last executing test programs: 10m38.014683479s ago: executing program 0 (id=143): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./dev\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = open(&(0x7f0000000040)='./bus\x00', 0x1c527e, 0x10) r1 = open(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', 0x1a1342, 0x0) fallocate(r0, 0x0, 0x0, 0x1000f4) sendfile(r0, r0, 0x0, 0x40000000800) sendfile(r1, r0, 0x0, 0x7ffff000) 10m36.71168436s ago: executing program 0 (id=148): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x2200002, &(0x7f00000002c0)={[{@discard}, {}, {@grpquota}, {@nojournal_checksum}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@delalloc}, {@nogrpid}, {@noauto_da_alloc}, {@dioread_nolock}]}, 0x1, 0x572, &(0x7f0000000380)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=") r0 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./file0\x00', 0x86842, 0x1fb) r1 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./file1\x00', 0x42, 0x0) pwrite64(r1, &(0x7f0000000980)='a', 0x200000c1, 0x9000) openat(0xffffffffffffff9c, 0x0, 0x696782, 0x15f) fallocate(r0, 0x8, 0x4000, 0x10000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file1\x00', 0x0, 0x20) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000a40), 0x1, 0x0) ioctl$TCSETSF2(r3, 0x402c542d, &(0x7f0000000e40)={0x1ff, 0x4, 0x0, 0xfffff6a8, 0x3, "c1d846f1120224c70b82426319d4c37ee7e4c0", 0x1, 0x6}) ioctl$TCSETS2(r3, 0x402c542b, &(0x7f0000000e80)={0x7, 0xa40, 0xffffff81, 0x7fffffff, 0x6, "662ceb757dcb7495e121fcd1f20e485396a278", 0x2, 0x5}) syslog(0x0, 0x0, 0x0) r4 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={&(0x7f0000001040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x3, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x2, 0x40}}, @int={0x40, 0x0, 0x0, 0x1, 0x5, 0x4}, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0x0, [{0x1, 0x1}]}]}, {0x0, [0x0]}}, 0x0, 0x5b}, 0x28) syz_mount_image$erofs(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', 0x20400a, &(0x7f0000000180)=ANY=[@ANYRES64=r4, @ANYRES64, @ANYRESDEC=0x0, @ANYRES32=r4], 0xfe, 0x208, &(0x7f0000000b00)="$eJzslr+L1EAUx78zCZNdfzSWNhYeqIW5JKtiI9w1VhaCPw4LwaDxOHf1YHcRb0HOw1oES8HCwt5/QNBW/wc5ra5ZOxsLRyYzScaQ3G12cbfwfWBnv5m8eXnzXvbNgiCI/5bv337uSrRSfQRL8Mz8nlPYcMv+a+vH009XLq+9vP3us7frt6t8Sjn5810AH1cdDPO1/K/VS+b7Oniub4DjjNFrJnbFHXDcNDoBwy2jH1h6Ewy+79/f6CX+3U0BJQI1hGqI1NApxzfeYbiXxycls+4PtkbduNdL+v9QHJS/8SrHJSs+u14+dLSBlb8QHKHRHTBcM/oivCw3OiXW/o+7hX9n3/0LzLTb59W32vDyGRVKA8/HjtaWSgCYLlSA5Q7foGzzJXsLs5kXh+sd4lnJeI7CQSqyijb3I8o7VcKpMXaqjEfd+NWUe1cv+gE2cOeWTGF2wZon07NmpqnFhxW9JpuR2/q6P3i8l/9Uy6vk9oSPEPolWWmWlqI/ybcMp6z+pFvJ6/SoUSVcHmyNzm48jNeT9eRRFHUuBOeC4Hy0nDYiPe7T/9ppfzpU+K88kxSCCTyJh8N+mI6/pZT6OtJjVcflAB/vcJw+qa9VcUXJb8vSzHxcuGC693bf10ZPEASxOE6A/ZIGNxPmNIH1X/fqAmMkCIIgCIIgCIIgCGI2/gQAAP//4qI4bQ==") mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/sys/kernel/sem\x00', 0x1, 0x0) writev(r5, &(0x7f00000009c0)=[{&(0x7f0000000a00)="ca41083b", 0x4}], 0x1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000040)=0x17, 0x4) syz_clone(0x2511, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000ec0)=@base={0x1a, 0x1909fc14, 0xb, 0x1, 0x1000, 0xffffffffffffffff, 0x200, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4}, 0x50) rt_sigtimedwait(&(0x7f0000000000)={[0xfffffffff7ff8518]}, 0xffffffffffffffff, 0x0, 0x8) 10m35.855403057s ago: executing program 0 (id=158): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000b40)=@base={0x19, 0x4, 0x4, 0x100, 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x5, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) close(0x3) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r4}, &(0x7f00000005c0), &(0x7f0000000600)=r5}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000004007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000880)={r6}, 0xc) 10m34.922506382s ago: executing program 0 (id=159): bpf$PROG_LOAD(0x5, &(0x7f0000002200)={0x1, 0x4, 0x0, &(0x7f0000002300)='GPL\x00', 0x2, 0xc3, &(0x7f0000002340)=""/195}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) syz_mount_image$hfsplus(&(0x7f00000000c0), &(0x7f0000002440)='./file1\x00', 0x1804810, &(0x7f0000002480)=ANY=[@ANYRES16=0x0, @ANYRESOCT], 0xfb, 0x6a0, &(0x7f00000024c0)="$eJzs3c1vHGcdB/DvrDd2Ni0hSZM2oEq1GgkQEYkTKy3mQkAI5VBVVTlwthKnseKkxXGRWyHi8HrtoX9AOeSCOCFx4hKpcOBCb72Bj0hIXMqBcGHRzM7aa+96s24Tr61+PtHs8zrPPPObl32xognwuXXlbJoPUuTK2VdWy/L6/dml9fuztzr5V5tJppKsJWW2kaT4T7vd/jC5nBQbwxTb0j7vL869/vEn6//olJr1UvVvDFtvm7rf2rbqtW7ddJKJOv0Mtox39TOPV2zM/HKSM3UKY3coSXuLH/3l6Y2WHq1Bax/ekzkCT1bRed/scyw5Ul/o5eeA7jtvY29nN7qpEftt/wQBAAAAB031HbjZV72l5osP8zCrxdE9nBYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcaGubz/8v6qXRzU+n6D7/f7KuS53fX17YXfcHT2oeAAAAAAAAALCHXniYh1nN0W65XVR/83+xKpysXp/K27mThSznXFYzn5WsZDkXkhzrGWhydX5lZapbGrbmxUFrLl98xES7Q7cew04DAAAAAAAAwIHz90d1+FmubP79HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9oMimegkKe71VB9Lo5nkcJLJsmIt+aibP8gejHsCAAAAsAemkodZzdFuuV3kZJJnq98ADuft3M5KFrOSpSzkWvW7QOdbf2P9/uzS+v3ZW+XSP+53/rWraVQjpvPbw+Atn656tHI9i1XNuVzNm1nKtTSqNUun6/l0R902r3vlnIpv114ebWbX6rTc8/fqtM/dXe3sTnb5Y8qxKiKHOhGZSGbquZXRON49MoOP0C6PzpYtZSEX0tiY7MltW5rcujNbY745ZGPY9o7Uabk/v9op5mPRicT/2h0Ludhz9j07PObJV//wux/O1Pn9s0ujmajTdvXa6j8nZnsi8dwokbixdPvmjet3zh60SPSZqSJxaqN8Jd/PD3I203kty1nMjzOflSxkOt+rcvP1wS96LvkdInV5S+m1R81ksj5DOwdrd3N6sVr3aBbzat7MtSzkperfxVzIy7mUS5nrOcKnhh/h6qpv9F/1lfYXBk7+zNfqTCvJr+t0fyjjerwnrptn/UwV7+NbajajdGKEKA24Nw7T/HKdKbfx80fdSPfU9khc6InEM8Mj8ZvqtnJn6fbN5Rvzb422uRPv1ZnyOvplMr1/biTl+XKiPFhVaWrL2VG2PbPRtjVeZdvJjbZGX9up/DHNZncri1nb8UqdrD/D9Y90sWp7bmDbbNV2uqdt0OctAPa9I18/Mtn6Z+uvrQ9av2jdaL1y+LtT35x6fjKH/nToW82Zia80ni9+nw/y083v/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwKd35513b84vLS0sb8u02+27Hw1uGjHTfV7Np1x9e6b7VKgROmf6b0+VXQc0TaR9d4emJ5X50tPJXm1r/2b+226365pihz6//fP2QE1lTKGrn/PX3hehG1NmbLckYI+cX7n11vk777z7jcVb828svLFwe+7SpbmZuUsvzZ6/vri0MNN5HfcsgSdh801/3DMBAAAAAAAAAAAARvWY/8/A2qCmce8jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcLBdOZvmgxS5MHNupiyv359dKpdufrNnM0kjSfGTpPgwuZzOkmM9wxU7bef9xbnXP/5k/d/tjnq8qn9j2HqjWauXTCeZ6KT3Htd4V+t0qGLYLhQbe1gG7Ew3cDBu/w8AAP//D3MQ+Q==") write$P9_RCREATE(r0, &(0x7f0000002b80)={0x18, 0x73, 0x1, {{0x40, 0x1, 0x2}, 0x6}}, 0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000002bc0)='./sys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000002c00)='./file1\x00', 0x101042, 0x15) pwrite64(r1, &(0x7f0000002c40)='2', 0xfdef, 0xc00) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000002c80)='127.0.0.1\x00', 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000002cc0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000002d00)=ANY=[@ANYBLOB="12000000220000000400000002"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002d40)={{r3, 0xffffffffffffffff}, &(0x7f0000002d80), &(0x7f0000002dc0)=r2}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002e00)={{r4, 0xffffffffffffffff}, &(0x7f0000002e40), &(0x7f0000002e80)=r2}, 0x20) r6 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002ec0)={{r5}, &(0x7f0000002f00), &(0x7f0000002f40)=r6}, 0x20) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/thermal/cooling_device0/cur_state\x00', 0x1, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000001c0)={0x2020}, 0x2020) socket$unix(0x1, 0x5, 0x0) 10m33.216899494s ago: executing program 0 (id=165): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./dev\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = open(&(0x7f0000000040)='./bus\x00', 0x1c527e, 0x10) r1 = open(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', 0x1a1342, 0x0) fallocate(r0, 0x0, 0x0, 0x1000f4) sendfile(r0, r0, 0x0, 0x40000000800) sendfile(r1, r0, 0x0, 0x7ffff000) 10m32.512704275s ago: executing program 0 (id=167): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000b40)=@base={0x19, 0x4, 0x4, 0x100, 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x5, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) close(0x3) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r4}, &(0x7f00000005c0), &(0x7f0000000600)=r5}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000004007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000880)={r6}, 0xc) 10m31.783765279s ago: executing program 32 (id=167): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000b40)=@base={0x19, 0x4, 0x4, 0x100, 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x5, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) close(0x3) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r4}, &(0x7f00000005c0), &(0x7f0000000600)=r5}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000004007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000880)={r6}, 0xc) 4m41.801436807s ago: executing program 1 (id=1623): setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2f, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) r1 = syz_open_dev$sg(0x0, 0xa, 0x28102) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000001c0)=0x2001) r2 = fcntl$dupfd(r1, 0x0, r1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000080)={0x6, @local, 0x4e20, 0x0, 'sed\x00', 0x1, 0x12c, 0xffffffff}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000380)={{0x6, @local, 0x4e20, 0x0, 'rr\x00', 0x1, 0x12c, 0xffffffff}, {@remote, 0x4e20, 0x4, 0x1}}, 0x44) r4 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r4, &(0x7f0000000400)={0x2, 0x4e20, @local}, 0x10) readv(r2, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) 4m40.715971917s ago: executing program 4 (id=1629): syz_usb_connect(0x0, 0x2d, &(0x7f0000000780)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d0009058203"], 0x0) 4m40.624025516s ago: executing program 1 (id=1630): fsopen(&(0x7f0000000080)='bpf\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6(0xa, 0x80003, 0x6) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000e80)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001b40)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000001b80)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001bc0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000001c00)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000001c80), 0x651, 0x0) recvmmsg(r3, &(0x7f0000001cc0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x3, 0x401d031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001d00)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x2, '\x00', 0x0, 0x0}, 0x50) r5 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001d80)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000001dc0)='./config\x00', &(0x7f0000001e00)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001e40)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001e80)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001ec0)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000001f40)="aa", 0x1) symlinkat(&(0x7f0000001f80)='./config/usb_gadget/g1/functions/uac2.0\x00', 0xffffffffffffff9c, &(0x7f0000001fc0)='./config/usb_gadget/g1/configs/c.1/uac2.0\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r6, &(0x7f0000002040)='dummy_udc.0', 0xb) sendmsg$nl_route(r5, &(0x7f0000002080)={0x0, 0x0, &(0x7f00000020c0)={&(0x7f0000002100)=ANY=[@ANYBLOB="4400000010004b0426bd70000000", @ANYBLOB="40180000042c0400240012800b0001006272696467650000140002800800040001000000050017f400000000"], 0x44}}, 0x24) 4m38.652123535s ago: executing program 1 (id=1631): r0 = syz_open_dev$dvb_frontend(0x0, 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000140)={0xa, &(0x7f0000000000)=[{0x1b, '\x00', @data=0xe, 0x4}, {0x1f, '\x00', @st={0x4, [{0x1, @uvalue=0xc7b}, {0x1, @svalue=0x5}, {0x3, @svalue=0x9}, {0x0, @svalue=0x3}]}}]}) 4m38.430615288s ago: executing program 1 (id=1632): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x2200002, &(0x7f00000002c0)={[{@discard}, {}, {@grpquota}, {@nojournal_checksum}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@delalloc}, {@nogrpid}, {@noauto_da_alloc}, {@dioread_nolock}]}, 0x1, 0x572, &(0x7f0000000380)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=") r0 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./file0\x00', 0x86842, 0x1fb) r1 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./file1\x00', 0x42, 0x0) pwrite64(r1, &(0x7f0000000980)='a', 0x200000c1, 0x9000) openat(0xffffffffffffff9c, 0x0, 0x696782, 0x15f) fallocate(r0, 0x8, 0x4000, 0x10000) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000a40), 0x1, 0x0) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f0000000e80)={0x7, 0xa40, 0xffffff81, 0x7fffffff, 0x6, "662ceb757dcb7495e121fcd1f20e485396a278", 0x2, 0x5}) syslog(0x0, 0x0, 0x0) r3 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) syz_mount_image$erofs(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', 0x20400a, &(0x7f0000000180)=ANY=[@ANYRES64=r3, @ANYRES64, @ANYRESDEC=0x0, @ANYRES32=r3], 0xfe, 0x208, &(0x7f0000000b00)="$eJzslr+L1EAUx78zCZNdfzSWNhYeqIW5JKtiI9w1VhaCPw4LwaDxOHf1YHcRb0HOw1oES8HCwt5/QNBW/wc5ra5ZOxsLRyYzScaQ3G12cbfwfWBnv5m8eXnzXvbNgiCI/5bv337uSrRSfQRL8Mz8nlPYcMv+a+vH009XLq+9vP3us7frt6t8Sjn5810AH1cdDPO1/K/VS+b7Oniub4DjjNFrJnbFHXDcNDoBwy2jH1h6Ewy+79/f6CX+3U0BJQI1hGqI1NApxzfeYbiXxycls+4PtkbduNdL+v9QHJS/8SrHJSs+u14+dLSBlb8QHKHRHTBcM/oivCw3OiXW/o+7hX9n3/0LzLTb59W32vDyGRVKA8/HjtaWSgCYLlSA5Q7foGzzJXsLs5kXh+sd4lnJeI7CQSqyijb3I8o7VcKpMXaqjEfd+NWUe1cv+gE2cOeWTGF2wZon07NmpqnFhxW9JpuR2/q6P3i8l/9Uy6vk9oSPEPolWWmWlqI/ybcMp6z+pFvJ6/SoUSVcHmyNzm48jNeT9eRRFHUuBOeC4Hy0nDYiPe7T/9ppfzpU+K88kxSCCTyJh8N+mI6/pZT6OtJjVcflAB/vcJw+qa9VcUXJb8vSzHxcuGC693bf10ZPEASxOE6A/ZIGNxPmNIH1X/fqAmMkCIIgCIIgCIIgCGI2/gQAAP//4qI4bQ==") mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/sys/kernel/sem\x00', 0x1, 0x0) writev(r4, &(0x7f00000009c0)=[{&(0x7f0000000a00)="ca41083b", 0x4}], 0x1) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f0000000040)=0x17, 0x4) syz_clone(0x2511, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000ec0)=@base={0x1a, 0x1909fc14, 0xb, 0x1, 0x1000, 0xffffffffffffffff, 0x200, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4}, 0x50) rt_sigtimedwait(0x0, 0xffffffffffffffff, 0x0, 0x0) 4m37.857198046s ago: executing program 1 (id=1636): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x1}, 0x50) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_KEY(r5, 0x0, 0x0) sendmsg$NL80211_CMD_GET_POWER_SAVE(r1, 0x0, 0x1) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) r6 = socket(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_MSFILTER(r6, 0x29, 0x30, &(0x7f0000000680)={0x3, {{0xa, 0x6e23, 0xc, @mcast1, 0xdffffff8}}}, 0x90) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000800)=0x5, 0x4) mount(0x0, &(0x7f0000000840)='./dev\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r6, 0xf504, 0x0) splice(r3, 0x0, r4, 0x0, 0xf3a, 0x0) dup(0xffffffffffffffff) writev(0xffffffffffffffff, &(0x7f00000009c0), 0x0) close(r1) tee(r0, r4, 0x4, 0x0) write(r2, 0x0, 0x0) 4m37.762341525s ago: executing program 3 (id=1638): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000540)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="3800000054000104000000000000000007000000", @ANYRES32=r2, @ANYBLOB="20000100", @ANYRES32, @ANYBLOB="01000001ef01"], 0x38}}, 0x0) 4m37.42037078s ago: executing program 4 (id=1639): bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[], 0x50) socket$nl_route(0x10, 0x3, 0x0) r0 = dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x808b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f00000002c0)={0x0, {0x2, 0x4e23, @remote}, {0x2, 0x4e22, @remote}, {0x2, 0x4e23, @empty}, 0x4, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000340)='team_slave_0\x00', 0x6, 0xffffffff, 0x2}) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, 0x0, 0x0) add_key(&(0x7f0000000780)='asymmetric\x00', 0x0, &(0x7f00000007c0)="308201103081bea00302012b020101300a06082a85030701010302300e310c300a06035504030c0373797a3020170d3232303531383232333234315a180f32313232303432343232333234315a300e310c300a06035504030c0373797a3066301f06082a85030701010101301306072a85030202230106082a850307010102020343000440d5a777f9262f8cbdcce31f0194053d2fecb50034f5516d3b904b23286f1dc836616036ecbbb40b954e544f152105d8526644317e5dc5d126005f60d8f0c727fc300a06082a8503070101030203410041320973a4c138d6637d8bf7503fda9f6848c150e3423a9b2b28122aa7c2753165778c3c9e0d56b2f9dc04333eb09ef9744e59b383f29127da5ec733c0c18f41", 0x114, 0xfffffffffffffffe) 4m37.327669249s ago: executing program 3 (id=1640): r0 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r0, 0x40084149, &(0x7f0000000040)=0x800) 4m36.714709731s ago: executing program 1 (id=1641): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0xe0000000, 0x8810040, 0xb, 0xffff, 0xe7, 0x2, 0x0, 0x0, 0x8, 0x80000001}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) dup3(r0, r2, 0x6700000000000000) 4m36.693671653s ago: executing program 3 (id=1642): ioctl$OCFS2_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046f01, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x0, 0x20, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40000, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000480)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000540), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000580), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000005c0)=0x6) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000600)={0x500, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000700)={{{@in=@private, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r1, &(0x7f0000000800)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) 4m36.03831394s ago: executing program 33 (id=1641): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0xe0000000, 0x8810040, 0xb, 0xffff, 0xe7, 0x2, 0x0, 0x0, 0x8, 0x80000001}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) dup3(r0, r2, 0x6700000000000000) 4m36.03493859s ago: executing program 4 (id=1644): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x56a, 0x37a, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x3e, "", [{{0x9, 0x4, 0x0, 0x0, 0xf7, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0xfff, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x7, 0xe, 0x8}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000001c0)={0x2c, &(0x7f0000000340)={0x20, 0x6, 0x15, {0x15, 0x8, "83efb930f01891f0478fa20961a54207b723a9"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 4m36.0342323s ago: executing program 3 (id=1645): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x2200002, &(0x7f00000002c0)={[{@discard}, {}, {@grpquota}, {@nojournal_checksum}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@delalloc}, {@nogrpid}, {@noauto_da_alloc}, {@dioread_nolock}]}, 0x1, 0x572, &(0x7f0000000380)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=") r0 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./file0\x00', 0x86842, 0x1fb) r1 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./file1\x00', 0x42, 0x0) pwrite64(r1, &(0x7f0000000980)='a', 0x200000c1, 0x9000) openat(0xffffffffffffff9c, 0x0, 0x696782, 0x15f) fallocate(r0, 0x8, 0x4000, 0x10000) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000a40), 0x1, 0x0) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f0000000e80)={0x7, 0xa40, 0xffffff81, 0x7fffffff, 0x6, "662ceb757dcb7495e121fcd1f20e485396a278", 0x2, 0x5}) syslog(0x0, 0x0, 0x0) r3 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) syz_mount_image$erofs(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', 0x20400a, &(0x7f0000000180)=ANY=[@ANYRES64=r3, @ANYRES64, @ANYRESDEC=0x0, @ANYRES32=r3], 0xfe, 0x208, &(0x7f0000000b00)="$eJzslr+L1EAUx78zCZNdfzSWNhYeqIW5JKtiI9w1VhaCPw4LwaDxOHf1YHcRb0HOw1oES8HCwt5/QNBW/wc5ra5ZOxsLRyYzScaQ3G12cbfwfWBnv5m8eXnzXvbNgiCI/5bv337uSrRSfQRL8Mz8nlPYcMv+a+vH009XLq+9vP3us7frt6t8Sjn5810AH1cdDPO1/K/VS+b7Oniub4DjjNFrJnbFHXDcNDoBwy2jH1h6Ewy+79/f6CX+3U0BJQI1hGqI1NApxzfeYbiXxycls+4PtkbduNdL+v9QHJS/8SrHJSs+u14+dLSBlb8QHKHRHTBcM/oivCw3OiXW/o+7hX9n3/0LzLTb59W32vDyGRVKA8/HjtaWSgCYLlSA5Q7foGzzJXsLs5kXh+sd4lnJeI7CQSqyijb3I8o7VcKpMXaqjEfd+NWUe1cv+gE2cOeWTGF2wZon07NmpqnFhxW9JpuR2/q6P3i8l/9Uy6vk9oSPEPolWWmWlqI/ybcMp6z+pFvJ6/SoUSVcHmyNzm48jNeT9eRRFHUuBOeC4Hy0nDYiPe7T/9ppfzpU+K88kxSCCTyJh8N+mI6/pZT6OtJjVcflAB/vcJw+qa9VcUXJb8vSzHxcuGC693bf10ZPEASxOE6A/ZIGNxPmNIH1X/fqAmMkCIIgCIIgCIIgCGI2/gQAAP//4qI4bQ==") mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/sys/kernel/sem\x00', 0x1, 0x0) writev(r4, &(0x7f00000009c0)=[{&(0x7f0000000a00)="ca41083b", 0x4}], 0x1) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f0000000040)=0x17, 0x4) syz_clone(0x2511, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000ec0)=@base={0x1a, 0x1909fc14, 0xb, 0x1, 0x1000, 0xffffffffffffffff, 0x200, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4}, 0x50) rt_sigtimedwait(0x0, 0xffffffffffffffff, 0x0, 0x0) 4m35.337079521s ago: executing program 3 (id=1646): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000100)=[@increfs]}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000200)=[@acquire]}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000840)={0x4c, 