last executing test programs: 17.364271789s ago: executing program 3 (id=248): syz_usbip_server_init(0x2) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002c00)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x60000000, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x4}, 0x50) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x428003, 0x15) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r1) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x0, &(0x7f0000001dc0)={0xf, 0x5, 0x0, {r1}}, 0x20) truncate(&(0x7f0000000000)='./file1\x00', 0x4edd) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$video4linux(&(0x7f0000000040), 0x7fff, 0x48b03) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r4, 0x80085665, &(0x7f00000000c0)={0x0, 0x21ff}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0xfffff001, 0x0, 0x9, 0x8, 0xfefffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1, 0x2, &(0x7f0000000140)=ANY=[@ANYBLOB="8110b000020000009500000500000000"], &(0x7f00000002c0)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x4}, 0x94) close(r5) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) getpid() syz_80211_join_ibss(&(0x7f0000000200)='wlan1\x00', &(0x7f00000002c0)=@default_ap_ssid, 0x6, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={0x0}, 0x1, 0x0, 0x0, 0x48800}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_int(r6, 0x1, 0x1, &(0x7f0000000380)=0xfffff272, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r7, &(0x7f0000003040)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0xdd65, @local, 0x4}, 0x1c, &(0x7f0000000140)=[{&(0x7f00000001c0)='7', 0x1}], 0x1}}, {{&(0x7f0000000040)={0xa, 0x4e21, 0x130a, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x6}, 0x1c, &(0x7f0000000080)=[{&(0x7f0000000200)='7', 0x1}], 0x1}}], 0x2, 0xd8) 15.541308447s ago: executing program 3 (id=256): socket$can_raw(0x1d, 0x3, 0x1) r0 = syz_usb_connect(0x3, 0x64, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000cb8be7406d04230848390102030109025200010000000009044000000e0100000a240608000b020102000600040007000300390c2402050302", @ANYRESOCT=0x0], 0x0) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x2382, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000180)={0x4, 0x2007}) syz_usb_control_io$printer(r0, &(0x7f0000000400)={0x14, 0x0, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44e}}}, 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000700)={0x14, &(0x7f0000000640)={0x40, 0x10, 0x2, {0x2, 0x8}}, &(0x7f0000000680)={0x0, 0x3, 0x3d, @string={0x3d, 0x3, "bc95ce0c21f3141eca85c8f1c5969d8238eb45ee2a79bfe688dac8204fad45ef8c8b811d834c065128894bdec44f060d2308b9c25c479c58553734"}}}, &(0x7f00000009c0)={0x44, &(0x7f0000000740)={0x40, 0x5, 0x7d, "7211e8e5735b4cda75a9d63b0637c1ec880c0fe44092b2ce98279a931a6ebc4e7ec34dd3ad716f6145721751c019c4f69b63cb81e84dab419a836a04275442e7718158cafe695c04a0d236eea716498964f73aa0ae14d58a6ee25ce8d94c25016971029d8ab33e30e4d15e1f36476a2256fd9c5f999436e2b43d200db0"}, &(0x7f0000000800)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000840)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000880)={0x20, 0x81, 0x3, "d3cb5b"}, &(0x7f00000008c0)={0x20, 0x82, 0x3, "58cc59"}, &(0x7f0000000900)={0x20, 0x83, 0x2, "7399"}, &(0x7f0000000940)={0x20, 0x84, 0x2, "f74c"}, &(0x7f0000000980)={0x20, 0x85, 0x3, "c98285"}}) syz_usb_control_io$rtl8150(r0, &(0x7f0000000380)={0x14, &(0x7f00000001c0)={0x0, 0x10, 0x8d, {0x8d, 0xb, "85d2e15781a57a924e596c754c62d481f98a0e97cb67c559673664fe34df86b9d7674ab39e4e357f22403e17e73e2767b24acca9341fca0bf0bba67b5395533a24725c31c20032b38cdf82db8dda3830466328ae703e87d452881d4fb4e2dcae3d3d4d9e7b61ad46f14cf6af56baa49d7640bd77d78e5c669300de104c8500af343dff1a3e4b7974467f94"}}, &(0x7f0000000280)={0x0, 0x3, 0xee, @string={0xee, 0x3, "805d69d621a33332ed54fe728a42e8c38168e5e629d93c5905ca813261987b58949319ad24c127c3428efb73a679a1aff8478f1f061d19c18f1f287c98b7b7022cd4c076d90a5053ae9574f0250cc9d58453dbaf339ba399663a73d76a9755db639a54af32833ea50c5135fa1254867a361e9feccc7e2358a4b3b1518aa6132dba574e3ec2cb72ababc08fef48120b5652994409a7aebffa3ab1a1119d72998dcfe63862de42a33431fb9f1452274c8f1b1d14c26ecf0e3ca8df9f79db23ebaf77727dc4e2715179ca795ab474086b6c2c08e2ac0f3107acf7e9a56c9f47920ab8e9eb6508b0c2911f074e08"}}}, &(0x7f0000000600)={0x2c, &(0x7f0000000480)={0x0, 0x30, 0x16, "915dce12c7d91c64eca1a8df292694d9f73e808afaeb"}, &(0x7f00000004c0)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000580), &(0x7f00000005c0)={0x40, 0x5, 0x2, "85f2"}}) capset(&(0x7f0000000100)={0x19980330}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1}) setgroups(0x0, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f0000000440)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_io_uring_setup(0x231, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000540), &(0x7f0000000140)) 12.768041176s ago: executing program 0 (id=265): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000200), 0x101000, 0x0) ioctl$SNAPSHOT_FREE_SWAP_PAGES(r2, 0x3309) sched_setattr(0x0, &(0x7f0000000400)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x6, 0xa, 0x4) mprotect(&(0x7f0000ff6000/0x8000)=nil, 0x8000, 0xb3d8aa3f318c3958) syz_open_dev$vim2m(&(0x7f0000000180), 0x0, 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f00000025c0)=ANY=[@ANYBLOB="b7000000010003c3bfa30000000000000703000020feffff720af0fff8ffffff71a4f0ff0000000065040200000000ff2d4005000c0000003400070001ed00007b900000000000001d440000000000007a0a00fe00ffffffdb030000e1000000b5000000000000009500000000000000023bc065b78111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e51815548000000000000000275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7f300c095199fe3ff3128e599b0eaebbdbd732c9cc00eec36574a8f6456e2ccae25ea21714eca8cf5d803e04d83b46e21557c0afc646cb7790b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2400000000000000800643a98d9ec21ead2ed51b104d4d91af25b845b9f75dd08d123deda8ebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987af1714e72ba7616536fd9aa58f2477184b6a89adaf17b0baf587aef370a2d426a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d64364c82770c8204a0deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee7d26b34381fcb59b854e9d5a17f4720082f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67051d355d84ce97bb0c6b4a595e487efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599ddd71063be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d96c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d38df9ba60248d9a0d61282dfb15eb6841bb64a1b3045024a982f3c48153baae2c4e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c3560811ea6c3560a43364d402ccdd9069bd50b994fd6a34ee18022a579dfc0229cc0dc9881610270928eaeb883418f562ae00003ea96d10f172c0374d6eed826407000000000000004a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea52acb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d851680f6f2f9a6a8906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f4ca2195234648e0a1ca50db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145eb6dc5f6a9037d2283c42efc54fa84323a3304f41ff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f928ba7554ba583fef3ec7932f5954f31a878e2fae6691df8b4b7ecd27ce82f7df3e7d1daac43738612e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e96735600000554f327a353511ccedde99493c31ac05a7b57f03ca91a01ba2c60ca99e8ebc15ecb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d40460780000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120968308c31db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd0000000069ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a003fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9e0600f86909bc90addb7b9aee813df534aac4b32fd691b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a000000000000000000000000000006acc19808d7cf29bc974b0ea92499a419aa095e203c1bafbb9b9a7c2bca3f0a18ee4952f2d325a56390578f12205db653a536f0100e0eda300a4dc6b3fb84f3738a4b6caa84feda91f3edb32231ec75300000000000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b88b5e7885e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035ab63de71a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db1829f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2744c46570e8f46da1ab990ca053cbfe801000000000000000000000000000000d55d7182af2ea5f8d0ad495e3eb9421963a5a683c3dcb2d300aa3b2cfe946d2348c35f5d67d68ac07c8f84b3679e77c2e629ecec7c12c35d6b6971b8ae13cc00956d2227db60c0a461ed2b3ecfb16d19037c8c88c91dda1f904fbbc864e95ad43d6dd6d5eadbcea25682ba4b91e14c3fbfdfd1d680aa1af102d97681656bf56ff0674237ce097d39008cc3257778de878bcd37467386f993be6d20c93a7791e7f2a155ce379b4cda2500108052aeb9bd03ff6d4c5dbda9ff485d6576a492d436d52edcd420e7deaa4343a0add3941ae7c5f58af43866ca64750f43e583ca1ceb3a805e46beef9dca77a4edcbb42aa0caf0bbd6cec72d85540293cb4849b0610800000000000000000000000000000000f9814d5f6c8673c143ff2f901e71b8818665b56f7a03afe3d900007656859db4cb06aaaf9f02cfab5b9e61cc00e8e19429921b8df4c4c53bddea4cc48737371cdf8f681dd7a2685df194ca89da8cf6d29a2be9779181fd5d105af5786094d9130f5826b18b9667b971a994f3fd069629a1052f441e96884f90c91f4a974242aabfc8adbadc9ca27955b5c90f0bd9a46ed044272383d3768871a9c8cfd7948aea445c55684351002ed4a4af45341de8e5e1f33624bd2ec1591dd00bbe05000000f89a928662e9b9449db34394fc5e946fadaee576e28ac0feab4e3585ed43d206218f524083840a78b7236bb7f5e42b5376642f8ad4028d4ead407240e7467d1b37afe20690d7672c7e926fded95cf805516ad836eb730619a05af36fb28329d6feb33219cc9164461a8ba3afd5949b9a6046c53663df30a049414089c1ae8f3476236b05dde8dda4843a62c591f8d2b1a62d0db8dc826219bd87398b33e140792297d023ef52de2e75b9dbbfb8712ccc15c69cfb4c6c1bc2ae74621e536b9d3f09a15dada1561a8192d65cc59d7ed5a6bd61000000000000000000000000000000000000000000000000000000000000000000000000f637782e317d492b2392fd0ea81397a80227f271bad21d688af35a2bd02c15d20f3d62a50e20260642c25f304c8034a5f4d8e45e701dbd84294d1096e715662b8223e10e98c4c38451fc5c702084e3fa9b184e0d0fba44acf3bb8a846cf680dfbf312cddfdb2043288fa6b67fa762c8b75d4478756ef240f2b314e4d77a3afb4fcec92248327004d1dac7ac87a6f8cb04d82acc307d60e4713bd9a8f29091d3048c669a5f5439e0a906ce098d177b9579882586511cfe6a23e57c44d1654899f077b5636e4181f3de6b814bedcac5290ad8018bbe4424edc6d9b0e61b404bb7a2d4883bbc200de8332029cbc04a0bc52d9870cdfb950b139625fa88f5c9088fc9032a5ea07415029c74354f54e37427a4b26e559cd240b7950630d7d4da9cb8d256356bee8c827db43313e75da9c36d0f7bef4fcf23469d8c9104a917959c3bc791a54d1882f532d2597ff50d4a10fe3b80a3d67d3c3dca0dfe0e4eb039df7480542f841313ad2ec26fe7d03829f80c6f3e028d2f4495c3c523929b203048ac9ba20b012c005e36b93eb5a02768503c6c41f50d2a04999bba560f86c7c9a78e4b337983cbdb5d71be3090208a1f7eaa3edc840ea0da5f4cc01f3e87c7566176981a738bcd4dd8b8a137e7a15e57054ebf1d9ba227361be11a7d155054e154364041468e6268ea23e74eacbb5200e2d8f8919402ca20794a29dd986c6593d47b47d5cd70153908a77039a995a44e960ad037f4d2569751eea3ae70fc49f32c30d6be0594bfda189f0be84d1eaf70e0e90223a3c97ade9973e9219c5a2e1c68efe6adf744710eb0ad8e555be26855496bc6b5e13078380230728b1862f0d93397b88ebf5197b61d27b6c555502aed27d2f2b127aeeae41dd4324fad2e7a962"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) r3 = socket(0x1d, 0x2, 0x6) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0) syz_open_procfs(0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_int(r3, 0x1, 0x28, &(0x7f00000000c0)=0x4, 0x4) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000080)={0x0, 0xb0}, 0x1, 0x7}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@ipv6_newrule={0x2c, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfd, {0xa, 0x0, 0x0, 0xcd, 0xff, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8}, @FIB_RULE_POLICY=@FRA_SUPPRESS_PREFIXLEN={0x8, 0xe, 0xb52a}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040090}, 0x40000) readv(0xffffffffffffffff, &(0x7f0000000780)=[{&(0x7f00000002c0)=""/255, 0xff}, {0x0}], 0x2) prlimit64(0x0, 0x2, &(0x7f0000000040)={0x0, 0xffffffffffffffff}, 0x0) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000fff000/0x1000)=nil) r5 = signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0xbb46]}, 0x8) r6 = getpid() fcntl$lock(r5, 0x26, &(0x7f0000000080)={0x1, 0x3, 0x8, 0x1, r6}) 11.22832584s ago: executing program 4 (id=268): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000440)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd00000010000100030808004149014006040800", 0x58}], 0x1) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) landlock_create_ruleset(&(0x7f0000000940)={0x1, 0x0, 0x1}, 0x18, 0x2) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket$can_bcm(0x1d, 0x2, 0x2) r11 = memfd_create(&(0x7f0000000980)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\x02A\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd\x1fel\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x86\x8d\x1e_g\xb6J\x87E\v,\x8a\x81\x92\x13oz2c\x97 \x03?S\x86\x82`\xf5m\x89\x89g\x80\ad\xaa0\x9d\xc1\xb3\xf9\xe0\xebw\x88\x1d\xe8.H\x95\bp\xe3\xa9d\x87u\x9f\v\x8cK\x14\x83\x18ST\x91\xf5\xd9\xe7\xa0\xa0B\xd9\xc1g\x04\xdf\x9f\xd8\b\x82u\xc7\xcd:\xb9\x8bk,(VB\xbb\xcaE\xb9\x11\xb4(\xe5/\xf2\xa5\x17\xc6\xc8C\xa1\xf7\x11@}\xb8i\xe4\xe4\xeeWdU7\b\xa0Q\xb2\xf4\x97f\xf8\xa0\x9d\xba\x91\x8d\xdc\x9e\xa4\x8aS3\xb4\xf20x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, {}, 0x1}) r7 = fanotify_init(0x200, 0x0) readv(r7, &(0x7f0000000340)=[{&(0x7f0000000380)=""/176, 0xfffffe2e}], 0x1) 10.825856691s ago: executing program 4 (id=270): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) sendmmsg$unix(r1, &(0x7f0000000700)=[{{&(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000280)=[{&(0x7f0000000440)="a28bdbd53fa214050c08eb545a4de9aa15b36f1ff44f92764024311cde5149dec8fb0f09d4ed34cefa39fbd5583b24e871c5656fceb499e2c04637ca5b9bd1969c0d37b9ac8d4e139e79dd698a7cd9afbe266b98585c85db65a91723161f7e2f0d612b0e6a", 0x65}, {&(0x7f00000004c0)="5fbe7b882b5f3ea28615c65bf394d986acc202c10be6f2dea583e3fcca60fe79b9fab8b817e03d76d1f649906a53f0de1a50ae1e8e55049a1f7f1e0f3b75c4cd69", 0x41}, {&(0x7f00000005c0)="ade5a34e97108380b646410c655a3254238ab9d3eceb8670e0b8f301664bc0d13f9e6faf6e42694781fa2f98d21b6c8b30fc2ffe349afbb2f734524be115587d7247180d4960fdec9bb561f6b7c123060d13facfdb08c579131c6c64a7ffc13ba95cc463a2b217cafbef429039699962f700412c6a0d1cb9e91de0e919eba7128c3085c4125fd623005551d63f41deb8998ec12d0ff4f6a55dbf8a98d161f9fdc8591a4c7f5ef3a70f23eea475c3daf53608c182dfaed742013147792353bb9a959d1e781316f37228a1", 0xca}], 0x3, &(0x7f00000006c0), 0x0, 0x880}}], 0x1, 0x10) syz_clone(0x648e7000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f00000001c0), 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000300)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x20, 0x8, 0x91, 0x9, 0x80000001, 0x8000000, "88ee9fdb45ada97dd28bc7af929edb66bbd02e523d043bf43903fe740b612ae9"}}, 0x138) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x37, 0x0, &(0x7f0000000240)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040)) ioctl$sock_SIOCBRDELBR(0xffffffffffffffff, 0x89a2, 0x0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000080}, 0x20000090) inotify_add_watch(0xffffffffffffffff, 0x0, 0x540) r9 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r9, &(0x7f0000000180)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e24, @multicast1}}, 0x24) syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x717e, 0x100, 0x14, 0x151}, &(0x7f0000000140)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r9, 0x0, 0x0, 0x0, 0x0, 0x0, {0x3}}) 10.130647137s ago: executing program 3 (id=273): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_usb_connect(0x3, 0x24, &(0x7f0000003040)={{0x12, 0x1, 0x250, 0x57, 0x9a, 0xa5, 0x8, 0x2dee, 0x4d22, 0x8cfd, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x6, 0x10, 0x10, 0x7f, "", [{{0x9, 0x4, 0xb8, 0x5f, 0x0, 0xff, 0x0, 0x0, 0x6}}]}}]}}, &(0x7f0000003a40)={0xfa, 0x0, 0x0, 0x0}) 9.919852347s ago: executing program 0 (id=274): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) r2 = socket$inet(0x2, 0x80000, 0xfffffffb) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x41, &(0x7f0000000100)=ANY=[@ANYBLOB="74617700000000000000000000000000000000000000000000000000000000000200000055f96f3e81555f52b3ca9805f788812f000000000000000000000000000000400000"], 0x48) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3ff, 0x8, &(0x7f0000006680)) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) syz_clone(0x25000000, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r3 = socket$tipc(0x1e, 0x5, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000007c0)=@updpolicy={0x1100, 0x19, 0x1, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1a}, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x2, 0x40800000000000, 0x800000000000000}}, [@algo_comp={0x1048, 0x3, {{'deflate\x00'}, 0x8000, "2e7e08b4aa0af67661a6aab8060ef55c5b8c181b56f38b569f98a9465916b86ce7876fe69c9729ed3f59c01e840904975a2772ce4ebfeb4a209f32c6126c6ff2bcbe632e37c440c1aeb184ff5de81db4587c3f09024c45c120fbb6f56c6ea2234cb13d553b65fc1646a39eb9f79ff32ab98f19283c5bc1ba108e4c30906135d98354974951fc40cd8caaa794b1dd9562bd99014aecb4de51b83cdbd015f2d27e37f81847ed56b5cbe2d6eb35286d4195c03f6e94bb2dce4df4bf93bfa788c705da4b59aee8c06980ed0633beb9ac4e0ccb8e26e0673d6ce48662bc477c9a075a9a82b0bbce4181ba9cbd42d49d449b15a432c535a5d4958dd397dbfaeba866e82461f2d9e84aa5af47e7f98827d38708b356ebe63120d362ce758cfd9bd3c5999de69c0182d69908dcf776b9d50a334d5d63d4f0d98486dcb5f57b3e1aad267320e25adc8a1eaf415266333742b3c20ae75b1db50ca55f17fd09743c9600381ef198544180791859af406865b36e31dc3e94e1c08cbfc404b34c5d65f835b75832705f06a049e136da12b9e9bf378f2f132166fb4113a0c9d1873513e60cc9cfaf6a81689c29f30ff64842014b33dc42022aab75b76612e8b8d152587cf84727c05fc6502e0a0af3a33a7c5fe7fc6340dee7cc1c2c3443990bd4b823ed4547c796e3d0a0afe80fa642ad9f56c1e2832b655d4409c11aa53849f90693a60d975c1da5c0d879ded68a2adc5554deb0edbe8542f2fdb5ad221c0e18d0a910b7d9bb1e8db31e949dea48237ba90b59f359fdd7607b78ad757c38cdddb3d41bca7497d84c26edd7599f48ffd2f628b95491c9e5fe3a44750091f1354bd31ae98187f189ef0fc8bf021cc0bda8c27a4b8c5d94ab09b3aa340bcfb8f15986c17b6cdb1964ae7b7d57b6ac035e736ae16ffccd1180a53eadc68b9402d50cd8cb552e2a4bed774f9dbf81d44e7a568793fc04c0224cef7384b4e1ea130bac3eaf6fee5629f33f80e6dbb37d588b568a4af7702300b7d98802abf0c41b82f06a0dc11dd6e79576301d186c01cf44b2686a0082a70461982ebc558d39c7e31e7eb5489360ba237ea5316077e5880f342e2e01e7a3589c8c397c06472cca4abd9bfddca5b5c80adff1dbbe1f2d0f2241d78a565fc3a549456e1b5c008171abe0c225a5604df37f871c49ba2e2f18f60fb15019b7df19ca9d82ccc16ce673e0dacde1d0203cb52bd8d8228e1bafd9d92fd3faee70893b4774d641e89364ea364aa65d4e1026fb7b470b3681ce14acaf68125bccafb9387d399e5401de9262f9d9b1858e9570eef3db81c9cc76cde76808441b7e183811a70b2c5b421e99d258ef921e943423b2baa030f3fdcd3b99537311f21da0ca95bed4000ca59fb830a4e8bc827faec9567017e0284c8d279e2d3bd92a44504ce908fb717130b835d3577ac64f76ca52576ee200cae5489d3010261fcae925d662e5cef45c97725f9e59618dab27480f63b863dc6886103bd004c71c83f940e694afd6fb1e1001b839e3db65c4d09d265a8919e51d036ba7c41f4a378307298cb351c491dd6460677811fca3575eb013fdbe8b75fbab97f7104f352fab91bedec2f81ed68ecfb138bef1aad8e3b1c82ba8c9fa936aded3db8865df550051a70efe5bf6c0b8acfd06e189623d2d2640479185a32676aea1279134ef016ad91f5f55ec2e1ff7ca5e6703323b232d9c060ac101b7d3ec5e5edf567b1b6adeaaf2c9cebb6e4a64ffcd852cf2da358d5ef9b92f43395258c352a316a30fc92b7f4dc049fbafc5a6b4e18ffcab06062e586e9b3a60589931f30507b02ade0dc25337ec9e46e266b4acd05ca8dc4fd58fb83f4ec9a265b5cf0f15cbeaf4e4ab851c4b48c73d406687594a2bbdc06fd4dda0d0287c0ae0f3148b12d1fdec4c45654678a287f2b7d63aaa3c328ae29d00801767e4af31f6f5f2544ae877ad402ba43f0109af89f8077c43d86242cdea320c514687e8a2eaf994adfdc05b00c9342f43746d75ed3715ef6a604486682705fa619e9a8e8678407be7db15fdf13ab356e4065a112f0770e7e39414076c02d1d28a15d58b2ec550ad127a3741320635119e26425136d7f8bb80c24915a12278b8efd1ed4516c7a5cc33137935950535013c17323668e28e533655b49cf0559458c1ef3bb4247d78911d82c8f705f0218547918043458db4dc508cd860a0bcfca2f776e9a73e76d56482e769b01bee41f32f83d50c9ea2725b6ec7456fd3b1672b34e5a2b9de1d69b21580e959f9999a192eedb931787c5224cdc1e52977b29bbc3099cf106af282bc82486d43b10268e9a5edcac97e25528d64b3e842d83bec52ed4f65c11366618d8c7ea86709ea6e2c4d37db36be9e080a966636a436658d05cc69cef78fd254185a112563d1a0ab0c24ed51eb521755a4db4e5427f994921207f803189ca5031b7fdba5633c9cad629169d8cea90553205f4a3829eb0beae7d9cace0b4cca42d78e5c4baff5f622c95ffdcf493cd67f51c939f40298d2335c4284a9b7da8e583df45de7e98cf2c06d78214528e2437442f08585fb33281ebe8b515381fa197a123b2fe3537b0a9ba794c045a51689dbd53107145b8a507c9fede9b21846f1fb35ae12dee97f9cdde678f42e9e68a3c41d94a47d955f00c8f287ca281a8911ae4629d5710f078574eff31c3716f2d0a72f8cdff0499287912029f4b66c2e34f462a2309edd2684c0089e3616a20279eebad8b83c68d7ddc80efc76b3e517b2b2931c676322f17bcbd47d6ff1c1ae660dff558d9c0801d120c274089d83e2480aaaeec4c502682539d11410a88d11a42146f3e11d724e6fa9ffa918517ab8a399011e1fa638f3203a2d5c473fbb4262b9ac38d3e3b4d6faf18468fa8c55c17c52662dde37e53d4c2817629c95d9bf4b763bd1096453eb5dc54b834dac74ee33f187bd27c6b701683abce4cea38958f3d4fad584458475f4c28a7982065b6cbb550fe8ab3daa61c052b9b71f201bfad544318b62aece3e13f59ed6b4a8531be135e19f5c9b838581850f84080d6ea73deefed2013511cc04286b65ddc4758dc8342a17f58f0c38d37bc1a4fe01550fa18f632ae8a0718e8eaff4ed40eff4c06b2c033bc211360271f6f6fcb5a72b6269d680540190dbd58c38fb6d4d7f5bb430229047c3d04e0a69bbc6af3fd11ca934d66f5dd7069e3d547827207ad2bbf37232aec59c48265dbc9bf636854e1018c0ad2f6754c4dc9d812507972b3ecf8e977b14be5d36b45482071571bae5df6d17212eb58205317acf5e301066b5327ec266f516776ca1ef99c056b45b1b5679415350d2f551b1c2eb501386b2d9ef539acb635620333a7b98bd228748cb4232eb0d1e49ddaed57c941c943d61d6faaa5312398f724c3ac1ff816dbf1bdc8a978f2425662558ceaca33f1161d78908872150292eb655b01b67acbc2caa82daff699d66312c51195db47368aa561748460bd63e7508d11f0e6b7528e91cde57988589c0a7b9577136ca637ec025cf303d10afff55c6119861497b2b18a464712c5c60af6f380d63d69c8ae4ba66ac00509e97789ffcb42d22fe5d165d361cd435e12c0b6602051f0425cb976cea6a66c2ca54c997cb77b5586955a37688eced359b97d0a25b65378675447c1d0f3dc72778c110f27b846e56b3a17340b8f4c6d7a0085ad734e9bb1098986a6e06d6d4f912437170782e44d2fd19ac5bc66e1c510d47033739d40a356c1c261c149e8dbf84523afd80c2eb21a5ac7e31d33a9545208fe442f4c53898864a05bb6c90cabd8816e14d2ddc5937e66023df0461e2fc5c1b26ad733bcaa4def1253f3206ef95547886116fd6b2d9af6e2a87ca71121d8b3c61a024d71032030a4bdd916ff939ce67291d433cddf3bcdae886ce93776e2b0e82018bd7de9d8ab5e108dc1af13a618677a4fe454536515d2ee2bbbcbca1e001c1613f6d43bbd2f24b574c2bdd3f61e468cd78380790fb1cc84d1415cccf994ba8cb28a74c429064c3f0f5e4a01e572cdf9473aa70a1413bf4bbef2be6fcfde71ee7f819c1c2cedac1ed1274e738094ecef7205b4778ab8fcfefbd16ee94a742aac63554ccc5f804b0d79a96fcb4cc2206616dee298c3d828ee002f30ca4e1b207bd03b13cbb80d5bce5e605b958ac16a65baf95b5d158dcfe61d7c2090c11d9e8d69fdf9f4588fae7d6b9f4b57dc7bf7247e1aeb6626200796e0b7538dba373c163c0445247f544ab8c5ec51b6530c4ccd4ed5f9810b471ca67b91b06895df4ce4e7512e88033ce3cbf10d61a99bf543d38563bf3464a46e18c8bb6195bd7c8b8a3f618a2faa9ba0885fa0402c7781e77ca325f7bae30fbdb6735a4c462c8218c2125ea6fd1f47added1d4553dd7f99a06eddc10896bebb7d68556711fc7e069b17a1d6800c2b25f65a68ef7b849476871b9c263cc01fe538f80ae6a9c96514b5d0fc405f6d4343fcb95923d9b9e871da753eeaac351b9b7a39c487cb984b9dc462c7a5749ed1b9a09d1dc91a8465f1a482417107f05cf41675d9addc5a6007eeda456aa64d6ac24b0437abbc1b4f834a6005e4b19c5e3455ae44d546c2c4cbf7ab1cebe4237f881d8e0d9834bd2dde704226ac65f8f374767ec7f40b3cf51506c09925f71f5ab92c36f784d98fa03f41fb2bcf49cee156ae4121f2d276b4e502b17421e0d2376f8614927a4c6ed45ed92779a9f15269d441d2f70c218e04dabf9ca243927fb87cd86dd72fdd92c9f23fcf5e02de2cacdd01ab8094b47eec019a2b46bb5e924b9fc4598347a27282f6ab9a5ce60dd26a5908b21624915b8655d7c788dfe10fb26b3c8424e7260aaecee22e0803d15b8a0c9010cf26f37204913c031d8b2d3d9adf8c701d64a523c52a31370c3846b6d9c5758fc804c6186c84d99d9c0333d6cb1ee128e9c1e5e5a92efe0e358de351dc3ab1081b2540645efa4a7fb5d1aaa9a10e0cef44418913e4cb2d6499457821a50d691f811a3d156f359b73f36367e6cdaf595c84814cb8539b70b5564ef74ffb591a04f90091eb698815e1daca14d2c8c82d6735d66f9a36272ce4602a8443d3b1de918acb56efe196c19a6bccf0e7971461a09813715252d0aeacfb3b5346f083e49289deb83b869840b4e1478311fae89d11829b2d73d3293af1673901a8d92d2c4f109ca27a3a3b99a2b2ffe1b78c72de02b619eb0a7afe200a26048e120a8ed27229e84aef2c3bef071978d5c6d567f9ad552204720ba5ff1ac42521ebf81747e1d82e6123296041d20d8c4572dbcf1fdd7e44895a8ef39f76c3d8c353bb0316ec0f938a4bfa5efffb4f95fa2795d9f30b2cf5df29d53970886a6206c6441c47d1760fdad5b0a92df40a0ee349db45aa86e89c9fa30714b7dde4fb53c4dae424320961dbadc04175b620fc9c6212465e51afb61ce16fb3e91ac58b6773071e76713d7c9934662dd349d0444e03ccf040ec2abe8883ce52d8e746d1c5e45b0d932894a44f6667599148d2f35aaeff1db9db17636e587ac8936c832b166468a929be045512e259d6daae12480c39186042bfca5c0b77d81462134ca4524a8bce45d60ed7a7efe4399ac24db884478ee3fbaaa1077a14e16b0a4e0af7a481a3d7137a4209a1f073a6d146d523b86d8bbd70cb287aa1e419d5fb9eb91a5eafcce481360110a00fb066ba2855a5e876bff8883ad3359e3919dc8c07fe20f0843325e9c3321f67e3ba123c8d13979fa0a5d18d65351b329fffe2e0392d51c4bd0e50d5728bafb40b28e1b154e018d21fe2bc0c0ef4ef47"}}]}, 