8ce40ec8fdfe9cbe5a375fd9952ed289fbfde43f990bb74c01897f1a28375bd6d5a610501a34f702b94756e1ef14eb128056d5615e94d917352946e3524f41ad525db3ffbc3a5691f0a944e9669f5971885d21164933c26054f8090942283784c320a5ac2b21edc4f5dc3ddf8ffb373fa72069549a8299eb19c7d49937cdb836a2d5390f783de116cb2a766cfc2aa1938bb9c2e6652f29dbe3cf80c4ea63e94c7d0ecb1838334f0fe4ba656eb74d614dd804489f9db000f4b682cfab42c091c53b3507ad2bfd3bf80acf21eab350c5642d62d6443e59208de047beda8ec05bddfacc42021cc34dfc975e006e1a90862c4869c96f3cc66482abde0c61a19ef86e229ef5037e54ca9e0afaffb0102d6aff95921060b742932e0acb010f2662f9bdbf92dc2a04f54b45d4130a9de71053f142fc169df25c6e2078b0695ac22b3f28b590f63d30488754bcda7fc73f7a855e7bf2712e394f5bba88972130f81090f1b0f0badfa919c0be535c0b21c64b8315a0163613f7889f8b8cb33e165dfdca1a01aff20ca9bf0b24d307a06eb781e54d13b817e958ee24908cdf82158eb1ed5f641964965e2d384d3ad180fb8a1a02b1488f68068f515146a4adbd5fb4dcb784926715358104fcbd3eaf0210b08836eae315ff81d23f196fad59d79784b14ea01177c843df34796ee1bf172e38eb4466ef8a6446b5a17dbbc4f88d6186b1d7ebb3d234ede0af7fee9cd1ba56351fb4951ee1cbdcbadb9901f63d767f5c0cb9c34f1dca0ea49da13b63bfc275575128659cb85b7d47eb8c8a7531a0c3a4c32c02fd77d60479c9ed8145b627bb0389e9a8cbba83a9c9e769a26c4d697f13854502427abb6f2cd60da5e1d860c65fcaaa9cff953053db6065d237c2763359221258bbb0764048fe9b58c2d3951d2b49105a60e711509172c6404e29faf2bdf93f379ad7a7d423bf701539c1b8e8b4d82375ac853fadda209d9d3533ead323c1aec5d1fe2b83286d165712d28d3d4afc1c5eb50bcbbfb82ae01685133839de78ced9b01c2577bfc355d48a23b6d3c22644da69e46e3d72f9106d3e7273f1922227b165baa2ac79f4b152662a6744aef80fbfe00c61c2ade19436616c7d0d16c6e4ffda269ee7c9e6c3a3d1182829d01160e7261551f867c51b9183128a5145a32f1331eeba784085d823d8759fbb542aef746cb6e702daee4c996f4217c959fbf80c47b0cdf1fe847564ad5c0d79ac8e84daa452eb72b1bff40870f2d7972949886a2fdbcf355926a649e532606d53ad236544d25e68acb71f04193c2e57485a61c5fb671441a928c7731abdf12a7d3357ab2a0bf5e1237f79f8bc6af2b10955d9e4666764e8c7aadef0f94055a11ea6d75eec0812231bc7f8931a50e8db3b15061e0eb708656ec34fc31e3571ffcbb3b5e281d8058e55d453e2b41c493595af85b8f3ce8acc6aab364b4ebf7dfe1b94d37030cdb121fddb4b55f0137a2c11667c92270541f2c79aaed2d5738d3d955da1c805d9a87126e35670fdb8bfbceb2eb1825efe59313cd1340d409a40c33c8a0a1eada6256019be31ad1c65d7267d3c06a3469194c7a24acce96b19985ce90e9106fe038d88cd87966ba213db59865641c3f86e61900062fb57c843783ee841bf15128b590720d5a11b7b95f605307fb010ed2ad6c8229a4854ca30f731e122032d707f00ee3902cb33c0742d04bfc2459a25e57b22b721256bd12d21528bb3e2c989a6cb30492d7d06b36f73bed330ff830f52586b11b720cb76af7e14144b7f76f51007a9d835038ded09282ff8fafb50ba39ac293dd5f99da47cf50e1dc925323e337c54ecf8387b8f298291cfba6ab56e5c50e99f14325e287d50c5182dc5319de2c4fa2db7a123e61dad5ba6542751e43b5158348cc7d0a4b48c71e32ff91b66bd2bdc2a4d4e627fb49bd2e5644b7fc94042af64cb0097c783aa862e7cfbf6afb86432b946712e45e826bf13cdfe7b2d9cfb576f912b6783da3dab6ae74d67d95a66c9552bf47e7a42a4cdd21754e103ccf3999cf8f989811b515a301fe41cc7c42da1a67f23a7a6e20a413dd93e4aee4e70ff62ae77788fcdfdd983449ce9fd11583cd2bb29965eb8b44a9c041e129558ec1466ff67624923dcc76c069644556dcaf52230cb39f7a506b67e86016ade1961a0c2afa81e4bee33a56340a6256cb01acf98a7ceb5f8a72e0e53e7ad8ba9931c33ffbbe921bbe4da9138971946cd808f7ca197b74caf11589bea1e4bc3e8a65823cd6d7acf59681d791f5c36b929e9b9a73c986f7bfcedfa122168d8ece9e189867750988d21edb2a777c8d48c4d8a72408ab02100bb41afcbfcab1f130be1bb3bdd58295691c315bc0cb5960444d60e124ac6022910338728ca1c699c56328ba3aa89293518cb15e157ec35f297293d1d47ce9615ef6841ce9646b33abe6c9bdffc73589ec13f3ee34fdee02c5e6bc74e87091a298c5b27742fc50895585ea1689fde12e1e9c6e7ac9c5b29309dee600cfa181ae3084f390d471c17737f3c25fd8f6a95857aeee6f7d871a381e9eef79ab39dd3789268f2e367b8eacc0ad7d2c1e0ce03afd329f9a9c236b1373264d365617cc2ac913f93add2381a28a915eb9123d2532dfc1d357cd7599540e3e0502058c0eb67c8818806741abce0e2d612e77d363603e8f1ec07db46ab17105646668ebfcc17a6a47f7261d27e42e8ae641154bd0e598e0c16b7e9b1dcbd05c0ebd8e38e8c0f744f2ecc0024177a3f963e429f02a6b6ddacb56a58c337d059720ea5e0e8fb98f9a49e0b45936bff42e9d8a1e858666da989fe604b824d62e3229f45266da1ae86e7fe42b13e4a1db949c336efb2609df3ca06826b6d3ce1efbf27f684845c8d349e94c9b3e14c2d0d9187fcf5f3a19c0e59a9691d2b38ef479ceddc6ca3123c77752014c106cc81d06aee6a393b066346904276280492d7dd6314b58d1a546258877495ade05956801e894a64d8df0bc06e070fa4688c7f86640b0dd1ef0c5ad302d3a3f2e8c4736a459112d000ef2745fc26fb471a3019a0fd95ab9f4bec2ebb16f04fff88d244aa3c8a361267e1880c8145b8197b293bc3681b05a91bf9bd6ad697f0d63585b5635df4a9366e4de57781c84e2836ed4163e94d7aeafe7e9394d7ced6d331a021c1d308860689662d86bc4c15c41a1fa979c52a5352095921bf4945eb0b6aa54944ae5e6cad4fc44361aca3fb0847329ee3c75c0dfce1eb80c18ae2d0aed50993147b62c28fadc965584a7feca5e9e3d3564aaecfcb9c09910440283fafd065f74bd37cda4fb541e37ba6587fe3a1331afd97a96573435492ce6e14624b3099fb368ecba4839ffc4e39302400e0c710f734f01b73527fbbd75b097b4e1bcbec0babbc5"}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000020000/0x18000)=nil, &(0x7f0000000300)=[@textreal={0x8, 0x0}], 0x1, 0x69, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x0, 0x10d000}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f"], 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000d40)=@filter={'filter\x00', 0x2, 0x4, 0x388, 0xffffffff, 0x1e8, 0x0, 0x0, 0xfeffffff, 0xffffffff, 0x2b8, 0x2b8, 0x2b8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @mcast1, [0xffffff00, 0xff, 0x0, 0xffffff00], [], 'pimreg0\x00', 'bond_slave_0\x00', {}, {}, 0x6, 0x0, 0x3, 0x40}, 0x2f2, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0xa, 0x8, 0x5365}}}, {{@ipv6={@remote, @loopback, [0x0, 0xff000000], [0x0, 0x0, 0xffffffff], 'netdevsim0\x00', 'syz_tun\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "ddabf53d9b1435965491f6531877000001e770b689f173dfa40b58c10327e3121114449fd20ba2be6eb0cde72a972f25170163232ed996b4789b9d00"}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x401}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 6 (id=964): syz_open_dev$dvb_dvr(&(0x7f0000000000), 0x0, 0x8257f) openat$mixer(0xffffffffffffff9c, 0x0, 0x121100, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="0600"], 0x50) mmap(&(0x7f0000a06000/0x2000)=nil, 0x2000, 0x200000c, 0x100030, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x4) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x4, &(0x7f0000001800)={{r1}, &(0x7f0000001780)=0x4, 0x0}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0a000000060000000800d0e3", @ANYBLOB='\x00'/19, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$uinput_user_dev(r2, &(0x7f0000000a80)={'syz1\x00', {0x5, 0x1, 0x173, 0x1004}, 0x4, [0xd, 0x2, 0x0, 0x0, 0x0, 0x1, 0x7, 0x5, 0x6c, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x6, 0xd127, 0x67c4, 0x0, 0x0, 0x3fffffd, 0xfffffffd, 0x0, 0x3, 0x0, 0x37eb, 0x0, 0x0, 0x81, 0x8, 0x0, 0x0, 0xab4, 0x0, 0xfffffffc, 0xfffffff0, 0x7fff, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xffffffff, 0x0, 0xc4], [0x5, 0x4, 0x1, 0x2, 0x0, 0x6, 0x0, 0x6, 0x0, 0x4, 0x1, 0x3fbc, 0x1, 0x4, 0x0, 0x0, 0x0, 0x42ac, 0x0, 0x3, 0x8000002, 0x1ab, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x200000, 0x4, 0x2, 0x0, 0x9, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x6, 0xe43, 0xbb, 0xfffffffd, 0x2, 0x24001, 0x6, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7, 0x5, 0x10000, 0x0, 0x3, 0x0, 0x0, 0x2, 0x4, 0x2], [0xfffffffe, 0xfffffffd, 0xfffffffd, 0x2, 0x6, 0x8, 0x322d, 0x8, 0x0, 0x0, 0x4, 0x2, 0xb, 0xcc5, 0x8, 0x0, 0x0, 0x2, 0xd38, 0x0, 0x0, 0x9fc7adae, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffe, 0x0, 0x1, 0x3, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1, 0x5, 0x0, 0x0, 0x2000000, 0x0, 0xffffffff, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8000, 0x0, 0xffffffff, 0x7fff], [0x0, 0x0, 0x40000001, 0x0, 0xab47, 0x0, 0x400526b, 0x4, 0x0, 0x80000000, 0x9, 0x0, 0x0, 0x7652fc9f, 0x0, 0x0, 0x2, 0x0, 0xfffffff9, 0x0, 0xffffffff, 0x6, 0xffffffff, 0x400, 0xfffffffd, 0x0, 0x100, 0x81, 0x1, 0xfffffffd, 0xe1a, 0x10004, 0x0, 0xff, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, 0x1000, 0x0, 0x7, 0x0, 0x1]}, 0x45c) syz_emit_vhci(0x0, 0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r5, &(0x7f0000002140)={0x2020}, 0x2020) kernel console output (not intermixed with test programs): 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 245.188695][ T6237] R13: 00007ff200a16038 R14: 00007ff200a15fa0 R15: 00007ffd2f029df8 [ 245.196689][ T6237] [ 245.324926][ T6240] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input32 [ 246.089508][ T6228] netlink: 'syz.4.408': attribute type 1 has an invalid length. [ 246.145878][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880559b3400: rx timeout, send abort [ 246.196893][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff8880559b3400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 246.846984][ T6246] device syzkaller0 entered promiscuous mode [ 247.024987][ T6248] loop0: detected capacity change from 0 to 2048 [ 247.070517][ T6248] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 247.536648][ T6248] fuse: Unknown parameter 'subj_user' [ 247.811551][ T5159] EXT4-fs (loop0): unmounting filesystem. [ 247.876151][ T6268] FAULT_INJECTION: forcing a failure. [ 247.876151][ T6268] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 247.921935][ T6268] CPU: 0 PID: 6268 Comm: syz.2.418 Not tainted syzkaller #0 [ 247.929308][ T6268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 247.939384][ T6268] Call Trace: [ 247.942701][ T6268] [ 247.945645][ T6268] dump_stack_lvl+0x188/0x24e [ 247.950373][ T6268] ? show_regs_print_info+0x12/0x12 [ 247.955769][ T6268] ? load_image+0x400/0x400 [ 247.960292][ T6268] ? __lock_acquire+0x7d10/0x7d10 [ 247.965345][ T6268] should_fail_ex+0x399/0x4d0 [ 247.970044][ T6268] _copy_from_user+0x2c/0x170 [ 247.974756][ T6268] ___sys_sendmsg+0x1c3/0x360 [ 247.979494][ T6268] ? __lock_acquire+0x7d10/0x7d10 [ 247.984552][ T6268] ? __sys_sendmsg+0x290/0x290 [ 247.989434][ T6268] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 247.995465][ T6268] __sys_sendmmsg+0x2c3/0x510 [ 248.000173][ T6268] ? __ia32_sys_sendmsg+0x80/0x80 [ 248.005229][ T6268] ? mutex_unlock+0x10/0x10 [ 248.009767][ T6268] ? __fget_files+0x43d/0x4b0 [ 248.014473][ T6268] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 248.020502][ T6268] ? lock_chain_count+0x20/0x20 [ 248.025380][ T6268] __x64_sys_sendmmsg+0x9c/0xb0 [ 248.030254][ T6268] do_syscall_64+0x4c/0xa0 [ 248.034689][ T6268] ? clear_bhb_loop+0x60/0xb0 [ 248.039397][ T6268] ? clear_bhb_loop+0x60/0xb0 [ 248.044089][ T6268] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 248.049998][ T6268] RIP: 0033:0x7f68a759c819 [ 248.054427][ T6268] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 248.074132][ T6268] RSP: 002b:00007f68a8498028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 248.082562][ T6268] RAX: ffffffffffffffda RBX: 00007f68a7815fa0 RCX: 00007f68a759c819 [ 248.090554][ T6268] RDX: 0000000000034000 RSI: 0000200000004380 RDI: 0000000000000003 [ 248.098540][ T6268] RBP: 00007f68a8498090 R08: 0000000000000000 R09: 0000000000000000 [ 248.106527][ T6268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 248.114511][ T6268] R13: 00007f68a7816038 R14: 00007f68a7815fa0 R15: 00007ffd2d671d18 [ 248.122741][ T6268] [ 249.003763][ T6278] netlink: 28 bytes leftover after parsing attributes in process `syz.4.421'. [ 249.192813][ T6251] loop3: detected capacity change from 0 to 32768 [ 249.350028][ T6251] XFS (loop3): Mounting V5 Filesystem [ 249.469535][ T6251] XFS (loop3): Ending clean mount [ 249.494205][ T26] audit: type=1800 audit(1775524380.381:7): pid=6251 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.415" name="file1" dev="loop3" ino=6150 res=0 errno=0 [ 249.692909][ T6292] device syzkaller0 entered promiscuous mode [ 249.731901][ T6297] device syzkaller0 entered promiscuous mode [ 250.034641][ T4268] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 250.292905][ T6306] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input33 [ 250.329853][ T4268] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 250.465738][ T4268] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 250.665064][ T4268] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 250.878311][ T4268] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.940995][ T4268] usb 4-1: can't set config #27, error -71 [ 250.958199][ T4268] usb 4-1: USB disconnect, device number 9 [ 251.132067][ T6312] netlink: 28 bytes leftover after parsing attributes in process `syz.1.426'. [ 251.144810][ T6312] netlink: 76 bytes leftover after parsing attributes in process `syz.1.426'. [ 251.397509][ T6303] loop4: detected capacity change from 0 to 40427 [ 251.431386][ T6303] F2FS-fs (loop4): Unrecognized mount option "Xctive_logs=4" or missing value [ 251.995281][ T6303] loop4: detected capacity change from 0 to 32768 [ 252.043136][ T6303] (syz.4.425,6303,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 252.069486][ T6303] (syz.4.425,6303,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 252.149163][ T6303] JBD2: Ignoring recovery information on journal [ 252.235982][ T6303] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 252.501897][ T4270] ocfs2: Unmounting device (7,4) on (node local) [ 252.928070][ T6326] FAULT_INJECTION: forcing a failure. [ 252.928070][ T6326] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 252.949158][ T6326] CPU: 0 PID: 6326 Comm: syz.4.428 Not tainted syzkaller #0 [ 252.956518][ T6326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 252.966681][ T6326] Call Trace: [ 252.969973][ T6326] [ 252.972923][ T6326] dump_stack_lvl+0x188/0x24e [ 252.977637][ T6326] ? show_regs_print_info+0x12/0x12 [ 252.982854][ T6326] ? load_image+0x400/0x400 [ 252.987377][ T6326] ? __lock_acquire+0x7d10/0x7d10 [ 252.992422][ T6326] ? trace_contention_end+0x5f/0x170 [ 252.997729][ T6326] should_fail_ex+0x399/0x4d0 [ 253.002421][ T6326] _copy_from_user+0x2c/0x170 [ 253.007122][ T6326] snd_pcm_oss_write2+0x2c1/0x410 [ 253.012167][ T6326] ? snd_pcm_hw_param_max+0x6a0/0x6a0 [ 253.017553][ T6326] ? snd_pcm_do_prepare+0x220/0x220 [ 253.022763][ T6326] ? snd_pcm_action_nonatomic+0x24a/0x2a0 [ 253.028501][ T6326] snd_pcm_oss_write+0x6a7/0xaf0 [ 253.033467][ T6326] ? snd_pcm_oss_read+0x8b0/0x8b0 [ 253.038509][ T6326] vfs_write+0x2e6/0xa30 [ 253.042774][ T6326] ? file_end_write+0x250/0x250 [ 253.047648][ T6326] ? __fget_files+0x28/0x4b0 [ 253.052257][ T6326] ? __fget_files+0x28/0x4b0 [ 253.056953][ T6326] ? __fget_files+0x43d/0x4b0 [ 253.061656][ T6326] ? __fdget_pos+0x1d4/0x360 [ 253.066265][ T6326] ? ksys_write+0x71/0x250 [ 253.070702][ T6326] ksys_write+0x14c/0x250 [ 253.075053][ T6326] ? __ia32_sys_read+0x80/0x80 [ 253.079839][ T6326] ? lockdep_hardirqs_on+0x94/0x140 [ 253.085055][ T6326] do_syscall_64+0x4c/0xa0 [ 253.089488][ T6326] ? clear_bhb_loop+0x60/0xb0 [ 253.094182][ T6326] ? clear_bhb_loop+0x60/0xb0 [ 253.098879][ T6326] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 253.104792][ T6326] RIP: 0033:0x7f667e19c819 [ 253.109224][ T6326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 253.128935][ T6326] RSP: 002b:00007f667f11f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 253.137361][ T6326] RAX: ffffffffffffffda RBX: 00007f667e415fa0 RCX: 00007f667e19c819 [ 253.145352][ T6326] RDX: 0000000000004000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 253.153334][ T6326] RBP: 00007f667f11f090 R08: 0000000000000000 R09: 0000000000000000 [ 253.161327][ T6326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 253.169305][ T6326] R13: 00007f667e416038 R14: 00007f667e415fa0 R15: 00007ffd90cd90e8 [ 253.177316][ T6326] [ 254.452014][ T6300] device syzkaller0 entered promiscuous mode [ 254.660523][ T4267] XFS (loop3): Unmounting Filesystem [ 255.932761][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.939271][ T1277] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.837347][ T6358] overlayfs: failed to resolve './cgroup': -2 [ 257.874296][ T6361] FAULT_INJECTION: forcing a failure. [ 257.874296][ T6361] name failslab, interval 1, probability 0, space 0, times 0 [ 257.934823][ T6361] CPU: 1 PID: 6361 Comm: syz.2.434 Not tainted syzkaller #0 [ 257.942191][ T6361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 