last executing test programs: 31.105392422s ago: executing program 1 (id=2753): syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100033887462023010100fe4a0102030109021b000100000000090400000193723400090582000001"], &(0x7f0000001080)={0x0, 0x0, 0x0, 0x0}) (async) syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100033887462023010100fe4a0102030109021b000100000000090400000193723400090582000001"], &(0x7f0000001080)={0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) socket$inet(0x2, 0x2, 0x0) (async) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000004880)='lo\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000004880)='lo\x00', 0x10) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000200)={@rand_addr=0x64010101, @loopback}, 0xc) (async) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000200)={@rand_addr=0x64010101, @loopback}, 0xc) socket$inet(0x2, 0x3, 0xd) (async) socket$inet(0x2, 0x3, 0xd) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x28, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0xc) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r3, r2, 0x0) (async) r4 = dup3(r3, r2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x32, 0x0, 0x0, 0x3d, 0x18, &(0x7f0000000280)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0xa, 0x1}, @flat=@binder={0x73622a85, 0x1000, 0x3}}, &(0x7f0000000700)={0x0, 0x18, 0x30}}, 0x40}], 0x0, 0x0, 0x0}) getsockopt$bt_hci(r1, 0x84, 0x80, &(0x7f0000002100)=""/4127, &(0x7f0000000000)=0x101f) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r7, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x7a47d6909bf5931b}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x10, 0x1404, 0x400, 0x70bd2a, 0x25dfdbfb}, 0x10}, 0x1, 0x0, 0x0, 0x40000}, 0x4040000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue1\x00'}) r8 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x4fe0, 0x0, 0x0, 0x2}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x3, 0x0, 0x0}) io_uring_enter(r8, 0x3516, 0x0, 0x0, 0x0, 0x0) write$sndseq(r6, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32={[0x2600]}}], 0xffc8) (async) write$sndseq(r6, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32={[0x2600]}}], 0xffc8) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_mptcp(0xa, 0x1, 0x106) 27.946716099s ago: executing program 1 (id=2759): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000000c0), 0x10) openat$nullb(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=ANY=[@ANYBLOB="0500000000000000010000000000000029e49c05e18dac2cf3eb8851d757579996ac37cf909aea9642dd9c9a78c88a9391544de8bb582ed8d1e2abd8b3c518bec570358db317a0f973386e80e5c2c186f18af83d2d70dc9e4527c814a693366d55f4ecbf063cf07dd20e1b46df4aadab9978b16a1f71b5d24cbd2c4490a76a35831f8b489122b4be4b42c00087f71b8e7fe41ff2fb52040f99687a77d51d929e041f374616b11f96349712cb68905149e8ccbf79925c853c1af16576e5d4401f5390b0170e3a9abe0a7e251a79b219", @ANYRES64=0x0, @ANYRES64=0xea60, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000003fae8a9ad451a727"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="050000009f60000000000000000000", @ANYRES64=0x2710], 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x8800) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1241, 0x5015, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x0, 0x40}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000640)={0x24, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0x0, "f5e8e46d"}]}}, 0x0}, 0x0) syz_io_uring_setup(0x239, &(0x7f00000002c0)={0x0, 0xf2cf, 0x10100}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x118, &(0x7f0000000100)=0x6, 0x0, 0x4) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1, &(0x7f0000000000)=0x7, 0x4) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000880)=ANY=[@ANYBLOB="8001000010000100fdffffff00000000ac1e0401000000000000000000000000ac1e1101000000000000000000000000000000014e230000000080005c000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="ac14140d000000000000000000000000000000146c00000000000000000000000000000000000000000000000000000000000000080000000000000000000000fffffffff7ffffff00000000000000000000000000000000000000000000001000000000000000002500000000000000060000000000000000000000000000000000000000000001000000000000000000000000000000800000000002000106"], 0x180}, 0x1, 0x0, 0x0, 0x4004050}, 0x0) sendto$inet(r1, &(0x7f0000000380)="0094ea15", 0x4, 0x10008095, 0x0, 0x0) 24.737626074s ago: executing program 1 (id=2774): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) r2 = socket$kcm(0x2, 0x3, 0x2) socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8916, &(0x7f0000000040)={'ip6tnl0\x00', @random="0200ac7f7f00"}) socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101402, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x5, 0x3, 0xc06a2f6, 0x1, 0x7}, 0x6, 0x0, 0xa, 0x4, 0x6, 0x8, 0x18, 0x9, 0x3, 0x4, {0x0, 0x2, 0x9, 0x800, 0x8704, 0x27000000}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=@newtfilter={0x48, 0x2c, 0xd2b, 0x800, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x10, 0xfff1}, {}, {0x7, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_CT_LABELS={0x14, 0x61, "d89933c8221bed90b593a1f978374fb9"}]}}]}, 0x48}}, 0x24044094) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001800dd8d000000000000380002001000010000000000002008001e0002000000"], 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) 22.137715675s ago: executing program 1 (id=2783): r0 = socket$l2tp(0x2, 0x2, 0x73) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) r1 = syz_usb_connect(0x3, 0x73, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000396d0940fd101315f9b10102030109026100010000000009040001"], 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) bind$l2tp(r0, &(0x7f00000000c0)={0x2, 0x0, @local, 0x4}, 0x10) sendto$l2tp(r0, &(0x7f0000000040)="e5786a0d000000000000c83b", 0xc, 0x0, &(0x7f0000000100)={0x2, 0x0, @loopback}, 0x10) r2 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x101840) ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f0000000080)={0xa, 0x0, 0x1, {0xe7ff, 0x1, 0x406, 0x870}}) 19.283818391s ago: executing program 1 (id=2798): r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x1e1800, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wg2\x00'}) sendmsg$nl_route(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)=@mpls_getroute={0x1c, 0x1a, 0x1, 0x70bd25, 0x25dfdbff, {0x1c, 0x10, 0x14, 0x6, 0x0, 0x1, 0xfe, 0x4, 0x2200}}, 0x1c}, 0x1, 0x0, 0x0, 0x2c000000}, 0x4044800) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x4, 0x2, 0x0, 0x0, 0x4d, @loopback, @mcast2, 0x1, 0x0, 0x1, 0x1}}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000000)="d80000001000810468f70082db44b904021d080b01000000e8fe55a11800150006001400000000120800040043000000a80016000a000140063f0d00036010fab94dcf5c0461c1d67f6f94000534cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4090000001fb791643a5e", 0x87}], 0x1}, 0x20000004) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000076000d0b0000000000000000030500000000000008000a"], 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000780)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000800300000014000180aa21ebbf497408246970766c616e3000"], 0x28}, 0x1, 0x0, 0x0, 0x10800}, 0x4800) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f00000002c0)={0x29ef, 0x856, {}, {0x0}, 0x5, 0x9}) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000100)) syz_usb_connect(0x4, 0x389, &(0x7f00000007c0)={{0x12, 0x1, 0x310, 0x6b, 0x87, 0xf5, 0xff, 0xfd9, 0x37, 0x5711, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x377, 0x2, 0x4, 0xff, 0x88, 0xc, [{{0x9, 0x4, 0x71, 0x5, 0x4, 0xb, 0x63, 0x4a, 0xc, [], [{{0x9, 0x5, 0xe, 0x0, 0x8, 0xa, 0x8, 0x0, [@generic={0x4e, 0x2, "65cacfa45f6ebdc9364b040298b2778e22559e8cf20bfdab4ed6b78beaa232c6ebbffcf625d1344bd87bd2c069a723d1a06a95bb75062dea87a7b375718dd6c5e4eab869e5dd82f01040c36b"}, @uac_iso={0x7, 0x25, 0x1, 0xdf1f2f4e64876f99, 0x6, 0x7ff}]}}, {{0x9, 0x5, 0x1, 0xc, 0x40, 0xe, 0x9, 0x90}}, {{0x9, 0x5, 0x1, 0x0, 0x10, 0x80, 0x9, 0x8, [@generic={0x61, 0x22, "23cf1d76f2213dc7779ba74dc1081fa989e4c1af72fd587105533e066a7c3db97b7e2fd795b45048f7e6b8bd8594916eafbf29b84abe665df2831f6d1e68058f6e3abdf80a7f45aeb1f191b377066cced6cefee33ce6db7c99aa27feb4bebf"}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x4d, 0x9}]}}, {{0x9, 0x5, 0xd, 0x10, 0x3ff, 0x1, 0x6, 0x6, [@generic={0x2, 0x4}]}}]}}, {{0x9, 0x4, 0x4, 0x5, 0x9, 0x1b, 0x5a, 0x43, 0x3, [], [{{0x9, 0x5, 0xa, 0x10, 0x3ff, 0x5, 0x5, 0x40}}, {{0x9, 0x5, 0xc, 0x0, 0x10, 0x2, 0x7, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0xe, 0x4}]}}, {{0x9, 0x5, 0x0, 0x3, 0x8, 0x8, 0x7, 0x8}}, {{0x9, 0x5, 0xd, 0x0, 0x3ff, 0xd, 0xfd, 0x8, [@generic={0xb7, 0xa, "76cfb55178cdf45005b0d72e0e4a5fb05d5f247bcb5a39c0a682c37eed2ba9030f57744ca3a51bfa37d651a73f1d41c8e1d3c9e9544b092ede048d1ad731ab9c24d74e78ed618b6ebe5fd3b52cc1c7e1f86b6a9a784bc9d2445f83fb613e7197a6a6a8eca431fcd877b9f4673a610e6526a851a3bf716d765312870f5e2943532106176ddd15f39a07a220c59c54ede45de68f5b1d4d24b7223ecc58b05642c4b11e7b51227f99b9ddf916c8b1ae2aa19078ab815c"}]}}, {{0x9, 0x5, 0x1, 0x2, 0x3ff, 0xfa, 0x8, 0x31}}, {{0x9, 0x5, 0x4, 0x2, 0x200, 0x0, 0x8, 0x84, [@generic={0x90, 0x31, "67230dc330c52345e95c26ab7c625096bb9e79ad22ce8f43c4bb57ce89709166615223d27fe92da622a453c5403ec50549dc2c621e7fd7e7ee73557fe8b188ce5b054bd00615fa2329835b20cac808f84bac27ec716243aab965a73ddbc125e3832679004761ea5058578ff9cc6a1ab6b2d75e8f49097e027c28123e574776d9fabe10dfb9497c85a1149bbfd3a3"}]}}, {{0x9, 0x5, 0xe, 0xc, 0x200, 0xe, 0x7, 0xf8, [@generic={0xd3, 0x23, "5e58df9cfb5d255aec91c69c608a64b49cbd5711bf31e4c50406ed1ce965511a9ec337f4c924cb8aaa691c8a434416cce65d5ebb0561374444cf2e2c36fb8f90f7f097d429c985f1ca85d0f24ca9ba2e7ade2188d3595015387f002495df5f3939f688b6d77f5b4993368fc237177ddfa8ad1407be695534959d64e7bd5231d00a45d57025bc85d8800f68fe24f474c463956209811196d696640581302537efdefa19de575280ec5cb8edad8bc7e2b97a6eb6200acf122b935a54874ba61147af7dd25b54062ac03875564bbaf20c8d59"}]}}, {{0x9, 0x5, 0x5, 0x0, 0x60, 0xc, 0x3, 0x1}}, {{0x9, 0x5, 0xe, 0x3, 0x20, 0x4, 0x1, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x2, 0xbaf}]}}]}}]}}]}}, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0), r4) sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000680)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x14, r10, 0x8, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x8040}, 0x0) ioctl$I2C_FUNCS(r0, 0x705, &(0x7f0000000580)=0x8) sendmsg$nl_xfrm(r6, &(0x7f0000000540)={&(0x7f0000000280), 0xc, &(0x7f0000000440)={&(0x7f0000000b80)=@getpolicy={0x1e0, 0x15, 0x200, 0x70bd26, 0x25dfdbfd, {{@in6=@mcast1, @in=@empty, 0x4e20, 0xfffc, 0x7fff, 0x0, 0xa, 0x80, 0x80, 0x0, 0x0, r9}, 0x6e6bb2, 0x2}, [@policy={0xac, 0x7, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in=@multicast2, 0x4e21, 0x0, 0x4e22, 0x3, 0xa, 0x80, 0x20, 0x5e, r2, r9}, {0x6, 0x3, 0x4, 0x1be6000000000000, 0x441c, 0xb, 0x7, 0x6}, {0x4400, 0x171, 0x9, 0x9}, 0x6, 0x0, 0x1}}, @sa={0xe4, 0x6, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@rand_addr=0x64010102, 0x4e21, 0x200, 0x4c21, 0x0, 0x2, 0x60, 0x80, 0x2c, r2, r9}, {@in=@multicast2, 0x4d2, 0x3c}, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, {0x3, 0xced, 0x3, 0xfffffffffffffff9, 0xffff, 0x2, 0x4, 0x9}, {0x45, 0x7, 0xfffffffffffffffe, 0x2}, {0x4, 0x328}, 0x70bd28, 0x3500, 0xa, 0x1, 0xfe, 0x43}}]}, 0x1e0}, 0x1, 0x0, 0x0, 0x44}, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000f00), &(0x7f0000000f40)=0x14) sendmsg$TIPC_NL_MON_PEER_GET(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="0d03000000000700df2512000000"], 0x14}}, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)="dbe104b35716e67da422221d32860d4b13014bf9cabfec7430777c646ebc9300e0590be6a84abaccb05e82ee330d123771e0cc0c9368b55648d963864232b7bdd621975af674b10d42de3941d75591da43b6ff6424dc7fc1865667d662ea9dbcb8523cc733be2ecdc8094f963f3993c367", 0x71, 0x20000814, 0x0, 0x0) r11 = syz_open_dev$evdev(&(0x7f0000000100), 0x1, 0x2002) ioctl$EVIOCSCLOCKID(r11, 0x400445a0, &(0x7f0000000080)=0x7) socket$inet6(0x10, 0x1, 0x101000) ioctl$EVIOCSKEYCODE_V2(r11, 0x40284504, &(0x7f00000000c0)={0x6, 0x14, 0x401, 0x80, "c8a394af88e6d4a86ebe244197fe81e2e6a95c428a1608e67f2e119d72daaa77"}) fsopen(&(0x7f0000000040)='afs\x00', 0x0) 11.508871823s ago: executing program 3 (id=2835): syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8001, 0x0, 0x9, 0x4f, 0x8, 0xfa11, 0x1}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) kexec_load(0x0, 0x0, 0x0, 0xa0000) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="c40000001900674c0000000004000000fc000000000000000000000000000002e000000200000000000000000000000000000000000000000a000000000000", @ANYRES16=r2, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000080000000000000000000000000000000000000000000000000000000000400000000000000000000000000000a0010000100000000000000"], 0xc4}}, 0x4c050) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000004c0)={0x2, 0x10, 0x9, 0x9, 0xa, 0x0, 0x70bd2a, 0x25dfdbfb, [@sadb_x_policy={0x8, 0x12, 0x4, 0x3, 0x0, 0x0, 0x8, {0x6, 0x32, 0x3, 0x8, 0x0, 0x0, 0x0, @in=@rand_addr=0x5, @in6=@ipv4={'\x00', '\xff\xff', @broadcast}}}]}, 0x50}}, 0x40010) r4 = socket(0x26, 0x5, 0x0) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x4621, 0x4, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8ff}, 0x1c) mprotect(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1) r5 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x1) fchdir(r6) openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000340)={0x0, 0xff, 0x1c}, 0xc) getsockopt$sock_buf(r4, 0x1, 0x1c, 0x0, &(0x7f00000001c0)=0x3b) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) semop(0x0, &(0x7f00000000c0)=[{0x2, 0xffff, 0x1000}, {0x2, 0xe, 0x800}], 0x2) semctl$GETVAL(0x0, 0x1, 0xc, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) 9.513880394s ago: executing program 3 (id=2841): r0 = socket$l2tp(0x2, 0x2, 0x73) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) r2 = syz_usb_connect(0x3, 0x73, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000396d0940fd101315f9b10102030109026100010000000009040001"], 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) bind$l2tp(r0, &(0x7f00000000c0)={0x2, 0x0, @local, 0x4}, 0x10) sendto$l2tp(r0, &(0x7f0000000040)="e5786a0d000000000000c83b", 0xc, 0x0, &(0x7f0000000100)={0x2, 0x0, @loopback}, 0x10) r3 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x101840) ioctl$VIDIOC_S_SELECTION(r3, 0xc040565f, &(0x7f0000000080)={0xa, 0x0, 0x1, {0xe7ff, 0x1, 0x406, 0x870}}) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r5, 0xc01064c8, &(0x7f00000002c0)={0x1, 0x0, &(0x7f0000000280)=[0x0]}) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r5, 0xc04064aa, &(0x7f00000003c0)={0x0, 0x0, r6}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f00000001c0)={0x28, 0x0, r4, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x4000}) 7.593749712s ago: executing program 0 (id=2846): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r4, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r0, 0xe9012000) preadv(r4, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="df2e00000f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x48}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x40f00, 0x24, '\x00', 0x0, 0x0, r4, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r5, 0xae80, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) r6 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r6, 0x1, &(0x7f0000000340)={0x2000, r7}, 0x0) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="020300030f0000002cbd7040fcdbdf2503000900800000001cdc0dca1d9f68846960e56de42944af030006000000000002004e22ac1414bb000000000000000002000100000000000000070c00000080030005000000000002004e22ac14140a00000000000000000200130002"], 0x78}, 0x1, 0x7}, 0x0) r9 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x210201, 0x0) renameat2(r9, &(0x7f0000000100)='./file0\x00', r7, &(0x7f00000001c0)='./file1/file2\x00', 0x5) linkat(0xffffffffffffffff, &(0x7f0000000140)='./file1\x00', r7, &(0x7f0000000180)='./file1\x00', 0x0) landlock_restrict_self(r6, 0x0) 6.432897781s ago: executing program 3 (id=2851): r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff80000000, 0x7e6d64e93bfd5421) pwritev(r0, &(0x7f0000000500)=[{&(0x7f0000000380)="9e", 0x1}], 0x1, 0x5, 0xfffffff9) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r3 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000001300)='./file0\x00', &(0x7f0000001380)={0x40, 0x108, 0x22}, 0x18) remap_file_pages(&(0x7f0000299000/0x2000)=nil, 0x2000, 0x0, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xd, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRESHEX=r3, @ANYBLOB="0000000000000000b70800000000ebff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r7, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000740)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0xa4}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400c040}, 0x0) r8 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB="1c0000005e0021a5553f8c6b23cbff070000e5373526a01edb"], 0x1c}, 0x1, 0x0, 0x0, 0x48050}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x3, &(0x7f00000012c0)=0x90000000) recvmmsg$unix(r8, &(0x7f0000002380)=[{{0x0, 0x3f, &(0x7f0000001340)=[{&(0x7f00000002c0)=""/4096, 0x1000}], 0x1}}], 0x4000000000003b9, 0x26022, 0x0) 6.12925286s ago: executing program 0 (id=2853): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f00002ae000/0x2000)=nil, 0x2000, 0x1) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x8, &(0x7f0000000040)=""/4096, &(0x7f0000001040)=0x1000) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000001080)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x10, &(0x7f00000010c0)={0x38e4}) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x40c400) write$6lowpan_control(r3, &(0x7f0000000140)='connect aa:aa:aa:aa:aa:10 1', 0x1b) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) socket$alg(0x26, 0x5, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1000f4) timer_create(0x5, &(0x7f0000000000)={0x0, 0x38, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000080)=0x0) timer_gettime(r4, &(0x7f00000000c0)) 6.109094813s ago: executing program 2 (id=2854): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x40c4}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000001780)=[{0x0}, {0x0}], 0x2}}], 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/timer\x00', 0x1800, 0x0) preadv(r0, &(0x7f0000000180)=[{&(0x7f0000000080)=""/228, 0xe4}], 0x1, 0x7, 0x9) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000000)={0x24, 0x11, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x14, 0x0, 0x0, 0x0, [@typed={0xd, 0x0, 0x0, 0x0, @binary="56ccabd869c2033840"}]}]}, 0x24}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r4 = accept4(r3, 0x0, 0x0, 0x800) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x4e22, 0x5875, @mcast1, 0x3}, 0x1c) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r6, &(0x7f0000000080)={0xa, 0x4e22, 0x8, @mcast1, 0x2}, 0x1c) r7 = syz_open_procfs(0x0, &(0x7f00000005c0)='net/udplite6\x00') preadv(r7, &(0x7f0000000540)=[{&(0x7f0000000200)=""/161, 0xa1}, {&(0x7f00000002c0)=""/109, 0x6d}], 0x2, 0xa3, 0x7) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r8, 0x0, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x8, 0x3, 0x420, 0x288, 0x43, 0xa0, 0x288, 0x98, 0x388, 0x178, 0x178, 0x388, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @multicast1, 0x0, 0x0, 'bridge_slave_1\x00', 'ip6erspan0\x00'}, 0x12a, 0x228, 0x288, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@string={{0xc0}, {0x0, 0x3, 'kmp\x00', "7af8bdb4c056dc65949041982abfe9ed51b01289c0026e2e6034ed587be5f09017b907388134b0ede40eb8d493f20d534fc37f23ec524d91a7a041f36bb1d1c3ab474544c5ef3f2fa69a80a0d967ee4464257d28d31e6843bc1221dfb9a6a27ad13af7061b737fd97d94f50942c68242819c941c0b4d9ec154c7d327187e8198", 0x38, 0x2, {0x1}}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x4, 0x7, 0x5, 0x4, 0x3, 0x4], 0x2, 0x4}, {0xffffffffffffffff, [0x1, 0x1, 0x1, 0x1, 0x1, 0x2], 0x4}}}}, {{@uncond, 0x0, 0xe0, 0x100, 0x0, {}, [@common=@unspec=@cluster={{0x30}, {0x1b, 0x408, 0xfffffffb}}, @common=@set={{0x40}, {{0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x300], 0x0, 0x1}}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x480) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) 5.518359344s ago: executing program 2 (id=2855): r0 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r1, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100000006002700"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x48010) 5.238077867s ago: executing program 2 (id=2856): mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) unshare(0x22020400) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x8, 0x3, 0x200, 0x0, 0x11, 0x148, 0x340, 0x0, 0x450, 0x2a8, 0x2a8, 0x450, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0x70, 0xb0}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x4f, 0x7, "72f6daeff0a9c6294e211d2d88fe6dcff5d0e552201da3b7a1fdb30dcb59"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x60) 4.794033845s ago: executing program 2 (id=2857): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) socket$kcm(0x2, 0x3, 0x2) socket$kcm(0x2, 0x3, 0x2) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101402, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x5, 0x3, 0xc06a2f6, 0x1, 0x7}, 0x6, 0x0, 0xa, 0x4, 0x6, 0x8, 0x18, 0x9, 0x3, 0x4, {0x0, 0x2, 0x9, 0x800, 0x8704, 0x27000000}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=@newtfilter={0x48, 0x2c, 0xd2b, 0x800, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x10, 0xfff1}, {}, {0x7, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_CT_LABELS={0x14, 0x61, "d89933c8221bed90b593a1f978374fb9"}]}}]}, 0x48}}, 0x24044094) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001800dd8d000000000000380002001000010000000000002008001e0002000000"], 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) 4.751846813s ago: executing program 0 (id=2858): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) r2 = socket$kcm(0x2, 0x3, 0x2) socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8916, &(0x7f0000000040)={'ip6tnl0\x00', @random="0200ac7f7f00"}) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000006800e97800000000000000000a0000000000000004000400886d97f44a190f08c6243b4cdf56bd5ebeb90761ce9ec21c99f0349ba39c8563c4bac571b76c17fdba914c20eabb20d90cdb79971df4c43c8578d931c454d50b52d738e7f293fde4e52142f8ad8960b97dad30267b0c96a129b5900d15d2dc823aba7a86e111fd6c3e48847867f70ded3fe2ef02c7588965d326"], 0x1c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101402, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x5, 0x3, 0xc06a2f6, 0x1, 0x7}, 0x6, 0x0, 0xa, 0x4, 0x6, 0x8, 0x18, 0x9, 0x3, 0x4, {0x0, 0x2, 0x9, 0x800, 0x8704, 0x27000000}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=@newtfilter={0x24, 0x2c, 0xd2b, 0x800, 0x25dfdbfc, {0x0, 0x0, 0x0, r9, {0x10, 0xfff1}, {}, {0x7, 0xb}}}, 0x24}}, 0x24044094) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001800dd8d000000000000380002001000010000000000002008001e0002000000"], 