0x1100}}, 0x0) prctl$PR_MCE_KILL(0x35, 0x0, 0x8) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') read$FUSE(r5, &(0x7f0000002580)={0x2020}, 0x2020) socket$nl_xfrm(0x10, 0x3, 0x6) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r6 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x10000000, 0x0, 0x32315559, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r7 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r7, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001980)={0x1, 0x3, &(0x7f00000013c0)=@framed, &(0x7f0000001400)='syzkaller\x00'}, 0x80) bpf$OBJ_PIN_PROG(0x11, &(0x7f0000000240)=@o_path={0x0, r8}, 0x18) r9 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) pread64(r9, &(0x7f00000003c0)=""/159, 0x9f, 0x0) 9.745533272s ago: executing program 4 (id=275): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000280)={0x84, @local, 0x4e24, 0x3, 'wrr\x00', 0x0, 0x1, 0x72}, 0x2c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x1000000c, 0x8001, 0x80000000, 0x4, 0x1, 0x8001, 0xfa11, 0x9}, 0x0) unshare(0x26020480) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_STARTDAEMON(r3, 0x0, 0x48b, 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) bpf$MAP_CREATE(0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000440)) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, 0x0, 0x80) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000600)={0x58, 0x3, 0x6, 0x401, 0x0, 0x0, {0xa, 0x0, 0x6}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x20048041) socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa002}, 0x4) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000000)={'lo\x00', {0x2, 0x4e23, @empty}}) io_uring_enter(0xffffffffffffffff, 0x2bed, 0xfe84, 0x9, &(0x7f00000000c0)={[0x1]}, 0x8) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r6, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000200)=ANY=[@ANYBLOB="4400000042e13543995b4e4c88f5d5c75c6a9af2d048460c27ca276285c0e0d7176d02b0044768fbd48204a5c401d40b9195f1eaccb9838c71d546", @ANYRES16=r7, @ANYBLOB="01002abd7000fbdbdf25410000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000d"], 0x44}, 0x1, 0x0, 0x0, 0x800c000}, 0x20000000) sendmsg$DEVLINK_CMD_RATE_DEL(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="90300000bcc10d278edaa6a9a06d53ed01000000244bf5bf19c499f0244c6407040e1900eed226070df0ebc94f6b00989ba9ad067b3b9b57dd33d0ef357e34fa104a7f3529517055b368f25521f013c41ee26be52d7ddad66019c6", @ANYRES16=r7, @ANYBLOB="000129bd7000fedbdf254d0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080001007063690011000200303030303a30303a31302e3000000000"], 0x90}, 0x1, 0x0, 0x0, 0x4000040}, 0x40) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) mbind(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000080)=0x3ba, 0x5, 0x2) r8 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r8, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 8.299652722s ago: executing program 3 (id=277): r0 = socket$qrtr(0x2a, 0x2, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x891b, &(0x7f00000002c0)={'lo\x00', {0x2, 0x4e22, @private=0xac14140a}}) connect$qrtr(r0, &(0x7f0000000200)={0x2a, 0x2, 0xfffffffa}, 0xc) r2 = syz_io_uring_setup(0x498, &(0x7f0000000540)={0x0, 0x465e, 0x400, 0x0, 0x8}, &(0x7f00000004c0)=0x0, &(0x7f0000000480)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000040)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r0, 0x0, 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r6, &(0x7f0000001d80)='.\x00', 0x0, &(0x7f0000000080)={0xb, 0x0, 0x40000}, 0x20) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)={0x18, 0x4e, 0x1, 0x0, 0x0, {0x0, 0x3}, [@generic="04da9d0e"]}, 0x18}}, 0x0) io_uring_enter(r2, 0x3498, 0x969, 0x0, 0x0, 0x0) 7.750981568s ago: executing program 3 (id=278): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x400022c, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = syz_io_uring_setup(0xcaf, &(0x7f0000000100)={0x0, 0x176d, 0x1, 0x5, 0x17a}, &(0x7f0000000240)=0x0, &(0x7f0000000000)=0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffcfffffa, 0x4031, 0xffffffffffffffff, 0x41d1000) ioctl$UI_GET_SYSNAME(0xffffffffffffffff, 0x8040552c, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x4007, @fd=r2, 0xc000000, &(0x7f0000000040), 0x92, 0x1e}) io_uring_enter(r3, 0x847ba, 0x20000000, 0x7, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0x609, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100a0, 0x48011}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_CSUM={0x5, 0x8, 0x1}, @IFLA_GENEVE_UDP_ZERO_CSUM6_TX={0x5, 0x9, 0x1}]}}}]}, 0x44}}, 0x0) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x25dfdbfe, {{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x7ffffffffffffffd, 0x407ffffffffffe, 0x800000000000002}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@empty, 0x0, 0x2b}, 0x2, @in6=@private2, 0x6, 0x4, 0x3, 0x0, 0x0, 0x0, 0xd}]}]}, 0xfc}}, 0x0) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) socket$kcm(0xa, 0x3, 0x3a) r9 = syz_usb_connect$printer(0x3, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000102105a8b140000102030109021b000101000000090400ff020701010009050102"], 0x0) mlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) preadv2(0xffffffffffffffff, &(0x7f0000000480), 0x0, 0x0, 0x2, 0x14) syz_usb_control_io$printer(r9, 0x0, &(0x7f00000000c0)={0xffffff04, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1, 0x4}}) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000000) r11 = syz_open_dev$sndctrl(&(0x7f00000001c0), 0x5, 0x280000) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r11, 0x40405515, &(0x7f00000002c0)={0x1, 0x4, 0xe7e, 0xe62c, 'syz1\x00'}) write$char_usb(r10, 0x0, 0x1a) ioctl$int_in(r7, 0x5452, &(0x7f0000000300)=0xfff) 7.203480796s ago: executing program 1 (id=280): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000440)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd00000010000100030808004149014006040800", 0x58}], 0x1) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) landlock_create_ruleset(&(0x7f0000000940)={0x1, 0x0, 0x1}, 0x18, 0x2) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket$can_bcm(0x1d, 0x2, 0x2) r11 = memfd_create(&(0x7f0000000980)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\x02A\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd\x1fel\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x86\x8d\x1e_g\xb6J\x87E\v,\x8a\x81\x92\x13oz2c\x97 \x03?S\x86\x82`\xf5m\x89\x89g\x80\ad\xaa0\x9d\xc1\xb3\xf9\xe0\xebw\x88\x1d\xe8.H\x95\bp\xe3\xa9d\x87u\x9f\v\x8cK\x14\x83\x18ST\x91\xf5\xd9\xe7\xa0\xa0B\xd9\xc1g\x04\xdf\x9f\xd8\b\x82u\xc7\xcd:\xb9\x8bk,(VB\xbb\xcaE\xb9\x11\xb4(\xe5/\xf2\xa5\x17\xc6\xc8C\xa1\xf7\x11@}\xb8i\xe4\xe4\xeeWdU7\b\xa0Q\xb2\xf4\x97f\xf8\xa0\x9d\xba\x91\x8d\xdc\x9e\xa4\x8aS3\xb4\xf20x0}) getsockname$packet(r5, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000600)=0x14) (async) getsockname$packet(r5, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000600)=0x14) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@mpls_getnetconf={0x0, 0x52, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@NETCONFA_IFINDEX={0x0, 0x1, r8}, @NETCONFA_IFINDEX={0x0, 0x1, r9}, @IGNORE_ROUTES_WITH_LINKDOWN={0x0, 0x6, 0xd473}]}, 0x88}, 0x1, 0x0, 0x0, 0x80}, 0x4) bind$inet(r6, &(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) (async) bind$inet(r6, &(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x840) r10 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000300), 0x80042) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc0105303, &(0x7f0000001380)={0x0, 0x0, 0x0, 'queue1\x00'}) connect$inet(r6, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) (async) connect$inet(r6, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r6, &(0x7f0000007fc0), 0x800001d, 0x0) 6.643308133s ago: executing program 0 (id=282): sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="90000000051405012cbd7000fbdbdf0100000000000800030000000015fd00012ce379552fc285"], 0x90}, 0x1, 0x0, 0x0, 0x20040081}, 0x40010) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8, 0x1) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cb, 0xf170, 0xa1d, 0x8, 0x5, 0x0, 0x3, 0x2, 0x0, 0xfffffffffffffffc], 0x10000, 0x202}) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000040)='batadv_slave_0\x00', 0x10) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$OCFS2_IOC_UNRESVSP64(r0, 0x4030582b, &(0x7f0000000240)={0x2, 0x0, 0x579, 0x9, 0x7fffffff, 0xfffffffb}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0x0, 0x60000, 0x0, 0x7, 0x8, 0x5, 0x0, 0x3, 0x0, 0x8, 0x6, 0x45}, {0xffff1000, 0x10000, 0xb, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7, 0xff}, {0xeeee0000, 0x8080000, 0xb, 0x4, 0x7, 0xc4, 0xfb, 0x0, 0xb6, 0x3, 0x0, 0xfd}, {0x0, 0xdddd0000, 0x3, 0x9, 0x1, 0x0, 0x9, 0x0, 0xca, 0x0, 0x4, 0x2}, {0x5000, 0x6000, 0x8, 0x3, 0x8, 0x4, 0x0, 0x0, 0x0, 0x3c}, {0x1000, 0xeeee0000, 0xe, 0x2, 0x70, 0x1, 0x2, 0x0, 0x0, 0x3, 0x1}, {0x0, 0xeeee0000, 0xa, 0x4, 0x1, 0x0, 0xa1, 0x20, 0x0, 0xff, 0x8}, {0x2, 0x6000, 0xc, 0x0, 0x0, 0x7, 0x8, 0x40, 0x26, 0x0, 0x5, 0x2}, {0x80a0000, 0x8cc}, {0xdddd1000}, 0xddf8ffdb, 0x0, 0x0, 0x118, 0xc, 0xf800, 0x0, [0x8000000000000001, 0x57, 0xffffffffffffffff, 0x1]}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = memfd_create(&(0x7f0000000040)='dev [\x1dx#l', 0x8) fsetxattr$security_capability(r4, &(0x7f0000000000), &(0x7f0000000080)=@v2, 0x14, 0x0) ioctl$FS_IOC_RESVSP(r4, 0x40305828, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0xc5c}) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x38, r7, 0x1, 0x70bd29, 0x0, {{0x2}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x41, 0x60}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x39a}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}]]}, 0x38}}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r10, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x10001}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r11 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000040)={'syzkaller0\x00'}) 5.958464323s ago: executing program 1 (id=283): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) unshare(0x8040480) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) fchdir(r3) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x10c) bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r4}, 0x8) syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c26, 0x10100, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000580)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, {}, 0x1}) r7 = fanotify_init(0x200, 0x0) readv(r7, &(0x7f0000000340)=[{&(0x7f0000000380)=""/176, 0xfffffe2e}], 0x1) 5.558536965s ago: executing program 0 (id=284): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000200), 0x101000, 0x0) ioctl$SNAPSHOT_FREE_SWAP_PAGES(r2, 0x3309) sched_setattr(0x0, &(0x7f0000000400)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x6, 0xa, 0x4) mprotect(&(0x7f0000ff6000/0x8000)=nil, 0x8000, 0xb3d8aa3f318c3958) syz_open_dev$vim2m(&(0x7f0000000180), 0x0, 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f00000025c0)=ANY=[@ANYBLOB="b7000000010003c3bfa30000000000000703000020feffff720af0fff8ffffff71a4f0ff0000000065040200000000ff2d4005000c0000003400070001ed00007baf0000000000001d440000000000007a0a00fe00ffffffdb030000e1000000b5000000000000009500000000000000023bc065b78111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e51815548000000000000000275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7f300c095199fe3ff3128e599b0eaebbdbd732c9cc00eec36574a8f6456e2ccae25ea21714eca8cf5d803e04d83b46e21557c0afc646cb7790b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2400000000000000800643a98d9ec21ead2ed51b104d4d91af25b845b9f75dd08d123deda8ebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987af1714e72ba7616536fd9aa58f2477184b6a89adaf17b0baf587aef370a2d426a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d64364c82770c8204a0deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee7d26b34381fcb59b854e9d5a17f4720082f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67051d355d84ce97bb0c6b4a595e487efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599ddd71063be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d96c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d38df9ba60248d9a0d61282dfb15eb6841bb64a1b3045024a982f3c48153baae2c4e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c3560811ea6c3560a43364d402ccdd9069bd50b994fd6a34ee18022a579dfc0229cc0dc9881610270928eaeb883418f562ae00003ea96d10f172c0374d6eed826407000000000000004a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea52acb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d851680f6f2f9a6a8906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f4ca2195234648e0a1ca50db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145eb6dc5f6a9037d2283c42efc54fa84323a3304f41ff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f928ba7554ba583fef3ec7932f5954f31a878e2fae6691df8b4b7ecd27ce82f7df3e7d1daac43738612e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e96735600000554f327a353511ccedde99493c31ac05a7b57f03ca91a01ba2c60ca99e8ebc15ecb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d40460780000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120968308c31db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd0000000069ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a003fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9e0600f86909bc90addb7b9aee813df534aac4b32fd691b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a000000000000000000000000000006acc19808d7cf29bc974b0ea92499a419aa095e203c1bafbb9b9a7c2bca3f0a18ee4952f2d325a56390578f12205db653a536f0100e0eda300a4dc6b3fb84f3738a4b6caa84feda91f3edb32231ec75300000000000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b88b5e7885e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035ab63de71a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db1829f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2744c46570e8f46da1ab990ca053cbfe801000000000000000000000000000000d55d7182af2ea5f8d0ad495e3eb9421963a5a683c3dcb2d300aa3b2cfe946d2348c35f5d67d68ac07c8f84b3679e77c2e629ecec7c12c35d6b6971b8ae13cc00956d2227db60c0a461ed2b3ecfb16d19037c8c88c91dda1f904fbbc864e95ad43d6dd6d5eadbcea25682ba4b91e14c3fbfdfd1d680aa1af102d97681656bf56ff0674237ce097d39008cc3257778de878bcd37467386f993be6d20c93a7791e7f2a155ce379b4cda2500108052aeb9bd03ff6d4c5dbda9ff485d6576a492d436d52edcd420e7deaa4343a0add3941ae7c5f58af43866ca64750f43e583ca1ceb3a805e46beef9dca77a4edcbb42aa0caf0bbd6cec72d85540293cb4849b0610800000000000000000000000000000000f9814d5f6c8673c143ff2f901e71b8818665b56f7a03afe3d900007656859db4cb06aaaf9f02cfab5b9e61cc00e8e19429921b8df4c4c53bddea4cc48737371cdf8f681dd7a2685df194ca89da8cf6d29a2be9779181fd5d105af5786094d9130f5826b18b9667b971a994f3fd069629a1052f441e96884f90c91f4a974242aabfc8adbadc9ca27955b5c90f0bd9a46ed044272383d3768871a9c8cfd7948aea445c55684351002ed4a4af45341de8e5e1f33624bd2ec1591dd00bbe05000000f89a928662e9b9449db34394fc5e946fadaee576e28ac0feab4e3585ed43d206218f524083840a78b7236bb7f5e42b5376642f8ad4028d4ead407240e7467d1b37afe20690d7672c7e926fded95cf805516ad836eb730619a05af36fb28329d6feb33219cc9164461a8ba3afd5949b9a6046c53663df30a049414089c1ae8f3476236b05dde8dda4843a62c591f8d2b1a62d0db8dc826219bd87398b33e140792297d023ef52de2e75b9dbbfb8712ccc15c69cfb4c6c1bc2ae74621e536b9d3f09a15dada1561a8192d65cc59d7ed5a6bd61000000000000000000000000000000000000000000000000000000000000000000000000f637782e317d492b2392fd0ea81397a80227f271bad21d688af35a2bd02c15d20f3d62a50e20260642c25f304c8034a5f4d8e45e701dbd84294d1096e715662b8223e10e98c4c38451fc5c702084e3fa9b184e0d0fba44acf3bb8a846cf680dfbf312cddfdb2043288fa6b67fa762c8b75d4478756ef240f2b314e4d77a3afb4fcec92248327004d1dac7ac87a6f8cb04d82acc307d60e4713bd9a8f29091d3048c669a5f5439e0a906ce098d177b9579882586511cfe6a23e57c44d1654899f077b5636e4181f3de6b814bedcac5290ad8018bbe4424edc6d9b0e61b404bb7a2d4883bbc200de8332029cbc04a0bc52d9870cdfb950b139625fa88f5c9088fc9032a5ea07415029c74354f54e37427a4b26e559cd240b7950630d7d4da9cb8d256356bee8c827db43313e75da9c36d0f7bef4fcf23469d8c9104a917959c3bc791a54d1882f532d2597ff50d4a10fe3b80a3d67d3c3dca0dfe0e4eb039df7480542f841313ad2ec26fe7d03829f80c6f3e028d2f4495c3c523929b203048ac9ba20b012c005e36b93eb5a02768503c6c41f50d2a04999bba560f86c7c9a78e4b337983cbdb5d71be3090208a1f7eaa3edc840ea0da5f4cc01f3e87c7566176981a738bcd4dd8b8a137e7a15e57054ebf1d9ba227361be11a7d155054e154364041468e6268ea23e74eacbb5200e2d8f8919402ca20794a29dd986c6593d47b47d5cd70153908a77039a995a44e960ad037f4d2569751eea3ae70fc49f32c30d6be0594bfda189f0be84d1eaf70e0e90223a3c97ade9973e9219c5a2e1c68efe6adf744710eb0ad8e555be26855496bc6b5e13078380230728b1862f0d93397b88ebf5197b61d27b6c555502aed27d2f2b127aeeae41dd4324fad2e7a962"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) r3 = socket(0x1d, 0x2, 0x6) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0) syz_open_procfs(0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_int(r3, 0x1, 0x28, &(0x7f00000000c0)=0x4, 0x4) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000080)={0x0, 0xb0}, 0x1, 0x7}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@ipv6_newrule={0x2c, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfd, {0xa, 0x0, 0x0, 0xcd, 0xff, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8}, @FIB_RULE_POLICY=@FRA_SUPPRESS_PREFIXLEN={0x8, 0xe, 0xb52a}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040090}, 0x40000) readv(0xffffffffffffffff, &(0x7f0000000780)=[{&(0x7f00000002c0)=""/255, 0xff}, {0x0}], 0x2) prlimit64(0x0, 0x2, &(0x7f0000000040)={0x0, 0xffffffffffffffff}, 0x0) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000fff000/0x1000)=nil) r5 = signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0xbb46]}, 0x8) r6 = getpid() fcntl$lock(r5, 0x26, &(0x7f0000000080)={0x1, 0x3, 0x8, 0x1, r6}) 5.240856236s ago: executing program 2 (id=286): r0 = socket$packet(0x11, 0x3, 0x300) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x402580, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'ip6erspan0\x00', 0x4000}) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x440c0, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000180)="d3e652feaf669435e5f28f7fa2365f034172541b3759a1434f04978c3b7f61bf166ff769002980851e8dad3f04f51475ef2c1f5a74fb60b2535ba3e9f0654af71ffaddf90eab212b6cb6349cdc4cc9d13a531ba2b863e735d9bf011e80229deb6611297e033cbe40ac0f9fdea4af3b45d1977ce6158ec2cc7787383632ae1ca8a49700e94e2846e78775da26d9ad5c80e4c51f54fdcd71b745b4222e6f07ac022b24c71ac22712dbc59e4e69894da5c17d6ab16a7de5433a4fba655ca6e8159724c6db2eef0475aaae99cc03bb1a061cab91303a74ec87b8e77a985a79f6d60e2b", 0xe1, 0x90, &(0x7f0000000280)={0x2, 0x4e20, @loopback}, 0x10) (async) close(r2) (async) socket$netlink(0x10, 0x3, 0x0) (async) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x200, 0xffffffff, 0x25dfdbf8, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0x7}, {0x7, 0x2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x10003, 0x3, 0x6361, 0x5, 0x10000, 0x3ff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088d5}, 0x44001) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000080), 0x3) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) (async) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r8 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r8, &(0x7f0000000200)={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0xc) (async) io_submit(0x0, 0x0, 0x0) r9 = syz_io_uring_setup(0x498, &(0x7f0000000540)={0x0, 0x465e, 0x400, 0x0, 0x8}, &(0x7f00000004c0)=0x0, &(0x7f0000000480)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0xc0, &(0x7f00000003c0), 0x0, 0x4) (async) syz_io_uring_submit(r10, r11, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r8, 0x0, 0x0}) (async) io_uring_enter(r9, 0x3498, 0x969, 0x14, 0x0, 0x0) (async) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x34, 0x24, 0x100, 0x70b923, 0x7fffe, {0x0, 0x0, 0x0, r4, {0x9, 0xffe0}, {0xb, 0xb}, {0x2, 0xb}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}}, 0x8000) (async) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) (async) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_service_bytes\x00', 0x26e1, 0x0) unshare(0x22020600) close(r12) 4.643940626s ago: executing program 1 (id=287): r0 = socket$nl_rdma(0x10, 0x3, 0x14) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x88f, &(0x7f0000000340)={0x0, 0xaee2, 0x0, 0x0, 0xbfdffffc}, &(0x7f0000000300)=0x0, &(0x7f0000000180)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r6 = socket$xdp(0x2c, 0x3, 0x0) syz_emit_ethernet(0x22, &(0x7f00000002c0)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3f}, @void, {@ipv4={0x806, @generic={{0x5, 0x4, 0x0, 0x38, 0x14, 0xff89, 0x0, 0x5, 0x89, 0x0, @empty, @broadcast}}}}}, 0x0) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x40012020, 0x1, {0x2}}) io_uring_enter(r3, 0x47f6, 0xfa, 0x4, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="0000000000000000000800010000000000090000000000000008004b0013000000"], 0x28}}, 0x0) 4.619795841s ago: executing program 2 (id=288): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x13) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4622, 0x5, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1ff}}, 0x24) listen(0xffffffffffffffff, 0x800) 3.770384012s ago: executing program 2 (id=289): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x22, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x2}) mprotect(&(0x7f00000e3000/0x1000)=nil, 0x1000, 