last executing test programs: 6m28.629295034s ago: executing program 0 (id=271): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}, 0x1, 0x0, 0x0, 0x4004050}, 0x800) recvmmsg(r0, &(0x7f0000007700), 0x318, 0xfc0, 0x0) 6m27.315979086s ago: executing program 0 (id=277): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10) r3 = socket$inet(0x2, 0x3, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000100)={0x2, 0x1bd, @loopback}, 0x10) listen(r5, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x0) mount(&(0x7f0000000300)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000200)='./cifs\x00', &(0x7f0000000400)='cifs\x00', 0x0, &(0x7f0000000500)='vers=1.0,user=root,pass=root\x00') setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000100)="890704b3771c16d355840f4e1489c2ce0596e0835d610400385cecb517a1a0c2b8c2c064bd3253e3ee7f28b562a24355f088e42ef567cadddbb9123f922de6a72cf8df0950b4f8a98f332bdbf8cea9628763708efd4f4da8758b8f226d184dff8b1544d4e7ba807ad5ef2754bc0c7e2e864965f60c981e52284e9be62e0e967ad68e732254637f82eeb8ca469a6b2678fa8dd73c4829472a6c514c86fdc7fcf0104d065f5f10413797a794439a4effb5f5eea130048c34f45f8730ad", 0xbc) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) write(0xffffffffffffffff, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(0xffffffffffffffff, &(0x7f0000000900), 0x100) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000001c0)=[r4, r3, r1, 0xffffffffffffffff, r2, r0, r0, r2], 0x8) close_range(r4, r4, 0x2) 6m24.776753668s ago: executing program 0 (id=283): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000003540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)={0x48, r1, 0x1, 0x470bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME={0x2a, 0x33, @assoc_req={{{0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1}, {0x2}, @device_b, @broadcast, @initial, {0x2, 0xfff}}, 0x600, 0xab0, {0x0, 0x6, @default_ibss_ssid}, @val, @void}}]}, 0x48}}, 0x8800) 6m24.6690548s ago: executing program 0 (id=285): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) 6m24.605222531s ago: executing program 0 (id=286): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x21) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r3, 0x800455cc, 0x1) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, 0x0) write(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) dup(r2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x800) 6m24.038946035s ago: executing program 0 (id=293): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = open(&(0x7f0000000180)='.\x00', 0x222400, 0x120) fcntl$getflags(r0, 0x1) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = gettid() ptrace$ARCH_GET_CPUID(0x1e, r1, 0x0, 0x1011) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mkdir(0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./pipefs\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sec\x00', &(0x7f0000000100)='securityfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r4, &(0x7f0000000300)=' /new_domain\nfile read /etc/passwd task.uid=0 task.eui!=0\n', 0x42) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x100, 0x103) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}) read$FUSE(r5, 0x0, 0x0) write$FUSE_INIT(r5, &(0x7f0000000180)={0x50, 0x0, 0x0, {0x7, 0x2b, 0xffffffde, 0x318145a8, 0x0, 0xfffe, 0x2, 0xfffffff6, 0x0, 0x0, 0x8, 0x100}}, 0x50) close(r5) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./sec/tomoyo/domain_policy\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000) chown(0x0, r6, 0x0) 6m23.549658017s ago: executing program 32 (id=293): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = open(&(0x7f0000000180)='.\x00', 0x222400, 0x120) fcntl$getflags(r0, 0x1) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = gettid() ptrace$ARCH_GET_CPUID(0x1e, r1, 0x0, 0x1011) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mkdir(0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./pipefs\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sec\x00', &(0x7f0000000100)='securityfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r4, &(0x7f0000000300)=' /new_domain\nfile read /etc/passwd task.uid=0 task.eui!=0\n', 0x42) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x100, 0x103) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}) read$FUSE(r5, 0x0, 0x0) write$FUSE_INIT(r5, &(0x7f0000000180)={0x50, 0x0, 0x0, {0x7, 0x2b, 0xffffffde, 0x318145a8, 0x0, 0xfffe, 0x2, 0xfffffff6, 0x0, 0x0, 0x8, 0x100}}, 0x50) close(r5) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./sec/tomoyo/domain_policy\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000) chown(0x0, r6, 0x0) 4m27.840016441s ago: executing program 2 (id=632): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYBLOB="35874207", @ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYRES32=r1, @ANYBLOB="66c429ef2213efc5a9e19ed391a9ab9eb0ac746698e78eee56fd2fc3b72a3c615b2925736f0184a847df38881ee2a6c0f58f56ab060993d19aa5bca04f976c695a50483577bec1c3bbd87ec0fdef561b93105bf1a29df22cad5b7e304aa83db432ab304df9c21268c812e566f8a8821144c1373a01f70d9cf5fbede22020e6e4fc87ce84363335985b96e0c1af57f61e7222782beb358c3a4f9ab1ba9b5db8fe321dcb97f2490aebc07ddaba7e2f3e38d7c88749e3eb8b60717aa17e1e7e4bdf15209641feafdaaa416b2f7aa8d25f6271d127c8afedbe0bd4e2bfef888dda68f6ba4717cc949f632c28c2161cea50dc81934a", @ANYRES16=r1, @ANYRES16], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r5 = getpgrp(0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r7 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r7, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r7, 0x0, 0x0) mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/ncm.usb0/os_desc/interface.ncm/sub_compatible_id\x00', 0x0, 0x0) 4m21.70543451s ago: executing program 2 (id=641): openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x1, &(0x7f0000000100)) syz_open_procfs(0x0, &(0x7f0000000140)='mounts\x00') sched_setscheduler(0x0, 0x1, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x1c, r2, 0x701, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x7ffffffe}, 0x24008000) 4m18.604474645s ago: executing program 2 (id=649): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000000000040050bbe1a00000000000109022400010000e80b0904000001030002000921fd7f000122e30109058103"], 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) r2 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) listen(r2, 0x9) r3 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r3, &(0x7f00000000c0)="ab", 0xfffd, 0xc1, &(0x7f0000000280)={0x2, 0x4e22, @loopback}, 0x10) readv(r1, &(0x7f0000000b40)=[{&(0x7f0000000cc0)=""/154, 0xfdef}, {0x0}, {0x0}], 0x3) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000140011f225bd7000fddbcf250284", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0x40) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) 4m13.905200199s ago: executing program 2 (id=662): r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000e7cc6120c4108a81ad7d0102030109021b00010000c005090423000103"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000100)=ANY=[@ANYBLOB="000c03"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) 4m9.051660737s ago: executing program 2 (id=672): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0xc8948000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0x6, 0x4, 0x1010, 0x89}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000840)={0x0, &(0x7f0000000000)=""/106, &(0x7f0000000340)="9ae7176fcfa6c9cdf18eb88343cc26f92a506e3aa151e2e908feb05bc394cab9da1dd7c7a678a6498484418bedbfbe3391047018ef9c370565215e157af7b258232ac3146bac994b8f2c41651ae16d8c6f0fe6bcb59ec0eef36e3b689089909c2e7f1a8313c110b1f24cad9e6521a7e663f6a93837c6a788d64276d9ab436115511a93a9b20802beca7b8ebfbec9f3bcdbafec565ed7adf31c7375952906b7c3b2c76fa83df3899e92e1c7346f81e34a5d318f8a5cbc45478fcb87a873a5c090a350477fed6d6e4380031f71a5b8a9454ac05a5d4b649a3b7c2fced54fd75b5113b366090a7847b5224e5bb21e5372ab7baf080d0dd4c355397dc3a4c49a0ebc55b286f3b045e69da691e8b2f151f7d648e8191a52b23d8e88344828b9c297e7cf1790cdf5da20f6ab3bf4d9ec32e8fd871ee0abba0b7f2b373e83923a2a6c43", &(0x7f00000004c0), 0x80, r5, 0x0, 0x7}, 0x38) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="8000", 0x2, 0x48840, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) 4m7.007833337s ago: executing program 2 (id=675): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) socket$key(0xf, 0x3, 0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) 3m51.354491176s ago: executing program 33 (id=675): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) socket$key(0xf, 0x3, 0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) 2m49.806380556s ago: executing program 4 (id=931): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40840) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000100)={0x88, r4, 0xacf5e67dd0b583a1, 0x4000000, 0x0, {{0x5}, {@val={0x8}, @val={0xc, 0x99, {0x2000000, 0x5d}}}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x5f, 0xe, {{{0x0, 0x2, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x9}, @device_b, @device_a, @random="ec03f3b85ad3", {}, @value=@ver_80211n={0x0, 0x2, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1}}, 0xffffffffffffffa1, @default, 0x0, @val={0x0, 0x6, @default_ibss_ssid}, @void, @val={0x3, 0x1}, @val={0x4, 0x6, {0x1, 0x2, 0x2, 0x1000}}, @val={0x6, 0x2, 0x8343}, @void, @void, @val={0x2a, 0x1}, @void, @void, @val={0x72, 0x6}, @val={0x71, 0x7, {0x81, 0x0, 0xffffffffffffffff, 0x1, 0x1, 0x4, 0x61}}, @val={0x76, 0x6, {0xf, 0xf4, 0x22, 0x4}}}}]]}, 0x88}, 0x1, 0x0, 0x0, 0x8810}, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r3) 2m48.789065851s ago: executing program 4 (id=933): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c0c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xf809, 0x2, 0x0, 0x42}, &(0x7f0000000400), &(0x7f0000011000), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r3, 0x6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000540), 0x0}, 0x20) 2m46.309300721s ago: executing program 4 (id=942): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000005fc0)={@remote, @private0={0xfc, 0x0, '\x00', 0x41}, @empty, 0x7, 0x7fff, 0x3d, 0x500, 0x5, 0x19c0000}) 2m45.95130299s ago: executing program 4 (id=946): io_uring_setup(0x1, &(0x7f0000000100)={0x0, 0x0, 0x1000, 0x0, 0x13, 0x0, 0xffffffff}) syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/cpu/cpuidle/current_governor\x00', 0x2, 0x0) write(r0, &(0x7f0000000380), 0x0) socket(0x10, 0x3, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, 0x0, 0x0, 0x8, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x4040050) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r2, 0x0, 0x4000000) chroot(&(0x7f0000000480)='./sys\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='./file0/../file0\x00') 2m43.89726136s ago: executing program 4 (id=952): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c0c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xf809, 0x2, 0x0, 0x42}, &(0x7f0000000400), &(0x7f0000011000), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r3, 0x6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000540), 0x0}, 0x20) 2m43.603791837s ago: executing program 4 (id=955): socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0xffffff1f, 0x70bd26, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8008, 0x4408}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x8, 0x2, @multicast2}]}}}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x84) 2m43.53747897s ago: executing program 34 (id=955): socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0xffffff1f, 0x70bd26, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8008, 0x4408}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x8, 0x2, @multicast2}]}}}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x84) 2m41.185866367s ago: executing program 5 (id=965): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002", 0x5) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, 0x0, 0x6) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x7, 0xe1, 0x200, 0xfc000004, 0x7, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x6, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x0, 0x8a, 0x79, 0x2, 0x10080, 0xfffffffe, 0x83f4, 0x129, 0x1, 0x16, 0x8, 0x2, 0x401, 0x1, 0x405, 0x0, 0x880, 0x9, 0xf9a6, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x2000007, 0x489, 0x7ff, 0x4, 0x4007b, 0xffffffff, 0x1, 0x2], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x8, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0xac12, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x7, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffff7fff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x3ff], [0x2, 0x4, 0x9, 0xc, 0x0, 0x2e6bf783, 0x80000001, 0x5, 0x40000005, 0x48e, 0x9, 0x200026, 0x7f, 0x403, 0x102, 0x1, 0x41, 0x6, 0xee4e, 0x2000104, 0x1, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x2, 0x400, 0x8, 0x5, 0xd2, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x9, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x4, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfe, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x3, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x2, 0x140f1, 0x5396, 0x4, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x80000000, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x2, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x1, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) capset(0x0, &(0x7f00000003c0)={0x5, 0x5, 0x80, 0x1, 0x1, 0x1}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$NILFS_IOCTL_DELETE_CHECKPOINT(r3, 0x40086e81, &(0x7f00000001c0)=0x5) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x2000000035, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x5, 0xef, 0xd, 0x7fffffffffffe, 0xcd3, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB="bf"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 2m39.41413363s ago: executing program 5 (id=970): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) ptrace$ARCH_GET_CPUID(0x1e, 0x0, 0x0, 0x1011) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket(0x10, 0x3, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x100, 0x103) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r2, &(0x7f0000004280)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000180)={0x50, 0x0, r3, {0x7, 0x2b, 0x177, 0x40e00c0, 0x0, 0x800, 0x6, 0xfffffff6, 0x0, 0x0, 0x8, 0x100}}, 0x50) close(r2) chown(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r4) r5 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) r6 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000000)={'syz', 0x2}, 0x0, 0x0, r5) add_key(&(0x7f00000007c0)='asymmetric\x00', 0x0, &(0x7f0000000d80)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657930820222300d06092a864886f70d01010105000382020f003082020a028202eeffccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04003000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a9862b5d6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7618bbaba553f3c08c1965b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f262", 0x559, r6) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_ACTIVATE(r7, 0x4b4a, 0x100000600081009) readv(r4, &(0x7f0000000180)=[{&(0x7f0000000040)}, {&(0x7f0000000100)=""/70, 0x46}], 0x2) mount(0x0, 0x0, &(0x7f0000000000)='proc\x00', 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x20605) 2m38.971106721s ago: executing program 5 (id=971): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) ptrace$ARCH_GET_CPUID(0x1e, 0x0, 0x0, 0x1011) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket(0x10, 0x3, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x100, 0x103) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r2, &(0x7f0000004280)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000180)={0x50, 0x0, r3, {0x7, 0x2b, 0x177, 0x40e00c0, 0x0, 0x800, 0x6, 0xfffffff6, 0x0, 0x0, 0x8, 0x100}}, 0x50) close(r2) chown(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r4) r5 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) r6 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000000)={'syz', 0x2}, 0x0, 0x0, r5) add_key(&(0x7f00000007c0)='asymmetric\x00', 0x0, &(0x7f0000000d80)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657930820222300d06092a864886f70d01010105000382020f003082020a028202eeffccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04003000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a9862b5d6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7618bbaba553f3c08c1965b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f262", 0x559, r6) ioctl$VT_ACTIVATE(0xffffffffffffffff, 0x4b4a, 0x100000600081009) readv(r4, &(0x7f0000000180)=[{&(0x7f0000000040)}, {&(0x7f0000000100)=""/70, 0x46}], 0x2) 2m37.801636849s ago: executing program 5 (id=973): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000018c0)=@newtfilter={0xf54, 0x2c, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x9}, {0x3, 