0x0, &(0x7f0000000880)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}]}) 4m34.546635091s ago: executing program 3 (id=1651): fsopen(&(0x7f0000000080)='bpf\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6(0xa, 0x80003, 0x6) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000e80)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001b40)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000001b80)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001bc0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000001c00)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000001c80), 0x651, 0x0) recvmmsg(r3, &(0x7f0000001cc0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x3, 0x401d031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001d00)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x2, '\x00', 0x0, 0x0}, 0x50) r5 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001d80)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000001dc0)='./config\x00', &(0x7f0000001e00)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001e40)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001e80)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001ec0)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000001f40)="aa", 0x1) symlinkat(&(0x7f0000001f80)='./config/usb_gadget/g1/functions/uac2.0\x00', 0xffffffffffffff9c, &(0x7f0000001fc0)='./config/usb_gadget/g1/configs/c.1/uac2.0\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r6, &(0x7f0000002040)='dummy_udc.0', 0xb) sendmsg$nl_route(r5, &(0x7f0000002080)={0x0, 0x0, &(0x7f00000020c0)={&(0x7f0000002100)=ANY=[@ANYBLOB="4400000010004b0426bd70000000", @ANYBLOB="40180000042c0400240012800b0001006272696467650000140002800800040001000000050017f400000000"], 0x44}}, 0x24) 4m34.147947531s ago: executing program 34 (id=1651): fsopen(&(0x7f0000000080)='bpf\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6(0xa, 0x80003, 0x6) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000e80)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001b40)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000001b80)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001bc0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000001c00)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000001c80), 0x651, 0x0) recvmmsg(r3, &(0x7f0000001cc0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x3, 0x401d031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001d00)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x2, '\x00', 0x0, 0x0}, 0x50) r5 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001d80)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000001dc0)='./config\x00', &(0x7f0000001e00)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001e40)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001e80)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001ec0)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000001f40)="aa", 0x1) symlinkat(&(0x7f0000001f80)='./config/usb_gadget/g1/functions/uac2.0\x00', 0xffffffffffffff9c, &(0x7f0000001fc0)='./config/usb_gadget/g1/configs/c.1/uac2.0\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r6, &(0x7f0000002040)='dummy_udc.0', 0xb) sendmsg$nl_route(r5, &(0x7f0000002080)={0x0, 0x0, &(0x7f00000020c0)={&(0x7f0000002100)=ANY=[@ANYBLOB="4400000010004b0426bd70000000", @ANYBLOB="40180000042c0400240012800b0001006272696467650000140002800800040001000000050017f400000000"], 0x44}}, 0x24) 4m34.073023498s ago: executing program 4 (id=1654): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x2200002, &(0x7f00000002c0)={[{@discard}, {}, {@grpquota}, {@nojournal_checksum}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@delalloc}, {@nogrpid}, {@noauto_da_alloc}, {@dioread_nolock}]}, 0x1, 0x572, &(0x7f0000000380)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=") r0 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./file0\x00', 0x86842, 0x1fb) r1 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./file1\x00', 0x42, 0x0) pwrite64(r1, &(0x7f0000000980)='a', 0x200000c1, 0x9000) openat(0xffffffffffffff9c, 0x0, 0x696782, 0x15f) fallocate(r0, 0x8, 0x4000, 0x10000) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000a40), 0x1, 0x0) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f0000000e80)={0x7, 0xa40, 0xffffff81, 0x7fffffff, 0x6, "662ceb757dcb7495e121fcd1f20e485396a278", 0x2, 0x5}) syslog(0x0, 0x0, 0x0) r3 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) syz_mount_image$erofs(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', 0x20400a, &(0x7f0000000180)=ANY=[@ANYRES64=r3, @ANYRES64, @ANYRESDEC=0x0, @ANYRES32=r3], 0xfe, 0x208, &(0x7f0000000b00)="$eJzslr+L1EAUx78zCZNdfzSWNhYeqIW5JKtiI9w1VhaCPw4LwaDxOHf1YHcRb0HOw1oES8HCwt5/QNBW/wc5ra5ZOxsLRyYzScaQ3G12cbfwfWBnv5m8eXnzXvbNgiCI/5bv337uSrRSfQRL8Mz8nlPYcMv+a+vH009XLq+9vP3us7frt6t8Sjn5810AH1cdDPO1/K/VS+b7Oniub4DjjNFrJnbFHXDcNDoBwy2jH1h6Ewy+79/f6CX+3U0BJQI1hGqI1NApxzfeYbiXxycls+4PtkbduNdL+v9QHJS/8SrHJSs+u14+dLSBlb8QHKHRHTBcM/oivCw3OiXW/o+7hX9n3/0LzLTb59W32vDyGRVKA8/HjtaWSgCYLlSA5Q7foGzzJXsLs5kXh+sd4lnJeI7CQSqyijb3I8o7VcKpMXaqjEfd+NWUe1cv+gE2cOeWTGF2wZon07NmpqnFhxW9JpuR2/q6P3i8l/9Uy6vk9oSPEPolWWmWlqI/ybcMp6z+pFvJ6/SoUSVcHmyNzm48jNeT9eRRFHUuBOeC4Hy0nDYiPe7T/9ppfzpU+K88kxSCCTyJh8N+mI6/pZT6OtJjVcflAB/vcJw+qa9VcUXJb8vSzHxcuGC693bf10ZPEASxOE6A/ZIGNxPmNIH1X/fqAmMkCIIgCIIgCIIgCGI2/gQAAP//4qI4bQ==") mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/sys/kernel/sem\x00', 0x1, 0x0) writev(r4, &(0x7f00000009c0)=[{&(0x7f0000000a00)="ca41083b", 0x4}], 0x1) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f0000000040)=0x17, 0x4) syz_clone(0x2511, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000ec0)=@base={0x1a, 0x1909fc14, 0xb, 0x1, 0x1000, 0xffffffffffffffff, 0x200, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4}, 0x50) rt_sigtimedwait(0x0, 0xffffffffffffffff, 0x0, 0x0) 4m33.221083335s ago: executing program 4 (id=1656): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000010000000850000005000000095"], 0x0, 0x0, 0x0, 0x0, 0x136e54520700452d, 0x5, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000000000008500000059"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x28}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 4m32.174588721s ago: executing program 4 (id=1657): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0a00000004000000080000000a"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) close(r1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r0}, &(0x7f0000000340), &(0x7f0000000500)}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000c40)=@base={0xa, 0x2, 0x4, 0x8}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x1, 0x100, 0x0, 0x0, 0x3b8000, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000611800000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) 4m31.582570361s ago: executing program 35 (id=1657): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0a00000004000000080000000a"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) close(r1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r0}, &(0x7f0000000340), &(0x7f0000000500)}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000c40)=@base={0xa, 0x2, 0x4, 0x8}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x1, 0x100, 0x0, 0x0, 0x3b8000, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000611800000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) 1m45.335032269s ago: executing program 5 (id=2349): socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6(0xa, 0x80003, 0xff) openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8000, 0x1f7) socket$nl_route(0x10, 0x3, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) epoll_create1(0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/diskstats\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x88002, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x0, @local}, {0x2, 0x4e23, @loopback}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 1m45.152257348s ago: executing program 5 (id=2352): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000080)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000180), 0x651, 0x0) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r2, 0xf503, 0x0) recvmmsg(r1, &(0x7f00000001c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$ITER_CREATE(0x21, 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000580)='/proc/asound/seq/clients\x00', 0x0, 0x0) lseek(r3, 0x9, 0x0) 1m44.063987268s ago: executing program 5 (id=2357): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000980)=@newtfilter={0x444, 0x2c, 0x601, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xffe0}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x414, 0x2, [@TCA_CGROUP_POLICE={0x410, 0x2, [@TCA_POLICE_AVRATE={0x8, 0x4, 0x86}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x5, 0xfffffffe, 0x6, 0x0, 0x7f, 0xe5e, 0x6, 0x8, 0x2, 0xfffffff8, 0x56fdfb9f, 0x7d9b4cd5, 0x5, 0x18000000, 0x8, 0x5, 0x5, 0xac6, 0x1000, 0x3, 0x7, 0x5, 0x2, 0x101, 0x8, 0x593, 0x3, 0x5, 0xffffffff, 0x5, 0x7ff, 0xe, 0x401, 0x2, 0xfffff800, 0x5, 0x2, 0xc4, 0xe7b, 0x7, 0xff, 0x63a8, 0x10, 0x5, 0x7, 0x1, 0x5, 0x6, 0xfffffff8, 0x7, 0xe, 0x2, 0x4, 0x9, 0x3, 0x2, 0x8, 0x4, 0x7, 0xfff, 0xffffffff, 0x6, 0x400, 0xa55e, 0x9, 0x5, 0x0, 0x8, 0x3c9a9a3c, 0x4, 0x6986, 0x7, 0x3, 0xd7a1, 0x13, 0x1, 0xce7, 0x800, 0x3, 0x7, 0x2, 0xcfd, 0x1, 0xfff, 0x4, 0x3, 0xbd, 0x9, 0x5, 0x5, 0x0, 0xfffffffc, 0x2, 0x0, 0x10000000, 0x0, 0xb14b, 0x6, 0x12a7, 0x8, 0x2, 0x9, 0x2, 0x7fffffff, 0x5ef, 0xffffff4f, 0xfff, 0x7, 0x548000, 0x100, 0xb096, 0x265, 0x6f5, 0x401, 0xb, 0x6, 0x5, 0x3, 0x2, 0x200, 0x6, 0x4, 0xfff, 0xeb3, 0x3, 0x100, 0xffffffff, 0x7a9, 0x9, 0x45d2d7dd, 0x1fc000, 0x9, 0x5, 0x1, 0x0, 0xd, 0x401, 0x3, 0x5, 0x3, 0x6073, 0xde, 0x7, 0x228, 0x3, 0x8001, 0x2, 0x0, 0x3, 0x8, 0x1b5cf129, 0x8, 0x3, 0xd79, 0x2, 0x6, 0x9, 0x1, 0x0, 0x1, 0x4, 0x2e5c024b, 0x8, 0x5, 0x8, 0x5, 0x800, 0x3, 0x1ff, 0xfffffff7, 0x9a9, 0x4, 0x7, 0x1bf, 0x9, 0xa, 0x2, 0x10000, 0x7, 0xf, 0x5, 0x4, 0x8, 0xbd82, 0x0, 0x5, 0x6, 0x8, 0x35c, 0x8001, 0x4, 0x0, 0x6, 0x88, 0x5, 0x5, 0x2, 0x101, 0x4, 0xff, 0x5, 0x9, 0x0, 0x10000, 0x6, 0x1, 0xed, 0x4, 0x9, 0xfc1, 0x0, 0x8, 0x8, 0x101, 0x9, 0x101, 0xfffffffd, 0xa, 0x6, 0x4, 0x0, 0x8, 0x7f, 0x5, 0x7, 0x7, 0x401, 0x1, 0xbb, 0x7fff, 0x9, 0x7f, 0x33cd, 0x6, 0x100, 0x4, 0x0, 0xf, 0x3, 0x6, 0x6, 0xfffffffd, 0x3, 0x5, 0x1, 0x1, 0x6, 0x8, 0x0, 0x0, 0x7ff, 0x2a, 0x7, 0x0, 0x2, 0x7]}]}]}}]}, 0x444}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000880)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 1m42.178740929s ago: executing program 5 (id=2359): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) getsockopt$IP_VS_SO_GET_VERSION(0xffffffffffffffff, 0x0, 0x480, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140)="ed", 0x1, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) recvmmsg(r0, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}, 0x20000011}], 0x1, 0x40008063, 0x0) 1m42.006291517s ago: executing program 5 (id=2362): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x10, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="18020000000000000000000000000000850000003d00000095"], &(0x7f00000002c0)='GPL\x00', 0x1, 0x98, &(0x7f0000000300)=""/152}, 0x80) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x12, 0x7, 0x8, 0xb}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000440)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x7) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000500)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000680)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000700), 0x651, 0x0) recvmmsg(r4, &(0x7f0000000740), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000780)=0x6) syz_open_dev$sndpcmp(0x0, 0x1, 0x2) setrlimit(0x9, &(0x7f00000007c0)={0x33, 0x81}) io_setup(0x4, &(0x7f0000000800)) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000840), 0x10000, 0x0) setsockopt$packet_tx_ring(r6, 0x107, 0xd, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000008c0)={@map=r2, r1, 0x7}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000900)={r2, &(0x7f0000000940), &(0x7f0000000980)=@tcp6=r0}, 0x20) sendmmsg$inet6(r0, &(0x7f00000009c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000a80)="b0", 0x1}], 0x11}}], 0x2, 0x1) r7 = memfd_create(&(0x7f0000000000)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9\xbe\\', 0x0) pwrite64(r7, &(0x7f0000000040)="2f4197", 0x3, 0xde2d) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r8, 0x0, 0x2f, &(0x7f0000000080)={0x2, {{0x2, 0x4e20, @broadcast}}, {{0x2, 0x4e24, @remote}}}, 0x108) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=@newlink={0x48, 0x10, 0xd07, 0x70bd2b, 0x25dfdc02, {0x0, 0x0, 0x0, 0x0, 0x8200, 0x4602}, [@IFLA_LINKMODE={0x5}, @IFLA_IFALIAS={0x14, 0x14, 'batadv_slave_1\x00'}, @IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x48}}, 0x4000080) 1m41.053729033s ago: executing program 5 (id=2366): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) sendmsg$NL80211_CMD_REQ_SET_REG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_REG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010001000000000000001a0100000700210042420000300022802c0001800800010000000000080002000000000008000300a0b8250008000400409c0000080006"], 0x4c}}, 0x0) getpgid(0xffffffffffffffff) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000440)={'wlan1\x00'}) fcntl$getown(r0, 0x9) 1m24.938611693s ago: executing program 36 (id=2366): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) sendmsg$NL80211_CMD_REQ_SET_REG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_REG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010001000000000000001a0100000700210042420000300022802c0001800800010000000000080002000000000008000300a0b8250008000400409c0000080006"], 0x4c}}, 0x0) getpgid(0xffffffffffffffff) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000440)={'wlan1\x00'}) fcntl$getown(r0, 0x9) 9.891737812s ago: executing program 6 (id=2766): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d0200"], 0x0) ioctl$XFS_IOC_FSGROWFSRT(0xffffffffffffffff, 0x40105870, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x4, 0x208002) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0xca, r0}, 0x38) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xb, 0x0, 0x0, 0x5, 0x0, 0x0, 0x41100}, 0x94) sendmsg$nl_route(r1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, &(0x7f0000000280)) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000400)=""/249) 6.576085634s ago: executing program 6 (id=2779): socketpair(0x1f, 0xa, 0x3, &(0x7f0000000000)) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) socket$can_bcm(0x1d, 0x2, 0x2) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f00000005c0)={0x1d, r1}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) 6.139159608s ago: executing program 6 (id=2782): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x5) ioctl$SG_IO(r0, 0x2285, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000140)="aefdda9d240300005a90f57f07703aeff0f657bbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {0x0}], 0x2) 6.092566143s ago: executing program 7 (id=2783): socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6(0xa, 0x80003, 0xff) openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8000, 0x1f7) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) epoll_create1(0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/diskstats\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x88002, 0x0) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 5.957507966s ago: executing program 2 (id=2784): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12014101f2c59620d016b8108ede0102030109022400010000100009040002020083ec0009050602000202000a090582"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000840)={0x2c, &(0x7f0000000540)={0x40, 0x14, 0xc, "281e0c8808c1bf7651ef4aaa"}, 0x0, 0x0, 0x0, 0x0}) 5.956792106s ago: executing program 6 (id=2785): ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000140)={0x57, 0x0, 0x7ff, {0xffdf, 0x1}, {0x45, 0x2}, @cond=[{0x8, 0x5388, 0x8, 0x800, 0x80cb, 0x9}, {0x81, 0x1, 0x1, 0x7, 0x7, 0x2}]}) write$char_usb(0xffffffffffffffff, &(0x7f0000000180)="e2", 0x2250) socket$nl_generic(0x10, 0x3, 0x10) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x42, 0x0) socket$packet(0x11, 0x2, 0x300) socket$kcm(0x2d, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./sys\x00', 0x1ff) mount(&(0x7f0000000640)=@filename='none\x00', &(0x7f0000000680)='./sys\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/cpu/drivers/processor\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000740)='unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000780)='cpu1', 0x4) write(r1, &(0x7f00000007c0)='cpu0\n', 0x5) 5.877318414s ago: executing program 7 (id=2786): socket$netlink(0x10, 0x3, 0xc) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1c, 0x0, 0x0) unshare(0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$pokeuser(0x6, r0, 0xb0, 0x2000000000000400) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="5800000002060102000034e40000000004000008050005000a000000050001000600000005000400000000000900020073797a310000000011000300686173683a69702c706f727400001f000c00078008000640"], 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private2}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x33}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) 5.738237408s ago: executing program 6 (id=2787): sched_setscheduler(0x0, 0x1, 0x0) r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000e13d6a206419010015d4010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000280), 0x1, 0x2703) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000300)={0x0, 0x1, 0x5, &(0x7f0000000340)={0x6, "b3d92cdddf96c20e9064264ccfc6000000fa00008c0000c87fb100000000000100"}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001180)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001240)={0x40, 0x17, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 5.680250934s ago: executing program 7 (id=2788): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d0200"], 0x0) ioctl$XFS_IOC_FSGROWFSRT(0xffffffffffffffff, 0x40105870, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x4, 0x208002) bpf$MAP_CREATE(0x0, 0x0, 0x50) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xb, 0x0, 0x0, 0x5, 0x0, 0x0, 0x41100}, 0x94) sendmsg$nl_route(r0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, &(0x7f0000000280)) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000400)=""/249) 5.041024178s ago: executing program 8 (id=2793): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0) setxattr$system_posix_acl(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='system.posix_acl_default\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x24, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000280)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f0000000440)=[@increfs]}) r1 = dup3(0xffffffffffffffff, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000004c0)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x8, 0x0, &(0x7f0000000540)=[@acquire]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000580)={0x4c, 0x0, &(0x7f00000006c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000b40)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @ptr={0x70742a85, 0x0, 0x0}}}}]}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000800)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000900)={0x5c, 0x0, &(0x7f0000000ac0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0xfffffffffffffffc, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0}}, @request_death={0x400c630e, 0x2, 0x3}]}) 4.204735121s ago: executing program 8 (id=2794): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x4d, 0x5, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.897395232s ago: executing program 8 (id=2795): ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000140)={0x57, 0x0, 0x7ff, {0xffdf, 0x1}, {0x45, 0x2}, @cond=[{0x8, 0x5388, 0x8, 0x800, 0x80cb, 0x9}, {0x81, 0x1, 0x1, 0x7, 0x7, 0x2}]}) write$char_usb(0xffffffffffffffff, &(0x7f0000000180)="e2", 0x2250) socket$nl_generic(0x10, 0x3, 0x10) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x42, 0x0) socket$packet(0x11, 0x2, 0x300) socket$kcm(0x2d, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./sys\x00', 0x1ff) mount(&(0x7f0000000640)=@filename='none\x00', &(0x7f0000000680)='./sys\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/cpu/drivers/processor\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000740)='unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000780)='cpu1', 0x4) write(r1, &(0x7f00000007c0)='cpu0\n', 0x5) 3.749303177s ago: executing program 8 (id=2796): prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000300), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000340), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x6) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40042, 0x1) close(r3) r4 = syz_open_dev$dri(&(0x7f0000000300), 0x0, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000340)={0x20, 0x20, 0x20}) r5 = fsopen(&(0x7f0000000080)='binfmt_misc\x00', 0x1) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r3) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r5}}) 2.769454644s ago: executing program 8 (id=2797): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newnexthop={0x24, 0x68, 0x1, 0x100003, 0x7ffffffd, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x8}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) syz_mount_image$iso9660(&(0x7f0000000180), &(0x7f0000000200)='./file0\x00', 0x8010, &(0x7f0000000240)={[{@uid}, {@iocharset={'iocharset', 0x3d, 'cp1251'}}, {@map_off}, {@unhide}]}, 0x1, 0x59a, &(0x7f0000000280)="$eJzs3EFv29YdAPBHR3ZcD0gLFGtSNwc23SEDVldSFgdGgQEaTdlsZVEg6SI5DcXiFMHsbmg7YM0tl2wD9iW63fYJdto3KnbcsQNFyU1iS3ZaNza63w+w3xP5J///RwnvQbKpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEKNlstztRGGTD3bvxbMlmke/M2T8937+eaQ69cSRvCFH9E5aXw1Kz6drr3+7+af3rRrjaPLoalutmOTz6yRuvvf96a2F6/JyCXoLFSbH7e5/ND4zCN9HLKuqHsX3cpW7FW+kwK/Nsp7eVxlmZxxvr6+33tvtl3M8GaXmvrNKdOGmFXpUX8c3k53FnY+NWnK7dy3eHW5u9QTrdeOfdbru9Hn+wNkp7RZkP3/tgrUy2s8EgG26NY+rddcyd+oX4YVbFlw+v/a2Tan/wcH+vc5qg7klB3Xa32+l0u5312xu377TbrSMb2s8JRyKmL9r2ZAAn5eTH5oxmbvj+pus/AAAA8OMVjT9jr9//L4Zr414/+qZx3qUBAAAAZ2T8l/+r/4jq9/8hhGsh6meDtH3eZQEAAABn6C8n3mNXji5H//5PKIrF6PHo7s+ig14d1zu41Bx36fkzVv1WdGVyknGz3po8StLr0ZtN0JvT6K8nzYOT6oheoIDVGQWEv4XVJmb1ftPen+5psqz0s0G6luSD9zuh17uyUKV3qz9++vBPYTz8vw53rkThwcP9vbXf/n7//riWx/VZHh9MbqA4ch/FnFq+GP+/xfgzl2dH/FVzqsW6lmiSd6XJ2356/AvN4Qtzc66EEL7N+SS81cS8tdK0K8+Of7nO2VmbMfqNV8O4is73HPmTcL2JuX7znbp55+YxVXSPq2Jyp+i4iu7TVZzqWnyHKm7NuhbNM3I5hHCqKl6ZVQXAeXkwaxU6XP+fX3dbh7Pc0rOnmjPXTlf3VyahdZZp/+xW9yfh7Sbm7dXxxNpaPWZGb69FYc6MPl1jHy9919Xtn+FGE3NjGnzsGvurV8d5w2vTvM2qOl78v5qZtxx0o/qJuvTFwR/CG59/+ejdhwcff7L3yd6n3e6t9fYv2+3b3bA4HsakmVMpAP+/0uLraKX6c1QU2eg3nY2NTq/aTuMiTz6Mi2xzK42zYZUWyXZvuJXGoyKv8iQf1J2Pss20jMvd0SgvqrifF/EoL7O7429+iSdf/VKm4RfDKkvK0SDtlWmc5MOql1TxZlYm8Wj314Os3E6L8cHlKE2yfpb0qiwfxq189+9JuhbHZZo+FZhtpsMq62d1dxiPimynV9yLP8oHuztpvJmWSZGNqrw54TRXNuznxU6vyi6FtfO+2ABwQXz+5aPffby/v/fZKTv/ndwceLjlcvMFePOOOpp16TyGCgBM1Kv00oxVGgAAAAAAAAAAAAAAuBhe9P6/M+wsTko4n+w/UOfKZFAvevj0jsiLMYqnOmH5QpRxPp2FUwUvhNkxrQswipmd6SRwbMzLn4sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CT/CwAA///ijpDw") socketpair(0x3, 0x3, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000840), 0x0, 0x0) syz_usb_disconnect(r1) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000880)=ANY=[], 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r2, 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000008c0), 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000940)='./proc\x00', &(0x7f0000000980)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000009c0)='./proc/self/root/var\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc/self/root/var/run\x00', 0x1ff) r4 = socket$unix(0x1, 0x1, 0x0) bind$unix(r4, &(0x7f0000000b00)=@file={0x1, './proc/1/root/var/run/gssproxy.sock\x00'}, 0x6e) listen(r4, 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f0000000b80)='./proc/net/rpc/use-gss-proxy\x00', 0x41, 0x0) write(r5, &(0x7f0000000bc0)='1', 0x1) close_range(r3, 0xffffffffffffffff, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000c40)={'wlan0\x00'}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r6, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 2.768344095s ago: executing program 2 (id=2798): socket$netlink(0x10, 0x3, 0xc) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1c, 0x0, 0x0) unshare(0x0) ptrace(0x10, 0x0) ptrace$pokeuser(0x6, 0x0, 0xb0, 0x2000000000000400) 2.570662654s ago: executing program 2 (id=2799): socketpair(0x1f, 0xa, 0x3, &(0x7f0000000000)) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) socket$can_bcm(0x1d, 0x2, 0x2) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f00000005c0)={0x1d, r1}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) 2.570297474s ago: executing program 6 (id=2800): syz_usb_connect$uac1(0x6, 0x72, &(0x7f00000002c0)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0x4, 0x10, 0x6, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x923d, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x81, 0x6, 0xff, {0x7, 0x25, 0x1, 0x4, 0xf4, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0xed, 0x0, 0xe, {0x7, 0x25, 0x1, 0x4, 0xc5, 0x8000}}}}}}}}]}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x202, 0x40) write(r0, &(0x7f0000000240)='27', 0x2) chroot(0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0) 2.536877118s ago: executing program 7 (id=2801): userfaultfd(0x801) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb4147000001000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe68db8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3542646bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000100)={0x8, "b546baa5cc590d30d4d8b40d29968173b959ebab028deda525e19bdeffafde25"}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES8=r3], 0x3c}, 0x1, 0x0, 0x0, 0x20004800}, 0x8010) 2.384718502s ago: executing program 2 (id=2802): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000280)=0x4000000000000200, 0xe50fb6c50bc849c9) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) sendmsg$nl_route(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newqdisc={0x44, 0x24, 0xe0b, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xffe0, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x2}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x4000080) bind$packet(r0, &(0x7f0000000780)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r0, &(0x7f0000000980)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) 1.938540078s ago: executing program 7 (id=2803): fsopen(&(0x7f0000000080)='bpf\x00', 0x0) r0 = socket$inet6(0xa, 0x80003, 0x6) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000e80)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001b40)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000001b80)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001bc0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000001c00)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000001c80), 0x651, 0x0) recvmmsg(r3, &(0x7f0000001cc0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x3, 0x401d031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001d00)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x2, '\x00', 0x0, 0x0}, 0x50) r5 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001d80)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000001dc0)='./config\x00', &(0x7f0000001e00)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001e40)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001e80)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001ec0)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000001f00)='./config/usb_gadget/g1/functions/uac2.0/c_chmask\x00', 0x2, 0x0) write(r6, &(0x7f0000001f40)="aa", 0x1) symlinkat(&(0x7f0000001f80)='./config/usb_gadget/g1/functions/uac2.0\x00', 0xffffffffffffff9c, &(0x7f0000001fc0)='./config/usb_gadget/g1/configs/c.1/uac2.0\x00') r7 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r7, &(0x7f0000002040)='dummy_udc.0', 0xb) sendmsg$nl_route(r5, &(0x7f0000002080)={0x0, 0x0, &(0x7f00000020c0)={&(0x7f0000002100)=ANY=[@ANYBLOB="4400000010004b0426bd70000000", @ANYBLOB="40180000042c0400240012800b0001006272696467650000140002800800040001000000050017f400000000"], 0x44}}, 0x24) 1.9197409s ago: executing program 2 (id=2804): ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000140)={0x57, 0x0, 0x7ff, {0xffdf, 0x1}, {0x45, 0x2}, @cond=[{0x8, 0x5388, 0x8, 0x800, 0x80cb, 0x9}, {0x81, 0x1, 0x1, 0x7, 0x7, 0x2}]}) write$char_usb(0xffffffffffffffff, &(0x7f0000000180)="e2", 0x2250) socket$nl_generic(0x10, 0x3, 0x10) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x42, 0x0) socket$packet(0x11, 0x2, 0x300) socket$kcm(0x2d, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./sys\x00', 0x1ff) mount(&(0x7f0000000640)=@filename='none\x00', &(0x7f0000000680)='./sys\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/cpu/drivers/processor\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000740)='unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000780)='cpu1', 0x4) write(r1, &(0x7f00000007c0)='cpu0\n', 0x5) 234.201877ms ago: executing program 7 (id=2805): r0 = openat$md_new_array(0xffffff9c, &(0x7f0000000080), 0x1, 0x0) write$md_new_array(r0, &(0x7f00000000c0)={'md', @num=0x0}, 0x3) r1 = openat$md(0xffffff9c, &(0x7f0000000100)={'/dev/md', @num=0x0}, 0x2, 0x0) ioctl$SET_ARRAY_INFO(r1, 0x40480923, &(0x7f0000000140)={0x0, 0x5a, 0x0, 0x0, 0x1, 0x800, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1}) ioctl$ADD_NEW_DISK(r1, 0x40140921, &(0x7f00000001c0)={0x0, {0x1, 0x0}, 0x0, 0x6}) ioctl$GET_DISK_INFO(r1, 0x80140912, &(0x7f0000000340)={0x1}) 169.262814ms ago: executing program 2 (id=2806): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='27', 0x2) r1 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000680)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) request_key(&(0x7f0000000280)='rxrpc\x00', &(0x7f0000000380)={'syz', 0x2}, &(0x7f00000003c0)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb14x\x0f\xdf\x83\xdd31\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x14\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb]@F\xe3?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18K\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00', r1) 0s ago: executing program 8 (id=2807): socket$netlink(0x10, 0x3, 0xc) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1c, 0x0, 0x0) unshare(0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$pokeuser(0x6, r0, 0xb0, 0x2000000000000400) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="5800000002060102000034e40000000004000008050005000a000000050001000600000005000400000000000900020073797a310000000011000300686173683a69702c706f727400001f000c00078008000640"], 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private2}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x33}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) kernel console output (not intermixed with test programs): 6.151512][T11648] loop5: detected capacity change from 0 to 256 [ 546.158520][T11648] exfat: Bad value for 'uid' [ 546.220209][T11607] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 546.754820][ T9] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 547.295927][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 547.340334][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 547.412395][ T9] usb 3-1: New USB device found, idVendor=0846, idProduct=1001, bcdDevice= 1.00 [ 547.451957][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.499964][ T9] usb 3-1: Product: syz [ 547.524186][ T9] usb 3-1: Manufacturer: syz [ 547.549221][ T9] usb 3-1: SerialNumber: syz [ 547.884247][ T9] kaweth 3-1:1.0: Firmware present in device. [ 548.034855][ T9] kaweth 3-1:1.0: Error reading configuration (-71), no net device created [ 548.093778][ T9] kaweth: probe of 3-1:1.0 failed with error -5 [ 548.144792][ T9] usb 3-1: USB disconnect, device number 16 [ 550.184520][ T9] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 550.419575][ T9] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 550.449022][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 550.484555][ T9] usb 3-1: Product: syz [ 550.504786][ T9] usb 3-1: Manufacturer: syz [ 550.519573][ T9] usb 3-1: SerialNumber: syz [ 550.542544][ T9] usb 3-1: config 0 descriptor?? [ 550.892527][T11708] FAULT_INJECTION: forcing a failure. [ 550.892527][T11708] name failslab, interval 1, probability 0, space 0, times 0 [ 550.964637][T11708] CPU: 0 PID: 11708 Comm: syz.6.1856 Not tainted syzkaller #0 [ 550.972132][T11708] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 550.982183][T11708] Call Trace: [ 550.985461][T11708] [ 550.988405][T11708] dump_stack_lvl+0x18c/0x250 [ 550.993122][T11708] ? show_regs_print_info+0x20/0x20 [ 550.998339][T11708] ? load_image+0x420/0x420 [ 551.002844][T11708] ? __lock_acquire+0x7eb0/0x7eb0 [ 551.007876][T11708] should_fail_ex+0x394/0x4c0 [ 551.012565][T11708] should_failslab+0x9/0x20 [ 551.017062][T11708] slab_pre_alloc_hook+0x59/0x300 [ 551.022088][T11708] kmem_cache_alloc+0x5a/0x2d0 [ 551.026859][T11708] ? security_inode_alloc+0x34/0x110 [ 551.032198][T11708] security_inode_alloc+0x34/0x110 [ 551.037316][T11708] inode_init_always+0x914/0xc90 [ 551.042266][T11708] new_inode_pseudo+0x95/0x1d0 [ 551.047052][T11708] new_inode+0x22/0x1d0 [ 551.051234][T11708] proc_get_inode+0x22/0x730 [ 551.055849][T11708] ? proc_fill_super+0x49c/0x730 [ 551.060811][T11708] proc_fill_super+0x4ab/0x730 [ 551.065591][T11708] ? proc_reconfigure+0x370/0x370 [ 551.070616][T11708] get_tree_nodev+0xb5/0x140 [ 551.075202][T11708] vfs_get_tree+0x8c/0x280 [ 551.079631][T11708] do_new_mount+0x24a/0xa60 [ 551.084142][T11708] __se_sys_mount+0x2e7/0x3d0 [ 551.088826][T11708] ? __x64_sys_mount+0xc0/0xc0 [ 551.093599][T11708] ? lockdep_hardirqs_on+0x98/0x150 [ 551.098806][T11708] ? __x64_sys_mount+0x20/0xc0 [ 551.103657][T11708] do_syscall_64+0x55/0xb0 [ 551.108090][T11708] ? clear_bhb_loop+0x40/0x90 [ 551.112792][T11708] ? clear_bhb_loop+0x40/0x90 [ 551.117470][T11708] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 551.123382][T11708] RIP: 0033:0x7f33be39f559 [ 551.127800][T11708] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 551.147404][T11708] RSP: 002b:00007f33bf222028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 551.155829][T11708] RAX: ffffffffffffffda RBX: 00007f33be625fa0 RCX: 00007f33be39f559 [ 551.163818][T11708] RDX: 00002000000002c0 RSI: 0000200000000280 RDI: 0000000000000000 [ 551.171798][T11708] RBP: 00007f33be436b20 R08: 0000000000000000 R09: 0000000000000000 [ 551.179770][T11708] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 551.187750][T11708] R13: 00007f33be626038 R14: 00007f33be625fa0 R15: 00007fff7eb020e8 [ 551.195728][T11708] [ 551.434596][ T9] usb 3-1: Firmware: major: 63, minor: 28, hardware type: UNKNOWN (21) [ 551.625283][ T9] usb 3-1: Firmware: build a{5ZzL 2 D0˛CG>&+xI"NTDn*X)ÌfqE+ɼ%[#o [ 551.666395][T11708] proc_fill_super: get root inode failed [ 551.829311][ T9] usb 3-1: failed to fetch extended address, random address set [ 551.837435][ T9] usb 3-1: atusb_probe: initialization failed, error = -524 [ 551.845187][ T9] atusb: probe of 3-1:0.0 failed with error -524 [ 551.885033][ T9] usb 3-1: USB disconnect, device number 17 [ 553.798882][T11732] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 553.805838][T11732] udc dummy_udc.0: failed to start g1: -19 [ 553.812142][T11732] UDC core: g1: couldn't find an available UDC or it's busy [ 553.826523][ T28] audit: type=1800 audit(1792761704.315:136): pid=11733 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1865" name="c_chmask" dev="configfs" ino=32065 res=0 errno=0 [ 553.905014][ T28] audit: type=1800 audit(1792761704.325:137): pid=11732 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1865" name="UDC" dev="configfs" ino=32066 res=0 errno=0 [ 555.635117][ T28] audit: type=1800 audit(1792761706.155:138): pid=11740 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1868" name="no_out_endpoint" dev="configfs" ino=32095 res=0 errno=0 [ 555.902970][T11746] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1869'. [ 555.930129][ T28] audit: type=1800 audit(1792761706.445:139): pid=11747 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1870" name="(" dev="sda1" ino=2052 res=0 errno=0 [ 556.307663][T11755] batadv_slave_0: entered promiscuous mode [ 556.328791][ T9] IPVS: starting estimator thread 0... [ 556.348348][T11753] batadv_slave_0: left promiscuous mode [ 556.435418][T11757] IPVS: using max 29 ests per chain, 69600 per kthread [ 557.425398][T11770] zram: Cannot change disksize for initialized device [ 557.436242][T11770] loop7: detected capacity change from 0 to 256 [ 557.443191][T11770] exfat: Bad value for 'uid' [ 557.598840][T11607] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 559.232211][T11786] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1886'. [ 559.354661][ T5752] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 559.544820][ T5752] usb 6-1: Using ep0 maxpacket: 8 [ 559.584242][ T5752] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.624657][ T5752] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 559.670646][ T5752] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.720546][ T5752] usb 6-1: config 0 descriptor?? [ 559.776516][ T5752] iowarrior 6-1:0.0: no interrupt-in endpoint found [ 559.955807][T11795] input: syz0 as /devices/virtual/input/input14 [ 559.982600][ T9] usb 6-1: USB disconnect, device number 10 [ 561.213647][ T9] IPVS: starting estimator thread 0... [ 561.335894][T11813] IPVS: using max 30 ests per chain, 72000 per kthread [ 562.804800][ T9] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 562.934711][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.941022][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.003812][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 563.108667][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 563.205218][ T9] usb 6-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 563.459812][ T9] usb 6-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 563.752833][ T9] usb 6-1: Manufacturer: syz [ 563.833347][ T9] usb 6-1: config 0 descriptor?? [ 565.601221][T11865] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1908'. [ 565.657785][ T9] uclogic 0003:256C:006D.0008: failed retrieving string descriptor #100: -71 [ 565.697725][ T9] uclogic 0003:256C:006D.0008: failed retrieving pen parameters: -71 [ 565.740445][ T9] uclogic 0003:256C:006D.0008: failed probing pen v1 parameters: -71 [ 565.783856][ T9] uclogic 0003:256C:006D.0008: failed probing parameters: -71 [ 565.822372][ T9] uclogic: probe of 0003:256C:006D.0008 failed with error -71 [ 565.872198][ T9] usb 6-1: USB disconnect, device number 11 [ 567.190383][T11880] netlink: 156 bytes leftover after parsing attributes in process `syz.7.1914'. [ 567.491401][T11884] binder: 11882:11884 ioctl 541b 0 returned -22 [ 567.777282][T11890] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1920'. [ 568.704531][ T9] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 568.916851][ T9] usb 7-1: device descriptor read/64, error -71 [ 569.218969][ T9] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 569.394652][ T9] usb 7-1: device descriptor read/64, error -71 [ 569.470744][T11913] loop2: detected capacity change from 0 to 512 [ 569.514863][ T9] usb usb7-port1: attempt power cycle [ 569.580503][T11913] EXT4-fs (loop2): invalid inodes per group: 0 [ 569.580503][T11913] [ 570.117962][T11917] loop2: detected capacity change from 0 to 1024 [ 570.125008][T11917] ext4: Unknown parameter 'noacl' [ 570.137603][ T9] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 570.182263][T11607] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 570.207026][ T9] usb 7-1: device descriptor read/8, error -71 [ 570.495333][ T9] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 570.574831][ T9] usb 7-1: device descriptor read/8, error -71 [ 570.639378][T11920] FAULT_INJECTION: forcing a failure. [ 570.639378][T11920] name failslab, interval 1, probability 0, space 0, times 0 [ 570.704927][ T9] usb usb7-port1: unable to enumerate USB device [ 570.763231][T11920] CPU: 0 PID: 11920 Comm: syz.2.1929 Not tainted syzkaller #0 [ 570.770730][T11920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 570.780798][T11920] Call Trace: [ 570.784082][T11920] [ 570.787013][T11920] dump_stack_lvl+0x18c/0x250 [ 570.791701][T11920] ? show_regs_print_info+0x20/0x20 [ 570.796900][T11920] ? load_image+0x420/0x420 [ 570.801405][T11920] ? __might_sleep+0xe0/0xe0 [ 570.806000][T11920] ? __lock_acquire+0x7eb0/0x7eb0 [ 570.811041][T11920] ? mark_lock+0x94/0x320 [ 570.815375][T11920] should_fail_ex+0x394/0x4c0 [ 570.820062][T11920] should_failslab+0x9/0x20 [ 570.824578][T11920] slab_pre_alloc_hook+0x59/0x300 [ 570.829604][T11920] ? lockdep_softirqs_off+0x440/0x440 [ 570.834969][T11920] ? afs_alloc_vlserver_list+0x22/0xa0 [ 570.840470][T11920] ? afs_alloc_vlserver_list+0x22/0xa0 [ 570.845927][T11920] __kmem_cache_alloc_node+0x53/0x260 [ 570.851292][T11920] ? lockdep_softirqs_off+0x440/0x440 [ 570.856679][T11920] ? afs_alloc_vlserver_list+0x22/0xa0 [ 570.862137][T11920] __kmalloc+0xa7/0x240 [ 570.866300][T11920] afs_alloc_vlserver_list+0x22/0xa0 [ 570.871585][T11920] afs_lookup_cell+0xd29/0x1680 [ 570.876455][T11920] ? afs_find_cell+0x310/0x310 [ 570.881219][T11920] ? afs_net+0x45/0x270 [ 570.885376][T11920] ? afs_net+0x45/0x270 [ 570.889556][T11920] afs_cell_init+0x6e/0x300 [ 570.894075][T11920] proc_simple_write+0x109/0x140 [ 570.899015][T11920] ? proc_remove+0x80/0x80 [ 570.903428][T11920] proc_reg_write+0x1e4/0x2d0 [ 570.908107][T11920] ? proc_reg_llseek+0x280/0x280 [ 570.913044][T11920] vfs_write+0x299/0x9a0 [ 570.917307][T11920] ? file_end_write+0x250/0x250 [ 570.922169][T11920] ? __fget_files+0x28/0x460 [ 570.926769][T11920] ? __fget_files+0x3fc/0x460 [ 570.931460][T11920] ? __fdget_pos+0x2a3/0x330 [ 570.936049][T11920] ? ksys_write+0x74/0x260 [ 570.940492][T11920] ksys_write+0x151/0x260 [ 570.944834][T11920] ? __ia32_sys_read+0x90/0x90 [ 570.949616][T11920] ? lockdep_hardirqs_on+0x98/0x150 [ 570.954825][T11920] do_syscall_64+0x55/0xb0 [ 570.959252][T11920] ? clear_bhb_loop+0x40/0x90 [ 570.963944][T11920] ? clear_bhb_loop+0x40/0x90 [ 570.968626][T11920] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 570.974522][T11920] RIP: 0033:0x7f4fd099f559 [ 570.978955][T11920] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 570.998855][T11920] RSP: 002b:00007f4fd17cc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 571.007266][T11920] RAX: ffffffffffffffda RBX: 00007f4fd0c25fa0 RCX: 00007f4fd099f559 [ 571.015245][T11920] RDX: 0000000000000002 RSI: 0000200000000500 RDI: 0000000000000003 [ 571.023235][T11920] RBP: 00007f4fd0a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 571.031218][T11920] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 571.039188][T11920] R13: 00007f4fd0c26038 R14: 00007f4fd0c25fa0 R15: 00007ffd1648e7a8 [ 571.047186][T11920] [ 573.250248][T11940] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 573.257214][T11940] udc dummy_udc.0: failed to start g1: -19 [ 573.263512][T11940] UDC core: g1: couldn't find an available UDC or it's busy [ 573.273145][T11940] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1936'. [ 573.286750][ T28] audit: type=1800 audit(1792761723.755:140): pid=11941 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1936" name="c_chmask" dev="configfs" ino=32888 res=0 errno=0 [ 573.518056][ T28] audit: type=1800 audit(1792761723.775:141): pid=11940 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1936" name="UDC" dev="configfs" ino=32889 res=0 errno=0 [ 573.755831][T11948] loop6: detected capacity change from 0 to 512 [ 573.803409][T11950] loop7: detected capacity change from 0 to 736 [ 573.907350][T11607] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 575.181669][T11960] loop6: detected capacity change from 0 to 164 [ 575.694605][ T9] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 575.874607][ T9] usb 6-1: device descriptor read/64, error -71 [ 577.399909][T11971] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 577.406871][T11971] udc dummy_udc.0: failed to start g1: -19 [ 577.413165][T11971] UDC core: g1: couldn't find an available UDC or it's busy [ 577.421426][T11971] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1946'. [ 577.433086][ T28] audit: type=1800 audit(1792761727.925:142): pid=11972 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1946" name="c_chmask" dev="configfs" ino=33005 res=0 errno=0 [ 577.498919][ T9] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 577.634364][ T28] audit: type=1800 audit(1792761727.925:143): pid=11971 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1946" name="UDC" dev="configfs" ino=33006 res=0 errno=0 [ 577.794608][ T9] usb 6-1: device descriptor read/64, error -71 [ 577.925205][ T9] usb usb6-port1: attempt power cycle [ 578.094546][ T5752] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 578.304493][ T5752] usb 3-1: Using ep0 maxpacket: 32 [ 578.364617][ T9] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 578.385499][ T5752] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 578.462164][ T5752] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 578.533083][ T9] usb 6-1: device descriptor read/8, error -71 [ 578.565577][ T5752] usb 3-1: config 0 interface 0 has no altsetting 0 [ 578.709494][T11989] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1955'. [ 578.759199][ T5752] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 578.937335][ T5752] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 580.237382][T11993] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 580.244293][T11993] udc dummy_udc.0: failed to start g1: -19 [ 580.250630][T11993] UDC core: g1: couldn't find an available UDC or it's busy [ 580.261587][ T28] audit: type=1800 audit(1792761730.755:144): pid=11994 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1957" name="c_chmask" dev="configfs" ino=33084 res=0 errno=0 [ 580.312577][ T5752] usb 3-1: Product: syz [ 580.339284][ T5752] usb 3-1: Manufacturer: syz [ 580.364529][ T5752] usb 3-1: SerialNumber: syz [ 580.391291][ T28] audit: type=1800 audit(1792761730.765:145): pid=11993 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1957" name="UDC" dev="configfs" ino=33085 res=0 errno=0 [ 580.447403][ T5752] usb 3-1: config 0 descriptor?? [ 580.532145][T11993] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1957'. [ 580.921878][ T5752] gs_usb 3-1:0.0: Configuring for 137 interfaces [ 581.124656][ T5752] gs_usb 3-1:0.0: Couldn't get bit timing const for channel 0 (-EREMOTEIO) [ 581.194975][ T5752] gs_usb: probe of 3-1:0.0 failed with error -121 [ 581.325492][ T5752] usb 3-1: USB disconnect, device number 18 [ 581.754256][T12017] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 581.761282][T12017] udc dummy_udc.0: failed to start g1: -19 [ 581.767586][T12017] UDC core: g1: couldn't find an available UDC or it's busy [ 581.777156][T12017] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1967'. [ 581.790174][ T28] audit: type=1800 audit(1792761732.275:146): pid=12017 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1967" name="c_chmask" dev="configfs" ino=33229 res=0 errno=0 [ 581.913125][ T28] audit: type=1800 audit(1792761732.275:147): pid=12017 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1967" name="UDC" dev="configfs" ino=33230 res=0 errno=0 [ 582.228496][T12025] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1970'. [ 582.494658][ T5881] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 582.564089][T12030] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1973'. [ 582.704567][ T5881] usb 6-1: Using ep0 maxpacket: 8 [ 582.720517][ T5881] usb 6-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 582.765115][ T5881] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 582.819621][ T5881] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 582.850997][ T5881] usb 6-1: config 0 descriptor?? [ 582.879277][ T5881] iowarrior 6-1:0.0: no interrupt-in endpoint found [ 583.004800][T10982] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 583.080438][ T5881] usb 6-1: USB disconnect, device number 16 [ 583.309345][T10982] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 583.322020][T10982] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.330438][T10982] usb 3-1: Product: syz [ 583.340359][T12048] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 583.347325][T12048] udc dummy_udc.0: failed to start g1: -19 [ 583.353619][T12048] UDC core: g1: couldn't find an available UDC or it's busy [ 583.361872][T12048] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1982'. [ 583.375110][ T28] audit: type=1800 audit(1792761733.865:148): pid=12048 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1982" name="c_chmask" dev="configfs" ino=33353 res=0 errno=0 [ 583.402607][T10982] usb 3-1: Manufacturer: syz [ 583.414228][T10982] usb 3-1: SerialNumber: syz [ 583.421682][T10982] usb 3-1: config 0 descriptor?? [ 583.433564][ T28] audit: type=1800 audit(1792761733.865:149): pid=12048 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1982" name="UDC" dev="configfs" ino=33354 res=0 errno=0 [ 583.964358][T12056] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1985'. [ 584.076810][T10982] usb 3-1: Firmware: major: 97, minor: 149, hardware type: UNKNOWN (123) [ 584.283614][T10982] usb 3-1: failed to fetch extended address, random address set [ 584.314017][T10982] usb 3-1: atusb_probe: initialization failed, error = -524 [ 584.343446][T12063] loop5: detected capacity change from 0 to 736 [ 584.358283][T10982] atusb: probe of 3-1:0.0 failed with error -524 [ 584.389513][T10982] usb 3-1: USB disconnect, device number 19 [ 584.427099][T11676] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 585.436622][T10982] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 585.492049][T12081] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 585.499024][T12081] udc dummy_udc.0: failed to start g1: -19 [ 585.505338][T12081] UDC core: g1: couldn't find an available UDC or it's busy [ 585.513586][T12081] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1995'. [ 585.524227][ T28] audit: type=1800 audit(1792761736.015:150): pid=12081 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1995" name="c_chmask" dev="configfs" ino=33468 res=0 errno=0 [ 585.551072][ T28] audit: type=1800 audit(1792761736.015:151): pid=12081 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1995" name="UDC" dev="configfs" ino=33469 res=0 errno=0 [ 585.646082][T10982] usb 6-1: Using ep0 maxpacket: 8 [ 585.661298][T10982] usb 6-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 585.673545][T10982] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 585.692236][T10982] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 585.712199][T10982] usb 6-1: config 0 descriptor?? [ 585.723417][T10982] iowarrior 6-1:0.0: no interrupt-in endpoint found [ 585.939509][T10982] usb 6-1: USB disconnect, device number 17 [ 587.130711][T12110] loop7: detected capacity change from 0 to 736 [ 587.770824][T12124] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2013'. [ 588.088728][T12135] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2018'. [ 588.124915][T12135] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2018'. [ 588.163469][T12135] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2018'. [ 588.385108][T12146] netlink: 208 bytes leftover after parsing attributes in process `syz.6.2024'. [ 588.409581][T12146] netlink: 208 bytes leftover after parsing attributes in process `syz.6.2024'. [ 590.028402][ T1134] Bluetooth: hci4: Frame reassembly failed (-84) [ 590.067730][ T1134] Bluetooth: hci4: Frame reassembly failed (-84) [ 590.510081][T12172] netlink: 208 bytes leftover after parsing attributes in process `syz.5.2034'. [ 590.529281][T12172] netlink: 208 bytes leftover after parsing attributes in process `syz.5.2034'. [ 591.100974][T12188] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 591.108084][T12188] udc dummy_udc.0: failed to start g1: -19 [ 591.114483][T12188] UDC core: g1: couldn't find an available UDC or it's busy [ 591.122833][T12188] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2040'. [ 591.133697][ T28] audit: type=1800 audit(1792761741.625:152): pid=12188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2040" name="c_chmask" dev="configfs" ino=34148 res=0 errno=0 [ 591.193573][ T28] audit: type=1800 audit(1792761741.625:153): pid=12188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2040" name="UDC" dev="configfs" ino=34149 res=0 errno=0 [ 591.437317][T12196] netlink: 208 bytes leftover after parsing attributes in process `syz.7.2044'. [ 591.449849][T12196] netlink: 208 bytes leftover after parsing attributes in process `syz.7.2044'. [ 592.044825][ T5796] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 592.615038][T12216] netlink: 208 bytes leftover after parsing attributes in process `syz.5.2053'. [ 592.665252][T12216] netlink: 208 bytes leftover after parsing attributes in process `syz.5.2053'. [ 593.025113][T10982] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 593.067948][ T28] audit: type=1326 audit(1792761743.595:154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12228 comm="syz.2.2058" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fd099f559 code=0x7ffc0000 [ 593.129229][ T28] audit: type=1326 audit(1792761743.625:155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12228 comm="syz.2.2058" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f4fd099f559 code=0x7ffc0000 [ 593.465363][ T28] audit: type=1326 audit(1792761743.625:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12228 comm="syz.2.2058" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fd099f559 code=0x7ffc0000 [ 593.499726][ T28] audit: type=1326 audit(1792761743.625:157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12228 comm="syz.2.2058" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fd099f559 code=0x7ffc0000 [ 593.529249][ T28] audit: type=1326 audit(1792761743.635:158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12228 comm="syz.2.2058" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4fd095fd8e code=0x7ffc0000 [ 593.563248][T10982] usb 7-1: config 1 interface 1 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 593.581644][T10982] usb 7-1: config 1 interface 1 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 593.591823][ T28] audit: type=1326 audit(1792761743.635:159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12228 comm="syz.2.2058" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4fd099f1eb code=0x7ffc0000 [ 593.616177][ T5881] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 593.623810][T10982] usb 7-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 593.637318][T10982] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 593.681170][ T28] audit: type=1326 audit(1792761743.635:160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12228 comm="syz.2.2058" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4fd099f1eb code=0x7ffc0000 [ 593.710982][T10982] pl2303 7-1:1.0: required endpoints missing [ 593.731869][T10982] pl2303 7-1:1.1: pl2303 converter detected [ 593.772299][T10982] usb 7-1: pl2303 converter now attached to ttyUSB0 [ 593.808406][ T28] audit: type=1326 audit(1792761743.635:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12228 comm="syz.2.2058" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4fd099f1eb code=0x7ffc0000 [ 593.842028][ T5881] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 593.892520][ T5881] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 0 [ 593.999941][T10982] usb 7-1: USB disconnect, device number 8 [ 594.013202][ T5881] usb 3-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 0.00 [ 594.063453][T10982] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 594.074777][ T5881] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 594.082769][ T5881] usb 3-1: Product: syz [ 594.109629][T10982] pl2303 7-1:1.1: device disconnected [ 594.133397][ T5881] usb 3-1: Manufacturer: syz [ 594.160541][ T5881] usb 3-1: SerialNumber: syz [ 594.193970][ T5881] usb 3-1: USB2VGA dongle found at address 20 [ 594.235542][ T5881] usb 3-1: Allocated 8 output buffers [ 594.434134][T12230] mmap: syz.2.2058 (12230) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 594.805100][T12247] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 594.812013][T12247] udc dummy_udc.0: failed to start g1: -19 [ 594.818445][T12247] UDC core: g1: couldn't find an available UDC or it's busy [ 594.826658][T12247] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2064'. [ 594.863662][T12248] netlink: 208 bytes leftover after parsing attributes in process `syz.6.2065'. [ 594.911527][T12248] netlink: 208 bytes leftover after parsing attributes in process `syz.6.2065'. [ 596.315262][T12273] netlink: 208 bytes leftover after parsing attributes in process `syz.5.2074'. [ 596.342266][T12273] netlink: 208 bytes leftover after parsing attributes in process `syz.5.2074'. [ 596.512171][T12280] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2077'. [ 596.528194][ T8] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 596.720525][ T8] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 596.749957][ T8] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 596.795152][ T8] usb 7-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 596.834338][ T8] usb 7-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 596.876272][ T8] usb 7-1: Manufacturer: syz [ 596.892201][ T8] usb 7-1: config 0 descriptor?? [ 596.940204][T12285] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2079'. [ 597.186500][T12287] loop7: detected capacity change from 0 to 736 [ 597.270469][T11676] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 597.738078][ T8] uclogic 0003:256C:006D.0009: failed retrieving Huion firmware version: -71 [ 597.762058][T12297] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2085'. [ 597.782192][ T8] uclogic 0003:256C:006D.0009: failed probing parameters: -71 [ 597.800445][T12297] netlink: 140 bytes leftover after parsing attributes in process `syz.2.2085'. [ 597.816105][ T8] uclogic: probe of 0003:256C:006D.0009 failed with error -71 [ 597.848285][T12297] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2085'. [ 597.867415][ T8] usb 7-1: USB disconnect, device number 9 [ 597.895179][T12297] netlink: 140 bytes leftover after parsing attributes in process `syz.2.2085'. [ 597.932394][ T28] kauditd_printk_skb: 57 callbacks suppressed [ 597.932404][ T28] audit: type=1326 audit(1792761748.455:219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12298 comm="syz.5.2086" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 598.032821][ T28] audit: type=1326 audit(1792761748.495:220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12298 comm="syz.5.2086" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 598.093384][ T28] audit: type=1326 audit(1792761748.505:221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12298 comm="syz.5.2086" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 598.184264][ T28] audit: type=1326 audit(1792761748.505:222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12298 comm="syz.5.2086" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 598.243818][T12306] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2088'. [ 598.259285][ T28] audit: type=1326 audit(1792761748.505:223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12298 comm="syz.5.2086" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 598.284526][T10982] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 598.360018][ T28] audit: type=1326 audit(1792761748.505:224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12298 comm="syz.5.2086" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f86ed95fd8e code=0x7ffc0000 [ 598.451291][ T28] audit: type=1326 audit(1792761748.505:225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12298 comm="syz.5.2086" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f86ed99f1eb code=0x7ffc0000 [ 598.508942][T10982] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 598.523219][T10982] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 0 [ 598.543602][ T28] audit: type=1326 audit(1792761748.505:226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12298 comm="syz.5.2086" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f86ed99f1eb code=0x7ffc0000 [ 598.595773][T10982] usb 6-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 0.00 [ 598.615524][T10982] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.636487][T10982] usb 6-1: Product: syz [ 598.644080][ T28] audit: type=1326 audit(1792761748.515:227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12298 comm="syz.5.2086" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f86ed99f1eb code=0x7ffc0000 [ 598.671723][T10982] usb 6-1: Manufacturer: syz [ 598.684665][ T8] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 598.692778][T12312] netlink: 1752 bytes leftover after parsing attributes in process `syz.7.2091'. [ 598.708262][T10982] usb 6-1: SerialNumber: syz [ 598.730573][T10982] usb 6-1: USB2VGA dongle found at address 18 [ 598.753161][T10982] usb 6-1: Allocated 8 output buffers [ 598.777969][ T28] audit: type=1326 audit(1792761748.515:228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12298 comm="syz.5.2086" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f86ed99f1eb code=0x7ffc0000 [ 598.864612][ T8] usb 7-1: device descriptor read/64, error -71 [ 599.155213][ T8] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 599.344661][ T8] usb 7-1: device descriptor read/64, error -71 [ 599.470128][T12328] loop2: detected capacity change from 0 to 512 [ 599.491146][ T8] usb usb7-port1: attempt power cycle [ 599.819548][T12333] loop2: detected capacity change from 0 to 164 [ 600.021514][T12335] loop5: detected capacity change from 0 to 512 [ 600.044815][ T8] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 600.101327][ T8] usb 7-1: device descriptor read/8, error -71 [ 600.133051][T12335] EXT4-fs (loop5): invalid inodes per group: 0 [ 600.133051][T12335] [ 600.613024][T12338] loop5: detected capacity change from 0 to 1024 [ 600.620064][T12338] ext4: Unknown parameter 'noacl' [ 600.694903][ T8] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 600.747689][ T8] usb 7-1: device descriptor read/8, error -71 [ 600.897669][ T5796] Bluetooth: hci1: command 0x0406 tx timeout [ 600.907412][ T8] usb usb7-port1: unable to enumerate USB device [ 603.134276][ T9] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 603.158561][ T28] kauditd_printk_skb: 66 callbacks suppressed [ 603.158571][ T28] audit: type=1326 audit(1792761753.685:295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12352 comm="syz.6.2108" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 603.214134][ T28] audit: type=1326 audit(1792761753.715:296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12352 comm="syz.6.2108" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 603.378492][ T9] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 603.391720][ T28] audit: type=1326 audit(1792761753.905:297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12352 comm="syz.6.2108" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 603.424483][ T9] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 0 [ 603.458305][ T9] usb 7-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 0.00 [ 603.472739][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 603.491495][ T28] audit: type=1326 audit(1792761753.905:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12352 comm="syz.6.2108" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 603.533882][ T9] usb 7-1: Product: syz [ 603.543425][ T9] usb 7-1: Manufacturer: syz [ 603.556929][ T9] usb 7-1: SerialNumber: syz [ 603.587199][ T9] usb 7-1: USB2VGA dongle found at address 14 [ 603.598788][ T28] audit: type=1326 audit(1792761753.905:299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12352 comm="syz.6.2108" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 603.643974][ T9] usb 7-1: Allocated 8 output buffers [ 603.678590][ T28] audit: type=1326 audit(1792761753.905:300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12352 comm="syz.6.2108" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 603.753756][ T28] audit: type=1326 audit(1792761753.905:301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12352 comm="syz.6.2108" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 603.851126][ T28] audit: type=1326 audit(1792761753.915:302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12352 comm="syz.6.2108" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 603.940625][ T28] audit: type=1326 audit(1792761753.975:303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12352 comm="syz.6.2108" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 604.058736][ T28] audit: type=1326 audit(1792761753.975:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12352 comm="syz.6.2108" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 604.171922][T12378] __nla_validate_parse: 5 callbacks suppressed [ 604.171960][T12378] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2118'. [ 604.831415][T12395] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2124'. [ 604.920156][T12398] loop2: detected capacity change from 0 to 512 [ 604.947471][T12398] EXT4-fs (loop2): invalid inodes per group: 0 [ 604.947471][T12398] [ 605.416078][T12399] loop2: detected capacity change from 0 to 1024 [ 605.424343][T12399] ext4: Unknown parameter 'noacl' [ 605.527615][T11851] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 605.967554][T12372] Bluetooth: hci2: command 0x0406 tx timeout [ 605.973931][T12372] Bluetooth: hci3: command 0x0406 tx timeout [ 606.062132][T12412] loop2: detected capacity change from 0 to 736 [ 606.116176][T11851] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 606.319895][T12419] netlink: 32 bytes leftover after parsing attributes in process `syz.7.2134'. [ 606.971252][T12424] loop5: detected capacity change from 0 to 512 [ 607.003633][T12424] EXT4-fs (loop5): invalid inodes per group: 0 [ 607.003633][T12424] [ 607.483927][T12425] loop5: detected capacity change from 0 to 1024 [ 607.491037][T12425] ext4: Unknown parameter 'noacl' [ 609.559572][ T28] kauditd_printk_skb: 56 callbacks suppressed [ 609.559584][ T28] audit: type=1800 audit(1792761760.085:361): pid=12445 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2143" name="no_out_endpoint" dev="configfs" ino=35466 res=0 errno=0 [ 609.745521][T12447] device-mapper: dirty region log: invalid region size 64 [ 609.752682][T12447] device-mapper: table: 248:2: mirror: Error creating mirror dirty log (-EINVAL) [ 609.944774][T12447] device-mapper: ioctl: error adding target to table [ 609.959250][T12452] input: syz0 as /devices/virtual/input/input15 [ 610.064782][T12454] syz.2.2147 uses obsolete (PF_INET,SOCK_PACKET) [ 610.260571][T12456] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 610.267553][T12456] udc dummy_udc.0: failed to start g1: -19 [ 610.273865][T12456] UDC core: g1: couldn't find an available UDC or it's busy [ 610.282275][T12456] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2148'. [ 610.360692][ T28] audit: type=1800 audit(1792761760.785:362): pid=12456 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2148" name="c_chmask" dev="configfs" ino=35502 res=0 errno=0 [ 610.413257][ T28] audit: type=1800 audit(1792761760.785:363): pid=12456 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2148" name="UDC" dev="configfs" ino=35503 res=0 errno=0 [ 612.242140][T12476] loop7: detected capacity change from 0 to 736 [ 612.344757][T11851] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 612.945600][ T28] audit: type=1326 audit(1792761763.475:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12486 comm="syz.5.2163" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 613.065982][ T28] audit: type=1326 audit(1792761763.505:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12486 comm="syz.5.2163" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 613.189448][ T28] audit: type=1326 audit(1792761763.505:366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12486 comm="syz.5.2163" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 613.388565][ T28] audit: type=1326 audit(1792761763.515:367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12486 comm="syz.5.2163" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 613.466125][ T28] audit: type=1326 audit(1792761763.515:368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12486 comm="syz.5.2163" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f86ed95fd8e code=0x7ffc0000 [ 613.540305][ T28] audit: type=1326 audit(1792761763.515:369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12486 comm="syz.5.2163" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f86ed99f1eb code=0x7ffc0000 [ 613.604219][ T28] audit: type=1326 audit(1792761763.515:370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12486 comm="syz.5.2163" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f86ed99f1eb code=0x7ffc0000 [ 616.773167][ T28] kauditd_printk_skb: 2 callbacks suppressed [ 616.773177][ T28] audit: type=1326 audit(1792761767.295:373): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12570 comm="syz.6.2193" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 616.828237][ T28] audit: type=1326 audit(1792761767.335:374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12570 comm="syz.6.2193" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 616.857002][ T28] audit: type=1326 audit(1792761767.335:375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12570 comm="syz.6.2193" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 616.885522][ T28] audit: type=1326 audit(1792761767.335:376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12570 comm="syz.6.2193" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 616.920812][ T28] audit: type=1326 audit(1792761767.335:377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12570 comm="syz.6.2193" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 617.045968][ T28] audit: type=1326 audit(1792761767.335:378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12570 comm="syz.6.2193" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f33be35fd8e code=0x7ffc0000 [ 617.105732][ T28] audit: type=1326 audit(1792761767.345:379): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12570 comm="syz.6.2193" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 617.169985][ T28] audit: type=1326 audit(1792761767.345:380): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12570 comm="syz.6.2193" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 617.234628][ T28] audit: type=1326 audit(1792761767.345:381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12570 comm="syz.6.2193" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 617.294057][ T28] audit: type=1326 audit(1792761767.345:382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12570 comm="syz.6.2193" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 619.905307][T12605] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2206'. [ 620.479736][T12600] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 620.528294][T12600] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 620.574351][T12600] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 620.601306][T12600] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 620.622421][T12600] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 620.638993][T12600] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 620.662004][T12600] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 620.679402][T12600] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 621.644780][ T5796] Bluetooth: hci0: command 0x0c1a tx timeout [ 621.652858][T12600] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 621.753750][T12629] loop5: detected capacity change from 0 to 736 [ 623.399393][ T5796] Bluetooth: hci1: command 0x0406 tx timeout [ 623.405541][T11257] Bluetooth: hci2: command 0x0406 tx timeout [ 623.411576][T12409] Bluetooth: hci3: command 0x0406 tx timeout [ 623.419747][ T28] audit: type=1800 audit(1792761773.925:383): pid=12636 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2216" name="no_out_endpoint" dev="configfs" ino=36119 res=0 errno=0 [ 623.605760][T12642] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2218'. [ 623.633515][T12641] loop7: detected capacity change from 0 to 736 [ 623.676574][T11851] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 623.725333][ T5796] Bluetooth: hci0: command 0x0c1a tx timeout [ 624.384252][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.390669][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.646604][T12663] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2228'. [ 624.682474][T12663] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2228'. [ 624.708468][T12666] loop5: detected capacity change from 0 to 736 [ 624.719152][T12668] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2228'. [ 624.740751][T12668] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2228'. [ 624.762690][T11851] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 625.484900][ T5796] Bluetooth: hci1: command 0x0406 tx timeout [ 625.491079][T11257] Bluetooth: hci2: command 0x0406 tx timeout [ 625.498568][T12409] Bluetooth: hci3: command 0x0406 tx timeout [ 625.805161][ T5796] Bluetooth: hci0: command 0x0c1a tx timeout [ 625.842760][T12687] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2239'. [ 625.856918][T12687] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2239'. [ 625.874247][T12687] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2239'. [ 625.887755][T12687] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2239'. [ 626.494686][T12707] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2249'. [ 626.514575][T12707] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2249'. [ 626.534097][T12707] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2249'. [ 626.543485][T12707] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2249'. [ 627.245269][ T28] audit: type=1800 audit(1792761777.775:384): pid=12716 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2252" name="c_chmask" dev="configfs" ino=36493 res=0 errno=0 [ 627.277958][T12716] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 627.334311][T12716] udc dummy_udc.0: failed to start g1: -19 [ 627.349416][ T28] audit: type=1800 audit(1792761777.795:385): pid=12716 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2252" name="UDC" dev="configfs" ino=36494 res=0 errno=0 [ 627.412821][T12719] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2252'. [ 627.494703][T12716] UDC core: g1: couldn't find an available UDC or it's busy [ 628.018609][T12731] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2259'. [ 628.629861][T12745] loop6: detected capacity change from 0 to 736 [ 628.718300][T11851] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 628.878316][ T28] audit: type=1326 audit(1792761779.405:386): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12751 comm="syz.5.2269" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 629.045626][ T28] audit: type=1326 audit(1792761779.445:387): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12751 comm="syz.5.2269" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 629.140915][ T28] audit: type=1326 audit(1792761779.445:388): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12751 comm="syz.5.2269" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 629.241847][ T28] audit: type=1326 audit(1792761779.445:389): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12751 comm="syz.5.2269" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 629.342170][ T28] audit: type=1326 audit(1792761779.465:390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12751 comm="syz.5.2269" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f86ed95fd8e code=0x7ffc0000 [ 629.440184][ T28] audit: type=1326 audit(1792761779.465:391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12751 comm="syz.5.2269" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f86ed99f1eb code=0x7ffc0000 [ 629.573223][ T28] audit: type=1326 audit(1792761779.465:392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12751 comm="syz.5.2269" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f86ed99f1eb code=0x7ffc0000 [ 629.704551][ T28] audit: type=1326 audit(1792761779.465:393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12751 comm="syz.5.2269" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f86ed99f1eb code=0x7ffc0000 [ 629.843287][ T28] audit: type=1326 audit(1792761779.465:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12751 comm="syz.5.2269" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f86ed99f1eb code=0x7ffc0000 [ 631.030099][ T5787] syz_tun (unregistering): left allmulticast mode [ 631.208651][T11257] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 631.219318][T11257] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 631.232536][T11257] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 631.242062][T11257] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 631.252517][T11257] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 631.261300][T11257] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 631.332022][T12786] __nla_validate_parse: 7 callbacks suppressed [ 631.332035][T12786] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2284'. [ 631.361307][T12783] rxe_eth0 speed is unknown, defaulting to 1000 [ 631.610063][T12790] netlink: 1616 bytes leftover after parsing attributes in process `syz.6.2286'. [ 631.920791][T12783] chnl_net:caif_netlink_parms(): no params data found [ 632.208206][T12783] bridge0: port 1(bridge_slave_0) entered blocking state [ 632.374352][T12783] bridge0: port 1(bridge_slave_0) entered disabled state [ 632.396995][T12783] bridge_slave_0: entered allmulticast mode [ 632.648374][T12783] bridge_slave_0: entered promiscuous mode [ 632.678443][T12783] bridge0: port 2(bridge_slave_1) entered blocking state [ 632.699060][T12783] bridge0: port 2(bridge_slave_1) entered disabled state [ 632.718727][T12783] bridge_slave_1: entered allmulticast mode [ 632.741755][T12783] bridge_slave_1: entered promiscuous mode [ 632.819107][T12783] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 632.851340][T12783] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 632.932820][T12816] netlink: 1616 bytes leftover after parsing attributes in process `syz.6.2294'. [ 632.944867][T12783] team0: Port device team_slave_0 added [ 632.962059][T12783] team0: Port device team_slave_1 added [ 633.118408][T12783] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 633.154578][T12783] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 633.277209][T12783] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 633.302724][T12783] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 633.328867][T11257] Bluetooth: hci0: command tx timeout [ 633.341124][T12783] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 633.680769][ T28] audit: type=1326 audit(1792761784.205:395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12825 comm="syz.5.2298" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86ed99f559 code=0x7ffc0000 [ 633.706362][T12783] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 633.891626][T12783] hsr_slave_0: entered promiscuous mode [ 633.941279][T12783] hsr_slave_1: entered promiscuous mode [ 633.952858][T12831] FAULT_INJECTION: forcing a failure. [ 633.952858][T12831] name fail_futex, interval 1, probability 0, space 0, times 1 [ 633.986635][T12783] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 634.016732][T12831] CPU: 0 PID: 12831 Comm: syz.6.2299 Not tainted syzkaller #0 [ 634.024223][T12831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 634.034294][T12831] Call Trace: [ 634.037567][T12831] [ 634.040493][T12831] dump_stack_lvl+0x18c/0x250 [ 634.045184][T12831] ? arch_stack_walk+0x160/0x190 [ 634.050123][T12831] ? show_regs_print_info+0x20/0x20 [ 634.055328][T12831] ? load_image+0x420/0x420 [ 634.059824][T12831] ? stack_trace_save+0xaa/0x100 [ 634.064760][T12831] ? stack_trace_snprint+0xf0/0xf0 [ 634.069874][T12831] should_fail_ex+0x394/0x4c0 [ 634.074553][T12831] get_futex_key+0x136/0x1030 [ 634.079231][T12831] ? ____kasan_slab_free+0x126/0x1f0 [ 634.084516][T12831] ? slab_free_freelist_hook+0x154/0x240 [ 634.090159][T12831] ? kmem_cache_free+0xf8/0x290 [ 634.095010][T12831] ? __x64_sys_mkdirat+0x89/0xa0 [ 634.099966][T12831] ? futex_setup_timer+0xc0/0xc0 [ 634.104909][T12831] futex_wake+0x127/0x4f0 [ 634.109239][T12831] ? futex_wake_mark+0x150/0x150 [ 634.114177][T12831] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 634.120166][T12831] ? lock_chain_count+0x20/0x20 [ 634.125024][T12831] do_futex+0x35d/0x3e0 [ 634.129179][T12831] ? __ia32_sys_get_robust_list+0x110/0x110 [ 634.135105][T12831] __se_sys_futex+0x3a9/0x440 [ 634.139789][T12831] ? __x64_sys_futex+0xf0/0xf0 [ 634.144551][T12831] ? __x64_sys_futex+0x21/0xf0 [ 634.149316][T12831] do_syscall_64+0x55/0xb0 [ 634.153732][T12831] ? clear_bhb_loop+0x40/0x90 [ 634.158408][T12831] ? clear_bhb_loop+0x40/0x90 [ 634.163083][T12831] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 634.168973][T12831] RIP: 0033:0x7f33be39f559 [ 634.173398][T12831] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 634.193005][T12831] RSP: 002b:00007f33bf2010e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 634.201423][T12831] RAX: ffffffffffffffda RBX: 00007f33be626098 RCX: 00007f33be39f559 [ 634.209397][T12831] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f33be62609c [ 634.217359][T12831] RBP: 00007f33be626090 R08: 0000000000745d1e R09: 0000000000000000 [ 634.225322][T12831] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 634.233289][T12831] R13: 00007f33be626128 R14: 00007fff7eb02000 R15: 00007fff7eb020e8 [ 634.241268][T12831] [ 634.246709][T12783] Cannot create hsr debugfs directory [ 634.407411][T12835] loop7: detected capacity change from 0 to 512 [ 634.661014][T11851] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 634.680753][T12783] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 634.937699][T12836] loop7: detected capacity change from 0 to 164 [ 635.129442][T12783] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 635.398447][T12839] netlink: 1616 bytes leftover after parsing attributes in process `syz.7.2302'. [ 635.408120][T11257] Bluetooth: hci0: command tx timeout [ 635.427623][T12783] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 