0x2000005) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000024010000090a01040000000000000000cb5f0000ed000d403a28d2892084d8e5fb851ea2bee01a28e4758a2494c71096394dbd3682c15b10c43e1f20e28ceb0e39a05914a8c18d22e0839cc7b86d92588a2d720848dc93278ee8b7941c883f28212abce4ad1c271cc4e6d7a75777f2e5638ee752f7691ea21934ecc2047f9c6d498363d0dc4d05af803b5c22ea885b1c14c227d030eb7694b788efb169f890b0337d1bc31f07ae8de842d781a9df08911919289f4f3c3d0c0bb0ad1e27def053b255af80e4a335ccafcdee02deb5f46c260cd2bec11df22becb55679020eb27e15e9d229ed36998b6ff4d00e19ab357801ba0000000900020073797a31000000000900010073797a30000000000800054000000004300000000c0a01020000000000000000070000000900020073797a30000000000900010073797a300000000004000380140000001000010000000000000000000084000a00"/412], 0x19c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x11c0, 0x80000) openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file4\x00', &(0x7f0000000380)={0x8a001, 0x0, 0x12}, 0x18) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_merged\x00', 0x275a, 0x0) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0xfffffffb, @local, 0x883}, 0x1c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r2, 0x0) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000180)={r2}, 0x8) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$BTRFS_IOC_SNAP_DESTROY(r3, 0x5000940f, &(0x7f0000000680)={{r4}, "b5de426be81032d644fdde88cbe16cf68ad5f7ac031fdf41b4ddd47a0377555bde026561fe0bd01a2f86cc7fede50aabfe3400188e849d55501473a37f8211e31a91d9f847135b0e63fbaeae1bd91cf78f0cf88c8c271802025d89e03bcc703d9dd12a5b9aaa12e4dcccb9abfea80b965abb41d2f4e09532592aa71747cfe7424806e01d9ef3b7d40e67706532e72f8ec8e099197a790822f540cdd5f2f4548d3db1ecedd77e14fcf22bf16bced95b2f25d1da754230f3493f79f829effc71bd7b0bccfb48c94aaaaa5023458c3be6879d782750de0f4f7948e78f5492d340edb9c733a0ba9986a4b2fa3b34855fbe04496cb76870d8a08ba463694126bd2065d1fb537e6d07a07f4a50587e0e0bd350be0ee0c1b8b3c5c1c142b83ac2f4b4f6170eaddda8883e820094f7fc5f780179f0a512fb9b4bc8069df0e2dd442b052b8e8a1f0f522edeb2fe11a19584031fd89b8724a5b624211a773324a1a3bb3005af546583bafe2f60df958518c9f2618dc5ddfa4c85578fc00103e97d91d64f630e4ca1a560db338d9c78cdc14b3392ecc2e57329a102c493221317f0a18e0a191623fdaddca24a390d6bd5855ee2a5bd86ce611f6bf3413304a1b8daada65b040e2d63f48e6bd043867d8503da9c1a999c6b5e7f51f74a2f4ddf1cd3137a3ec53d92e54e5db0cd11973b127b0ae84c42fb6c4649898cc373db4c85aa29566dd8af7ee4b82262a08558dcfa84440d4cc4a12726b31ac1da44cef443f8610f3fb20cbe357017e36528c25ac394df641092455acfe6d76e5b131d3a25388bb107ce5e1f9f71755f3a92ea0e78f821f76213610e5d8a0053e24f6b1228c9db5cced5b7def20cb5e9fa651855bbef8310b1badba70168a39940e43eb31088901e4e3f8f2b3ff8575572be47ce83d6629c824d970e65302afe3083a10f1b4c445d17ac7e9bddbb3dfc10278ed0c232cabe8699260faf8ad4f4a54c97974c1151ce1f438fb029fcca7ed81e00be4cb782b83cb5c0500057d4249d2a6d2e94cdd2c2df63a07c88fd7308cc5897be454fbb420806a6d6ab60c866d3c252641004705e758af4e8591dc89e89b59fcdb75484848592aa8af427e916abdfff5005e981b5cbc7cf6e236e7d656c8495f239cf334897dd2b330f147f665cae0f51ae55681f51ca5a78fa8a7f5e130d0d596eaa9849b6513b16880f4a16ebdef653509eb5415c340fb48ccb92a0d32c9fc49037d4aead8de3989fabc07baabca8d18f7ee43706c9c98984a9f0e11b407936b06f0191983ee4a126db431f5c0fae29abc70268c710d8b71eb75f08b12f9443a5a0506336b233a34094df5e17875ab37265edfac336ee8b936989035484e21daf1504b25ce52189fcaf54593fd922e93bde8ed21c4a0262f6603307b23aa23aefe00164aea14814a62a00379cee6caeafe6dec55c1f29a3838802129fe12e27e96fe7161cfb595608c51009d28e5757a765fadf8994c00d7e8292b959325d8554df869b4f68332eed7466c795ba63b1c54d4a710ed46f11826cc54c78f4e922cdb93db4624d36a0c2831743d1ee5a93039800052266d01fcfab71ea9b43baf0d894ac0206fd5c3668a78d6ce5a120e3bcf2471361b94c1908b68e25a46c166b656ee2f5ca4b23986f5c184bf5397a9e6e3b210860f75e83139c3a7eb2461d2722cdbf657b291f36411e0b41571c41bd0c81fc1f39ed9026aff67ddac42fdd16a2f6759eb59eddeff33603c9e79237f2a5403452f1eb1060815305c61786a7a5c09e7a1020b3596792205f648b544abe87333d18102d3d26d0e426105e2abf2ee079a4645e832fd92e587ca75e37797a393b3d0659abab8253d243e928d24ca30f2a1d37954ae5c06552a730e3c660f25227a165fef0e5bb2c607d32202c78a801808f5377b4ab1b714ad2980eca58f9273d17b33f563590be8a22a0f870bb11e7881d8697ccf0c447b8c11dca9b94c0da594a78c9d66c7fa4e50cf9f07a945ab2f03bdef08ded5b2d871debd4b4bec5c0cd8e34c024c41d23efba2b590292e9480685d7599b0de6925db2255da89a6ec5d70f1b998bddac02d4bfdf6ef7e1d2f5e130aaac1c8630d1707128976c016d94872e7c687e276299e4171f0960c8e862a7d2cc90d68d373bc57261d6c6b0536dc2064221f96a771ff22910932097ef5ed79773cb44d07ebab0423e98b9dd3294cd74689a4c0ec243b75cd12c415429903dee9aec7a35a832a72c82c24abc88829dfc398297acdc21985a5a6a86014fd2538b500647048be62c9819218dda278fdf46ec73a1582fa3745c727a3cf242680e5334af98ad3d56cf94f42f50c86376e267a61a58da6e47da721b4f2720e8a060f59ae0fd0559f40bada1b4542c5aa7fd6149b3609e6fc8f2d396dfbdd68b7efe82f081f6c586a13a328c1ab3959682480ca73d2abbdc9104474e691899720372da1519f5c146538f40a5808fda9dc53cf59263f8368ee760961595add866db767cf8c78b1796beb1300c5984ff372483af32c4ee59a0d4764424a8f3edd2212c27826b412fac962b34802dd4dda4705bf6d0615b6a8074378a076e76cf80280a6c2a06783c02f8468044636434fa69c48fdf85fcdbb7fb376e44096af07d27fcae1ceddbff3ffd80fce5aeb4448883106c9c7d446dd56f0c3df744e0bbbaa13443a56fa27a86871f1cbba9f3b72c7ea614ade05a1b001099b8bcc67cf4d78d9419fcf100183fc1ee0a56e1af19730f41c6f48ac5b831ba713ececd2cfd2dda3750d9fe5e7b10b99b8be26038b7fdc996b2c147b7878310c3da2bfdd6c47d1e9fcfa4732dee0395532112e9fdd874cc4deaa4eb8575662c5f89311f15e98d8d001be51f51546416054c6ac9537399346aaa3c1d8ba93a8579dd890feb6e473ea95b09ced1d5ecfe869ba1cc4262b3a93048c10e49ed3280560aa2780ea7d286a005a3ede78c3cf0e55f21746fe363085686d4a92edbd5e610668aa52c4c96a13b9120b61334167d6d98440bb9be5d3f2e3ecf1557531f3126918f0546a4a25f1a8437e04ec22785b24bd6b021125087169cdef27d64bd3ee3f048fcfd1c47696c40012815024da83d1c7a068304767489ce9c949ddc3ad81b4975dce2ffecc79b92cc3b8f519f5e538b5f5ba8548c0c2123c47b578d1e84150d051f537b200b1dca615af5f5dd52a4b80a7bc6393b608646e9fc4e9c35dd076e703a0ae678d4c1e8cba1f0df6972da003d864b6f918bef4ace46bec01c56ea9b2c279fdff297b65b2c33e2124b75b806f73ca581f0904b50983489ae67f046d505ba66b56526834661b6cf8f40c1c1fb8b3153ac6c0f7b32699b2476739c86fbf4cf4cd6bfda844f4e60c0c49a87161cbf0fa464701a516d550f10b4088cc1924038f88bdf8a67b0aa104504ea4a65a7bf64e3ea15fe56ebe5934ace365e10bab94c7fa23b5af441a2572e805d04bf2854ac31f7850cf94cc6fe03cdfe84178126e5f7002b7322a6bc7793dcd9bad500f72a216b82fc33381011a864c1ab9c4acf401762f6c050c69266f5de153ea0d1b7f9d67ff9c620caabbc75f505770a617f866f9dc7d07a8237ea158d5d24e75e501f537df5ba9bb573915a229adbb0a8ce6983794ac8dbc9492dc1cf7ab7e2cdfc64de9da8884a78a2e3bb66230f50e304ce0123a0905fefc4c6228c43ba1158bf0292da81b3112831e72b36bb9f4af21ba01be03a6d2a6152baef888d79e9f0c44843e50a2984c16cda09fb4a1365a02cab7eeca31a755b3c27e4fcb28f28635f839bac3510d229bff3fd77844054071fce0bb670b603f9d9cd1f86be1cbe322e292fe3aa92e1c8ead03204676d6b49cd81f9c799c19d1a02da321a4a6c1d5b8cdfa354405ab2f2bb13cbb20e004c65063dcec4ca9c816a185ed3d0ea73f772faf15367ea0d5c2fb810cbb31cf92fe9cdb5151ee9650721f3c0bfc29e42948567028ae512509e1617d4c64f66796d5d3a331f4044904d67f002e2f980ed66100476be0f866beca044a0bbe0538fc5e8ec4fdffea8c553acd297d999b8c7c75a5eca083d8326d649eb1263586a4b298292cae80baf429bdcc922c795a895a08778660fac6b29b7f9a7117a0cdf771415176427357dc184b1f44fec5570021a5cdcd12d6f7cee6b0e8fc5d54bedf9652d1dc53800d3b95634e08e823e38453cdf39737a78c5ece96d95fd4493234517b3027affeebe2fe12f28ab95cc8b7d8a2a5971e669e1ea2ef329128f3ba70bfe5d94856a83dfa80b5c030018b5fd73a70bcae928e4c2218867fe632c0a2efa2db0be7a938ec2de4eff86e69028b8dc218395fead9b2ae2b1ce1ff78dbd47b5c4ba6a5e02b65935f65a8eabb1a00a3c7964875b9ea13d78c85d799967a3a51d3735511cd9b5d0d6317f063a7fd11ef4607ce1c3cfd9c5c990fe68478ddf10c32946e0ce67cf0dfda90d3300a0c07c52a979a2e647dec64af80e6d23456170593e6ef1fce05a7547f3012768e0f5c3c144117af602d0bec73a2794afb50f64c1e61e2bdef4cdffdcdd2fd4b1521905fe512430b0a0b9b3e4e1881b0bc53edd833857805453b4e5f04d3b278585d10c0c35dcfb455f0a1742f04e0932a7e0e0f01db6d5d75d898357456b1a0d0f41cacf6f5de12f329f94b1d1ca4f01789cf5517bc7dad59f999ac61a61341deaeb26ed2c5cd9ed5e3e20a3a739cfb8ebf7962326ee058ec6465cc8fcb4a95211d829641150990eb342100b28b26e595dbfa056a180a25620693ebee2e1bb4c6951179c8f3227a484c4c22c05ea8fd1ee9cca4ddd2e31f7e2b83eccea84bf280a2c21a54990496bb47a20ac14c0e2fa500739eaafe4acc1278c6e13b2e811501cc64ed76a43e5b00b66c562e737a2e348348489aa31615af4ab9611730cbf6e486ed72c1b44e8331b78f4d525c9423809bc642e81e4ee18bb4ffc4fc0aaabe3a16ed47e0bb1be9001bfde9de9f44da291644921224d41227addcc9cf4e59df58718e3fa4dfa880247da77ee65d431ef58fc3b2ffd8c2319300558ebe6b159d23fb0e23231b53a544e65858333b05e78b10e303ea02fd6d9dc1c6e01d3cfe565857675204e7f60ebf8a8308bbb25c6388db9e428c2a6d5049293ea1b672bb3860e5a3348626b6aca3ae28ac625e145e856984c454d4dadbb3246a2112b8cd020faa678ecd1722dde930d9bf09b0a7b4de651e1e660b4ef4b220db01706a26b939b5a43b34f36404a62640437702b8278f4c1e3860dbb5fbf65db3df7e1ee7221b46728e5058cf53033b974260fdc544d4d59320072fb13500328769de259cae3f8860e0ea823cb36f6829af45e2ecdf04412c812ecfcad9eea7607d19e105c2d9755268e329c4343f238a506c489945305ebd9c91879d97cd046b6551e3a8683085efb8d542d3dc3d3e4e9397402bd1e101d341b89b1098e093355d2bf5b35e44abd1b661b9b7436e3f35f5e4fdc018c45656793d72457be757cff76f7d532d57a57895386a3d508a42644bce6b72d2b2304acaf0f3c410a63d4a8a5285afe30d47d8579a1273b0cf953ea494bfb45bb1890ca9edad701f325f0d597a5445c8d2510b6f336fac3a38e3218d8c975fcc9533cb0e433f18c60b3a023e7192b78ebca0c5e72b93460e383280843e171c060bd7fb405143784d7e972865fabcf045f796fff7b91bb66c7cb23d48a5ec5541aea3270bef354e4f2c265954cdd6f7feab693e93355d2acb905b0d9ef0840f4a5611cded0bf93f738ee884a181383f7ddc1dc18f40e01acf4f5"}) 3.13958662s ago: executing program 4 (id=290): chdir(&(0x7f0000000000)='./cgroup\x00') mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0xfffffffe) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000140)={0x3, &(0x7f0000000000)=[{0x20, 0x10, 0x4, 0xfffff00c}, {0x30, 0x0, 0xfd, 0x5ae9}, {0x6, 0x0, 0x7, 0x2}]}, 0x10) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r3 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.swap.current\x00', 0x275a, 0x0) getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8) ioctl$VHOST_VDPA_GET_IOVA_RANGE(r3, 0x8010af78, &(0x7f0000000180)) getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8) ioctl$SG_IO(r2, 0x2285, &(0x7f00000000c0)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000ac0)="439f43e278bd", 0x0, 0x3, 0x0, 0x1, 0x0}) sendmmsg$inet(r0, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) 2.810300037s ago: executing program 4 (id=291): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804dd000000000000010902240001000000000904004001030000000921010000012205"], 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, 0x0, 0x0) syz_usb_connect$printer(0x3, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x4, 0x80, 0xfc, "", [{{0x9, 0x4, 0x0, 0xc6, 0x1, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x9, 0x6, 0x5}}}}}]}}]}}, &(0x7f0000000580)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x35, 0x6, 0xff, 0x10, 0xf9}, 0xdb, &(0x7f0000000180)={0x5, 0xf, 0xdb, 0x1, [@generic={0xd6, 0x10, 0xa, "c5f69be03dfcbeb3e1664ac6ec6ba2175141bda9f64452f2488a7b14dd200c57a363d73a1a80f0eb92e15644fa9377cf8572b9640b8a09097d467f8b96eadd61cacaabc6d0fb3df641a249111c50c82111621443a6257e6d8ebf187a8a6b0cd737ec8c46e2b18e16bb2c96b0626871cd1e1fdf8bb3a2204d22766dc48de7ad1573b4311aff67faeda01bc456fcc71fa902f2d23adaf65804b83f012745b1bd750985dff8c8a3b348688482a4df62ac0cbb7a2b7c56513928d33246c43923cf0ab90e2d370b1704a63218c24bf8e144ac209634"}]}, 0x8, [{0xd3, &(0x7f0000000300)=@string={0xd3, 0x3, "3572ae661b18f380412a69966dd2145c0daa598058c7e11983b80f1cb27305a7ef7b3f36c19aefc56c98363b2be266741a27fe079ae70940fd93062b928e1420999cb66d65058807506de5cd78144f23db318b86d64085e9bfc93898acef2c0064ff174e6350c6750ffe57b66ac665ce79992792205687597f831b1269d88769a794d84cecccfb1d265005f5302ba803af0056df21c2002c787db91fe077c9d02f74af597bfc7d76a15fac66970dec7b5e10b77b83da7d8fab0cd58afdaf1d6f1d30ca0f6dd20ce232c5e428b525b3ca78"}}, {0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x860}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x2401}}, {0x83, &(0x7f0000000400)=@string={0x83, 0x3, "b66fbef318a9362255a8f79fcf07d36dc7cc142c3cb50227e933da2185562a8c733fffd226043a3fdb6f6c9ed7c62a963f1fc14217f5d1ed7899782091750005992fd9f5c098672aceb86a3b0ed7453cfa308a2767b8a660b88240f81f9ef2990f44700a468a9192eebc1b44be7128618fe2508073b904009edc199d8e08311b48"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x405}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x455}}, {0x26, &(0x7f0000000540)=@string={0x26, 0x3, "5dd9cc2d2eda2cbe58d5da4cdec5c7db979d1b7df560c018d01cb9eeb46e8143ef041d3d"}}, {0xad, &(0x7f0000000640)=@string={0xad, 0x3, "2374327ec3de77ec78666403b2973a0fcc0aaa26746f43d04a81ef2f066a3670a08a33fbeaa7a159e5a4483b72ddd1c8f3f1c0b92f4c1ad88fe36ff6766b0aa623b472e3f3963cde54d9b8a22d27be6821323955f66c1fe08c113889c2d5f8c945c1457597faaf792a9ff0e61d27502dc7c2a01a80893b5fa8d518d7751ad2c7715717c852dbf0dd374b9dd5cab51c4dc18815f7a5e5fbdbe5b13bc4e4801ff2930f411e09761eff94e175"}}]}) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000040)={0x7f, 0x4, 0xa, 0x4, 0x3, 0x0, 0x9, 0x6, 0x3, 0x4, 0x1, 0x2, 0x8, 0x9}, 0xe) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x11, 0x0) socket$key(0xf, 0x3, 0x2) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000180), 0x40, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket(0x2, 0x3, 0x6) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f00000017c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r3, @ANYBLOB="07b0cf7e2c89cc"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="00221200000083"], 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000140)='P') 2.592219179s ago: executing program 2 (id=292): madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) mremap(&(0x7f0000ff6000/0x1000)=nil, 0x1000, 0xfffffffff000, 0x3, &(0x7f0000ffc000/0x4000)=nil) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x38, 0x7, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0xa}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x6}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x7fff}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008888}, 0x24008000) bpf$PROG_LOAD(0x5, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001780)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000045c0)='/proc/zoneinfo\x00', 0x0, 0x0) read$FUSE(r5, &(0x7f0000000200)={0x2020}, 0x2020) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="18000000780001062abd700000008ec20700"], 0x18}], 0x1, 0x0, 0x0, 0x2000}, 0x4000880) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r4, 0x0, 0x0) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r7, 0xc01864c6, &(0x7f0000000040)={0x0, 0xfdd0}) r8 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0xc010}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD1={0x8, 0x2, @udp=r8}]}}}]}, 0x38}}, 0x0) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r9, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 2.557884447s ago: executing program 1 (id=293): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000440)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd00000010000100030808004149014006040800", 0x58}], 0x1) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) landlock_create_ruleset(&(0x7f0000000940)={0x1, 0x0, 0x1}, 0x18, 0x2) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket$can_bcm(0x1d, 0x2, 0x2) r11 = memfd_create(&(0x7f0000000980)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\x02A\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd\x1fel\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x86\x8d\x1e_g\xb6J\x87E\v,\x8a\x81\x92\x13oz2c\x97 \x03?S\x86\x82`\xf5m\x89\x89g\x80\ad\xaa0\x9d\xc1\xb3\xf9\xe0\xebw\x88\x1d\xe8.H\x95\bp\xe3\xa9d\x87u\x9f\v\x8cK\x14\x83\x18ST\x91\xf5\xd9\xe7\xa0\xa0B\xd9\xc1g\x04\xdf\x9f\xd8\b\x82u\xc7\xcd:\xb9\x8bk,(VB\xbb\xcaE\xb9\x11\xb4(\xe5/\xf2\xa5\x17\xc6\xc8C\xa1\xf7\x11@}\xb8i\xe4\xe4\xeeWdU7\b\xa0Q\xb2\xf4\x97f\xf8\xa0\x9d\xba\x91\x8d\xdc\x9e\xa4\x8aS3\xb4\xf20x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) r6 = socket(0x11, 0x3, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) r9 = accept4$alg(r2, 0x0, 0x0, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x440}, 0x800) bind$packet(r6, &(0x7f0000000080)={0x11, 0xf7, r8, 0x1, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xf}}, 0x14) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f00000000c0)={0x4, 0x5}, 0x4) socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$IP_SET_OP_GET_FNAME(r9, 0x1, 0x53, &(0x7f0000000300)={0x8, 0x7, 0x0, 'syz1\x00'}, &(0x7f0000000340)=0x2c) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 1.612222748s ago: executing program 1 (id=295): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@private2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000000080)=0xe8) r3 = geteuid() setresuid(r2, 0xffffffffffffffff, r3) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001340)={'geneve0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_FLAGS={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x0) 1.260285851s ago: executing program 0 (id=296): unshare(0x8040600) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) accept4(r0, 0x0, 0x0, 0x0) r1 = syz_io_uring_setup(0xb5c, &(0x7f0000000640)={0x0, 0x498, 0x0, 0x1, 0x164}, &(0x7f0000000dc0)=0x0, &(0x7f00000001c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) r3 = syz_io_uring_setup(0x49b, &(0x7f0000000200)={0x0, 0x4661, 0x400, 0x7, 0x123, 0x0, r1}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r3, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) socket(0x22, 0x2, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x7, 0x40, 0x7fff0000}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mincore(&(0x7f0000000000/0xc00000)=nil, 0xc00000, &(0x7f0000000140)=""/142) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r6, 0x8983, &(0x7f0000000180)={0x0, 'netdevsim0\x00', {0x4}, 0xfffe}) 1.090714334s ago: executing program 1 (id=297): personality(0x6000003) r0 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000080)={0x8, 0x6, 0x2}, 0x10) syz_open_dev$dvb_dvr(&(0x7f00000002c0), 0x10, 0x0) write(r0, &(0x7f0000000480)="1c0000001a009b8a140000003b00"/28, 0x1c) r1 = socket(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2a, &(0x7f0000000080)={0x2, {{0xa, 0x0, 0xfffffffe, @mcast1={0xff, 0x7}, 0x10}}, {{0xa, 0x0, 0x0, @remote, 0xfffffffc}}}, 0x108) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4001, 0x0, @loopback}}}, 0x108) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) close_range(r2, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f00000014c0)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x3}, {0xffff, 0xffff}, {0xffff}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ECN={0x8, 0xa, 0x1}, @TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x1e}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x9b6b4f4cc3fcc40b}, 0x2000400c) r5 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$BTRFS_IOC_RESIZE(r1, 0x50009403, &(0x7f0000000280)=ANY=[@ANYRES32=r5, @ANYBLOB='\x00\x00 \x00max']) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0xfffffffd, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0xa10904, 0x9, '\x00', @string=0x0}}) timer_create(0x2, &(0x7f0000000440)={0x0, 0x21, 0x0, @thr={&(0x7f0000000340)="85a64ae0a756d71d625e8a74d119510ccc5d8bf6203ce44d7a996a34d0a44f3cd3ea7124d8ddbfd8b0ad924fac45a71ebc7d15eb9f2cf961f11be04f582ad4f55faa31891d64ee5514ae7fbf69f905320269bd9c9b054c0bc47215ad01e62d01272a8d03cee6fc6f55cc48e667e3622eaf68203a25eab31247017dc5fd3f8cc4ee8bc0d3f44efa14f6a4d6f8505636aa17d82f8afc819dde5b0bb1c7238995434880ac469b7ad4ef75b0396aaf446c34535d2d64d9b086949b5672ccb982ff5489ccfff50ef98b88afdec5084f3025957b", &(0x7f00000005c0)="c46d3cd2e79e426ca67d5b479bda258c8c8399f09e935c35770aff9b67b04188e86c3bb26440cdb3de592391cd17f4d34705314a9c3e8403ba0d83361060e2fe0074c608c4ff2deb2f354ef94c486ef8cec9cc9a6d0c43e5a2d88305b5d5e5dbdd07e5a863f0c4b191918c2490bfdd964001ec8cdd0cfe9f109f59df401d1bf0439ac33f5303c59c72a12f1eb8022064cefb9e27a9428134e441fd5a0fdbf6a989c08ca8335da3bf0746fb835ba299f406cb96448b83c988a2ace5822d7dcf95c0596c66f6c15803153081dbe1d308dea851410941728eb540dbdc2660c9347387ebc7f92976f5d94c3e5bdc97c2d3d679913f9104f9c5b1e86aac11c06fdc5d3f1a1be7984bf33520cf5fc8a1df2a8fbc159298c6639c43153bb46bb87bf256b209469730"}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="030300000000fcffffff0c48000008000300a7"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) clock_nanosleep(0x8, 0x0, &(0x7f0000000000)={0x0, 0x3938700}, 0xfffffffffffffffe) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0xc369d000) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000000)={0x6, 0x4, 0xdfc, 0x6, 0x83, 0x4, 0x91, 0x4222}, 0x0, &(0x7f0000000100)={0x101, 0x20e66a, 0x4000000000000, 0x6, 0x7, 0x9, 0x8, 0xcc}, &(0x7f00000001c0)={r8, r9+10000000}, &(0x7f0000000180)={&(0x7f0000000200)={[0xd43b]}, 0x8}) 352.530517ms ago: executing program 2 (id=298): ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x8000}}, './file0\x00'}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f00000007c0)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_RES_CTX(r1, 0xc0106426, &(0x7f0000000840)={0x1, &(0x7f0000000800)=[{0x0}]}) ioctl$DRM_IOCTL_DMA(r2, 0xc0406429, &(0x7f0000000980)={r3, 0x1, &(0x7f0000000880)=[0x7], &(0x7f00000008c0)=[0x80], 0x80, 0x4, 0x4, &(0x7f0000000900)=[0x4, 0x38, 0x8000, 0x4215], &(0x7f0000000940)=[0x6, 0x59, 0x2, 0x1, 0x3ae9]}) ioctl$DRM_IOCTL_NEW_CTX(r0, 0x40086425, &(0x7f0000000040)={r3, 0x1}) 0s ago: executing program 2 (id=299): r0 = syz_clone(0x200011, 0x0, 0xff48, 0x0, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x202, &(0x7f0000000180)=ANY=[@ANYBLOB="1201100152018b401e040740185d000000010902f00101040000030904"], 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000040)={0x2c, &(0x7f00000000c0)={0x0, 0xd, 0x2, 'Vx'}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, &(0x7f0000000000)={0x14, &(0x7f00000001c0)={0x20, 0xc, 0x9, {0x9, 0x22, "2557cba2f16414"}}, 0x0}, 0x0) syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f0000000200)={0x0, 0x9, 0x6d, {0x6d, 0x21, "114ef545041db452d72a1973c44e1a97a3a34cdf600a62727c7c6fa6270812dd7e1b1abe1d191bf8954ab34ac0266d99185ad0d4ba535cc5f0d9bc5cc56fc77d8b2f1aad64d8c8d0d207b8861fa6cece172fae22179dab3ee228d21d505906c0cff2a67446dd7aa183d957"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x42a}}, 0x0, &(0x7f0000000140)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x1, 0x1, 0xa, "0504b9c1", "09ac9626"}}, &(0x7f0000000300)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xf2, 0x60, 0x7, 0x7, 0x6, 0x8, 0xa59c}}}, &(0x7f0000000840)={0x84, &(0x7f0000000380)={0x20, 0x8, 0x5a, "3fe039a1ad09ae24006c210fb895fc5d07341c2eec3257af5a8146db0820e789f393dedde20b24a3b676ff54203e07ff5c09980029746bf72a12fedb36b2b517a3ac9bd2422b0a3297fb4c190444f5b9f4e94cb6a4ac9d71da3f"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0xf8}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x8}, 0x0, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x400, 0x20}}, &(0x7f0000000580)={0x40, 0x7, 0x2, 0x6}, &(0x7f00000005c0)={0x40, 0x9, 0x1, 0x6e}, &(0x7f0000000600)={0x40, 0xb, 0x2, "cb98"}, &(0x7f0000000640)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000680)={0x40, 0x13, 0x6, @local}, &(0x7f00000006c0)={0x40, 0x17, 