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) 3.581800645s ago: executing program 3 (id=2859): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x44801}, 0x840) 3.512903988s ago: executing program 3 (id=2860): r0 = socket$l2tp(0x2, 0x2, 0x73) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) r2 = syz_usb_connect(0x3, 0x73, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000396d0940fd101315f9b10102030109026100010000000009040001"], 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) bind$l2tp(r0, &(0x7f00000000c0)={0x2, 0x0, @local, 0x4}, 0x10) sendto$l2tp(r0, &(0x7f0000000040)="e5786a0d000000000000c83b", 0xc, 0x0, &(0x7f0000000100)={0x2, 0x0, @loopback}, 0x10) r3 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x101840) ioctl$VIDIOC_S_SELECTION(r3, 0xc040565f, &(0x7f0000000080)={0xa, 0x0, 0x1, {0xe7ff, 0x1, 0x406, 0x870}}) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r5, 0xc01064c8, &(0x7f00000002c0)={0x1, 0x0, &(0x7f0000000280)=[0x0]}) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r5, 0xc04064aa, &(0x7f00000003c0)={0x0, 0x0, r6}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f00000001c0)={0x28, 0x0, r4, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x4000}) 2.338695005s ago: executing program 4 (id=2861): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, 0x0, &(0x7f0000000180)) io_uring_setup(0x1020, &(0x7f00000000c0)={0x0, 0x6a0d, 0x3000, 0x1, 0x387}) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000000280)={{0x7}, 0x0, [0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x0, 0x6, 0x0, 0x800000000000000, 0x0, 0x80000000, 0x1, 0x0, 0x0, 0x4, 0xffffffbffffffffc, 0x0, 0x0, 0x40, 0x0, 0xfffffffffffffffd, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x7785, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x100000001, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x7, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4100000000, 0x0, 0xd, 0x0, 0xe2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 1.801723358s ago: executing program 4 (id=2862): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000001c0)={0x5813}, 0x10) sendmsg$nl_route(r0, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000001e008d2a00000000000000000a0000", @ANYRES32=0x0, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x10008000}, 0x14048010) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0x3751, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000300)={r1, r1, r1}, 0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_QUERYCTRL(r3, 0xc0445624, &(0x7f0000000240)={0x8098f8fe, 0x0, "6005588a00050c29009a9f7e1db9c906000080406585e41e00", 0x1, 0x6, 0x0, 0x2, 0x4}) sendmsg$nl_route(r2, &(0x7f0000024c80)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="44001cb737bf80553ef300001000ff042cbd7000", @ANYRES32=0x0, @ANYBLOB="0100000002000000240012800b00010067656e65766500001400028005000a00010000000500090000000000"], 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x0) 1.765821915s ago: executing program 0 (id=2863): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) mbind(&(0x7f0000ae3000/0x3000)=nil, 0x3000, 0x3, 0x0, 0x7fff, 0x6) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f000000e280)={0x2020, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r1, &(0x7f000000c280)="897c6500ff3035465c7acb4e06980b05687c1480c7aafe631c0543db2bf0d6f539506e8782da06c1ca018774d72e9e5a3418ab66ee78dad68457b17ec9d47bf7d8272d607c1c0a4bd906f0cee7f8451828d2458596bdd6a459ba18ebaf61b38f5d66c27fa8a024ad7832a85e58689a4c254c94cbcf7208fce6e61d9566459789d15a6f91dd7db7c54cc3a94da956fb290a8a15f849270bc459d9d9f47801be86dd5c9d18382081a993b7bfde5c28adca4c71329afd6be743b076033b5859891703eb65fa256d6f47450b6edacbd05a9bd8b372e90cfc30f32826566dac6c48e6ef001881cbc30482f9ec469e476a101da496b8c0785eaf875d3608b0c49e9d39baaa1041f903a805f0f24aa63722fa2d87b98595fa5cfaf8b79c458de43ee39904e7cac7540a934b4108957785d58807abff186949f1b94cd21b724aff34ac45c7066dcdbd68ea7b766af9d045cd7fafeafc5c5a0c3400ef4e0c71a6fdd5b8d68a6f317644cda9d2fd2c839a82b97b3d909b54c672227bef573c9de1991d65a63017f724d1f7f1575e69db53318a7fd7065b303e751518c8eef04f642dbd4dfa349040a7b5401050ffc2b4ef62803a7c8eaba99e011dfac24d81b2b61e0b0581e53bf520f623eca17f0545c5e59ff15b527475f970f589894ae589145fa4283f7225088ccfeba1d72e9128f8c223ae1840f2edae3dbcdf7e560d5cdf4f71c9ada1931c0f8312c000101b264aaddb9fab166ba8d8903d6098eca20935ca607ea79e936798b3dfb22a7e159abb234cf21f3733dbf263a8ff116092f251659108892b2e21e1b428fd225096a5040270b2d70347013eaa1fd8e452942200283aab092c4ffc5b8b427b5d691a5a773e09da20539ff0f8214331c5d84107ae8a59aeb58efe22d7a079e446f1dfb07510377799bfdc7ee59cabcd76af0fe8a427ac8258ff33bbad5a8061f1cfdfbf375d73d676cc7916d6658ce46a0b17ad6350150fdf0a1fb9582ace7906c493fe1fd2889d9aac0b7c29c2b6c205537627bad64df433336a5ace32ca871e51b4dab0fbb00886a1fa81a98b74de0a26cebf65723515ebb807fc3c161ed42d1a7b6b55717613577ea437f3a2967c66ce45ff85a6a35b7cd40625fc575b107d7394e3d2db51d58347276c33e21f50b5a6b5672bf9fda63139bb75aead1fe4ee9a4064af5a5958466aa39faa6d821489fa415224c8d69d3b5922236832c2b1e4f6b8863b32f9aea83fb522a2de081d674502b48f73ce6db98d84136059b4a6676bc85ac6b7626329afa9bc7d3f9f2caa3c4d872744e0a8e02d72a75c6c545b8ec8e15b6fb0fe4185bd0d154960e6fef05ba40e5fe2968eb1301dcc52a03337179e74ba1522af93d77827845f8941c69ed8bb84567e3c63f1cc378a542f1de7007b688ff0a9c69d5861f0b85402c30a2fd391c52bafbe65f8e82135fd38361d7c0b43c982b2f3e7cb09c40c7e215114f4243d670cd576bcd93c1e959345170c75d6c3cf89cf8c2c70dc792e646e7c649d4c5f36bb016c7acd466ad58473d40dfef36394e581065a8581ab852250403cf372ac0065bf757fa3f445424ac0d82aec1938a2ea116bdfd306baa1cb06c62a4a97d66ab1b9489469cb8ba842da12e310caed02c5ef05c0be1e1e8c9c8b87d6871c94c57d164d08672b205c948086a06a545b266b7ad902a908681eb188bc51b6190b5cb9d8ca59b8c4c6e7369c00d6f6119fd5d437239e3d3c89cb81e09e560fb817590106015f08e7b09f1e1e65bfab3b8489fa058e24081978b9e25463d9945bfbca81c08885d4b6d4c62e217bd9e19460762f36c66bc948fe31cde089626fbb310e3c78a8d3f2eac21d374d9b58d887235d3a95721168e4b9475849071d60ecfe7ea5d6c4bf60da3747612ef59bb651270f326c0af31bc8c71361f851de34ccb3c8071b96f1128d7ee79b41246e566edd0272dbd3ccfe472b38e5e03d3ef83218bd498e6de8b4d92cb6f82716449ede7ba845028eccdb9137be8a622ac88ac53118fbc39637fa7a93cd3abc6f7671c7804420d66e94720acbcac916950f9baca77fef4217155ccc2cd0507339a0486f9f468eb28772986ee768c63eba671bf8c52e48a2a5dc2cc24fe925368706c2d712dd1064692b0fb2a32ddfbd4a0ffcf9c2abcedaae6e527bc1d42637aff2a275b76a7a7f010e42e1cc1d27141f6c3585a2bf58c6c5789ce61551d10118a000e3764631ec0b7f4b1a6f22a678133a30940b79dc76f863dd9f6e0d7776300898c97cef286c731c2050928c492439256e481652bff0d202db3cfdc54c9816ceea7895357bfa0362fad79afd09ed55189294d6ead7e898ac091cddbe7efcedb314bc02a18dd5bbddc42e089124758bb491fd1536aab27c5c124567bc325e7028bced5a179a011d1cb9a5ffb61d7af863e91ec8e60495561188b74d158ba1418228d44e92915a22eb1c166ef7d6179e84381ed950ffd747f13e24172942d922ca3109fb8b1e4e6264fa4a4eec75ad0d0e22579d90f45d6cd157300e38ae665eb56457202e25a8dd5877ba99725de288660badd2704345d9bad208c903ba27ea167dd45a77f77b6502b525b2973270582858183c784c324c1366fbba8d410c38bf75b41e067f6a9a017c56595161db4fc5639393fdafb1f148d3f416c1adc5fe1ab9cebe4689855c9b4bda6dcba5d5fa858a1b87d2ad23cdf54dbdf4d14aa4462da0b6f1107f4afa0091c2643508861a4d9f133ba77751941bb8fb756abf1a104205b80d47a3b4a59724d959c8b5833da4f56fb6613231f230a9378c9af741e94fd2c7213ac1d7625559b3f032f6c8df3ab441929720fe43d7c548cc661eed5b3c62b3c61f538ea3228376e2a18c6da2ad906322f64fb4865cde8e1889a8e5237fd6a39bbd6662f1dedc22fbd74e4376fa610cd710703dbd3924a38beae69783d1d5abf36122cbb87129ba719042748f060f4303a3199c5891c5040fd8cdb9761b006bf64cdcb65e5cc50a29994b8c1c34b83760ece12ed9ed7c3d2a7f8911cdf23a1afe0d7db1bf342aa0123dd5cd31339f5c8e160c4efef882602b3eccbe76fb690162b8bfb8a31910bcdf9a4a5dde76c2ac2fcd8678add7a000cfdcab398eb2171c026313eb6eb56b4b87bf8ef93f7f8a1c0bcc3775b681d4229ea561cb52281d8ba4315c3694ed08433596884d5a7ce3a8b1f82359846b7136726e2fe37bf4f7b7e2206cdcdb0705ced9f0dcaaa2ed3a78ea70d2cfeab668eb321400fc955e9aeb7bbcf86cd03f02dd443503a1480d9d9f899f53bd747a95293786798fc59fceb09e686a9328da4f929b6201841bbbefaffcf3386abdf69540e3b46a643ec10f0acf21f27c0053dc13f18485dbc898729dfbeaaa4887b58cd442d7ffa941808cd9658595be8650a815b088621278d89f0d8a4252566b923df3a3cd65c0e4af08fad385927251b31d35f75eaf25e6cf13a579aeeb0bcc0a14ca4a20a6831d532be0b2af3821792a2df95131b7fafef245aa19b214053342aa820c35858d13f84e496294529411015c41ed447b5b51dc44a45d52552a2be1abfc157f3ace7bfa32d5b931421d5a152dd66b7bf549311b08325e5a7201f793037b38990bedeca8a647c08d2478670f8fc2b4e8983ea18bcd514daeeeeb9d7a778f783c76edf01bd4beda4b77b612cd2e865c2e4f58ca7ae06147bf66ae6aee221cf9b9505dc07e6fb6cf4f82dc8c406c78e270210c11cf2531011ed678d9dfe1f49c9a69a95a9f3b0e5b624d9c2664d787ab911b75a4a38d63e9d6c353f8aaf433ff961fe5e34d84936ead0d0bc7954caf84e541f5c6f3f20c9eed21eb0316b82c0dc5182540e63a0af25565496792153d6395adc2b8d68b8bcd93dd110ff5685879db4384ec390d44b89663d43a5de3bdc0e103b7c1b355dc5f6fe3518c93628780ba03f156badea65d1d0af8433c9e8a975fdd19453da662a33fa9f0f5fa15fdb216b483fb48370a967246e0b763df8b3bc7924a6c76c4b114f803dbfa3b312e6815b4eb67be167283a9e482d9a5beac250089d069d4c386b7fda5fc228404a0f58b12ca4dc131c381b49b42b570bcfc0dd663f24afaf65a26a21f6d92f52c9f8de36cb76bacbaa0eef98ba6b7dbbc2629a03bb2b6f83fc5adaf20c217bc8d0f0d2421e01472532bcb546aeb2d483c8f95011a3ba1d2fd8086a717cb015dd53064ef4a80b6d6fdc12d9069223fdf2aa9b192a0e0bdb38436f49d9eedfef3665815633fee4344aff11162526362b70b18e1dbedbb5d8c4698860beccf667851878a25a1e766caae2861f2e23404aac859e62fdfeac06a6057554828d7035806e8ab3ee2fa6d711e5811db61231a22f4672f6a11b27641f350bcab78792362e6ebc1c054a643bbbf2746678c14dc567d1f73e37005c8ab6374c4d8d3106384a2d32c5fcb05cb9ba97cb7fa1aff11505a701bead543e555f3901ef3b693d5b9ebf49518c3509af042b7e84b1b867c22b7e08725220e4338fd074edce428212e6a3563a08e2ccd8ab71910256532904542e93d5c7deb5bf5d49beb3202d4da4f643649e55edbb91188cdcf0883a40c6ed6b8a086fb5c50dc08fee00308420121d4c7431b3cfb80f9c1e099423ac451d67b12e930d9e391d0a799c7d4b54a0d56ea0aae00c1d009e21fb5459416b464b227d66ccc1a68da59d64c1583dee54bbcd7d61ffe541fd0fb7452adba91906918966a7d58019ad1f8fdebeceeed7018837b6e4272eefeec8385abe7207fb2d7061fa6cdc478165a98971f9729b818a73edefed976d5c7c0a651c091cfd1174c020e39330a79144271fe4cbc61ea0ffa274d0d87d06dd08c1d5f8a0364d46ef7b54426bc28afeb2715c2ae511ff53b1189cc59ab80b1325fbdcedfdb8f36ed71f70091116e16b52188b794e637755027caac8db8554f8674b844964c710cacd7a9d6b06baf6fef76159a380e639b0d3e66080a7cf7f86baac01dbe47fe687fcef2f3bfbf6f8fba045181dee688360a11ee56e5fc73ed31c0e2924ae57f0cc93c63a30662a65c5d5f17123ae28cc5b74dd13ed81b03dc7fa61dc575668868c0df12d3553269f04ba79084d070abcdbd4745de80e90e4e3e524f2724f5024a2f2d4c8b331b0cb6d4efe62a298daacc6eacdfe008c1f912795dbdc37098c42db860953120fda709baa6d46f52eaba781505e68561ca0f281e850532ef8e7c779883e312806e1c357bdef8d0dda005e710cfa6eb8686e8bf3bff036b3fcdc4036541d93530ce6f598442c24170b307ef05f23c93aa0ec96831b532d8120402214a940d1fa01ed649061a4a71308be189cffd729a196754fb8a75f23851189589be1b819f0612cad3dc94ccee88f4ab9ef6ac9c7daad8cf94f5ed9496c4c824e5b4f66ce32a80e7a6ef069a32f6812e656aa5f5742bd432afdf026c86e8f28212c1139dad47d7fc07e5c1a83e993daaa4a4bb5f0c9435ccab2a10f867ffe259dba7a1d9168619b1e3048860a5122e4a5d0b00372eaae861a0cc88549852fffa76e6d78739b654d67df15ea97a9a46b7c382d83191a673aa619b4a10ec05bc681379b0d6df824cb6fe158e9d89ae5dd1ef66976f67972b553db52eb6feef836dca6026293f83a61e117754a7424a3da63bd82d017f87f0603e2a9b8fc550aae611681935ae91f7ca2b5341b05a25208bd28f1a202a7f2a213b1d7411ffb557470aec00c4d13c70163f22a038a189710dd19a47e8db4a87c3fd329a63abca172a9810edad2d8e19ef85b57ea4287cfb3d740d7ea3fa9c80d06e1aa84b317f678ddb3c147ba5e0db432125f59ca4944c8e9050281ca82a3ecf67b2a5df678697a52a7297af1ecb03c586af7b91d74e881964ed95f7be12fa07e2a4e71aab8b913a13996fa33e915144bf00e49b8e7adec5b2c4b8165f54ba3155230e241ee023af77a295ab87c40f63f6092ccee05cb08a265abe8f57c9919bf45064b6c2240ba8011db223a283a4e2292d9b59df8c9a4fdc763f0631007db9976f351717db0e6b5f9c6e5f227c2efa1ae5fe0be1af0b22fc164f9f9678a01fe8b059749fe8a2972455732da1989c609d191544ef9fbb3e58da93ec4a582430523f260b776e4d747312747d18a9bae14740f5dcd35fd1072f8a4d81573b5882203be856b62d7e1d87081a9e431872c9d68864197bbc61f15dd8aeae950d34d6ce97182deebd2ad64cabd1c723baf512acfc7e94675b31369bd60e155af79b97bb734312569f736dcd5b5a78223ffaa0f7e93e1a112cb9f6a5b88fe3cf12c30024c16c6b8380fdf086c662665d3751c11617cc4dbd5b8bc7543301a23fbc90ba8d060193cdc2b68c31c734d516707b759f7db009c8f06e69b40154e1cd8ae444afb28134acdf871136b4fd78bd86d7faaaf618afb25e92d1ee37cdff0595278f9565f5eb109e181e9cacec2f22e32e9f34774ee223fdb992febcc5dbc5cceeda16cbcf1434730d859e7e03d36ff17636a7a7e66956b515894da114f3040909f90ce3cfbb2d7d46e37049c0fb124e0683d662eb427cd7b851ada229451e6e3aaee64b9964ced3036bde5d9d80eb062474f96ecfb9b65fcafc719494ac12ab7df245475f2a5e7f85ca4789833ca373e6214d39176c8f51dde87a4cfe5414a20f68bb9f34709979b99533ba3435c4aa56e525195e10ffd00f8e41aee30a909c07b973bbf733d45500b539ebe2206d438216690998d9e256db1b7ac6bef3e810785e1986985c945a2b820323a592721fcfa444934d0faf8aa439d5efca5dcd77b72d1eb91b3790d50d0a7483e354c415f81d99c133d648c1293e795b3c43f9b47e23ef982e10072ea5baafb0df675e69af1807b225afa0cec3eafbde8535d3ecaa0ea6ddbffe4465207425bb003670320324df0aeeb16b38a043f9c0e85673b36def332fd68b2b1e6edda621d0cadebbced8c7fc8f890489115b457249e8d8103676b3207a472804d33e0fe511ac56cd8dc5333b2333892f87b455940ada78fcf5075c358fce990e6f65f095eb416d876ce6f120b8b02cfa6b176ee269c942f881247c3e464cce2aa65c39137607c585aeb4b5f24f5f8e058c9c8b48003c1809da3e8aad1bee7955c3a976d43fe132e2b16f4758a0a9884e51d13b930675a4361ff366b0fed190ad7b2a00385528951e39cd44ea06d8921b9d613d7626221154cf86249a550198fe4e5b05ad3052b474291da0a0a2f701759859bc0392adf243ad5eca89e6d18e28dff99ef95743bcabe75504be8c715cd6360facf3bb06cb97c29989d4f6ff5083573cefe6ef0b39a252a2678112fa88e5b06c9a6bfc9597cc96e5a49710c4fc120fb0da4945b9d94e46de1e9989d0fc3d8d20df23d815b660c799a903f651b0d013f7fe158f1d297f7fcb6a48780ca5525f1d081ada0aafa83552318b848783306549750b6254cf676c7b934cf7fdab992717f0cdc089b34278f3fb151cadde14d0d3250e85a4b0ff2a2778a219aa40563d3ef575285484424b6d0e7cc8392342e4848c6fc8cb20fa1b450cc4c1fea19f3bbdd9e342e6c49cd7ac893b1eda2e93d1d74d20969465946b398fbc733757741ac822c4a118632cd242a439fc37512cf79b7c629504ccc1e7f2f11798955c3262b5e9695625ba74d8050e20f51d4769e1ab938f487f1bc4b55b5abcaa3ec079c2d0972b2ae9bfb7c5423b959119292ea05f1d79d35afe47e49d97c946b193bffc0a8f607f18a6845cecbbdd98cd351db2b2dce05a4848ba84a6a497b4618950130cb7e76c03d0976eb2fb41d3a42a1430063ed8e5b8c67e80fd4fc1148911958babbcbff33a6505de209b0d9320017fd736fd027a16564008ab2e1f48a6dd66c9256730e9fda0a606875d0871b2b9b0bc2ed4e1b696dbf0283c8dc72cf4338e595266f5390bc3a21f988353118f2948fc75d050ea076b73508d9ed89bade0ba305c1f4e5daf9d40d2f5e7ababed8d1b1d919c61a6d3fb149c1a9b44e38585a2fe322f83d73a3aecb44da3f0e82942d75d62ed3f91eb44f3411df014f88839e4cb1e21b9b259d4eb4a7e642fdc56d11c2ec87ec77dde5ee9d566e3dd8d928fc1875c63af26c59daba5ae267d9bd5da72b99a03e6a33cc48ed961ab484ff4a46c2d5fa597e626e00b530d7b9a9705e4e08d03f3a7f2a5a5233ad6340e3b5c89db81ca713b6d7d855c6324955f85109b204566f50178cd88abe3fcba25de905e8ea0b75ad51831761ed9b1af2470f976f05ec73bf74d137c207270cfd614170518cdc449aeeb663e114359c8124eaf2499d8cf5dc84a0872301db2e57b50bd285060ec4390d99d4ae3674ca3bb8679c1b08e566ba4f30daec8684a980055eb43cb5a1306c4b52a154682aa96637e06c869278aa2f74ef7345632c11265ef8ac97e953745302556881ba0cb590fef271c0abb193fb84d18ee3f24d9976ae816b857d6f68d1fdfe10b312c799fe014debf875d04bff8b4f387859e97c6bf13f7083c28a2045a0b5eb09c94e781a165965e8617c0efed1701ea9667aeca26d9577ea7b1242e1d91b25d6a66756cc627648a293b9f4345966bc469fafaeddc1118d0972bd5c7751a1f51e5989fd952f314ae10417c97b41e60ebfbc47e496486fa4a89fd16aea7fa1eabebd26eb2a37a3e2b351e0c9d2f67b2e5be0f921adc9b6045b045948e5103af0e5050b9c0799b513c00865deebda730de538f956ceb6164e08bd6f58655a294b4b44fc65309b30f9c00f92ef5bd5b911a3d830f72c258b19521bb8e80db02129954efb61423f518d2c5f36587303890cad9a93fa4f4bcd0e24c67db679c67ea59c1350b8442577632d5e8735833f3daf5a74bc7bd82659a81beba8c889632efe03cd24187aee856cf659e16e195464f52f2b984fc7a299e7b2aa53979a147ebed35705d5e89691666536f2febacfcef9b32d14952f958b72512869e4f6a0a34176918217888b1eb8b89322ebb6bb1dead2b4744e728479880db70e6147edaff6c3f083f18e0696bdbd78cf0bda14d9f42e5c1077ced00041aadff90470aacec0e48e2a5f2a0ed37818a173b96061e8c5bf24c0bde9e09f9e0ddb8e13306ef1d4eb8043ebadde5d7553e5212ecd4691eb426251f9d6720b8276ac543dde02399a35d974b22c1727d4b6df01957cae47443b706d43165e01d6932b136f561ce837431254cfb2a6e7d8070a2d3805aaa15b3c10ccd0cda2e9b418ce9ef380e5d08217752e12b3b892d03a9495c83d78d674612fde5a67738b2d4649ce44606ecce6bf3bd1293eca246a83643e4f1c7ba362b110e07c8479f216e3d4afc4fcb8d0820c8ab702a66d8183e83174597035e92b9b500dee08c80b927b42c3689c7c9617b4112c9e54cbfa51e989b5fd42b80c595d3edd265f138e8128cfbbb0e4f53aa0aa95a2ecda4518b2e564c42d5de7671560843d08103b9bdceac5fdeb0b1266f72f491265dd2b2b80a225a50955167da1812364ea340d82f61535401bae6f3140a8795d7c318a64cee4676627244930957b2f0b227be21b72d90027e6a5a7af3c59470c74dcdb71d1ef090a0f49c91acd604c792385c8f4e085765292822ee5eca03885fd6bfeaca9b3bbbdeac939f7846a487c5a483ed1e4fbf37c93886ea27bb35c812089b900b77c7c924147e97b6a71533610750bc84921012aa8158b213f7601d934a20bdd1f757b09ffd42a683af6b9069f3900059d7f80f9fdcc9f33ece8cf7888dc9e24f1fc6ca0ecccf161c5334c60f440feb3acfc3d115011c176dfa05314c5bcf089e3c82bbe7680a3eefdcdbf3ac27265b779db4f49bade0128eda6e29bc5933ef454601db1b49628fd39ab938794fa46a33937a086ece7050d31a21524e2f0cacb307ed4412a2078636f9cc8e11c5c31cc0f9edd7be6d1e31a1513a58e25215f5a24245cb988589e6d5e5119f4f6557c697fad7d1c3a7e3bae064db4382701e33e48c5b6a52fe9141a385ef2325c6f7781134607e98bfd02c43d6deefaa861700388b40d98e941cfb2ddec209f977e8b9f93d29fdbf85e3010ce7cd622e8c75ce3df535e392052b6d65d5042d2a6e78bbfe5ee146e8b18d4bc7fb024dbba57cbe0402205593766a313950cb719d00c67bb6b3bcaa1015b89e820f11475afce655947113a7c3dcbb52427f090df994fbf076db867e0ab3f6125fb8884c1d13ff3e99fab5fa8b9f0b72cb44db4d0a48d9ec17f9733764e213c40a15ad821ec60e4a88cb2fd9dd9a4f35e6a708f4b74067f4be3f03a95261f6b191df53fa5bb5164e4a164630ad9ce39087aa950ad9e60cd2c44fa2237c49abf858c97737fd21180fd0b9542767150fbed3f39a29e6c3484d9437e15d2439f2a54b2a1ac7e63e6c436658abc3f1dd52d984f6c6901768a8cf2ec98ebf44e90e0fc0c24f8957c62e05d8eacecaf25b178fd710af609a8a1bc4d7955b5f0cb4f48a37685e6304ea5843573a1abff37b5106916c83c8f23f939a0dc43aea8d196191ed6e18dd793990d1f37d7de0bf8fac6f469843724eaab86be8a483be281b8ecf4aa29d9c571951cde8cd8c2aaf4d597ac2cb48f23fad145916920a55d655924940573b64dbd42a280cddc4810434f930183fdbbdc72db1491a4c9d44daf9b1bc2fecd855508648063040faeb125da0e68e6cd2002181118eecff0be1dd8eae726af5d451630cd65119c52abd6dded97f931202f186a18c4ba34bc2c3f6d765e2d8f445e959f26ffb55827cf3ff2cc0289f17b82c8caa5a2d3da452647e342e2591be4ea9e32c5d4b1173942745cdcfe4f5d1619eefaf8dc600afbc9171d516f7f4b35331d0b9be005132ffad5e9df59710278b842afb626a78b8b8b37fc3a894dc705b2d4e0940cb264e9dc87eaa148e6faf78125462f28a0f1d7b3c65a291b85713fa71ffc478f6601e8716c35489f4a54ed0c70bcfd5502cc91374dc3c982075c5180398bc6b195b36e79dcc4087cb990cc9d964a150e0dcc887d496bdd27c3f298736b9ad8345ba2df46021964cf43c38f9d2e94b77bee2b7bf059e0870ff9f17b9ef1320c0aa88a2fa9781e9017ab64643de9a3df9ed4b8cfd8fa080a2e494409520b795eb1517d224a05e450c4c8ae0e9fd29c0e72d3a592cce55f6dd5107f21214e1a3f9a5448384de06149f959ec0c92790f0ff229ab4971171f1c528ae6d095ec007bf5e7f55d623a68194e9ea8edc3af418075338328f24e7504341c22bef72c2963fc9c3237ba990d29c2c8aa3007395f6d96e95b40ee1b18dbad550bf39d0d98268cb74dde76d987c3169c9067495fb1b88508bbb7e94cbb7dfc15c03b1d5b163132c8a468906f02d422a8cf98d0b432b5779dd962074b72dd27439b2e94312f573435e5aa84664432c1914839cd6e172186ce93eeb1d7cb0659696d9d550eb3b185f8c6ee16e53f78233cbe709f99d2879d63d93f7d0ed133241d2f1ab1eb2c56605ca0f0e01c39ab0ba2370fe5c4e68de0561b517ff9a10023c386236398372c7176e35443e2cf5dd6cbed9f23395f231e6a54f65626cb5860a8b72122c34664119e7c47204ef4a70583a00", 0x2000, &(0x7f0000001940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x90, 0x0, 0xa, {0x3, 0xffffffffffffffff, 0x100000000000000, 0x800, 0x0, 0x0, {0x0, 0x3, 0x2, 0x0, 0x0, 0x46, 0x1, 0x0, 0x2000000, 0x4000}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r1, &(0x7f0000000380)={0x50, 0x0, r2, {0x7, 0x27, 0x0, 0x30000, 0x0, 0x0, 0x8, 0x10000, 0x0, 0x0, 0x10}}, 0x50) rename(&(0x7f0000000100)='./file0/../file0/file0\x00', &(0x7f0000000140)='./file0/../file0/file0\x00') umount2(0x0, 0xb) 1.623811435s ago: executing program 2 (id=2864): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x40c4}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000001780)=[{0x0}, {0x0}], 0x2}}], 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/timer\x00', 0x1800, 0x0) preadv(r0, &(0x7f0000000180)=[{&(0x7f0000000080)=""/228, 0xe4}], 0x1, 0x7, 0x9) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000000)={0x24, 0x11, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x14, 0x0, 0x0, 0x0, [@typed={0xd, 0x0, 0x0, 0x0, @binary="56ccabd869c2033840"}]}]}, 0x24}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r4 = accept4(r3, 0x0, 0x0, 0x800) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x4e22, 0x5875, @mcast1, 0x3}, 0x1c) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r6, &(0x7f0000000080)={0xa, 0x4e22, 0x8, @mcast1, 0x2}, 0x1c) r7 = syz_open_procfs(0x0, &(0x7f00000005c0)='net/udplite6\x00') preadv(r7, &(0x7f0000000540)=[{&(0x7f0000000200)=""/161, 0xa1}, {&(0x7f00000002c0)=""/109, 0x6d}], 0x2, 0xa3, 0x7) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r8, 0x0, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x8, 0x3, 0x420, 0x288, 0x43, 0xa0, 0x288, 0x98, 0x388, 0x178, 0x178, 0x388, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @multicast1, 0x0, 0x0, 'bridge_slave_1\x00', 'ip6erspan0\x00'}, 0x12a, 0x228, 0x288, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@string={{0xc0}, {0x0, 0x3, 'kmp\x00', "7af8bdb4c056dc65949041982abfe9ed51b01289c0026e2e6034ed587be5f09017b907388134b0ede40eb8d493f20d534fc37f23ec524d91a7a041f36bb1d1c3ab474544c5ef3f2fa69a80a0d967ee4464257d28d31e6843bc1221dfb9a6a27ad13af7061b737fd97d94f50942c68242819c941c0b4d9ec154c7d327187e8198", 0x38, 0x2, {0x1}}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x4, 0x7, 0x5, 0x4, 0x3, 0x4], 0x2, 0x4}, {0xffffffffffffffff, [0x1, 0x1, 0x1, 0x1, 0x1, 0x2], 0x4}}}}, {{@uncond, 0x0, 0xe0, 0x100, 0x0, {}, [@common=@unspec=@cluster={{0x30}, {0x1b, 0x408, 0xfffffffb}}, @common=@set={{0x40}, {{0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x300], 0x0, 0x1}}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x480) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) 1.305335466s ago: executing program 4 (id=2865): r0 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r1, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100000006002700"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x48010) 1.097253276s ago: executing program 4 (id=2866): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) set_mempolicy(0x3, &(0x7f0000000000)=0x7, 0x7) r0 = socket$netlink(0x10, 0x3, 0x8) bind$netlink(r0, &(0x7f0000000140)={0x10, 0x0, 0x25dfdbf9, 0x20}, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0x6, 0x4) r1 = landlock_create_ruleset(&(0x7f0000000000)={0x10, 0x0, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) r2 = open(&(0x7f0000000280)='.