635.526340][T12783] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 636.096143][T12783] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 636.107310][T12783] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 636.120812][T12783] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 636.131536][T12783] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 636.320201][T12783] 8021q: adding VLAN 0 to HW filter on device bond0 [ 636.342614][T12846] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2304'. [ 636.491128][T12783] 8021q: adding VLAN 0 to HW filter on device team0 [ 636.547245][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 636.554437][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 636.661505][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 636.668760][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 637.485443][T11257] Bluetooth: hci0: command tx timeout [ 637.513823][T12783] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 637.573444][T12783] veth0_vlan: entered promiscuous mode [ 637.608344][T12783] veth1_vlan: entered promiscuous mode [ 637.871191][T12783] veth0_macvtap: entered promiscuous mode [ 637.891291][T12783] veth1_macvtap: entered promiscuous mode [ 638.123915][T12870] zram: Cannot change disksize for initialized device [ 638.134950][T12870] loop6: detected capacity change from 0 to 256 [ 638.141989][T12870] exfat: Bad value for 'uid' [ 638.178079][T11851] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 638.295514][T12783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 638.338776][T12783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 638.390418][T12783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 638.429202][T12783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 638.456815][T12783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 638.483923][T12783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 638.519333][T12783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 638.635007][T12783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 638.662859][T12783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 638.690072][T12783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 638.720279][T12783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 638.749477][T12783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 638.789305][T12783] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 638.843833][T12783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 638.888328][T12783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 638.933427][T12783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 638.977554][T12783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 639.017848][T12783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 639.057561][T12783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 639.100282][T12783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 639.141207][T12783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 639.178675][T12783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 639.229084][T12783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 639.268726][T12783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 639.297300][ T28] kauditd_printk_skb: 8 callbacks suppressed [ 639.297311][ T28] audit: type=1326 audit(1792761789.825:404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12881 comm="syz.7.2314" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 639.332942][T12783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 639.356217][T12783] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 639.381579][T12783] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 639.395653][ T28] audit: type=1326 audit(1792761789.855:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12881 comm="syz.7.2314" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 639.424505][T12783] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 639.433203][T12783] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 639.446943][T12783] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 639.462324][ T28] audit: type=1326 audit(1792761789.855:406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12881 comm="syz.7.2314" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 639.502362][T12879] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2313'. [ 639.569308][T11257] Bluetooth: hci0: command tx timeout [ 639.607001][ T28] audit: type=1326 audit(1792761789.855:407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12881 comm="syz.7.2314" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 639.722370][ T32] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 639.778904][ T28] audit: type=1326 audit(1792761789.855:408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12881 comm="syz.7.2314" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 639.816735][ T32] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 639.910707][ T28] audit: type=1326 audit(1792761789.875:409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12881 comm="syz.7.2314" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7be8b5fd8e code=0x7ffc0000 [ 639.990848][ T7062] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 640.039104][ T7062] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 640.101838][ T28] audit: type=1326 audit(1792761789.875:410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12881 comm="syz.7.2314" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7be8b9f1eb code=0x7ffc0000 [ 640.510652][ T28] audit: type=1326 audit(1792761789.875:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12881 comm="syz.7.2314" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7be8b9f1eb code=0x7ffc0000 [ 640.634626][ T28] audit: type=1326 audit(1792761789.875:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12881 comm="syz.7.2314" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7be8b9f1eb code=0x7ffc0000 [ 640.744357][ T28] audit: type=1326 audit(1792761789.875:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12881 comm="syz.7.2314" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7be8b9f1eb code=0x7ffc0000 [ 641.296440][T12898] zram: Cannot change disksize for initialized device [ 641.306959][T12898] loop2: detected capacity change from 0 to 256 [ 641.313921][T12898] exfat: Bad value for 'uid' [ 641.360879][T11851] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 641.901981][T12909] 9pnet_fd: Insufficient options for proto=fd [ 643.718857][T12920] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2327'. [ 644.796035][T12929] zram: Cannot change disksize for initialized device [ 644.806536][T12929] loop7: detected capacity change from 0 to 256 [ 644.813496][T12929] exfat: Bad value for 'uid' [ 645.289471][T12937] loop6: detected capacity change from 0 to 736 [ 645.387451][T11851] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 646.130303][T12952] Bluetooth: MGMT ver 1.22 [ 646.823613][T12963] zram: Cannot change disksize for initialized device [ 646.834089][T12963] loop6: detected capacity change from 0 to 256 [ 646.841080][T12963] exfat: Bad value for 'uid' [ 646.878060][T11851] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 647.195308][ T28] audit: type=1800 audit(1792761797.725:414): pid=12969 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2346" name="UDC" dev="configfs" ino=38309 res=0 errno=0 [ 647.217668][T12969] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 647.239221][T12969] udc dummy_udc.0: failed to start g1: -19 [ 647.338617][T12969] UDC core: g1: couldn't find an available UDC or it's busy [ 650.691041][T12992] orangefs_mount: mount request failed with -4 [ 651.324268][T13017] FAULT_INJECTION: forcing a failure. [ 651.324268][T13017] name failslab, interval 1, probability 0, space 0, times 0 [ 651.338018][T13017] CPU: 0 PID: 13017 Comm: syz.7.2365 Not tainted syzkaller #0 [ 651.345517][T13017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 651.355581][T13017] Call Trace: [ 651.358877][T13017] [ 651.361830][T13017] dump_stack_lvl+0x18c/0x250 [ 651.366552][T13017] ? show_regs_print_info+0x20/0x20 [ 651.371754][T13017] ? load_image+0x420/0x420 [ 651.376257][T13017] ? __lock_acquire+0x7eb0/0x7eb0 [ 651.381294][T13017] should_fail_ex+0x394/0x4c0 [ 651.385975][T13017] should_failslab+0x9/0x20 [ 651.390477][T13017] slab_pre_alloc_hook+0x59/0x300 [ 651.395507][T13017] kmem_cache_alloc_node+0x5e/0x320 [ 651.400699][T13017] ? alloc_vmap_area+0x6f7/0x1e50 [ 651.405735][T13017] alloc_vmap_area+0x6f7/0x1e50 [ 651.410631][T13017] ? vm_map_ram+0xcf0/0xcf0 [ 651.415152][T13017] ? rcu_is_watching+0x15/0xb0 [ 651.419929][T13017] __get_vm_area_node+0x162/0x370 [ 651.424966][T13017] ? __vb2_queue_alloc+0x78f/0x1410 [ 651.430258][T13017] __vmalloc_node_range+0x36f/0x1320 [ 651.435548][T13017] ? vb2_vmalloc_alloc+0xef/0x330 [ 651.440583][T13017] ? free_vm_area+0x50/0x50 [ 651.445100][T13017] vmalloc_user+0x74/0x80 [ 651.449432][T13017] ? vb2_vmalloc_alloc+0xef/0x330 [ 651.454456][T13017] vb2_vmalloc_alloc+0xef/0x330 [ 651.459322][T13017] ? __copy_timestamp+0x1f0/0x1f0 [ 651.464344][T13017] __vb2_queue_alloc+0x78f/0x1410 [ 651.469389][T13017] vb2_core_reqbufs+0x9e8/0x10d0 [ 651.474339][T13017] ? vb2_verify_memory_type+0x570/0x570 [ 651.479904][T13017] __vb2_init_fileio+0x2ec/0xcc0 [ 651.484874][T13017] ? _raw_spin_unlock+0x40/0x40 [ 651.489732][T13017] vb2_core_poll+0x5a8/0x7a0 [ 651.494345][T13017] vb2_fop_poll+0x14f/0x320 [ 651.498847][T13017] ? vb2_fop_read+0x360/0x360 [ 651.503538][T13017] v4l2_poll+0x144/0x2b0 [ 651.507861][T13017] ? v4l2_write+0x2c0/0x2c0 [ 651.512375][T13017] do_sys_poll+0x8e7/0x11e0 [ 651.516902][T13017] ? poll_select_finish+0x5e0/0x5e0 [ 651.522143][T13017] ? poll_initwait+0x160/0x160 [ 651.526944][T13017] ? __ia32_compat_sys_ppoll_time64+0x320/0x320 [ 651.533257][T13017] ? set_user_sigmask+0xce/0x1c0 [ 651.538212][T13017] ? sigprocmask+0x190/0x190 [ 651.542817][T13017] __se_sys_ppoll+0x20a/0x2b0 [ 651.547497][T13017] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 651.553480][T13017] ? __x64_sys_ppoll+0xc0/0xc0 [ 651.558275][T13017] ? lockdep_hardirqs_on+0x98/0x150 [ 651.563485][T13017] ? __x64_sys_ppoll+0x20/0xc0 [ 651.568291][T13017] do_syscall_64+0x55/0xb0 [ 651.572736][T13017] ? clear_bhb_loop+0x40/0x90 [ 651.577425][T13017] ? clear_bhb_loop+0x40/0x90 [ 651.582109][T13017] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 651.588005][T13017] RIP: 0033:0x7f7be8b9f559 [ 651.592421][T13017] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 651.612043][T13017] RSP: 002b:00007f7be9a3e028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 651.620480][T13017] RAX: ffffffffffffffda RBX: 00007f7be8e25fa0 RCX: 00007f7be8b9f559 [ 651.628458][T13017] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000680 [ 651.636426][T13017] RBP: 00007f7be8c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 651.644392][T13017] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 651.652371][T13017] R13: 00007f7be8e26038 R14: 00007f7be8e25fa0 R15: 00007ffc83f3f798 [ 651.660352][T13017] [ 651.894065][T13025] netlink: 1688 bytes leftover after parsing attributes in process `syz.7.2368'. [ 654.038316][T13047] netlink: 1688 bytes leftover after parsing attributes in process `syz.6.2377'. [ 655.509439][T13073] netlink: 1688 bytes leftover after parsing attributes in process `syz.6.2387'. [ 657.528389][T13075] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2388'. [ 657.782263][ T28] audit: type=1326 audit(1792761808.305:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13082 comm="syz.2.2391" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff23ff9f559 code=0x7ffc0000 [ 657.830767][ T28] audit: type=1326 audit(1792761808.335:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13082 comm="syz.2.2391" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff23ff9f559 code=0x7ffc0000 [ 657.866553][ T28] audit: type=1326 audit(1792761808.335:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13082 comm="syz.2.2391" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7ff23ff9f559 code=0x7ffc0000 [ 657.898208][ T28] audit: type=1326 audit(1792761808.335:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13082 comm="syz.2.2391" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff23ff9f559 code=0x7ffc0000 [ 657.929338][ T28] audit: type=1326 audit(1792761808.345:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13082 comm="syz.2.2391" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ff23ff5fd8e code=0x7ffc0000 [ 657.962826][ T28] audit: type=1326 audit(1792761808.345:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13082 comm="syz.2.2391" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff23ff9f1eb code=0x7ffc0000 [ 657.998082][ T28] audit: type=1326 audit(1792761808.345:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13082 comm="syz.2.2391" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff23ff9f1eb code=0x7ffc0000 [ 658.030527][ T28] audit: type=1326 audit(1792761808.345:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13082 comm="syz.2.2391" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff23ff9f1eb code=0x7ffc0000 [ 658.065257][ T28] audit: type=1326 audit(1792761808.345:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13082 comm="syz.2.2391" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff23ff9f1eb code=0x7ffc0000 [ 658.931543][T13095] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2396'. [ 659.351992][ T28] audit: type=1800 audit(1792761809.875:424): pid=13104 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2399" name="c_chmask" dev="configfs" ino=38793 res=0 errno=0 [ 659.377495][T13104] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 659.421975][T13104] udc dummy_udc.0: failed to start g1: -19 [ 659.471948][T13104] UDC core: g1: couldn't find an available UDC or it's busy [ 659.497193][T13106] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2399'. [ 663.943695][T13143] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 663.950750][T13143] udc dummy_udc.0: failed to start g1: -19 [ 663.957078][T13143] UDC core: g1: couldn't find an available UDC or it's busy [ 663.965610][T13143] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2407'. [ 663.983483][ T28] kauditd_printk_skb: 1 callbacks suppressed [ 663.983492][ T28] audit: type=1800 audit(1792761814.465:426): pid=13143 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2407" name="c_chmask" dev="configfs" ino=38949 res=0 errno=0 [ 664.153351][ T28] audit: type=1800 audit(1792761814.465:427): pid=13143 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2407" name="UDC" dev="configfs" ino=38950 res=0 errno=0 [ 664.184303][T13147] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2415'. [ 664.940064][ T28] audit: type=1326 audit(1792761815.465:428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13155 comm="syz.6.2419" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 665.021373][ T28] audit: type=1326 audit(1792761815.465:429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13155 comm="syz.6.2419" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 665.075045][ T28] audit: type=1326 audit(1792761815.495:430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13155 comm="syz.6.2419" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 665.142690][ T28] audit: type=1326 audit(1792761815.495:431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13155 comm="syz.6.2419" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 665.200628][ T28] audit: type=1326 audit(1792761815.505:432): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13155 comm="syz.6.2419" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f33be35fd8e code=0x7ffc0000 [ 665.271439][ T28] audit: type=1326 audit(1792761815.505:433): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13155 comm="syz.6.2419" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 665.313690][ T28] audit: type=1326 audit(1792761815.505:434): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13155 comm="syz.6.2419" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 665.352955][ T28] audit: type=1326 audit(1792761815.505:435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13155 comm="syz.6.2419" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 665.529360][T13165] netlink: 'syz.2.2422': attribute type 72 has an invalid length. [ 668.485036][T13175] loop6: detected capacity change from 0 to 736 [ 668.589891][T11851] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 669.415355][ T5796] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 669.427633][ T5796] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 669.435625][ T5796] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 669.443809][ T5796] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 669.454571][ T5796] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 669.463711][ T5796] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 669.532184][T13185] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.2431'. [ 669.580195][T13182] rxe_eth0 speed is unknown, defaulting to 1000 [ 670.329785][T13182] chnl_net:caif_netlink_parms(): no params data found [ 670.534006][T13182] bridge0: port 1(bridge_slave_0) entered blocking state [ 670.559780][T13182] bridge0: port 1(bridge_slave_0) entered disabled state [ 670.580355][T13182] bridge_slave_0: entered allmulticast mode [ 670.603433][T13182] bridge_slave_0: entered promiscuous mode [ 670.645167][T13194] orangefs_mount: mount request failed with -4 [ 670.663508][T13182] bridge0: port 2(bridge_slave_1) entered blocking state [ 670.681584][T13182] bridge0: port 2(bridge_slave_1) entered disabled state [ 670.728314][T13182] bridge_slave_1: entered allmulticast mode [ 670.770887][T13182] bridge_slave_1: entered promiscuous mode [ 670.924169][T13182] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 671.056329][T13182] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 671.245931][T13182] team0: Port device team_slave_0 added [ 671.297484][T13182] team0: Port device team_slave_1 added [ 671.338671][T13210] loop2: detected capacity change from 0 to 736 [ 671.453874][T13182] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 671.492481][T13182] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 671.566054][ T5796] Bluetooth: hci4: command tx timeout [ 671.612402][T13182] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 671.652460][T13182] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 671.682511][T13182] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 671.751480][T13182] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 671.894240][T13182] hsr_slave_0: entered promiscuous mode [ 671.911557][T13182] hsr_slave_1: entered promiscuous mode [ 671.929994][T13182] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 671.948018][T13182] Cannot create hsr debugfs directory [ 672.160361][T13218] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.2441'. [ 672.512559][T13182] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 672.555435][T13182] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 672.595121][T13182] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 672.664272][T13182] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 673.003217][T13182] 8021q: adding VLAN 0 to HW filter on device bond0 [ 673.209852][T13182] 8021q: adding VLAN 0 to HW filter on device team0 [ 673.298098][ T1145] bridge0: port 1(bridge_slave_0) entered blocking state [ 673.305263][ T1145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 673.365654][ T1145] bridge0: port 2(bridge_slave_1) entered blocking state [ 673.372837][ T1145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 673.645099][ T5796] Bluetooth: hci4: command tx timeout [ 673.712202][T13238] netlink: 1752 bytes leftover after parsing attributes in process `syz.6.2449'. [ 674.310919][T13182] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 674.781417][T13256] FAULT_INJECTION: forcing a failure. [ 674.781417][T13256] name failslab, interval 1, probability 0, space 0, times 0 [ 674.794500][T13256] CPU: 0 PID: 13256 Comm: syz.6.2455 Not tainted syzkaller #0 [ 674.801966][T13256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 674.812023][T13256] Call Trace: [ 674.815308][T13256] [ 674.818233][T13256] dump_stack_lvl+0x18c/0x250 [ 674.822925][T13256] ? driver_probe_device+0x4f/0x420 [ 674.828163][T13256] ? show_regs_print_info+0x20/0x20 [ 674.833363][T13256] ? load_image+0x420/0x420 [ 674.837871][T13256] should_fail_ex+0x394/0x4c0 [ 674.842558][T13256] should_failslab+0x9/0x20 [ 674.847061][T13256] slab_pre_alloc_hook+0x59/0x300 [ 674.852085][T13256] ? raw_queue_event+0x83/0x2f0 [ 674.856998][T13256] ? raw_queue_event+0x83/0x2f0 [ 