0x2}, {0xfff8, 0x9}}, [@filter_kind_options=@f_route={{0xa}, {0xf24, 0x2, [@TCA_ROUTE4_POLICE={0xc44, 0x5, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0xa, 0x7fff, 0x5, 0x9601, 0x47, 0x2, 0x80, 0xa8, 0x684, 0x2, 0x2, 0x5, 0x3ff, 0x1, 0x6, 0xff, 0x9, 0x3, 0x4, 0xfffffffe, 0x6, 0x7fffffff, 0x3, 0x0, 0x9, 0x4, 0x1, 0x8, 0x80000000, 0x0, 0xfff, 0xffffe982, 0x5, 0x5, 0x9, 0x6, 0xffff, 0x2, 0x7, 0x7f, 0x19, 0x5, 0x8, 0x0, 0x2, 0x1, 0x6, 0x10, 0xe4, 0x732, 0xe, 0x4, 0x7, 0x8000, 0x4, 0x4, 0x8, 0x7, 0xffffffff, 0x6, 0x5, 0x3, 0xb, 0xa3, 0x7, 0x5, 0x10001, 0x5, 0x10000, 0x7fff, 0x7, 0x3, 0x7, 0x9bf, 0x1, 0x6, 0x7, 0x6, 0x8001, 0x9, 0x6, 0x8, 0x6, 0x9, 0x51a, 0x4, 0x3, 0x5, 0x1, 0x81, 0x4, 0x6, 0x40, 0x1, 0x80000001, 0x1, 0xfffffffb, 0x0, 0x5, 0x13d1, 0x8, 0x1bc, 0x6f, 0x7, 0x4, 0xe, 0x6, 0x4, 0x7, 0x3, 0x9, 0x3, 0x6, 0xfffffff8, 0x3b, 0x5, 0x5, 0x1, 0x5, 0x800, 0x6, 0x4, 0x4, 0x4, 0xfffffff7, 0xfc10, 0x25, 0x101, 0x838, 0x7ff, 0x7f8, 0xffff, 0xd83f, 0x23, 0x80000001, 0xeb8, 0x5, 0x91, 0x89, 0x9, 0x1, 0x3, 0x1, 0x8, 0x7, 0x8, 0x1, 0xffffffff, 0x1, 0x7, 0x1, 0xffffe26b, 0x80000000, 0x7fffffff, 0x7, 0x8, 0x4, 0x1000, 0x800, 0x4, 0x6, 0x1000, 0xfff, 0x0, 0x48000000, 0x5ae, 0x2e30, 0x2, 0x7fffffff, 0x3ac, 0x2, 0x6, 0x1, 0x40000000, 0x3, 0x4, 0x800, 0x10, 0x7, 0x7, 0xffffffb7, 0xfa80, 0x8, 0xe, 0x4a, 0x0, 0x8001, 0x0, 0x2008, 0x80000001, 0x5, 0xff, 0xf1, 0x8284, 0x2ee, 0x8a, 0x9, 0x200, 0x23, 0x20, 0x6, 0xff, 0x9, 0xbfdd, 0x7, 0x8, 0x401, 0x401, 0xc10b, 0x1, 0x9, 0x8, 0x9, 0xc, 0x0, 0x400, 0xffffffff, 0x8001, 0x8, 0x6a8c, 0x40, 0x0, 0x1, 0x100, 0xfffffffa, 0x8, 0x9, 0x8, 0x9, 0x0, 0x80000001, 0x3, 0x8, 0x0, 0x8, 0x9, 0x8, 0x7, 0x3, 0x90d8, 0x0, 0x9, 0x80000000, 0x5, 0x3, 0xb, 0x4, 0x6, 0x844, 0x2, 0x401, 0x200, 0xffffffff, 0x6, 0x8, 0x3]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x5}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x100}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x2, 0x8, 0x4, 0x3c1, 0x4, 0xb, 0x1, 0x4, 0x1, 0x81, 0x8, 0x86, 0xfffffffa, 0x9, 0x1, 0x1ff, 0x7, 0x99ac0, 0x1000, 0x5, 0x6d, 0x7, 0x8, 0x8f1, 0xfffff1e5, 0x80, 0x5, 0xffff8000, 0x200000, 0x10001, 0x4, 0x4, 0x4, 0x95, 0xd, 0xe8a, 0x3, 0x0, 0x52d, 0xed, 0x8, 0x13d69f1d, 0x400, 0x5, 0xbe4d98d, 0x5, 0x6, 0x0, 0x4, 0x195, 0x0, 0x8001, 0x8, 0x16, 0x0, 0x0, 0x200, 0x7f, 0xa65, 0x4, 0x7ff, 0x6, 0x4, 0x6, 0x4f8c, 0x10, 0x3ff, 0x15f, 0x90, 0x8, 0x6, 0x7, 0x1, 0x3, 0x5, 0x400, 0x4, 0x4, 0x7, 0xa, 0x88a6, 0x1, 0x8001, 0x0, 0xd, 0xa7, 0x1, 0x2, 0x3, 0x8000, 0x1000, 0x7fffffff, 0x6fc8, 0x7606, 0x291, 0x14, 0xfffffffe, 0x5, 0x1, 0x0, 0x3, 0xcbc8, 0x101, 0x7, 0x5, 0x884, 0xfffffff8, 0x9, 0x5, 0x5, 0x8, 0x80000000, 0x6, 0x3, 0x10000, 0x1c000, 0x6, 0x1, 0x1, 0x1, 0x5, 0x10001, 0x9, 0xffffffff, 0x101, 0x2, 0x7fffffff, 0xa79, 0x2, 0x2040000, 0x3, 0x400, 0x1, 0x1, 0x13e, 0x4, 0x4, 0x6, 0x1, 0x1, 0x8000, 0xcb, 0x3, 0xc, 0x5, 0x400, 0x0, 0x86, 0x7, 0x10001, 0x9, 0x500000, 0xfff, 0x0, 0x0, 0x6f65, 0x0, 0x0, 0x5, 0x0, 0x2, 0x4, 0xe5b7, 0x7, 0x1, 0x9, 0x0, 0x2, 0x4, 0xdfc, 0x4fb5, 0x2, 0x35d, 0x9, 0x4, 0x9, 0x101, 0x7, 0x0, 0x393, 0x6, 0x4, 0x1000, 0x1, 0x5b94c4b2, 0x6, 0x1000, 0x6, 0x1ea0b96e, 0x6318, 0x4, 0x0, 0x401, 0x5, 0x7f94, 0x1, 0x1e6, 0x1, 0x4, 0x31c4, 0x1, 0x1000, 0x400, 0xa9cd, 0x2, 0x0, 0x8, 0x9, 0x200, 0x2, 0x4de, 0x2, 0x7818, 0x22, 0x200, 0x7, 0x7, 0x2, 0xfffffffa, 0x2, 0x0, 0x6, 0x7, 0x101, 0xa26, 0x6d6e, 0x0, 0x4, 0x3, 0xff, 0x85, 0xffffa54b, 0x7, 0x80, 0xffff, 0xc, 0x0, 0xff, 0x0, 0x2, 0x2, 0x7, 0x1, 0x3, 0x4, 0x7, 0x6, 0x3, 0x2, 0x80000000, 0x3, 0x4e9e, 0x98, 0xae, 0x0, 0xe]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x7}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x800}, @TCA_POLICE_RATE={0x404, 0x2, [0x8, 0x1, 0x3, 0xffffffff, 0x0, 0x9, 0x9, 0x1, 0x40, 0x9, 0xda, 0x4, 0x5, 0x83e2, 0x73, 0x0, 0xba, 0x7, 0xed05, 0x6, 0x490, 0x9, 0xdd02, 0x9, 0x0, 0x1ff, 0x7f, 0xe6, 0x8, 0x7, 0x8f, 0x2, 0x9, 0x0, 0x3, 0x1, 0x1000, 0x7, 0xfffff800, 0xffff, 0x5, 0x8, 0x4, 0x10000, 0x1, 0x10001, 0x3, 0x80000000, 0x8, 0x4, 0x1, 0x5, 0xffff8d70, 0x4, 0x6, 0xcec7, 0x5, 0x80, 0xfffffff9, 0x2c, 0x4, 0x2, 0x5, 0x1a00000, 0x0, 0x5, 0x22, 0x2, 0x5, 0x3, 0x9, 0x3, 0x7, 0x3, 0x6, 0x5, 0x80000000, 0x4, 0x9, 0x8, 0x0, 0x0, 0x77, 0x6, 0x81, 0xb22, 0xff, 0xa, 0xfffffffa, 0x1000, 0x7f, 0x2, 0x9, 0x0, 0x3c, 0x5, 0x41, 0x5e, 0x7, 0x9, 0xa89a, 0x5, 0x80, 0x9, 0x969e, 0x3, 0x2, 0x4, 0x3, 0x3, 0x3, 0x6, 0x0, 0x7b3a, 0x6, 0x4, 0x4, 0x4, 0x8, 0xc7, 0x9, 0x400, 0xd81a, 0x9, 0xc, 0x0, 0x3, 0xc, 0x7fffffff, 0x40, 0x77, 0x200, 0xfffffff8, 0x4, 0x7, 0x1, 0x10000, 0x7, 0x1, 0x0, 0x5c6, 0x4, 0xffffff80, 0x9, 0x0, 0x2, 0xfffffffa, 0x401, 0x4, 0x1, 0xb9, 0x7, 0x4, 0x0, 0x2, 0x28, 0x80000001, 0x7, 0x4, 0x3, 0x800, 0xffffffff, 0x1, 0x6, 0x5, 0x100, 0x7, 0x7f, 0xd, 0x6, 0x80000000, 0x2, 0x40, 0x4, 0x3, 0x7, 0x886, 0x1, 0xf, 0x1000, 0x3, 0x40, 0x41, 0x6, 0xd, 0x8, 0x9, 0x8, 0x7, 0x200, 0xfffeffff, 0x3c, 0x80, 0x1, 0xf7a8, 0x7, 0x2, 0x8, 0xfffff917, 0xff, 0x6, 0x1, 0x2, 0xb, 0x7, 0x0, 0x8, 0x32c, 0x5, 0x200, 0x1, 0x8, 0x7, 0x1, 0x7, 0x1, 0x0, 0xcfc, 0x6, 0x9, 0x6, 0x2, 0x3732, 0x400, 0x5, 0x9, 0x6f9, 0xc, 0xe6bd, 0xa5, 0x7, 0x800, 0x3, 0x100, 0x7fff, 0x2, 0x9d8, 0x7, 0x0, 0x0, 0x64, 0x5, 0x7, 0x3, 0xea, 0x7, 0x9, 0xb4, 0x7fff, 0x3f, 0x2, 0x8, 0x2, 0x40, 0x0, 0x1]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x10000}]}, @TCA_ROUTE4_ACT={0x2dc, 0x6, [@m_simple={0x8c, 0x14, 0x0, 0x0, {{0xb}, {0x34, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x7, 0xb, 0x6, 0x7, 0xf}}, @TCA_DEF_PARMS={0x18, 0x2, {0x6, 0x3, 0x1, 0x5, 0x85f}}]}, {0x2d, 0x6, "1c8f2244ff323e5107199b7d50f99bdff64d556dd8b6ff1fde1a46e5f6bd970eb81c72cb5d1e64fe3c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x6, 0x1}}}}, @m_skbmod={0x9c, 0x12, 0x0, 0x0, {{0xb}, {0x6c, 0x2, 0x0, 0x1, [@TCA_SKBMOD_DMAC={0xa, 0x3, @remote}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x80, 0xf43, 0x10000000, 0x9, 0x5}, 0x9}}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0xec, 0x101, 0x4, 0x5, 0x3}, 0x10}}, @TCA_SKBMOD_SMAC={0xa, 0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x4812d917c52f750d}}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x2}]}, {0x7, 0x6, '_yj'}, {0xc, 0x7, {0x1, 0x9faae5589fa2f024}}, {0xc, 0x8, {0x2, 0x6}}}}, @m_ife={0xd8, 0x1f, 0x0, 0x0, {{0x8}, {0x50, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @broadcast}, @TCA_IFE_SMAC={0xa, 0x4, @multicast}, @TCA_IFE_SMAC={0xa, 0x4, @broadcast}, @TCA_IFE_DMAC={0xa, 0x3, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, @TCA_IFE_TYPE={0x6, 0x5, 0x5}, @TCA_IFE_DMAC={0xa, 0x3, @local}, @TCA_IFE_TYPE={0x6, 0x5, 0xb}]}, {0x63, 0x6, "f5e50e1636e08eb40c704b7588dbd577e5231d2bf2f54616502487a8c0e1c35ee1cfecb9a2c4cefbca2d1ef21cdac997d36fc8ea2d16665f926750d0f5616275276c999cfeff615ffce5778f96349d6e47a7a3cccdb5a762f7f4edcb93936b"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}, @m_gact={0xd8, 0x1b, 0x0, 0x0, {{0x9}, {0x4c, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x0, 0x1e24, 0x10000000}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0x13e5, 0x1}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0x5dc, 0x7}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0xbf, 0x10000000}}, @TCA_GACT_PROB={0xc, 0x3, {0x0, 0x2510, 0x4}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0x25f4, 0x3}}]}, {0x64, 0x6, "17dd44dbf3658836d4ef43aa6ebbc9d66fa4da5e52d7e7b36be6cf1688713aa3954b601c9ac6dd41e25a98e19263bc4090d1e0077b55c65cc9c5b290b6cbf0bbc85d91d4d3507418ad0426a0a7dcac327d454574bc8a95d50715d5e520ad978e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x2}}}}]}]}}]}, 0xf54}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000001880)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000640), 0xf501, r0}, 0x38) 2m36.429115563s ago: executing program 5 (id=976): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20}, {0x8, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) mq_open(&(0x7f0000000040)=']\x00', 0xdd326361bc84707c, 0x4, 0x0) r2 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r2, 0x8982, &(0x7f0000000100)={0x8, 'macvlan1\x00', {'veth1_to_bond\x00'}}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000240)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0xa, {[@global=@item_4={0x3, 0x1, 0xe, '\a\x00'}, @main=@item_4={0x3, 0x0, 0xa, "e811e23b"}]}}, 0x0}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) close(0x3) mkdirat(0xffffffffffffff9c, 0x0, 0x1c1) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc2c45512, 0x0) prctl$PR_MCE_KILL(0x42, 