0x6, @local}, &(0x7f0000000700)={0x40, 0x19, 0x2, "bbf2"}, &(0x7f0000000740)={0x40, 0x1a, 0x2, 0x400}, &(0x7f0000000780)={0x40, 0x1c, 0x1, 0x9}, &(0x7f00000007c0)={0x40, 0x1e, 0x1, 0x52}, &(0x7f0000000800)={0x40, 0x21, 0x1, 0x1}}) r2 = syz_pidfd_open(r0, 0x0) ioctl$FS_IOC_GETVERSION(r2, 0xc040ff0b, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.25' (ED25519) to the list of known hosts. [ 81.549393][ T5812] cgroup: Unknown subsys name 'net' [ 81.665639][ T5812] cgroup: Unknown subsys name 'cpuset' [ 81.675643][ T5812] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 83.392844][ T5812] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 85.657807][ T5827] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.677992][ T5830] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 85.689048][ T5835] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 85.697166][ T5835] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.705524][ T5835] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 85.712930][ T5837] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.719890][ T5835] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 85.723930][ T5835] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 85.735239][ T5837] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.735519][ T5835] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 85.745599][ T5837] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.751885][ T5835] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.758787][ T5837] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.766581][ T5835] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 85.784892][ T5839] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 85.784910][ T5838] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 85.787237][ T5837] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 85.796438][ T5839] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 85.815213][ T5839] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 85.824143][ T5837] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 85.832039][ T5839] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 85.836351][ T5837] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.847513][ T5147] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 85.863574][ T5147] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 85.870990][ T5147] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 86.420940][ T5841] chnl_net:caif_netlink_parms(): no params data found [ 86.572236][ T5843] chnl_net:caif_netlink_parms(): no params data found [ 86.707413][ T5841] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.714971][ T5841] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.722985][ T5841] bridge_slave_0: entered allmulticast mode [ 86.730292][ T5841] bridge_slave_0: entered promiscuous mode [ 86.753286][ T5844] chnl_net:caif_netlink_parms(): no params data found [ 86.800690][ T5841] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.807888][ T5841] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.815547][ T5841] bridge_slave_1: entered allmulticast mode [ 86.822903][ T5841] bridge_slave_1: entered promiscuous mode [ 86.893803][ T5846] chnl_net:caif_netlink_parms(): no params data found [ 86.943362][ T5841] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.975517][ T5843] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.991468][ T5843] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.998823][ T5843] bridge_slave_0: entered allmulticast mode [ 87.018950][ T5843] bridge_slave_0: entered promiscuous mode [ 87.064079][ T5841] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.102843][ T5843] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.110033][ T5843] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.131637][ T5843] bridge_slave_1: entered allmulticast mode [ 87.139461][ T5843] bridge_slave_1: entered promiscuous mode [ 87.262777][ T5841] team0: Port device team_slave_0 added [ 87.268735][ T5845] chnl_net:caif_netlink_parms(): no params data found [ 87.306479][ T5843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.319720][ T5843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.354837][ T5841] team0: Port device team_slave_1 added [ 87.401146][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.408484][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.415985][ T5844] bridge_slave_0: entered allmulticast mode [ 87.424185][ T5844] bridge_slave_0: entered promiscuous mode [ 87.489454][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.496874][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.504246][ T5844] bridge_slave_1: entered allmulticast mode [ 87.512540][ T5844] bridge_slave_1: entered promiscuous mode [ 87.531184][ T5841] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.538884][ T5841] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.565862][ T5841] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.577794][ T5846] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.585267][ T5846] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.597071][ T5846] bridge_slave_0: entered allmulticast mode [ 87.604676][ T5846] bridge_slave_0: entered promiscuous mode [ 87.614542][ T5843] team0: Port device team_slave_0 added [ 87.620413][ T5846] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.627614][ T5846] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.635428][ T5846] bridge_slave_1: entered allmulticast mode [ 87.643225][ T5846] bridge_slave_1: entered promiscuous mode [ 87.680168][ T5841] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.687250][ T5841] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.713871][ T5841] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.727429][ T5843] team0: Port device team_slave_1 added [ 87.784313][ T5846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.796911][ T5846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.808800][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.832248][ T51] Bluetooth: hci1: command tx timeout [ 87.856348][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.889747][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.896880][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.914790][ T5147] Bluetooth: hci2: command tx timeout [ 87.923032][ T5843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.929712][ T5830] Bluetooth: hci3: command tx timeout [ 87.945690][ T51] Bluetooth: hci0: command tx timeout [ 87.981032][ T5845] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.988486][ T5845] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.991928][ T5830] Bluetooth: hci4: command tx timeout [ 87.997498][ T5845] bridge_slave_0: entered allmulticast mode [ 88.008583][ T5845] bridge_slave_0: entered promiscuous mode [ 88.016639][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.023859][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.050160][ T5843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.063045][ T5846] team0: Port device team_slave_0 added [ 88.101662][ T5844] team0: Port device team_slave_0 added [ 88.107665][ T5845] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.114952][ T5845] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.122474][ T5845] bridge_slave_1: entered allmulticast mode [ 88.129761][ T5845] bridge_slave_1: entered promiscuous mode [ 88.150878][ T5846] team0: Port device team_slave_1 added [ 88.174552][ T5841] hsr_slave_0: entered promiscuous mode [ 88.181901][ T5841] hsr_slave_1: entered promiscuous mode [ 88.190493][ T5844] team0: Port device team_slave_1 added [ 88.211125][ T5845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.260779][ T5845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.282082][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.289075][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.315290][ T5846] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.328267][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.335685][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.362215][ T5846] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.428785][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.436837][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.463170][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.480353][ T5843] hsr_slave_0: entered promiscuous mode [ 88.487268][ T5843] hsr_slave_1: entered promiscuous mode [ 88.493738][ T5843] debugfs: 'hsr0' already exists in 'hsr' [ 88.499563][ T5843] Cannot create hsr debugfs directory [ 88.546029][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.553465][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.579545][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.598473][ T5845] team0: Port device team_slave_0 added [ 88.643681][ T5845] team0: Port device team_slave_1 added [ 88.674152][ T5846] hsr_slave_0: entered promiscuous mode [ 88.680601][ T5846] hsr_slave_1: entered promiscuous mode [ 88.687504][ T5846] debugfs: 'hsr0' already exists in 'hsr' [ 88.693672][ T5846] Cannot create hsr debugfs directory [ 88.811253][ T5844] hsr_slave_0: entered promiscuous mode [ 88.818163][ T5844] hsr_slave_1: entered promiscuous mode [ 88.824558][ T5844] debugfs: 'hsr0' already exists in 'hsr' [ 88.830414][ T5844] Cannot create hsr debugfs directory [ 88.836807][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.844708][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.870719][ T5845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.914215][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.921214][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.947863][ T5845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.143096][ T5845] hsr_slave_0: entered promiscuous mode [ 89.149567][ T5845] hsr_slave_1: entered promiscuous mode [ 89.157450][ T5845] debugfs: 'hsr0' already exists in 'hsr' [ 89.163422][ T5845] Cannot create hsr debugfs directory [ 89.347672][ T5841] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 89.393928][ T5841] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 89.428057][ T5841] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 89.445695][ T5841] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 89.565670][ T5843] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 89.576624][ T5843] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 89.604666][ T5843] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 89.623544][ T5843] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 89.715538][ T5846] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 89.727017][ T5846] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 89.738542][ T5846] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 89.771774][ T5846] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 89.875336][ T5844] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 89.887041][ T5844] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 89.897914][ T5844] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 89.910093][ T5844] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 89.916922][ T5830] Bluetooth: hci1: command tx timeout [ 89.992252][ T5830] Bluetooth: hci3: command tx timeout [ 89.997726][ T5830] Bluetooth: hci0: command tx timeout [ 90.002250][ T51] Bluetooth: hci2: command tx timeout [ 90.037413][ T5845] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 90.061196][ T5845] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 90.072392][ T51] Bluetooth: hci4: command tx timeout [ 90.082601][ T5845] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 90.096456][ T5841] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.112798][ T5845] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 90.128692][ T5843] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.175415][ T5843] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.210926][ T5841] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.226774][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.234155][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.265996][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.273185][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.286837][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.294179][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.324815][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.332109][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.367700][ T5846] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.448762][ T5846] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.467149][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.480751][ T5841] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 90.534340][ T5844] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.544180][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.551423][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.576281][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.583507][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.598955][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.606183][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.635275][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.642534][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.705476][ T5841] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.749607][ T5843] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.770129][ T5845] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.886930][ T5845] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.894929][ T5841] veth0_vlan: entered promiscuous mode [ 90.919499][ T5843] veth0_vlan: entered promiscuous mode [ 90.939304][ T5841] veth1_vlan: entered promiscuous mode [ 90.955564][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.962783][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.989578][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.996798][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.017592][ T5843] veth1_vlan: entered promiscuous mode [ 91.039374][ T5846] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.050823][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.137352][ T5841] veth0_macvtap: entered promiscuous mode [ 91.185775][ T5843] veth0_macvtap: entered promiscuous mode [ 91.196913][ T5841] veth1_macvtap: entered promiscuous mode [ 91.215589][ T5843] veth1_macvtap: entered promiscuous mode [ 91.241720][ T5846] veth0_vlan: entered promiscuous mode [ 91.256594][ T5844] veth0_vlan: entered promiscuous mode [ 91.270422][ T5845] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.294612][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.306591][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.319723][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.329644][ T5846] veth1_vlan: entered promiscuous mode [ 91.346440][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.362543][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.372270][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.402768][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.412296][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.422985][ T5844] veth1_vlan: entered promiscuous mode [ 91.435284][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.445569][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.470162][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.479433][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.598882][ T5846] veth0_macvtap: entered promiscuous mode [ 91.640192][ T5844] veth0_macvtap: entered promiscuous mode [ 91.654571][ T5846] veth1_macvtap: entered promiscuous mode [ 91.674791][ T5844] veth1_macvtap: entered promiscuous mode [ 91.687919][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.697035][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.765114][ T5845] veth0_vlan: entered promiscuous mode [ 91.784434][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.794704][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.806878][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.816575][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.838081][ T209] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.847715][ T5845] veth1_vlan: entered promiscuous mode [ 91.855337][ T209] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.868551][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.884037][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.934837][ T209] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.942909][ T209] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.951189][ T1120] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.964832][ T1120] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.995259][ T51] Bluetooth: hci1: command tx timeout [ 92.003150][ T1120] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.017498][ T1120] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.030861][ T5841] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 92.058203][ T1120] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.067148][ T1120] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.076589][ T51] Bluetooth: hci0: command tx timeout [ 92.082110][ T5147] Bluetooth: hci2: command tx timeout [ 92.082193][ T5830] Bluetooth: hci3: command tx timeout [ 92.095041][ T24] cfg80211: failed to load regulatory.db [ 92.116152][ T1120] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.125071][ T1120] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.152018][ T51] Bluetooth: hci4: command tx timeout [ 92.176083][ T5845] veth0_macvtap: entered promiscuous mode [ 92.255150][ T5845] veth1_macvtap: entered promiscuous mode [ 92.454982][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.482185][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.517427][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.631245][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.677455][ T1120] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.693297][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.711391][ T1120] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.719833][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.739267][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.756080][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.783225][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.791177][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.831741][ T24] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 92.938628][ T209] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.971608][ T209] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.040433][ T24] usb 3-1: config 0 has an invalid interface number: 120 but max is 0 [ 93.079446][ T24] usb 3-1: config 0 has no interface number 0 [ 93.100003][ T24] usb 3-1: config 0 interface 120 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 93.131504][ T24] usb 3-1: config 0 interface 120 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 93.161417][ T24] usb 3-1: config 0 interface 120 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 93.181635][ T24] usb 3-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 93.222415][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.238929][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.265751][ T24] usb 3-1: config 0 descriptor?? [ 93.301690][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.370834][ T24] input: USB Touchscreen 16e3:f9e9 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.120/input/input5 [ 93.497202][ T209] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.535333][ C0] hrtimer: interrupt took 31385 ns [ 93.548658][ T209] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.856508][ T5943] openvswitch: netlink: ERSPAN option length err (len 13596, max 255). [ 94.037829][ T5948] netlink: 'syz.0.9': attribute type 10 has an invalid length. [ 94.082701][ T51] Bluetooth: hci1: command tx timeout [ 94.107463][ T5950] netlink: 'syz.0.9': attribute type 10 has an invalid length. [ 94.134545][ T5951] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 94.151763][ T51] Bluetooth: hci3: command tx timeout [ 94.151812][ T51] Bluetooth: hci2: command tx timeout [ 94.164179][ T51] Bluetooth: hci0: command tx timeout [ 94.190719][ T5948] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.221989][ T5950] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9'. [ 94.231938][ T5830] Bluetooth: hci4: command tx timeout [ 94.287346][ T5948] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 94.339102][ T5950] batadv0: entered promiscuous mode [ 94.348328][ T5950] batadv0: entered allmulticast mode [ 94.365001][ T5950] bond0: (slave batadv0): Releasing backup interface [ 94.379775][ T5950] bridge0: port 3(batadv0) entered blocking state [ 94.388974][ T5950] bridge0: port 3(batadv0) entered disabled state [ 94.464829][ T5955] fuse: Bad value for 'fd' [ 94.602185][ T12] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 94.611744][ T12] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 94.737485][ T5964] FAULT_INJECTION: forcing a failure. [ 94.737485][ T5964] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 94.753778][ T5964] CPU: 1 UID: 0 PID: 5964 Comm: syz.0.12 Not tainted syzkaller #0 PREEMPT(full) [ 94.753808][ T5964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 94.753828][ T5964] Call Trace: [ 94.753836][ T5964] [ 94.753845][ T5964] dump_stack_lvl+0xe8/0x150 [ 94.753882][ T5964] should_fail_ex+0x412/0x560 [ 94.753918][ T5964] _copy_from_user+0x2d/0xb0 [ 94.753942][ T5964] ___sys_sendmsg+0x1c6/0x360 [ 94.753973][ T5964] ? __pfx____sys_sendmsg+0x10/0x10 [ 94.754003][ T5964] ? kstrtouint+0x6e/0xe0 [ 94.754057][ T5964] ? __fget_files+0x2a/0x420 [ 94.754087][ T5964] ? __fget_files+0x3a0/0x420 [ 94.754127][ T5964] __sys_sendmmsg+0x27c/0x4e0 [ 94.754157][ T5964] ? __pfx___sys_sendmmsg+0x10/0x10 [ 94.754179][ T5964] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 94.754228][ T5964] ? ksys_write+0x242/0x270 [ 94.754253][ T5964] ? __pfx_ksys_write+0x10/0x10 [ 94.754281][ T5964] __x64_sys_sendmmsg+0xa0/0xc0 [ 94.754307][ T5964] do_syscall_64+0x14d/0xf80 [ 94.754330][ T5964] ? trace_irq_disable+0x3b/0x150 [ 94.754347][ T5964] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.754368][ T5964] ? clear_bhb_loop+0x40/0x90 [ 94.754401][ T5964] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.754421][ T5964] RIP: 0033:0x7fc77739c799 [ 94.754445][ T5964] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.754467][ T5964] RSP: 002b:00007fc77831b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 94.754488][ T5964] RAX: ffffffffffffffda RBX: 00007fc777615fa0 RCX: 00007fc77739c799 [ 94.754503][ T5964] RDX: 0000000000000001 RSI: 0000200000001340 RDI: 0000000000000003 [ 94.754515][ T5964] RBP: 00007fc77831b090 R08: 0000000000000000 R09: 0000000000000000 [ 94.754527][ T5964] R10: 000000000000c040 R11: 0000000000000246 R12: 0000000000000001 [ 94.754538][ T5964] R13: 00007fc777616038 R14: 00007fc777615fa0 R15: 00007fc77773fa48 [ 94.754569][ T5964] [ 95.333196][ T10] usb 3-1: USB disconnect, device number 2 [ 95.975326][ T5982] input: syz0 as /devices/virtual/input/input6 [ 96.325080][ T5994] loop5: detected capacity change from 0 to 7 [ 96.334988][ T5994] Buffer I/O error on dev loop5, logical block 0, async page read [ 96.344746][ T5994] Buffer I/O error on dev loop5, logical block 0, async page read [ 96.360870][ T5994] Buffer I/O error on dev loop5, logical block 0, async page read [ 96.510312][ T5994] Buffer I/O error on dev loop5, logical block 0, async page read [ 96.538733][ T5994] Buffer I/O error on dev loop5, logical block 0, async page read [ 96.606890][ T5994] Buffer I/O error on dev loop5, logical block 0, async page read [ 96.676616][ T5994] Buffer I/O error on dev loop5, logical block 0, async page read [ 96.735478][ T5994] ldm_validate_partition_table(): Disk read failed. [ 96.795729][ T5994] Buffer I/O error on dev loop5, logical block 0, async page read [ 96.882454][ T5994] Buffer I/O error on dev loop5, logical block 0, async page read [ 96.921468][ T5994] Buffer I/O error on dev loop5, logical block 0, async page read [ 96.961502][ T5994] Dev loop5: unable to read RDB block 0 [ 97.045653][ T5994] loop5: unable to read partition table [ 97.061672][ T5994] loop5: partition table beyond EOD, truncated [ 97.096506][ T5994] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 98.251475][ T5917] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 98.436259][ T5917] usb 4-1: Using ep0 maxpacket: 32 [ 98.456691][ T5917] usb 4-1: unable to get BOS descriptor or descriptor too short [ 98.506511][ T5917] usb 4-1: too many configurations: 255, using maximum allowed: 8 [ 98.538183][ T5917] usb 4-1: config 1 interface 0 has no altsetting 0 [ 98.552495][ T5917] usb 4-1: config 1 interface 0 has no altsetting 0 [ 98.570971][ T5917] usb 4-1: config 1 interface 0 has no altsetting 0 [ 98.609530][ T5917] usb 4-1: config 1 interface 0 has no altsetting 0 [ 98.634027][ T5917] usb 4-1: config 1 interface 0 has no altsetting 0 [ 98.652918][ T5917] usb 4-1: config 1 interface 0 has no altsetting 0 [ 98.687606][ T5917] usb 4-1: config 1 interface 0 has no altsetting 0 [ 98.713663][ T5917] usb 4-1: config 1 interface 0 has no altsetting 0 [ 98.774235][ T5917] usb 4-1: string descriptor 0 read error: -22 [ 98.780800][ T5917] usb 4-1: New USB device found, idVendor=320f, idProduct=ffff, bcdDevice=ff.ff [ 98.834669][ T5917] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=255 [ 98.964988][ T6033] Invalid logical block size (16896) [ 99.019863][ T6036] vivid-002: disconnect [ 99.121251][ T6038] fuse: Bad value for 'fd' [ 99.233105][ T6041] syz.0.37 uses obsolete (PF_INET,SOCK_PACKET) [ 99.285274][ T6041] fuse: Unknown parameter 'mfEsfd' [ 99.300114][ T6012] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 99.367768][ T5917] usbhid 4-1:1.0: can't add hid device: -32 [ 99.407401][ T5917] usbhid 4-1:1.0: probe with driver usbhid failed with error -32 [ 99.427657][ T5917] usb 4-1: USB disconnect, device number 2 [ 99.872564][ T6030] vivid-002: reconnect [ 100.351463][ T5902] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 100.501618][ T5902] usb 4-1: Using ep0 maxpacket: 8 [ 100.517531][ T5902] usb 4-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 100.541004][ T5902] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.561027][ T5902] usb 4-1: Product: syz [ 100.571499][ T5902] usb 4-1: Manufacturer: syz [ 100.576181][ T5902] usb 4-1: SerialNumber: syz [ 100.731030][ T5917] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 100.802806][ T6049] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 100.820759][ T6049] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 100.894969][ T5917] usb 3-1: unable to get BOS descriptor or descriptor too short [ 100.905432][ T5917] usb 3-1: not running at top speed; connect to a high speed hub [ 100.942179][ T5917] usb 3-1: config 1 has an invalid interface number: 93 but max is 0 [ 101.151411][ T5917] usb 3-1: config 1 has no interface number 0 [ 101.161231][ T5917] usb 3-1: config 1 interface 93 has no altsetting 0 [ 101.204919][ T5917] usb 3-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice= e.3d [ 101.219794][ T6064] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 101.231401][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.239551][ T5917] usb 3-1: Product: syz [ 101.248783][ T6064] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 101.279250][ T5917] usb 3-1: Manufacturer: syz [ 101.296893][ T5917] usb 3-1: SerialNumber: syz [ 101.456816][ T6066] netlink: 'syz.3.39': attribute type 10 has an invalid length. [ 101.529775][ T6059] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 101.551591][ T10] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 101.562120][ T6059] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 101.581236][ T6066] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.664633][ T5917] usb 3-1: USB disconnect, device number 3 [ 101.696776][ T6066] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 101.731421][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 101.997991][ T6064] warning: `syz.3.39' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 102.026530][ T6073] netlink: 5268 bytes leftover after parsing attributes in process `syz.0.48'. [ 102.109188][ T6064] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 102.131795][ T6064] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 102.244885][ T6080] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 102.287065][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 102.316973][ T5917] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 102.339197][ T10] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 102.366374][ T10] usb 2-1: can't read configurations, error -71 [ 102.390292][ T6081] netlink: 60 bytes leftover after parsing attributes in process `syz.2.50'. [ 102.485095][ T6081] bridge_slave_1: left allmulticast mode [ 102.492295][ T6081] bridge_slave_1: left promiscuous mode [ 102.495442][ T5917] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 102.510751][ T6081] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.516773][ T5917] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 102.544079][ T5917] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.561036][ T5917] usb 5-1: config 0 descriptor?? [ 102.581121][ T6081] bridge_slave_0: left allmulticast mode [ 102.616645][ T6081] bridge_slave_0: left promiscuous mode [ 102.650232][ T6081] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.999382][ T5917] keytouch 0003:0926:3333.0001: fixing up Keytouch IEC report descriptor [ 103.053207][ T10] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 103.061752][ T5917] input: HID 0926:3333 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0926:3333.0001/input/input7 [ 103.231477][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 103.246298][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 103.292527][ T10] usb 2-1: config 128 has an invalid interface number: 127 but max is 3 [ 103.306411][ T10] usb 2-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 103.337332][ T5917] keytouch 0003:0926:3333.0001: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.4-1/input0 [ 103.370418][ T10] usb 2-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 103.429261][ T10] usb 2-1: config 128 has no interface number 0 [ 103.466041][ T10] usb 2-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid wMaxPacketSize 0 [ 103.504349][ T10] usb 2-1: config 128 interface 127 has no altsetting 0 [ 103.526446][ T5917] usb 5-1: USB disconnect, device number 2 [ 103.574355][ T10] usb 2-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 103.606370][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.631383][ T10] usb 2-1: Product: syz [ 103.637164][ T6092] fido_id[6092]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 103.662810][ T10] usb 2-1: Manufacturer: syz [ 103.689935][ T10] usb 2-1: SerialNumber: syz [ 103.697839][ T5902] usb 4-1: 1:1: cannot get freq (v2/v3): err -71 [ 103.743192][ T5902] usb 4-1: 2:1: cannot get freq (v2/v3): err -71 [ 103.921135][ T6086] loop5: detected capacity change from 0 to 7 [ 103.952924][ T6086] Dev loop5: unable to read RDB block 7 [ 103.981052][ T6086] loop5: unable to read partition table [ 104.005578][ T6086] loop5: partition table beyond EOD, truncated [ 104.035393][ T6086] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 104.083694][ T5902] usb 4-1: USB disconnect, device number 3 [ 104.282905][ T6113] netlink: 'syz.3.57': attribute type 15 has an invalid length. [ 104.363739][ T10] usb 2-1: USB disconnect, device number 3 [ 104.532306][ T6118] FAULT_INJECTION: forcing a failure. [ 104.532306][ T6118] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 104.565888][ T6118] CPU: 1 UID: 0 PID: 6118 Comm: syz.4.59 Not tainted syzkaller #0 PREEMPT(full) [ 104.565918][ T6118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 104.565930][ T6118] Call Trace: [ 104.565938][ T6118] [ 104.565946][ T6118] dump_stack_lvl+0xe8/0x150 [ 104.565981][ T6118] should_fail_ex+0x412/0x560 [ 104.566015][ T6118] _copy_from_user+0x2d/0xb0 [ 104.566037][ T6118] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 104.566057][ T6118] drm_ioctl+0x5ca/0xb80 [ 104.566084][ T6118] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 104.566109][ T6118] ? __pfx_drm_ioctl+0x10/0x10 [ 104.566139][ T6118] ? __fget_files+0x2a/0x420 [ 104.566173][ T6118] ? bpf_lsm_file_ioctl+0x9/0x20 [ 104.566200][ T6118] ? __pfx_drm_ioctl+0x10/0x10 [ 104.566219][ T6118] __se_sys_ioctl+0xfc/0x170 [ 104.566246][ T6118] do_syscall_64+0x14d/0xf80 [ 104.566268][ T6118] ? trace_irq_disable+0x3b/0x150 [ 104.566285][ T6118] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.566305][ T6118] ? clear_bhb_loop+0x40/0x90 [ 104.566330][ T6118] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.566350][ T6118] RIP: 0033:0x7fd7cb79c799 [ 104.566369][ T6118] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.566386][ T6118] RSP: 002b:00007fd7cc5d3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 104.566408][ T6118] RAX: ffffffffffffffda RBX: 00007fd7cba15fa0 RCX: 00007fd7cb79c799 [ 104.566423][ T6118] RDX: 0000200000000240 RSI: 00000000c06864a2 RDI: 0000000000000003 [ 104.566436][ T6118] RBP: 00007fd7cc5d3090 R08: 0000000000000000 R09: 0000000000000000 [ 104.566448][ T6118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 104.566460][ T6118] R13: 00007fd7cba16038 R14: 00007fd7cba15fa0 R15: 00007fd7cbb3fa48 [ 104.566495][ T6118] [ 104.828757][ T5978] udevd[5978]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:128.127/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 105.161279][ T5902] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 105.273762][ T24] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 105.311466][ T5902] usb 4-1: device descriptor read/64, error -71 [ 105.431837][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 105.468492][ T24] usb 5-1: config 6 has an invalid interface number: 184 but max is 0 [ 105.477610][ T24] usb 5-1: config 6 has no interface number 0 [ 105.498790][ T24] usb 5-1: config 6 interface 184 has no altsetting 0 [ 105.527005][ T24] usb 5-1: New USB device found, idVendor=2dee, idProduct=4d22, bcdDevice=8c.fd [ 105.571425][ T5902] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 105.588042][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.618390][ T24] usb 5-1: Manufacturer: 뛮꼰ད෶廣뿖㏁䕠᪔핃ஐ覥䊧⢙㭳א쬇汔毰O䶐⺚ﴔ嵢鵢᥺Ɱఏ鄼涉霚ʴ✃땗慗쉋୽ꔹꋄז酥㾁ͻ煦喓ዥ啞飄뭤耊⩥믁䜕鋔ꭁ뿌䔙죎樀岥剢慠᫋諣䅤㖄葔廱䊴턯垔ꁯ펷ᗕ薑贿沆뺞쏮렗㨆搤鷣ﹽ䋇።칽顰넏ෑ㋎㝎騈彼慫헄깃햬갰쵞쑯 [ 105.706494][ T24] usb 5-1: SerialNumber: 㐊 [ 105.732905][ T5917] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 105.741736][ T5902] usb 4-1: device descriptor read/64, error -71 [ 105.852495][ T5902] usb usb4-port1: attempt power cycle [ 105.986564][ T5917] usb 3-1: config 0 has an invalid interface number: 35 but max is 0 [ 105.996925][ T5917] usb 3-1: config 0 has no interface number 0 [ 106.003923][ T5917] usb 3-1: config 0 interface 35 altsetting 0 endpoint 0xE has an invalid bInterval 0, changing to 10 [ 106.017963][ T5917] usb 3-1: config 0 interface 35 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 106.031134][ T5917] usb 3-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 106.040416][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.048601][ T5917] usb 3-1: Product: syz [ 106.053884][ T5917] usb 3-1: Manufacturer: syz [ 106.066279][ T5917] usb 3-1: SerialNumber: syz [ 106.089151][ T5917] usb 3-1: config 0 descriptor?? [ 106.102091][ T5917] cypress_m8 3-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 106.221484][ T5902] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 106.242262][ T5902] usb 4-1: device descriptor read/8, error -71 [ 106.392932][ T6128] netlink: 212344 bytes leftover after parsing attributes in process `syz.2.63'. [ 106.408989][ T6128] netlink: 12 bytes leftover after parsing attributes in process `syz.2.63'. [ 106.491438][ T5902] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 106.532999][ T5902] usb 4-1: device descriptor read/8, error -71 [ 106.537771][ T24] option 5-1:6.184: GSM modem (1-port) converter detected [ 106.562625][ T24] usb 5-1: USB disconnect, device number 3 [ 106.588342][ T24] option 5-1:6.184: device disconnected [ 106.655968][ T5902] usb usb4-port1: unable to enumerate USB device [ 106.691922][ T5917] usb 3-1: Nokia CA-42 V2 Adapter converter now attached to ttyUSB0 [ 106.738963][ T5917] usb 3-1: USB disconnect, device number 4 [ 106.761481][ T10] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 106.785476][ T5917] nokiaca42v2 ttyUSB0: Nokia CA-42 V2 Adapter converter now disconnected from ttyUSB0 [ 106.786910][ T6142] tipc: Started in network mode [ 106.842128][ T6142] tipc: Node identity 6644b6035966, cluster identity 4711 [ 106.852445][ T6142] tipc: Enabled bearer , priority 0 [ 106.864598][ T6143] tipc: Resetting bearer [ 106.872812][ T5917] cypress_m8 3-1:0.35: device disconnected [ 106.902275][ T10] usb 1-1: device descriptor read/64, error -71 [ 106.930264][ T6141] tipc: Disabling bearer [ 107.058896][ T6149] netlink: 36 bytes leftover after parsing attributes in process `syz.4.69'. [ 107.217013][ T10] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 107.260099][ T6156] netlink: 4 bytes leftover after parsing attributes in process `syz.3.71'. [ 107.361428][ T10] usb 1-1: device descriptor read/64, error -71 [ 107.482313][ T10] usb usb1-port1: attempt power cycle [ 107.896193][ T10] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 107.962125][ T10] usb 1-1: device descriptor read/8, error -71 [ 108.221576][ T10] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 108.313284][ T10] usb 1-1: device descriptor read/8, error -71 [ 108.421784][ T10] usb usb1-port1: unable to enumerate USB device [ 108.661429][ T10] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 108.701584][ T5933] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 108.725872][ T6184] FAULT_INJECTION: forcing a failure. [ 108.725872][ T6184] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 108.741121][ T6184] CPU: 0 UID: 0 PID: 6184 Comm: syz.4.81 Not tainted syzkaller #0 PREEMPT(full) [ 108.741150][ T6184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 108.741163][ T6184] Call Trace: [ 108.741171][ T6184] [ 108.741179][ T6184] dump_stack_lvl+0xe8/0x150 [ 108.741235][ T6184] should_fail_ex+0x412/0x560 [ 108.741313][ T6184] _copy_to_user+0x31/0xb0 [ 108.741338][ T6184] drm_ioctl+0x6da/0xb80 [ 108.741365][ T6184] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 108.741392][ T6184] ? __pfx_drm_ioctl+0x10/0x10 [ 108.741425][ T6184] ? __fget_files+0x2a/0x420 [ 108.741459][ T6184] ? bpf_lsm_file_ioctl+0x9/0x20 [ 108.741486][ T6184] ? __pfx_drm_ioctl+0x10/0x10 [ 108.741506][ T6184] __se_sys_ioctl+0xfc/0x170 [ 108.741534][ T6184] do_syscall_64+0x14d/0xf80 [ 108.741558][ T6184] ? trace_irq_disable+0x3b/0x150 [ 108.741576][ T6184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.741598][ T6184] ? clear_bhb_loop+0x40/0x90 [ 108.741622][ T6184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.741642][ T6184] RIP: 0033:0x7fd7cb79c799 [ 108.741662][ T6184] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.741678][ T6184] RSP: 002b:00007fd7cc5d3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 108.741700][ T6184] RAX: ffffffffffffffda RBX: 00007fd7cba15fa0 RCX: 00007fd7cb79c799 [ 108.741714][ T6184] RDX: 0000200000000240 RSI: 00000000c06864a2 RDI: 0000000000000003 [ 108.741727][ T6184] RBP: 00007fd7cc5d3090 R08: 0000000000000000 R09: 0000000000000000 [ 108.741738][ T6184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 108.741750][ T6184] R13: 00007fd7cba16038 R14: 00007fd7cba15fa0 R15: 00007fd7cbb3fa48 [ 108.741780][ T6184] [ 108.779330][ T6185] tipc: Started in network mode [ 108.897066][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 108.926497][ T5933] usb 2-1: Using ep0 maxpacket: 16 [ 108.944055][ T6185] tipc: Node identity , cluster identity 4711 [ 108.950475][ T6185] tipc: Failed to obtain node identity [ 108.960215][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 108.974250][ T6185] tipc: Enabling of bearer rejected, failed to enable media [ 108.983479][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 109.001614][ T5933] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 109.012697][ T10] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 109.012731][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.030042][ T10] usb 4-1: config 0 descriptor?? [ 109.052594][ T5933] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 109.075305][ T5933] usb 2-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 109.088978][ T5933] usb 2-1: config 0 interface 0 has no altsetting 0 [ 109.098278][ T5933] usb 2-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 109.109986][ T5933] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.140561][ T5933] usb 2-1: config 0 descriptor?? [ 109.497215][ T6170] Zero length message leads to an empty skb [ 109.529160][ T10] usbhid 4-1:0.0: can't add hid device: -71 [ 109.564299][ T10] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 109.565386][ T5933] hid (null): unknown global tag 0xd [ 109.586453][ T10] usb 4-1: USB disconnect, device number 8 [ 109.588069][ T5933] hid (null): global environment stack underflow [ 109.612932][ T5933] hid (null): unknown global tag 0xe [ 109.633911][ T5933] hid (null): unknown global tag 0xe [ 109.761556][ T5917] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 109.769891][ T6174] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 109.771174][ T6174] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 109.793307][ T6174] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 109.805762][ T6208] loop5: detected capacity change from 0 to 7 [ 109.812552][ T6174] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 109.840140][ T6208] Dev loop5: unable to read RDB block 7 [ 109.864901][ T6208] loop5: unable to read partition table [ 109.869580][ T10] usb 2-1: USB disconnect, device number 4 [ 109.899957][ T6208] loop5: partition table beyond EOD, truncated [ 109.923785][ T6208] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 109.935606][ T6211] capability: warning: `syz.0.91' uses 32-bit capabilities (legacy support in use) [ 109.962550][ T5917] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 109.979555][ T5917] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.991037][ T6213] FAULT_INJECTION: forcing a failure. [ 109.991037][ T6213] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 110.006812][ T5917] usb 5-1: Product: syz [ 110.012616][ T5917] usb 5-1: Manufacturer: syz [ 110.021720][ T5917] usb 5-1: SerialNumber: syz [ 110.028437][ T6213] CPU: 1 UID: 0 PID: 6213 Comm: syz.1.92 Not tainted syzkaller #0 PREEMPT(full) [ 110.028466][ T6213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 110.028478][ T6213] Call Trace: [ 110.028487][ T6213] [ 110.028495][ T6213] dump_stack_lvl+0xe8/0x150 [ 110.028531][ T6213] should_fail_ex+0x412/0x560 [ 110.028566][ T6213] _copy_to_user+0x31/0xb0 [ 110.028591][ T6213] simple_read_from_buffer+0xe1/0x170 [ 110.028627][ T6213] proc_fail_nth_read+0x1bb/0x230 [ 110.028659][ T6213] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 110.028692][ T6213] ? rw_verify_area+0x2a6/0x4d0 [ 110.028713][ T6213] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 110.028743][ T6213] vfs_read+0x20c/0xa70 [ 110.028763][ T6213] ? fdget_pos+0x246/0x320 [ 110.028786][ T6213] ? __pfx___mutex_lock+0x10/0x10 [ 110.028812][ T6213] ? __pfx_vfs_read+0x10/0x10 [ 110.028835][ T6213] ? __fget_files+0x2a/0x420 [ 110.028869][ T6213] ? __fget_files+0x3a0/0x420 [ 110.028898][ T6213] ? __fget_files+0x2a/0x420 [ 110.028938][ T6213] ksys_read+0x150/0x270 [ 110.028963][ T6213] ? __pfx_ksys_read+0x10/0x10 [ 110.028984][ T6213] ? __pfx_drm_ioctl+0x10/0x10 [ 110.029013][ T6213] do_syscall_64+0x14d/0xf80 [ 110.029037][ T6213] ? trace_irq_disable+0x3b/0x150 [ 110.029053][ T6213] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.029073][ T6213] ? clear_bhb_loop+0x40/0x90 [ 110.029098][ T6213] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.029126][ T6213] RIP: 0033:0x7fda8ab5cfce [ 110.029145][ T6213] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 110.029161][ T6213] RSP: 002b:00007fda8bab6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 110.029182][ T6213] RAX: ffffffffffffffda RBX: 00007fda8bab76c0 RCX: 00007fda8ab5cfce [ 110.029197][ T6213] RDX: 000000000000000f RSI: 00007fda8bab70a0 RDI: 0000000000000005 [ 110.029209][ T6213] RBP: 00007fda8bab7090 R08: 0000000000000000 R09: 0000000000000000 [ 110.029220][ T6213] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 110.029231][ T6213] R13: 00007fda8ae16038 R14: 00007fda8ae15fa0 R15: 00007fda8af3fa48 [ 110.029262][ T6213] [ 110.543609][ T6196] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 110.593632][ T6196] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 110.647050][ T6226] netlink: 136 bytes leftover after parsing attributes in process `syz.1.96'. [ 110.661342][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 110.710526][ T6196] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 110.830571][ T6196] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 110.977520][ T6196] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 111.011433][ T5916] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 111.066558][ T6196] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 111.128251][ T6196] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 111.174281][ T6196] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 111.204176][ T5916] usb 1-1: config 0 has an invalid interface number: 16 but max is 0 [ 111.242139][ T6196] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 111.256022][ T5916] usb 1-1: config 0 has no interface number 0 [ 111.282991][ T5916] usb 1-1: too many endpoints for config 0 interface 16 altsetting 144: 127, using maximum allowed: 30 [ 111.322039][ T6196] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 111.345151][ T5916] usb 1-1: config 0 interface 16 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 111.396038][ T5916] usb 1-1: config 0 interface 16 