674.861851][T13256] __kmem_cache_alloc_node+0x53/0x260 [ 674.867229][T13256] ? raw_queue_event+0x83/0x2f0 [ 674.872070][T13256] __kmalloc+0xa7/0x240 [ 674.876236][T13256] raw_queue_event+0x83/0x2f0 [ 674.880908][T13256] gadget_bind+0x474/0x5b0 [ 674.885323][T13256] ? gadget_disconnect+0x10/0x10 [ 674.890271][T13256] gadget_bind_driver+0x2b3/0x770 [ 674.895400][T13256] ? gadget_match_driver+0x130/0x130 [ 674.900737][T13256] really_probe+0x24a/0xae0 [ 674.905257][T13256] ? pm_runtime_barrier+0x14b/0x1c0 [ 674.910493][T13256] __driver_probe_device+0x1f5/0x390 [ 674.915794][T13256] driver_probe_device+0x4f/0x420 [ 674.920829][T13256] __driver_attach+0x444/0x6d0 [ 674.925602][T13256] bus_for_each_dev+0x235/0x2b0 [ 674.930494][T13256] ? driver_attach+0x50/0x50 [ 674.935191][T13256] ? bus_remove_file+0x140/0x140 [ 674.940172][T13256] ? do_raw_spin_unlock+0x121/0x230 [ 674.945534][T13256] bus_add_driver+0x340/0x630 [ 674.950270][T13256] driver_register+0x23a/0x310 [ 674.955074][T13256] usb_gadget_register_driver_owner+0xf9/0x270 [ 674.961249][T13256] raw_ioctl+0x1613/0x3d80 [ 674.965693][T13256] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 674.971345][T13256] ? tomoyo_path_number_perm+0x217/0x5e0 [ 674.976995][T13256] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 674.982465][T13256] ? make_qualifier+0x260/0x260 [ 674.987350][T13256] ? __fget_files+0x28/0x460 [ 674.991968][T13256] ? bpf_lsm_file_ioctl+0x9/0x10 [ 674.996956][T13256] ? security_file_ioctl+0x80/0xa0 [ 675.002098][T13256] ? make_qualifier+0x260/0x260 [ 675.006972][T13256] __se_sys_ioctl+0xfd/0x170 [ 675.011732][T13256] do_syscall_64+0x55/0xb0 [ 675.016165][T13256] ? clear_bhb_loop+0x40/0x90 [ 675.020858][T13256] ? clear_bhb_loop+0x40/0x90 [ 675.025553][T13256] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 675.031469][T13256] RIP: 0033:0x7f33be39f1eb [ 675.035902][T13256] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 675.055537][T13256] RSP: 002b:00007f33bf21ff00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 675.063955][T13256] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f33be39f1eb [ 675.071950][T13256] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000005 [ 675.079920][T13256] RBP: 00007f33bf220fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 675.087897][T13256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 675.095888][T13256] R13: 0000200000000280 R14: 0000000000000005 R15: 0000000000000868 [ 675.103879][T13256] [ 675.454339][T13256] raw-gadget.1 gadget.6: failed to queue event [ 675.530413][T13256] udc dummy_udc.6: failed to start USB Raw Gadget: -12 [ 675.552227][T13182] veth0_vlan: entered promiscuous mode [ 675.575494][T13256] raw-gadget.1: probe of gadget.6 failed with error -12 [ 675.603888][T13256] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 675.616454][T13182] veth1_vlan: entered promiscuous mode [ 675.652048][T13256] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 675.725812][ T5796] Bluetooth: hci4: command tx timeout [ 675.746884][T13182] veth0_macvtap: entered promiscuous mode [ 675.783353][T13182] veth1_macvtap: entered promiscuous mode [ 675.832104][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 675.862078][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 675.889708][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 675.926748][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 675.957691][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 675.986751][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 676.017739][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 676.048706][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 676.074550][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 676.100100][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 676.118305][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 676.131527][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 676.176009][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 676.211370][T13268] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 676.218476][T13268] udc dummy_udc.0: failed to start g1: -19 [ 676.224883][T13268] UDC core: g1: couldn't find an available UDC or it's busy [ 676.242590][ T28] kauditd_printk_skb: 1 callbacks suppressed [ 676.242599][ T28] audit: type=1800 audit(1792761826.735:437): pid=13268 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2457" name="c_chmask" dev="configfs" ino=40072 res=0 errno=0 [ 676.308684][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 676.370421][T13182] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 676.416579][ T28] audit: type=1800 audit(1792761826.735:438): pid=13268 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2457" name="UDC" dev="configfs" ino=40073 res=0 errno=0 [ 676.446022][T13268] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2457'. [ 676.478502][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 676.533490][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 676.573739][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 676.627836][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 676.664545][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 676.692069][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 676.724003][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 676.754332][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 676.780247][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 676.812669][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 676.842753][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 676.877953][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 676.910831][T13182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 676.940145][T13182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 676.974980][T13182] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 677.032554][T13182] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 677.073594][T13182] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 677.109960][T13182] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 677.159716][T13182] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 678.838078][ T5796] Bluetooth: hci4: command tx timeout [ 679.267397][ T6406] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 679.321511][ T6406] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 679.719735][ T7062] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 679.758239][ T7062] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 680.147940][T13297] loop2: detected capacity change from 0 to 512 [ 680.731827][T13300] binder: 13296:13300 ioctl c0306201 0 returned -14 [ 681.123844][T13311] jffs2: notice: (13311) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 684.099463][T13387] loop6: detected capacity change from 0 to 512 [ 684.739544][T13391] loop6: detected capacity change from 0 to 164 [ 686.319036][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.325353][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.733974][T13405] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2505'. [ 688.440132][T13432] loop7: detected capacity change from 0 to 7 [ 688.553113][T13432] Dev loop7: unable to read RDB block 7 [ 688.610534][T13432] loop7: unable to read partition table [ 688.650305][T13432] loop7: partition table beyond EOD, truncated [ 688.682853][T13432] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 690.914847][T13485] netlink: 32 bytes leftover after parsing attributes in process `syz.8.2539'. [ 691.475070][ T5881] usb 3-1: Failed to early initialize device [ 691.622645][ T5881] usb 3-1: USB disconnect, device number 20 [ 692.963275][T13518] Bluetooth: hci0: unsupported parameter 255 [ 692.993810][T13518] Bluetooth: hci0: unsupported parameter 255 [ 693.065250][ T28] audit: type=1800 audit(1792761843.522:439): pid=13519 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2549" name="c_chmask" dev="configfs" ino=41706 res=0 errno=0 [ 693.097020][T13519] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 693.173404][ T28] audit: type=1800 audit(1792761843.552:440): pid=13519 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2549" name="UDC" dev="configfs" ino=41707 res=0 errno=0 [ 693.208386][T13519] udc dummy_udc.0: failed to start g1: -19 [ 693.408450][T13522] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2549'. [ 693.664071][T13523] zram: Cannot change disksize for initialized device [ 693.675188][T13523] loop7: detected capacity change from 0 to 256 [ 693.682205][T13523] exfat: Bad value for 'uid' [ 693.717258][T11851] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 693.730123][T13519] UDC core: g1: couldn't find an available UDC or it's busy [ 694.842576][T13529] loop6: detected capacity change from 0 to 736 [ 695.358281][T13532] sg_write: data in/out 8192/1 bytes for SCSI command 0x2-- guessing data in; [ 695.358281][T13532] program syz.7.2559 not setting count and/or reply_len properly [ 695.730521][T13540] Bluetooth: hci0: unsupported parameter 255 [ 695.757476][T13540] Bluetooth: hci0: unsupported parameter 255 [ 696.368833][T13548] zram: Cannot change disksize for initialized device [ 696.379494][T13548] loop2: detected capacity change from 0 to 256 [ 696.386435][T13548] exfat: Bad value for 'uid' [ 696.391835][ T175] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 696.460715][ T28] audit: type=1800 audit(1792761846.899:441): pid=13550 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.2566" name="UDC" dev="configfs" ino=41822 res=0 errno=0 [ 696.530463][T10982] usb 6-1: Failed to early initialize device [ 696.550491][T10982] usb 6-1: USB disconnect, device number 18 [ 696.592847][T11851] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 696.602621][ T175] usb 9-1: Using ep0 maxpacket: 32 [ 696.612200][ T175] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 696.678331][ T175] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 697.218670][ T175] usb 9-1: config 0 interface 0 has no altsetting 0 [ 697.262393][ T175] usb 9-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 697.322773][ T175] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 697.354566][ T175] usb 9-1: Product: syz [ 697.364249][ T175] usb 9-1: Manufacturer: syz [ 697.760074][ T175] usb 9-1: SerialNumber: syz [ 697.789689][ T175] usb 9-1: config 0 descriptor?? [ 697.815158][ T175] gs_usb 9-1:0.0: Required endpoints not found [ 697.894279][T13562] loop2: detected capacity change from 0 to 736 [ 698.255162][T13570] Bluetooth: hci0: unsupported parameter 255 [ 698.272959][T13570] Bluetooth: hci0: unsupported parameter 255 [ 698.363112][ T28] audit: type=1800 audit(1792761848.787:442): pid=13573 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2575" name="UDC" dev="configfs" ino=41931 res=0 errno=0 [ 698.953585][T13579] zram: Cannot change disksize for initialized device [ 698.964231][T13579] loop7: detected capacity change from 0 to 256 [ 698.971246][T13579] exfat: Bad value for 'uid' [ 699.008015][T11851] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 699.113461][T12883] usb 9-1: USB disconnect, device number 2 [ 701.295624][ T28] audit: type=1800 audit(1792761851.699:443): pid=13591 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.2582" name=08 dev="sda1" ino=2045 res=0 errno=0 [ 701.602167][ T9] usb 7-1: Failed to early initialize device [ 701.766196][ T9] usb 7-1: USB disconnect, device number 14 [ 702.298556][ T28] audit: type=1800 audit(1792761852.703:444): pid=13603 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.2585" name="UDC" dev="configfs" ino=42024 res=0 errno=0 [ 702.603047][T13607] loop8: detected capacity change from 0 to 736 [ 702.776862][T11676] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 703.248423][ T28] audit: type=1800 audit(1792761853.638:445): pid=13617 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2588" name="(" dev="sda1" ino=2052 res=0 errno=0 [ 703.501539][T13620] zram: Cannot change disksize for initialized device [ 703.512153][T13620] loop7: detected capacity change from 0 to 256 [ 703.519255][T13620] exfat: Bad value for 'uid' [ 704.504514][ T28] audit: type=1800 audit(1792761854.890:446): pid=13631 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.2594" name="UDC" dev="configfs" ino=42117 res=0 errno=0 [ 706.319640][T13637] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 706.326565][T13637] udc dummy_udc.0: failed to start g1: -19 [ 706.335211][T13637] UDC core: g1: couldn't find an available UDC or it's busy [ 706.343452][T13637] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2596'. [ 706.355016][ T28] audit: type=1800 audit(1792761856.690:447): pid=13638 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2596" name="c_chmask" dev="configfs" ino=42140 res=0 errno=0 [ 706.450123][ T28] audit: type=1800 audit(1792761856.700:448): pid=13637 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2596" name="UDC" dev="configfs" ino=42141 res=0 errno=0 [ 706.954481][ T28] audit: type=1800 audit(1792761857.327:449): pid=13647 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.2599" name="(" dev="sda1" ino=2052 res=0 errno=0 [ 707.490772][T13652] zram: Cannot change disksize for initialized device [ 707.501126][T13652] loop2: detected capacity change from 0 to 256 [ 707.508213][T13652] exfat: Bad value for 'uid' [ 707.598469][T11607] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 708.812420][ T28] audit: type=1800 audit(1792761859.177:450): pid=13674 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.2610" name="(" dev="sda1" ino=2052 res=0 errno=0 [ 708.909260][T13680] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2612'. [ 710.001577][ T28] audit: type=1800 audit(1792761860.360:451): pid=13704 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.2623" name="(" dev="sda1" ino=2052 res=0 errno=0 [ 710.480705][T13714] UDC core: g1: couldn't find an available UDC or it's busy [ 710.491571][ T28] audit: type=1800 audit(1792761860.828:452): pid=13714 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2628" name="UDC" dev="configfs" ino=42481 res=0 errno=0 [ 710.628420][ T28] audit: type=1800 audit(1792761860.977:453): pid=13718 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2630" name="(" dev="sda1" ino=2052 res=0 errno=0 [ 710.823152][T10982] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 710.996552][ T28] audit: type=1800 audit(1792761861.355:454): pid=13725 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.2633" name="(" dev="sda1" ino=2052 res=0 errno=0 [ 711.052736][T10982] usb 7-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 711.079499][T10982] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.127071][T10982] usb 7-1: Product: syz [ 711.151600][T10982] usb 7-1: Manufacturer: syz [ 711.185246][T10982] usb 7-1: SerialNumber: syz [ 711.216352][T10982] usb 7-1: config 0 descriptor?? [ 711.748906][T10982] usb 7-1: Firmware version (0.0) predates our first public release. [ 711.776210][T10982] usb 7-1: Please update to version 0.2 or newer [ 712.069049][T10982] usb 7-1: USB disconnect, device number 15 [ 712.303752][ T28] audit: type=1800 audit(1792761862.649:455): pid=13743 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2639" name="UDC" dev="configfs" ino=42582 res=0 errno=0 [ 712.340526][T13743] UDC core: g1: couldn't find an available UDC or it's busy [ 713.803608][ T28] audit: type=1326 audit(1792761864.141:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 714.031432][ T28] audit: type=1326 audit(1792761864.171:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 714.202574][ T28] audit: type=1326 audit(1792761864.181:458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 714.348611][ T28] audit: type=1326 audit(1792761864.181:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 714.605877][T13785] input: syz0 as /devices/virtual/input/input18 [ 715.987988][T13789] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 715.995006][T13789] udc dummy_udc.0: failed to start g1: -19 [ 716.001786][T13789] UDC core: g1: couldn't find an available UDC or it's busy [ 716.012013][T13789] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2655'. [ 716.057209][ T28] audit: type=1326 audit(1792761864.181:460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=300 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 716.294126][ T28] audit: type=1326 audit(1792761864.181:461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 716.294166][ T28] audit: type=1326 audit(1792761864.181:462): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 716.294199][ T28] audit: type=1326 audit(1792761864.181:463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 716.294231][ T28] audit: type=1326 audit(1792761864.191:464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=19 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 716.294266][ T28] audit: type=1326 audit(1792761864.191:465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 716.294300][ T28] audit: type=1326 audit(1792761864.191:466): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 716.294333][ T28] audit: type=1326 audit(1792761864.191:467): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 716.294365][ T28] audit: type=1326 audit(1792761864.191:468): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 716.294397][ T28] audit: type=1326 audit(1792761864.191:469): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13771 comm="syz.7.2650" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7be8b9f559 code=0x7ffc0000 [ 716.816072][T13801] zram: Cannot change disksize for initialized device [ 716.819830][T13801] loop7: detected capacity change from 0 to 256 [ 716.820630][T13801] exfat: Bad value for 'uid' [ 716.856233][T11607] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 717.485348][T13812] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2660'. [ 717.728497][ T9] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 717.919153][ T9] usb 7-1: Using ep0 maxpacket: 32 [ 717.922860][ T9] usb 7-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 717.922901][ T9] usb 7-1: config 0 interface 0 has no altsetting 0 [ 717.928506][ T9] usb 7-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 717.928524][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 717.928538][ T9] usb 7-1: Product: syz [ 717.928547][ T9] usb 7-1: Manufacturer: syz [ 717.928556][ T9] usb 7-1: SerialNumber: syz [ 717.930208][ T9] usb 7-1: config 0 descriptor?? [ 717.934017][ T9] gs_usb 7-1:0.0: Required endpoints not found [ 718.694612][T13828] zram: Cannot change disksize for initialized device [ 718.698307][T13828] loop2: detected capacity change from 0 to 256 [ 718.699024][T13828] exfat: Bad value for 'uid' [ 718.733674][T11607] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 719.314535][ T5752] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 719.438521][T13841] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2673'. [ 719.475443][ T5752] usb 9-1: device descriptor read/64, error -71 [ 719.756005][ T5752] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 719.917366][ T5752] usb 9-1: device descriptor read/64, error -71 [ 720.057557][ T5752] usb usb9-port1: attempt power cycle [ 721.751215][ T5752] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 721.791730][T13853] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 721.798781][T13853] udc dummy_udc.0: failed to start g1: -19 [ 721.805177][T13853] UDC core: g1: couldn't find an available UDC or it's busy [ 721.813506][T13853] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2678'. [ 721.833746][ T28] kauditd_printk_skb: 15 callbacks suppressed [ 721.833757][ T28] audit: type=1800 audit(1792761872.094:485): pid=13854 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2678" name="c_chmask" dev="configfs" ino=43092 res=0 errno=0 [ 721.909330][ T5752] usb 9-1: device descriptor read/8, error -71 [ 722.054628][T10982] usb 7-1: USB disconnect, device number 16 [ 722.128946][ T28] audit: type=1800 audit(1792761872.094:486): pid=13853 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2678" name="UDC" dev="configfs" ino=43093 res=0 errno=0 [ 724.339411][T13869] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2682'. [ 724.668403][T13881] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2687'. [ 725.327583][T13899] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2694'. [ 725.772488][T13908] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2698'. [ 726.156273][T13916] loop6: detected capacity change from 0 to 736 [ 726.486135][T13922] netlink: 32 bytes leftover after parsing attributes in process `syz.8.2704'. [ 728.634938][T13939] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 728.641842][T13939] udc dummy_udc.0: failed to start g1: -19 [ 728.648165][T13939] UDC core: g1: couldn't find an available UDC or it's busy [ 728.658471][T13939] netlink: 36 bytes leftover after parsing attributes in process `syz.8.2709'. [ 728.668321][ T28] audit: type=1800 audit(1792761878.906:487): pid=13940 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.2709" name="c_chmask" dev="configfs" ino=43757 res=0 errno=0 [ 728.887098][ T28] audit: type=1800 audit(1792761878.916:488): pid=13939 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.2709" name="UDC" dev="configfs" ino=43758 res=0 errno=0 [ 729.008771][T13946] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2712'. [ 730.636728][T13952] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 730.643705][T13952] udc dummy_udc.0: failed to start g1: -19 [ 730.649975][T13952] UDC core: g1: couldn't find an available UDC or it's busy [ 730.658261][T13952] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2714'. [ 730.669304][ T28] audit: type=1800 audit(1792761880.898:489): pid=13952 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2714" name="c_chmask" dev="configfs" ino=43930 res=0 errno=0 [ 730.902773][ T28] audit: type=1800 audit(1792761880.898:490): pid=13952 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2714" name="UDC" dev="configfs" ino=43931 res=0 errno=0 [ 730.950047][T13957] netlink: 32 bytes leftover after parsing attributes in process `syz.8.2715'. [ 732.503948][ T5752] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 732.858895][ T5752] usb 3-1: Using ep0 maxpacket: 32 [ 732.865815][ T5752] usb 3-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 733.163460][ T5752] usb 3-1: config 0 interface 0 has no altsetting 0 [ 733.196601][ T5752] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 733.235438][ T5752] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 733.273046][ T5752] usb 3-1: Product: syz [ 733.289430][ T5752] usb 3-1: Manufacturer: syz [ 733.302611][ T5752] usb 3-1: SerialNumber: syz [ 733.322778][ T5752] usb 3-1: config 0 descriptor?? [ 733.347201][ T5752] gs_usb 3-1:0.0: Required endpoints not found [ 733.578679][T10982] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 733.795646][T10982] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 733.821486][T13989] loop8: detected capacity change from 0 to 736 [ 733.837737][T10982] usb 7-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 733.855982][T10982] usb 7-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 733.878806][T11607] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 733.905871][T10982] usb 7-1: Manufacturer: syz [ 733.929741][T10982] usb 7-1: config 0 descriptor?? [ 733.965099][T10982] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 734.736376][ T5881] usb 3-1: USB disconnect, device number 21 [ 735.580990][T14014] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 735.706490][T14019] loop7: detected capacity change from 0 to 736 [ 736.322422][ T5881] usb 7-1: USB disconnect, device number 17 [ 736.454900][T14028] loop6: detected capacity change from 0 to 736 [ 736.530761][T11607] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 738.270687][T14033] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 738.277719][T14033] udc dummy_udc.0: failed to start g1: -19 [ 738.284080][T14033] UDC core: g1: couldn't find an available UDC or it's busy [ 738.292426][T14033] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2741'. [ 738.302248][ T28] audit: type=1800 audit(1792761888.511:491): pid=14033 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2741" name="c_chmask" dev="configfs" ino=44199 res=0 errno=0 [ 738.527994][ T28] audit: type=1800 audit(1792761888.511:492): pid=14033 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2741" name="UDC" dev="configfs" ino=44200 res=0 errno=0 [ 740.253615][T14065] loop8: detected capacity change from 0 to 736 [ 740.359259][T11607] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 740.533154][ C0] vcan0: j1939_tp_rxtimer: 0xffff88801c7a5800: rx timeout, send abort [ 741.034831][ C0] vcan0: j1939_tp_rxtimer: 0xffff88801c7a7000: rx timeout, send abort [ 741.044561][ C0] vcan0: j1939_tp_rxtimer: 0xffff88801c7a5800: abort rx timeout. Force session deactivation [ 741.196377][T11257] Bluetooth: hci2: unexpected event for opcode 0x0803 [ 741.544676][ C0] vcan0: j1939_tp_rxtimer: 0xffff88801c7a7000: abort rx timeout. Force session deactivation [ 742.649823][ T28] audit: type=1800 audit(1792761892.857:493): pid=14092 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2764" name=08 dev="sda1" ino=2045 res=0 errno=0 [ 742.940567][ T28] audit: type=1326 audit(1792761893.166:494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 743.038340][ T28] audit: type=1326 audit(1792761893.196:495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 743.132141][ T28] audit: type=1326 audit(1792761893.206:496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 743.239445][ T28] audit: type=1326 audit(1792761893.206:497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 743.265395][ T5881] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 743.415747][ T28] audit: type=1326 audit(1792761893.206:498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33be39f559 code=0x7ffc0000 [ 743.510812][ T5881] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 743.594949][ T5881] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 0 [ 743.616171][ T28] audit: type=1326 audit(1792761893.206:499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f33be35fd8e code=0x7ffc0000 [ 743.747572][ T5881] usb 7-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 0.00 [ 743.788116][ T5881] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 743.844085][ T28] audit: type=1326 audit(1792761893.206:500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 743.871441][T14108] netlink: 32 bytes leftover after parsing attributes in process `syz.7.2770'. [ 743.880593][ T5881] usb 7-1: Product: syz [ 743.909438][ T5881] usb 7-1: Manufacturer: syz [ 743.914065][ T5881] usb 7-1: SerialNumber: syz [ 743.977975][ T5881] usb 7-1: USB2VGA dongle found at address 18 [ 744.018995][ T5881] usb 7-1: Allocated 8 output buffers [ 744.038343][ T28] audit: type=1326 audit(1792761893.206:501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 744.133782][T14113] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2773'. [ 744.146449][ T28] audit: type=1326 audit(1792761893.216:502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 744.271591][ T28] audit: type=1326 audit(1792761893.216:503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 744.335380][ C0] vcan0: j1939_tp_rxtimer: 0xffff88804adb0800: rx timeout, send abort [ 744.384313][ T28] audit: type=1326 audit(1792761893.555:504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 744.490917][ T28] audit: type=1326 audit(1792761893.555:505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 744.562954][ T28] audit: type=1326 audit(1792761893.735:506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 744.836991][ C0] vcan0: j1939_tp_rxtimer: 0xffff88804adb1c00: rx timeout, send abort [ 744.848508][ C0] vcan0: j1939_tp_rxtimer: 0xffff88804adb0800: abort rx timeout. Force session deactivation [ 745.346813][ C0] vcan0: j1939_tp_rxtimer: 0xffff88804adb1c00: abort rx timeout. Force session deactivation [ 746.109121][ T28] audit: type=1326 audit(1792761893.735:507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14098 comm="syz.6.2766" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f33be39f1eb code=0x7ffc0000 [ 746.298962][T14130] loop8: detected capacity change from 0 to 736 [ 746.790805][T14144] Bluetooth: hci0: invalid length 0, exp 2 for type 14 [ 747.135459][ T5752] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 747.325961][ T5752] usb 3-1: Using ep0 maxpacket: 32 [ 747.356107][ T5752] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 747.386190][ T5752] usb 3-1: config 0 interface 0 has no altsetting 0 [ 747.405153][ T5752] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 747.424865][ T5752] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 747.445139][ T5752] usb 3-1: Product: syz [ 747.454535][ T5752] usb 3-1: Manufacturer: syz [ 747.471060][T14164] Bluetooth: hci0: unsupported parameter 255 [ 747.479797][ T5752] usb 3-1: SerialNumber: syz [ 747.485371][T14164] Bluetooth: hci0: unsupported parameter 255 [ 747.507157][ T5752] usb 3-1: config 0 descriptor?? [ 747.525998][ T5752] gs_usb 3-1:0.0: Required endpoints not found [ 747.570351][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.576795][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.714439][T14168] binder: BINDER_SET_CONTEXT_MGR already set [ 747.731062][T14168] binder: 14167:14168 ioctl 4018620d 2000000004c0 returned -16 [ 749.979098][ T5752] usb 3-1: USB disconnect, device number 22 [ 750.106088][T14187] loop8: detected capacity change from 0 to 736 [ 750.320936][T14192] FAULT_INJECTION: forcing a failure. [ 750.320936][T14192] name failslab, interval 1, probability 0, space 0, times 0 [ 750.399917][T14192] CPU: 0 PID: 14192 Comm: syz.6.2800 Not tainted syzkaller #0 [ 750.407439][T14192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 750.417501][T14192] Call Trace: [ 750.420802][T14192] [ 750.423734][T14192] dump_stack_lvl+0x18c/0x250 [ 750.428425][T14192] ? show_regs_print_info+0x20/0x20 [ 750.433642][T14192] ? load_image+0x420/0x420 [ 750.438147][T14192] ? __might_sleep+0xe0/0xe0 [ 750.442739][T14192] ? __lock_acquire+0x7eb0/0x7eb0 [ 750.447763][T14192] should_fail_ex+0x394/0x4c0 [ 750.452468][T14192] should_failslab+0x9/0x20 [ 750.456986][T14192] slab_pre_alloc_hook+0x59/0x300 [ 750.462023][T14192] kmem_cache_alloc+0x5a/0x2d0 [ 750.466787][T14192] ? __kernfs_new_node+0xe5/0x7f0 [ 750.471826][T14192] __kernfs_new_node+0xe5/0x7f0 [ 750.476684][T14192] ? kernfs_new_node+0x260/0x260 [ 750.481641][T14192] ? sysfs_do_create_link_sd+0x75/0x110 [ 750.487187][T14192] ? __lock_acquire+0x7eb0/0x7eb0 [ 750.492216][T14192] kernfs_new_node+0x14c/0x260 [ 750.496999][T14192] kernfs_create_link+0xa7/0x200 [ 750.501938][T14192] sysfs_do_create_link_sd+0x83/0x110 [ 750.507318][T14192] driver_sysfs_add+0xec/0x210 [ 750.512122][T14192] really_probe+0x13f/0xae0 [ 750.516631][T14192] ? pm_runtime_barrier+0x14b/0x1c0 [ 750.521830][T14192] __driver_probe_device+0x1f5/0x390 [ 750.527119][T14192] driver_probe_device+0x4f/0x420 [ 750.532155][T14192] __driver_attach+0x444/0x6d0 [ 750.536926][T14192] bus_for_each_dev+0x235/0x2b0 [ 750.541799][T14192] ? driver_attach+0x50/0x50 [ 750.546389][T14192] ? bus_remove_file+0x140/0x140 [ 750.551344][T14192] ? do_raw_spin_unlock+0x121/0x230 [ 750.556551][T14192] bus_add_driver+0x340/0x630 [ 750.561237][T14192] driver_register+0x23a/0x310 [ 750.566003][T14192] usb_gadget_register_driver_owner+0xf9/0x270 [ 750.572160][T14192] raw_ioctl+0x1613/0x3d80 [ 750.576588][T14192] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 750.582225][T14192] ? tomoyo_path_number_perm+0x217/0x5e0 [ 750.587858][T14192] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 750.593341][T14192] ? make_qualifier+0x260/0x260 [ 750.598213][T14192] ? __fget_files+0x28/0x460 [ 750.602820][T14192] ? bpf_lsm_file_ioctl+0x9/0x10 [ 750.607781][T14192] ? security_file_ioctl+0x80/0xa0 [ 750.612894][T14192] ? make_qualifier+0x260/0x260 [ 750.617737][T14192] __se_sys_ioctl+0xfd/0x170 [ 750.622331][T14192] do_syscall_64+0x55/0xb0 [ 750.626749][T14192] ? clear_bhb_loop+0x40/0x90 [ 750.631428][T14192] ? clear_bhb_loop+0x40/0x90 [ 750.636104][T14192] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 750.641998][T14192] RIP: 0033:0x7f33be39f1eb [ 750.646417][T14192] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 750.666018][T14192] RSP: 002b:00007f33bf21ff00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 750.674436][T14192] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f33be39f1eb [ 750.682408][T14192] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000005 [ 750.690381][T14192] RBP: 00007f33bf220fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 750.698365][T14192] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 750.706327][T14192] R13: 0000200000000280 R14: 0000000000000005 R15: 0000000000000868 [ 750.714307][T14192] [ 750.759400][T14196] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2802'. [ 752.317239][T14203] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 752.324214][T14203] udc dummy_udc.0: failed to start g1: -19 [ 752.330603][T14203] UDC core: g1: couldn't find an available UDC or it's busy [ 752.338815][T14203] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2803'. [ 752.359799][ T28] kauditd_printk_skb: 65 callbacks suppressed [ 752.359809][ T28] audit: type=1800 audit(1792761902.509:573): pid=14204 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2803" name="c_chmask" dev="configfs" ino=45069 res=0 errno=0 [ 752.594338][ T28] audit: type=1800 audit(1792761902.509:574): pid=14203 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2803" name="UDC" dev="configfs" ino=45070 res=0 errno=0 [ 752.718960][T14210] ------------[ cut here ]------------ [ 752.725019][T14210] kobject: '(null)' (ffff88807c5740f0): is not initialized, yet kobject_get() is being called. [ 752.811142][T14192] really_probe: driver_sysfs_add(gadget.6) failed [ 752.834724][T14192] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 752.844622][T14210] WARNING: CPU: 0 PID: 14210 at lib/kobject.c:642 kobject_add_internal+0x115/0xc90 [ 752.854439][T14210] Modules linked in: [ 752.858358][T14210] CPU: 0 PID: 14210 Comm: syz.7.2805 Not tainted syzkaller #0 [ 752.866078][T14210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 752.876382][T14210] RIP: 0010:kobject_add_internal+0x115/0xc90 [ 752.882575][T14210] Code: b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 5e 30 5e f7 49 8b 34 24 48 c7 c7 c0 4e 0b 8c 4c 89 e2 e8 fb d8 ce f6 <0f> 0b e9 e5 00 00 00 e8 cf 2a 05 f7 b8 fe ff ff ff e9 f0 06 00 00 [ 752.904070][T14210] RSP: 0018:ffffc900052df8c8 EFLAGS: 00010246 [ 752.910146][T14210] RAX: ef6a42b5f8ed0200 RBX: ffff88807c3a6878 RCX: 0000000000080000 [ 752.918422][T14210] RDX: ffffc9000dd5d000 RSI: 000000000000d965 RDI: 000000000000d966 [ 752.926683][T14210] RBP: 0000000000000000 R08: ffffc900052df4c7 R09: 1ffff92000a5be98 [ 752.934706][T14210] R10: dffffc0000000000 R11: fffff52000a5be99 R12: ffff88807c5740f0 [ 752.942739][T14210] R13: dffffc0000000000 R14: ffff88807c57412c R15: dffffc0000000000 [ 752.950725][T14210] FS: 00007f7be9a1d6c0(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000 [ 752.959714][T14210] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 752.966347][T14210] CR2: 00007f7be8becc40 CR3: 000000006a530000 CR4: 00000000003506f0 [ 752.974391][T14210] Call Trace: [ 752.977695][T14210] [ 752.980637][T14210] ? kfree+0x31/0x1a0 [ 752.984752][T14210] kobject_add+0x164/0x240 [ 752.989192][T14210] ? kobject_init+0x1d0/0x1d0 [ 752.993918][T14210] ? mddev_create_serial_pool+0x1f3/0x4d0 [ 752.999738][T14210] bind_rdev_to_array+0xb51/0x1270 [ 753.006548][T14210] ? bind_rdev_to_array+0x5fb/0x1270 [ 753.012113][T14210] ? md_import_device+0x7b0/0x7b0 [ 753.017151][T14210] md_add_new_disk+0xe31/0x17b0 [ 753.022058][T14210] md_ioctl+0x2152/0x24e0 [ 753.026399][T14210] ? blkdev_common_ioctl+0x10ee/0x2580 [ 753.031926][T14210] ? md_release+0x1e0/0x1e0 [ 753.036432][T14210] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 753.042141][T14210] ? blkdev_bszset+0x1f0/0x1f0 [ 753.046939][T14210] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 753.052468][T14210] ? md_release+0x1e0/0x1e0 [ 753.056976][T14210] blkdev_ioctl+0x5b2/0x730 [ 753.061480][T14210] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 753.066987][T14210] ? bpf_lsm_file_ioctl+0x9/0x10 [ 753.071956][T14210] ? security_file_ioctl+0x80/0xa0 [ 753.077067][T14210] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 753.082562][T14210] __se_sys_ioctl+0xfd/0x170 [ 753.087157][T14210] do_syscall_64+0x55/0xb0 [ 753.091590][T14210] ? clear_bhb_loop+0x40/0x90 [ 753.096657][T14210] ? clear_bhb_loop+0x40/0x90 [ 753.101351][T14210] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 753.108989][T14210] RIP: 0033:0x7f7be8b9f559 [ 753.113682][T14210] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 753.133396][T14210] RSP: 002b:00007f7be9a1d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 753.141852][T14210] RAX: ffffffffffffffda RBX: 00007f7be8e26090 RCX: 00007f7be8b9f559 [ 753.149827][T14210] RDX: 00002000000001c0 RSI: 0000000040140921 RDI: 0000000000000004 [ 753.157844][T14210] RBP: 00007f7be8c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 753.165870][T14210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 753.173926][T14210] R13: 00007f7be8e26128 R14: 00007f7be8e26090 R15: 00007ffc83f3f798 [ 753.181966][T14210] [ 753.184999][T14210] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 753.192268][T14210] CPU: 0 PID: 14210 Comm: syz.7.2805 Not tainted syzkaller #0 [ 753.199711][T14210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 753.209758][T14210] Call Trace: [ 753.213034][T14210] [ 753.215975][T14210] dump_stack_lvl+0x18c/0x250 [ 753.220661][T14210] ? show_regs_print_info+0x20/0x20 [ 753.225872][T14210] ? load_image+0x420/0x420 [ 753.230411][T14210] panic+0x2ca/0x720 [ 753.234340][T14210] ? bpf_jit_dump+0xd0/0xd0 [ 753.238848][T14210] __warn+0x2e0/0x470 [ 753.242820][T14210] ? kobject_add_internal+0x115/0xc90 [ 753.248203][T14210] ? kobject_add_internal+0x115/0xc90 [ 753.253605][T14210] report_bug+0x2be/0x4f0 [ 753.258012][T14210] ? kobject_add_internal+0x115/0xc90 [ 753.263384][T14210] ? kobject_add_internal+0x115/0xc90 [ 753.268773][T14210] ? kobject_add_internal+0x117/0xc90 [ 753.274149][T14210] handle_bug+0xcf/0x120 [ 753.278397][T14210] exc_invalid_op+0x1a/0x50 [ 753.282901][T14210] asm_exc_invalid_op+0x1a/0x20 [ 753.287757][T14210] RIP: 0010:kobject_add_internal+0x115/0xc90 [ 753.293750][T14210] Code: b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 5e 30 5e f7 49 8b 34 24 48 c7 c7 c0 4e 0b 8c 4c 89 e2 e8 fb d8 ce f6 <0f> 0b e9 e5 00 00 00 e8 cf 2a 05 f7 b8 fe ff ff ff e9 f0 06 00 00 [ 753.313365][T14210] RSP: 0018:ffffc900052df8c8 EFLAGS: 00010246 [ 753.319448][T14210] RAX: ef6a42b5f8ed0200 RBX: ffff88807c3a6878 RCX: 0000000000080000 [ 753.327412][T14210] RDX: ffffc9000dd5d000 RSI: 000000000000d965 RDI: 000000000000d966 [ 753.335392][T14210] RBP: 0000000000000000 R08: ffffc900052df4c7 R09: 1ffff92000a5be98 [ 753.343374][T14210] R10: dffffc0000000000 R11: fffff52000a5be99 R12: ffff88807c5740f0 [ 753.351351][T14210] R13: dffffc0000000000 R14: ffff88807c57412c R15: dffffc0000000000 [ 753.359342][T14210] ? kobject_add_internal+0x115/0xc90 [ 753.364732][T14210] ? kfree+0x31/0x1a0 [ 753.368728][T14210] kobject_add+0x164/0x240 [ 753.373172][T14210] ? kobject_init+0x1d0/0x1d0 [ 753.377860][T14210] ? mddev_create_serial_pool+0x1f3/0x4d0 [ 753.383601][T14210] bind_rdev_to_array+0xb51/0x1270 [ 753.388750][T14210] ? bind_rdev_to_array+0x5fb/0x1270 [ 753.394060][T14210] ? md_import_device+0x7b0/0x7b0 [ 753.399114][T14210] md_add_new_disk+0xe31/0x17b0 [ 753.403970][T14210] md_ioctl+0x2152/0x24e0 [ 753.408305][T14210] ? blkdev_common_ioctl+0x10ee/0x2580 [ 753.413771][T14210] ? md_release+0x1e0/0x1e0 [ 753.418278][T14210] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 753.423911][T14210] ? blkdev_bszset+0x1f0/0x1f0 [ 753.428695][T14210] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 753.434225][T14210] ? md_release+0x1e0/0x1e0 [ 753.438734][T14210] blkdev_ioctl+0x5b2/0x730 [ 753.443238][T14210] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 753.448696][T14210] ? bpf_lsm_file_ioctl+0x9/0x10 [ 753.453637][T14210] ? security_file_ioctl+0x80/0xa0 [ 753.458769][T14210] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 753.464265][T14210] __se_sys_ioctl+0xfd/0x170 [ 753.468877][T14210] do_syscall_64+0x55/0xb0 [ 753.473302][T14210] ? clear_bhb_loop+0x40/0x90 [ 753.477992][T14210] ? clear_bhb_loop+0x40/0x90 [ 753.482698][T14210] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 753.488699][T14210] RIP: 0033:0x7f7be8b9f559 [ 753.493122][T14210] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 753.512740][T14210] RSP: 002b:00007f7be9a1d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 753.521155][T14210] RAX: ffffffffffffffda RBX: 00007f7be8e26090 RCX: 00007f7be8b9f559 [ 753.529128][T14210] RDX: 00002000000001c0 RSI: 0000000040140921 RDI: 0000000000000004 [ 753.537097][T14210] RBP: 00007f7be8c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 753.545061][T14210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 753.553025][T14210] R13: 00007f7be8e26128 R14: 00007f7be8e26090 R15: 00007ffc83f3f798 [ 753.561004][T14210] [ 753.564082][T14210] Kernel Offset: disabled [ 753.568509][T14210] Rebooting in 86400 seconds..