0x1, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x1, 0x5, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}, 0x1, 0x0, 0x0, 0x4004050}, 0x800) recvmmsg(r4, &(0x7f0000007700), 0x318, 0xfc0, 0x0) sendmsg$nl_xfrm(r1, 0x0, 0x2c000010) socket$nl_xfrm(0x10, 0x3, 0x6) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) syz_usb_control_io$uac2(0xffffffffffffffff, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4}}}, &(0x7f0000000480)={0x44, &(0x7f0000000200)={0x0, 0x9}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2m35.605836713s ago: executing program 5 (id=978): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x101042, 0x15) syz_clone(0x2000, 0x0, 0x0, 0x0, 0x0, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000440)={0x8, {"77b7cb7d9c4a8c4dc078e5186e5878eb2a4c66c7249cd95fe846e14abfacf66ca7584a26186075be2f6f0f57c6e96e096030bf0d2743671ae99cfd1217d1155f6df84c5d319ba1cbc143338007a959578a6f02b6f71ccdb3c53c887d1dc88f43004c4e2a3f730458798221cb214f6e4a9ddee49e0915bf5fc2d0218565fae733bea8d793eb63de1f0dc73a0ecebecbfc55a9ce41d0638cd3ffd993f6b2ef4031103e6103302c056421bbc500ece3fea7e0c64354e661f62e42658c9d85e7d81c66a345b78103702bb92c4d265115148e2345871be8a79a8d215c6d373c9801dd002cf19b0a0da82e8f73561d151a6e521732b2d26d05157bbc7aaa1c85425d5a2aa0727ee702a1f73694cf2f0ff637ea909b418c461be78e4b3646c12beef1476048250388f2720e353483469196cdea3f338e4cb778009b5e596fb05fa861d9879538a8c575e94a10d775280767f19e77992dd21a47469e995e1052ae29a62c18586d28714d340168597127184062c76d3be77c3584d679472574a098a19efb1e875f23ac16d1732edb57693fc22b04fc601a2623c4f939568d775f84a4e2ffca8f0c5f33d81a347326bb3024d9bd2e16b8a26d21150b39bb0a660b61211f3a312c22af37062298d0a2d6162fe692eb363e988db75429999c1f0792feae2084db70d6c91f333f40b41474fa7a1a97232b656ff9ec473a33d28c74cd5777b8900aab3a64924659d7ccfb02a7a63194d6c998260a85e5f38723f4b6f9c69d67c4f4b8a88852351ade349e4e863b0813eb4a6ab01e5fcd70642c12877b992fdbea27399387ec666542f094648e63e5ade537a75824b41df207f94795427f023469564217c91ca69506177e767eaa2714d0787f2092c54bad1d474aa431d40ead0a20b76200ddab4305e8577c3b8907abfe2cde9487671431ba0f2bed6f3b542299fc49be4bc1c590bb7c8a0e7f09ddfb6d6ecc46037b008bdf70fba4d8f8b41dbd7a65e3e2e1266d85bbdcd5885bcf6bbc1815ca2cc4f765e468f1273b11171a50930ed184f196733660d72ed650caaa762daab1a62cac073e19470b27eabb4ca8618d68a026f2ac5bef988c61b0561f99564e0021c688749c3c5999878e7f4dfb790f4fa80df610adb3701b070edb2b8a097cd39130edc33c3aa1d58a1e3ce614183c06ba2c07fc00d7822f9d950882f31cd90c008d02e122bd9bb0ead0c140d885aa2640275615289cc877a538b7ecc50497cf5de50435e13c5e3fa26d9c6e75199e83a9843759e252cb9136c8a1f9ec3eae031a78dd47a15f5707dce4eae0329465875afd515e42928454f5d72cf399322a1bd893086429198cdcbca8af0913c6dcf4b851b002f439e223bd195b7c8af961e11866b79fb4aa307c6e29f9cb8a4478397742956a93c0c05b67fe3d1c16b0ae34f549ead0cac4d836b27a33c975063a09e57e46e07a65d4783001a7e9636004fb8ab5312b676655a4ed83d09050c579fd3727e821453e1370c96e216a843a129d07fc368fadcdbb031ab62f5f07fae045f3c5702d7751af9c50a5b66011798835f302663bcf8c4c5086154e988c9e573e9e46e6d9ae1ec042561b65970970acb4ab251bde381d52c23d429f7be17dad20229200e26a7f8be47bab8188b8e0c9bde276f49c85f5d9462a65a38b2026d136f080de203836c3e56bc291d018d9ec893c77ef59578927c7d3f70c9649dc49f4387f290f7ba8900b87e3bd808293e66eba04fecd493edd14f7cbc6659c425c62bfc4a9bc870b276c0675d4f8f869d800a08b74507abfad3096bc20d619606ef9f6bbd9a64d54d258409076a038414c3d85e50a26517609ad70e51e6564c843e7dcb022b7e7443cdeffbdef8da96690a5c22f8dcd8936664e81e08871fe920b978e9e706df084fb9253e460a58cb1ac86729fccae46bf5cd6870bf15ec19ee2285be5aec22a6718ae00dd35e7efdb9e780426bb821607b848d1d669611119c055c2a136c991a9385ad1186e2a855e513e5110563c1d0b551603b79195a0f4e684e9ea73f473082477db32e897a8fa32d2c3f26101ded3e7adb62c026a55c2ff2cb1938d18f51f00cdff8ae4d29ae1aca6da3db40a4cdae833782452329921168ff2f15de11f14cf13dc98c5b2a34b4676da9d0b4b1bdf130450f056078c5df032fdf1e9b6e2ff13a208c3b0ba09437b478cfe1f03bfd9318e00f09a8a661436058e35e8ff603399c6c7cc61a95fc5aa5c4d9350d76217c1aa07f88979d1219f08e85899218d4a91ce4dbffc9f22acc700e0796e3b32c8bbae0c87aed5abc6bb9105b88047131b378cd72ff455bfc6996cde8d101629800b0631d16e86ad69d9d6a0ed4700c1297881b6f340ee9b23b6c852f930e3964dac52100078752565a44503c13dcd8dcca8a5bcb917a30e282ad98750254280c058ab8d29cb7535ff38d019a9cc101f9e163ec81cc40cda0277aa52cc71c53548e23e109f06c6504801cf39da201e8ad7be63def9ad0b1263def806e78de3d6f95bfa798024e5d8758136f6b9bd4381dfc57fc6e2c06ee079e72caaed4b40400ac6e79a1459f9965237b4c6b50e9bac50e5b972be701d1d4d83f0098d03313e3d4791928d31fdebbb276920f750d8e38984c720dcf081e3a92240935ca814e03b7b278a6d9615ff91a6bdbcba1fbc900420fb3f8327e617f804417710dfd2bd1dc9a871f694581d03ad751d0144f75b655e0bc4205e17ec3e0e9b052dbad1372778fa623f643f80a7ba4467c267216792df003771a50426d2ec16e5d06f848deaa330b0ae18d941f05186bf35134faa996e5988c211bb50d4783cf7d42ce217d7e6e814327dd5259b57394c8895036f6da2b3577ec98b24a18652df8f173d2adfeec11b708e4d00f9e7c8e27adb01ebfa71362c6117ccdf0b47442958ba9b16688c7cacc94c1630e0a698bf3705406040d7c5717fe7f4db43f912f17ac05a7594835ddec5f10a3e33dd75e2676e22460e5124295740d548323202072c436cb7f78dd4b776e37cded3dc1f327d128b13f4de84eb3a279f597bd833bcdbbedf95c19321ecda0d8efb4dfd9376600f3f0557e49074d3a0f41ec85ffb096dd8a60f1c0f66034d9a2f398c46f6f39f4f481cc8f5c5b95fde87ec48a89bbdd6fd99e92241ec87e54650cbe263f1cf651783a0c5777b5fa503d7a0db5d2f13cf4c3ccfb69fa02af648be2429aa18293fd5ed0c8f589ddb542019f9dc63a9337d6b2c501cc0b3b3cff3eef0c8e78a131d5da50ad384aa7b33139d762bd36e1908bd5cc244a5fe60f8d64dcb17db60eef669d93a2da7559870d52718a88bf86430fd3a89427fe7647745373cdc1333ec11994a3134f862568bd1036d1d2ce45d6f4a441ca108caa44d3d194bca6829bcc56fc54b7d7654b778e4c4f6c500870c7dbd5295d9db78994434bef2912f9ee8ca776a2f7b7b06e05cf82adc7e3e07207a914d7d4de8761ea6d18caf463280f35945bc3093e42f43f4ce7dd95bcdd9539cb32f8398f080334f75de1892056456dd928d9d0a1e8170afcc5e49d023db01af37d5a1696de872f3fe21da4d517b3158c7a8a12dc164c0890e35fc32c4b046e4110c158489bbdc4094a1c0b421ca6c9a9ed3bf301cf82459d41ac0dddfcc5a83a1eb8fae033558930d558ec7b192a42c5767f5319e2ec071b326224454d3351ad980b12016bb871645fbc270e1d781f9336da82cf6d6652e0369d9c32ef3c3034fc42920f513d2e5d9d2fd55e60f5e3871353f8dd8352cbb191c24930e92827660862ed8f9221d038f15a59c5dbfbf12be1e936c9f4df780390f02eca32119a924edffb3d85acbd166375eb9f4206e8e9dd85bcf7212ce5f7c1abee24939ac36c5fdb3be689ca62671ad51b67bff566527c624611cdcba5aefce5af0c5c14014bc284f312c0a5b7d3ec8ab46639a3b10ef3d2d85fae2bc13e81de93a495be80affd7c4b193c5b15bb947c24329b84f952c2ed50b4a431abbc780e9684fdfa06a3388f6001da4dd6baaa0fc24ceaf32710742b0062962db5b6bad30ebf7c562f169261e95d1c8240830d750cc5c7d120a07e5100abdf20fa8303ed8251a1555ec26848969dfaaa5581df432c04d421020a95997aeca7047e5824ffdd0c4ff171b95337ae58b392d0209e53400f4fc89eb509bb4d52e9292f32ba8bd3094c2f0bd4c4761125404c53db775ec151f9033b3f35621f7152fe59dd5d4548a9e5190b8d3b97a639916600b78c8e4270b05fe1cfb117a2a131f148aeb6773513e877d14b8bca0ffdab520ef19e160898fae8bb77feca3cb370c6753a71b46ea4e8414cd5d6c8b15fb18888d9f97631bbb3cb42ec6306ba8e1d7ba80d892a28f1d7c5402c5b0c6c68b7d938f9adf12eecca5bc32f8d19314818d54aac9f3702000d05e6947a8ab1def9c56d97c45fb8266281d29990b54e0fa9252323e2d0a147da36224171d6a9ac59a32a449f1f3f9ef87aff3c0e5b5a56103047a73ded1128ca7c5b20b38089ae42304543b1017ae63692b6f838b6518134cabe1292b2988d32916626c01bbca90b6a9d8efed189f0815bb242af57357e9ba32c8a690391a08e29482771d76170be815bf6fd2293a99fc8a01ee12475398c6d27a289d5bf3b98d7b5fa22ae9734c3023a3a09003d111fd9a3b334b293f4dd2355afe1ccd03aba957b0a57e9f7b2503dece8b06d53b0abd13b2a6b93bfd28ca7805a75d7aad5568737a2b7aeed34487fd2b2e29491d8f74e27bc8e912e3a246d8825ef4d0d8b00dba795a4802bf1edd0b9372753ad4bb3ce04da7742da6ffabaf3ef7668045dd4f321d015ebce8a6abed0b7a007034cdcc388e52ec28b4dedf56f924335942d890f1e37bb6e6d24a3f6eae1a6f02a0c1be19cdf4bb3f31fdbf7f6f026bfc0f73c55a9595a22136e13855dbb879f88606e6341e487c0b79bca05ed917c71333b45d02e2a9b35f53028f1350bcd950865d19023ddc0ecc418853ce970e6ca3ed39b118203569f7d38cc6c8db605d9d4fef4278cbfa56ff1706df244e4b5ec1989302bbe783945e7d43120fedd0eb31ec93de5d4b06c776b5ab0ba0b3a2df90738d9a76e66b211cd51489d6f0cd8c8485b253846f8ba5a402f35912e992a17b87a50c889a3769e9ec98c335f163be7e60863cc43965fd1339cc8631b2aeb95f8958d00a3eba338a29bf88394ed65a823c81927df94d6c079ebf602cc69e1d8f8db121cefe3e18b3b431716ff0d9362226e894c2eab40ecb67609ee937a28b90037020286075a0d92ece5399fcb5fdee633891eff4a0ea821bc9336b9308c38e7529690a4c3bb217d014ef44a8ca0ac003bb6451c3c75e59c0560609862e8eebdc2e23cb0e75e4a9b0648da709a8261b065665209cab9b810b1f37a7f2078ae6717906a5e4cdb6218fcdafb7133b64fec9ad4f26e5dcf7ec473876dbb67d09053acf2760d4697ddf819ec0ca0f85cc1a2a6f189c65f9b374b59be703fe8d287f3e122eb327997418f13216fdb37a96738c853f48bbe661a836bece1d340d30c1290adeec6ab80579393daa54bcb983f569466c82b0f7f631b2f3378de1ac5008d7a4f50ca8733c404c25bd8b5af0e73a1e01939c97e850fc56fa09f3cee4aa0ed233a30d1c32b7ceea456b315cacdc5f4b3f516ed0d5a246d8da7d9190623642ccb26aaff0525dd229c6b73ee59378f75c4162f75d396366f5b06ae968db244c9993ad47cd79ad31a300c5b424f6302ead9b48f0c0cab516a670e3fcaa75a5358fcbb1fab63eccd263437413606cff10", 