257.952376][ T6361] Call Trace: [ 257.955700][ T6361] [ 257.958664][ T6361] dump_stack_lvl+0x188/0x24e [ 257.963414][ T6361] ? show_regs_print_info+0x12/0x12 [ 257.968654][ T6361] ? load_image+0x400/0x400 [ 257.973183][ T6361] ? __might_sleep+0xd0/0xd0 [ 257.977788][ T6361] ? __lock_acquire+0x7d10/0x7d10 [ 257.982839][ T6361] should_fail_ex+0x399/0x4d0 [ 257.987537][ T6361] should_failslab+0x5/0x20 [ 257.992054][ T6361] slab_pre_alloc_hook+0x59/0x310 [ 257.997092][ T6361] ? prepend_path+0xa68/0xc20 [ 258.001782][ T6361] ? tomoyo_encode+0x27e/0x540 [ 258.006829][ T6361] __kmem_cache_alloc_node+0x4f/0x260 [ 258.012220][ T6361] ? tomoyo_encode+0x27e/0x540 [ 258.017021][ T6361] __kmalloc+0xa0/0x240 [ 258.021201][ T6361] tomoyo_encode+0x27e/0x540 [ 258.025815][ T6361] tomoyo_realpath_from_path+0x58e/0x5d0 [ 258.031473][ T6361] ? tomoyo_path2_perm+0x281/0x880 [ 258.036690][ T6361] tomoyo_path2_perm+0x2aa/0x880 [ 258.041647][ T6361] ? tomoyo_check_mkdev_acl+0x490/0x490 [ 258.047211][ T6361] ? mark_lock+0x94/0x320 [ 258.051565][ T6361] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 258.057586][ T6361] ? __lock_acquire+0x7d10/0x7d10 [ 258.062630][ T6361] ? __rwlock_init+0x140/0x140 [ 258.067419][ T6361] tomoyo_path_rename+0x14b/0x1a0 [ 258.072485][ T6361] ? tomoyo_path_link+0x120/0x120 [ 258.077552][ T6361] security_path_rename+0x168/0x200 [ 258.082794][ T6361] do_renameat2+0x6ba/0xce0 [ 258.087331][ T6361] ? __lock_acquire+0x7d10/0x7d10 [ 258.092399][ T6361] ? fsnotify_move+0x4e0/0x4e0 [ 258.097194][ T6361] ? __check_object_size+0x500/0xa40 [ 258.102520][ T6361] ? getname_flags+0x206/0x500 [ 258.107376][ T6361] __x64_sys_renameat2+0xce/0xe0 [ 258.112386][ T6361] do_syscall_64+0x4c/0xa0 [ 258.116830][ T6361] ? clear_bhb_loop+0x60/0xb0 [ 258.121523][ T6361] ? clear_bhb_loop+0x60/0xb0 [ 258.126226][ T6361] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 258.132219][ T6361] RIP: 0033:0x7f68a759c819 [ 258.136651][ T6361] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 258.156360][ T6361] RSP: 002b:00007f68a8477028 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 258.164964][ T6361] RAX: ffffffffffffffda RBX: 00007f68a7816090 RCX: 00007f68a759c819 [ 258.172957][ T6361] RDX: ffffffffffffff9c RSI: 0000200000000440 RDI: ffffffffffffff9c [ 258.181031][ T6361] RBP: 00007f68a8477090 R08: 0000000000000000 R09: 0000000000000000 [ 258.189101][ T6361] R10: 0000200000000480 R11: 0000000000000246 R12: 0000000000000001 [ 258.197082][ T6361] R13: 00007f68a7816128 R14: 00007f68a7816090 R15: 00007ffd2d671d18 [ 258.205080][ T6361] [ 258.276811][ T6367] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 258.341453][ T6361] ERROR: Out of memory at tomoyo_realpath_from_path. [ 258.703349][ T6369] netlink: 8 bytes leftover after parsing attributes in process `syz.1.437'. [ 258.734274][ T6369] loop1: detected capacity change from 0 to 512 [ 258.741633][ T6369] FAT-fs (loop1): Unrecognized mount option "sys_immut" or missing value [ 258.805103][ T6373] FAULT_INJECTION: forcing a failure. [ 258.805103][ T6373] name failslab, interval 1, probability 0, space 0, times 0 [ 258.825910][ T6373] CPU: 1 PID: 6373 Comm: syz.4.439 Not tainted syzkaller #0 [ 258.833268][ T6373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 258.843350][ T6373] Call Trace: [ 258.846646][ T6373] [ 258.849590][ T6373] dump_stack_lvl+0x188/0x24e [ 258.854288][ T6373] ? show_regs_print_info+0x12/0x12 [ 258.859505][ T6373] ? load_image+0x400/0x400 [ 258.864025][ T6373] ? __might_sleep+0xd0/0xd0 [ 258.868636][ T6373] ? __lock_acquire+0x7d10/0x7d10 [ 258.873676][ T6373] should_fail_ex+0x399/0x4d0 [ 258.878365][ T6373] should_failslab+0x5/0x20 [ 258.882872][ T6373] slab_pre_alloc_hook+0x59/0x310 [ 258.887912][ T6373] ? page_pool_create+0x6d/0x5c0 [ 258.892861][ T6373] __kmem_cache_alloc_node+0x4f/0x260 [ 258.898247][ T6373] ? page_pool_create+0x6d/0x5c0 [ 258.903195][ T6373] kmalloc_node_trace+0x22/0xe0 [ 258.908063][ T6373] page_pool_create+0x6d/0x5c0 [ 258.912838][ T6373] bpf_test_run_xdp_live+0x223/0x1a90 [ 258.918226][ T6373] ? verify_lock_unused+0x140/0x140 [ 258.923441][ T6373] ? kasan_set_track+0x60/0x70 [ 258.928219][ T6373] ? kasan_set_track+0x4b/0x70 [ 258.932996][ T6373] ? __kasan_kmalloc+0x8e/0xa0 [ 258.937774][ T6373] ? bpf_test_init+0x9f/0x140 [ 258.942457][ T6373] ? bpf_prog_test_run_xdp+0x484/0xf10 [ 258.947925][ T6373] ? bpf_prog_test_run+0x31e/0x390 [ 258.953050][ T6373] ? __x64_sys_bpf+0x78/0x90 [ 258.957657][ T6373] ? do_syscall_64+0x4c/0xa0 [ 258.962265][ T6373] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 258.968348][ T6373] ? xdp_convert_md_to_buff+0x330/0x330 [ 258.973922][ T6373] ? __lock_acquire+0x7d10/0x7d10 [ 258.978963][ T6373] ? __virt_addr_valid+0x188/0x540 [ 258.984097][ T6373] ? trace_raw_output_bpf_test_finish+0xd0/0xd0 [ 258.990356][ T6373] ? bpf_test_init+0x119/0x140 [ 258.995128][ T6373] ? xdp_convert_md_to_buff+0x5b/0x330 [ 259.000601][ T6373] bpf_prog_test_run_xdp+0x736/0xf10 [ 259.005909][ T6373] ? dev_put+0x80/0x80 [ 259.009998][ T6373] ? dev_put+0x80/0x80 [ 259.014079][ T6373] bpf_prog_test_run+0x31e/0x390 [ 259.019037][ T6373] __sys_bpf+0x62b/0x780 [ 259.023293][ T6373] ? bpf_link_show_fdinfo+0x380/0x380 [ 259.028692][ T6373] ? lock_chain_count+0x20/0x20 [ 259.033567][ T6373] __x64_sys_bpf+0x78/0x90 [ 259.038001][ T6373] do_syscall_64+0x4c/0xa0 [ 259.042432][ T6373] ? clear_bhb_loop+0x60/0xb0 [ 259.047157][ T6373] ? clear_bhb_loop+0x60/0xb0 [ 259.051988][ T6373] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 259.058053][ T6373] RIP: 0033:0x7f667e19c819 [ 259.062483][ T6373] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 259.082115][ T6373] RSP: 002b:00007f667f11f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 259.090544][ T6373] RAX: ffffffffffffffda RBX: 00007f667e415fa0 RCX: 00007f667e19c819 [ 259.098525][ T6373] RDX: 0000000000000050 RSI: 00002000000001c0 RDI: 000000000000000a [ 259.106508][ T6373] RBP: 00007f667f11f090 R08: 0000000000000000 R09: 0000000000000000 [ 259.114491][ T6373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 259.122472][ T6373] R13: 00007f667e416038 R14: 00007f667e415fa0 R15: 00007ffd90cd90e8 [ 259.130464][ T6373] [ 259.165717][ T4438] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 259.309575][ T6381] loop3: detected capacity change from 0 to 512 [ 259.371098][ T6380] device syzkaller0 entered promiscuous mode [ 259.492043][ T6381] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 259.571645][ T6388] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 259.666096][ T6370] sctp: failed to load transform for md5: -2 [ 261.519366][ T14] kernel write not supported for file /vcs (pid: 14 comm: kworker/0:1) [ 261.547313][ T6407] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input34 [ 262.388150][ T6401] loop1: detected capacity change from 0 to 262144 [ 262.400777][ T6401] BTRFS: device fsid 7e32c2af-f87a-45a1-bcba-64dea7c56a53 devid 1 transid 8 /dev/loop1 scanned by syz.1.446 (6401) [ 262.451891][ T6401] BTRFS info (device loop1): first mount of filesystem 7e32c2af-f87a-45a1-bcba-64dea7c56a53 [ 262.462140][ T6401] BTRFS info (device loop1): using xxhash64 (xxhash64-generic) checksum algorithm [ 262.471818][ T6401] BTRFS info (device loop1): metadata ratio 3 [ 262.477948][ T6401] BTRFS info (device loop1): enabling ssd optimizations [ 262.484936][ T6401] BTRFS info (device loop1): using free space tree [ 262.820911][ T26] audit: type=1800 audit(1775524393.711:8): pid=6401 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.446" name="bus" dev="loop1" ino=263 res=0 errno=0 [ 262.842309][ T6401] misc userio: No port type given on /dev/userio [ 262.849932][ T6401] misc userio: Invalid payload size [ 262.955244][ T4267] EXT4-fs (loop3): unmounting filesystem. [ 262.979401][ T6429] netlink: 8 bytes leftover after parsing attributes in process `syz.2.449'. [ 262.988734][ T4266] BTRFS info (device loop1): last unmount of filesystem 7e32c2af-f87a-45a1-bcba-64dea7c56a53 [ 263.610279][ T6430] loop0: detected capacity change from 0 to 131072 [ 263.617850][ T6430] F2FS-fs (loop0): Wrong CP boundary, start(512) end(1536) blocks(0) [ 263.626176][ T6430] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 263.637734][ T6430] F2FS-fs (loop0): invalid crc value [ 263.746736][ T6430] F2FS-fs (loop0): Found nat_bits in checkpoint [ 263.827805][ T6430] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 263.835183][ T6430] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 264.168151][ T4438] BTRFS: device fsid 7e32c2af-f87a-45a1-bcba-64dea7c56a53 devid 1 transid 10 /dev/loop1 scanned by udevd (4438) [ 264.644582][ C0] icmp: detected local route for 172.20.20.170 during ICMP sending, src 172.20.20.0 [ 265.162177][ T6446] loop3: detected capacity change from 0 to 512 [ 265.251646][ T6446] EXT4-fs: Ignoring removed nobh option [ 265.344923][ T6446] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 265.429522][ T6446] EXT4-fs (loop3): 1 truncate cleaned up [ 265.438567][ T6446] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 266.063229][ T4267] EXT4-fs (loop3): unmounting filesystem. [ 266.424482][ T6447] mmap: syz.2.455 (6447): VmData 25837568 exceed data ulimit 5. Update limits or use boot option ignore_rlimit_data. [ 266.924155][ T22] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 266.942584][ T6458] overlayfs: './file0' not a directory [ 267.914270][ T22] usb 4-1: device descriptor read/64, error -71 [ 267.996458][ T6463] FAT-fs (nullb0): bogus number of reserved sectors [ 268.184389][ T22] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 268.281710][ T6463] FAT-fs (nullb0): Can't find a valid FAT filesystem [ 268.344284][ T22] usb 4-1: device descriptor read/64, error -71 [ 268.464813][ T22] usb usb4-port1: attempt power cycle [ 268.762181][ T26] audit: type=1326 audit(1775524399.651:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6462 comm="syz.1.461" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f715759c819 code=0x0 [ 268.859553][ T6473] netlink: 'syz.0.453': attribute type 1 has an invalid length. [ 268.884531][ T22] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 269.032224][ T22] usb 4-1: device descriptor read/8, error -71 [ 269.226433][ T6476] loop4: detected capacity change from 0 to 512 [ 269.315511][ T22] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 269.323892][ T6476] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 269.366081][ T22] usb 4-1: device descriptor read/8, error -71 [ 269.644364][ T22] usb usb4-port1: unable to enumerate USB device [ 270.116992][ T6491] loop3: detected capacity change from 0 to 65 [ 270.233265][ T6476] EXT4-fs (loop4): failed to open journal device unknown-block(0,0) -6 [ 270.260639][ T6491] BFS-fs: bfs_fill_super(): Superblock is corrupted on loop3 [ 270.453714][ T6481] loop0: detected capacity change from 0 to 131072 [ 270.467211][ T6481] F2FS-fs (loop0): Wrong CP boundary, start(512) end(1536) blocks(0) [ 270.475512][ T6481] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 270.486984][ T6481] F2FS-fs (loop0): invalid crc value [ 270.619156][ T6481] F2FS-fs (loop0): Found nat_bits in checkpoint [ 270.676386][ T6481] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 270.683524][ T6481] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 270.760420][ T6497] FAULT_INJECTION: forcing a failure. [ 270.760420][ T6497] name failslab, interval 1, probability 0, space 0, times 0 [ 270.834482][ T6497] CPU: 0 PID: 6497 Comm: syz.1.468 Not tainted syzkaller #0 [ 270.841916][ T6497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 270.852019][ T6497] Call Trace: [ 270.855336][ T6497] [ 270.858299][ T6497] dump_stack_lvl+0x188/0x24e [ 270.863034][ T6497] ? show_regs_print_info+0x12/0x12 [ 270.868303][ T6497] ? load_image+0x400/0x400 [ 270.872856][ T6497] ? verify_lock_unused+0x140/0x140 [ 270.878114][ T6497] should_fail_ex+0x399/0x4d0 [ 270.882840][ T6497] should_failslab+0x5/0x20 [ 270.887388][ T6497] slab_pre_alloc_hook+0x59/0x310 [ 270.892466][ T6497] kmem_cache_alloc+0x56/0x2f0 [ 270.897286][ T6497] ? skb_clone+0x1e7/0x370 [ 270.901761][ T6497] skb_clone+0x1e7/0x370 [ 270.906057][ T6497] __netlink_deliver_tap+0x3ed/0x800 [ 270.911407][ T6497] ? netlink_deliver_tap+0x2e/0x1b0 [ 270.916835][ T6497] netlink_deliver_tap+0x19c/0x1b0 [ 270.922094][ T6497] netlink_unicast+0x728/0x8d0 [ 270.926924][ T6497] netlink_sendmsg+0x8ad/0xbd0 [ 270.931758][ T6497] ? netlink_getsockopt+0x550/0x550 [ 270.937015][ T6497] ? aa_sock_msg_perm+0x94/0x150 [ 270.941995][ T6497] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 270.947325][ T6497] ? security_socket_sendmsg+0x7c/0xa0 [ 270.952841][ T6497] ? netlink_getsockopt+0x550/0x550 [ 270.958125][ T6497] ____sys_sendmsg+0x5be/0x970 [ 270.962950][ T6497] ? __sys_sendmsg_sock+0x30/0x30 [ 270.968031][ T6497] ? __import_iovec+0x315/0x500 [ 270.972948][ T6497] ? import_iovec+0x6f/0xa0 [ 270.977496][ T6497] ___sys_sendmsg+0x2a2/0x360 [ 270.982252][ T6497] ? __sys_sendmsg+0x290/0x290 [ 270.987107][ T6497] ? __lock_acquire+0x7d10/0x7d10 [ 270.992218][ T6497] __se_sys_sendmsg+0x1bb/0x2a0 [ 270.997140][ T6497] ? __x64_sys_sendmsg+0x80/0x80 [ 271.002147][ T6497] ? lockdep_hardirqs_on+0x94/0x140 [ 271.007405][ T6497] do_syscall_64+0x4c/0xa0 [ 271.011879][ T6497] ? clear_bhb_loop+0x60/0xb0 [ 271.016601][ T6497] ? clear_bhb_loop+0x60/0xb0 [ 271.021324][ T6497] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 271.027283][ T6497] RIP: 0033:0x7f715759c819 [ 271.031745][ T6497] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 271.051413][ T6497] RSP: 002b:00007f71583ea028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 271.059879][ T6497] RAX: ffffffffffffffda RBX: 00007f7157815fa0 RCX: 00007f715759c819 [ 271.067905][ T6497] RDX: 0000000020040054 RSI: 00002000000001c0 RDI: 0000000000000004 [ 271.075926][ T6497] RBP: 00007f71583ea090 R08: 0000000000000000 R09: 0000000000000000 [ 271.083940][ T6497] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 271.091956][ T6497] R13: 00007f7157816038 R14: 00007f7157815fa0 R15: 00007ffd816ac6a8 [ 271.099993][ T6497] [ 271.846997][ T6505] loop3: detected capacity change from 0 to 512 [ 271.968227][ T4594] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 272.473788][ T6511] FAULT_INJECTION: forcing a failure. [ 272.473788][ T6511] name failslab, interval 1, probability 0, space 0, times 0 [ 272.532912][ T6511] CPU: 0 PID: 6511 Comm: syz.4.473 Not tainted syzkaller #0 [ 272.540275][ T6511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 272.550335][ T6511] Call Trace: [ 272.553616][ T6511] [ 272.556547][ T6511] dump_stack_lvl+0x188/0x24e [ 272.561261][ T6511] ? show_regs_print_info+0x12/0x12 [ 272.566466][ T6511] ? load_image+0x400/0x400 [ 272.570983][ T6511] ? __might_sleep+0xd0/0xd0 [ 272.575662][ T6511] ? __lock_acquire+0x7d10/0x7d10 [ 272.580692][ T6511] should_fail_ex+0x399/0x4d0 [ 272.585373][ T6511] should_failslab+0x5/0x20 [ 272.589883][ T6511] slab_pre_alloc_hook+0x59/0x310 [ 272.594984][ T6511] kmem_cache_alloc+0x56/0x2f0 [ 272.599753][ T6511] ? __alloc_file+0x25/0x230 [ 272.604348][ T6511] __alloc_file+0x25/0x230 [ 272.608768][ T6511] alloc_empty_file+0x90/0x180 [ 272.613552][ T6511] alloc_file+0x5c/0x5f0 [ 272.617800][ T6511] alloc_file_pseudo+0x180/0x200 [ 272.622754][ T6511] ? alloc_empty_file_noaccount+0x80/0x80 [ 272.628494][ T6511] __shmem_file_setup+0x1cf/0x290 [ 272.633605][ T6511] ? shmem_file_setup+0x13/0x30 [ 272.638645][ T6511] __se_sys_memfd_create+0x1e1/0x340 [ 272.643930][ T6511] do_syscall_64+0x4c/0xa0 [ 272.648384][ T6511] ? clear_bhb_loop+0x60/0xb0 [ 272.653076][ T6511] ? clear_bhb_loop+0x60/0xb0 [ 272.657754][ T6511] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 272.663689][ T6511] RIP: 0033:0x7f667e19c819 [ 272.668119][ T6511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 272.687737][ T6511] RSP: 002b:00007f667f11ee08 EFLAGS: 00000202 ORIG_RAX: 000000000000013f [ 272.696159][ T6511] RAX: ffffffffffffffda RBX: 0000000000000a02 RCX: 00007f667e19c819 [ 272.704251][ T6511] RDX: 00007f667f11eee0 RSI: 0000000000000000 RDI: 00007f667e232e71 [ 272.712253][ T6511] RBP: 0000200000000a80 R08: 00000000ffffffff R09: 