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 111.439493][ T5916] usb 1-1: config 0 interface 16 altsetting 144 has 1 endpoint descriptor, different from the interface descriptor's value: 127 [ 111.470851][ T5917] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 111.485575][ T5917] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 111.523870][ T5916] usb 1-1: config 0 interface 16 has no altsetting 0 [ 111.538308][ T5917] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 111.565679][ T5916] usb 1-1: New USB device found, idVendor=5543, idProduct=004d, bcdDevice= 0.00 [ 111.598335][ T5916] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.639158][ T5917] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 111.658281][ T5916] usb 1-1: config 0 descriptor?? [ 111.702199][ T5917] usb 5-1: USB disconnect, device number 4 [ 111.763190][ T6243] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 111.800959][ T6243] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 111.841890][ T30] audit: type=1326 audit(1774648465.754:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6232 comm="syz.1.99" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fda8ab9c799 code=0x0 [ 112.107109][ T6246] batadv0: entered promiscuous mode [ 112.122242][ T6246] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 112.296331][ T5916] uclogic 0003:5543:004D.0003: interface is invalid, ignoring [ 112.389718][ T30] audit: type=1326 audit(1774648466.304:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6247 comm="syz.2.103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 112.505408][ T30] audit: type=1326 audit(1774648466.364:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6247 comm="syz.2.103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 112.602049][ T6254] loop5: detected capacity change from 0 to 7 [ 112.623509][ T6254] Dev loop5: unable to read RDB block 7 [ 112.629162][ T6254] loop5: unable to read partition table [ 112.678727][ T30] audit: type=1326 audit(1774648466.364:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6247 comm="syz.2.103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 112.682130][ T6254] loop5: partition table beyond EOD, [ 112.748057][ T6250] netlink: 'syz.2.103': attribute type 3 has an invalid length. [ 112.824575][ T6254] truncated [ 112.828738][ T6254] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 112.858765][ T30] audit: type=1326 audit(1774648466.364:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6247 comm="syz.2.103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 112.962320][ T30] audit: type=1326 audit(1774648466.364:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6247 comm="syz.2.103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 113.066786][ T30] audit: type=1326 audit(1774648466.364:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6247 comm="syz.2.103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 113.267343][ T30] audit: type=1326 audit(1774648466.364:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6247 comm="syz.2.103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 113.364272][ T30] audit: type=1326 audit(1774648466.364:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6247 comm="syz.2.103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 113.444944][ T30] audit: type=1326 audit(1774648466.364:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6247 comm="syz.2.103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 113.914871][ T5917] usb 1-1: USB disconnect, device number 6 [ 113.992746][ T5828] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 114.049741][ T6271] Invalid logical block size (55998) [ 114.097516][ T6273] netlink: 'syz.0.112': attribute type 1 has an invalid length. [ 114.121689][ T5916] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 114.175639][ T6273] veth3: entered promiscuous mode [ 114.184061][ T5828] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 114.211608][ T5828] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 114.233504][ T5828] usb 2-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.01 [ 114.257414][ T5828] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.281800][ T5916] usb 4-1: Using ep0 maxpacket: 8 [ 114.299281][ T5916] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 114.311407][ T5828] usb 2-1: config 0 descriptor?? [ 114.327257][ T5916] usb 4-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 114.344507][ T6275] netlink: 16 bytes leftover after parsing attributes in process `syz.4.113'. [ 114.354426][ T5916] usb 4-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 114.372540][ T5916] usb 4-1: Product: syz [ 114.380235][ T5916] usb 4-1: Manufacturer: syz [ 114.408672][ T5916] usb 4-1: SerialNumber: syz [ 114.441446][ T10] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 114.530891][ T6265] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 114.556400][ T6265] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 114.591505][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 114.600018][ T10] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 114.630800][ T10] usb 1-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 114.664835][ T10] usb 1-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 114.677378][ T10] usb 1-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 114.691020][ T10] usb 1-1: config 7 interface 0 has no altsetting 0 [ 114.698317][ T10] usb 1-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 114.708176][ T5916] usb 4-1: Handspring Visor / Palm OS: No valid connect info available [ 114.721612][ T5916] usb 4-1: Handspring Visor / Palm OS: port 0, is for HotSync use [ 114.729828][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.738768][ T5916] usb 4-1: Handspring Visor / Palm OS: port 211, is for unknown use [ 114.760777][ T5916] usb 4-1: Handspring Visor / Palm OS: Number of ports: 2 [ 114.918062][ T5916] usb 4-1: palm_os_3_probe - error -71 getting bytes available request [ 114.947102][ T5916] visor 4-1:1.0: Handspring Visor / Palm OS converter detected [ 114.996474][ T5916] usb 4-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 115.077385][ T5916] usb 4-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 115.127768][ T5916] usb 4-1: USB disconnect, device number 9 [ 115.163033][ T5916] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 115.185656][ T6273] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.211891][ T6273] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.250841][ T10] hid (null): unknown global tag 0xd [ 115.258695][ T5916] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 115.300792][ T5916] visor 4-1:1.0: device disconnected [ 115.318373][ T6288] netlink: 16 bytes leftover after parsing attributes in process `syz.4.116'. [ 115.354681][ T10] input: HID 0458:5010 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:7.0/0003:0458:5010.0004/input/input8 [ 115.522016][ T10] kye 0003:0458:5010.0004: input,hiddev0,hidraw0: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.0-1/input0 [ 115.544007][ T5828] usbhid 2-1:0.0: can't add hid device: -71 [ 115.552405][ T5828] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 115.619095][ T6296] loop7: detected capacity change from 0 to 16384 [ 115.630440][ T5828] usb 2-1: USB disconnect, device number 5 [ 115.814844][ T6276] macvlan0: entered promiscuous mode [ 115.820517][ T6276] macvlan0: entered allmulticast mode [ 115.861483][ T6276] veth1_vlan: entered allmulticast mode [ 115.870755][ T10] usb 1-1: USB disconnect, device number 7 [ 115.990422][ T6300] loop7: detected capacity change from 16384 to 16383 [ 116.061883][ T6305] netlink: 8 bytes leftover after parsing attributes in process `syz.2.119'. [ 116.089722][ T6305] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 116.111875][ T6305] bridge0: entered allmulticast mode [ 116.142284][ T6305] netlink: 4 bytes leftover after parsing attributes in process `syz.2.119'. [ 116.157400][ T6306] netlink: 8 bytes leftover after parsing attributes in process `syz.2.119'. [ 116.214407][ T6306] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 116.244713][ T6306] bridge1: entered allmulticast mode [ 116.594569][ T6314] Invalid logical block size (61183) [ 116.652901][ T6318] fuse: Bad value for 'fd' [ 116.972745][ T6324] hub 9-0:1.0: USB hub found [ 117.006687][ T6324] hub 9-0:1.0: 1 port detected [ 117.740804][ T5902] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 117.831324][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 117.992645][ T5902] usb 1-1: Using ep0 maxpacket: 8 [ 118.019994][ T5902] usb 1-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 118.033325][ T5902] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.048445][ T5902] usb 1-1: Product: syz [ 118.052950][ T5902] usb 1-1: Manufacturer: syz [ 118.058080][ T5902] usb 1-1: SerialNumber: syz [ 118.102424][ T5902] usb 1-1: config 0 descriptor?? [ 118.120826][ T5902] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 118.129819][ T5902] pctv452e: pctv452e_power_ctrl: 1 [ 118.129819][ T5902] [ 118.161102][ T5902] usb 1-1: selecting invalid altsetting 3 [ 118.187915][ T5902] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 118.187915][ T5902] [ 118.231716][ T5902] dvb-usb: bulk message failed: -22 (5/0) [ 118.355161][ T6339] netlink: 68 bytes leftover after parsing attributes in process `syz.0.127'. [ 118.480947][ T5902] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 118.530630][ T5902] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 118.571601][ T5902] usb 1-1: media controller created [ 118.584183][ T5902] dvb-usb: bulk message failed: -22 (8/0) [ 118.652107][ T5902] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 118.666569][ T5902] dvb-usb: MAC address reading failed. [ 118.734144][ T5902] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 118.803637][ T10] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 119.010580][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 119.077749][ T5902] DVB: Unable to find symbol stb0899_attach() [ 119.087947][ T10] usb 2-1: config index 0 descriptor too short (expected 30, got 18) [ 119.173762][ T10] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 119.185385][ T5902] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 119.200153][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.227490][ T10] usb 2-1: Product: syz [ 119.247122][ T10] usb 2-1: Manufacturer: syz [ 119.267524][ T10] usb 2-1: SerialNumber: syz [ 119.379767][ T10] usb 2-1: config 0 descriptor?? [ 119.406730][ T10] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 119.429769][ T10] usb 2-1: setting power ON [ 119.448194][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 119.471424][ T5902] rc_core: IR keymap rc-tt-1500 not found [ 119.478429][ T5902] Registered IR keymap rc-empty [ 119.485537][ T916] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 119.501609][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 119.524746][ T5902] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 119.550702][ T10] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 119.581257][ T5902] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input9 [ 119.603678][ T10] usb 2-1: media controller created [ 119.679232][ T6348] netlink: 4 bytes leftover after parsing attributes in process `syz.1.130'. [ 119.704769][ T5902] dvb-usb: schedule remote query interval to 100 msecs. [ 119.720674][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 119.738797][ T5902] pctv452e: pctv452e_power_ctrl: 0 [ 119.738797][ T5902] [ 119.767955][ T5902] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 119.839621][ T10] usb 2-1: selecting invalid altsetting 6 [ 119.847554][ T5902] dvb-usb: bulk message failed: -22 (4/0) [ 119.859166][ T5902] dvb-usb: error -22 while querying for an remote control event. [ 119.882330][ T10] usb 2-1: digital interface selection failed (-22) [ 119.905060][ T10] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 119.932608][ T10] usb 2-1: setting power OFF [ 119.940993][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 119.988287][ T10] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 120.012244][ T5902] dvb-usb: bulk message failed: -22 (4/0) [ 120.025749][ T10] (NULL device *): no alternate interface [ 120.035090][ T5902] dvb-usb: error -22 while querying for an remote control event. [ 120.139783][ T10] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 120.168004][ T6362] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 120.212088][ T5902] dvb-usb: bulk message failed: -22 (4/0) [ 120.219162][ T5902] dvb-usb: error -22 while querying for an remote control event. [ 120.237624][ T10] usb 2-1: USB disconnect, device number 6 [ 120.249657][ T6362] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 120.364137][ T5902] usb 1-1: USB disconnect, device number 8 [ 120.419701][ T5916] dvb-usb: bulk message failed: -22 (4/0) [ 120.428132][ T5916] dvb-usb: error -22 while querying for an remote control event. [ 120.568022][ T5902] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 120.601828][ T916] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 120.751984][ T5917] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 120.761540][ T916] usb 5-1: Using ep0 maxpacket: 32 [ 120.768764][ T916] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 120.783706][ T916] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 120.826120][ T916] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 120.835811][ T916] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.316592][ T916] usb 5-1: config 0 descriptor?? [ 121.326566][ T916] hub 5-1:0.0: USB hub found [ 121.335285][ T5917] usb 3-1: Using ep0 maxpacket: 16 [ 121.347311][ T5917] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 121.369082][ T5917] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 121.383277][ T5917] usb 3-1: config 0 has no interface number 0 [ 121.390141][ T5917] usb 3-1: New USB device found, idVendor=0bd3, idProduct=0555, bcdDevice= 0.5b [ 121.400231][ T5917] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.441242][ T5917] usb 3-1: config 0 descriptor?? [ 121.451423][ T5932] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 121.479435][ T5917] uvcvideo 3-1:0.64: probe with driver uvcvideo failed with error -22 [ 121.525405][ T916] hub 5-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 121.622679][ T5932] usb 2-1: Using ep0 maxpacket: 8 [ 121.638110][ T5932] usb 2-1: too many endpoints for config 0 interface 0 altsetting 33: 193, using maximum allowed: 30 [ 121.674183][ T5932] usb 2-1: config 0 interface 0 altsetting 33 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 121.685541][ T5932] usb 2-1: config 0 interface 0 altsetting 33 endpoint 0x81 has invalid wMaxPacketSize 0 [ 121.704610][ T5917] usb 3-1: USB disconnect, device number 5 [ 121.730089][ T5932] usb 2-1: config 0 interface 0 altsetting 33 has 1 endpoint descriptor, different from the interface descriptor's value: 193 [ 121.780978][ T5932] usb 2-1: config 0 interface 0 has no altsetting 0 [ 121.791136][ T5932] usb 2-1: New USB device found, idVendor=056a, idProduct=010e, bcdDevice= 0.00 [ 121.815657][ T5932] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.848236][ T5932] usb 2-1: config 0 descriptor?? [ 121.932603][ T916] hid-generic 0003:046D:C31C.0005: unknown main item tag 0x0 [ 121.971824][ T916] hid-generic 0003:046D:C31C.0005: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.4-1/input0 [ 122.210071][ T6392] binder: 6386:6392 ioctl c0306201 0 returned -14 [ 122.271729][ T5932] wacom 0003:056A:010E.0006: unbalanced collection at end of report description [ 122.296656][ T5932] wacom 0003:056A:010E.0006: parse failed [ 122.301746][ T916] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 122.311913][ T5932] wacom 0003:056A:010E.0006: probe with driver wacom failed with error -22 [ 122.472153][ T916] usb 4-1: Using ep0 maxpacket: 16 [ 122.487940][ T916] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 122.507726][ T916] usb 4-1: config 0 has no interface number 0 [ 122.517494][ T916] usb 4-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 122.527321][ T916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.536365][ T916] usb 4-1: Product: syz [ 122.540751][ T916] usb 4-1: Manufacturer: syz [ 122.546633][ T916] usb 4-1: SerialNumber: syz [ 122.562922][ T916] usb 4-1: config 0 descriptor?? [ 122.577659][ T916] hub 4-1:0.132: bad descriptor, ignoring hub [ 122.584214][ T916] hub 4-1:0.132: probe with driver hub failed with error -5 [ 122.594463][ T916] usbhid 4-1:0.132: couldn't find an input interrupt endpoint [ 122.887657][ T916] usb 2-1: USB disconnect, device number 7 [ 123.834685][ T6419] syz_tun: entered promiscuous mode [ 124.665679][ T916] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 124.881352][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 125.919016][ T5916] usb 5-1: USB disconnect, device number 6 [ 126.229848][ T916] usb 4-1: USB disconnect, device number 10 [ 127.034034][ T9] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 127.223513][ T9] usb 1-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 127.251997][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 127.286143][ T9] usb 1-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 127.303108][ T6494] syzkaller0: entered promiscuous mode [ 127.312154][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.330674][ T9] usb 1-1: Product: syz [ 127.340677][ T6494] syzkaller0: entered allmulticast mode [ 127.340692][ T9] usb 1-1: Manufacturer: syz [ 127.340710][ T9] usb 1-1: SerialNumber: syz [ 127.411517][ T5916] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 127.450163][ T9] usb 1-1: config 0 descriptor?? [ 127.459972][ T9] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 127.591726][ T5916] usb 2-1: Using ep0 maxpacket: 16 [ 127.598942][ T5916] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 127.629586][ T5916] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 127.660139][ T30] kauditd_printk_skb: 23 callbacks suppressed [ 127.660154][ T30] audit: type=1326 audit(1774648481.574:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.0.154" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc77739c799 code=0x7ffc0000 [ 127.699399][ T5916] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 127.724369][ T5916] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 127.740224][ T5916] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.749227][ T30] audit: type=1326 audit(1774648481.574:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.0.154" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc77739c799 code=0x7ffc0000 [ 127.757101][ T5916] usb 2-1: Product: syz [ 127.851393][ T30] audit: type=1326 audit(1774648481.574:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.0.154" exe="/root/syz-executor" sig=0 arch=c000003e syscall=327 compat=0 ip=0x7fc77739c799 code=0x7ffc0000 [ 127.911746][ T5916] usb 2-1: Manufacturer: syz [ 127.931447][ T30] audit: type=1326 audit(1774648481.574:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.0.154" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc77739c799 code=0x7ffc0000 [ 127.956030][ T30] audit: type=1326 audit(1774648481.574:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.0.154" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc77739c799 code=0x7ffc0000 [ 127.980614][ T30] audit: type=1326 audit(1774648481.874:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.0.154" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fc77739c42b code=0x7ffc0000 [ 128.011560][ T5916] usb 2-1: SerialNumber: syz [ 128.021929][ T30] audit: type=1326 audit(1774648481.874:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.0.154" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fc77739c42b code=0x7ffc0000 [ 128.092921][ T30] audit: type=1326 audit(1774648481.874:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.0.154" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc77735cfce code=0x7ffc0000 [ 128.181530][ T30] audit: type=1326 audit(1774648482.074:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.0.154" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc77739c799 code=0x7ffc0000 [ 128.244656][ T9] gspca_sunplus: reg_r err -71 [ 128.249680][ T9] sunplus 1-1:0.0: probe with driver sunplus failed with error -71 [ 128.260236][ T30] audit: type=1326 audit(1774648482.074:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6478 comm="syz.0.154" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fc77739c42b code=0x7ffc0000 [ 128.307027][ T9] usb 1-1: USB disconnect, device number 9 [ 128.559963][ T5916] usb 2-1: 0:2 : does not exist [ 128.671349][ T0] NOHZ tick-stop error: local softirq work is pending, handler #280!!! [ 128.712603][ T916] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 129.042500][ T916] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 129.068828][ T916] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 129.131492][ T916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 129.157667][ T916] usb 4-1: Product: syz [ 129.163047][ T916] usb 4-1: Manufacturer: syz [ 129.167843][ T916] usb 4-1: SerialNumber: syz [ 129.433600][ T6485] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.452438][ T6485] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.693939][ T916] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 11 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 129.957638][ C1] usblp0: nonzero write bulk status received: -71 [ 130.179116][ T5917] usb 4-1: USB disconnect, device number 11 [ 130.189282][ T5917] usblp0: removed [ 130.521432][ T5916] usb 2-1: USB disconnect, device number 9 [ 131.022481][ T5916] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 131.217863][ T5916] usb 2-1: Using ep0 maxpacket: 16 [ 131.229943][ T5916] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 131.238461][ T5916] usb 2-1: config 0 has no interface number 0 [ 131.262180][ T5916] usb 2-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 131.271698][ T5916] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.281724][ T5916] usb 2-1: Product: syz [ 131.287188][ T5916] usb 2-1: Manufacturer: syz [ 131.294953][ T5916] usb 2-1: SerialNumber: syz [ 131.314901][ T5916] usb 2-1: config 0 descriptor?? [ 131.335729][ T5916] hub 2-1:0.132: bad descriptor, ignoring hub [ 131.350973][ T5916] hub 2-1:0.132: probe with driver hub failed with error -5 [ 131.371267][ T5916] usbhid 2-1:0.132: couldn't find an input interrupt endpoint [ 131.614858][ T6524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 131.644855][ T6525] binder: 6523:6525 ioctl c0306201 0 returned -14 [ 131.707839][ T6524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.243846][ T6530] syzkaller0: entered promiscuous mode [ 132.253813][ T6530] syzkaller0: entered allmulticast mode [ 133.141916][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.148519][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.659605][ T30] audit: type=1326 audit(1774648487.574:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6555 comm="syz.2.173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 133.837994][ T30] audit: type=1326 audit(1774648487.604:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6555 comm="syz.2.173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 133.981525][ T30] audit: type=1326 audit(1774648487.604:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6555 comm="syz.2.173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 134.021391][ T5917] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 134.069159][ T30] audit: type=1326 audit(1774648487.604:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6555 comm="syz.2.173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 134.155924][ T30] audit: type=1326 audit(1774648487.604:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6555 comm="syz.2.173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 134.221138][ T30] audit: type=1326 audit(1774648487.604:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6555 comm="syz.2.173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 134.221592][ T5917] usb 4-1: Using ep0 maxpacket: 8 [ 134.330737][ T30] audit: type=1326 audit(1774648487.604:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6555 comm="syz.2.173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 134.376216][ T5917] usb 4-1: unable to get BOS descriptor or descriptor too short [ 134.411490][ T30] audit: type=1326 audit(1774648487.604:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6555 comm="syz.2.173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 134.436750][ T5917] usb 4-1: config 6 has an invalid interface number: 184 but max is 0 [ 134.446963][ T5917] usb 4-1: config 6 has no interface number 0 [ 134.461403][ T5917] usb 4-1: config 6 interface 184 has no altsetting 0 [ 134.483422][ T5917] usb 4-1: New USB device found, idVendor=2dee, idProduct=4d22, bcdDevice=8c.fd [ 134.501487][ T5917] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.509728][ T30] audit: type=1326 audit(1774648487.604:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6555 comm="syz.2.173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 134.543649][ T5917] usb 4-1: Manufacturer: 뛮꼰ད෶廣뿖㏁䕠᪔핃ஐ覥䊧⢙㭳א쬇汔毰O䶐⺚ﴔ嵢鵢᥺Ɱఏ鄼涉霚ʴ✃땗慗쉋୽ꔹꋄז酥㾁ͻ煦喓ዥ啞飄뭤耊⩥믁䜕鋔ꭁ뿌䔙죎樀岥剢慠᫋諣䅤㖄葔廱䊴턯垔ꁯ펷ᗕ薑贿沆뺞쏮렗㨆搤鷣ﹽ䋇።