0x1000}}, 0x1006) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xe7c) 2m20.382470546s ago: executing program 35 (id=978): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x101042, 0x15) syz_clone(0x2000, 0x0, 0x0, 0x0, 0x0, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000440)={0x8, {"77b7cb7d9c4a8c4dc078e5186e5878eb2a4c66c7249cd95fe846e14abfacf66ca7584a26186075be2f6f0f57c6e96e096030bf0d2743671ae99cfd1217d1155f6df84c5d319ba1cbc143338007a959578a6f02b6f71ccdb3c53c887d1dc88f43004c4e2a3f730458798221cb214f6e4a9ddee49e0915bf5fc2d0218565fae733bea8d793eb63de1f0dc73a0ecebecbfc55a9ce41d0638cd3ffd993f6b2ef4031103e6103302c056421bbc500ece3fea7e0c64354e661f62e42658c9d85e7d81c66a345b78103702bb92c4d265115148e2345871be8a79a8d215c6d373c9801dd002cf19b0a0da82e8f73561d151a6e521732b2d26d05157bbc7aaa1c85425d5a2aa0727ee702a1f73694cf2f0ff637ea909b418c461be78e4b3646c12beef1476048250388f2720e353483469196cdea3f338e4cb778009b5e596fb05fa861d9879538a8c575e94a10d775280767f19e77992dd21a47469e995e1052ae29a62c18586d28714d340168597127184062c76d3be77c3584d679472574a098a19efb1e875f23ac16d1732edb57693fc22b04fc601a2623c4f939568d775f84a4e2ffca8f0c5f33d81a347326bb3024d9bd2e16b8a26d21150b39bb0a660b61211f3a312c22af37062298d0a2d6162fe692eb363e988db75429999c1f0792feae2084db70d6c91f333f40b41474fa7a1a97232b656ff9ec473a33d28c74cd5777b8900aab3a64924659d7ccfb02a7a63194d6c998260a85e5f38723f4b6f9c69d67c4f4b8a88852351ade349e4e863b0813eb4a6ab01e5fcd70642c12877b992fdbea27399387ec666542f094648e63e5ade537a75824b41df207f94795427f023469564217c91ca69506177e767eaa2714d0787f2092c54bad1d474aa431d40ead0a20b76200ddab4305e8577c3b8907abfe2cde9487671431ba0f2bed6f3b542299fc49be4bc1c590bb7c8a0e7f09ddfb6d6ecc46037b008bdf70fba4d8f8b41dbd7a65e3e2e1266d85bbdcd5885bcf6bbc1815ca2cc4f765e468f1273b11171a50930ed184f196733660d72ed650caaa762daab1a62cac073e19470b27eabb4ca8618d68a026f2ac5bef988c61b0561f99564e0021c688749c3c5999878e7f4dfb790f4fa80df610adb3701b070edb2b8a097cd39130edc33c3aa1d58a1e3ce614183c06ba2c07fc00d7822f9d950882f31cd90c008d02e122bd9bb0ead0c140d885aa2640275615289cc877a538b7ecc50497cf5de50435e13c5e3fa26d9c6e75199e83a9843759e252cb9136c8a1f9ec3eae031a78dd47a15f5707dce4eae0329465875afd515e42928454f5d72cf399322a1bd893086429198cdcbca8af0913c6dcf4b851b002f439e223bd195b7c8af961e11866b79fb4aa307c6e29f9cb8a4478397742956a93c0c05b67fe3d1c16b0ae34f549ead0cac4d836b27a33c975063a09e57e46e07a65d4783001a7e9636004fb8ab5312b676655a4ed83d09050c579fd3727e821453e1370c96e216a843a129d07fc368fadcdbb031ab62f5f07fae045f3c5702d7751af9c50a5b66011798835f302663bcf8c4c5086154e988c9e573e9e46e6d9ae1ec042561b65970970acb4ab251bde381d52c23d429f7be17dad20229200e26a7f8be47bab8188b8e0c9bde276f49c85f5d9462a65a38b2026d136f080de203836c3e56bc291d018d9ec893c77ef59578927c7d3f70c9649dc49f4387f290f7ba8900b87e3bd808293e66eba04fecd493edd14f7cbc6659c425c62bfc4a9bc870b276c0675d4f8f869d800a08b74507abfad3096bc20d619606ef9f6bbd9a64d54d258409076a038414c3d85e50a26517609ad70e51e6564c843e7dcb022b7e7443cdeffbdef8da96690a5c22f8dcd8936664e81e08871fe920b978e9e706df084fb9253e460a58cb1ac86729fccae46bf5cd6870bf15ec19ee2285be5aec22a6718ae00dd35e7efdb9e780426bb821607b848d1d669611119c055c2a136c991a9385ad1186e2a855e513e5110563c1d0b551603b79195a0f4e684e9ea73f473082477db32e897a8fa32d2c3f26101ded3e7adb62c026a55c2ff2cb1938d18f51f00cdff8ae4d29ae1aca6da3db40a4cdae833782452329921168ff2f15de11f14cf13dc98c5b2a34b4676da9d0b4b1bdf130450f056078c5df032fdf1e9b6e2ff13a208c3b0ba09437b478cfe1f03bfd9318e00f09a8a661436058e35e8ff603399c6c7cc61a95fc5aa5c4d9350d76217c1aa07f88979d1219f08e85899218d4a91ce4dbffc9f22acc700e0796e3b32c8bbae0c87aed5abc6bb9105b88047131b378cd72ff455bfc6996cde8d101629800b0631d16e86ad69d9d6a0ed4700c1297881b6f340ee9b23b6c852f930e3964dac52100078752565a44503c13dcd8dcca8a5bcb917a30e282ad98750254280c058ab8d29cb7535ff38d019a9cc101f9e163ec81cc40cda0277aa52cc71c53548e23e109f06c6504801cf39da201e8ad7be63def9ad0b1263def806e78de3d6f95bfa798024e5d8758136f6b9bd4381dfc57fc6e2c06ee079e72caaed4b40400ac6e79a1459f9965237b4c6b50e9bac50e5b972be701d1d4d83f0098d03313e3d4791928d31fdebbb276920f750d8e38984c720dcf081e3a92240935ca814e03b7b278a6d9615ff91a6bdbcba1fbc900420fb3f8327e617f804417710dfd2bd1dc9a871f694581d03ad751d0144f75b655e0bc4205e17ec3e0e9b052dbad1372778fa623f643f80a7ba4467c267216792df003771a50426d2ec16e5d06f848deaa330b0ae18d941f05186bf35134faa996e5988c211bb50d4783cf7d42ce217d7e6e814327dd5259b57394c8895036f6da2b3577ec98b24a18652df8f173d2adfeec11b708e4d00f9e7c8e27adb01ebfa71362c6117ccdf0b47442958ba9b16688c7cacc94c1630e0a698bf3705406040d7c5717fe7f4db43f912f17ac05a7594835ddec5f10a3e33dd75e2676e22460e5124295740d548323202072c436cb7f78dd4b776e37cded3dc1f327d128b13f4de84eb3a279f597bd833bcdbbedf95c19321ecda0d8efb4dfd9376600f3f0557e49074d3a0f41ec85ffb096dd8a60f1c0f66034d9a2f398c46f6f39f4f481cc8f5c5b95fde87ec48a89bbdd6fd99e92241ec87e54650cbe263f1cf651783a0c5777b5fa503d7a0db5d2f13cf4c3ccfb69fa02af648be2429aa18293fd5ed0c8f589ddb542019f9dc63a9337d6b2c501cc0b3b3cff3eef0c8e78a131d5da50ad384aa7b33139d762bd36e1908bd5cc244a5fe60f8d64dcb17db60eef669d93a2da7559870d52718a88bf86430fd3a89427fe7647745373cdc1333ec11994a3134f862568bd1036d1d2ce45d6f4a441ca108caa44d3d194bca6829bcc56fc54b7d7654b778e4c4f6c500870c7dbd5295d9db78994434bef2912f9ee8ca776a2f7b7b06e05cf82adc7e3e07207a914d7d4de8761ea6d18caf463280f35945bc3093e42f43f4ce7dd95bcdd9539cb32f8398f080334f75de1892056456dd928d9d0a1e8170afcc5e49d023db01af37d5a1696de872f3fe21da4d517b3158c7a8a12dc164c0890e35fc32c4b046e4110c158489bbdc4094a1c0b421ca6c9a9ed3bf301cf82459d41ac0dddfcc5a83a1eb8fae033558930d558ec7b192a42c5767f5319e2ec071b326224454d3351ad980b12016bb871645fbc270e1d781f9336da82cf6d6652e0369d9c32ef3c3034fc42920f513d2e5d9d2fd55e60f5e3871353f8dd8352cbb191c24930e92827660862ed8f9221d038f15a59c5dbfbf12be1e936c9f4df780390f02eca32119a924edffb3d85acbd166375eb9f4206e8e9dd85bcf7212ce5f7c1abee24939ac36c5fdb3be689ca62671ad51b67bff566527c624611cdcba5aefce5af0c5c14014bc284f312c0a5b7d3ec8ab46639a3b10ef3d2d85fae2bc13e81de93a495be80affd7c4b193c5b15bb947c24329b84f952c2ed50b4a431abbc780e9684fdfa06a3388f6001da4dd6baaa0fc24ceaf32710742b0062962db5b6bad30ebf7c562f169261e95d1c8240830d750cc5c7d120a07e5100abdf20fa8303ed8251a1555ec26848969dfaaa5581df432c04d421020a95997aeca7047e5824ffdd0c4ff171b95337ae58b392d0209e53400f4fc89eb509bb4d52e9292f32ba8bd3094c2f0bd4c4761125404c53db775ec151f9033b3f35621f7152fe59dd5d4548a9e5190b8d3b97a639916600b78c8e4270b05fe1cfb117a2a131f148aeb6773513e877d14b8bca0ffdab520ef19e160898fae8bb77feca3cb370c6753a71b46ea4e8414cd5d6c8b15fb18888d9f97631bbb3cb42ec6306ba8e1d7ba80d892a28f1d7c5402c5b0c6c68b7d938f9adf12eecca5bc32f8d19314818d54aac9f3702000d05e6947a8ab1def9c56d97c45fb8266281d29990b54e0fa9252323e2d0a147da36224171d6a9ac59a32a449f1f3f9ef87aff3c0e5b5a56103047a73ded1128ca7c5b20b38089ae42304543b1017ae63692b6f838b6518134cabe1292b2988d32916626c01bbca90b6a9d8efed189f0815bb242af57357e9ba32c8a690391a08e29482771d76170be815bf6fd2293a99fc8a01ee12475398c6d27a289d5bf3b98d7b5fa22ae9734c3023a3a09003d111fd9a3b334b293f4dd2355afe1ccd03aba957b0a57e9f7b2503dece8b06d53b0abd13b2a6b93bfd28ca7805a75d7aad5568737a2b7aeed34487fd2b2e29491d8f74e27bc8e912e3a246d8825ef4d0d8b00dba795a4802bf1edd0b9372753ad4bb3ce04da7742da6ffabaf3ef7668045dd4f321d015ebce8a6abed0b7a007034cdcc388e52ec28b4dedf56f924335942d890f1e37bb6e6d24a3f6eae1a6f02a0c1be19cdf4bb3f31fdbf7f6f026bfc0f73c55a9595a22136e13855dbb879f88606e6341e487c0b79bca05ed917c71333b45d02e2a9b35f53028f1350bcd950865d19023ddc0ecc418853ce970e6ca3ed39b118203569f7d38cc6c8db605d9d4fef4278cbfa56ff1706df244e4b5ec1989302bbe783945e7d43120fedd0eb31ec93de5d4b06c776b5ab0ba0b3a2df90738d9a76e66b211cd51489d6f0cd8c8485b253846f8ba5a402f35912e992a17b87a50c889a3769e9ec98c335f163be7e60863cc43965fd1339cc8631b2aeb95f8958d00a3eba338a29bf88394ed65a823c81927df94d6c079ebf602cc69e1d8f8db121cefe3e18b3b431716ff0d9362226e894c2eab40ecb67609ee937a28b90037020286075a0d92ece5399fcb5fdee633891eff4a0ea821bc9336b9308c38e7529690a4c3bb217d014ef44a8ca0ac003bb6451c3c75e59c0560609862e8eebdc2e23cb0e75e4a9b0648da709a8261b065665209cab9b810b1f37a7f2078ae6717906a5e4cdb6218fcdafb7133b64fec9ad4f26e5dcf7ec473876dbb67d09053acf2760d4697ddf819ec0ca0f85cc1a2a6f189c65f9b374b59be703fe8d287f3e122eb327997418f13216fdb37a96738c853f48bbe661a836bece1d340d30c1290adeec6ab80579393daa54bcb983f569466c82b0f7f631b2f3378de1ac5008d7a4f50ca8733c404c25bd8b5af0e73a1e01939c97e850fc56fa09f3cee4aa0ed233a30d1c32b7ceea456b315cacdc5f4b3f516ed0d5a246d8da7d9190623642ccb26aaff0525dd229c6b73ee59378f75c4162f75d396366f5b06ae968db244c9993ad47cd79ad31a300c5b424f6302ead9b48f0c0cab516a670e3fcaa75a5358fcbb1fab63eccd263437413606cff10", 