\x00', 0x80, 0x0) r3 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, 0x0, 0x0) fcntl$notify(r2, 0x402, 0x8000003d) r4 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x40, 0x0, 0x1000, 0x0, r2}, &(0x7f00000006c0), &(0x7f0000000000)) io_uring_enter(r4, 0x48e9, 0x0, 0x2, 0x0, 0x0) landlock_restrict_self(r1, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x42, 0x0) io_setup(0x20, 0x0) io_submit(0x0, 0x1, &(0x7f00000001c0)=[&(0x7f0000002040)={0xf, 0x400000000000, 0x0, 0x1, 0x0, r5, &(0x7f0000000080)="0d32818e7e6ae0", 0x7}]) 848.408896ms ago: executing program 2 (id=2867): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f00002ae000/0x2000)=nil, 0x2000, 0x1) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x8, &(0x7f0000000040)=""/4096, &(0x7f0000001040)=0x1000) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000001080)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x10, &(0x7f00000010c0)={0x38e4}) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x40c400) write$6lowpan_control(r3, &(0x7f0000000140)='connect aa:aa:aa:aa:aa:10 1', 0x1b) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) socket$alg(0x26, 0x5, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1000f4) timer_create(0x5, &(0x7f0000000000)={0x0, 0x38, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000080)=0x0) timer_gettime(r4, &(0x7f00000000c0)) 789.648336ms ago: executing program 4 (id=2868): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@deltfilter={0x24, 0x2d, 0x200, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0x0, 0xfff2}, {0x9, 0xd}}}, 0x24}}, 0x4000) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x4, 0xb}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0x7, 0x5, 0x9}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x20000090) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x4, 0xa}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x5}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x80) close_range(r0, 0xffffffffffffffff, 0x40000000000000) r8 = socket(0x2a, 0x2, 0x0) r9 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r9, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x3, 0x0, 0x2, 0x10, 0x0, 0x0, 0x0, [@sadb_key={0x2, 0x8, 0x8, 0x0, "a3"}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @private2}}, @sadb_sa={0x2, 0x1, 0x0, 0x7, 0x0, 0xa, 0x0, 0x40000000}, @sadb_address={0x5, 0x5, 0x0, 0x130, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}}]}, 0x80}, 0x1, 0x7}, 0x0) getsockname$packet(r8, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=@newtfilter={0x98, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x60, 0x2, [@TCA_FLOWER_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x29, 0x1, {{0x3b, 0x200, 0x0, 0x100, 0x7}, 0x42}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_FLOWER_KEY_ENC_UDP_SRC_PORT={0x6}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x3}}]}, 0x98}, 0x1, 0x0, 0x0, 0x10}, 0x24000000) r11 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r11, &(0x7f00000002c0), 0x40000000000009f, 0x0) r12 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0xe8f, 0x12, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x3}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r12, 0x0, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_PORT={0x6, 0x5, 0x4e20}]}}}, @IFLA_MASTER={0x8, 0x3}]}, 0x44}, 0x1, 0xd, 0x0, 0x4000000}, 0x44050) syz_usb_control_io$hid(r12, &(0x7f0000000200)={0x24, 0x0, 0x0, &(0x7f0000000180)={0x0, 0x22, 0x3, {[@local=@item_012={0x2, 0x2, 0x9, "c81c"}]}}, 0x0}, 0x0) 650.928948ms ago: executing program 0 (id=2869): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x44801}, 0x840) 555.946677ms ago: executing program 1 (id=2803): r0 = syz_open_dev$dri(0x0, 0x1, 0x400) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0xff00, &(0x7f0000000000)={&(0x7f0000000580)=@newlink={0x44, 0x10, 0x449, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MIN_LINKS={0x8, 0x12, 0x9}, @IFLA_BOND_ALL_SLAVES_ACTIVE={0x5, 0x11, 0x1}]}}}]}, 0x44}}, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, r1, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f00000006c0)={0x0, 0x0, r1, r3, 0x227, 0x0, 0x8, 0x7, {0x8e, 0x0, 0x7, 0x220, 0x4, 0x2, 0x8, 0x2, 0x3, 0x3, 0x5, 0x8, 0x3ff, 0x2, "e5d88f223fa4a2700ea357d21e65a316b58acaf2f8c9068dcfeb29c02ff1aed8"}}) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0xa, &(0x7f0000000080)=[{0x101, 0x5, 0x9, 0x80}, {0x0, 0x10, 0x8, 0x5}, {0x6583, 0x8, 0x16, 0x4}, {0x40, 0x1, 0x3f, 0x83}, {0x3ff, 0x3, 0x67, 0xcf5}, {0xa, 0xe, 0xeb}, {0xa, 0x30, 0xf0, 0xa4ec}, {0x800, 0x3, 0x1, 0x4}, {0x9, 0x1, 0x15}, {0xfffd, 0x9, 0x17, 0x3ff}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f0000000140)=0x1, 0x4) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) getrusage(0x1, &(0x7f0000000500)) landlock_create_ruleset(&(0x7f0000000000)={0xe01, 0x2, 0x1}, 0x18, 0x0) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x41) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r4, 0x7a5, &(0x7f0000000040)={{@any, 0xffffffff}, 0x1, 0x2, 0x800}) lchown(&(0x7f0000000740)='./file0\x00', 0x0, 0x0) 421.119445ms ago: executing program 0 (id=2870): syz_open_dev$video4linux(&(0x7f0000000480), 0xd, 0x123002) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000002240)={0x200000, 0x220000, 0xc, 0x0, 0x2, 0xfffffffe}) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) rt_sigsuspend(0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) capget(&(0x7f00000021c0)={0x19980330}, &(0x7f0000002200)={0xb70, 0x6, 0x4, 0xfff, 0x2, 0x5}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_genetlink_get_family_id$wireguard(&(0x7f0000000840), 0xffffffffffffffff) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000027c0)='/proc/asound/timers\x00', 0x0, 0x0) ioctl$UFFDIO_MOVE(r2, 0xc028aa05, &(0x7f0000000100)={&(0x7f0000960000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x3000, 0x6}) open(&(0x7f0000000780)='./bus\x00', 0x400141042, 0x0) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$alg(r2, 0x0, 0x0) r4 = socket$kcm(0xa, 0x2, 0x0) r5 = socket(0x2, 0x80805, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f0000000040)={0x84, @broadcast, 0x4e21, 0x3, 'sh\x00', 0xd, 0x5, 0x8a1a}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44) sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x2000000) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f00000000c0)=0xa0000) 410.805689ms ago: executing program 4 (id=2871): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x800020, 0x0, 0xffffffffffffffc0, 0x9, 0x8, 0x0, 0x3}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000000050005000a00000012000300686173683a6e65742c706f7274"], 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=ANY=[@ANYBLOB="1400000009060102000000000000000002000000283283bc7fa43de1e723d64158cccb8e8008f413f5aaa9429dcb06d030e2d647f2c44112117d3121ad870319036f6e534833abfec5a797b2fbaaa3128eecc4dd155e631458534dca1411a17d67f68fcf"], 0x14}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x8001, 0x0) ioctl$DRM_IOCTL_AGP_ENABLE(r5, 0x40086432, &(0x7f0000000040)) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r6, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r7, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(r8, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r8, &(0x7f0000000180), 0x400008a, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000040)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='dvmrp0\x00', 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000340)=[@in6={0xa, 0x4e23, 0x0, @local, 0x3}], 0x1c) 0s ago: executing program 3 (id=2872): openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(0xffffffffffffffff, 0x4188aec6, &(0x7f0000003980)={0x1, [{0x2, 0x0, 0x7, 0x0}, {0x3, 0x0, 0x1, 0x0}, {0x1, 0x0, 0x10000, 0x0}, {0x3, 0x0, 0x90, 0x0}, {0x2, 0x0, 0xf, 0x0}, {0x1, 0x0, 0xe7b6, 0x0}, {0x0, 0x0, 0xffff32e3, 0x0}, {0x2, 0x0, 0xfffffff7, 0x0}, {0x2, 0x0, 0x5, 0x0}, {0x0, 0x0, 0x2, 0x0}, {0x1, 0x0, 0x1, 0x0}, {0x0, 0x0, 0xfffff03a, 0x0}, {0x3, 0x0, 0x8, 0x0}, {0x3, 0x0, 0x0, 0x0}, {0x2, 0x0, 0x80, 0x0}, {0x1, 0x0, 0x3, 0x0}]}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) sendmsg$ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x40904}, 0x20040814) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)}}], 0x1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_usb_disconnect(0xffffffffffffffff) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f000000040b2100000095f57584"], 0x0}, 0x0) r3 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000740)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x1, 0x26, "c08f2b2e64440258df88701430086694409cdcda35e66aa01e07fe087cf624a501057610f635"}, 0x0}) ioctl$HIDIOCGUSAGES(r3, 0xd01c4813, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x1, &(0x7f0000000080)="b0") r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r0, &(0x7f00003a1000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="9a01000000f800b8d58800000f23d00f21f8351000000d0f23f864640f79ea66baf80cb8c85f5480ef66bafc0cecc4c2adac17b9550200000f320f2860c7c4e11751df0f2e2d00000080b9800000c00f3235008000000f30", 0x58}], 0x1, 0x4a, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r4, 0x4048ae9b, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1181}) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000040)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x200000000000000, &(0x7f00000001c0)="d6"}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f00000025c0)=[@request_death={0x400c6313}], 0x0, 0x0, 0x0}) read$FUSE(0xffffffffffffffff, &(0x7f00000027c0)={0x2020}, 0x2020) ioctl$KVM_RUN(r4, 0xae80, 0x0) kernel console output (not intermixed with test programs): 2191][T13854] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 652.032230][T13854] ? __fget_files+0x3a0/0x420 [ 652.032271][T13854] ? ksys_write+0x22a/0x250 [ 652.032295][T13854] ? __pfx_ksys_write+0x10/0x10 [ 652.032323][T13854] __x64_sys_sendto+0xde/0x100 [ 652.032351][T13854] do_syscall_64+0xec/0xf80 [ 652.032374][T13854] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 652.032396][T13854] ? trace_irq_disable+0x37/0x100 [ 652.032427][T13854] ? clear_bhb_loop+0x60/0xb0 [ 652.032454][T13854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 652.032476][T13854] RIP: 0033:0x7fbd3dd8f749 [ 652.032497][T13854] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 652.032521][T13854] RSP: 002b:00007fbd3ec2f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 652.032546][T13854] RAX: ffffffffffffffda RBX: 00007fbd3dfe6090 RCX: 00007fbd3dd8f749 [ 652.032564][T13854] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 652.032579][T13854] RBP: 00007fbd3ec2f090 R08: 0000200000000100 R09: 000000000000001c [ 652.032595][T13854] R10: 0000000000044004 R11: 0000000000000246 R12: 0000000000000001 [ 652.032610][T13854] R13: 00007fbd3dfe6128 R14: 00007fbd3dfe6090 R15: 00007fbd3e10fa28 [ 652.032706][T13854] [ 653.243597][T13875] SET target dimension over the limit! [ 653.251384][ T9] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 653.491145][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 653.502009][T13882] xfrm1: entered allmulticast mode [ 653.544037][ T9] usb 5-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0 [ 653.585040][ T9] usb 5-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 0 [ 653.607937][ T9] usb 5-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 653.626541][T13884] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2345'. [ 653.737802][ T9] usb 5-1: config 1 interface 0 has no altsetting 0 [ 653.764253][ T9] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 653.797272][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 653.808551][ T9] usb 5-1: Product: syz [ 653.815138][ T9] usb 5-1: Manufacturer: syz [ 653.821255][ T9] usb 5-1: SerialNumber: syz [ 654.199226][T13895] team0: Device ip6tnl2 is of different type [ 654.326980][ T9] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 82 if 0 alt 255 proto 1 vid 0x0525 pid 0xA4A8 [ 654.445891][T13899] binder: 13897:13899 ioctl c0306201 200000000680 returned -14 [ 654.698314][T13865] usblp0:failed reading printer status (-32) [ 654.736112][T13865] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 654.780238][T13865] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 654.800052][T13912] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.2355'. [ 654.812807][T13914] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2353'. [ 655.841210][T13924] bond4: entered promiscuous mode [ 655.901835][T13924] 8021q: adding VLAN 0 to HW filter on device bond4 [ 655.937660][T13929] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147483648 (4294967296 ns) > initial count (131078 ns). Using initial count to start timer. [ 656.188359][ T7746] usb 5-1: USB disconnect, device number 82 [ 656.200679][ T7746] usblp0: removed [ 656.530628][T13939] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2361'. [ 658.398011][T13973] FAULT_INJECTION: forcing a failure. [ 658.398011][T13973] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 658.417418][T13973] CPU: 0 UID: 0 PID: 13973 Comm: syz.2.2372 Tainted: G L syzkaller #0 PREEMPT(full) [ 658.417455][T13973] Tainted: [L]=SOFTLOCKUP [ 658.417464][T13973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 658.417479][T13973] Call Trace: [ 658.417489][T13973] [ 658.417499][T13973] dump_stack_lvl+0xe8/0x150 [ 658.417535][T13973] should_fail_ex+0x414/0x560 [ 658.417575][T13973] prepare_alloc_pages+0x22b/0x650 [ 658.417611][T13973] __alloc_frozen_pages_noprof+0x123/0x370 [ 658.417637][T13973] ? __lock_acquire+0x6b6/0x2cf0 [ 658.417663][T13973] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 658.417701][T13973] ? policy_nodemask+0x27c/0x720 [ 658.417725][T13973] ? __kmalloc_cache_node_noprof+0x475/0x700 [ 658.417747][T13973] ? __get_vm_area_node+0x13f/0x300 [ 658.417779][T13973] ? __vmalloc_node_range_noprof+0x371/0x16a0 [ 658.417799][T13973] ? __vmalloc_node_noprof+0xc2/0x110 [ 658.417824][T13973] alloc_pages_mpol+0x232/0x4a0 [ 658.417857][T13973] alloc_pages_noprof+0xa9/0x190 [ 658.417887][T13973] get_free_pages_noprof+0xf/0x80 [ 658.417914][T13973] __kasan_populate_vmalloc+0x38/0x1d0 [ 658.417936][T13973] ? do_raw_spin_unlock+0x122/0x240 [ 658.417972][T13973] alloc_vmap_area+0xdc4/0x14e0 [ 658.418026][T13973] ? __pfx_alloc_vmap_area+0x10/0x10 [ 658.418057][T13973] ? __kasan_kmalloc+0x93/0xb0 [ 658.418086][T13973] ? __get_vm_area_node+0x13f/0x300 [ 658.418120][T13973] ? copy_process+0x4ea/0x3950 [ 658.418153][T13973] __get_vm_area_node+0x1f8/0x300 [ 658.418194][T13973] __vmalloc_node_range_noprof+0x371/0x16a0 [ 658.418217][T13973] ? copy_process+0x4ea/0x3950 [ 658.418244][T13973] ? percpu_ref_get_many+0x19/0x140 [ 658.418299][T13973] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 658.418330][T13973] ? memcpy_and_pad+0x48/0x80 [ 658.418366][T13973] __vmalloc_node_noprof+0xc2/0x110 [ 658.418389][T13973] ? copy_process+0x4ea/0x3950 [ 658.418411][T13973] ? copy_process+0x4ea/0x3950 [ 658.418438][T13973] dup_task_struct+0x228/0x9a0 [ 658.418464][T13973] ? _raw_spin_unlock_irq+0x23/0x50 [ 658.418512][T13973] copy_process+0x4ea/0x3950 [ 658.418564][T13973] ? __pfx_copy_process+0x10/0x10 [ 658.418603][T13973] ? mutex_init_lockep+0xf9/0x130 [ 658.418633][T13973] vhost_task_create+0x1ce/0x320 [ 658.418662][T13973] ? arch_stack_walk+0xfc/0x150 [ 658.418686][T13973] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 658.418717][T13973] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 658.418748][T13973] ? __pfx_vhost_task_create+0x10/0x10 [ 658.418786][T13973] ? __pfx_vhost_task_fn+0x10/0x10 [ 658.418821][T13973] ? __lock_acquire+0x6b6/0x2cf0 [ 658.418848][T13973] ? kasan_save_track+0x4f/0x80 [ 658.418869][T13973] ? kasan_save_track+0x3e/0x80 [ 658.418889][T13973] ? kasan_save_free_info+0x46/0x50 [ 658.418925][T13973] kvm_mmu_post_init_vm+0x14c/0x300 [ 658.418961][T13973] kvm_arch_vcpu_ioctl_run+0xdc/0x1c90 [ 658.419008][T13973] ? look_up_lock_class+0x57/0x110 [ 658.419031][T13973] ? register_lock_class+0x31/0x2e0 [ 658.419053][T13973] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 658.419091][T13973] ? __lock_acquire+0x6b6/0x2cf0 [ 658.419116][T13973] ? __mutex_lock+0x335/0x1350 [ 658.419153][T13973] ? kasan_quarantine_put+0xbb/0x1f0 [ 658.419188][T13973] ? do_raw_write_lock+0x120/0x260 [ 658.419237][T13973] kvm_vcpu_ioctl+0x99a/0xed0 [ 658.419274][T13973] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 658.419301][T13973] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 658.419348][T13973] ? __fget_files+0x2a/0x420 [ 658.419380][T13973] ? __fget_files+0x2a/0x420 [ 658.419407][T13973] ? __fget_files+0x3a0/0x420 [ 658.419434][T13973] ? __fget_files+0x2a/0x420 [ 658.419465][T13973] ? bpf_lsm_file_ioctl+0x9/0x20 [ 658.419491][T13973] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 658.419520][T13973] __se_sys_ioctl+0xfc/0x170 [ 658.419545][T13973] do_syscall_64+0xec/0xf80 [ 658.419568][T13973] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 658.419590][T13973] ? trace_irq_disable+0x37/0x100 [ 658.419620][T13973] ? clear_bhb_loop+0x60/0xb0 [ 658.419647][T13973] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 658.419669][T13973] RIP: 0033:0x7f84a6b8f749 [ 658.419690][T13973] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 658.419710][T13973] RSP: 002b:00007f84a7a76038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 658.419734][T13973] RAX: ffffffffffffffda RBX: 00007f84a6de5fa0 RCX: 00007f84a6b8f749 [ 658.419751][T13973] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 658.419765][T13973] RBP: 00007f84a7a76090 R08: 0000000000000000 R09: 0000000000000000 [ 658.419780][T13973] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 658.419794][T13973] R13: 00007f84a6de6038 R14: 00007f84a6de5fa0 R15: 00007f84a6f0fa28 [ 658.419830][T13973] [ 658.420019][T13973] syz.2.2372: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 659.020316][T13973] CPU: 0 UID: 0 PID: 13973 Comm: syz.2.2372 Tainted: G L syzkaller #0 PREEMPT(full) [ 659.020341][T13973] Tainted: [L]=SOFTLOCKUP [ 659.020348][T13973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 659.020358][T13973] Call Trace: [ 659.020366][T13973] [ 659.020374][T13973] dump_stack_lvl+0xe8/0x150 [ 659.020399][T13973] warn_alloc+0x214/0x310 [ 659.020418][T13973] ? kasan_quarantine_put+0xbb/0x1f0 [ 659.020436][T13973] ? __pfx_warn_alloc+0x10/0x10 [ 659.020452][T13973] ? __get_vm_area_node+0x211/0x300 [ 659.020476][T13973] ? __get_vm_area_node+0x13f/0x300 [ 659.020501][T13973] ? copy_process+0x4ea/0x3950 [ 659.020518][T13973] ? __get_vm_area_node+0x211/0x300 [ 659.020547][T13973] __vmalloc_node_range_noprof+0x396/0x16a0 [ 659.020565][T13973] ? percpu_ref_get_many+0x19/0x140 [ 659.020603][T13973] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 659.020624][T13973] ? memcpy_and_pad+0x48/0x80 [ 659.020650][T13973] __vmalloc_node_noprof+0xc2/0x110 [ 659.020666][T13973] ? copy_process+0x4ea/0x3950 [ 659.020681][T13973] ? copy_process+0x4ea/0x3950 [ 659.020700][T13973] dup_task_struct+0x228/0x9a0 [ 659.020718][T13973] ? _raw_spin_unlock_irq+0x23/0x50 [ 659.020746][T13973] copy_process+0x4ea/0x3950 [ 659.020781][T13973] ? __pfx_copy_process+0x10/0x10 [ 659.020803][T13973] ? mutex_init_lockep+0xf9/0x130 [ 659.020825][T13973] vhost_task_create+0x1ce/0x320 [ 659.020845][T13973] ? arch_stack_walk+0xfc/0x150 [ 659.020863][T13973] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 659.020884][T13973] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 659.020906][T13973] ? __pfx_vhost_task_create+0x10/0x10 [ 659.020932][T13973] ? __pfx_vhost_task_fn+0x10/0x10 [ 659.020957][T13973] ? __lock_acquire+0x6b6/0x2cf0 [ 659.021005][T13973] ? kasan_save_track+0x4f/0x80 [ 659.021025][T13973] ? kasan_save_track+0x3e/0x80 [ 659.021049][T13973] ? kasan_save_free_info+0x46/0x50 [ 659.021076][T13973] kvm_mmu_post_init_vm+0x14c/0x300 [ 659.021102][T13973] kvm_arch_vcpu_ioctl_run+0xdc/0x1c90 [ 659.021143][T13973] ? look_up_lock_class+0x57/0x110 [ 659.021160][T13973] ? register_lock_class+0x31/0x2e0 [ 659.021176][T13973] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 659.021205][T13973] ? __lock_acquire+0x6b6/0x2cf0 [ 659.021224][T13973] ? __mutex_lock+0x335/0x1350 [ 659.021246][T13973] ? kasan_quarantine_put+0xbb/0x1f0 [ 659.021271][T13973] ? do_raw_write_lock+0x120/0x260 [ 659.021305][T13973] kvm_vcpu_ioctl+0x99a/0xed0 [ 659.021331][T13973] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 659.021350][T13973] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 659.021383][T13973] ? __fget_files+0x2a/0x420 [ 659.021406][T13973] ? __fget_files+0x2a/0x420 [ 659.021425][T13973] ? __fget_files+0x3a0/0x420 [ 659.021445][T13973] ? __fget_files+0x2a/0x420 [ 659.021467][T13973] ? bpf_lsm_file_ioctl+0x9/0x20 [ 659.021485][T13973] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 659.021507][T13973] __se_sys_ioctl+0xfc/0x170 [ 659.021524][T13973] do_syscall_64+0xec/0xf80 [ 659.021540][T13973] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 659.021555][T13973] ? trace_irq_disable+0x37/0x100 [ 659.021576][T13973] ? clear_bhb_loop+0x60/0xb0 [ 659.021595][T13973] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 659.021611][T13973] RIP: 0033:0x7f84a6b8f749 [ 659.021625][T13973] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 659.021639][T13973] RSP: 002b:00007f84a7a76038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 659.021657][T13973] RAX: ffffffffffffffda RBX: 00007f84a6de5fa0 RCX: 00007f84a6b8f749 [ 659.021669][T13973] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 659.021678][T13973] RBP: 00007f84a7a76090 R08: 0000000000000000 R09: 0000000000000000 [ 659.021689][T13973] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 659.021699][T13973] R13: 00007f84a6de6038 R14: 00007f84a6de5fa0 R15: 00007f84a6f0fa28 [ 659.021723][T13973] [ 659.472040][T13973] Mem-Info: [ 659.475201][T13973] active_anon:16778 inactive_anon:0 isolated_anon:0 [ 659.475201][T13973] active_file:15550 inactive_file:40279 isolated_file:0 [ 659.475201][T13973] unevictable:768 dirty:288 writeback:0 [ 659.475201][T13973] slab_reclaimable:10522 slab_unreclaimable:137312 [ 659.475201][T13973] mapped:35345 shmem:11333 pagetables:1401 [ 659.475201][T13973] sec_pagetables:0 bounce:0 [ 659.475201][T13973] kernel_misc_reclaimable:0 [ 659.475201][T13973] free:1249957 free_pcp:15365 free_cma:0 [ 659.568673][T13985] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2374'. [ 659.579101][T13973] Node 0 active_anon:64612kB inactive_anon:0kB active_file:62044kB inactive_file:160912kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:133096kB dirty:1152kB writeback:0kB shmem:43796kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12228kB pagetables:5584kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 659.621765][T13985] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2374'. [ 659.623607][T13980] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2376'. [ 659.695630][T13973] Node 1 active_anon:0kB inactive_anon:0kB