칽顰넏ෑ㋎㝎騈彼慫헄깃햬갰쵞쑯 [ 134.596868][ T30] audit: type=1326 audit(1774648487.784:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6555 comm="syz.2.173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 134.637806][ T5917] usb 4-1: SerialNumber: 㐊 [ 134.888354][ T5917] option 4-1:6.184: GSM modem (1-port) converter detected [ 134.938292][ T5917] usb 4-1: USB disconnect, device number 12 [ 134.967995][ T5917] option 4-1:6.184: device disconnected [ 135.292883][ T6580] netlink: 'syz.2.178': attribute type 1 has an invalid length. [ 136.035143][ T916] usb 2-1: USB disconnect, device number 10 [ 136.184488][ T6593] FAULT_INJECTION: forcing a failure. [ 136.184488][ T6593] name failslab, interval 1, probability 0, space 0, times 0 [ 136.264940][ T6593] CPU: 0 UID: 0 PID: 6593 Comm: syz.2.182 Not tainted syzkaller #0 PREEMPT(full) [ 136.264971][ T6593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 136.264984][ T6593] Call Trace: [ 136.264992][ T6593] [ 136.265001][ T6593] dump_stack_lvl+0xe8/0x150 [ 136.265043][ T6593] should_fail_ex+0x412/0x560 [ 136.265078][ T6593] should_failslab+0xa8/0x100 [ 136.265105][ T6593] ? alloc_empty_file+0x55/0x1d0 [ 136.265134][ T6593] kmem_cache_alloc_noprof+0x87/0x650 [ 136.265154][ T6593] ? is_bpf_text_address+0x292/0x2b0 [ 136.265184][ T6593] alloc_empty_file+0x55/0x1d0 [ 136.265215][ T6593] path_openat+0x10f/0x3860 [ 136.265236][ T6593] ? arch_stack_walk+0xfb/0x150 [ 136.265282][ T6593] ? do_getname+0x2e/0x250 [ 136.265309][ T6593] ? stack_trace_save+0xa9/0x100 [ 136.265331][ T6593] ? __pfx_stack_trace_save+0x10/0x10 [ 136.265352][ T6593] ? do_getname+0x2e/0x250 [ 136.265379][ T6593] ? stack_depot_save_flags+0x33/0x810 [ 136.265411][ T6593] ? do_getname+0x2e/0x250 [ 136.265439][ T6593] ? kasan_save_track+0x4f/0x80 [ 136.265459][ T6593] ? kasan_save_track+0x3e/0x80 [ 136.265479][ T6593] ? __kasan_slab_alloc+0x6c/0x80 [ 136.265502][ T6593] ? __pfx_path_openat+0x10/0x10 [ 136.265522][ T6593] ? __x64_sys_openat+0x138/0x170 [ 136.265552][ T6593] ? do_syscall_64+0x14d/0xf80 [ 136.265575][ T6593] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.265604][ T6593] ? __lock_acquire+0x6b5/0x2cf0 [ 136.265637][ T6593] do_file_open+0x23e/0x4a0 [ 136.265666][ T6593] ? __pfx_do_file_open+0x10/0x10 [ 136.265710][ T6593] ? _raw_spin_unlock+0x28/0x50 [ 136.265730][ T6593] ? alloc_fd+0x64b/0x6c0 [ 136.265769][ T6593] do_sys_openat2+0x113/0x200 [ 136.265803][ T6593] ? __pfx_do_sys_openat2+0x10/0x10 [ 136.265832][ T6593] ? exc_page_fault+0x6a/0xc0 [ 136.265859][ T6593] ? do_user_addr_fault+0xc6f/0x1340 [ 136.265888][ T6593] __x64_sys_openat+0x138/0x170 [ 136.265923][ T6593] do_syscall_64+0x14d/0xf80 [ 136.265946][ T6593] ? trace_irq_disable+0x3b/0x150 [ 136.265963][ T6593] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.265984][ T6593] ? clear_bhb_loop+0x40/0x90 [ 136.266008][ T6593] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.266029][ T6593] RIP: 0033:0x7f261b15cfce [ 136.266058][ T6593] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 136.266074][ T6593] RSP: 002b:00007f261bf75ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 136.266102][ T6593] RAX: ffffffffffffffda RBX: 00007f261bf786c0 RCX: 00007f261b15cfce [ 136.266121][ T6593] RDX: 0000000000000002 RSI: 00007f261b231f90 RDI: ffffffffffffff9c [ 136.266133][ T6593] RBP: 00007f261bf78090 R08: 0000000000000000 R09: 0000000000000000 [ 136.266145][ T6593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000024 [ 136.266157][ T6593] R13: 0000200000003040 R14: 0000000000000003 R15: 00007f261b53fa48 [ 136.266187][ T6593] [ 137.981763][ T6611] netlink: 752 bytes leftover after parsing attributes in process `syz.4.188'. [ 138.592592][ T5828] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 138.811707][ T5828] usb 3-1: Using ep0 maxpacket: 8 [ 138.833051][ T5828] usb 3-1: unable to get BOS descriptor or descriptor too short [ 138.842217][ T5828] usb 3-1: config 6 has an invalid interface number: 184 but max is 0 [ 138.850446][ T5828] usb 3-1: config 6 has no interface number 0 [ 138.861682][ T5828] usb 3-1: config 6 interface 184 has no altsetting 0 [ 138.880562][ T5828] usb 3-1: New USB device found, idVendor=2dee, idProduct=4d22, bcdDevice=8c.fd [ 138.890112][ T5828] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.908899][ T5828] usb 3-1: Manufacturer: 뛮꼰ད෶廣뿖㏁䕠᪔핃ஐ覥䊧⢙㭳א쬇汔毰O䶐⺚ﴔ嵢鵢᥺Ɱఏ鄼涉霚ʴ✃땗慗쉋୽ꔹꋄז酥㾁ͻ煦喓ዥ啞飄뭤耊⩥믁䜕鋔ꭁ뿌䔙죎樀岥剢慠᫋諣䅤㖄葔廱䊴턯垔ꁯ펷ᗕ薑贿沆뺞쏮렗㨆搤鷣ﹽ䋇።칽顰넏ෑ㋎㝎騈彼慫헄깃햬갰쵞쑯 [ 138.950009][ T5828] usb 3-1: SerialNumber: 㐊 [ 139.031512][ T5933] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 139.191786][ T5933] usb 5-1: Using ep0 maxpacket: 16 [ 139.205148][ T5933] usb 5-1: config 0 has an invalid interface number: 132 but max is 0 [ 139.218189][ T5828] option 3-1:6.184: GSM modem (1-port) converter detected [ 139.231537][ T5933] usb 5-1: config 0 has no interface number 0 [ 139.257653][ T5933] usb 5-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 139.273862][ T5828] usb 3-1: USB disconnect, device number 6 [ 139.288617][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.305056][ T5828] option 3-1:6.184: device disconnected [ 139.325953][ T5933] usb 5-1: Product: syz [ 139.330253][ T5933] usb 5-1: Manufacturer: syz [ 139.369992][ T5933] usb 5-1: SerialNumber: syz [ 139.388999][ T5933] usb 5-1: config 0 descriptor?? [ 139.410583][ T5933] hub 5-1:0.132: bad descriptor, ignoring hub [ 139.425124][ T5933] hub 5-1:0.132: probe with driver hub failed with error -5 [ 139.439414][ T5933] usbhid 5-1:0.132: couldn't find an input interrupt endpoint [ 139.741981][ T5916] usb 5-1: USB disconnect, device number 7 [ 139.870729][ T6633] netlink: 'syz.3.195': attribute type 1 has an invalid length. [ 139.885711][ T6629] netlink: 8 bytes leftover after parsing attributes in process `syz.0.194'. [ 139.900143][ T6629] netlink: 24 bytes leftover after parsing attributes in process `syz.0.194'. [ 139.934090][ T6635] netlink: 188 bytes leftover after parsing attributes in process `syz.3.195'. [ 139.950603][ T6633] bond1: entered promiscuous mode [ 139.996945][ T6633] 8021q: adding VLAN 0 to HW filter on device bond1 [ 140.251484][ T5828] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 140.401368][ T5828] usb 4-1: device descriptor read/64, error -71 [ 140.421253][ T5932] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 140.583238][ T5933] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 140.611372][ T5932] usb 2-1: Using ep0 maxpacket: 16 [ 140.623324][ T5932] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 140.639047][ T5932] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 140.651452][ T5828] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 140.675597][ T5932] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 140.690330][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 140.719522][ T5932] usb 2-1: Product: syz [ 140.723874][ T5932] usb 2-1: Manufacturer: syz [ 140.728517][ T5932] usb 2-1: SerialNumber: syz [ 140.739486][ T5932] usb 2-1: config 0 descriptor?? [ 140.754811][ T5933] usb 5-1: Using ep0 maxpacket: 16 [ 140.771829][ T5932] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 140.802501][ T5932] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 140.810061][ T5933] usb 5-1: unable to get BOS descriptor or descriptor too short [ 140.818389][ T5828] usb 4-1: device descriptor read/64, error -71 [ 140.829824][ T5933] usb 5-1: New USB device found, idVendor=0e41, idProduct=4249, bcdDevice= 0.40 [ 140.849251][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 140.859326][ T5933] usb 5-1: Product: syz [ 140.869454][ T5933] usb 5-1: Manufacturer: syz [ 140.877270][ T5933] usb 5-1: SerialNumber: syz [ 140.933843][ T5828] usb usb4-port1: attempt power cycle [ 141.140413][ T5933] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 141.149450][ T5933] usb 5-1: 2:0: failed to get current value for ch 0 (-71) [ 141.157581][ T5933] usb 5-1: unit 7 not found! [ 141.282296][ T5828] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 141.302672][ T5828] usb 4-1: device descriptor read/8, error -71 [ 141.431091][ T5933] usb 5-1: USB disconnect, device number 8 [ 141.541676][ T5828] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 141.562977][ T5828] usb 4-1: device descriptor read/8, error -71 [ 141.611403][ T5916] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 141.685601][ T5828] usb usb4-port1: unable to enumerate USB device [ 141.764342][ T5916] usb 3-1: device descriptor read/64, error -71 [ 141.984037][ T5932] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 142.050918][ T5932] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 142.059292][ T5932] em28xx 2-1:0.0: AC97 chip type couldn't be determined [ 142.079588][ T5932] em28xx 2-1:0.0: No AC97 audio processor [ 142.101773][ T5916] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 142.412343][ T5916] usb 3-1: device descriptor read/64, error -71 [ 142.521658][ T5916] usb usb3-port1: attempt power cycle [ 142.961597][ T5916] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 143.126799][ T5916] usb 3-1: device descriptor read/8, error -71 [ 143.375569][ T5916] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 143.424813][ T5916] usb 3-1: device descriptor read/8, error -71 [ 143.550724][ T5916] usb usb3-port1: unable to enumerate USB device [ 143.665596][ T5916] usb 2-1: USB disconnect, device number 11 [ 143.681696][ T5916] em28xx 2-1:0.0: Disconnecting em28xx [ 143.699975][ T5916] em28xx 2-1:0.0: Freeing device [ 144.169145][ T6686] input: syz1 as /devices/virtual/input/input10 [ 144.641422][ T5902] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 144.845957][ T5902] usb 4-1: Using ep0 maxpacket: 8 [ 144.875036][ T5902] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 144.905344][ T5902] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 145.044453][ T5902] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 145.061384][ T5902] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 145.106770][ T5902] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 145.220190][ T5902] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.468249][ T5902] usb 4-1: GET_CAPABILITIES returned 0 [ 145.474196][ T5902] usbtmc 4-1:16.0: can't read capabilities [ 145.683085][ T5932] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 145.714391][ T5902] usb 4-1: USB disconnect, device number 17 [ 145.863631][ T5932] usb 3-1: not running at top speed; connect to a high speed hub [ 145.901641][ T5932] usb 3-1: config 3 has an invalid interface number: 131 but max is 1 [ 146.056801][ T5932] usb 3-1: config 3 has an invalid interface number: 66 but max is 1 [ 146.137699][ T5932] usb 3-1: config 3 contains an unexpected descriptor of type 0x2, skipping [ 146.167049][ T5932] usb 3-1: config 3 has an invalid descriptor of length 204, skipping remainder of the config [ 146.201630][ T5932] usb 3-1: config 3 has no interface number 0 [ 146.223623][ T5932] usb 3-1: config 3 has no interface number 1 [ 146.250215][ T5932] usb 3-1: config 3 interface 66 altsetting 64 has an invalid descriptor for endpoint zero, skipping [ 146.290051][ T5932] usb 3-1: config 3 interface 66 altsetting 64 has an invalid descriptor for endpoint zero, skipping [ 146.326614][ T5932] usb 3-1: config 3 interface 66 altsetting 64 has 5 endpoint descriptors, different from the interface descriptor's value: 11 [ 146.398885][ T5932] usb 3-1: config 3 interface 131 has no altsetting 0 [ 146.426314][ T5932] usb 3-1: config 3 interface 66 has no altsetting 0 [ 146.447599][ T5932] usb 3-1: New USB device found, idVendor=12d1, idProduct=9b2f, bcdDevice=60.05 [ 146.464818][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 146.486039][ T5932] usb 3-1: Product: 臧♒益迻ᎀ掜ꀂ잟䵘Ⱏ鞼⸐ﴊ沪㶹嶸㊡뙒⩳栍圅뙤⵷캋膚⢊楟抃搅봎愆ꛕ濟⛨忬栦郛⁩翮燦┙丟㳊疃ε钿㳺돩闒䖡磦莥ÂԪ묐鳌䲲⹢ꘌ穮駵壮㣅黒✹뻩㶹闲쩸嫉젇턓힟뺺㣐ࡪ㑸遫먋㨷⏉幍㮐盲렾 [ 146.630898][ T5932] usb 3-1: Manufacturer: 觙뱄鈎﮵嶦໹ꪙ⟟䴕≄ㅿ槉淸຿ᬰ륒댂⴯ｴ䧳ġ縖瀝㨿鉫錉䥃庹뾭쓶慃ﰉ⹨︊ᑑ눵䳟먚䱜၎佤묤꼇⣣冟迖軲敻꼇啿쨘봜戧䛭儥ㆵ皕珹企湱ᙒ契屠[穒돰⎟㰵⋾퀲芟圡燣컽㉩䠽䧮ᘵ૝바沑䒊뙂﨏ᄽ䄷鑽鬇雈㒫虔㬾걙▛覍⟲榃 [ 146.735895][ T5932] usb 3-1: SerialNumber: ᴲ얋쑘ყ鴾ᇒ䑾ﯙϯ익ㄐ꺂턧쳈ꋝ콓蚅놣芴弽쏸倏슴灡顔叽觋돷㼗灂겱经㪀儋ࡳ [ 147.013909][ T6714] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.025742][ T6714] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.054725][ T5932] option 3-1:3.131: GSM modem (1-port) converter detected [ 147.095550][ T5932] usb 3-1: USB disconnect, device number 11 [ 147.162414][ T5828] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 147.192705][ T6744] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 147.204871][ T5932] option 3-1:3.131: device disconnected [ 147.296125][ T6744] tipc: Started in network mode [ 147.312952][ T6744] tipc: Node identity 4a66c0f4c1dc, cluster identity 4711 [ 147.331813][ T5828] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 147.348677][ T6744] tipc: Enabled bearer , priority 0 [ 147.373127][ T5828] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 147.404708][ T5828] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 147.423465][ T6744] syzkaller0: entered promiscuous mode [ 147.488366][ T6744] syzkaller0: entered allmulticast mode [ 147.637257][ T6744] tipc: Resetting bearer [ 147.681551][ T5828] usb 5-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 147.818471][ T5828] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.833531][ T6743] tipc: Resetting bearer [ 147.900203][ T5828] usb 5-1: config 0 descriptor?? [ 148.012228][ T6743] tipc: Disabling bearer [ 148.390921][ T6740] tipc: Enabling of bearer rejected, failed to enable media [ 148.410624][ T6740] syzkaller0: entered promiscuous mode [ 148.430121][ T6740] syzkaller0: entered allmulticast mode [ 149.341457][ T5917] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 149.514950][ T5917] usb 3-1: Using ep0 maxpacket: 32 [ 149.526502][ T5917] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 149.551487][ T5917] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 149.567722][ T5917] usb 3-1: too many endpoints for config 0 interface 0 altsetting 5: 69, using maximum allowed: 30 [ 149.593836][ T5828] usbhid 5-1:0.0: can't add hid device: -71 [ 149.600905][ T5828] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 149.620657][ T5917] usb 3-1: config 0 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 69 [ 149.653822][ T5828] usb 5-1: USB disconnect, device number 9 [ 149.703540][ T5917] usb 3-1: config 0 interface 0 has no altsetting 0 [ 149.722859][ T5917] usb 3-1: New USB device found, idVendor=152d, idProduct=0539, bcdDevice= 0.00 [ 149.733750][ T5917] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 149.755409][ T5917] usb 3-1: SerialNumber: syz [ 149.762993][ T5917] usb 3-1: config 0 descriptor?? [ 149.977016][ T6765] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 149.997477][ T6765] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 150.020355][ T5917] usb-storage 3-1:0.0: USB Mass Storage device detected [ 150.048190][ T5917] usb-storage 3-1:0.0: Quirks match for vid 152d pid 0539: 4000000 [ 150.149628][ T5828] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 150.166354][ T5917] usb 3-1: USB disconnect, device number 12 [ 150.333040][ T5828] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 150.348474][ T5828] usb 1-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 150.359451][ T5828] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.371261][ T5828] usb 1-1: Product: syz [ 150.378745][ T5828] usb 1-1: Manufacturer: syz [ 150.391041][ T5828] usb 1-1: SerialNumber: syz [ 150.425594][ T5828] usb 1-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 150.755543][ T6788] syzkaller0: entered promiscuous mode [ 150.774824][ T6788] syzkaller0: entered allmulticast mode [ 150.913798][ T5828] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 150.935425][ T5828] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 150.984878][ T5828] usb 1-1: media controller created [ 151.072316][ T5828] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 151.321410][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 151.321431][ T30] audit: type=1326 audit(1774648505.234:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6792 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 151.439926][ T30] audit: type=1326 audit(1774648505.234:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6792 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 151.514752][ T30] audit: type=1326 audit(1774648505.274:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6792 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=260 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 151.567732][ T5828] usb 1-1: USB disconnect, device number 10 [ 151.638962][ T30] audit: type=1326 audit(1774648505.274:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6792 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 151.711427][ T916] usb 3-1: new low-speed USB device number 13 using dummy_hcd [ 151.737509][ T30] audit: type=1326 audit(1774648505.274:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6792 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 151.760783][ T30] audit: type=1326 audit(1774648505.274:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6792 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 151.871456][ T916] usb 3-1: Invalid ep0 maxpacket: 32 [ 151.871551][ T6807] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 151.883602][ T6807] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 151.899514][ T30] audit: type=1326 audit(1774648505.274:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6792 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 151.935242][ T6807] vhci_hcd vhci_hcd.0: Device attached [ 151.950547][ T30] audit: type=1326 audit(1774648505.274:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6792 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 151.975276][ T5828] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 152.001423][ T916] usb 3-1: new low-speed USB device number 14 using dummy_hcd [ 152.011479][ T30] audit: type=1326 audit(1774648505.274:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6792 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 152.052864][ T30] audit: type=1326 audit(1774648505.274:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6792 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f261b19c799 code=0x7ffc0000 [ 152.171790][ T5916] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 152.183718][ T5828] usb 1-1: Using ep0 maxpacket: 8 [ 152.193131][ T916] usb 3-1: Invalid ep0 maxpacket: 32 [ 152.201017][ T916] usb usb3-port1: attempt power cycle [ 152.243010][ T5916] usb 39-1: new full-speed USB device number 2 using vhci_hcd [ 152.414608][ T6820] syzkaller0: entered promiscuous mode [ 152.432786][ T6820] syzkaller0: entered allmulticast mode [ 152.621417][ T916] usb 3-1: new low-speed USB device number 15 using dummy_hcd [ 152.651011][ T916] usb 3-1: Invalid ep0 maxpacket: 32 [ 152.730656][ T6808] vhci_hcd: connection reset by peer [ 152.739563][ T6453] vhci_hcd vhci_hcd.3: stop threads [ 152.750853][ T6453] vhci_hcd vhci_hcd.3: release socket [ 152.758011][ T6453] vhci_hcd vhci_hcd.3: disconnect device [ 152.768869][ T5828] usb 1-1: unable to get BOS descriptor or descriptor too short [ 152.788677][ T5828] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 152.796405][ T916] usb 3-1: new low-speed USB device number 16 using dummy_hcd [ 152.818167][ T916] usb 3-1: Invalid ep0 maxpacket: 32 [ 152.836165][ T916] usb usb3-port1: unable to enumerate USB device [ 152.837986][ T5828] usb 1-1: can't read configurations, error -71 [ 153.425788][ T6836] Invalid logical block size (33554432) [ 154.011711][ T5917] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 154.063926][ T5828] IPVS: starting estimator thread 0... [ 154.175186][ T6849] IPVS: using max 38 ests per chain, 91200 per kthread [ 154.194835][ T5917] usb 4-1: config 0 has an invalid interface number: 64 but max is 0 [ 154.238249][ T5917] usb 4-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 154.453925][ T5917] usb 4-1: config 0 has no interface number 0 [ 154.665329][ T5917] usb 4-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 154.698022][ T5917] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.726554][ T5917] usb 4-1: Product: syz [ 154.753651][ T5917] usb 4-1: Manufacturer: syz [ 154.788232][ T5917] usb 4-1: SerialNumber: syz [ 154.852077][ T5917] usb 4-1: config 0 descriptor?? [ 154.874824][ T5828] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 154.911348][ T6859] syz.4.261 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 155.061413][ T5828] usb 1-1: Using ep0 maxpacket: 16 [ 155.132872][ T5828] usb 1-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice=2a.35 [ 155.142157][ T5828] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.156849][ T5828] usb 1-1: Product: syz [ 155.172791][ T5828] usb 1-1: Manufacturer: syz [ 155.185557][ T5828] usb 1-1: SerialNumber: syz [ 155.237886][ T5828] usb 