0000000000000000 [ 272.720227][ T6511] R10: 0000000000000001 R11: 0000000000000202 R12: 0000200000000040 [ 272.728201][ T6511] R13: 00007f667f11eee0 R14: 00007f667f11eea0 R15: 0000200000000180 [ 272.736292][ T6511] [ 272.945016][ T26] audit: type=1326 audit(1775524403.841:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6512 comm="syz.1.474" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 273.070767][ T26] audit: type=1326 audit(1775524403.841:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6512 comm="syz.1.474" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 273.180972][ T26] audit: type=1326 audit(1775524403.881:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6512 comm="syz.1.474" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 273.985303][ T4284] Bluetooth: hci4: command 0x0406 tx timeout [ 274.095062][ T6523] loop2: detected capacity change from 0 to 128 [ 274.215944][ T6523] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 274.248027][ T26] audit: type=1326 audit(1775524403.891:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6512 comm="syz.1.474" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 274.327986][ T6523] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 274.371102][ T6526] loop4: detected capacity change from 0 to 1024 [ 274.374085][ T26] audit: type=1326 audit(1775524403.891:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6512 comm="syz.1.474" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 274.414297][ T6523] hpfs: You really don't want any checks? You are crazy... [ 274.423445][ T6523] hpfs: hpfs_map_sector(): read error [ 274.469071][ T6523] hpfs: code page support is disabled [ 274.483956][ T26] audit: type=1326 audit(1775524403.921:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6512 comm="syz.1.474" exe="/root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 274.525996][ T6523] hpfs: hpfs_map_4sectors(): unaligned read [ 274.532900][ T6523] hpfs: hpfs_map_4sectors(): unaligned read [ 274.604169][ T6523] hpfs: filesystem error: unable to find root dir [ 274.622156][ T26] audit: type=1326 audit(1775524403.921:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6512 comm="syz.1.474" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 274.744419][ T26] audit: type=1326 audit(1775524403.921:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6512 comm="syz.1.474" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 274.877019][ T26] audit: type=1326 audit(1775524403.921:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6512 comm="syz.1.474" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 274.890498][ T6532] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 274.904790][ T26] audit: type=1326 audit(1775524403.921:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6512 comm="syz.1.474" exe="/root/syz-executor" sig=0 arch=c000003e syscall=0 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 274.912011][ T6532] (syz.0.470,6532,0):ocfs2_get_sector:1771 ERROR: status = -5 [ 274.939153][ T6532] (syz.0.470,6532,0):ocfs2_sb_probe:749 ERROR: status = -5 [ 274.939623][ T26] audit: type=1326 audit(1775524403.921:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6512 comm="syz.1.474" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 274.947316][ T6532] (syz.0.470,6532,0):ocfs2_fill_super:990 ERROR: superblock probe failed! [ 274.979139][ T6532] (syz.0.470,6532,0):ocfs2_fill_super:1176 ERROR: status = -5 [ 275.244459][ T32] hfsplus: b-tree write err: -5, ino 8 [ 275.536086][ T26] audit: type=1326 audit(1775524403.921:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6512 comm="syz.1.474" exe="/root/syz-executor" sig=0 arch=c000003e syscall=72 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 275.624393][ T26] audit: type=1326 audit(1775524403.921:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6512 comm="syz.1.474" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 275.777755][ T6539] FAULT_INJECTION: forcing a failure. [ 275.777755][ T6539] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 275.791470][ T6539] CPU: 0 PID: 6539 Comm: syz.4.480 Not tainted syzkaller #0 [ 275.798833][ T6539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 275.804133][ T2165] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 275.808918][ T6539] Call Trace: [ 275.808935][ T6539] [ 275.808945][ T6539] dump_stack_lvl+0x188/0x24e [ 275.827706][ T6539] ? asm_sysvec_call_function_single+0x16/0x20 [ 275.833916][ T6539] ? show_regs_print_info+0x12/0x12 [ 275.839263][ T6539] ? load_image+0x400/0x400 [ 275.843929][ T6539] should_fail_ex+0x399/0x4d0 [ 275.848669][ T6539] strncpy_from_user+0x32/0x350 [ 275.853573][ T6539] getname_flags+0xf2/0x500 [ 275.858184][ T6539] user_path_at_empty+0x28/0x60 [ 275.863055][ T6539] __se_sys_mount+0x2a4/0x3d0 [ 275.867760][ T6539] ? __x64_sys_mount+0xc0/0xc0 [ 275.872566][ T6539] ? __x64_sys_mount+0x1c/0xc0 [ 275.877356][ T6539] do_syscall_64+0x4c/0xa0 [ 275.881887][ T6539] ? clear_bhb_loop+0x60/0xb0 [ 275.886581][ T6539] ? clear_bhb_loop+0x60/0xb0 [ 275.891275][ T6539] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 275.897186][ T6539] RIP: 0033:0x7f667e19c819 [ 275.901621][ T6539] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 275.921329][ T6539] RSP: 002b:00007f667f0fe028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 275.929932][ T6539] RAX: ffffffffffffffda RBX: 00007f667e416090 RCX: 00007f667e19c819 [ 275.937920][ T6539] RDX: 0000200000000240 RSI: 0000200000000080 RDI: 0000200000000280 [ 275.945913][ T6539] RBP: 00007f667f0fe090 R08: 0000000000000000 R09: 0000000000000000 [ 275.953987][ T6539] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 275.961976][ T6539] R13: 00007f667e416128 R14: 00007f667e416090 R15: 00007ffd90cd90e8 [ 275.969982][ T6539] [ 275.973774][ T22] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 276.074309][ T2165] usb 3-1: Using ep0 maxpacket: 8 [ 276.096874][ T2165] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 276.105645][ T2165] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 276.117349][ T2165] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 276.129283][ T2165] usb 3-1: config 168 interface 0 altsetting 188 bulk endpoint 0x83 has invalid maxpacket 245 [ 276.139978][ T2165] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 276.153848][ T2165] usb 3-1: config 168 interface 0 has no altsetting 0 [ 276.168402][ T2165] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 276.176580][ T2165] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 276.189577][ T2165] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 276.201558][ T22] usb 1-1: Using ep0 maxpacket: 32 [ 276.224361][ T22] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 276.235532][ T2165] usb 3-1: config 168 interface 0 altsetting 188 bulk endpoint 0x83 has invalid maxpacket 245 [ 276.246283][ T22] usb 1-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 276.256686][ T2165] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 276.270797][ T22] usb 1-1: config 0 interface 0 has no altsetting 0 [ 276.282243][ T2165] usb 3-1: config 168 interface 0 has no altsetting 0 [ 276.295968][ T22] usb 1-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 276.311095][ T2165] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 276.319112][ T22] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.327559][ T2165] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 276.339354][ T22] usb 1-1: Product: syz [ 276.343649][ T22] usb 1-1: Manufacturer: syz [ 276.348449][ T22] usb 1-1: SerialNumber: syz [ 276.353792][ T2165] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 276.371209][ T2165] usb 3-1: config 168 interface 0 altsetting 188 bulk endpoint 0x83 has invalid maxpacket 245 [ 276.389884][ T22] usb 1-1: config 0 descriptor?? [ 276.408880][ T2165] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 276.423405][ T2165] usb 3-1: config 168 interface 0 has no altsetting 0 [ 276.485646][ T2165] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 276.533414][ T2165] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.542421][ T2165] usb 3-1: Product: syz [ 276.546935][ T2165] usb 3-1: Manufacturer: syz [ 276.551689][ T2165] usb 3-1: SerialNumber: syz [ 276.915160][ T6536] loop0: detected capacity change from 0 to 1024 [ 276.944607][ T2165] usb 3-1: can't set config #168, error -71 [ 276.968353][ T2165] usb 3-1: USB disconnect, device number 8 [ 277.083925][ T6529] loop1: detected capacity change from 0 to 32768 [ 277.156011][ T6529] gfs2: Unknown parameter ' [ 277.156011][ T6529] ' [ 277.186939][ T6529] netlink: 8 bytes leftover after parsing attributes in process `syz.1.479'. [ 277.210076][ T6546] loop2: detected capacity change from 0 to 128 [ 277.237790][ T6536] netlink: 12 bytes leftover after parsing attributes in process `syz.0.481'. [ 277.262013][ T6546] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 277.266370][ T6536] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 277.352682][ T6546] UDF-fs: error (device loop2): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 277.402550][ T6536] netlink: 100 bytes leftover after parsing attributes in process `syz.0.481'. [ 277.700304][ T6546] UDF-fs: error (device loop2): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 277.844544][ T6552] netlink: 'syz.1.485': attribute type 1 has an invalid length. [ 278.085509][ T22] gs_usb 1-1:0.0: Couldn't get device config: (err=-110) [ 278.092781][ T22] gs_usb: probe of 1-1:0.0 failed with error -110 [ 278.862745][ T6556] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input35 [ 278.899320][ T22] usb 1-1: USB disconnect, device number 8 [ 278.939637][ T6560] netlink: 4 bytes leftover after parsing attributes in process `syz.2.486'. [ 278.956148][ T6562] FAULT_INJECTION: forcing a failure. [ 278.956148][ T6562] name failslab, interval 1, probability 0, space 0, times 0 [ 278.983859][ T6560] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 278.993482][ T6560] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 279.002233][ T6560] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 279.010959][ T6560] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 279.022859][ T6560] netlink: 4 bytes leftover after parsing attributes in process `syz.2.486'. [ 279.034226][ T6562] CPU: 0 PID: 6562 Comm: syz.1.487 Not tainted syzkaller #0 [ 279.041572][ T6562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 279.051671][ T6562] Call Trace: [ 279.054994][ T6562] [ 279.057966][ T6562] dump_stack_lvl+0x188/0x24e [ 279.062734][ T6562] ? show_regs_print_info+0x12/0x12 [ 279.067984][ T6562] ? load_image+0x400/0x400 [ 279.072532][ T6562] ? __might_sleep+0xd0/0xd0 [ 279.077162][ T6562] ? __lock_acquire+0x7d10/0x7d10 [ 279.082276][ T6562] should_fail_ex+0x399/0x4d0 [ 279.087092][ T6562] should_failslab+0x5/0x20 [ 279.091641][ T6562] slab_pre_alloc_hook+0x59/0x310 [ 279.096720][ T6562] kmem_cache_alloc_node+0x5a/0x320 [ 279.102143][ T6562] ? __alloc_skb+0xfc/0x7e0 [ 279.106718][ T6562] __alloc_skb+0xfc/0x7e0 [ 279.111089][ T6562] ? netlink_autobind+0xda/0x300 [ 279.116056][ T6562] netlink_sendmsg+0x654/0xbd0 [ 279.120856][ T6562] ? netlink_getsockopt+0x550/0x550 [ 279.126099][ T6562] ? aa_sock_msg_perm+0x94/0x150 [ 279.131077][ T6562] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 279.136382][ T6562] ? security_socket_sendmsg+0x7c/0xa0 [ 279.141879][ T6562] ? netlink_getsockopt+0x550/0x550 [ 279.147097][ T6562] ____sys_sendmsg+0x5be/0x970 [ 279.151902][ T6562] ? __sys_sendmsg_sock+0x30/0x30 [ 279.156941][ T6562] ? __import_iovec+0x315/0x500 [ 279.161798][ T6562] ? import_iovec+0x6f/0xa0 [ 279.166318][ T6562] ___sys_sendmsg+0x2a2/0x360 [ 279.171028][ T6562] ? __sys_sendmsg+0x290/0x290 [ 279.175807][ T6562] ? __lock_acquire+0x7d10/0x7d10 [ 279.180843][ T6562] __se_sys_sendmsg+0x1bb/0x2a0 [ 279.185700][ T6562] ? __x64_sys_sendmsg+0x80/0x80 [ 279.190671][ T6562] ? lockdep_hardirqs_on+0x94/0x140 [ 279.195978][ T6562] do_syscall_64+0x4c/0xa0 [ 279.200408][ T6562] ? clear_bhb_loop+0x60/0xb0 [ 279.205109][ T6562] ? clear_bhb_loop+0x60/0xb0 [ 279.209789][ T6562] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 279.215699][ T6562] RIP: 0033:0x7f715759c819 [ 279.220115][ T6562] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 279.239725][ T6562] RSP: 002b:00007f71583ea028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 279.248138][ T6562] RAX: ffffffffffffffda RBX: 00007f7157815fa0 RCX: 00007f715759c819 [ 279.256110][ T6562] RDX: 0000000000008000 RSI: 0000200000006100 RDI: 0000000000000003 [ 279.264096][ T6562] RBP: 00007f71583ea090 R08: 0000000000000000 R09: 0000000000000000 [ 279.272071][ T6562] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 279.280054][ T6562] R13: 00007f7157816038 R14: 00007f7157815fa0 R15: 00007ffd816ac6a8 [ 279.288052][ T6562] [ 279.291128][ C0] vkms_vblank_simulate: vblank timer overrun [ 279.631743][ T6572] loop3: detected capacity change from 0 to 8 [ 279.733735][ T6572] SQUASHFS error: Unable to read directory block [629:26] [ 279.772697][ T6579] netlink: 204 bytes leftover after parsing attributes in process `syz.3.491'. [ 279.855130][ T6583] loop2: detected capacity change from 0 to 256 [ 279.881445][ T6581] loop1: detected capacity change from 0 to 1024 [ 279.889273][ T6583] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 279.978957][ T6583] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512 [ 279.988255][ T6581] hfsplus: invalid length 256 has been corrected to 255 [ 279.998204][ T6583] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 280.008006][ T6583] UDF-fs: Scanning with blocksize 512 failed [ 280.042235][ T6583] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 280.083238][ T6583] UDF-fs: error (device loop2): udf_process_sequence: Primary Volume Descriptor not found! [ 280.116193][ T6583] UDF-fs: error (device loop2): udf_process_sequence: Primary Volume Descriptor not found! [ 280.132765][ T4381] hfsplus: b-tree write err: -5, ino 25 [ 280.140569][ T6583] UDF-fs: Scanning with blocksize 1024 failed [ 280.162949][ T4381] hfsplus: b-tree write err: -5, ino 4 [ 280.169271][ T4381] hfsplus: b-tree write err: -5, ino 2 [ 280.250809][ T6583] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 280.374676][ T6583] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512 [ 280.400147][ T6583] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 280.441589][ T6583] UDF-fs: Scanning with blocksize 2048 failed [ 280.696959][ T6583] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 280.861468][ T6583] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512 [ 281.111086][ T6583] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 281.124161][ T6583] UDF-fs: Scanning with blocksize 4096 failed [ 281.130292][ T6583] UDF-fs: warning (device loop2): udf_fill_super: No partition found (1) [ 282.482813][ T6604] loop1: detected capacity change from 0 to 131072 [ 282.494393][ T2165] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 282.852155][ T6606] sched: RT throttling activated [ 283.008531][ T6604] F2FS-fs (loop1): Wrong CP boundary, start(512) end(1536) blocks(0) [ 283.016800][ T6604] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 283.048457][ T6604] F2FS-fs (loop1): invalid crc value [ 283.129162][ T6604] F2FS-fs (loop1): Found nat_bits in checkpoint [ 283.204108][ T2165] usb 5-1: Using ep0 maxpacket: 16 [ 283.310231][ T6604] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 283.317360][ T6604] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 283.344176][ T2165] usb 5-1: unable to get BOS descriptor or descriptor too short [ 283.360845][ T2165] usb 5-1: config 127 has an invalid interface number: 16 but max is 0 [ 283.380062][ T2165] usb 5-1: config 127 has no interface number 0 [ 283.397134][ T2165] usb 5-1: config 127 interface 16 has no altsetting 0 [ 283.415586][ T6619] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input37 [ 283.765184][ T2165] usb 5-1: string descriptor 0 read error: -71 [ 283.773620][ T2165] usb 5-1: New USB device found, idVendor=1a0a, idProduct=0103, bcdDevice=70.8a [ 283.794673][ T2165] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 