active_file:156kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:136kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 659.774962][T13973] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 659.861725][T13973] lowmem_reserve[]: 0 2499 2501 2501 2501 [ 659.867782][T13973] Node 0 DMA32 free:1097748kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:64712kB inactive_anon:0kB active_file:62044kB inactive_file:160912kB unevictable:1536kB writepending:1152kB zspages:0kB present:3129332kB managed:2559512kB mlocked:0kB bounce:0kB free_pcp:34012kB local_pcp:16232kB free_cma:0kB [ 659.961111][T13973] lowmem_reserve[]: 0 0 1 1 1 [ 659.966019][T13973] Node 0 Normal free:0kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 660.036600][T13996] FAULT_INJECTION: forcing a failure. [ 660.036600][T13996] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 660.050368][T13996] CPU: 0 UID: 0 PID: 13996 Comm: syz.0.2380 Tainted: G L syzkaller #0 PREEMPT(full) [ 660.050403][T13996] Tainted: [L]=SOFTLOCKUP [ 660.050412][T13996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 660.050426][T13996] Call Trace: [ 660.050436][T13996] [ 660.050447][T13996] dump_stack_lvl+0xe8/0x150 [ 660.050481][T13996] should_fail_ex+0x414/0x560 [ 660.050522][T13996] _copy_to_user+0x31/0xb0 [ 660.050553][T13996] simple_read_from_buffer+0xe1/0x170 [ 660.050586][T13996] proc_fail_nth_read+0x1b3/0x220 [ 660.050614][T13996] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 660.050642][T13996] ? rw_verify_area+0x2a6/0x4d0 [ 660.050663][T13996] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 660.050689][T13996] vfs_read+0x200/0xa30 [ 660.050709][T13996] ? fdget_pos+0x247/0x320 [ 660.050742][T13996] ? __pfx___mutex_lock+0x10/0x10 [ 660.050768][T13996] ? __pfx_vfs_read+0x10/0x10 [ 660.050791][T13996] ? __fget_files+0x2a/0x420 [ 660.050824][T13996] ? __fget_files+0x3a0/0x420 [ 660.050851][T13996] ? __fget_files+0x2a/0x420 [ 660.050888][T13996] ksys_read+0x145/0x250 [ 660.050913][T13996] ? __pfx_ksys_read+0x10/0x10 [ 660.050947][T13996] do_syscall_64+0xec/0xf80 [ 660.050976][T13996] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.050998][T13996] ? clear_bhb_loop+0x60/0xb0 [ 660.051023][T13996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.051045][T13996] RIP: 0033:0x7fbd3dd8e15c [ 660.051064][T13996] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 660.051084][T13996] RSP: 002b:00007fbd3ec50030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 660.051107][T13996] RAX: ffffffffffffffda RBX: 00007fbd3dfe5fa0 RCX: 00007fbd3dd8e15c [ 660.051124][T13996] RDX: 000000000000000f RSI: 00007fbd3ec500a0 RDI: 0000000000000004 [ 660.051138][T13996] RBP: 00007fbd3ec50090 R08: 0000000000000000 R09: 0000000000000000 [ 660.051153][T13996] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 660.051167][T13996] R13: 00007fbd3dfe6038 R14: 00007fbd3dfe5fa0 R15: 00007fbd3e10fa28 [ 660.051202][T13996] [ 660.071202][T13973] lowmem_reserve[]: 0 0 0 0 0 [ 660.421142][T13973] Node 1 Normal free:3887608kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:156kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:26620kB local_pcp:20468kB free_cma:0kB [ 660.604964][T13973] lowmem_reserve[]: 0 0 0 0 0 [ 660.609774][T13973] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 660.713550][T13973] Node 0 DMA32: 1547*4kB (UME) 2409*8kB (UME) 1273*16kB (UME) 492*32kB (UME) 243*64kB (UME) 159*128kB (UME) 105*256kB (UME) 55*512kB (UME) 29*1024kB (UME) 3*2048kB (UE) 223*4096kB (UM) = 1101764kB [ 660.786824][T13973] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 660.799486][T14008] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 660.841277][T13973] Node 1 Normal: 76*4kB (UME) 43*8kB (UE) 41*16kB (UME) 199*32kB (UME) 56*64kB (UME) 10*128kB (UME) 7*256kB (UME) 3*512kB (ME) 5*1024kB (UME) 4*2048kB (UME) 942*4096kB (M) = 3887608kB [ 660.857923][T14008] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 660.886468][T13973] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 660.897654][T13973] Node 0 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 660.908504][T13973] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 660.920369][T13973] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 660.932778][T13973] 67648 total pagecache pages [ 660.938600][T13973] 0 pages in swap cache [ 660.943567][T13973] Free swap = 124996kB [ 660.947825][T13973] Total swap = 124996kB [ 660.951086][T14008] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 660.991624][T14008] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 661.011086][T13973] 2097051 pages RAM [ 661.015080][T13973] 0 pages HighMem/MovableOnly [ 661.020825][T13973] 425083 pages reserved [ 661.037325][T14008] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 661.048245][T13973] 0 pages cma reserved [ 661.110768][T14008] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 661.407810][T14019] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2388'. [ 661.444530][T14019] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2388'. [ 661.550421][T14025] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 661.599397][T14028] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 661.813388][T14039] FAULT_INJECTION: forcing a failure. [ 661.813388][T14039] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 661.881389][T14039] CPU: 0 UID: 0 PID: 14039 Comm: syz.2.2392 Tainted: G L syzkaller #0 PREEMPT(full) [ 661.881423][T14039] Tainted: [L]=SOFTLOCKUP [ 661.881431][T14039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 661.881444][T14039] Call Trace: [ 661.881452][T14039] [ 661.881461][T14039] dump_stack_lvl+0xe8/0x150 [ 661.881492][T14039] should_fail_ex+0x414/0x560 [ 661.881526][T14039] _copy_to_user+0x31/0xb0 [ 661.881552][T14039] video_usercopy+0xd93/0x13f0 [ 661.881580][T14039] ? __pfx___video_do_ioctl+0x10/0x10 [ 661.881598][T14039] ? __pfx_video_usercopy+0x10/0x10 [ 661.881628][T14039] ? __fget_files+0x2a/0x420 [ 661.881660][T14039] ? __fget_files+0x2a/0x420 [ 661.881686][T14039] ? __fget_files+0x3a0/0x420 [ 661.881717][T14039] v4l2_ioctl+0x18d/0x1e0 [ 661.881753][T14039] ? __pfx_v4l2_ioctl+0x10/0x10 [ 661.881786][T14039] __se_sys_ioctl+0xfc/0x170 [ 661.881810][T14039] do_syscall_64+0xec/0xf80 [ 661.881861][T14039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 661.881882][T14039] ? trace_irq_disable+0x37/0x100 [ 661.881930][T14039] ? clear_bhb_loop+0x60/0xb0 [ 661.881962][T14039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 661.881981][T14039] RIP: 0033:0x7f84a6b8f749 [ 661.881999][T14039] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 661.882016][T14039] RSP: 002b:00007f84a7a76038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 661.882037][T14039] RAX: ffffffffffffffda RBX: 00007f84a6de5fa0 RCX: 00007f84a6b8f749 [ 661.882052][T14039] RDX: 0000200000000400 RSI: 00000000c008561c RDI: 0000000000000003 [ 661.882065][T14039] RBP: 00007f84a7a76090 R08: 0000000000000000 R09: 0000000000000000 [ 661.882077][T14039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 661.882089][T14039] R13: 00007f84a6de6038 R14: 00007f84a6de5fa0 R15: 00007f84a6f0fa28 [ 661.882117][T14039] [ 662.149703][T14046] fuse: Unknown parameter '' [ 662.169233][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 662.169254][ T30] audit: type=1326 audit(1767075863.362:359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14032 comm="syz.4.2391" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f9f2758f749 code=0x0 [ 662.494698][T14060] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2400'. [ 662.508348][T14060] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2400'. [ 662.671981][T14065] netlink: 156 bytes leftover after parsing attributes in process `syz.2.2401'. [ 662.683436][ T9] usb 4-1: new full-speed USB device number 59 using dummy_hcd [ 662.755220][T14068] loop2: detected capacity change from 0 to 7 [ 662.785794][T14068] Dev loop2: unable to read RDB block 7 [ 662.796368][T14068] loop2: AHDI p1 p2 p3 [ 662.802967][T14068] loop2: partition table partially beyond EOD, truncated [ 662.830586][T14068] loop2: p1 start 1601398130 is beyond EOD, truncated [ 662.911236][T14068] loop2: p2 start 1702059890 is beyond EOD, truncated [ 662.923087][ T9] usb 4-1: config 5 has an invalid interface number: 15 but max is 3 [ 662.933914][ T794] IPVS: starting estimator thread 0... [ 662.992792][ T9] usb 4-1: config 5 contains an unexpected descriptor of type 0x1, skipping [ 663.010336][ T9] usb 4-1: config 5 has an invalid interface number: 149 but max is 3 [ 663.046857][ T9] usb 4-1: config 5 has an invalid interface number: 153 but max is 3 [ 663.066947][ T9] usb 4-1: config 5 has an invalid interface number: 126 but max is 3 [ 663.078543][ T9] usb 4-1: config 5 has an invalid interface number: 90 but max is 3 [ 663.116542][T14072] IPVS: using max 38 ests per chain, 91200 per kthread [ 663.834576][ T9] usb 4-1: config 5 has an invalid interface number: 125 but max is 3 [ 663.851208][ T9] usb 4-1: config 5 contains an unexpected descriptor of type 0x2, skipping [ 663.909560][ T9] usb 4-1: config 5 contains an unexpected descriptor of type 0x1, skipping [ 663.938667][ T9] usb 4-1: config 5 has 6 interfaces, different from the descriptor's value: 4 [ 663.981097][ T9] usb 4-1: config 5 has no interface number 0 [ 663.991224][ T9] usb 4-1: config 5 has no interface number 1 [ 663.997362][ T9] usb 4-1: config 5 has no interface number 2 [ 664.125949][ T9] usb 4-1: config 5 has no interface number 3 [ 664.156850][ T9] usb 4-1: config 5 has no interface number 4 [ 664.183905][ T9] usb 4-1: config 5 has no interface number 5 [ 664.207933][ T9] usb 4-1: config 5 interface 15 altsetting 2 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 664.239077][ T9] usb 4-1: config 5 interface 15 altsetting 2 has 2 endpoint descriptors, different from the interface descriptor's value: 12 [ 664.275023][ T9] usb 4-1: too many endpoints for config 5 interface 149 altsetting 39: 50, using maximum allowed: 30 [ 664.315150][T14085] syzkaller0: entered promiscuous mode [ 664.320859][T14085] syzkaller0: entered allmulticast mode [ 664.346439][ T9] usb 4-1: config 5 interface 149 altsetting 39 endpoint 0xF has invalid maxpacket 512, setting to 64 [ 664.415721][ T794] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 664.420596][ T9] usb 4-1: config 5 interface 149 altsetting 39 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 664.456946][ T9] usb 4-1: config 5 interface 149 altsetting 39 has an invalid descriptor for endpoint zero, skipping [ 664.492910][ T9] usb 4-1: config 5 interface 149 altsetting 39 has a duplicate endpoint with address 0x6, skipping [ 664.520601][ T9] usb 4-1: config 5 interface 149 altsetting 39 has a duplicate endpoint with address 0x9, skipping [ 664.551382][ T9] usb 4-1: config 5 interface 149 altsetting 39 endpoint 0x5 has invalid maxpacket 1024, setting to 64 [ 664.567581][ T9] usb 4-1: config 5 interface 149 altsetting 39 has 9 endpoint descriptors, different from the interface descriptor's value: 50 [ 664.601372][ T794] usb 2-1: Using ep0 maxpacket: 32 [ 664.613841][ T794] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 664.625580][ T794] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 664.651804][ T9] usb 4-1: too many endpoints for config 5 interface 153 altsetting 6: 80, using maximum allowed: 30 [ 664.677441][ T9] usb 4-1: config 5 interface 153 altsetting 6 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 664.686664][ T794] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 664.699449][ T9] usb 4-1: config 5 interface 153 altsetting 6 endpoint 0x83 has invalid maxpacket 1024, setting to 64 [ 664.720780][ T9] usb 4-1: config 5 interface 153 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 80 [ 664.722388][ T794] usb 2-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 664.735933][ T9] usb 4-1: config 5 interface 126 altsetting 255 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 664.770936][ T794] usb 2-1: Product: syz [ 664.785016][ T9] usb 4-1: config 5 interface 126 altsetting 255 has a duplicate endpoint with address 0xF, skipping [ 664.808763][ T9] usb 4-1: config 5 interface 126 altsetting 255 has an invalid descriptor for endpoint zero, skipping [ 664.826462][T14092] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 664.873142][ T9] usb 4-1: config 5 interface 126 altsetting 255 has a duplicate endpoint with address 0x1, skipping [ 664.903012][ T9] usb 4-1: config 5 interface 126 altsetting 255 has a duplicate endpoint with address 0x1, skipping [ 664.914192][ T794] usb 2-1: Manufacturer: syz [ 664.937212][ T9] usb 4-1: config 5 interface 90 altsetting 13 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 665.058245][ T794] hub 2-1:4.0: USB hub found [ 665.058858][ T9] usb 4-1: config 5 interface 90 altsetting 13 endpoint 0xA has invalid maxpacket 1023, setting to 64 [ 665.076275][T14095] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2412'. [ 665.138274][ T9] usb 4-1: config 5 interface 90 altsetting 13 has an invalid descriptor for endpoint zero, skipping [ 665.183594][ T794] hub 2-1:4.0: config failed, can't read hub descriptor (err -22) [ 665.197202][T14095] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2412'. [ 665.243567][ T9] usb 4-1: config 5 interface 90 altsetting 13 has a duplicate endpoint with address 0xF, skipping [ 665.254540][ T794] usb 2-1: USB disconnect, device number 68 [ 665.293724][ T9] usb 4-1: config 5 interface 90 altsetting 13 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 665.331470][ T9] usb 4-1: config 5 interface 125 altsetting 6 has a duplicate endpoint with address 0x9, skipping [ 665.374355][ T9] usb 4-1: config 5 interface 125 altsetting 6 has a duplicate endpoint with address 0xD, skipping [ 665.492157][ T9] usb 4-1: config 5 interface 125 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 665.523625][ T9] usb 4-1: config 5 interface 125 altsetting 6 has a duplicate endpoint with address 0x3, skipping [ 665.541097][ T9] usb 4-1: config 5 interface 125 altsetting 6 has a duplicate endpoint with address 0x5, skipping [ 665.662940][ T9] usb 4-1: config 5 interface 125 altsetting 6 has a duplicate endpoint with address 0xE, skipping [ 665.680628][ T9] usb 4-1: config 5 interface 15 has no altsetting 0 [ 665.691269][ T9] usb 4-1: config 5 interface 149 has no altsetting 0 [ 665.712916][ T9] usb 4-1: config 5 interface 153 has no altsetting 0 [ 665.720330][ T9] usb 4-1: config 5 interface 126 has no altsetting 0 [ 665.744085][ T9] usb 4-1: config 5 interface 90 has no altsetting 0 [ 665.755835][ T9] usb 4-1: config 5 interface 125 has no altsetting 0 [ 665.764485][ T9] usb 4-1: string descriptor 0 read error: -71 [ 665.771416][ T9] usb 4-1: New USB device found, idVendor=1e0e, idProduct=9001, bcdDevice=51.fc [ 665.780651][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 665.804838][ T9] usb 4-1: can't set config #5, error -71 [ 665.838705][ T9] usb 4-1: USB disconnect, device number 59 [ 666.161965][ T9] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 666.456682][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 666.505366][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 666.526722][ T9] usb 4-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 666.553988][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 666.569328][ T9] usb 4-1: config 0 descriptor?? [ 667.274845][ T9] hid-led 0003:27B8:01ED.000E: hidraw0: USB HID v0.00 Device [HID 27b8:01ed] on usb-dummy_hcd.3-1/input0 [ 667.549019][T14128] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2422'. [ 667.563471][ T9] hid-led 0003:27B8:01ED.000E: ThingM blink(1) initialized [ 667.643677][ T9] usb 4-1: USB disconnect, device number 60 [ 668.110442][ T30] audit: type=1326 audit(1767075869.422:360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14140 comm="syz.0.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 668.142294][ T30] audit: type=1326 audit(1767075869.452:361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14140 comm="syz.0.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 668.201784][ T30] audit: type=1326 audit(1767075869.452:362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14140 comm="syz.0.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 668.412078][ T30] audit: type=1326 audit(1767075869.452:363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14140 comm="syz.0.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 668.462188][ T30] audit: type=1326 audit(1767075869.452:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14140 comm="syz.0.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 668.523230][ T30] audit: type=1326 audit(1767075869.452:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14140 comm="syz.0.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 668.709458][T14153] xt_hashlimit: size too large, truncated to 1048576 [ 668.841557][ T30] audit: type=1326 audit(1767075869.452:366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14140 comm="syz.0.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 668.930815][ T30] audit: type=1326 audit(1767075869.452:367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14140 comm="syz.0.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 669.025872][T14162] binder: BINDER_SET_CONTEXT_MGR already set [ 669.033846][T14162] binder: 14158:14162 ioctl 4018620d 200000004a80 returned -16 [ 669.050815][ T30] audit: type=1326 audit(1767075869.452:368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14140 comm="syz.0.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 669.078470][ T30] audit: type=1326 audit(1767075869.452:369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14140 comm="syz.0.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7fbd3dd915dc code=0x7ffc0000 [ 669.148349][T14164] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvtap0, syncid = 5, id = 0 [ 669.520093][T14171] netlink: 312 bytes leftover after parsing attributes in process `syz.0.2435'. [ 670.348138][ T7746] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 670.533137][ T7746] usb 5-1: config 0 has an invalid interface number: 239 but max is 0 [ 670.546777][ T7746] usb 5-1: config 0 has no interface number 0 [ 670.662256][ T7746] usb 5-1: config 0 interface 239 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 670.685715][T14189] syzkaller0: entered promiscuous mode [ 670.691894][T14189] syzkaller0: entered allmulticast mode [ 670.699683][ T7746] usb 5-1: config 0 interface 239 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 670.732038][ T7746] usb 5-1: config 0 interface 239 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 670.744978][ T7746] usb 5-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=60.d9 [ 670.754817][ T7746] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 670.763287][ T7746] usb 5-1: Product: syz [ 670.767571][ T7746] usb 5-1: Manufacturer: syz [ 670.772637][ T7746] usb 5-1: SerialNumber: syz [ 670.783381][ T7746] usb 5-1: config 0 descriptor?? [ 670.789888][T14183] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 671.016833][T14183] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 671.029384][T14183] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 671.152436][ T7746] usb 5-1: probing VID:PID(2201:012C) [ 671.201380][T14208] netlink: 80 bytes leftover after parsing attributes in process `syz.1.2446'. [ 671.221342][ T794] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 671.252436][ T7746] usb 5-1: vub300 testing BULK OUT EndPoint(0) 02 [ 671.258951][ T7746] usb 5-1: vub300 testing BULK IN EndPoint(1) 82 [ 671.285983][ T7746] usb 5-1: Could not find two sets of bulk-in/out endpoint pairs [ 671.316645][ T7746] vub300 5-1:0.239: probe with driver vub300 failed with error -22 [ 671.347212][ T7746] usb 5-1: USB disconnect, device number 83 [ 671.373307][ T794] usb 3-1: config 252 has an invalid interface number: 254 but max is 0 [ 671.391681][ T794] usb 3-1: config 252 has an invalid descriptor of length 64, skipping remainder of the config [ 671.421474][ T794] usb 3-1: config 252 has no interface number 0 [ 671.458852][ T794] usb 3-1: config 252 interface 254 has no altsetting 0 [ 671.477942][ T794] usb 3-1: New USB device found, idVendor=057c, idProduct=2200, bcdDevice=46.29 [ 671.506351][ T794] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.561719][ T794] usb 3-1: Product: syz [ 671.571078][ T794] usb 3-1: Manufacturer: syz [ 671.586243][ T794] usb 3-1: SerialNumber: syz [ 671.650291][ T794] bfusb 3-1:252.254: probe with driver bfusb failed with error -5 [ 671.961609][ T794] usb 3-1: USB disconnect, device number 83 [ 672.088556][T14218] netlink: 156 bytes leftover after parsing attributes in process `syz.4.2449'. [ 672.868465][T14231] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2454'. [ 673.171998][T14233] SET target dimension over the limit! [ 673.323002][T14240] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2458'. [ 673.567062][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 673.567081][ T30] audit: type=1326 audit(1767075874.882:381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14246 comm="syz.3.2460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 673.662893][ T30] audit: type=1326 audit(1767075874.882:382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14246 comm="syz.3.2460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 673.726818][ T30] audit: type=1326 audit(1767075874.882:383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14246 comm="syz.3.2460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 673.779423][ T30] audit: type=1326 audit(1767075874.882:384): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14246 comm="syz.3.2460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 673.839727][ T30] audit: type=1326 audit(1767075874.892:385): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14246 comm="syz.3.2460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 673.888957][ T30] audit: type=1326 audit(1767075874.892:386): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14246 comm="syz.3.2460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 673.952911][ T30] audit: type=1326 audit(1767075874.892:387): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14246 comm="syz.3.2460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=325 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 673.993295][T14250] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2461'. [ 674.027075][T14250] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2461'. [ 674.031859][ T30] audit: type=1326 audit(1767075874.932:388): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14246 comm="syz.3.2460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 674.111093][ T30] audit: type=1326 audit(1767075874.932:389): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14246 comm="syz.3.2460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 674.163305][ T30] audit: type=1326 