0x1000}}, 0x1006) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xe7c) 12.851712426s ago: executing program 7 (id=1358): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, 0x0, 0x4c814) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000001c0), &(0x7f0000000280)=0xc) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000180)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$FS_IOC_SETFLAGS(r4, 0x40186f40, &(0x7f0000000440)=0x20000) 12.805366277s ago: executing program 3 (id=1359): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x100, 0x103) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r2, &(0x7f0000004280)={0x2020}, 0x2020) 10.927516733s ago: executing program 6 (id=1361): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYBLOB="35874207", @ANYBLOB="440000001100a7cc4a372eaf541d00200700", @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYRES32=r1, @ANYBLOB="66c429ef2213efc5a9e19ed391a9ab9eb0ac746698e78eee56fd2fc3b72a3c615b2925736f0184a847df38881ee2a6c0f58f56ab060993d19aa5bca04f976c695a50483577bec1c3bbd87ec0fdef561b93105bf1a29df22cad5b7e304aa83db432ab304df9c21268c812e566f8a8821144c1373a01f70d9cf5fbede22020e6e4fc87ce84363335985b96e0c1af57f61e7222782beb358c3a4f9ab1ba9b5db8fe321dcb97f2490aebc07ddaba7e2f3e38d7c88749e3eb8b60717aa17e1e7e4bdf15209641feafdaaa416b2f7aa8d25f6271d127c8afedbe0bd4e2bfef888dda68f6ba4717cc949f632c28c2161cea50dc81934a45caf28c15e352", @ANYRES16=r1, @ANYRES16], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r5 = getpgrp(0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r7 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r7, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r7, 0x0, 0x0) mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/ncm.usb0/os_desc/interface.ncm/sub_compatible_id\x00', 0x0, 0x0) 10.876672774s ago: executing program 3 (id=1363): memfd_create(0x0, 0x6) close(0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) lseek(0xffffffffffffffff, 0x0, 0x2) preadv(0xffffffffffffffff, &(0x7f0000000400), 0x0, 0x17f, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r3, &(0x7f0000002140)={0x2020}, 0x2020) writev(0xffffffffffffffff, &(0x7f00000003c0)=[{0x0}, {0x0}, {&(0x7f0000000280)}, {&(0x7f00000002c0)="4fbe4e5310", 0x5}, {0x0}], 0x5) 9.061332038s ago: executing program 3 (id=1364): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c0c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xf809, 0x2, 0x0, 0x42}, &(0x7f0000000400), &(0x7f0000011000), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r3, 0x6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000540), 0x0}, 0x20) 9.058899848s ago: executing program 6 (id=1365): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7fd}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000180)={r0, r0, 0x8, 0x0, 0x0, 0xfd, 0xe1, 0x6, 0x1, 0xc5, 0x2, 0x7, 'syz1\x00'}) shutdown(r0, 0x1) 9.051319998s ago: executing program 1 (id=1366): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)=@newtaction={0x60, 0x30, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [{0x4c, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x401, 0x3ff, 0x60, 0x2, 0x20000008}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x1}}}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x2000c800}, 0x2400c800) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x80, 0x20, 0x3ff, 0x1, {{0x5, 0x4, 0x2, 0x7, 0x14, 0x64, 0x0, 0xfd, 0x29, 0x0, @multicast1, @multicast1}}}}) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0300000004020000040000000a0000", @ANYRES32=0x1, @ANYRES32=0x0, @ANYRESHEX], 0x48) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed, 0x8}]}) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000300)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x9, 0xfffffffffffffffd, 0x10000000, 0x10000, 0x3, 0x65, 0x7ff, 0x9, 0x0, 0x400, 0x80, 0x89, 0x0, 0x101, 0x7], 0x100000, 0x240046}) ioctl$KVM_RUN(r2, 0xae80, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, &(0x7f00000000c0)) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 9.050921518s ago: executing program 8 (id=1367): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x3) accept4$bt_l2cap(r0, 0x0, 0x0, 0x800) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) 8.219592739s ago: executing program 1 (id=1368): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe2000/0x18000)=nil, &(0x7f0000005700)=[@text32={0x20, &(0x7f0000000040)="f20f3365f2a72e0fc7b2000000000f015a10c510c4e2fd307c0800f30f09f20f10a95d4e00006466f30fbcb30f000000b9800000c00f3235002000000f308ed0", 0x40}], 0x1, 0xb, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xe, 0x4, 0x280, 0xffffffff, 0x0, 0x98, 0x130, 0xffffffff, 0xffffffff, 0x0, 0x98, 0x1e8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0xb8}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@loopback, 'lo\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e0) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) connect$inet6(r3, &(0x7f0000002140)={0xa, 0x4e25, 0x1, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x35}}, 0x5}, 0x5f) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003240)=[{&(0x7f0000000200)='/`={', 0x4}], 0x1}}], 0x1, 0x4001c00) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = socket$inet6_tcp(0xa, 0x1, 0x6) socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r4, 0x29, 0x4e, &(0x7f0000000000)=0x1, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x1}, 0x1c) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4001, 0x0, @loopback, 0x1}, 0x1c) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x37) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text32={0x20, 0x0}], 0x1, 0x9, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 8.090502292s ago: executing program 6 (id=1369): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020}, 0x2020) syz_emit_ethernet(0x8e, &(0x7f0000000380)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "d3ffff", 0x58, 0x3a, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x502, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @private1, @remote, [@hopopts={0x3a, 0x3, '\x00', [@calipso={0x7, 0x18, {0x2, 0x4, 0x7, 0x2, [0xfffffffffffffffa, 0x101]}}]}]}}}}}}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000005fc0)={@remote, @private0={0xfc, 0x0, '\x00', 0x41}, @empty, 0x7, 0x7fff, 0x3d, 0x500, 0x5, 0x19c0000}) 7.980902505s ago: executing program 8 (id=1370): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) socket$unix(0x1, 0x2, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020400060e00000025bd7000fcdbdf2505000600000000000a004e2400000000fe880000000000000000000000000001020000000000000002000100000000000400030380ffffff050005003c0000000a000000000000050000000000000000000000000000000107000000000000008b1a965fb0b83d3577e20cb69965b1b07f"], 0x70}, 0x1, 0x7}, 0x4) landlock_create_ruleset(&(0x7f0000000080)={0x10}, 0x10, 0x0) socket$alg(0x26, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) getpid() mkdirat(0xffffffffffffffff, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f0000000100)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r4, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0xf00, 0x480, 0x1, 0x1, 0xd59f80, 0x19f2, 0x3f, 0x19ef, 0x3, 0x3, 0x2800, 0x2800, 0x2, 0xd1, 0xc, 0x30, {0x8, 0xfffffff7}, 0xd0, 0x9}}) write(r3, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) write(r5, &(0x7f00000001c0)='1\x00', 0x1) 6.269957457s ago: executing program 6 (id=1371): socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, r1, 0xffffffffffffffff, 0x0) syz_emit_vhci(0x0, 0x6) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r2, &(0x7f00000000c0)={0x1d, r3, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r2, 0x0, 0x0) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000640)=ANY=[], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)={0x14, r6, 0x534, 0x70bd2b, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40050}, 