283.807300][ T2165] usb 5-1: can't set config #127, error -71 [ 283.821945][ T2165] usb 5-1: USB disconnect, device number 6 [ 284.116370][ T6625] input: syz0 as /devices/virtual/input/input38 [ 284.216628][ T6627] loop0: detected capacity change from 0 to 2048 [ 284.345954][ T6631] loop2: detected capacity change from 0 to 32768 [ 284.460322][ T6636] FAULT_INJECTION: forcing a failure. [ 284.460322][ T6636] name failslab, interval 1, probability 0, space 0, times 0 [ 284.504763][ T6627] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 284.536692][ T6636] CPU: 1 PID: 6636 Comm: syz.1.503 Not tainted syzkaller #0 [ 284.544085][ T6636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 284.554186][ T6636] Call Trace: [ 284.557498][ T6636] [ 284.560459][ T6636] dump_stack_lvl+0x188/0x24e [ 284.565193][ T6636] ? show_regs_print_info+0x12/0x12 [ 284.570441][ T6636] ? load_image+0x400/0x400 [ 284.574989][ T6636] ? __might_sleep+0xd0/0xd0 [ 284.579623][ T6636] ? __lock_acquire+0x7d10/0x7d10 [ 284.584705][ T6636] should_fail_ex+0x399/0x4d0 [ 284.589428][ T6636] should_failslab+0x5/0x20 [ 284.593970][ T6636] slab_pre_alloc_hook+0x59/0x310 [ 284.599036][ T6636] kmem_cache_alloc+0x56/0x2f0 [ 284.603819][ T6636] ? __alloc_file+0x25/0x230 [ 284.608428][ T6636] __alloc_file+0x25/0x230 [ 284.612860][ T6636] alloc_empty_file+0x90/0x180 [ 284.617637][ T6636] alloc_file+0x5c/0x5f0 [ 284.621945][ T6636] alloc_file_pseudo+0x180/0x200 [ 284.626898][ T6636] ? alloc_empty_file_noaccount+0x80/0x80 [ 284.632639][ T6636] __shmem_file_setup+0x1cf/0x290 [ 284.637682][ T6636] ? shmem_file_setup+0x13/0x30 [ 284.642552][ T6636] __se_sys_memfd_create+0x1e1/0x340 [ 284.647859][ T6636] do_syscall_64+0x4c/0xa0 [ 284.652298][ T6636] ? clear_bhb_loop+0x60/0xb0 [ 284.657176][ T6636] ? clear_bhb_loop+0x60/0xb0 [ 284.661879][ T6636] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 284.667791][ T6636] RIP: 0033:0x7f715759c819 [ 284.672220][ T6636] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 284.691932][ T6636] RSP: 002b:00007f71583e9e08 EFLAGS: 00000202 ORIG_RAX: 000000000000013f [ 284.700365][ T6636] RAX: ffffffffffffffda RBX: 00000000000055a3 RCX: 00007f715759c819 [ 284.708350][ T6636] RDX: 00007f71583e9ee0 RSI: 0000000000000000 RDI: 00007f7157632e71 [ 284.716333][ T6636] RBP: 000020000000e0c0 R08: 00000000ffffffff R09: 0000000000000000 [ 284.724328][ T6636] R10: 0000000000000001 R11: 0000000000000202 R12: 00002000000001c0 [ 284.732309][ T6636] R13: 00007f71583e9ee0 R14: 00007f71583e9ea0 R15: 0000200000000540 [ 284.740314][ T6636] [ 285.851884][ T5528] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by udevd (5528) [ 285.922106][ T5159] EXT4-fs (loop0): unmounting filesystem. [ 285.978890][ T6654] loop4: detected capacity change from 0 to 256 [ 286.053980][ T6654] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 286.117921][ T6654] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=512, location=512 [ 286.148509][ T6654] UDF-fs: warning (device loop4): udf_load_vrs: No anchor found [ 286.174106][ T6654] UDF-fs: Scanning with blocksize 512 failed [ 286.294166][ T6654] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 286.345824][ T6654] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 286.424325][ T6654] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 286.444088][ T6654] UDF-fs: Scanning with blocksize 1024 failed [ 286.484193][ C0] icmp: detected local route for 172.20.20.170 during ICMP sending, src 172.20.20.0 [ 286.520604][ T6660] loop0: detected capacity change from 0 to 128 [ 287.276299][ T6644] loop3: detected capacity change from 0 to 32768 [ 287.304760][ T6654] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 287.306601][ T6644] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.510 (6644) [ 287.357194][ T4300] kworker/u4:6: attempt to access beyond end of device [ 287.357194][ T4300] loop0: rw=1, sector=145, nr_sectors = 896 limit=128 [ 287.371533][ T6654] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=512, location=512 [ 287.400495][ T6654] UDF-fs: warning (device loop4): udf_load_vrs: No anchor found [ 287.412390][ T6644] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 287.451251][ T6654] UDF-fs: Scanning with blocksize 2048 failed [ 287.461496][ T6644] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 287.477719][ T6654] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 287.516780][ T6644] BTRFS info (device loop3): using free space tree [ 287.570918][ T6654] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=512, location=512 [ 287.698381][ T6653] loop2: detected capacity change from 0 to 32768 [ 287.705174][ T6654] UDF-fs: warning (device loop4): udf_load_vrs: No anchor found [ 287.719800][ T6654] UDF-fs: Scanning with blocksize 4096 failed [ 287.801398][ T6654] UDF-fs: warning (device loop4): udf_fill_super: No partition found (1) [ 287.817126][ T6653] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 287.904153][ T6653] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 287.913030][ T6653] BTRFS info (device loop2): setting nodatasum [ 287.969414][ T6653] BTRFS info (device loop2): force zlib compression, level 3 [ 288.014460][ T6685] loop0: detected capacity change from 0 to 128 [ 288.035681][ T6653] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_LZO (0x8) [ 288.062566][ T6653] BTRFS info (device loop2): use lzo compression, level 0 [ 288.091006][ T6653] BTRFS info (device loop2): turning on flush-on-commit [ 288.107134][ T6653] BTRFS info (device loop2): enabling auto defrag [ 288.122571][ T6653] BTRFS info (device loop2): max_inline at 4096 [ 288.136832][ T6653] BTRFS info (device loop2): using free space tree [ 288.171981][ T6685] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 288.368242][ T6644] BTRFS error (device loop3): open_ctree failed: -12 [ 288.368609][ T4288] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by udevd (4288) [ 288.460759][ T6653] BTRFS info (device loop2): enabling ssd optimizations [ 288.551449][ T6673] UDF-fs: error (device loop0): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 288.568250][ T6710] FAULT_INJECTION: forcing a failure. [ 288.568250][ T6710] name failslab, interval 1, probability 0, space 0, times 0 [ 288.643622][ T6710] CPU: 0 PID: 6710 Comm: syz.3.516 Not tainted syzkaller #0 [ 288.651050][ T6710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 288.661152][ T6710] Call Trace: [ 288.664466][ T6710] [ 288.667428][ T6710] dump_stack_lvl+0x188/0x24e [ 288.672155][ T6710] ? show_regs_print_info+0x12/0x12 [ 288.677411][ T6710] ? load_image+0x400/0x400 [ 288.682025][ T6710] ? verify_lock_unused+0x140/0x140 [ 288.687258][ T6710] should_fail_ex+0x399/0x4d0 [ 288.692050][ T6710] should_failslab+0x5/0x20 [ 288.696566][ T6710] slab_pre_alloc_hook+0x59/0x310 [ 288.701613][ T6710] kmem_cache_alloc+0x56/0x2f0 [ 288.706393][ T6710] ? skb_clone+0x1e7/0x370 [ 288.710837][ T6710] skb_clone+0x1e7/0x370 [ 288.715191][ T6710] __netlink_deliver_tap+0x3ed/0x800 [ 288.720512][ T6710] ? netlink_deliver_tap+0x2e/0x1b0 [ 288.725730][ T6710] netlink_deliver_tap+0x19c/0x1b0 [ 288.730864][ T6710] netlink_unicast+0x728/0x8d0 [ 288.735659][ T6710] netlink_sendmsg+0x8ad/0xbd0 [ 288.740455][ T6710] ? netlink_getsockopt+0x550/0x550 [ 288.745768][ T6710] ? aa_sock_msg_perm+0x94/0x150 [ 288.750766][ T6710] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 288.756068][ T6710] ? security_socket_sendmsg+0x7c/0xa0 [ 288.761550][ T6710] ? netlink_getsockopt+0x550/0x550 [ 288.766768][ T6710] ____sys_sendmsg+0x5be/0x970 [ 288.771572][ T6710] ? __sys_sendmsg_sock+0x30/0x30 [ 288.776614][ T6710] ? __import_iovec+0x315/0x500 [ 288.781490][ T6710] ? import_iovec+0x6f/0xa0 [ 288.786023][ T6710] ___sys_sendmsg+0x2a2/0x360 [ 288.790723][ T6710] ? __sys_sendmsg+0x290/0x290 [ 288.795524][ T6710] ? __lock_acquire+0x7d10/0x7d10 [ 288.800681][ T6710] __se_sys_sendmsg+0x1bb/0x2a0 [ 288.805561][ T6710] ? __x64_sys_sendmsg+0x80/0x80 [ 288.810547][ T6710] ? lockdep_hardirqs_on+0x94/0x140 [ 288.815774][ T6710] do_syscall_64+0x4c/0xa0 [ 288.820224][ T6710] ? clear_bhb_loop+0x60/0xb0 [ 288.824922][ T6710] ? clear_bhb_loop+0x60/0xb0 [ 288.829616][ T6710] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 288.835523][ T6710] RIP: 0033:0x7fe43839c819 [ 288.839949][ T6710] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 288.859587][ T6710] RSP: 002b:00007fe4391ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 288.868038][ T6710] RAX: ffffffffffffffda RBX: 00007fe438615fa0 RCX: 00007fe43839c819 [ 288.876039][ T6710] RDX: 0000000000000810 RSI: 0000200000000280 RDI: 0000000000000003 [ 288.884037][ T6710] RBP: 00007fe4391ed090 R08: 0000000000000000 R09: 0000000000000000 [ 288.892105][ T6710] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 288.900090][ T6710] R13: 00007fe438616038 R14: 00007fe438615fa0 R15: 00007ffc222912a8 [ 288.908180][ T6710] [ 289.099479][ T4277] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 289.423181][ T6722] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input39 [ 289.467716][ T6720] netlink: 12 bytes leftover after parsing attributes in process `syz.1.520'. [ 289.593823][ T6723] loop1: detected capacity change from 0 to 128 [ 289.620603][ T6723] hpfs: bad mount options. [ 289.875865][ T6732] loop4: detected capacity change from 0 to 64 [ 290.296196][ T6736] minix_free_block (loop4:21): bit already cleared [ 291.421773][ T4438] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 9 /dev/loop2 scanned by udevd (4438) [ 292.702044][ T6745] loop0: detected capacity change from 0 to 4096 [ 292.730621][ T6745] ntfs3: Bad value for 'gid' [ 292.834435][ T6752] netlink: 220 bytes leftover after parsing attributes in process `syz.4.526'. [ 292.867147][ T6752] netlink: 8 bytes leftover after parsing attributes in process `syz.4.526'. [ 293.472492][ T6755] loop2: detected capacity change from 0 to 128 [ 293.605281][ T6755] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 293.755127][ T6764] loop1: detected capacity change from 0 to 4096 [ 293.780420][ T6764] ntfs3: Unknown parameter 'Ý ê|YFÆlÚ醬?ýŸÏŧ„¼.úLUwÇ.Žìº—ÖnºÁµ«(ÓˆeY;䩯`+RÞ«XþXAjŠzé+3ÉÆGmïÖv+¢ÙÅy1s À¯f¤øÜÙÓîOÖßz$Ê5·qÞ ¹@áCâà¯÷7“K gmÌniL"pù5 —²üG~~ Xì;…õšYmx„;;~ª „°ú[¬~!zÕ÷'8ß:þÆ-‡¸1Ÿ@{O~Ø(WÕ¡™È!qPãJ ©ˆq…äU¡×t§3°m¡?@ý' [ 293.907444][ T6755] UDF-fs: error (device loop2): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 294.140631][ T6774] loop4: detected capacity change from 0 to 4096 [ 294.185698][ T6774] ntfs3: loop4: Different NTFS' sector size (4096) and media sector size (512) [ 294.896825][ T6783] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input40 [ 295.188698][ T6791] loop0: detected capacity change from 0 to 512 [ 295.219075][ T6791] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 295.272354][ T6791] EXT4-fs (loop0): 1 orphan inode deleted [ 295.278551][ T6791] EXT4-fs (loop0): 1 truncate cleaned up [ 295.285844][ T6791] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 295.727532][ T6797] EXT4-fs error (device loop0): ext4_inlinedir_to_tree:1450: inode #12: block 7: comm syz.0.539: path /59/file0/file0: bad entry in directory: directory entry overrun - offset=788, inode=13, rec_len=784, size=60 fake=0 [ 295.749460][ C0] vkms_vblank_simulate: vblank timer overrun [ 295.783033][ T6797] EXT4-fs (loop0): Remounting filesystem read-only [ 297.747612][ T6813] loop3: detected capacity change from 0 to 512 [ 297.793961][ T6813] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 297.863666][ T6813] EXT4-fs (loop3): 1 orphan inode deleted [ 297.925001][ T5159] EXT4-fs (loop0): unmounting filesystem. [ 297.930948][ T6813] EXT4-fs (loop3): 1 truncate cleaned up [ 297.974587][ T6813] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 298.029852][ T6819] FAULT_INJECTION: forcing a failure. [ 298.029852][ T6819] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 298.044367][ T4582] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 298.155446][ T6819] CPU: 1 PID: 6819 Comm: syz.4.547 Not tainted syzkaller #0 [ 298.162816][ T6819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 298.172891][ T6819] Call Trace: [ 298.176187][ T6819] [ 298.179132][ T6819] dump_stack_lvl+0x188/0x24e [ 298.183842][ T6819] ? show_regs_print_info+0x12/0x12 [ 298.189128][ T6819] ? load_image+0x400/0x400 [ 298.193653][ T6819] ? __lock_acquire+0x7d10/0x7d10 [ 298.198698][ T6819] ? snprintf+0xe5/0x140 [ 298.202975][ T6819] should_fail_ex+0x399/0x4d0 [ 298.207670][ T6819] _copy_to_user+0x2c/0x130 [ 298.212208][ T6819] simple_read_from_buffer+0xe3/0x150 [ 298.217594][ T6819] proc_fail_nth_read+0x1a6/0x220 [ 298.222827][ T6819] ? proc_fault_inject_write+0x310/0x310 [ 298.228478][ T6819] ? fsnotify_perm+0x248/0x550 [ 298.233264][ T6819] ? proc_fault_inject_write+0x310/0x310 [ 298.238944][ T6819] vfs_read+0x2de/0xa00 [ 298.243134][ T6819] ? kernel_read+0x1e0/0x1e0 [ 298.247741][ T6819] ? __fget_files+0x28/0x4b0 [ 298.252350][ T6819] ? __fget_files+0x28/0x4b0 [ 298.256964][ T6819] ? __fget_files+0x43d/0x4b0 [ 298.261665][ T6819] ? __fdget_pos+0x2ae/0x360 [ 298.266273][ T6819] ? ksys_read+0x71/0x250 [ 298.270626][ T6819] ksys_read+0x14c/0x250 [ 298.274925][ T6819] ? vfs_write+0xa30/0xa30 [ 298.279367][ T6819] ? lockdep_hardirqs_on+0x94/0x140 [ 298.284579][ T6819] do_syscall_64+0x4c/0xa0 [ 298.289014][ T6819] ? clear_bhb_loop+0x60/0xb0 [ 298.293710][ T6819] ? clear_bhb_loop+0x60/0xb0 [ 298.298412][ T6819] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 298.304505][ T6819] RIP: 0033:0x7f667e15d04e [ 298.308937][ T6819] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 298.328736][ T6819] RSP: 002b:00007f667f11efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 298.337173][ T6819] RAX: ffffffffffffffda RBX: 00007f667f11f6c0 RCX: 00007f667e15d04e [ 298.345163][ T6819] RDX: 000000000000000f RSI: 00007f667f11f0a0 RDI: 0000000000000008 [ 298.353261][ T6819] RBP: 00007f667f11f090 R08: 0000000000000000 R09: 0000000000000000 [ 298.361245][ T6819] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 298.369231][ T6819] R13: 00007f667e416038 R14: 00007f667e415fa0 R15: 00007ffd90cd90e8 [ 298.377233][ T6819] [ 298.464155][ T4582] usb 2-1: device descriptor read/64, error -71 [ 298.910591][ T4582] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 299.084216][ T4582] usb 2-1: device descriptor read/64, error -71 [ 299.205488][ T4582] usb usb2-port1: attempt power cycle [ 299.284201][ T4267] EXT4-fs (loop3): unmounting filesystem. [ 299.363399][ T6834] loop2: detected capacity change from 0 to 512 [ 299.371648][ T6834] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 299.441405][ T6834] EXT4-fs (loop2): 1 orphan inode deleted [ 299.447909][ T6834] EXT4-fs (loop2): 1 truncate cleaned up [ 299.453551][ T6834] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 300.004179][ T4582] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 300.038708][ T4582] usb 2-1: device descriptor read/8, error -71 [ 300.101382][ T4277] EXT4-fs (loop2): unmounting filesystem. [ 300.239665][ T6828] loop4: detected capacity change from 0 to 32768 [ 300.314129][ T4582] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 300.354776][ T4582] usb 2-1: device descriptor read/8, error -71 [ 300.435059][ T5171] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 300.474260][ T4582] usb usb2-port1: unable to enumerate USB device [ 300.644316][ T5171] usb 1-1: Using ep0 maxpacket: 16 [ 300.658494][ T5171] usb 1-1: unable to get BOS descriptor or descriptor too short [ 300.678624][ T5171] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 300.688260][ T5171] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 300.688377][ T6847] loop3: detected capacity change from 0 to 4096 [ 300.708553][ T5171] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 300.718240][ T5171] usb 1-1: too many endpoints for config 1 interface 1 altsetting 151: 235, using maximum allowed: 30 [ 300.732182][ T5171] usb 1-1: config 1 interface 1 altsetting 151 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 300.744283][ T5171] usb 1-1: config 1 interface 1 altsetting 151 has 1 endpoint descriptor, different from the interface descriptor's value: 235 [ 