audit(1767075874.942:390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14246 comm="syz.3.2460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 674.351076][ T9] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 674.526165][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 674.535164][ T9] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 674.545087][ T9] usb 4-1: config 0 has no interface number 0 [ 674.554003][ T9] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 674.566145][ T9] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 674.579411][ T9] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 674.589629][ T9] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 674.598201][ T9] usb 4-1: Product: syz [ 674.604087][ T9] usb 4-1: SerialNumber: syz [ 674.622783][ T9] usb 4-1: config 0 descriptor?? [ 674.636655][ T9] cm109 4-1:0.8: invalid payload size 0, expected 4 [ 674.656925][ T9] input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.8/input/input44 [ 674.870598][T14255] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 674.900142][T14255] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 674.992758][T14273] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 675.002200][T14273] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 675.670483][T14275] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 675.722188][T14275] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 676.081745][T14283] SET target dimension over the limit! [ 676.124634][T14287] netlink: 'syz.0.2471': attribute type 10 has an invalid length. [ 676.453909][T14212] syz.1.2448 (14212): drop_caches: 1 [ 676.730614][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 676.734597][ T7746] usb 4-1: USB disconnect, device number 61 [ 676.738145][ C0] cm109 4-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 676.839961][ T7746] cm109 4-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 677.703133][T14320] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 679.402091][T14336] xt_CT: You must specify a L4 protocol and not use inversions on it [ 679.749964][T14345] netlink: 80 bytes leftover after parsing attributes in process `syz.2.2485'. [ 680.157824][T14351] fuse: Bad value for 'group_id' [ 680.173787][T14351] fuse: Bad value for 'group_id' [ 680.348452][T14353] Invalid logical block size (83886080) [ 680.397126][T14357] Set syz0 is full, maxelem 0 reached [ 680.924086][T14367] netlink: 'syz.1.2496': attribute type 4 has an invalid length. [ 680.942846][T14369] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2497'. [ 680.951282][ T9] usb 5-1: new full-speed USB device number 84 using dummy_hcd [ 681.010310][T14369] bridge0: port 2(bridge_slave_1) entered disabled state [ 681.018521][T14369] bridge0: port 1(bridge_slave_0) entered disabled state [ 681.067889][T14370] tipc: Enabled bearer , priority 0 [ 681.075320][T14365] syzkaller0: entered promiscuous mode [ 681.099364][T14365] syzkaller0: entered allmulticast mode [ 681.133636][T14365] tipc: Resetting bearer [ 681.146829][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 681.155418][T14364] tipc: Resetting bearer [ 681.164248][ T9] usb 5-1: not running at top speed; connect to a high speed hub [ 681.183678][ T9] usb 5-1: config 188 has an invalid interface number: 3 but max is 1 [ 681.199529][ T9] usb 5-1: config 188 has an invalid interface number: 9 but max is 1 [ 681.233475][ T9] usb 5-1: config 188 has no interface number 0 [ 681.245635][T14364] tipc: Disabling bearer [ 681.270570][ T9] usb 5-1: config 188 has no interface number 1 [ 681.279721][ T9] usb 5-1: config 188 interface 3 has no altsetting 0 [ 681.288986][ T9] usb 5-1: config 188 interface 9 has no altsetting 0 [ 681.307648][ T9] usb 5-1: New USB device found, idVendor=1410, idProduct=a002, bcdDevice=86.a0 [ 681.317026][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 681.326339][ T9] usb 5-1: Product: syz [ 681.330660][ T9] usb 5-1: Manufacturer: syz [ 681.356932][ T9] usb 5-1: SerialNumber: syz [ 681.751456][ T106] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 681.873137][T14386] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2501'. [ 682.043909][ T106] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 682.065909][ T106] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 682.079629][ T106] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 682.088966][ T106] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 682.111472][ T5972] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 682.128775][ T106] usb 2-1: config 0 descriptor?? [ 682.147342][ T106] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 682.301059][ T5972] usb 4-1: Using ep0 maxpacket: 32 [ 682.310048][ T5972] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 682.318917][ T5972] usb 4-1: config 0 has no interface number 0 [ 682.328761][ T5972] usb 4-1: config 0 interface 51 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 682.353387][ T5972] usb 4-1: config 0 interface 51 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 682.396754][ T5972] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 682.406088][ T5972] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 682.447159][ T5972] usb 4-1: Product: syz [ 682.456792][ T5972] usb 4-1: Manufacturer: syz [ 682.468566][ T5972] usb 4-1: SerialNumber: syz [ 682.809810][ T5972] usb 4-1: config 0 descriptor?? [ 682.839447][ T5972] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 683.126597][ T5972] usb 4-1: qt2_setup_urbs - submit read urb failed -90 [ 683.134326][ T5972] quatech2 4-1:0.51: probe with driver quatech2 failed with error -90 [ 683.236967][T14403] binder: 14371:14403 ioctl c0306201 2000000003c0 returned -14 [ 683.985116][ T9] usb 5-1: unknown number of interfaces: 2 [ 684.012325][ T9] usb 5-1: USB disconnect, device number 84 [ 684.631177][ T7746] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 684.781100][ T7746] usb 5-1: Using ep0 maxpacket: 16 [ 684.788387][ T7746] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 684.817219][ T9] usb 2-1: USB disconnect, device number 69 [ 684.823367][ T7746] usb 5-1: config 0 has no interface number 0 [ 684.884195][ T7746] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 684.927231][ T7746] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 684.946573][ T5876] usb 4-1: USB disconnect, device number 62 [ 684.971745][ T7746] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 684.971797][T14412] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2509'. [ 685.000888][ T7746] usb 5-1: Product: syz [ 685.058408][ T7746] usb 5-1: SerialNumber: syz [ 685.071431][ T7746] usb 5-1: config 0 descriptor?? [ 685.102248][ T7746] usbhid 5-1:0.8: couldn't find an input interrupt endpoint [ 685.351182][ T9] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 685.623684][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 685.731213][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 685.740656][ T9] usb 2-1: config 120 has an invalid interface number: 243 but max is 0 [ 685.750643][ T9] usb 2-1: config 120 has no interface number 0 [ 685.757373][T14435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 685.831838][T14435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 686.011836][ T9] usb 2-1: config 120 interface 243 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1023 [ 686.045144][ T9] usb 2-1: New USB device found, idVendor=2304, idProduct=0243, bcdDevice=66.1c [ 686.075811][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 686.106690][ T9] usb 2-1: Product: syz [ 686.151138][ T9] usb 2-1: Manufacturer: syz [ 686.156662][ T9] usb 2-1: SerialNumber: syz [ 686.165524][T14415] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 686.398238][ T9] dvb-usb: found a 'Pinnacle PCTV 73A' in cold state, will try to load a firmware [ 686.614725][ T9] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 686.673494][ T9] dib0700: firmware download failed at 7 with -71 [ 686.741390][ T9] usb 2-1: USB disconnect, device number 70 [ 687.244869][T14447] misc userio: No port type given on /dev/userio [ 687.253230][T14447] misc userio: The device must be registered before sending interrupts [ 687.525941][T14454] sctp: [Deprecated]: syz.3.2522 (pid 14454) Use of int in max_burst socket option deprecated. [ 687.525941][T14454] Use struct sctp_assoc_value instead [ 687.840395][ T9] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 688.052757][ T9] usb 2-1: device descriptor read/64, error -71 [ 688.211193][ T5972] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 688.371327][ T9] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 688.391241][ T5972] usb 4-1: Using ep0 maxpacket: 8 [ 688.432426][ T5972] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 688.451216][ T5972] usb 4-1: New USB device found, idVendor=2833, idProduct=0201, bcdDevice=2a.d5 [ 688.460328][ T5972] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 688.492156][ T5972] usb 4-1: config 0 descriptor?? [ 688.501087][ T9] usb 2-1: device descriptor read/64, error -71 [ 688.553714][ T5972] uvcvideo 4-1:0.0: probe with driver uvcvideo failed with error -22 [ 688.621420][ T9] usb usb2-port1: attempt power cycle [ 688.961117][ T9] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 688.995364][ T9] usb 2-1: device descriptor read/8, error -71 [ 689.024637][T14468] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 689.095257][T14468] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 689.108127][T14468] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2524'. [ 689.625088][ T9] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 689.674644][ T9] usb 2-1: device descriptor read/8, error -71 [ 689.956021][ T9] usb usb2-port1: unable to enumerate USB device [ 690.610077][T14484] netlink: 'syz.2.2530': attribute type 3 has an invalid length. [ 690.678667][T14484] program syz.2.2530 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 690.714443][T14484] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2530'. [ 691.203662][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 691.210457][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 691.361163][ T9] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 691.535349][ T9] usb 3-1: config 160 has an invalid interface number: 200 but max is 0 [ 691.553338][ T9] usb 3-1: config 160 has no interface number 0 [ 691.588975][ T9] usb 3-1: config 160 interface 200 has no altsetting 0 [ 691.625048][ T5972] usb 4-1: USB disconnect, device number 63 [ 691.651778][ T9] usb 3-1: New USB device found, idVendor=21bb, idProduct=2070, bcdDevice=87.0b [ 691.672465][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 691.691509][ T9] usb 3-1: Product: syz [ 691.702320][ T9] usb 3-1: Manufacturer: syz [ 691.713574][ T9] usb 3-1: SerialNumber: syz [ 692.054227][T14490] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2532'. [ 692.080582][T14490] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2532'. [ 692.131122][T14490] netlink: 'syz.2.2532': attribute type 5 has an invalid length. [ 692.163480][T14502] dvmrp1: tun_chr_ioctl cmd 35108 [ 692.178018][T14490] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2532'. [ 692.288286][ T9] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 692.308986][ T9] usb 3-1: MIDIStreaming interface descriptor not found [ 692.419838][ T9] usb 3-1: USB disconnect, device number 84 [ 692.621128][ T9729] udevd[9729]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:160.200/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 693.271771][ T5972] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 693.429326][T14525] vim2m vim2m.0: vidioc_s_fmt queue busy [ 693.435766][ T5972] usb 3-1: device descriptor read/64, error -71 [ 693.528193][T14529] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 693.734938][T14529] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 693.747857][T14535] netlink: 'syz.3.2546': attribute type 4 has an invalid length. [ 693.771100][ T5972] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 693.931075][ T5972] usb 3-1: device descriptor read/64, error -71 [ 694.054432][ T5972] usb usb3-port1: attempt power cycle [ 694.304367][T14541] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2547'. [ 694.340876][T14541] netlink: 'syz.1.2547': attribute type 11 has an invalid length. [ 694.365054][T14541] program syz.1.2547 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 694.401138][ T5972] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 694.422468][ T5972] usb 3-1: device descriptor read/8, error -71 [ 694.661110][ T5972] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 694.931865][ T5972] usb 3-1: device descriptor read/8, error -71 [ 695.067686][ T5972] usb usb3-port1: unable to enumerate USB device [ 695.711564][ T5972] usb 5-1: USB disconnect, device number 85 [ 696.882922][ T7746] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 696.908955][T14555] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 696.947354][T14555] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 697.101863][ T7746] usb 3-1: Using ep0 maxpacket: 16 [ 697.222514][ T7746] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 697.258528][ T7746] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 697.291101][ T7746] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 697.313803][ T7746] usb 3-1: config 0 descriptor?? [ 697.699836][T14561] xt_TCPMSS: Only works on TCP SYN packets [ 697.749071][ T7746] mcp2221 0003:04D8:00DD.000F: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 698.149772][ T7746] usb 3-1: USB disconnect, device number 89 [ 698.230837][T14568] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2550'. [ 698.612127][T14572] SET target dimension over the limit! [ 698.708369][T14581] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2559'. [ 699.583812][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 699.583836][ T30] audit: type=1326 audit(1767075900.882:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14585 comm="syz.2.2560" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f84a6b8f749 code=0x0 [ 699.921105][ T5972] usb 5-1: new low-speed USB device number 86 using dummy_hcd [ 700.037483][T14600] team0: Device ip6tnl2 is of different type [ 700.051182][ T5972] usb 5-1: device descriptor read/64, error -71 [ 700.311116][ T5972] usb 5-1: new low-speed USB device number 87 using dummy_hcd [ 700.339343][T14614] fuse: Unknown parameter ''' [ 700.369457][T14617] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2572'. [ 700.501271][ T5972] usb 5-1: device descriptor read/64, error -71 [ 700.570761][T14633] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 700.579947][T14633] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 700.601768][T14633] fuse: Unknown parameter 'rootmod' [ 700.621223][ T7746] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 700.622706][ T5972] usb usb5-port1: attempt power cycle [ 700.809787][ T7746] usb 4-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 700.820423][ T7746] usb 4-1: config 16 has no interfaces? [ 700.826228][ T7746] usb 4-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 700.851875][ T7746] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 700.974796][T14633] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2573'. [ 700.986371][T14633] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2573'. [ 700.995927][ T5972] usb 5-1: new low-speed USB device number 88 using dummy_hcd [ 701.090519][ T5972] usb 5-1: device descriptor read/8, error -71 [ 701.171134][ T9] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 701.444209][ T5972] usb 5-1: new low-speed USB device number 89 using dummy_hcd [ 701.496066][ T5972] usb 5-1: device descriptor read/8, error -71 [ 701.541051][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 701.577621][ T9] usb 3-1: too many configurations: 14, using maximum allowed: 8 [ 701.614870][ T5972] usb usb5-port1: unable to enumerate USB device [ 701.779661][ T9] usb 3-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice= 6.ad [ 701.789688][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 701.817654][ T9] usb 3-1: Product: syz [ 701.822127][ T9] usb 3-1: Manufacturer: syz [ 701.829688][ T9] usb 3-1: SerialNumber: syz [ 701.852035][ T9] usb 3-1: config 0 descriptor?? [ 702.530895][ T30] audit: type=1326 audit(1767075903.842:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14644 comm="syz.1.2578" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe7c658f749 code=0x0 [ 703.134048][T14654] openvswitch: netlink: Flow key attr not present in new flow. [ 703.692954][T14659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 703.708561][T14659] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 703.772567][T14659] netlink: 'syz.0.2583': attribute type 1 has an invalid length. [ 703.882099][T14659] erspan1: entered allmulticast mode [ 703.926422][T14662] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2583'. [ 704.130352][ T9] usb 4-1: USB disconnect, device number 64 [ 704.288162][ T5972] usb 3-1: USB disconnect, device number 90 [ 705.369907][ T30] audit: type=1326 audit(1767075906.682:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14683 comm="syz.4.2591" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f9f2758f749 code=0x0 [ 705.582444][T14691] loop9: detected capacity change from 0 to 7 [ 705.611240][T14691] Dev loop9: unable to read RDB block 7 [ 705.616989][T14691] loop9: AHDI p3 p4 [ 705.621998][T14691] loop9: partition table partially beyond EOD, truncated [ 705.756029][T14691] loop9: p3 size 4227858431 extends beyond EOD, truncated [ 705.953760][ T6063] udevd[6063]: inotify_add_watch(7, /dev/loop9p3, 10) failed: No such file or directory [ 706.418396][T14696] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 706.741179][ T7746] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 706.927954][ T7746] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 64, changing to 10 [ 706.949386][ T7746] usb 4-1: New USB device found, idVendor=0c70, idProduct=f011, bcdDevice= 0.00 [ 707.111239][ T7746] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 707.151885][ T7746] usb 4-1: config 0 descriptor?? [ 707.161095][ T5972] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 708.249942][ T5972] usb 3-1: Using ep0 maxpacket: 8 [ 708.271906][ T5972] usb 3-1: unable to get BOS descriptor or descriptor too short [ 708.281279][ T5972] usb 3-1: config 64 has an invalid interface number: 103 but max is 0 [ 708.289617][ T5972] usb 3-1: config 64 has no interface number 0 [ 708.316007][ T7746] aquacomputer_d5next 0003:0C70:F011.0010: hidraw0: USB HID v0.00 Device [HID 0c70:f011] on usb-dummy_hcd.3-1/input0 [ 708.349754][ T5972] usb 3-1: config 64 interface 103 has no altsetting 0 [ 708.443970][ T5972] usb 3-1: New USB device found, idVendor=17cc, idProduct=1000, bcdDevice=8d.88 [ 708.517401][ T5972] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 708.533800][T14716] netlink: 7064 bytes leftover after parsing attributes in process `syz.0.2599'. [ 708.680297][T14716] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 709.461255][ T5972] snd-usb-audio 3-1:64.103: probe with driver snd-usb-audio failed with error -71 [ 709.713958][ T5972] usb 3-1: USB disconnect, device number 91 [ 709.914928][ T106] usb 4-1: USB disconnect, device number 65 [ 710.321522][ T30] audit: type=1326 audit(1767075911.632:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14726 comm="syz.1.2603" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe7c658f749 code=0x0 [ 710.875723][T14746] FAULT_INJECTION: forcing a failure. [ 710.875723][T14746] name failslab, interval 1, probability 0, space 0, times 0 [ 710.889402][T14746] CPU: 1 UID: 0 PID: 14746 Comm: syz.4.2607 Tainted: G L syzkaller #0 PREEMPT(full) [ 710.889438][T14746] Tainted: [L]=SOFTLOCKUP [ 710.889447][T14746] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 710.889462][T14746] Call Trace: [ 710.889472][T14746] [ 710.889483][T14746] dump_stack_lvl+0xe8/0x150 [ 710.889519][T14746] should_fail_ex+0x414/0x560 [ 710.889568][T14746] should_failslab+0xa8/0x100 [ 710.889599][T14746] kmem_cache_alloc_noprof+0x88/0x710 [ 710.889636][T14746] ? skb_clone+0x212/0x3a0 [ 710.889663][T14746] ? call_rcu+0xee/0x890 [ 710.889696][T14746] skb_clone+0x212/0x3a0 [ 710.889722][T14746] ? dev_queue_xmit_nit+0x27d/0xad0 [ 710.889751][T14746] dev_queue_xmit_nit+0x29a/0xad0 [ 710.889778][T14746] ? dev_queue_xmit_nit+0x2d/0xad0 [ 710.889815][T14746] dev_hard_start_xmit+0x1c1/0x800 [ 710.889864][T14746] sch_direct_xmit+0x241/0x4b0 [ 710.889895][T14746] ? __pfx_sch_direct_xmit+0x10/0x10 [ 710.889931][T14746] __dev_queue_xmit+0x136f/0x3140 [ 710.889971][T14746] ? __dev_queue_xmit+0x289/0x3140 [ 710.890011][T14746] ? __lock_acquire+0x6b6/0x2cf0 [ 710.890038][T14746] ? __pfx___dev_queue_xmit+0x10/0x10 [ 710.890076][T14746] ? nf_hook+0x9d/0x380 [ 710.890130][T14746] ? ip_finish_output2+0x951/0x1000 [ 710.890164][T14746] ip_finish_output2+0xb52/0x1000 [ 710.890195][T14746] ? ip_finish_output2+0x3d0/0x1000 [ 710.890228][T14746] ip_push_pending_frames+0xbe/0x150 [ 710.890258][T14746] raw_sendmsg+0x1440/0x18b0 [ 710.890301][T14746] ? __pfx_raw_sendmsg+0x10/0x10 [ 710.890348][T14746] ? aa_sk_perm+0x7ee/0x920 [ 710.890382][T14746] ? __pfx_aa_sk_perm+0x10/0x10 [ 710.890407][T14746] ? tomoyo_socket_sendmsg_permission+0x216/0x300 [ 710.890442][T14746] ? sock_rps_record_flow+0x19/0x410 [ 710.890476][T14746] ? inet_sendmsg+0x2f4/0x370 [ 710.890503][T14746] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 710.890530][T14746] __sock_sendmsg+0x19c/0x270 [ 710.890567][T14746] __sys_sendto+0x3bd/0x520 [ 710.890594][T14746] ? __pfx___sys_sendto+0x10/0x10 [ 710.890616][T14746] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 710.890657][T14746] ? __fget_files+0x3a0/0x420 [ 710.890699][T14746] ? ksys_write+0x22a/0x250 [ 710.890724][T14746] ? __pfx_ksys_write+0x10/0x10 [ 710.890752][T14746] __x64_sys_sendto+0xde/0x100 [ 710.890781][T14746] do_syscall_64+0xec/0xf80 [ 710.890804][T14746] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 710.890826][T14746] ? trace_irq_disable+0x37/0x100 [ 710.890856][T14746] ? clear_bhb_loop+0x60/0xb0 [ 710.890883][T14746] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 710.890906][T14746] RIP: 0033:0x7f9f2758f749 [ 710.890928][T14746] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 710.890952][T14746] RSP: 002b:00007f9f257ee038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 710.890975][T14746] RAX: ffffffffffffffda RBX: 00007f9f277e5fa0 RCX: 00007f9f2758f749 [ 710.890992][T14746] RDX: 0000000000000014 RSI: 00002000000023c0 RDI: 0000000000000004 [ 710.891006][T14746] RBP: 00007f9f257ee090 R08: 0000200000002400 R09: 0000000000000010 [ 710.891020][T14746] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 710.891033][T14746] R13: 00007f9f277e6038 R14: 00007f9f277e5fa0 R15: 00007f9f2790fa28 [ 710.891070][T14746] [ 712.103789][ T7746] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 712.251163][ T7746] usb 2-1: device descriptor read/64, error -71 [ 712.373202][T14763] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2611'. [ 712.457003][T14766] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 712.472015][T14766] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 712.491142][ T7746] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 712.620433][ T30] audit: type=1326 audit(1767075913.932:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14774 comm="syz.2.2618" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f84a6b8f749 code=0x0 [ 712.642925][ T7746] usb 2-1: device descriptor read/64, error -71 [ 712.752053][ T7746] usb usb2-port1: attempt power cycle [ 713.101114][ T7746] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 713.131767][ T7746] usb 2-1: device descriptor read/8, error -71 [ 713.381098][ T7746] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 713.424989][ T7746] usb 2-1: device descriptor read/8, error -71 [ 713.621599][ T7746] usb usb2-port1: unable to enumerate USB device [ 713.972159][T14808] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 713.981600][T14808] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 713.997149][T14808] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 714.052089][T14808] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 714.201097][ T7746] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 714.369290][T14817] xt_l2tp: missing protocol rule (udp|l2tpip) [ 714.659729][T14820] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2626'. [ 714.676168][T14820] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2626'. [ 715.983809][ T5876] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 715.993832][T14839] netlink: 'syz.4.2631': attribute type 4 has an invalid length. [ 716.098032][T14844] random: crng reseeded on system resumption [ 716.171127][ T5876] usb 2-1: Using ep0 maxpacket: 8 [ 716.178249][ T30] audit: type=1326 audit(1767075917.462:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14841 comm="syz.0.2632" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fbd3dd8f749 code=0x0 [ 716.244690][ T5876] usb 2-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 716.260225][ T5876] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 716.328708][ T5876] usb 2-1: Product: syz [ 716.370401][ T5876] usb 2-1: Manufacturer: syz [ 716.380552][ T5876] usb 2-1: SerialNumber: syz [ 716.402380][ T5876] usb 2-1: config 0 descriptor?? [ 716.447651][ T5876] gspca_main: se401-2.14.0 probing 047d:5003 [ 716.825256][T14833] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 716.853272][T14833] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 716.938495][T14858] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 716.975930][T14858] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 717.372915][T14864] FAULT_INJECTION: forcing a failure. [ 717.372915][T14864] name failslab, interval 1, probability 0, space 0, times 0 [ 717.434311][T14864] CPU: 1 UID: 0 PID: 14864 Comm: syz.0.2637 Tainted: G L syzkaller #0 PREEMPT(full) [ 717.434350][T14864] Tainted: [L]=SOFTLOCKUP [ 717.434358][T14864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 717.434372][T14864] Call Trace: [ 717.434383][T14864] [ 717.434397][T14864] dump_stack_lvl+0xe8/0x150 [ 717.434430][T14864] should_fail_ex+0x414/0x560 [ 717.434469][T14864] should_failslab+0xa8/0x100 [ 717.434497][T14864] __kmalloc_noprof+0xdf/0x800 [ 717.434518][T14864] ? ethnl_default_notify+0x189/0xb20 [ 717.434555][T14864] ethnl_default_notify+0x189/0xb20 [ 717.434596][T14864] ? __pfx_ethnl_default_notify+0x10/0x10 [ 717.434639][T14864] ? __pfx_ethnl_set_debug+0x10/0x10 [ 717.434661][T14864] ? rcu_is_watching+0x15/0xb0 [ 717.434701][T14864] ? mutex_is_locked+0x17/0x50 [ 717.434727][T14864] ? rtnl_is_locked+0x15/0x20 [ 717.434759][T14864] ethnl_default_set_doit+0x4ea/0x8f0 [ 717.434800][T14864] genl_family_rcv_msg_doit+0x215/0x300 [ 717.434831][T14864] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 717.434867][T14864] ? bpf_lsm_capable+0x9/0x20 [ 717.434895][T14864] ? security_capable+0x7e/0x2e0 [ 717.434929][T14864] genl_rcv_msg+0x60e/0x790 [ 717.434957][T14864] ? __pfx_genl_rcv_msg+0x10/0x10 [ 717.434978][T14864] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 717.435027][T14864] netlink_rcv_skb+0x208/0x470 [ 717.435057][T14864] ? __pfx_genl_rcv_msg+0x10/0x10 [ 717.435080][T14864] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 717.435106][T14864] ? genl_rcv+0x19/0x40 [ 717.435156][T14864] ? down_read+0x274/0x2e0 [ 717.435181][T14864] ? genl_rcv+0xd/0x40 [ 717.435216][T14864] genl_rcv+0x28/0x40 [ 717.435249][T14864] netlink_unicast+0x82f/0x9e0 [ 717.435285][T14864] ? __pfx_netlink_unicast+0x10/0x10 [ 717.435309][T14864] ? __alloc_skb+0x198/0x3a0 [ 717.435333][T14864] ? netlink_sendmsg+0x642/0xb30 [ 717.435360][T14864] ? skb_put+0x11b/0x210 [ 717.435388][T14864] netlink_sendmsg+0x805/0xb30 [ 717.435429][T14864] ? __pfx_netlink_sendmsg+0x10/0x10 [ 717.435461][T14864] ? aa_sock_msg_perm+0xf1/0x1b0 [ 717.435492][T14864] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 717.435513][T14864] ? __pfx_netlink_sendmsg+0x10/0x10 [ 717.435542][T14864] __sock_sendmsg+0x21c/0x270 [ 717.435578][T14864] ____sys_sendmsg+0x505/0x820 [ 717.435611][T14864] ? __pfx_____sys_sendmsg+0x10/0x10 [ 717.435648][T14864] ? import_iovec+0x74/0xa0 [ 717.435688][T14864] ___sys_sendmsg+0x21f/0x2a0 [ 717.435717][T14864] ? __pfx____sys_sendmsg+0x10/0x10 [ 717.435785][T14864] ? __fget_files+0x2a/0x420 [ 717.435814][T14864] ? __fget_files+0x3a0/0x420 [ 717.435853][T14864] __x64_sys_sendmsg+0x19b/0x260 [ 717.435884][T14864] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 717.435938][T14864] do_syscall_64+0xec/0xf80 [ 717.435962][T14864] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 717.435983][T14864] ? trace_irq_disable+0x37/0x100 [ 717.436013][T14864] ? clear_bhb_loop+0x60/0xb0 [ 717.436037][T14864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 717.436057][T14864] RIP: 0033:0x7fbd3dd8f749 [ 717.436077][T14864] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 717.436097][T14864] RSP: 002b:00007fbd3ec50038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 717.436122][T14864] RAX: ffffffffffffffda RBX: 00007fbd3dfe5fa0 RCX: 00007fbd3dd8f749 [ 717.436139][T14864] RDX: 0000000000000000 RSI: 0000200000001540 RDI: 0000000000000004 [ 717.436154][T14864] RBP: 00007fbd3ec50090 R08: 0000000000000000 R09: 0000000000000000 [ 717.436169][T14864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 717.436183][T14864] R13: 00007fbd3dfe6038 R14: 00007fbd3dfe5fa0 R15: 00007fbd3e10fa28 [ 717.436220][T14864] [ 717.811227][ T5876] gspca_se401: write req failed req 0x57 val 0x00 error -110 [ 717.832060][ T5876] se401 2-1:0.0: probe with driver se401 failed with error -110 [ 718.035918][T14868] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2639'. [ 718.099687][T14868] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2639'. [ 718.266408][T14874] FAULT_INJECTION: forcing a failure. [ 718.266408][T14874] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 718.279955][T14874] CPU: 1 UID: 0 PID: 14874 Comm: syz.3.2641 Tainted: G L syzkaller #0 PREEMPT(full) [ 718.279992][T14874] Tainted: [L]=SOFTLOCKUP [ 718.280001][T14874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 718.280015][T14874] Call Trace: [ 718.280025][T14874] [ 718.280035][T14874] dump_stack_lvl+0xe8/0x150 [ 718.280080][T14874] should_fail_ex+0x414/0x560 [ 718.280121][T14874] _copy_from_user+0x2d/0xb0 [ 718.280150][T14874] ___sys_sendmsg+0x158/0x2a0 [ 718.280180][T14874] ? __pfx____sys_sendmsg+0x10/0x10 [ 718.280245][T14874] ? __fget_files+0x2a/0x420 [ 718.280280][T14874] ? __fget_files+0x3a0/0x420 [ 718.280320][T14874] __x64_sys_sendmsg+0x19b/0x260 [ 718.280350][T14874] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 718.280387][T14874] ? __pfx_ksys_write+0x10/0x10 [ 718.280421][T14874] do_syscall_64+0xec/0xf80 [ 718.280445][T14874] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.280466][T14874] ? trace_irq_disable+0x37/0x100 [ 718.280496][T14874] ? clear_bhb_loop+0x60/0xb0 [ 718.280523][T14874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.280545][T14874] RIP: 0033:0x7f9e9f18f749 [ 718.280565][T14874] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 718.280585][T14874] RSP: 002b:00007f9e9d3f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 718.280610][T14874] RAX: ffffffffffffffda RBX: 00007f9e9f3e5fa0 RCX: 00007f9e9f18f749 [ 718.280627][T14874] RDX: 0000000000000040 RSI: 0000200000000340 RDI: 0000000000000004 [ 718.280642][T14874] RBP: 00007f9e9d3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 718.280656][T14874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 718.280670][T14874] R13: 00007f9e9f3e6038 R14: 00007f9e9f3e5fa0 R15: 00007f9e9f50fa28 [ 718.280705][T14874] [ 718.788616][ T5876] usb 2-1: USB disconnect, device number 79 [ 718.872770][T14880] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2643'. [ 718.892042][T14882] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 718.902704][T14880] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2643'. [ 719.511482][T15081] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2647'. [ 719.906351][T15047] 8021q: adding VLAN 0 to HW filter on device bond0 [ 720.061992][T15047] 8021q: adding VLAN 0 to HW filter on device team0 [ 720.154015][T15047] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 720.642329][T15097] xt_socket: unknown flags 0x50 [ 721.125164][T15106] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2653'. [ 722.947347][T15123] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2658'. [ 722.984493][T15123] syzkaller0: entered promiscuous mode [ 722.991083][T15123] syzkaller0: entered allmulticast mode [ 723.168940][ T5876] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 723.207753][T15132] random: crng reseeded on system resumption [ 723.311075][ T5876] usb 5-1: device descriptor read/64, error -71 [ 723.607283][ T5876] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 723.648056][T15146] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2662'. [ 723.761079][ T5876] usb 5-1: device descriptor read/64, error -71 [ 723.916121][ T5876] usb usb5-port1: attempt power cycle [ 724.278456][ T5876] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 724.375873][ T5876] usb 5-1: device descriptor read/8, error -71 [ 724.673506][ T5876] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 724.722601][ T5876] usb 5-1: device descriptor read/8, error -71 [ 724.751183][T15150] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2664'. [ 724.895697][T15150] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2664'. [ 724.934050][ T5876] usb usb5-port1: unable to enumerate USB device [ 727.046303][T15181] openvswitch: netlink: IP tunnel dst address not specified [ 727.142569][ T30] audit: type=1326 audit(1767075928.462:424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15161 comm="syz.0.2668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 727.362818][ T30] audit: type=1326 audit(1767075928.482:425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15161 comm="syz.0.2668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 727.581139][ T30] audit: type=1326 audit(1767075928.512:426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15161 comm="syz.0.2668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=98 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 727.610412][ T30] audit: type=1326 audit(1767075928.512:427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15161 comm="syz.0.2668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 727.731617][ T30] audit: type=1326 audit(1767075928.512:428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15161 comm="syz.0.2668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 727.795263][ T30] audit: type=1326 audit(1767075928.512:429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15161 comm="syz.0.2668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=444 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 727.871207][ T30] audit: type=1326 audit(1767075928.512:430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15161 comm="syz.0.2668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 727.978917][ T30] audit: type=1326 audit(1767075928.512:431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15161 comm="syz.0.2668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd3dd8f749 code=0x7ffc0000 [ 728.076914][ T30] audit: type=1326 audit(1767075928.512:432): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15161 comm="syz.0.2668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fbd3dd8df90 code=0x7ffc0000 [ 728.141303][ T30] audit: type=1326 audit(1767075928.512:433): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15161 comm="syz.0.2668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fbd3dd8df90 code=0x7ffc0000 [ 728.464188][T15190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 728.484497][T15190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 729.397605][T15209] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 729.423891][T15209] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 730.512786][ T106] usb 2-1: new full-speed USB device number 80 using dummy_hcd [ 730.673146][ T106] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 730.699337][ T106] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 730.721025][ T106] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 730.739778][ T106] usb 2-1: Product: syz [ 730.749602][ T106] usb 2-1: Manufacturer: syz [ 730.761115][ T106] usb 2-1: SerialNumber: syz [ 730.781936][ T106] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 730.978921][ T106] usb 2-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 731.007457][ T106] usb 2-1: USB disconnect, device number 80 [ 731.110507][T15248] openvswitch: netlink: IP tunnel dst address not specified [ 731.265778][ T5835] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 731.301310][T15247] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2692'. [ 732.528645][T15265] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2697'. [ 732.650905][T15265] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2697'. [ 732.951108][ T794] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 733.095454][T15279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 733.106925][T15279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 733.123558][ T794] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 733.132721][ T794] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 733.145319][ T794] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 733.160117][ T794] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 733.168802][ T794] usb 2-1: Manufacturer: syz [ 733.177300][ T794] usb 2-1: config 0 descriptor?? [ 733.181270][ T106] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 733.262035][ T794] rc_core: IR keymap rc-hauppauge not found [ 733.268135][ T794] Registered IR keymap rc-empty [ 733.274752][ T794] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 733.291738][ T794] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input45 [ 733.341206][ T106] usb 5-1: Using ep0 maxpacket: 8 [ 733.349072][ T106] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 733.371717][ T106] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 733.391212][ T106] usb 5-1: New USB device found, idVendor=056a, idProduct=7d84, bcdDevice= 0.0a [ 733.405929][ T106] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 733.422426][ T106] usb 5-1: config 0 descriptor?? [ 733.511165][ T5972] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 733.681042][ T5972] usb 3-1: Using ep0 maxpacket: 32 [ 733.707718][ T5972] usb 3-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 733.741091][ T5972] usb 3-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 733.784350][ T5972] usb 3-1: config 0 interface 0 has no altsetting 0 [ 733.807243][ T5972] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 733.837093][ T5972] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 733.861551][ T5972] usb 3-1: Product: syz [ 733.871510][ T106] wacom 0003:056A:7D84.0011: unknown main item tag 0x0 [ 733.882583][ T5972] usb 3-1: Manufacturer: syz [ 733.894742][ T5972] usb 3-1: SerialNumber: syz [ 733.899609][ T106] wacom 0003:056A:7D84.0011: unknown main item tag 0x0 [ 733.924503][ T5972] usb 3-1: config 0 descriptor?? [ 733.931138][ T106] wacom 0003:056A:7D84.0011: Unknown device_type for 'HID 056a:7d84'. Ignoring. [ 733.959695][ T5972] gs_usb 3-1:0.0: Required endpoints not found [ 734.060456][ T794] usb 5-1: USB disconnect, device number 94 [ 734.288879][T15268] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 734.315650][T15268] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 734.352782][ T5972] usb 2-1: USB disconnect, device number 81 [ 735.415495][T15306] netlink: 'syz.1.2709': attribute type 10 has an invalid length. [ 735.483367][T15306] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2709'. [ 735.546505][T15306] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 735.579072][T15306] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 735.618561][T15306] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 736.275419][ T794] usb 3-1: USB disconnect, device number 93 [ 736.598196][T15319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 736.613220][T15319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 736.647844][T15319] program syz.0.2715 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 737.049573][T15322] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2716'. [ 737.643573][T15337] netlink: 276 bytes leftover after parsing attributes in process `syz.1.2719'. [ 737.653064][T15337] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2719'. [ 737.912214][T15337] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2719'. [ 738.051735][T15339] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 738.086581][T15339] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 738.179363][T15339] batadv_slave_1: entered promiscuous mode [ 738.296961][T15338] batadv_slave_1: left promiscuous mode [ 738.412504][T15344] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2722'. [ 738.421777][ T5972] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 738.594169][ T5972] usb 2-1: config 1 has an invalid descriptor of length 76, skipping remainder of the config [ 738.657520][ T5972] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 738.687449][ T5972] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 738.708337][ T5972] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 738.727352][ T5972] usb 2-1: SerialNumber: syz [ 738.777312][ T5972] usb 2-1: bad CDC descriptors [ 739.035492][T15358] fuse: Bad value for 'fd' [ 739.067285][T15358] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2726'. [ 739.481052][ T5876] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 739.613110][T15370] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 739.631128][ T5876] usb 5-1: Using ep0 maxpacket: 8 [ 739.640372][ T5876] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 739.659530][ T5876] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 739.678366][T15370] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 739.735197][ T5876] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 739.752772][ T5876] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 739.813673][ T5876] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 739.885146][ T5876] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 740.145756][ T5876] usb 5-1: GET_CAPABILITIES returned 0 [ 740.164013][ T5876] usbtmc 5-1:16.0: can't read capabilities [ 740.373446][T15350] kvm: pic: non byte write [ 740.382420][ T5972] usb 5-1: USB disconnect, device number 95 [ 740.887852][ T5876] usb 2-1: USB disconnect, device number 82 [ 740.934936][ T5972] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 741.101118][ T5972] usb 4-1: Using ep0 maxpacket: 8 [ 741.108388][ T5972] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 741.165035][ T5972] usb 4-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 741.192120][ T5972] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 741.201571][ T794] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 741.291558][ T5972] usb 4-1: Product: syz [ 741.295817][ T5972] usb 4-1: Manufacturer: syz [ 741.300446][ T5972] usb 4-1: SerialNumber: syz [ 741.349878][ T5972] usb 4-1: config 0 descriptor?? [ 741.395574][ T5972] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 741.544394][ T794] usb 3-1: config 0 has no interfaces? [ 741.583465][ T794] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 741.646922][ T794] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 741.721909][ T794] usb 3-1: config 0 descriptor?? [ 742.480575][T15412] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2741'. [ 742.561221][ T794] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 742.715848][ T794] usb 2-1: device descriptor read/64, error -71 [ 742.742367][T15415] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 742.752815][T15415] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 742.840831][T15415] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 743.021275][ T794] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 743.201436][ T794] usb 2-1: device descriptor read/64, error -71 [ 743.311546][ T794] usb usb2-port1: attempt power cycle [ 743.471101][T15388] netlink: 'syz.3.2734': attribute type 21 has an invalid length. [ 743.479505][T15388] netlink: 160 bytes leftover after parsing attributes in process `syz.3.2734'. [ 743.565674][ T5972] gspca_sonixj: reg_w1 err -71 [ 743.571219][ T5972] sonixj 4-1:0.0: probe with driver sonixj failed with error -71 [ 743.604839][ T5972] usb 4-1: USB disconnect, device number 66 [ 743.661103][ T794] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 743.684317][ T794] usb 2-1: device descriptor read/8, error -71 [ 743.931122][ T794] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 743.982590][ T794] usb 2-1: device descriptor read/8, error -71 [ 744.092719][ T5876] usb 3-1: USB disconnect, device number 94 [ 744.102627][ T5972] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 744.112875][ T794] usb usb2-port1: unable to enumerate USB device [ 744.264346][ T5972] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 744.276195][ T5972] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 744.293164][ T5972] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 744.324724][ T5972] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 744.362309][T15418] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 744.374674][ T5972] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 744.673784][ T106] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 744.814019][T15429] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2745'. [ 744.871171][ T106] usb 4-1: Using ep0 maxpacket: 32 [ 744.935744][ T106] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 744.946318][ T106] usb 4-1: config 0 has no interface number 0 [ 744.953392][ T106] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 744.964945][ T106] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 745.008809][ T106] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 745.020430][ T106] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.029349][ T106] usb 4-1: Product: syz [ 745.035827][ T106] usb 4-1: Manufacturer: syz [ 745.047395][ T106] usb 4-1: SerialNumber: syz [ 745.071439][ T106] usb 4-1: config 0 descriptor?? [ 745.301687][T15428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 745.314732][T15428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 745.405554][T15428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 745.421784][T15428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 745.462397][T15428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 745.501912][T15428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 745.535374][T15428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 745.603955][T15428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 745.611937][ T106] radio-si470x 4-1:0.35: this is not a si470x device. [ 745.640269][ T5876] usb 5-1: USB disconnect, device number 96 [ 745.667916][ T106] radio-raremono 4-1:0.35: this is not Thanko's Raremono. [ 745.727421][T15428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 745.760691][T15428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 746.065051][T15445] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 746.084456][T15445] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 746.391629][ T794] usb 4-1: USB disconnect, device number 67 [ 746.864556][T15468] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 746.910592][T15468] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 747.031175][ T794] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 747.371060][ T794] usb 2-1: Using ep0 maxpacket: 32 [ 747.381394][ T794] usb 2-1: unable to get BOS descriptor or descriptor too short [ 747.403703][ T794] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 256, setting to 64 [ 747.497890][ T794] usb 2-1: New USB device found, idVendor=0123, idProduct=0001, bcdDevice=4a.fe [ 747.527603][ T794] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 747.594952][ T794] usb 2-1: Product: syz [ 747.600605][ T794] usb 2-1: Manufacturer: syz [ 747.620899][ T794] usb 2-1: SerialNumber: syz [ 747.713391][ T5876] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 747.723692][ T794] usb 2-1: config 0 descriptor?? [ 747.937074][T15468] binder: BINDER_SET_CONTEXT_MGR already set [ 747.947302][T15468] binder: 15467:15468 ioctl 4018620d 200000000040 returned -16 [ 749.755793][ T794] usbtouchscreen 2-1:0.0: probe with driver usbtouchscreen failed with error -71 [ 749.822054][ T794] usb 2-1: USB disconnect, device number 87 [ 750.043041][T15496] tipc: Enabling of bearer rejected, already enabled [ 750.231307][ T794] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 750.325215][T15503] netlink: 'syz.0.2763': attribute type 10 has an invalid length. [ 750.348159][T15503] bond0: (slave wlan1): Opening slave failed [ 750.382918][ T794] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 750.394350][ T794] usb 2-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.00 [ 750.404355][ T794] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 750.415629][ T794] usb 2-1: config 0 descriptor?? [ 750.591077][ T106] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 750.764713][ T106] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 750.776253][ T106] usb 4-1: config 0 interface 0 has no altsetting 0 [ 750.817099][ T106] usb 4-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=b1.f9 [ 750.839200][ T106] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 750.869156][ T106] usb 4-1: Product: syz [ 750.877078][ T794] holtek 0003:1241:5015.0012: unknown main item tag 0x0 [ 750.877100][ T106] usb 4-1: Manufacturer: syz [ 750.877153][ T106] usb 4-1: SerialNumber: syz [ 750.962841][ T794] holtek 0003:1241:5015.0012: hidraw0: USB HID v0.00 Device [HID 1241:5015] on usb-dummy_hcd.1-1/input0 [ 750.974602][ T794] holtek 0003:1241:5015.0012: no inputs found [ 750.983619][ T106] usb 4-1: config 0 descriptor?? [ 751.006790][ T106] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 751.028587][ T106] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 751.086163][ T106] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 751.100547][ T106] usb 4-1: media controller created [ 751.132874][T15494] netlink: 144 bytes leftover after parsing attributes in process `syz.1.2759'. [ 751.164485][ T106] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 751.338096][ T106] DVB: Unable to find symbol tda10046_attach() [ 751.386401][ T106] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 751.477132][ T106] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 751.729328][T15528] kvm: kvm [15524]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 751.781975][T15528] kvm: kvm [15524]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 752.431129][ T106] dvb_usb_m920x 4-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 752.450238][ T106] usb 4-1: USB disconnect, device number 68 [ 752.635092][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 752.650183][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 752.861510][ T106] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 752.969829][ T794] usb 2-1: USB disconnect, device number 88 [ 753.021305][ T106] usb 3-1: Using ep0 maxpacket: 32 [ 753.029298][ T106] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 753.060278][ T106] usb 3-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 753.090013][ T106] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 753.112511][ T106] usb 3-1: config 0 descriptor?? [ 753.131386][ T106] dvb-usb: found a 'TeVii S662' in warm state. [ 753.148106][ T106] dw2102: su3000_power_ctrl: 1, initialized 0 [ 753.161126][ T106] dvb-usb: bulk message failed: -22 (2/0) [ 753.299558][ T106] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 753.355190][ T106] dvbdev: DVB: registering new adapter (TeVii S662) [ 753.379745][ T106] usb 3-1: media controller created [ 753.406083][ T106] dvb-usb: bulk message failed: -22 (6/0) [ 753.428785][ T106] dw2102: i2c transfer failed. [ 753.450752][ T106] dvb-usb: bulk message failed: -22 (6/0) [ 753.464281][ T106] dw2102: i2c transfer failed. [ 753.476766][ T106] dvb-usb: bulk message failed: -22 (6/0) [ 753.496034][ T106] dw2102: i2c transfer failed. [ 753.511916][ T106] dvb-usb: bulk message failed: -22 (6/0) [ 753.538754][ T106] dw2102: i2c transfer failed. [ 753.552678][ T106] dvb-usb: bulk message failed: -22 (6/0) [ 753.573765][ T106] dw2102: i2c transfer failed. [ 753.586242][ T106] dvb-usb: bulk message failed: -22 (6/0) [ 753.603302][ T106] dw2102: i2c transfer failed. [ 753.617262][ T106] dvb-usb: MAC address: 02:02:02:02:02:02 [ 753.659337][ T106] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 753.672170][ T794] usb 4-1: new full-speed USB device number 69 using dummy_hcd [ 753.733412][ T106] dvb-usb: bulk message failed: -22 (3/0) [ 753.761064][ T106] dw2102: command 0x0e transfer failed. [ 753.779079][ T106] dvb-usb: bulk message failed: -22 (3/0) [ 753.808391][ T106] dw2102: command 0x0e transfer failed. [ 753.844185][ T794] usb 4-1: unable to get BOS descriptor or descriptor too short [ 753.852930][ T794] usb 4-1: not running at top speed; connect to a high speed hub [ 753.883858][ T794] usb 4-1: config 17 has an invalid interface number: 8 but max is 1 [ 753.909634][ T794] usb 4-1: config 17 has 1 interface, different from the descriptor's value: 2 [ 754.073482][ T794] usb 4-1: config 17 has no interface number 0 [ 754.079763][ T794] usb 4-1: config 17 interface 8 altsetting 6 endpoint 0x3 has an invalid bInterval 0, changing to 4 [ 754.121930][ T794] usb 4-1: config 17 interface 8 has no altsetting 0 [ 754.132507][ T106] dvb-usb: bulk message failed: -22 (3/0) [ 754.150535][ T794] usb 4-1: New USB device found, idVendor=0763, idProduct=2001, bcdDevice=2c.ff [ 754.156190][ T106] dw2102: command 0x0e transfer failed. [ 754.166542][ T794] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 754.169102][T15563] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.2777'. [ 754.269277][ T106] dvb-usb: bulk message failed: -22 (3/0) [ 754.279293][ T106] dw2102: command 0x0e transfer failed. [ 754.298816][ T106] dvb-usb: bulk message failed: -22 (1/0) [ 754.301776][ T794] usb 4-1: Product: syz [ 754.309440][ T794] usb 4-1: Manufacturer: syz [ 754.316983][ T106] dw2102: command 0x51 transfer failed. [ 754.322888][ T794] usb 4-1: SerialNumber: syz [ 754.361016][ T106] dvb-usb: bulk message failed: -22 (5/0) [ 754.402658][ T106] dw2102: i2c probe for address 0x68 failed. [ 754.422092][ T106] dvb-usb: bulk message failed: -22 (5/0) [ 754.449629][ T106] dw2102: i2c probe for address 0x69 failed. [ 754.461278][ T106] dvb-usb: bulk message failed: -22 (5/0) [ 754.467262][ T106] dw2102: i2c probe for address 0x6a failed. [ 754.477609][ T106] dw2102: probing for demodulator failed. Is the external power switched on? [ 754.499376][ T106] dvb-usb: no frontend was attached by 'TeVii S662' [ 754.540328][T15568] SET target dimension over the limit! [ 754.662896][ T794] usb 4-1: selecting invalid altsetting 0 [ 754.672955][ T794] usb 4-1: 8:6 : no UAC_FORMAT_TYPE desc [ 754.678682][ T794] usb 4-1: selecting invalid altsetting 0 [ 754.751104][ T106] rc_core: IR keymap rc-tt-1500 not found [ 754.785895][ T794] usb 4-1: USB disconnect, device number 69 [ 754.789138][ T106] Registered IR keymap rc-empty [ 754.817938][ T106] rc rc0: TeVii S662 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 754.843829][T15573] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2779'. [ 755.073130][T15576] FAULT_INJECTION: forcing a failure. [ 755.073130][T15576] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 755.105197][T15576] CPU: 1 UID: 0 PID: 15576 Comm: syz.2.2781 Tainted: G L syzkaller #0 PREEMPT(full) [ 755.105234][T15576] Tainted: [L]=SOFTLOCKUP [ 755.105243][T15576] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 755.105257][T15576] Call Trace: [ 755.105267][T15576] [ 755.105278][T15576] dump_stack_lvl+0xe8/0x150 [ 755.105313][T15576] should_fail_ex+0x414/0x560 [ 755.105353][T15576] _copy_from_user+0x2d/0xb0 [ 755.105382][T15576] kstrtouint_from_user+0xc4/0x170 [ 755.105408][T15576] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 755.105448][T15576] proc_fail_nth_write+0x88/0x200 [ 755.105473][T15576] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 755.105504][T15576] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 755.105538][T15576] vfs_write+0x27e/0xb30 [ 755.105570][T15576] ? __pfx_vfs_write+0x10/0x10 [ 755.105594][T15576] ? __fget_files+0x2a/0x420 [ 755.105627][T15576] ? __fget_files+0x3a0/0x420 [ 755.105653][T15576] ? __fget_files+0x2a/0x420 [ 755.105691][T15576] ksys_write+0x145/0x250 [ 755.105716][T15576] ? __pfx_ksys_write+0x10/0x10 [ 755.105751][T15576] do_syscall_64+0xec/0xf80 [ 755.105775][T15576] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.105796][T15576] ? trace_irq_disable+0x37/0x100 [ 755.105825][T15576] ? clear_bhb_loop+0x60/0xb0 [ 755.105853][T15576] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.105876][T15576] RIP: 0033:0x7f84a6b8e1ff [ 755.105896][T15576] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 755.105915][T15576] RSP: 002b:00007f84a7a76030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 755.105939][T15576] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f84a6b8e1ff [ 755.105954][T15576] RDX: 0000000000000001 RSI: 00007f84a7a760a0 RDI: 0000000000000005 [ 755.105978][T15576] RBP: 00007f84a7a76090 R08: 0000000000000000 R09: 0000000000000010 [ 755.105992][T15576] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 [ 755.106005][T15576] R13: 00007f84a6de6038 R14: 00007f84a6de5fa0 R15: 00007f84a6f0fa28 [ 755.106041][T15576] [ 755.124016][ T106] input: TeVii S662 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input51 [ 755.630735][ T106] dvb-usb: schedule remote query interval to 250 msecs. [ 755.662071][ T106] dw2102: su3000_power_ctrl: 0, initialized 1 [ 755.668245][ T106] dvb-usb: TeVii S662 successfully initialized and connected. [ 755.748327][ T106] usb 3-1: USB disconnect, device number 97 [ 755.917602][ T106] dvb-usb: TeVii S662 successfully deinitialized and disconnected. [ 756.031115][ T5972] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 756.264920][ T5972] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 756.319975][ T5972] usb 2-1: config 0 interface 0 has no altsetting 0 [ 756.346860][ T5972] usb 2-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=b1.f9 [ 756.377807][ T5972] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 756.396486][ T5972] usb 2-1: Product: syz [ 756.406609][ T5972] usb 2-1: Manufacturer: syz [ 756.419937][ T5972] usb 2-1: SerialNumber: syz [ 756.436822][ T5972] usb 2-1: config 0 descriptor?? [ 756.537415][ T5972] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 756.562866][ T5972] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 756.573261][ T5972] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 756.583019][ T5972] usb 2-1: media controller created [ 756.608390][ T5972] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 756.730584][ T5972] DVB: Unable to find symbol tda10046_attach() [ 756.739866][ T5972] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 756.754605][ T5972] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 757.078966][T15606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 757.089406][T15606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 757.187986][T15606] binder: 15605:15606 ioctl c0306201 2000000003c0 returned -14 [ 757.808054][ T5972] dvb_usb_m920x 2-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 757.830591][ T5972] usb 2-1: USB disconnect, device number 89 [ 758.037245][T15624] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2795'. [ 758.072276][T15625] openvswitch: netlink: Flow key attr not present in new flow. [ 758.163432][T15624] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2795'. [ 758.315710][T15624] vlan2: entered allmulticast mode [ 758.321173][T15624] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 758.512671][T15630] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 758.522062][T15630] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 758.550087][T15632] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2798'. [ 759.697385][ T5826] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 759.708143][ T5826] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 759.721285][ T5826] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 759.729430][ T5826] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 759.737382][ T5826] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 760.157944][T15671] openvswitch: netlink: Flow key attr not present in new flow. [ 760.232813][ T5876] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 760.401079][ T5876] usb 4-1: Using ep0 maxpacket: 8 [ 760.410857][ T5876] usb 4-1: config 1 interface 0 altsetting 6 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 760.424492][ T5876] usb 4-1: config 1 interface 0 has no altsetting 0 [ 760.437713][ T5876] usb 4-1: New USB device found, idVendor=062a, idProduct=7100, bcdDevice= 0.40 [ 760.469568][ T5876] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 760.488166][ T5876] usb 4-1: Product: ᆗ玷ᮯḪ롑⦲￁뿹臄塙蚎먅峗畻읦ꤡ웊譚ꅎ湥穧㹆펗딫ㆉ˸弤ꮴ軣雾瓺 [ 760.508461][ T5876] usb 4-1: Manufacturer: 苖팖峁惉锵츣髯魶⤠恖⨪퇩ꌼ꽭৉ᄮäῖ怀ꅷޣ᜶⹒阼뎈곦ꀀ鬀㒘ᄭ刢뮕ṳ碯Ƭ䨛塥ભ艩툳ꛎ毇﫣⼳ [ 760.533692][ T5876] usb 4-1: SerialNumber: syz [ 760.760709][T15656] chnl_net:caif_netlink_parms(): no params data found [ 760.917768][ T5949] bridge_slave_1: left allmulticast mode [ 760.955208][T15662] sctp: [Deprecated]: syz.3.2809 (pid 15662) Use of int in max_burst socket option deprecated. [ 760.955208][T15662] Use struct sctp_assoc_value instead [ 760.991323][ T5949] bridge_slave_1: left promiscuous mode [ 761.123053][ T5949] bridge0: port 2(bridge_slave_1) entered disabled state [ 761.220702][ T5949] bridge_slave_0: left allmulticast mode [ 761.244824][ T5949] bridge_slave_0: left promiscuous mode [ 761.263765][ T5949] bridge0: port 1(bridge_slave_0) entered disabled state [ 762.017307][ T5835] Bluetooth: hci4: command tx timeout [ 762.885908][ T5949] bond3 (unregistering): (slave gretap1): Releasing active interface [ 763.036509][ T5876] usbhid 4-1:1.0: can't add hid device: -71 [ 763.051899][ T5876] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 763.118783][ T5876] usb 4-1: USB disconnect, device number 70 [ 763.577731][T15712] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2820'. [ 763.862725][ T5949] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 763.873262][ T5949] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 763.883285][ T5949] bond0 (unregistering): Released all slaves [ 763.897906][ T5949] bond1 (unregistering): Released all slaves [ 763.920820][ T5949] bond2 (unregistering): Released all slaves [ 763.949572][ T5949] bond3 (unregistering): Released all slaves [ 764.081228][ T5835] Bluetooth: hci4: command tx timeout [ 764.084750][ T5949] bond4 (unregistering): Released all slaves [ 764.313799][ T5949] tipc: Left network mode [ 764.387411][ T5949] IPVS: stopping master sync thread 6787 ... [ 764.419517][ T5949] IPVS: stopping backup sync thread 14164 ... [ 764.524392][T15656] bridge0: port 1(bridge_slave_0) entered blocking state [ 764.537269][T15656] bridge0: port 1(bridge_slave_0) entered disabled state [ 764.545545][T15656] bridge_slave_0: entered allmulticast mode [ 764.568446][T15656] bridge_slave_0: entered promiscuous mode [ 764.601200][T15656] bridge0: port 2(bridge_slave_1) entered blocking state [ 764.608496][T15656] bridge0: port 2(bridge_slave_1) entered disabled state [ 764.621440][T15656] bridge_slave_1: entered allmulticast mode [ 764.630593][T15656] bridge_slave_1: entered promiscuous mode [ 764.643926][T15726] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2823'. [ 764.672149][T15726] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2823'. [ 764.711663][T15726] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2823'. [ 764.737990][T15726] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2823'. [ 764.866364][T15656] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 764.878181][T15734] netlink: 'syz.4.2827': attribute type 23 has an invalid length. [ 764.907829][T15656] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 765.035415][T15656] team0: Port device team_slave_0 added [ 765.611641][T15656] team0: Port device team_slave_1 added [ 765.837727][T15747] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2830'. [ 765.858203][T15748] x_tables: duplicate underflow at hook 2 [ 765.891969][T15748] loop2: detected capacity change from 0 to 7 [ 765.899272][T15748] loop2: [ 765.904328][T15748] loop2: partition table partially beyond EOD, truncated [ 765.921961][T15656] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 765.928979][T15656] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 766.088786][T15656] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 766.151166][ T5835] Bluetooth: hci4: command tx timeout [ 766.181565][T15759] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 766.200276][T15759] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 766.226864][T15656] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 766.255471][T15656] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 766.284562][ T5835] Bluetooth: hci3: unexpected event 0x01 length: 3 > 1 [ 766.298610][T15656] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 766.521414][T15774] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2835'. [ 766.584714][ T30] kauditd_printk_skb: 23 callbacks suppressed [ 766.584734][ T30] audit: type=1326 audit(1767075967.832:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15764 comm="syz.3.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 766.646272][T15656] hsr_slave_0: entered promiscuous mode [ 766.662585][T15656] hsr_slave_1: entered promiscuous mode [ 766.683627][T15656] debugfs: 'hsr0' already exists in 'hsr' [ 766.695799][T15656] Cannot create hsr debugfs directory [ 766.761789][T15776] FAULT_INJECTION: forcing a failure. [ 766.761789][T15776] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 766.787602][ T30] audit: type=1326 audit(1767075967.832:458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15764 comm="syz.3.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=246 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 766.788922][T15776] CPU: 1 UID: 0 PID: 15776 Comm: syz.2.2837 Tainted: G L syzkaller #0 PREEMPT(full) [ 766.789017][T15776] Tainted: [L]=SOFTLOCKUP [ 766.789040][T15776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 766.789080][T15776] Call Trace: [ 766.789102][T15776] [ 766.789132][T15776] dump_stack_lvl+0xe8/0x150 [ 766.789277][T15776] should_fail_ex+0x414/0x560 [ 766.789384][T15776] prepare_alloc_pages+0x22b/0x650 [ 766.789472][T15776] __alloc_frozen_pages_noprof+0x123/0x370 [ 766.789542][T15776] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 766.789653][T15776] ? policy_nodemask+0x27c/0x720 [ 766.789717][T15776] ? do_raw_spin_lock+0x121/0x290 [ 766.789800][T15776] ? lock_acquire+0x107/0x340 [ 766.789863][T15776] alloc_pages_mpol+0x232/0x4a0 [ 766.789946][T15776] alloc_pages_noprof+0xa9/0x190 [ 766.790021][T15776] get_free_pages_noprof+0xf/0x80 [ 766.790085][T15776] __pollwait+0x263/0x430 [ 766.790156][T15776] ? __pfx___pollwait+0x10/0x10 [ 766.790218][T15776] pipe_poll+0x16f/0x470 [ 766.790301][T15776] ? __pfx_pipe_poll+0x10/0x10 [ 766.790365][T15776] do_sys_poll+0x8c9/0x1070 [ 766.790472][T15776] ? __pfx_do_sys_poll+0x10/0x10 [ 766.790592][T15776] ? __pfx___pollwait+0x10/0x10 [ 766.790690][T15776] ? __pfx_pollwake+0x10/0x10 [ 766.790756][T15776] ? __pfx_pollwake+0x10/0x10 [ 766.790837][T15776] ? __pfx_pollwake+0x10/0x10 [ 766.790910][T15776] ? __pfx_pollwake+0x10/0x10 [ 766.790986][T15776] ? __pfx_pollwake+0x10/0x10 [ 766.791078][T15776] ? __pfx_pollwake+0x10/0x10 [ 766.791152][T15776] ? __pfx_pollwake+0x10/0x10 [ 766.791225][T15776] ? __pfx_pollwake+0x10/0x10 [ 766.791314][T15776] ? __pfx_pollwake+0x10/0x10 [ 766.791402][T15776] ? ktime_get_ts64+0xa9/0x3d0 [ 766.791557][T15776] ? __pfx_timespec64_add_safe+0x10/0x10 [ 766.791658][T15776] __se_sys_poll+0x128/0x320 [ 766.791747][T15776] ? __pfx___se_sys_poll+0x10/0x10 [ 766.791841][T15776] do_syscall_64+0xec/0xf80 [ 766.791902][T15776] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.791968][T15776] ? trace_irq_disable+0x37/0x100 [ 766.792062][T15776] ? clear_bhb_loop+0x60/0xb0 [ 766.792143][T15776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.792204][T15776] RIP: 0033:0x7f84a6b8f749 [ 766.792256][T15776] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 766.792309][T15776] RSP: 002b:00007f84a7a76038 EFLAGS: 00000246 ORIG_RAX: 0000000000000007 [ 766.792373][T15776] RAX: ffffffffffffffda RBX: 00007f84a6de5fa0 RCX: 00007f84a6b8f749 [ 766.792415][T15776] RDX: 0000000000000009 RSI: 20000000000000b5 RDI: 0000200000000000 [ 766.792457][T15776] RBP: 00007f84a7a76090 R08: 0000000000000000 R09: 0000000000000000 [ 766.792497][T15776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 766.792549][T15776] R13: 00007f84a6de6038 R14: 00007f84a6de5fa0 R15: 00007f84a6f0fa28 [ 766.792635][T15776] [ 767.113047][ T30] audit: type=1326 audit(1767075967.832:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15764 comm="syz.3.