0x4050) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r8, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0xe501, 0x3, 0x208, 0xb8, 0xa, 0x1000000, 0xb8, 0x0, 0x170, 0x230, 0x230, 0x170, 0x223, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3b9, 'syz0\x00'}}}, {{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3c0, 'syz0\x00', {0xffffffffffffffff}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x268) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01080000000000000000020000000900010073797a30000000002c000000030a01040000000000000000020000000900010073797a30000000000900030073797a300000000090000000060a01240000000000000000020000000900010073797a30000000000900020073797a300000000064000480600001800b0001007461726765740000500002800e00010049444c4554494d455200000008000240000000013400030064000000746573745f6c6162656c0000000000000500dfd74d058923000000000000000000"], 0x104}}, 0x0) 6.189282859s ago: executing program 7 (id=1372): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1f7) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='f2fs\x00', 0x8410, 0x0) 6.110490001s ago: executing program 7 (id=1373): mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x100, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r0, 0x0, 0x0) write$FUSE_INIT(r0, &(0x7f0000000180)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x177, 0x40e00c0, 0x0, 0x800, 0x6, 0xfffffff6, 0x0, 0x0, 0x8, 0x100}}, 0x50) close(r0) chown(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) 6.102248351s ago: executing program 8 (id=1374): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20}, {0x8, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) socket$inet_sctp(0x2, 0x1, 0x84) mkdirat(0xffffffffffffff9c, 0x0, 0x1c1) prctl$PR_MCE_KILL(0x42, 0x1, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x1, 0x5, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}, 0x1, 0x0, 0x0, 0x4004050}, 0x800) recvmmsg(r2, &(0x7f0000007700), 0x318, 0xfc0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x2c000010) socket$nl_xfrm(0x10, 0x3, 0x6) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) syz_usb_control_io$uac2(0xffffffffffffffff, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4}}}, &(0x7f0000000480)={0x44, &(0x7f0000000200)={0x0, 0x9}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.965396834s ago: executing program 7 (id=1375): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYBLOB="35874207", @ANYBLOB="440000001100a7cc4a372eaf541d00200700", @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYRES32=r1, @ANYBLOB="66c429ef2213efc5a9e19ed391a9ab9eb0ac746698e78eee56fd2fc3b72a3c615b2925736f0184a847df38881ee2a6c0f58f56ab060993d19aa5bca04f976c695a50483577bec1c3bbd87ec0fdef561b93105bf1a29df22cad5b7e304aa83db432ab304df9c21268c812e566f8a8821144c1373a01f70d9cf5fbede22020e6e4fc87ce84363335985b96e0c1af57f61e7222782beb358c3a4f9ab1ba9b5db8fe321dcb97f2490aebc07ddaba7e2f3e38d7c88749e3eb8b60717aa17e1e7e4bdf15209641feafdaaa416b2f7aa8d25f6271d127c8afedbe0bd4e2bfef888dda68f6ba4717cc949f632c28c2161cea50dc81934a45caf28c15e352", @ANYRES16=r1, @ANYRES16], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r5 = getpgrp(0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r7 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r7, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r7, 0x0, 0x0) mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/ncm.usb0/os_desc/interface.ncm/sub_compatible_id\x00', 0x0, 0x0) 3.776824998s ago: executing program 1 (id=1376): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="68000000000905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000600000008000500000000002c00048008000100000000012000ff800c000100706f6c69637930000800020000000002080003000000001e", 0x68}], 0x1}, 0x0) 3.650395731s ago: executing program 6 (id=1377): r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200) readv(r0, &(0x7f0000000900)=[{&(0x7f0000000480)=""/135, 0x87}], 0x1) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 3.062064145s ago: executing program 8 (id=1378): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x13, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000000000000000001085200000ea36030095"], &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) 2.943209888s ago: executing program 1 (id=1379): setns(0xc9, 0x0) r0 = socket(0x8, 0x3, 0x9) ioctl$sock_TIOCINQ(r0, 0x541b, 0x0) 2.941710008s ago: executing program 7 (id=1380): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x3) accept4$bt_l2cap(r0, &(0x7f0000000200), 0x0, 0x800) syz_emit_vhci(0x0, 0x16) 2.781234802s ago: executing program 8 (id=1381): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) ptrace$ARCH_GET_CPUID(0x1e, 0x0, 0x0, 0x1011) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket(0x10, 0x3, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x100, 0x103) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r2, &(0x7f0000004280)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000180)={0x50, 0x0, r3, {0x7, 0x2b, 0x177, 0x40e00c0, 0x0, 0x800, 0x6, 0xfffffff6, 0x0, 0x0, 0x8, 0x100}}, 0x50) close(r2) chown(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) fchdir(0xffffffffffffffff) r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f00000000c0), &(0x7f0000000000)={'syz', 0x2}, 0x0, 0x0, r4) readv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000040)}, {&(0x7f0000000100)=""/70, 0x46}], 0x2) getpid() mount(0x0, 0x0, &(0x7f0000000000)='proc\x00', 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x20605) 2.225115605s ago: executing program 8 (id=1382): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, 0x0, 0x4c814) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000001c0), &(0x7f0000000280)=0xc) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000180)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$FS_IOC_SETFLAGS(r4, 0x40186f40, &(0x7f0000000440)=0x20000) 2.224913156s ago: executing program 3 (id=1383): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_emit_ethernet(0x8e, &(0x7f0000000380)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "d3ffff", 0x58, 0x3a, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x502, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @private1, @remote, [@hopopts={0x3a, 0x3, '\x00', [@calipso={0x7, 0x18, {0x2, 0x4, 0x7, 0x2, [0xfffffffffffffffa, 0x101]}}]}]}}}}}}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000005fc0)={@remote, @private0={0xfc, 0x0, '\x00', 0x41}, @empty, 0x7, 0x7fff, 0x3d, 0x500, 0x5, 0x19c0000}) 2.010547581s ago: executing program 1 (id=1384): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) socket$unix(0x1, 0x2, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020400060e00000025bd7000fcdbdf2505000600000000000a004e2400000000fe880000000000000000000000000001020000000000000002000100000000000400030380ffffff050005003c0000000a000000000000050000000000000000000000000000000107000000000000008b1a965fb0b83d3577e20cb69965b1b07f"], 0x70}, 0x1, 0x7}, 0x4) landlock_create_ruleset(&(0x7f0000000080)={0x10}, 0x10, 0x0) socket$alg(0x26, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) getpid() mkdirat(0xffffffffffffffff, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f0000000100)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r4, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0xf00, 0x480, 0x1, 0x1, 0xd59f80, 0x19f2, 0x3f, 0x19ef, 0x3, 0x3, 0x2800, 0x2800, 0x2, 0xd1, 0xc, 0x30, {0x8, 0xfffffff7}, 0xd0, 0x9}}) write(r3, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) write(r5, &(0x7f00000001c0)='1\x00', 0x1) 1.785248566s ago: executing program 3 (id=1385): mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x100, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r0, 0x0, 0x0) write$FUSE_INIT(r0, &(0x7f0000000180)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x177, 0x40e00c0, 0x0, 0x800, 0x6, 0xfffffff6, 0x0, 0x0, 0x8, 0x100}}, 0x50) close(r0) chown(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) 179.576706ms ago: executing program 6 (id=1386): r0 = socket$inet_tcp(0x2, 0x1, 0x6) listen(r0, 0x5) close(0x3) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) setsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f00000000c0), 0x4) r1 = socket(0x2, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) socket$inet_sctp(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r2}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0x4, 0xfff3}, {0x0, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x48080}, 0x0) 84.656928ms