300.770219][ T5171] usb 1-1: config 1 interface 1 has no altsetting 1 [ 300.780082][ T6847] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 300.780915][ T5171] usb 1-1: New USB device found, idVendor=1235, idProduct=8214, bcdDevice= 0.40 [ 300.798771][ T5171] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 300.807286][ T5171] usb 1-1: Product: syz [ 300.811773][ T5171] usb 1-1: Manufacturer: syz [ 300.816881][ T5171] usb 1-1: SerialNumber: syz [ 301.828157][ T6841] netlink: 'syz.0.551': attribute type 1 has an invalid length. [ 301.866786][ T6841] netlink: 220 bytes leftover after parsing attributes in process `syz.0.551'. [ 301.914523][ T6841] netlink: 16 bytes leftover after parsing attributes in process `syz.0.551'. [ 302.099647][ T6854] loop1: detected capacity change from 0 to 4096 [ 302.218311][ T4267] EXT4-fs (loop3): unmounting filesystem. [ 302.226349][ T6858] loop2: detected capacity change from 0 to 512 [ 302.270881][ T6854] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 302.326431][ T6858] EXT4-fs (loop2): ext4_check_descriptors: Block bitmap for group 1 overlaps superblock [ 302.351720][ T6858] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 1 overlaps superblock [ 302.414192][ T6858] EXT4-fs (loop2): ext4_check_descriptors: Inode table for group 1 overlaps superblock [ 302.595470][ T6858] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 304.081016][ T6862] loop3: detected capacity change from 0 to 8192 [ 304.084358][ T6858] EXT4-fs (loop2): failed to initialize system zone (-117) [ 304.124117][ T4266] EXT4-fs (loop1): unmounting filesystem. [ 304.133052][ T6858] EXT4-fs (loop2): mount failed [ 304.304195][ T6862] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 304.354510][ T6862] REISERFS (device loop3): found reiserfs format "3.5" with non-standard journal [ 304.376760][ T6862] REISERFS (device loop3): using ordered data mode [ 304.383514][ T6862] reiserfs: using flush barriers [ 304.415304][ T6862] REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 304.416395][ T6858] loop2: detected capacity change from 0 to 1024 [ 304.435779][ T5171] usb 1-1: 1:151 : invalid UAC_AS_GENERAL desc [ 304.473244][ T5171] usb 1-1: 0:2 : does not exist [ 304.552576][ T5171] usb 1-1: USB disconnect, device number 9 [ 304.611600][ T6862] REISERFS (device loop3): checking transaction log (loop3) [ 304.641921][ T6858] EXT4-fs: Mount option(s) incompatible with ext2 [ 304.674293][ T4288] udevd[4288]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 304.697468][ T6862] REISERFS (device loop3): Using r5 hash to sort names [ 304.729716][ T6862] REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage. [ 304.753268][ T4279] Bluetooth: hci3: unexpected subevent 0x1a length: 10 > 6 [ 304.774172][ T4321] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 304.906018][ T6872] netlink: 12 bytes leftover after parsing attributes in process `syz.0.558'. [ 304.954207][ T4321] usb 2-1: Using ep0 maxpacket: 16 [ 304.986277][ T4321] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 305.218127][ T4321] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 305.253860][ T4321] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 305.279343][ T4321] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.484510][ T4321] usb 2-1: Product: syz [ 305.488758][ T4321] usb 2-1: Manufacturer: syz [ 305.493598][ T4321] usb 2-1: SerialNumber: syz [ 307.918530][ T4321] usb 2-1: 0:2 : does not exist [ 307.929264][ T4321] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 307.947043][ T4321] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 308.756954][ T4321] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 308.777727][ T4321] usb 2-1: USB disconnect, device number 13 [ 309.168181][ T4438] udevd[4438]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 310.781959][ T6919] loop4: detected capacity change from 0 to 128 [ 310.844798][ T6919] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 311.097421][ T6916] UDF-fs: error (device loop4): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 312.122029][ T6936] IPVS: sync thread started: state = BACKUP, mcast_ifn = hsr0, syncid = 4, id = 0 [ 312.214193][ T6939] netlink: 24 bytes leftover after parsing attributes in process `syz.4.573'. [ 312.312631][ T6941] bridge0: port 3(netdevsim0) entered blocking state [ 312.424376][ T6941] bridge0: port 3(netdevsim0) entered disabled state [ 312.470820][ T6941] device netdevsim0 entered promiscuous mode [ 312.496364][ T6941] bridge0: port 3(netdevsim0) entered blocking state [ 312.503941][ T6941] bridge0: port 3(netdevsim0) entered forwarding state [ 315.434275][ T22] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 315.487294][ T6965] Bluetooth: MGMT ver 1.22 [ 315.680678][ T22] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 315.708026][ T22] usb 2-1: New USB device found, idVendor=3823, idProduct=0001, bcdDevice= 3.eb [ 315.738135][ T22] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.754280][ T22] usb 2-1: Product: syz [ 315.759459][ T22] usb 2-1: Manufacturer: syz [ 315.764978][ T22] usb 2-1: SerialNumber: syz [ 315.792638][ T6965] IPVS: stopping backup sync thread 6936 ... [ 315.793699][ T22] usb 2-1: config 0 descriptor?? [ 317.366036][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.380524][ T1277] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.571319][ T26] kauditd_printk_skb: 48 callbacks suppressed [ 317.571337][ T26] audit: type=1326 audit(1775524448.461:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6960 comm="syz.1.580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 317.638150][ T6984] sctp: [Deprecated]: syz.1.580 (pid 6984) Use of int in max_burst socket option deprecated. [ 317.638150][ T6984] Use struct sctp_assoc_value instead [ 317.665924][ T26] audit: type=1326 audit(1775524448.501:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6960 comm="syz.1.580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 317.693818][ T26] audit: type=1326 audit(1775524448.501:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6960 comm="syz.1.580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 317.741350][ T26] audit: type=1326 audit(1775524448.511:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6960 comm="syz.1.580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 317.771698][ T26] audit: type=1326 audit(1775524448.511:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6960 comm="syz.1.580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 317.799958][ T26] audit: type=1326 audit(1775524448.511:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6960 comm="syz.1.580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=0 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 317.924614][ T6994] netlink: 24 bytes leftover after parsing attributes in process `syz.2.588'. [ 318.141553][ T6992] netlink: 'syz.2.588': attribute type 1 has an invalid length. [ 318.149367][ T6992] netlink: 'syz.2.588': attribute type 2 has an invalid length. [ 318.173093][ T26] audit: type=1326 audit(1775524448.511:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6960 comm="syz.1.580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 318.282532][ T7002] ufs: You didn't specify the type of your ufs filesystem [ 318.282532][ T7002] [ 318.282532][ T7002] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 318.282532][ T7002] [ 318.282532][ T7002] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 318.314685][ T7002] ufs: ufstype=old is supported read-only [ 318.388990][ T7002] ufs: ufs_fill_super(): bad magic number [ 318.934053][ T26] audit: type=1326 audit(1775524448.521:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6960 comm="syz.1.580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 319.257542][ T7012] netlink: 20 bytes leftover after parsing attributes in process `syz.3.592'. [ 321.139605][ T26] audit: type=1326 audit(1775524448.521:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6960 comm="syz.1.580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 321.903970][ T26] audit: type=1326 audit(1775524448.521:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6960 comm="syz.1.580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f715759c819 code=0x7ffc0000 [ 326.011605][ T4321] usb 2-1: USB disconnect, device number 14 [ 326.283202][ T7031] comedi comedi0: Minor 3 could not be opened [ 327.271685][ T7041] 9pnet_fd: Insufficient options for proto=fd [ 328.907989][ T7059] bridge0: port 3(netdevsim0) entered blocking state [ 328.921451][ T7059] bridge0: port 3(netdevsim0) entered disabled state [ 328.943321][ T7059] device netdevsim0 entered promiscuous mode [ 328.994755][ T7059] bridge0: port 3(netdevsim0) entered blocking state [ 329.001545][ T7059] bridge0: port 3(netdevsim0) entered forwarding state [ 330.776496][ T7084] netlink: 'syz.3.613': attribute type 1 has an invalid length. [ 330.785230][ T7084] netlink: 4 bytes leftover after parsing attributes in process `syz.3.613'. [ 331.524180][ T4268] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 332.492201][ T7097] tmpfs: Bad value for 'mpol' [ 332.560470][ T4268] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 332.616286][ T4268] usb 3-1: config 0 interface 0 has no altsetting 0 [ 333.093325][ T4268] usb 3-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=b1.f9 [ 333.141738][ T4268] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 333.166213][ T4268] usb 3-1: Product: syz [ 333.179552][ T4268] usb 3-1: Manufacturer: syz [ 333.188469][ T4268] usb 3-1: SerialNumber: syz [ 333.220035][ T4268] usb 3-1: config 0 descriptor?? [ 333.248446][ T4268] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 333.457815][ T4268] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 333.492499][ T4268] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 333.504179][ T4268] usb 3-1: media controller created [ 333.599717][ T4268] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 336.011450][ T4268] DVB: Unable to find symbol tda10046_attach() [ 336.040098][ T4268] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 336.167262][ T4279] Bluetooth: hci1: unknown advertising packet type: 0x75 [ 336.167379][ T4279] Bluetooth: hci1: Malformed LE Event: 0x02 [ 337.195791][ T4268] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 337.244227][ T4268] dvb_usb_m920x: probe of 3-1:0.0 failed with error -71 [ 337.288032][ T4268] usb 3-1: USB disconnect, device number 9 [ 337.864746][ T4268] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 338.089732][ T4268] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 338.194329][ T4268] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 338.203452][ T4268] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.328615][ T4268] usb 3-1: config 0 descriptor?? [ 339.266805][ T4268] pwc: Askey VC010 type 2 USB webcam detected. [ 339.316312][ T4268] pwc: recv_control_msg error -32 req 02 val 2b00 [ 339.361666][ T4268] pwc: recv_control_msg error -32 req 02 val 2700 [ 339.418235][ T4268] pwc: recv_control_msg error -32 req 02 val 2c00 [ 339.647546][ T4268] pwc: recv_control_msg error -71 req 04 val 1300 [ 339.681725][ T4268] pwc: recv_control_msg error -71 req 04 val 1400 [ 339.707654][ T4268] pwc: recv_control_msg error -71 req 02 val 2000 [ 339.770119][ T4268] pwc: recv_control_msg error -71 req 02 val 2100 [ 339.795770][ T4268] pwc: recv_control_msg error -71 req 04 val 1500 [ 339.886798][ T4268] pwc: recv_control_msg error -71 req 02 val 2500 [ 340.232450][ T7136] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.285417][ T4268] pwc: recv_control_msg error -71 req 02 val 2400 [ 340.317428][ T4268] pwc: recv_control_msg error -71 req 02 val 2600 [ 340.329168][ T4268] pwc: recv_control_msg error -71 req 02 val 2900 [ 340.353735][ T4268] pwc: recv_control_msg error -71 req 02 val 2800 [ 340.372768][ T4268] pwc: recv_control_msg error -71 req 04 val 1100 [ 340.405647][ T4268] pwc: recv_control_msg error -71 req 04 val 1200 [ 340.445722][ T4268] pwc: Registered as video103. [ 340.453611][ T4268] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input41 [ 340.539066][ T4268] usb 3-1: USB disconnect, device number 10 [ 344.641733][ T7136] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.963085][ T7136] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.204804][ T4582] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 346.278547][ T7136] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.422584][ T7179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 347.432686][ T7179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 348.012046][ T7136] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.056936][ T7136] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.082974][ T7136] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.113612][ T7136] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.684110][ T5171] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 348.874283][ T5171] usb 5-1: Using ep0 maxpacket: 32 [ 348.877297][ T5171] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 348.877332][ T5171] usb 5-1: config 0 has no interface number 0 [ 348.877365][ T5171] usb 5-1: config 0 interface 184 has no altsetting 0 [ 348.880648][ T5171] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 348.880668][ T5171] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 348.880683][ T5171] usb 5-1: Product: syz [ 348.880698][ T5171] usb 5-1: Manufacturer: syz [ 348.880715][ T5171] usb 5-1: SerialNumber: syz [ 348.882340][ T5171] usb 5-1: config 0 descriptor?? [ 348.889757][ T5171] smsc75xx v1.0.0 [ 349.024119][ T4582] usb 3-1: unable to get BOS descriptor or descriptor too short [ 349.025788][ T4582] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 349.025825][ T4582] usb 3-1: can't read configurations, error -71 [ 350.117138][ T5171] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -71 [ 350.143250][ T5171] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 350.173693][ T5171] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 350.194181][ T5171] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 350.212321][ T5171] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 350.246109][ T5171] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 350.257936][ T5171] smsc75xx: probe of 5-1:0.184 failed with error -71 [ 350.275131][ T5171] usb 5-1: USB disconnect, device number 7 [ 352.220831][ T7227] ufs: You didn't specify the type of your ufs filesystem [ 352.220831][ T7227] [ 352.220831][ T7227] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 352.220831][ T7227] [ 352.220831][ T7227] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 352.252761][ T7227] ufs: ufstype=old is supported read-only [ 352.286321][ T7227] ufs: ufs_fill_super(): bad magic number [ 354.164415][ T7223] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 354.327068][ T4279] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 354.336150][ T4279] Bluetooth: hci4: Injecting HCI hardware error event [ 354.345945][ T4284] Bluetooth: hci4: hardware error 0x00 [ 354.482432][ T7247] netlink: 12 bytes leftover after parsing attributes in process `syz.0.656'. [ 357.051442][ T4284] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 358.722980][ T7283] device veth1_virt_wifi entered promiscuous mode [ 358.732899][ T7283] netlink: 4 bytes leftover after parsing attributes in process `syz.1.666'. [ 362.791070][ T7308] TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 363.128751][ T22] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 363.244110][ T4268] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 363.348331][ T22] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 363.367525][ T22] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 363.400444][ T22] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 363.441441][ T22] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 363.915084][ T7334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 363.923730][ T7334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 364.568419][ T22] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 364.667556][ T22] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 364.745246][ T22] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 364.812812][ T22] usb 3-1: Product: syz [ 364.817234][ T22] usb 3-1: Manufacturer: syz [ 364.863674][ T22] cdc_wdm 3-1:1.0: skipping garbage [ 364.893302][ T22] cdc_wdm 3-1:1.0: skipping garbage [ 364.929681][ T22] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 364.968992][ T22] cdc_wdm 3-1:1.0: Unknown control protocol [ 365.071808][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 365.078600][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 365.086613][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 365.093310][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 365.100953][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 365.107682][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 365.114219][ T14] usb 3-1: USB disconnect, device number 13 [ 366.571181][ T4268] usb 5-1: unable to get BOS descriptor or descriptor too short [ 366.676019][ T4268] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 366.708869][ T4268] usb 5-1: can't read configurations, error -71 [ 366.934425][ T7365] mmap: syz.3.686 (7365) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 367.281574][ T4582] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 367.554427][ T4582] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 367.825377][ T4582] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 367.841448][ T4582] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 367.855419][ T4582] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 367.865186][ T4582] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 367.970072][ T4582] usb 1-1: config 0 descriptor?? [ 368.397774][ T4582] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 368.438741][ T4582] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 371.077357][ T4582] usb 1-1: USB disconnect, device number 10 [ 371.854245][ T14] usb 2-1: new full-speed USB device number 15 using dummy_hcd [ 372.048568][ T14] usb 2-1: unable to get BOS descriptor or descriptor too short [ 372.063799][ T14] usb 2-1: not running at top speed; connect to a high speed hub [ 372.403557][ T14] usb 2-1: config index 0 descriptor too short (expected 46, got 18) [ 372.475906][ T7429] netlink: 12 bytes leftover after parsing attributes in process `syz.2.707'. [ 373.186319][ T14] usb 2-1: config 0 has an invalid interface number: 175 but max is 0 [ 373.328807][ T14] usb 2-1: config 0 has no interface number 0 [ 373.352424][ T14] usb 2-1: config 0 interface 175 has no altsetting 0 [ 373.363009][ T7433] loop8: detected capacity change from 0 to 7 [ 373.389355][ T14] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 0.02 [ 373.401100][ T7433] Dev loop8: unable to read RDB block 7 [ 373.417492][ T7433] loop8: AHDI p1 p2 p3 [ 373.427512][ T7433] loop8: partition table partially beyond EOD, truncated [ 373.435639][ T14] usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 373.451920][ T14] usb 2-1: Product: syz [ 373.467942][ T14] usb 2-1: config 0 descriptor?? [ 374.375758][ T7433] loop8: p1 start 1601398130 is beyond EOD, truncated [ 374.424187][ T7433] loop8: p2 start 1702059890 is beyond EOD, truncated [ 374.456328][ T14] usb-storage 2-1:0.175: USB Mass Storage device detected [ 374.718256][ T7018] udevd[7018]: inotify_add_watch(7, /dev/loop8p3, 10) failed: No such file or directory [ 378.388445][ T14] usb 2-1: USB disconnect, device number 15 [ 378.758570][ T7468] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.806386][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.815153][ T1277] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.894481][ T14] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 379.164496][ T14] usb 2-1: device descriptor read/64, error -71 [ 379.309927][ T7473] netlink: 256 bytes leftover after parsing attributes in process `syz.3.721'. [ 379.416512][ T7468] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.444486][ T14] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 379.650622][ T7468] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 380.404110][ T4279] Bluetooth: hci3: command 0x0405 tx timeout [ 380.420614][ T7468] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 380.484358][ T4284] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 380.489433][ T4283] Bluetooth: hci5: command 0x1003 tx timeout [ 381.199665][ T7468] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.300365][ T7468] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.380260][ T7468] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.419746][ T7468] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 382.261829][ T7506] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 382.304472][ T7506] overlayfs: missing 'lowerdir' [ 382.690518][ T7511] ufs: You didn't specify the type of your ufs filesystem [ 382.690518][ T7511] [ 382.690518][ T7511] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 382.690518][ T7511] [ 382.690518][ T7511] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 382.724891][ T7511] ufs: ufstype=old is supported read-only [ 382.734398][ T7511] ufs: ufs_fill_super(): bad magic number [ 387.680620][ T7575] pci 0000:00:05.0: vgaarb: changed VGA decodes: olddecodes=io+mem,decodes=none:owns=io+mem [ 388.509271][ T7583] loop4: detected capacity change from 0 to 7 [ 388.548486][ T7018] Dev loop4: unable to read RDB block 7 [ 388.554717][ T7018] loop4: unable to read partition table [ 388.566463][ T7018] loop4: partition table beyond EOD, truncated [ 388.601437][ T7583] Dev loop4: unable to read RDB block 7 [ 388.626915][ T7583] loop4: unable to read partition table [ 388.660179][ T7583] loop4: partition table beyond EOD, truncated [ 388.687533][ T7583] loop_reread_partitions: partition scan of loop4 (úùƒå¡™‰ü¾SêjºÐ œëÜ%õ«`ÉæÖ€ù…ˆŠ5) failed (rc=-5) [ 388.734722][ T7584] Dev loop4: unable to read RDB block 7 [ 388.740462][ T7584] loop4: unable to read partition table [ 388.782894][ T7584] loop4: partition table beyond EOD, truncated [ 390.136002][ T7596] binder: 7595:7596 unknown command 1472 [ 390.161210][ T7596] binder: 7595:7596 ioctl c0306201 200000000080 returned -22 [ 390.302483][ T7599] netlink: 12 bytes leftover after parsing attributes in process `syz.4.763'. [ 391.464749][ T4284] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 391.474371][ T4284] CPU: 0 PID: 4284 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 391.482037][ T4284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 391.492144][ T4284] Workqueue: hci1 hci_rx_work [ 391.496857][ T4284] Call Trace: [ 391.500155][ T4284] [ 391.503107][ T4284] dump_stack_lvl+0x188/0x24e [ 391.507811][ T4284] ? show_regs_print_info+0x12/0x12 [ 391.513037][ T4284] ? load_image+0x400/0x400 [ 391.517583][ T4284] sysfs_create_dir_ns+0x26a/0x290 [ 391.522788][ T4284] ? sysfs_warn_dup+0xa0/0xa0 [ 391.527488][ T4284] ? do_raw_spin_unlock+0x11d/0x230 [ 391.532706][ T4284] kobject_add_internal+0x61c/0xcc0 [ 391.538017][ T4284] kobject_add+0x160/0x230 [ 391.542458][ T4284] ? kobject_init+0x1d0/0x1d0 [ 391.547280][ T4284] ? klist_children_get+0x50/0x50 [ 391.552366][ T4284] ? get_device_parent+0x121/0x3f0 [ 391.557511][ T4284] device_add+0x483/0xfb0 [ 391.561860][ T4284] ? kmem_cache_free+0xf7/0x290 [ 391.566735][ T4284] hci_conn_add_sysfs+0xd1/0x1e0 [ 391.571700][ T4284] le_conn_complete_evt+0x1062/0x1670 [ 391.577103][ T4284] ? hci_le_big_info_adv_report_evt+0x2f0/0x2f0 [ 391.584583][ T4284] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 391.590244][ T4284] ? skb_pull_data+0xf7/0x200 [ 391.595035][ T4284] hci_le_conn_complete_evt+0x183/0x440 [ 391.600606][ T4284] ? hci_remote_host_features_evt+0x270/0x270 [ 391.606694][ T4284] hci_event_packet+0x7b9/0x1280 [ 391.611673][ T4284] ? bis_list+0x280/0x280 [ 391.616108][ T4284] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 391.622025][ T4284] ? kcov_remote_start+0x4c7/0x7e0 [ 391.627155][ T4284] ? sync_thread_master+0x620/0x10b0 [ 391.632464][ T4284] ? hci_send_to_monitor+0x9c/0x4a0 [ 391.637684][ T4284] hci_rx_work+0x3eb/0xd40 [ 391.642204][ T4284] ? _raw_spin_unlock+0x40/0x40 [ 391.647077][ T4284] ? process_one_work+0x7b0/0x1160 [ 391.652232][ T4284] process_one_work+0x8a2/0x1160 [ 391.657200][ T4284] ? worker_detach_from_pool+0x240/0x240 [ 391.662852][ T4284] ? _raw_spin_lock_irq+0xb7/0xf0 [ 391.668065][ T4284] ? _raw_spin_lock_irqsave+0x100/0x100 [ 391.673629][ T4284] ? kthread_data+0x4b/0xc0 [ 391.678157][ T4284] worker_thread+0xaa2/0x1270 [ 391.682877][ T4284] kthread+0x29d/0x330 [ 391.687050][ T4284] ? worker_clr_flags+0x1a0/0x1a0 [ 391.692087][ T4284] ? kthread_blkcg+0xd0/0xd0 [ 391.696775][ T4284] ret_from_fork+0x1f/0x30 [ 391.701232][ T4284] [ 391.704343][ C0] vkms_vblank_simulate: vblank timer overrun [ 391.713396][ T4284] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 391.726770][ T4284] Bluetooth: hci1: failed to register connection device [ 395.265353][ T7644] xt_hashlimit: size too large, truncated to 1048576 [ 395.535898][ T7646] netlink: 'syz.4.777': attribute type 10 has an invalid length. [ 396.497631][ T7659] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 397.111787][ T7667] netlink: 104 bytes leftover after parsing attributes in process `syz.2.784'. [ 400.306498][ T5696] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 402.350007][ T7704] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 402.358758][ T7704] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 404.550532][ T5696] usb 1-1: unable to get BOS descriptor or descriptor too short [ 404.614475][ T4582] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 404.635087][ T5696] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 404.688910][ T5696] usb 1-1: can't read configurations, error -71 [ 404.784332][ T4582] usb 3-1: device descriptor read/64, error -71 [ 405.064195][ T4582] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 405.374096][ T4271] kernel read not supported for file /dsp1 (pid: 4271 comm: kworker/0:4) [ 405.637557][ T7718] Failed to get privilege flags for destination (handle=0x2:0x0) [ 412.232145][ T7770] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 412.607787][ T7772] block device autoloading is deprecated and will be removed. [ 413.703573][ T4283] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 413.718763][ T4283] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 413.727689][ T4283] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 413.737339][ T4283] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 413.751698][ T4283] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 413.759182][ T4283] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 415.729622][ T7783] chnl_net:caif_netlink_parms(): no params data found [ 415.828790][ T4284] Bluetooth: hci5: command 0x0409 tx timeout [ 416.225027][ T7783] bridge0: port 1(bridge_slave_0) entered blocking state [ 416.240931][ T7783] bridge0: port 1(bridge_slave_0) entered disabled state [ 416.255281][ T7783] device bridge_slave_0 entered promiscuous mode [ 416.293332][ T7783] bridge0: port 2(bridge_slave_1) entered blocking state [ 416.326469][ T7783] bridge0: port 2(bridge_slave_1) entered disabled state [ 416.358521][ T7783] device bridge_slave_1 entered promiscuous mode [ 416.593778][ T5463] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.680923][ T7783] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 416.744788][ T7783] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 416.775842][ T5463] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.808411][ T4583] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 416.869598][ T7783] team0: Port device team_slave_0 added [ 416.899155][ T5463] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.950554][ T7783] team0: Port device team_slave_1 added [ 417.003014][ T4583] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 417.055294][ T4583] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 417.127878][ T4583] usb 5-1: config 0 descriptor?? [ 417.161020][ T4583] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 417.170002][ T5463] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 417.210400][ T7783] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 417.222562][ T7783] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 417.323775][ T7783] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 417.358637][ T7783] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 417.428439][ T7783] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 417.527943][ T7783] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 417.894805][ T7783] device hsr_slave_0 entered promiscuous mode [ 417.907851][ T4284] Bluetooth: hci5: command 0x041b tx timeout [ 417.934950][ T7783] device hsr_slave_1 entered promiscuous mode [ 417.987836][ T7783] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 418.006172][ T7783] Cannot create hsr debugfs directory [ 420.114018][ T4283] Bluetooth: hci5: command 0x040f tx timeout [ 420.254164][ T7830] infiniband syz2: set down [ 420.259227][ T7830] infiniband syz2: added ipvlan0 [ 420.266824][ T7830] rdma_rxe: unable to create cq [ 420.272433][ T7830] infiniband syz2: Couldn't create ib_mad CQ [ 420.278933][ T7830] infiniband syz2: Couldn't open port 1 [ 420.304791][ T7830] RDS/IB: syz2: added [ 420.309329][ T7830] smc: adding ib device syz2 with port count 1 [ 420.315638][ T7830] smc: ib device syz2 port 1 has pnetid [ 420.335903][ T4583] usb 5-1: USB disconnect, device number 10 [ 423.309191][ T4283] Bluetooth: hci5: command 0x0419 tx timeout [ 428.253893][ T7783] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 428.342501][ T5696] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 428.377355][ T7783] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 428.396926][ T7783] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 428.537779][ T7783] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 428.547586][ T5696] usb 5-1: config 0 has no interfaces? [ 428.553998][ T5696] usb 5-1: New USB device found, idVendor=12d1, idProduct=42f7, bcdDevice=aa.47 [ 428.597043][ T5696] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 428.637832][ T5696] usb 5-1: config 0 descriptor?? [ 429.814125][ T5696] usb 5-1: USB disconnect, device number 11 [ 431.712286][ T7907] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 433.775259][ T7783] 8021q: adding VLAN 0 to HW filter on device bond0 [ 433.946985][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 433.987268][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 434.027989][ T7783] 8021q: adding VLAN 0 to HW filter on device team0 [ 434.063081][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 434.102462][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 434.130233][ T4300] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.137695][ T4300] bridge0: port 1(bridge_slave_0) entered forwarding state [ 434.252933][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 434.421354][ T5463] device hsr_slave_0 left promiscuous mode [ 434.447843][ T5463] device hsr_slave_1 left promiscuous mode [ 434.520305][ T5463] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 434.527903][ T5463] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 434.596838][ T5463] device bridge_slave_1 left promiscuous mode [ 434.609832][ T5463] bridge0: port 2(bridge_slave_1) entered disabled state [ 434.804346][ T5463] device bridge_slave_0 left promiscuous mode [ 435.595519][ T5463] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.083639][ T5463] device veth1_macvtap left promiscuous mode [ 436.130964][ C1] vcan0: j1939_tp_rxtimer: 0xffff888055b40800: rx timeout, send abort [ 436.141097][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888055b40800: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 436.488546][ T5463] device veth0_macvtap left promiscuous mode [ 436.537534][ T5463] device veth1_vlan left promiscuous mode [ 436.569002][ T5463] device veth0_vlan left promiscuous mode [ 440.219812][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.226197][ T1277] ieee802154 phy1 wpan1: encryption failed: -22 [ 444.319603][ T7989] input: syz0 as /devices/virtual/input/input42 [ 445.673124][ T5463] team0 (unregistering): Port device team_slave_1 removed [ 446.045284][ T5463] team0 (unregistering): Port device team_slave_0 removed [ 446.354343][ T5463] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 446.521750][ T5463] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 447.348637][ T4284] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 447.363229][ T4284] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 447.382406][ T4284] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 447.392757][ T4284] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 447.416511][ T4284] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 447.425586][ T4284] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 447.788405][ T5463] bond0 (unregistering): Released all slaves [ 448.913579][ T5579] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 448.922989][ T5579] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 448.931650][ T5579] bridge0: port 2(bridge_slave_1) entered blocking state [ 448.938891][ T5579] bridge0: port 2(bridge_slave_1) entered forwarding state [ 448.948074][ T5579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 448.958227][ T5579] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 448.992719][ T8004] tipc: Enabling of bearer rejected, failed to enable media [ 449.491918][ T4283] Bluetooth: hci1: command 0x0409 tx timeout [ 450.354350][ T6060] libceph: connect (1)[c::]:6789 error -101 [ 450.364688][ T6060] libceph: mon0 (1)[c::]:6789 connect error [ 450.392082][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 450.405316][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 450.447576][ T8030] ceph: No mds server is up or the cluster is laggy [ 450.469610][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 450.654003][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 450.705173][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 450.868816][ T7783] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 450.951824][ T7783] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 450.998149][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 451.024075][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 451.095308][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 451.155121][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 451.693589][ T4283] Bluetooth: hci1: command 0x041b tx timeout [ 451.727077][ T8041] netlink: 4 bytes leftover after parsing attributes in process `syz.2.869'. [ 451.797338][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 452.679506][ T4283] Bluetooth: hci3: command 0x0406 tx timeout [ 453.996759][ T4283] Bluetooth: hci1: command 0x040f tx timeout [ 454.233208][ T8015] chnl_net:caif_netlink_parms(): no params data found [ 454.496625][ T5202] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 454.740772][ T5202] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 455.337834][ T8015] bridge0: port 1(bridge_slave_0) entered blocking state [ 455.376788][ T8015] bridge0: port 1(bridge_slave_0) entered disabled state [ 455.435875][ T8015] device bridge_slave_0 entered promiscuous mode [ 455.479101][ T7783] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 455.532364][ T8015] bridge0: port 2(bridge_slave_1) entered blocking state [ 455.556313][ T8015] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.589948][ T8015] device bridge_slave_1 entered promiscuous mode [ 455.774090][ T5463] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 455.917176][ T8015] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 455.970548][ T5463] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 456.048692][ T4283] Bluetooth: hci1: command 0x0419 tx timeout [ 456.134502][ T8015] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 456.786272][ T5463] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 456.924091][ T8015] team0: Port device team_slave_0 added [ 457.000281][ T5463] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.147665][ T8015] team0: Port device team_slave_1 added [ 458.511619][ T8015] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 458.537487][ T8015] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 458.621075][ T8015] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 458.707789][ T8015] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 458.714808][ T8015] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 458.818149][ T8015] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 459.059957][ T4617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 459.087711][ T4617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 459.120558][ T8015] device hsr_slave_0 entered promiscuous mode [ 459.138689][ T8015] device hsr_slave_1 entered promiscuous mode [ 459.174386][ T8015] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 459.196995][ T8015] Cannot create hsr debugfs directory [ 459.213695][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 459.223740][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 459.235264][ T7783] device veth0_vlan entered promiscuous mode [ 459.280092][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 459.296295][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 459.369098][ T7783] device veth1_vlan entered promiscuous mode [ 459.432426][ T5463] tipc: Left network mode [ 459.463196][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 459.487748][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 459.502000][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 459.512188][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 459.529750][ T7783] device veth0_macvtap entered promiscuous mode [ 459.557638][ T7783] device veth1_macvtap entered promiscuous mode [ 459.731620][ T7783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 459.756861][ T7783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 459.767517][ T7783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 459.778368][ T7783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 459.789511][ T7783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 459.803042][ T7783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 459.820390][ T7783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 459.833675][ T7783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 459.853449][ T7783] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 459.943530][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 459.952814][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 459.970385][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 459.990231][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 460.003856][ T7783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 460.069466][ T7783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 460.079754][ T7783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 460.090634][ T7783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 460.100970][ T7783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 460.111689][ T7783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 460.121775][ T7783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 460.132667][ T7783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 461.324402][ T7783] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 461.860777][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 461.874769][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 461.917979][ T7783] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.939161][ T7783] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.954103][ T7783] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.971505][ T7783] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 463.651647][ T8015] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 464.015675][ T8015] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 464.345311][ T8155] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.700985][ T8157] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 464.711296][ T8157] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 464.786367][ T8157] Bluetooth: hci3: Suspend notifier action (1) failed: -4 [ 464.801261][ T8015] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 464.813761][ T8157] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 464.824162][ T8168] blktrace: Concurrent blktraces are not allowed on sg0 [ 464.897287][ T8157] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 464.993513][ T8157] Bluetooth: hci5: Suspend notifier action (1) failed: -4 [ 465.001576][ T8157] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 465.008668][ T8157] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 465.015888][ T8015] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 465.025610][ T8157] Bluetooth: hci1: Suspend notifier action (1) failed: -4 [ 465.180837][ T8155] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.247379][ T8173] netlink: 32 bytes leftover after parsing attributes in process `syz.0.892'. [ 465.993043][ T8155] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 466.283548][ T4283] Bluetooth: hci3: command 0x0c1a tx timeout [ 466.343964][ T4380] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.351939][ T4380] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 466.363366][ T8155] bridge0: port 3(netdevsim0) entered disabled state [ 466.657925][ T8155] device netdevsim0 left promiscuous mode [ 466.676187][ T8155] bridge0: port 3(netdevsim0) entered disabled state [ 466.788749][ T8155] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 466.845023][ T4283] Bluetooth: hci5: command 0x0c1a tx timeout [ 467.003138][ T4283] Bluetooth: hci1: command 0x0c1a tx timeout [ 467.110085][ T5202] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 467.458165][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.484740][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.542505][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 467.643123][ T5698] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 468.534795][ T4283] Bluetooth: hci3: command 0x0406 tx timeout [ 468.574952][ T8155] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.648665][ T8155] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.693113][ T8015] 8021q: adding VLAN 0 to HW filter on device bond0 [ 468.726937][ T8155] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.760693][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 468.772237][ T5698] usb 1-1: Using ep0 maxpacket: 8 [ 468.789244][ T5698] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 468.793961][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 468.825226][ T5698] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 468.852226][ T5698] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 468.864000][ T8015] 8021q: adding VLAN 0 to HW filter on device team0 [ 468.896439][ T5698] usb 1-1: config 0 descriptor?? [ 468.900012][ T8155] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.932472][ T4283] Bluetooth: hci5: command 0x0406 tx timeout [ 468.977197][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 469.002516][ T4321] usb 6-1: new low-speed USB device number 2 using dummy_hcd [ 469.033282][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 469.056262][ T5068] bridge0: port 1(bridge_slave_0) entered blocking state [ 469.063587][ T5068] bridge0: port 1(bridge_slave_0) entered forwarding state [ 469.083207][ T4283] Bluetooth: hci1: command 0x0406 tx timeout [ 469.119634][ T5698] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 469.166121][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 469.186613][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 469.205913][ T5068] bridge0: port 2(bridge_slave_1) entered blocking state [ 469.206027][ T4321] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 469.213148][ T5068] bridge0: port 2(bridge_slave_1) entered forwarding state [ 469.241654][ T4321] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 469.262325][ T4321] usb 6-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 469.268766][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 469.277127][ T4321] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 469.294007][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 469.302474][ T4321] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 469.332141][ T4271] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 469.361143][ T4321] usb 6-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 469.373797][ T5463] device hsr_slave_0 left promiscuous mode [ 469.388394][ T5463] device hsr_slave_1 left promiscuous mode [ 469.398200][ T4321] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 469.406297][ T5463] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 469.428875][ T4321] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 469.430786][ T5463] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 469.461175][ T5463] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 469.461521][ T4321] usb 6-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 469.471028][ T5463] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 469.489690][ T4582] usb 1-1: USB disconnect, device number 13 [ 469.499227][ T4321] usb 6-1: string descriptor 0 read error: -22 [ 469.507636][ T5463] device bridge_slave_1 left promiscuous mode [ 469.507734][ T4321] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 469.525469][ T5463] bridge0: port 2(bridge_slave_1) entered disabled state [ 469.550764][ T4321] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.559654][ T5463] device bridge_slave_0 left promiscuous mode [ 469.601923][ T5463] bridge0: port 1(bridge_slave_0) entered disabled state [ 469.739640][ T5463] device veth1_macvtap left promiscuous mode [ 469.764719][ T4321] adutux 6-1:168.0: interrupt endpoints not found [ 469.773104][ T5463] device veth0_macvtap left promiscuous mode [ 469.788804][ T5463] device veth1_vlan left promiscuous mode [ 469.818689][ T5463] device veth0_vlan left promiscuous mode [ 470.176964][ T8229] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 470.188061][ T8229] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 470.543095][ T5171] usb 6-1: USB disconnect, device number 2 [ 474.078474][ T4271] usb 3-1: unable to get BOS descriptor or descriptor too short [ 474.118673][ T4271] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 474.143577][ T4271] usb 3-1: can't read configurations, error -71 [ 475.095173][ T5463] team0 (unregistering): Port device team_slave_1 removed [ 475.192398][ T5463] team0 (unregistering): Port device team_slave_0 removed [ 475.298165][ T5463] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 475.483513][ T5463] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 476.456682][ T5463] bond0 (unregistering): Released all slaves [ 476.674031][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 476.683767][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 476.697529][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 476.719560][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 476.731974][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 476.741212][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 476.749929][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 476.759459][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 476.770885][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 476.957860][ T8270] netlink: 8 bytes leftover after parsing attributes in process `syz.0.915'. [ 476.977767][ T8270] netlink: 4 bytes leftover after parsing attributes in process `syz.0.915'. [ 477.018057][ T8270] netlink: 'syz.0.915': attribute type 11 has an invalid length. [ 477.108109][ T8270] netlink: 'syz.0.915': attribute type 13 has an invalid length. [ 478.205377][ T8273] bridge0: port 2(bridge_slave_1) entered disabled state [ 478.213496][ T8273] bridge0: port 1(bridge_slave_0) entered disabled state [ 478.258876][ T8272] device bridge_slave_1 left promiscuous mode [ 478.265858][ T8272] bridge0: port 2(bridge_slave_1) entered disabled state [ 478.288231][ T8272] device bridge_slave_0 left promiscuous mode [ 