1-1: config 0 descriptor?? [ 155.306984][ T5828] as10x_usb: device has been detected [ 155.328698][ T5917] uvcvideo 4-1:0.64: Found UVC 0.00 device syz (046d:0823) [ 155.353002][ T5917] uvcvideo 4-1:0.64: No valid video chain found. [ 155.363459][ T5828] dvbdev: DVB: registering new adapter (Sky IT Digital Key (green led)) [ 155.429291][ T5828] usb 1-1: DVB: registering adapter 1 frontend 0 (Sky IT Digital Key (green led))... [ 155.472613][ T6856] random: crng reseeded on system resumption [ 155.538277][ T5828] as10x_usb: error during firmware upload part1 [ 155.576123][ T5828] Registered device Sky IT Digital Key (green led) [ 155.971485][ T5917] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 156.052248][ T6872] usb usb7: usbfs: process 6872 (syz.1.264) did not claim interface 0 before use [ 156.144008][ T5902] usb 1-1: USB disconnect, device number 13 [ 156.151431][ T5917] usb 3-1: Using ep0 maxpacket: 8 [ 156.259695][ T5902] Unregistered device Sky IT Digital Key (green led) [ 156.275374][ T5902] as10x_usb: device has been disconnected [ 156.676889][ T5917] usb 3-1: unable to get BOS descriptor or descriptor too short [ 156.699669][ T5917] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 156.717466][ T5917] usb 3-1: can't read configurations, error -71 [ 156.904180][ T6881] Invalid logical block size (50331648) [ 157.718448][ T5916] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 157.886256][ T916] usb 4-1: USB disconnect, device number 18 [ 158.521834][ T5917] hid-generic 0008:0091:0009.0007: reserved main item tag 0xd [ 158.581402][ T5917] hid-generic 0008:0091:0009.0007: item fetching failed at offset 28/32 [ 158.625386][ T5917] hid-generic 0008:0091:0009.0007: probe with driver hid-generic failed with error -22 [ 159.071549][ T9] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 159.221710][ T9] usb 2-1: device descriptor read/64, error -71 [ 159.241755][ T5917] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 159.431411][ T5917] usb 4-1: Using ep0 maxpacket: 8 [ 159.447282][ T5917] usb 4-1: unable to get BOS descriptor or descriptor too short [ 159.473469][ T5828] IPVS: starting estimator thread 0... [ 159.479826][ T5917] usb 4-1: config 6 has an invalid interface number: 184 but max is 0 [ 159.491403][ T5917] usb 4-1: config 6 has no interface number 0 [ 159.521388][ T5917] usb 4-1: config 6 interface 184 has no altsetting 0 [ 159.521626][ T9] usb 2-1: new full-speed USB device number 13 using dummy_hcd [ 159.608766][ T6916] IPVS: using max 38 ests per chain, 91200 per kthread [ 159.625023][ T5917] usb 4-1: New USB device found, idVendor=2dee, idProduct=4d22, bcdDevice=8c.fd [ 159.640173][ T5917] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.659350][ T5917] usb 4-1: Product: syz [ 159.668966][ T5917] usb 4-1: Manufacturer: syz [ 159.682758][ T6918] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 159.751954][ T5917] usb 4-1: SerialNumber: syz [ 159.828306][ T9] usb 2-1: device descriptor read/64, error -71 [ 159.962026][ T9] usb usb2-port1: attempt power cycle [ 160.321600][ T9] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 160.382115][ T9] usb 2-1: device descriptor read/8, error -71 [ 160.627803][ T9] usb 2-1: new full-speed USB device number 15 using dummy_hcd [ 160.674632][ T9] usb 2-1: device descriptor read/8, error -71 [ 160.704687][ T5917] option 4-1:6.184: GSM modem (1-port) converter detected [ 160.712789][ T6922] netlink: 'syz.2.276': attribute type 1 has an invalid length. [ 160.752230][ T5917] usb 4-1: USB disconnect, device number 19 [ 160.781986][ T9] usb usb2-port1: unable to enumerate USB device [ 160.799516][ T5917] option 4-1:6.184: device disconnected [ 160.982022][ T6922] bond1: entered promiscuous mode [ 161.092972][ T6922] 8021q: adding VLAN 0 to HW filter on device bond1 [ 161.136809][ T6929] netlink: 4 bytes leftover after parsing attributes in process `syz.3.277'. [ 161.424127][ T6931] FAULT_INJECTION: forcing a failure. [ 161.424127][ T6931] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 161.499334][ T6931] CPU: 0 UID: 0 PID: 6931 Comm: syz.2.279 Tainted: G L syzkaller #0 PREEMPT(full) [ 161.499369][ T6931] Tainted: [L]=SOFTLOCKUP [ 161.499377][ T6931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 161.499388][ T6931] Call Trace: [ 161.499396][ T6931] [ 161.499406][ T6931] dump_stack_lvl+0xe8/0x150 [ 161.499440][ T6931] should_fail_ex+0x412/0x560 [ 161.499475][ T6931] prepare_alloc_pages+0x22a/0x650 [ 161.499509][ T6931] __alloc_frozen_pages_noprof+0x12f/0x380 [ 161.499540][ T6931] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 161.499571][ T6931] ? __pfx_policy_nodemask+0x10/0x10 [ 161.499597][ T6931] ? is_bpf_text_address+0x26/0x2b0 [ 161.499625][ T6931] ? is_bpf_text_address+0x292/0x2b0 [ 161.499650][ T6931] alloc_pages_mpol+0x232/0x4a0 [ 161.499683][ T6931] vma_alloc_folio_noprof+0xea/0x210 [ 161.499713][ T6931] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 161.499751][ T6931] do_wp_page+0x1204/0x5a00 [ 161.499813][ T6931] ? __pfx_do_wp_page+0x10/0x10 [ 161.499841][ T6931] ? do_raw_spin_lock+0x12b/0x2f0 [ 161.499866][ T6931] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 161.499898][ T6931] handle_mm_fault+0x1520/0x3310 [ 161.499944][ T6931] ? handle_mm_fault+0xee/0x3310 [ 161.499983][ T6931] ? __pfx_handle_mm_fault+0x10/0x10 [ 161.500012][ T6931] ? lock_vma_under_rcu+0x45a/0x500 [ 161.500061][ T6931] do_user_addr_fault+0xa73/0x1340 [ 161.500096][ T6931] ? rcu_is_watching+0x15/0xb0 [ 161.500125][ T6931] ? trace_page_fault_user+0x84/0x210 [ 161.500155][ T6931] exc_page_fault+0x6a/0xc0 [ 161.500182][ T6931] asm_exc_page_fault+0x26/0x30 [ 161.500202][ T6931] RIP: 0033:0x7f261b064230 [ 161.500221][ T6931] Code: 74 13 00 89 c3 85 c0 0f 88 ad 07 00 00 83 f8 1d 0f 8f 9d 09 00 00 48 8d 3d 2d 56 1a 00 31 c0 41 bf 01 00 00 00 e8 a0 cf fe ff 44 0f c1 3d c7 c0 4d 00 41 83 ff 05 7f 06 49 83 fc 1a 77 1b 48 [ 161.500238][ T6931] RSP: 002b:00007f261bf75f60 EFLAGS: 00010202 [ 161.500257][ T6931] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000 [ 161.500269][ T6931] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f261b209850 [ 161.500282][ T6931] RBP: 00007f261bf78090 R08: 0000000000000000 R09: 0000000000000000 [ 161.500294][ T6931] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000024 [ 161.500306][ T6931] R13: 0000200000003040 R14: 0000000000000003 R15: 0000000000000001 [ 161.500336][ T6931] [ 161.500544][ T6931] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 162.341427][ T9] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 162.441486][ T916] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 162.511443][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 162.519282][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 162.661398][ T916] usb 4-1: Using ep0 maxpacket: 16 [ 162.677261][ T9] usb 3-1: config 6 has an invalid interface number: 184 but max is 0 [ 162.698603][ T9] usb 3-1: config 6 has no interface number 0 [ 162.713849][ T9] usb 3-1: config 6 interface 184 has no altsetting 0 [ 162.731015][ T916] usb 4-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid maxpacket 25959, setting to 1024 [ 162.756878][ T9] usb 3-1: New USB device found, idVendor=2dee, idProduct=4d22, bcdDevice=8c.fd [ 162.771236][ T916] usb 4-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 162.791449][ T24] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 162.794450][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.811382][ T916] usb 4-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 162.828280][ T9] usb 3-1: Product: syz [ 162.840524][ T9] usb 3-1: Manufacturer: syz [ 162.845719][ T916] usb 4-1: config 1 interface 0 has no altsetting 0 [ 162.852613][ T9] usb 3-1: SerialNumber: syz [ 162.880183][ T916] usb 4-1: New USB device found, idVendor=0521, idProduct=b1a8, bcdDevice= 0.40 [ 162.896386][ T916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.917727][ T916] usb 4-1: Product: syz [ 162.931622][ T916] usb 4-1: Manufacturer: syz [ 162.941846][ T916] usb 4-1: SerialNumber: syz [ 162.960671][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 162.997616][ T6940] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 163.022606][ T24] usb 5-1: config 4 has an invalid interface number: 128 but max is 0 [ 163.034434][ T6948] syzkaller0: entered promiscuous mode [ 163.039978][ T6948] syzkaller0: entered allmulticast mode [ 163.062702][ T24] usb 5-1: config 4 has no interface number 0 [ 163.088344][ T24] usb 5-1: config 4 interface 128 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 163.201780][ T24] usb 5-1: config 4 interface 128 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 163.225857][ T24] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 163.238144][ T916] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 20 if 0 alt 255 proto 1 vid 0x0521 pid 0xB1A8 [ 163.303146][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 163.413873][ T24] hub 5-1:4.128: USB hub found [ 163.724370][ T9] option 3-1:6.184: GSM modem (1-port) converter detected [ 163.894003][ T9] usb 3-1: USB disconnect, device number 19 [ 163.958283][ T9] option 3-1:6.184: device disconnected [ 164.161323][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 164.906524][ T24] hub 5-1:4.128: config failed, can't read hub descriptor (err -22) [ 165.290756][ T24] usb 5-1: USB disconnect, device number 10 [ 165.756352][ T7004] netlink: 32 bytes leftover after parsing attributes in process `syz.2.289'. [ 166.761857][ T24] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 167.180841][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 167.238589][ T24] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 167.263626][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.305714][ T7019] netlink: 'syz.0.294': attribute type 10 has an invalid length. [ 167.333280][ T24] usb 5-1: config 0 descriptor?? [ 167.465300][ T7019] 8021q: adding VLAN 0 to HW filter on device team0 [ 167.581585][ T7019] bond0: (slave team0): Enslaving as an active interface with an up link [ 167.672187][ T24] usbhid 5-1:0.0: can't add hid device: -71 [ 167.678232][ T24] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 167.754817][ T24] usb 5-1: USB disconnect, device number 11 [ 168.191536][ T24] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 168.441436][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 168.456320][ T24] usb 5-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 168.474894][ T24] usb 5-1: config 0 interface 0 has no altsetting 0 [ 168.522950][ T24] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 168.582398][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.637760][ T24] usb 5-1: config 0 descriptor?? [ 168.868591][ T7009] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 168.879787][ T7009] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 168.941602][ T7009] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 168.984872][ T7009] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 169.230023][ T24] mcp2221 0003:04D8:00DD.0008: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 169.420079][ C1] ================================================================== [ 169.428329][ C1] BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x106a/0x1240 [ 169.436379][ C1] Read of size 1 at addr ffff88807cbbffff by task swapper/1/0 [ 169.443889][ C1] [ 169.446298][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 169.446333][ C1] Tainted: [L]=SOFTLOCKUP [ 169.446342][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 169.446357][ C1] Call Trace: [ 169.446366][ C1] [ 169.446376][ C1] dump_stack_lvl+0xe8/0x150 [ 169.446415][ C1] print_report+0xba/0x230 [ 169.446444][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 169.446472][ C1] kasan_report+0x117/0x150 [ 169.446504][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 169.446535][ C1] mcp2221_raw_event+0x106a/0x1240 [ 169.446561][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 169.446586][ C1] ? down_trylock+0x50/0xb0 [ 169.446617][ C1] hid_input_report+0x41d/0x580 [ 169.446651][ C1] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 169.446678][ C1] hid_irq_in+0x47e/0x6d0 [ 169.446708][ C1] __usb_hcd_giveback_urb+0x376/0x540 [ 169.446745][ C1] dummy_timer+0xbbd/0x45d0 [ 169.446807][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 169.446842][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 169.446866][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 169.446897][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 169.446929][ C1] __hrtimer_run_queues+0x53a/0xcc0 [ 169.446972][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 169.447004][ C1] ? ktime_get_update_offsets_now+0x3b2/0x3d0 [ 169.447036][ C1] hrtimer_run_softirq+0x182/0x5a0 [ 169.447074][ C1] handle_softirqs+0x22a/0x870 [ 169.447105][ C1] ? __irq_exit_rcu+0x5f/0x150 [ 169.447148][ C1] __irq_exit_rcu+0x5f/0x150 [ 169.447177][ C1] irq_exit_rcu+0x9/0x30 [ 169.447204][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 169.447231][ C1] [ 169.447239][ C1] [ 169.447248][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 169.447272][ C1] RIP: 0010:finish_task_switch+0x245/0x920 [ 169.447303][ C1] Code: 00 00 48 85 db 0f 85 e8 01 00 00 e9 56 05 00 00 4c 8b 75 d0 49 83 c4 48 4c 89 e7 e8 d5 a5 1c 0a e8 d0 8d 38 00 fb 4c 8b 65 c0 <49> 8d bc 24 80 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 28 84 c0 [ 169.447323][ C1] RSP: 0018:ffffc90000197bb8 EFLAGS: 00000202 [ 169.447345][ C1] RAX: 000000000016ad85 RBX: 0000000000000000 RCX: 0000000080000001 [ 169.447361][ C1] RDX: 0000000000000000 RSI: ffffffff8def9650 RDI: ffffffff8c27cb80 [ 169.447377][ C1] RBP: ffffc90000197c10 R08: ffffffff9011beb7 R09: 1ffffffff20237d6 [ 169.447394][ C1] R10: dffffc0000000000 R11: fffffbfff20237d7 R12: ffff88801d6c8000 [ 169.447411][ C1] R13: dffffc0000000000 R14: ffff888030ec3d00 R15: ffff8880b873b998 [ 169.447438][ C1] ? finish_task_switch+0x240/0x920 [ 169.447469][ C1] __schedule+0x15e5/0x52d0 [ 169.447505][ C1] ? trace_irq_disable+0x3b/0x150 [ 169.447527][ C1] ? __pfx___schedule+0x10/0x10 [ 169.447549][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 169.447580][ C1] ? tick_nohz_idle_exit+0x2e1/0x3a0 [ 169.447608][ C1] schedule_idle+0x51/0x90 [ 169.447631][ C1] do_idle+0x58a/0x5f0 [ 169.447661][ C1] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 169.447689][ C1] ? __pfx_do_idle+0x10/0x10 [ 169.447724][ C1] cpu_startup_entry+0x43/0x60 [ 169.447756][ C1] start_secondary+0x101/0x110 [ 169.447783][ C1] common_startup_64+0x13e/0x147 [ 169.447815][ C1] [ 169.447823][ C1] [ 169.491975][ T9] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 169.493531][ C1] Allocated by task 6898: [ 169.776031][ C1] kasan_save_track+0x3e/0x80 [ 169.780747][ C1] __kasan_slab_alloc+0x6c/0x80 [ 169.785626][ C1] kmem_cache_alloc_bulk_noprof+0x570/0x7e0 [ 169.791559][ C1] __io_alloc_req_refill+0xb4/0x360 [ 169.796789][ C1] io_submit_sqes+0x1011/0x2400 [ 169.801666][ C1] __se_sys_io_uring_enter+0x2cc/0x18c0 [ 169.807236][ C1] do_syscall_64+0x14d/0xf80 [ 169.811860][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 169.817796][ C1] [ 169.820142][ C1] Freed by task 23: [ 169.823971][ C1] kasan_save_track+0x3e/0x80 [ 169.828671][ C1] kasan_save_free_info+0x46/0x50 [ 169.833732][ C1] __kasan_slab_free+0x5c/0x80 [ 169.838520][ C1] slab_free_after_rcu_debug+0x126/0x220 [ 169.844274][ C1] rcu_core+0x7cd/0x1070 [ 169.848541][ C1] handle_softirqs+0x22a/0x870 [ 169.853334][ C1] run_ksoftirqd+0x36/0x60 [ 169.857788][ C1] smpboot_thread_fn+0x541/0xa50 [ 169.862758][ C1] kthread+0x388/0x470 [ 169.866860][ C1] ret_from_fork+0x51e/0xb90 [ 169.871484][ C1] ret_from_fork_asm+0x1a/0x30 [ 169.876290][ C1] [ 169.878636][ C1] Last potentially related work creation: [ 169.884536][ C1] kasan_save_stack+0x3e/0x60 [ 169.889246][ C1] kasan_record_aux_stack+0xbd/0xd0 [ 169.894478][ C1] kmem_cache_free+0x426/0x630 [ 169.899268][ C1] __io_req_caches_free+0x1c1/0x270 [ 169.904494][ C1] io_req_caches_free+0x21/0x60 [ 169.909409][ C1] io_ring_exit_work+0x41b/0x960 [ 169.914381][ C1] process_scheduled_works+0xb6e/0x18c0 [ 169.919954][ C1] worker_thread+0xa53/0xfc0 [ 169.924571][ C1] kthread+0x388/0x470 [ 169.928666][ C1] ret_from_fork+0x51e/0xb90 [ 169.933278][ C1] ret_from_fork_asm+0x1a/0x30 [ 169.938156][ C1] [ 169.940502][ C1] The buggy address belongs to the object at ffff88807cbbfdc0 [ 169.940502][ C1] which belongs to the cache io_kiocb of size 248 [ 169.954313][ C1] The buggy address is located 327 bytes to the right of [ 169.954313][ C1] allocated 248-byte region [ffff88807cbbfdc0, ffff88807cbbfeb8) [ 169.969012][ C1] [ 169.971379][ C1] The buggy address belongs to the physical page: [ 169.977916][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7cbbf [ 169.986701][ C1] memcg:ffff88807cbbff01 [ 169.990996][ C1] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 169.998136][ C1] page_type: f5(slab) [ 170.002240][ C1] raw: 00fff00000000000 ffff88801f7368c0 dead000000000100 dead000000000122 [ 170.010971][ C1] raw: 0000000000000000 00000008000c000c 00000000f5000000 ffff88807cbbff01 [ 170.019682][ C1] page dumped because: kasan: bad access detected [ 170.026124][ C1] page_owner tracks the page as allocated [ 170.031878][ C1] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6898, tgid 6897 (syz.2.271), ts 159697818864, free_ts 156126027726 [ 170.051440][ C1] post_alloc_hook+0x231/0x280 [ 170.056249][ C1] get_page_from_freelist+0x24dc/0x2580 [ 170.061830][ C1] __alloc_frozen_pages_noprof+0x18d/0x380 [ 170.067758][ C1] allocate_slab+0x77/0x660 [ 170.072297][ C1] refill_objects+0x331/0x3c0 [ 170.077016][ C1] __kmem_cache_alloc_bulk+0x3c/0x1a0 [ 170.082421][ C1] kmem_cache_alloc_bulk_noprof+0x4d3/0x7e0 [ 170.088340][ C1] __io_alloc_req_refill+0xb4/0x360 [ 170.093565][ C1] io_submit_sqes+0x1011/0x2400 [ 170.098456][ C1] __se_sys_io_uring_enter+0x2cc/0x18c0 [ 170.104022][ C1] do_syscall_64+0x14d/0xf80 [ 170.108638][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.114652][ C1] page last free pid 6856 tgid 6853 stack trace: [ 170.121117][ C1] __free_frozen_pages+0xc2b/0xdb0 [ 170.126383][ C1] memory_bm_free+0x2c1/0x4e0 [ 170.131219][ C1] free_basic_memory_bitmaps+0x4f/0xd0 [ 170.136701][ C1] snapshot_release+0xe4/0x1d0 [ 170.141511][ C1] __fput+0x44f/0xa70 [ 170.145555][ C1] task_work_run+0x1d9/0x270 [ 170.150405][ C1] do_exit+0x70f/0x23c0 [ 170.154595][ C1] do_group_exit+0x21b/0x2d0 [ 170.159208][ C1] get_signal+0x1284/0x1330 [ 170.163773][ C1] arch_do_signal_or_restart+0xbc/0x830 [ 170.169352][ C1] exit_to_user_mode_loop+0x86/0x480 [ 170.174703][ C1] do_syscall_64+0x32d/0xf80 [ 170.179332][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.185248][ C1] [ 170.187594][ C1] Memory state around the buggy address: [ 170.193247][ C1] ffff88807cbbfe80: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc [ 170.201340][ C1] ffff88807cbbff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 170.209778][ C1] >ffff88807cbbff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 170.217958][ C1] ^ [ 170.225975][ C1] ffff88807cbc0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 170.234067][ C1] ffff88807cbc0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 170.242155][ C1] ================================================================== [ 170.250237][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 170.257469][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 170.268013][ C1] Tainted: [L]=SOFTLOCKUP [ 170.272361][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 170.282470][ C1] Call Trace: [ 170.285780][ C1] [ 170.288658][ C1] vpanic+0x56c/0xa60 [ 170.292678][ C1] ? __pfx_vpanic+0x10/0x10 [ 170.297223][ C1] panic+0xc5/0xd0 [ 170.301061][ C1] ? __pfx_panic+0x10/0x10 [ 170.305520][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 170.310840][ C1] ? rcu_is_watching+0x15/0xb0 [ 170.315646][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 170.320973][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 170.326295][ C1] check_panic_on_warn+0x89/0xb0 [ 170.331263][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 170.336578][ C1] end_report+0x73/0x180 [ 170.340879][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 170.346237][ C1] kasan_report+0x128/0x150 [ 170.350774][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 170.356086][ C1] mcp2221_raw_event+0x106a/0x1240 [ 170.361220][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 170.367054][ C1] ? down_trylock+0x50/0xb0 [ 170.371597][ C1] hid_input_report+0x41d/0x580 [ 170.376494][ C1] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 170.381982][ C1] hid_irq_in+0x47e/0x6d0 [ 170.386356][ C1] __usb_hcd_giveback_urb+0x376/0x540 [ 170.391766][ C1] dummy_timer+0xbbd/0x45d0 [ 170.396324][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 170.401295][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 170.407140][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 170.412118][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 170.417097][ C1] __hrtimer_run_queues+0x53a/0xcc0 [ 170.422343][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 170.428099][ C1] ? ktime_get_update_offsets_now+0x3b2/0x3d0 [ 170.434196][ C1] hrtimer_run_softirq+0x182/0x5a0 [ 170.439338][ C1] handle_softirqs+0x22a/0x870 [ 170.444150][ C1] ? __irq_exit_rcu+0x5f/0x150 [ 170.448965][ C1] __irq_exit_rcu+0x5f/0x150 [ 170.453594][ C1] irq_exit_rcu+0x9/0x30 [ 170.457908][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 170.463566][ C1] [ 170.466552][ C1] [ 170.469512][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 170.475703][ C1] RIP: 0010:finish_task_switch+0x245/0x920 [ 170.481562][ C1] Code: 00 00 48 85 db 0f 85 e8 01 00 00 e9 56 05 00 00 4c 8b 75 d0 49 83 c4 48 4c 89 e7 e8 d5 a5 1c 0a e8 d0 8d 38 00 fb 4c 8b 65 c0 <49> 8d bc 24 80 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 28 84 c0 [ 170.501453][ C1] RSP: 0018:ffffc90000197bb8 EFLAGS: 00000202 [ 170.507570][ C1] RAX: 000000000016ad85 RBX: 0000000000000000 RCX: 0000000080000001 [ 170.515561][ C1] RDX: 0000000000000000 RSI: ffffffff8def9650 RDI: ffffffff8c27cb80 [ 170.523562][ C1] RBP: ffffc90000197c10 R08: ffffffff9011beb7 R09: 1ffffffff20237d6 [ 170.531560][ C1] R10: dffffc0000000000 R11: fffffbfff20237d7 R12: ffff88801d6c8000 [ 170.539764][ C1] R13: dffffc0000000000 R14: ffff888030ec3d00 R15: ffff8880b873b998 [ 170.547782][ C1] ? finish_task_switch+0x240/0x920 [ 170.553100][ C1] __schedule+0x15e5/0x52d0 [ 170.557657][ C1] ? trace_irq_disable+0x3b/0x150 [ 170.562713][ C1] ? __pfx___schedule+0x10/0x10 [ 170.567588][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 170.572820][ C1] ? tick_nohz_idle_exit+0x2e1/0x3a0 [ 170.578137][ C1] schedule_idle+0x51/0x90 [ 170.582582][ C1] do_idle+0x58a/0x5f0 [ 170.586684][ C1] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 170.592948][ C1] ? __pfx_do_idle+0x10/0x10 [ 170.597569][ C1] cpu_startup_entry+0x43/0x60 [ 170.602360][ C1] start_secondary+0x101/0x110 [ 170.607159][ C1] common_startup_64+0x13e/0x147 [ 170.612120][ C1] [ 170.615768][ C1] Kernel Offset: disabled [ 170.620102][ C1] Rebooting in 86400 seconds..