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 767.314334][ T30] audit: type=1326 audit(1767075967.832:460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15764 comm="syz.3.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 767.374243][ T30] audit: type=1326 audit(1767075967.832:461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15764 comm="syz.3.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 767.477114][ T30] audit: type=1326 audit(1767075967.832:462): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15764 comm="syz.3.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 767.576044][ T30] audit: type=1326 audit(1767075967.852:463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15764 comm="syz.3.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 767.620910][ T5949] hsr_slave_0: left promiscuous mode [ 767.628996][ T5949] hsr_slave_1: left promiscuous mode [ 767.665967][ T5949] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 767.712340][ T5949] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 767.717243][ T30] audit: type=1326 audit(1767075967.852:464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15764 comm="syz.3.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 767.799861][ T30] audit: type=1326 audit(1767075967.862:465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15764 comm="syz.3.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 767.891535][ T30] audit: type=1326 audit(1767075967.862:466): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15764 comm="syz.3.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f9e9f18f749 code=0x7ffc0000 [ 768.143346][ T5949] team0 (unregistering): Port device macvlan0 removed [ 768.237483][ T5835] Bluetooth: hci4: command tx timeout [ 768.511134][ T9] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 768.624925][ T5949] team0 (unregistering): Port device team_slave_1 removed [ 768.673531][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 768.699995][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 768.710682][ T9] usb 4-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=b1.f9 [ 768.726568][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 768.735107][ T9] usb 4-1: Product: syz [ 768.739565][ T9] usb 4-1: Manufacturer: syz [ 768.744579][ T9] usb 4-1: SerialNumber: syz [ 768.771911][ T9] usb 4-1: config 0 descriptor?? [ 768.784182][ T9] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 768.803158][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 768.836207][ T9] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 768.850286][ T9] usb 4-1: media controller created [ 768.883394][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 769.030529][ T9] DVB: Unable to find symbol tda10046_attach() [ 769.039794][ T9] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 769.058052][ T9] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 769.641811][T15807] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2845'. [ 771.050613][ T5949] IPVS: stop unused estimator thread 0... [ 771.277506][ T9] dvb_usb_m920x 4-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 771.324835][ T9] usb 4-1: USB disconnect, device number 71 [ 771.752638][T15835] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2851'. [ 771.798309][T15656] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 771.860021][T15656] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 771.900809][T15845] SET target dimension over the limit! [ 771.948632][T15656] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 772.017006][T15656] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 773.026342][T15656] 8021q: adding VLAN 0 to HW filter on device bond0 [ 773.102988][T15656] 8021q: adding VLAN 0 to HW filter on device team0 [ 773.117541][ T1024] bridge0: port 1(bridge_slave_0) entered blocking state [ 773.124845][ T1024] bridge0: port 1(bridge_slave_0) entered forwarding state [ 773.510623][ T5949] bridge0: port 2(bridge_slave_1) entered blocking state [ 773.517943][ T5949] bridge0: port 2(bridge_slave_1) entered forwarding state [ 773.961335][T15877] IPVS: You probably need to specify IP address on multicast interface. [ 773.970217][T15877] IPVS: Error connecting to the multicast addr [ 774.164869][T15656] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 774.759431][T15656] veth0_vlan: entered promiscuous mode [ 774.791527][ T9] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 774.942801][T15656] veth1_vlan: entered promiscuous mode [ 774.958367][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 774.974051][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 774.983820][ T9] usb 4-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=b1.f9 [ 775.011008][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 775.063297][ T9] usb 4-1: Product: syz [ 775.067608][ T9] usb 4-1: Manufacturer: syz [ 775.091030][ T9] usb 4-1: SerialNumber: syz [ 775.149225][ T9] usb 4-1: config 0 descriptor?? [ 775.189235][ T9] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 775.239024][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 775.291949][ T9] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 775.358320][ T9] usb 4-1: media controller created [ 775.434321][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 775.635682][ T9] DVB: Unable to find symbol tda10046_attach() [ 775.654396][T15656] veth0_macvtap: entered promiscuous mode [ 775.655260][ T9] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 775.693810][ T9] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 775.741893][T15656] veth1_macvtap: entered promiscuous mode [ 775.823049][T15656] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 775.881961][T15656] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 775.972380][ T1054] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 775.993925][ T1054] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 776.032112][ T1054] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 776.052641][T15901] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2862'. [ 776.062699][ T1054] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 776.085873][T15901] MPI: mpi too large (113288 bits) [ 776.420236][T15907] SET target dimension over the limit! [ 776.430318][ T1024] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 776.494948][ T1024] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 776.918776][ T1054] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 776.976626][ T1054] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 777.705760][ T9] dvb_usb_m920x 4-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 777.763715][ T9] usb 4-1: USB disconnect, device number 72 [ 779.131133][ T5876] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 779.292998][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 779.293021][ T30] audit: type=1326 audit(1767075980.612:493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15928 comm="syz.1.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f729218f749 code=0x7ffc0000 [ 779.331063][ T5876] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 779.398243][ T30] audit: type=1326 audit(1767075980.632:494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15928 comm="syz.1.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f729218f749 code=0x7ffc0000 [ 779.401300][ T5876] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 779.572574][ T5876] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 779.591178][ T31] INFO: task kworker/1:9:6478 blocked for more than 143 seconds. [ 779.601695][ T5876] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 779.621591][ T31] Tainted: G L syzkaller #0 [ 779.623828][ T5876] usb 4-1: config 0 descriptor?? [ 779.630278][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 779.658799][ T30] audit: type=1326 audit(1767075980.642:495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15928 comm="syz.1.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=98 compat=0 ip=0x7f729218f749 code=0x7ffc0000 [ 779.682748][ T31] task:kworker/1:9 state:D stack:21048 pid:6478 tgid:6478 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 779.695456][ T31] Workqueue: usb_hub_wq hub_event [ 779.700538][ T31] Call Trace: [ 779.711161][ T30] audit: type=1326 audit(1767075980.642:496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15928 comm="syz.1.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f729218f749 code=0x7ffc0000 [ 779.716102][ T31] [ 779.734091][ T30] audit: type=1326 audit(1767075980.642:497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15928 comm="syz.1.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f729218f749 code=0x7ffc0000 [ 779.805450][ T5876] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 779.820838][ T30] audit: type=1326 audit(1767075980.642:498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15928 comm="syz.1.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=444 compat=0 ip=0x7f729218f749 code=0x7ffc0000 [ 779.848295][ T31] __schedule+0x149b/0x4fd0 [ 779.920872][ T30] audit: type=1326 audit(1767075980.642:499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15928 comm="syz.1.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f729218f749 code=0x7ffc0000 [ 779.949477][ T31] ? __pfx___schedule+0x10/0x10 [ 780.006771][ T30] audit: type=1326 audit(1767075980.642:500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15928 comm="syz.1.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f729218f749 code=0x7ffc0000 [ 780.007929][ T31] ? schedule+0x91/0x360 [ 780.131078][ T30] audit: type=1326 audit(1767075980.642:501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15928 comm="syz.1.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f729218f749 code=0x7ffc0000 [ 780.200798][ T30] audit: type=1326 audit(1767075980.642:502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15928 comm="syz.1.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f729218f749 code=0x7ffc0000 [ 780.224251][ T31] schedule+0x165/0x360 [ 780.245658][ T31] schedule_timeout+0x9a/0x270 [ 780.268940][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 780.284178][ T31] ? do_raw_spin_lock+0x121/0x290 [ 780.294799][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 780.306807][ T31] ? wait_for_completion+0x267/0x5d0 [ 780.326805][ T31] wait_for_completion+0x2bf/0x5d0 [ 780.337682][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 780.349162][ T31] i2c_del_adapter+0x591/0x760 [ 780.367322][ T31] ? lockdep_hardirqs_on+0x7b/0x110 [ 780.372845][ T31] ? kfree+0x1c0/0x660 [ 780.377113][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 780.382904][ T31] ? dvb_usbv2_exit+0x949/0xb90 [ 780.390288][ T31] dvb_usbv2_probe+0x497/0x3c20 [ 780.401026][ T31] ? __pfx_dvb_usbv2_probe+0x10/0x10 [ 780.412221][ T31] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 780.423485][ T31] ? __pm_runtime_set_status+0x785/0xa50 [ 780.434894][ T31] usb_probe_interface+0x668/0xc90 [ 780.452302][ T31] ? __pfx_usb_probe_interface+0x10/0x10 [ 780.458066][ T31] really_probe+0x26d/0xad0 [ 780.471032][ T31] __driver_probe_device+0x18c/0x320 [ 780.476407][ T31] driver_probe_device+0x4f/0x240 [ 780.491196][ T31] __device_attach_driver+0x279/0x430 [ 780.496671][ T31] bus_for_each_drv+0x251/0x2e0 [ 780.508715][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 780.514801][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 780.520239][ T31] ? lockdep_hardirqs_on+0x7b/0x110 [ 780.525595][ T31] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 780.533067][ T31] __device_attach+0x2b8/0x430 [ 780.537940][ T31] ? __pfx___device_attach+0x10/0x10 [ 780.543422][ T31] ? _raw_spin_unlock+0x28/0x50 [ 780.548340][ T31] device_initial_probe+0xa1/0xd0 [ 780.553512][ T31] bus_probe_device+0x12a/0x220 [ 780.558446][ T31] ? device_add+0x726/0xb80 [ 780.563070][ T31] device_add+0x7b6/0xb80 [ 780.567449][ T31] usb_set_configuration+0x1a87/0x2110 [ 780.573191][ T31] usb_generic_driver_probe+0x8d/0x150 [ 780.578722][ T31] usb_probe_device+0x1c4/0x3c0 [ 780.583995][ T31] ? __pfx_usb_probe_device+0x10/0x10 [ 780.589464][ T31] really_probe+0x26d/0xad0 [ 780.594111][ T31] __driver_probe_device+0x18c/0x320 [ 780.599492][ T31] driver_probe_device+0x4f/0x240 [ 780.605801][ T31] __device_attach_driver+0x279/0x430 [ 780.612050][ T31] bus_for_each_drv+0x251/0x2e0 [ 780.617088][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 780.623464][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 780.628917][ T31] ? lockdep_hardirqs_on+0x7b/0x110 [ 780.634648][ T31] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 780.640564][ T31] __device_attach+0x2b8/0x430 [ 780.645684][ T31] ? __pfx___device_attach+0x10/0x10 [ 780.651257][ T31] ? _raw_spin_unlock+0x28/0x50 [ 780.656206][ T31] device_initial_probe+0xa1/0xd0 [ 780.662024][ T31] bus_probe_device+0x12a/0x220 [ 780.666970][ T31] ? device_add+0x726/0xb80 [ 780.671851][ T31] device_add+0x7b6/0xb80 [ 780.676260][ T31] usb_new_device+0xa39/0x1720 [ 780.681563][ T31] ? __pfx_usb_new_device+0x10/0x10 [ 780.686829][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 780.692457][ T31] hub_event+0x29b1/0x4ef0 [ 780.696987][ T31] ? __pfx_hub_event+0x10/0x10 [ 780.702608][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 780.708702][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 780.719735][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 780.738242][ T31] process_scheduled_works+0xad1/0x1770 [ 780.744298][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 780.750342][ T31] ? do_raw_spin_lock+0x121/0x290 [ 780.756871][ T31] worker_thread+0x8a0/0xda0 [ 780.761955][ T31] ? __kthread_parkme+0x7b/0x200 [ 780.767550][ T31] kthread+0x711/0x8a0 [ 780.771993][ T31] ? __pfx_worker_thread+0x10/0x10 [ 780.777194][ T31] ? __pfx_kthread+0x10/0x10 [ 780.782796][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 780.788104][ T31] ? __pfx_kthread+0x10/0x10 [ 780.794905][ T31] ret_from_fork+0x510/0xa50 [ 780.799557][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 780.805165][ T31] ? __switch_to+0xc9e/0x1480 [ 780.809928][ T31] ? __pfx_kthread+0x10/0x10 [ 780.815597][ T31] ret_from_fork_asm+0x1a/0x30 [ 780.820460][ T31] [ 780.824477][ T31] [ 780.824477][ T31] Showing all locks held in the system: [ 780.832556][ T31] 1 lock held by khungtaskd/31: [ 780.837465][ T31] #0: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 780.852115][ T31] 2 locks held by getty/5585: [ 780.857020][ T31] #0: ffff88814dc940a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 780.867354][T15966] binder: 15948:15966 ioctl c0306201 2000000003c0 returned -14 [ 780.875976][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x449/0x1460 [ 780.886723][ T31] 5 locks held by kworker/1:9/6478: [ 780.892364][ T31] #0: ffff88801ceff948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 780.904159][ T31] #1: ffffc9001bb57bc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 780.919028][ T31] #2: ffff888028644198 (&dev->mutex){....}-{4:4}, at: hub_event+0x187/0x4ef0 [ 780.929379][ T31] #3: ffff88801ef9f198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 [ 780.942537][ T31] #4: ffff8880491be160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 [ 780.958772][ T31] 4 locks held by syz.3.2872/15968: [ 780.965292][ T31] 1 lock held by dhcpcd-run-hook/15953: [ 780.971391][ T31] [ 780.973865][ T31] ============================================= [ 780.973865][ T31] [ 781.015803][ T31] NMI backtrace for cpu 1 [ 781.015828][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 781.015857][ T31] Tainted: [L]=SOFTLOCKUP [ 781.015865][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 781.015879][ T31] Call Trace: [ 781.015887][ T31] [ 781.015896][ T31] dump_stack_lvl+0xe8/0x150 [ 781.015929][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 781.015960][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 781.015998][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 781.016032][ T31] sys_info+0x135/0x170 [ 781.016057][ T31] watchdog+0xf95/0xfe0 [ 781.016093][ T31] ? watchdog+0x20a/0xfe0 [ 781.016130][ T31] kthread+0x711/0x8a0 [ 781.016163][ T31] ? __pfx_watchdog+0x10/0x10 [ 781.016214][ T31] ? __pfx_kthread+0x10/0x10 [ 781.016246][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 781.016279][ T31] ? __pfx_kthread+0x10/0x10 [ 781.016308][ T31] ret_from_fork+0x510/0xa50 [ 781.016332][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 781.016352][ T31] ? __switch_to+0xc9e/0x1480 [ 781.016385][ T31] ? __pfx_kthread+0x10/0x10 [ 781.016412][ T31] ret_from_fork_asm+0x1a/0x30 [ 781.016456][ T31] [ 781.016465][ T31] Sending NMI from CPU 1 to CPUs 0: [ 781.143702][ C0] NMI backtrace for cpu 0 [ 781.143725][ C0] CPU: 0 UID: 0 PID: 15970 Comm: dhcpcd-run-hook Tainted: G L syzkaller #0 PREEMPT(full) [ 781.143752][ C0] Tainted: [L]=SOFTLOCKUP [ 781.143759][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 781.143771][ C0] RIP: 0010:__lock_acquire+0x2dd/0x2cf0 [ 781.143797][ C0] Code: 00 00 ba 00 e0 ff ff 41 23 54 c7 20 09 ca 41 89 54 c7 20 4d 89 44 c7 08 4d 89 4c c7 10 48 8b 94 24 20 01 00 00 49 89 54 c7 18 <65> 8b 15 78 3d e2 10 31 f6 85 d2 40 0f 95 c6 31 d2 41 83 be 14 0b [ 781.143815][ C0] RSP: 0018:ffffc9001c3a7130 EFLAGS: 00000002 [ 781.143832][ C0] RAX: 000000000000000f RBX: 0000000000000000 RCX: 0000000000000007 [ 781.143844][ C0] RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000000 [ 781.143855][ C0] RBP: 0000000000000003 R08: ffffffff8173fd65 R09: ffffffff8df41aa0 [ 781.143868][ C0] R10: ffffc9001c3a7438 R11: ffffffff81acf3d0 R12: 0000000000000000 [ 781.143882][ C0] R13: 0000000000000002 R14: ffff88807bd91e80 R15: ffff88807bd929b0 [ 781.143896][ C0] FS: 00007f1b92d4ac80(0000) GS:ffff888125e21000(0000) knlGS:0000000000000000 [ 781.143913][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 781.143926][ C0] CR2: 00007ffdb0001fe8 CR3: 0000000048fa0000 CR4: 00000000003526f0 [ 781.143944][ C0] DR0: 0000000000000000 DR1: 0000000000004e03 DR2: 0000000000000000 [ 781.143955][ C0] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 781.143967][ C0] Call Trace: [ 781.143975][ C0] [ 781.143986][ C0] ? mas_wr_store_entry+0xc76/0x27b0 [ 781.144019][ C0] ? unwind_next_frame+0xa5/0x23d0 [ 781.144045][ C0] ? unwind_next_frame+0xa5/0x23d0 [ 781.144065][ C0] lock_acquire+0x107/0x340 [ 781.144083][ C0] ? unwind_next_frame+0xa5/0x23d0 [ 781.144108][ C0] ? unwind_next_frame+0xa5/0x23d0 [ 781.144129][ C0] ? dup_mmap+0x870/0x1b80 [ 781.144147][ C0] ? unwind_next_frame+0xa5/0x23d0 [ 781.144167][ C0] unwind_next_frame+0xc2/0x23d0 [ 781.144188][ C0] ? unwind_next_frame+0xa5/0x23d0 [ 781.144212][ C0] ? unwind_next_frame+0xa5/0x23d0 [ 781.144233][ C0] ? vm_area_dup+0x2b/0x680 [ 781.144249][ C0] ? dup_mmap+0x870/0x1b80 [ 781.144265][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 781.144296][ C0] arch_stack_walk+0x11c/0x150 [ 781.144320][ C0] ? dup_mmap+0x870/0x1b80 [ 781.144339][ C0] stack_trace_save+0x9c/0xe0 [ 781.144367][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 781.144397][ C0] ? stack_depot_save_flags+0x33/0x810 [ 781.144431][ C0] kasan_save_track+0x3e/0x80 [ 781.144449][ C0] ? kasan_save_track+0x3e/0x80 [ 781.144508][ C0] ? __kasan_slab_alloc+0x6c/0x80 [ 781.144527][ C0] ? kmem_cache_alloc_noprof+0x37d/0x710 [ 781.144555][ C0] ? vm_area_dup+0x2b/0x680 [ 781.144572][ C0] ? dup_mmap+0x870/0x1b80 [ 781.144609][ C0] __kasan_slab_alloc+0x6c/0x80 [ 781.144628][ C0] ? kmem_cache_alloc_noprof+0x230/0x710 [ 781.144656][ C0] kmem_cache_alloc_noprof+0x37d/0x710 [ 781.144684][ C0] ? vm_area_dup+0x2b/0x680 [ 781.144703][ C0] vm_area_dup+0x2b/0x680 [ 781.144723][ C0] dup_mmap+0x870/0x1b80 [ 781.144747][ C0] ? __pfx_dup_mmap+0x10/0x10 [ 781.144764][ C0] ? copy_mm+0x131/0x4b0 [ 781.144793][ C0] copy_mm+0x13c/0x4b0 [ 781.144814][ C0] copy_process+0x165d/0x3950 [ 781.144839][ C0] ? copy_process+0x915/0x3950 [ 781.144863][ C0] ? __pfx_copy_process+0x10/0x10 [ 781.144888][ C0] kernel_clone+0x21e/0x820 [ 781.144912][ C0] ? __pfx_kernel_clone+0x10/0x10 [ 781.144943][ C0] __x64_sys_clone+0x18b/0x1e0 [ 781.144967][ C0] ? __pfx___x64_sys_clone+0x10/0x10 [ 781.145003][ C0] do_syscall_64+0xec/0xf80 [ 781.145023][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 781.145041][ C0] ? trace_irq_disable+0x37/0x100 [ 781.145066][ C0] ? clear_bhb_loop+0x60/0xb0 [ 781.145087][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 781.145105][ C0] RIP: 0033:0x7f1b92ee4636 [ 781.145121][ C0] Code: 89 df e8 6d e8 f6 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 52 89 c5 85 c0 75 31 64 48 8b 04 25 10 00 00 [ 781.145137][ C0] RSP: 002b:00007ffdb0001980 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 781.145156][ C0] RAX: ffffffffffffffda RBX: 00007ffdb0001988 RCX: 00007f1b92ee4636 [ 781.145171][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 781.145182][ C0] RBP: 000055a42723cc30 R08: 0000000000000000 R09: 00000000000000d0 [ 781.145195][ C0] R10: 00007f1b92d4af50 R11: 0000000000000246 R12: 000055a42724afc0 [ 781.145208][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 781.145229][ C0] [ 781.601894][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 781.608885][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 781.619610][ T31] Tainted: [L]=SOFTLOCKUP [ 781.623968][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 781.634209][ T31] Call Trace: [ 781.637534][ T31] [ 781.640497][ T31] vpanic+0x1e0/0x670 [ 781.644574][ T31] panic+0xb9/0xc0 [ 781.648350][ T31] ? __pfx_panic+0x10/0x10 [ 781.652813][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 781.658241][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 781.664467][ T31] watchdog+0xfdf/0xfe0 [ 781.668688][ T31] ? watchdog+0x20a/0xfe0 [ 781.673088][ T31] kthread+0x711/0x8a0 [ 781.677215][ T31] ? __pfx_watchdog+0x10/0x10 [ 781.682039][ T31] ? __pfx_kthread+0x10/0x10 [ 781.686688][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 781.691948][ T31] ? __pfx_kthread+0x10/0x10 [ 781.696603][ T31] ret_from_fork+0x510/0xa50 [ 781.701255][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 781.706419][ T31] ? __switch_to+0xc9e/0x1480 [ 781.711203][ T31] ? __pfx_kthread+0x10/0x10 [ 781.715863][ T31] ret_from_fork_asm+0x1a/0x30 [ 781.720707][ T31] [ 781.724379][ T31] Kernel Offset: disabled [ 781.729080][ T31] Rebooting in 86400 seconds..