478.297885][ T8272] bridge0: port 1(bridge_slave_0) entered disabled state [ 478.885557][ T8015] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 478.944046][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 481.483969][ T5696] kernel write not supported for file /dsp1 (pid: 5696 comm: kworker/1:16) [ 483.093494][ T4381] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 483.133578][ T4381] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 483.181351][ T8015] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 483.325136][ T4582] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 483.505265][ T6060] usb 3-1: new full-speed USB device number 18 using dummy_hcd [ 484.638727][ T8358] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 484.648541][ T8358] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 485.172704][ T8345] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 485.224816][ T6060] usb 3-1: unable to get BOS descriptor or descriptor too short [ 485.362514][ T6060] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 485.408232][ T6060] usb 3-1: can't read configurations, error -71 [ 486.636695][ T4582] usb 6-1: unable to get BOS descriptor or descriptor too short [ 486.679923][ T4582] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 486.690346][ T4582] usb 6-1: can't read configurations, error -71 [ 488.851431][ T6060] kernel write not supported for file /dsp1 (pid: 6060 comm: kworker/1:18) [ 490.331563][ T4321] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 490.434255][ T4618] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 490.444484][ T4618] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 490.468854][ T8015] device veth0_vlan entered promiscuous mode [ 490.529732][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 490.546271][ T4321] usb 3-1: Using ep0 maxpacket: 8 [ 490.555040][ T4321] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 490.571493][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 490.853269][ T4283] Bluetooth: hci3: unknown advertising packet type: 0x75 [ 490.854424][ T4283] Bluetooth: hci3: Malformed LE Event: 0x02 [ 490.935773][ T8015] device veth1_vlan entered promiscuous mode [ 491.141307][ T5696] usb 1-1: new low-speed USB device number 14 using dummy_hcd [ 491.356001][ T5696] usb 1-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 62, changing to 4 [ 491.411217][ T4271] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 491.420836][ T4321] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 491.421115][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 491.429917][ T4321] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.431747][ T4321] usb 3-1: config 0 descriptor?? [ 491.459001][ T5696] usb 1-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 47767, setting to 0 [ 491.492645][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 491.510870][ T5696] usb 1-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 491.513062][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 491.529310][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 491.591231][ T5696] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.592764][ T4271] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 491.616172][ T4271] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 491.620225][ T8015] device veth0_macvtap entered promiscuous mode [ 491.627814][ T4271] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 491.644188][ T4271] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 491.670637][ T4321] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 491.700415][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 491.715166][ T4271] usb 2-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 491.739847][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 491.744798][ T4271] usb 2-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 491.776815][ T8015] device veth1_macvtap entered promiscuous mode [ 491.795453][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 491.809163][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 491.819169][ T4271] usb 2-1: Manufacturer: syz [ 491.855700][ T4271] usb 2-1: config 0 descriptor?? [ 491.862051][ T8015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 491.936219][ T8015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 491.970620][ T8015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 492.005614][ T8015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 492.029672][ T4268] usb 3-1: USB disconnect, device number 20 [ 492.036453][ T8015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 492.036480][ T8015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 492.087445][ T8015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 492.100569][ T8015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 492.268261][ T8015] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 492.308127][ T5463] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 492.324848][ T5463] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 492.331921][ T4271] appleir 0003:05AC:8243.0005: unknown main item tag 0x0 [ 492.343171][ T4271] appleir 0003:05AC:8243.0005: No inputs registered, leaving [ 492.357511][ T4271] appleir 0003:05AC:8243.0005: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.1-1/input0 [ 492.383610][ T8015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 492.425253][ T8015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 492.435449][ T8015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 492.450401][ T8015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 492.479558][ T8015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 492.550096][ T8015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 492.642464][ T8015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 492.693524][ T8015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 492.755289][ T8015] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 492.815958][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 492.846281][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 492.918909][ T8015] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 492.952955][ T8015] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 492.999566][ T8015] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 493.050216][ T8015] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 493.392304][ T4617] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 493.400632][ T5696] usb 1-1: string descriptor 0 read error: -71 [ 493.408848][ T5696] hub 1-1:32.0: bad descriptor, ignoring hub [ 493.419296][ T5696] hub: probe of 1-1:32.0 failed with error -5 [ 493.431996][ T4617] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 493.521861][ T5068] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 493.581220][ T5696] usb 1-1: USB disconnect, device number 14 [ 493.608278][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 493.623830][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 493.652785][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 494.144620][ T7018] udevd[7018]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:32.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 496.047907][ T4268] usb 2-1: USB disconnect, device number 18 [ 496.312962][ T4322] kernel write not supported for file /dsp1 (pid: 4322 comm: kworker/0:7) [ 498.051727][ T8498] siw: device registration error -23 [ 498.505834][ T8502] smc: removing ib device syz2 [ 499.304340][ T8502] ------------[ cut here ]------------ [ 499.309889][ T8502] WARNING: CPU: 1 PID: 8502 at drivers/infiniband/sw/rxe/rxe_pool.c:116 rxe_pool_cleanup+0x3e/0x50 [ 499.320653][ T8502] Modules linked in: [ 499.324558][ T8502] CPU: 1 PID: 8502 Comm: syz.5.962 Not tainted syzkaller #0 [ 499.331882][ T8502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 499.341957][ T8502] RIP: 0010:rxe_pool_cleanup+0x3e/0x50 [ 499.347465][ T8502] Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 24 91 38 fa 48 83 3b 00 75 07 e8 f9 85 e7 f9 5b c3 e8 f2 85 e7 f9 <0f> 0b 5b c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 55 41 57 41 [ 499.367375][ T8502] RSP: 0018:ffffc900034d71c8 EFLAGS: 00010246 [ 499.373451][ T8502] RAX: ffffffff879aee9e RBX: ffff888079f8d298 RCX: 0000000000080000 [ 499.381495][ T8502] RDX: ffffc9001e7e9000 RSI: 000000000007ffff RDI: 0000000000080000 [ 499.389489][ T8502] RBP: 0000000000000002 R08: ffff888079f8c743 R09: 1ffff1100f3f18e8 [ 499.397491][ T8502] R10: dffffc0000000000 R11: ffffed100f3f18e9 R12: dffffc0000000000 [ 499.405465][ T8502] R13: 0000000000000008 R14: ffffffff87997300 R15: dffffc0000000000 [ 499.413485][ T8502] FS: 00007f93912b16c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 499.422529][ T8502] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 499.429159][ T8502] CR2: 0000001b31c11ff8 CR3: 000000006277c000 CR4: 00000000003526e0 [ 499.437255][ T8502] Call Trace: [ 499.440536][ T8502] [ 499.443465][ T8502] rxe_dealloc+0x2f/0x100 [ 499.447837][ T8502] ? trace_raw_output_rtrs_clt_conn_class+0x230/0x230 [ 499.454610][ T8502] ib_dealloc_device+0x4a/0x1f0 [ 499.459512][ T8502] __ib_unregister_device+0x120/0x170 [ 499.465147][ T8502] ib_unregister_device_and_put+0xb4/0xf0 [ 499.470905][ T8502] nldev_dellink+0x28f/0x320 [ 499.475502][ T8502] ? lock_chain_count+0x20/0x20 [ 499.480392][ T8502] ? nldev_newlink+0x610/0x610 [ 499.485207][ T8502] ? apparmor_capable+0x12c/0x190 [ 499.490280][ T8502] ? bpf_lsm_capable+0x5/0x10 [ 499.494960][ T8502] ? security_capable+0x85/0xb0 [ 499.499844][ T8502] ? nldev_newlink+0x610/0x610 [ 499.504617][ T8502] rdma_nl_rcv+0x6cd/0x9f0 [ 499.509071][ T8502] ? rdma_nl_net_init+0x190/0x190 [ 499.514115][ T8502] ? netlink_deliver_tap+0x2e/0x1b0 [ 499.519384][ T8502] ? netlink_deliver_tap+0x2e/0x1b0 [ 499.524621][ T8502] netlink_unicast+0x74d/0x8d0 [ 499.529450][ T8502] netlink_sendmsg+0x8ad/0xbd0 [ 499.534262][ T8502] ? netlink_getsockopt+0x550/0x550 [ 499.539547][ T8502] ? aa_sock_msg_perm+0x94/0x150 [ 499.544531][ T8502] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 499.550018][ T8502] ? security_socket_sendmsg+0x7c/0xa0 [ 499.555512][ T8502] ? netlink_getsockopt+0x550/0x550 [ 499.560831][ T8502] ____sys_sendmsg+0x5be/0x970 [ 499.565696][ T8502] ? __sys_sendmsg_sock+0x30/0x30 [ 499.571021][ T8502] ? __import_iovec+0x315/0x500 [ 499.575883][ T8502] ? import_iovec+0x6f/0xa0 [ 499.580423][ T8502] ___sys_sendmsg+0x2a2/0x360 [ 499.585106][ T8502] ? try_to_wake_up+0x6ae/0x1080 [ 499.590081][ T8502] ? __sys_sendmsg+0x290/0x290 [ 499.594877][ T8502] __se_sys_sendmsg+0x1bb/0x2a0 [ 499.599764][ T8502] ? __x64_sys_sendmsg+0x80/0x80 [ 499.604716][ T8502] ? lockdep_hardirqs_on+0x94/0x140 [ 499.609964][ T8502] do_syscall_64+0x4c/0xa0 [ 499.614397][ T8502] ? clear_bhb_loop+0x60/0xb0 [ 499.619116][ T8502] ? clear_bhb_loop+0x60/0xb0 [ 499.623800][ T8502] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 499.629740][ T8502] RIP: 0033:0x7f939039c819 [ 499.634159][ T8502] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 499.653924][ T8502] RSP: 002b:00007f93912b1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 499.662376][ T8502] RAX: ffffffffffffffda RBX: 00007f9390616180 RCX: 00007f939039c819 [ 499.670676][ T8502] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 499.678709][ T8502] RBP: 00007f9390432c91 R08: 0000000000000000 R09: 0000000000000000 [ 499.686727][ T8502] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 499.694875][ T8502] R13: 00007f9390616218 R14: 00007f9390616180 R15: 00007fff9c91b578 [ 499.702902][ T8502] [ 499.705924][ T8502] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 499.713204][ T8502] CPU: 1 PID: 8502 Comm: syz.5.962 Not tainted syzkaller #0 [ 499.720517][ T8502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 499.730616][ T8502] Call Trace: [ 499.733903][ T8502] [ 499.737033][ T8502] dump_stack_lvl+0x188/0x24e [ 499.741810][ T8502] ? memcpy+0x3c/0x60 [ 499.745796][ T8502] ? show_regs_print_info+0x12/0x12 [ 499.751012][ T8502] ? load_image+0x400/0x400 [ 499.755518][ T8502] panic+0x2e5/0x730 [ 499.759425][ T8502] ? bpf_jit_dump+0xd0/0xd0 [ 499.763931][ T8502] __warn+0x2f8/0x4f0 [ 499.768007][ T8502] ? rxe_pool_cleanup+0x3e/0x50 [ 499.772865][ T8502] ? rxe_pool_cleanup+0x3e/0x50 [ 499.777717][ T8502] report_bug+0x2ba/0x4f0 [ 499.782054][ T8502] ? rxe_pool_cleanup+0x3e/0x50 [ 499.786909][ T8502] handle_bug+0x3a/0x70 [ 499.791066][ T8502] exc_invalid_op+0x16/0x40 [ 499.795575][ T8502] asm_exc_invalid_op+0x16/0x20 [ 499.800437][ T8502] RIP: 0010:rxe_pool_cleanup+0x3e/0x50 [ 499.805953][ T8502] Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 24 91 38 fa 48 83 3b 00 75 07 e8 f9 85 e7 f9 5b c3 e8 f2 85 e7 f9 <0f> 0b 5b c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 55 41 57 41 [ 499.825556][ T8502] RSP: 0018:ffffc900034d71c8 EFLAGS: 00010246 [ 499.831680][ T8502] RAX: ffffffff879aee9e RBX: ffff888079f8d298 RCX: 0000000000080000 [ 499.839672][ T8502] RDX: ffffc9001e7e9000 RSI: 000000000007ffff RDI: 0000000000080000 [ 499.847757][ T8502] RBP: 0000000000000002 R08: ffff888079f8c743 R09: 1ffff1100f3f18e8 [ 499.855817][ T8502] R10: dffffc0000000000 R11: ffffed100f3f18e9 R12: dffffc0000000000 [ 499.863810][ T8502] R13: 0000000000000008 R14: ffffffff87997300 R15: dffffc0000000000 [ 499.871812][ T8502] ? trace_raw_output_rtrs_clt_conn_class+0x230/0x230 [ 499.878675][ T8502] ? rxe_pool_cleanup+0x3e/0x50 [ 499.883610][ T8502] ? rxe_pool_cleanup+0x3e/0x50 [ 499.888473][ T8502] rxe_dealloc+0x2f/0x100 [ 499.892808][ T8502] ? trace_raw_output_rtrs_clt_conn_class+0x230/0x230 [ 499.899591][ T8502] ib_dealloc_device+0x4a/0x1f0 [ 499.904505][ T8502] __ib_unregister_device+0x120/0x170 [ 499.909982][ T8502] ib_unregister_device_and_put+0xb4/0xf0 [ 499.915712][ T8502] nldev_dellink+0x28f/0x320 [ 499.920301][ T8502] ? lock_chain_count+0x20/0x20 [ 499.925154][ T8502] ? nldev_newlink+0x610/0x610 [ 499.929966][ T8502] ? apparmor_capable+0x12c/0x190 [ 499.934995][ T8502] ? bpf_lsm_capable+0x5/0x10 [ 499.939673][ T8502] ? security_capable+0x85/0xb0 [ 499.944522][ T8502] ? nldev_newlink+0x610/0x610 [ 499.949284][ T8502] rdma_nl_rcv+0x6cd/0x9f0 [ 499.953719][ T8502] ? rdma_nl_net_init+0x190/0x190 [ 499.958761][ T8502] ? netlink_deliver_tap+0x2e/0x1b0 [ 499.963989][ T8502] ? netlink_deliver_tap+0x2e/0x1b0 [ 499.969195][ T8502] netlink_unicast+0x74d/0x8d0 [ 499.973965][ T8502] netlink_sendmsg+0x8ad/0xbd0 [ 499.978738][ T8502] ? netlink_getsockopt+0x550/0x550 [ 499.983941][ T8502] ? aa_sock_msg_perm+0x94/0x150 [ 499.988878][ T8502] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 499.994164][ T8502] ? security_socket_sendmsg+0x7c/0xa0 [ 499.999759][ T8502] ? netlink_getsockopt+0x550/0x550 [ 500.004972][ T8502] ____sys_sendmsg+0x5be/0x970 [ 500.009770][ T8502] ? __sys_sendmsg_sock+0x30/0x30 [ 500.014801][ T8502] ? __import_iovec+0x315/0x500 [ 500.019669][ T8502] ? import_iovec+0x6f/0xa0 [ 500.024173][ T8502] ___sys_sendmsg+0x2a2/0x360 [ 500.028853][ T8502] ? try_to_wake_up+0x6ae/0x1080 [ 500.033793][ T8502] ? __sys_sendmsg+0x290/0x290 [ 500.038644][ T8502] __se_sys_sendmsg+0x1bb/0x2a0 [ 500.043515][ T8502] ? __x64_sys_sendmsg+0x80/0x80 [ 500.048485][ T8502] ? lockdep_hardirqs_on+0x94/0x140 [ 500.053703][ T8502] do_syscall_64+0x4c/0xa0 [ 500.058140][ T8502] ? clear_bhb_loop+0x60/0xb0 [ 500.062831][ T8502] ? clear_bhb_loop+0x60/0xb0 [ 500.067598][ T8502] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 500.073583][ T8502] RIP: 0033:0x7f939039c819 [ 500.078007][ T8502] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 500.097636][ T8502] RSP: 002b:00007f93912b1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 500.106052][ T8502] RAX: ffffffffffffffda RBX: 00007f9390616180 RCX: 00007f939039c819 [ 500.114132][ T8502] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 500.122203][ T8502] RBP: 00007f9390432c91 R08: 0000000000000000 R09: 0000000000000000 [ 500.130180][ T8502] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 500.138165][ T8502] R13: 00007f9390616218 R14: 00007f9390616180 R15: 00007fff9c91b578 [ 500.146164][ T8502] [ 500.149653][ T8502] Kernel Offset: disabled [ 500.154081][ T8502] Rebooting in 86400 seconds..