ago: executing program 7 (id=1387): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x4, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x7000000}, 0x94) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xf, &(0x7f0000000000)=0xb, 0x4) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'}) 24.306159ms ago: executing program 1 (id=1388): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20}, {0x8, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) socket$inet_sctp(0x2, 0x1, 0x84) mkdirat(0xffffffffffffff9c, 0x0, 0x1c1) prctl$PR_MCE_KILL(0x42, 0x1, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x1, 0x5, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}, 0x1, 0x0, 0x0, 0x4004050}, 0x800) recvmmsg(r2, &(0x7f0000007700), 0x318, 0xfc0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x2c000010) socket$nl_xfrm(0x10, 0x3, 0x6) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) syz_usb_control_io$uac2(0xffffffffffffffff, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4}}}, &(0x7f0000000480)={0x44, &(0x7f0000000200)={0x0, 0x9}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 0s ago: executing program 3 (id=1389): r0 = syz_io_uring_setup(0x2f8d, &(0x7f0000000080)={0x0, 0xc383, 0x0, 0x2, 0x200003}, &(0x7f0000000240), &(0x7f0000000140), &(0x7f0000000000)) r1 = eventfd2(0xfff, 0x80800) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000040)=r1, 0x1) kernel console output (not intermixed with test programs): ftover after parsing attributes in process `syz.3.932'. [ 371.863016][ T4231] Bluetooth: hci1: command 0x0406 tx timeout [ 371.901931][ T4272] usb 7-1: New USB device found, idVendor=413c, idProduct=8196, bcdDevice=71.fa [ 371.913092][ T4272] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.921187][ T4272] usb 7-1: Product: syz [ 371.925838][ T4272] usb 7-1: Manufacturer: syz [ 371.930438][ T4272] usb 7-1: SerialNumber: syz [ 372.029568][ T7766] IPVS: dh: UDP 127.0.0.1:21 - no destination available [ 372.134408][ T4231] usb 2-1: USB disconnect, device number 22 [ 372.713658][ T4272] qmi_wwan: probe of 7-1:9.27 failed with error -22 [ 372.732979][ T4272] usb 7-1: USB disconnect, device number 7 [ 372.844821][ T7774] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 372.908913][ T7780] binder: 7779:7780 ioctl 4018620d 0 returned -22 [ 373.091828][ T7788] ubi: mtd0 is already attached to ubi0 [ 373.100098][ T4190] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 373.109968][ T4190] CPU: 0 PID: 4190 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 373.117533][ T4190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 373.127577][ T4190] Workqueue: hci0 hci_rx_work [ 373.132251][ T4190] Call Trace: [ 373.135515][ T4190] [ 373.138431][ T4190] dump_stack_lvl+0x188/0x250 [ 373.143098][ T4190] ? show_regs_print_info+0x20/0x20 [ 373.148288][ T4190] ? load_image+0x410/0x410 [ 373.152792][ T4190] sysfs_create_dir_ns+0x26a/0x290 [ 373.157892][ T4190] ? sysfs_warn_dup+0xa0/0xa0 [ 373.162639][ T4190] ? kthread+0x42e/0x520 [ 373.166898][ T4190] ? do_raw_spin_unlock+0x11d/0x230 [ 373.172090][ T4190] kobject_add_internal+0x5ba/0xcd0 [ 373.177277][ T4190] kobject_add+0x160/0x230 [ 373.181681][ T4190] ? kobject_init+0x1c0/0x1c0 [ 373.186371][ T4190] ? __raw_spin_lock_init+0x41/0x100 [ 373.191663][ T4190] ? klist_children_get+0x50/0x50 [ 373.196671][ T4190] ? get_device_parent+0x121/0x3e0 [ 373.201768][ T4190] device_add+0x470/0x1050 [ 373.206178][ T4190] ? device_initialize+0x2a5/0x4d0 [ 373.211274][ T4190] hci_conn_add_sysfs+0xd1/0x1e0 [ 373.216201][ T4190] le_conn_complete_evt+0xc55/0x14d0 [ 373.221476][ T4190] ? cs_le_create_conn+0x5e0/0x5e0 [ 373.226660][ T4190] ? __mutex_trylock_common+0x15c/0x260 [ 373.232192][ T4190] hci_le_meta_evt+0x285/0x3ca0 [ 373.237116][ T4190] ? hci_event_packet+0x363/0x1310 [ 373.242220][ T4190] ? __lock_acquire+0x7d40/0x7d40 [ 373.247234][ T4190] ? hci_remote_host_features_evt+0x240/0x240 [ 373.253304][ T4190] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 373.258935][ T4190] ? mark_lock+0x94/0x320 [ 373.263256][ T4190] ? mutex_unlock+0x10/0x10 [ 373.267745][ T4190] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 373.273726][ T4190] ? lock_chain_count+0x20/0x20 [ 373.278561][ T4190] ? __rwlock_init+0x140/0x140 [ 373.283311][ T4190] hci_event_packet+0xe0b/0x1310 [ 373.288235][ T4190] ? _raw_spin_unlock+0x40/0x40 [ 373.293082][ T4190] ? rcu_lock_release+0x20/0x20 [ 373.297968][ T4190] ? hci_send_to_monitor+0x9c/0x4a0 [ 373.303155][ T4190] hci_rx_work+0x255/0xa10 [ 373.307565][ T4190] process_one_work+0x867/0xff0 [ 373.312408][ T4190] ? worker_detach_from_pool+0x240/0x240 [ 373.318023][ T4190] ? lockdep_hardirqs_off+0x70/0x100 [ 373.323316][ T4190] ? _raw_spin_lock_irq+0xb7/0xf0 [ 373.328346][ T4190] ? _raw_spin_lock_irqsave+0x100/0x100 [ 373.333878][ T4190] ? wq_worker_running+0x97/0x170 [ 373.338906][ T4190] worker_thread+0xad7/0x12a0 [ 373.344019][ T4190] kthread+0x42e/0x520 [ 373.348068][ T4190] ? rcu_lock_release+0x20/0x20 [ 373.352899][ T4190] ? kthread_blkcg+0xd0/0xd0 [ 373.357496][ T4190] ret_from_fork+0x1f/0x30 [ 373.361900][ T4190] [ 373.370562][ T4190] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 373.384513][ T4190] Bluetooth: hci0: failed to register connection device [ 376.352999][ T5962] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 376.596650][ T5962] usb 7-1: Using ep0 maxpacket: 32 [ 376.660967][ T7844] binder: 7843:7844 ioctl c0306201 0 returned -14 [ 376.712986][ T5962] usb 7-1: config 9 has an invalid interface number: 27 but max is 0 [ 376.733685][ T5962] usb 7-1: config 9 has no interface number 0 [ 376.744556][ T5962] usb 7-1: config 9 interface 27 has no altsetting 0 [ 376.983091][ T5962] usb 7-1: New USB device found, idVendor=413c, idProduct=8196, bcdDevice=71.fa [ 376.996654][ T5962] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 377.006137][ T5962] usb 7-1: Product: syz [ 377.010414][ T5962] usb 7-1: Manufacturer: syz [ 377.087477][ T5962] usb 7-1: SerialNumber: syz [ 377.628012][ T5962] qmi_wwan: probe of 7-1:9.27 failed with error -22 [ 377.751322][ T5962] usb 7-1: USB disconnect, device number 8 [ 377.809442][ T7851] chnl_net:caif_netlink_parms(): no params data found [ 379.083738][ T7851] bridge0: port 1(bridge_slave_0) entered blocking state [ 379.111756][ T7851] bridge0: port 1(bridge_slave_0) entered disabled state [ 379.140291][ T7851] device bridge_slave_0 entered promiscuous mode [ 379.151938][ T1420] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.160990][ T7] Bluetooth: hci3: command 0x0409 tx timeout [ 379.167079][ T1420] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.266968][ T7851] bridge0: port 2(bridge_slave_1) entered blocking state [ 379.286726][ T7851] bridge0: port 2(bridge_slave_1) entered disabled state [ 379.331539][ T7851] device bridge_slave_1 entered promiscuous mode [ 379.339356][ T7879] netlink: 8 bytes leftover after parsing attributes in process `syz.3.963'. [ 379.407189][ T7851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 379.436372][ T7886] ubi: mtd0 is already attached to ubi0 [ 379.471760][ T7851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 379.577849][ T7851] team0: Port device team_slave_0 added [ 379.615411][ T7851] team0: Port device team_slave_1 added [ 379.686910][ T7851] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 379.708552][ T7851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 379.786595][ T7851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 379.826666][ T7851] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 379.847975][ T7851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 379.914513][ T7851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 380.554314][ T7851] device hsr_slave_0 entered promiscuous mode [ 380.561150][ T7851] device hsr_slave_1 entered promiscuous mode [ 380.575544][ T7851] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 380.594198][ T7851] Cannot create hsr debugfs directory [ 380.632675][ T7894] binder: 7893:7894 ioctl c0306201 0 returned -14 [ 380.868846][ T7851] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 380.892259][ T7851] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 380.907578][ T7851] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 380.929202][ T7851] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 382.271433][ T7] Bluetooth: hci3: command 0x041b tx timeout [ 382.523436][ T7908] vivid-008: ================= START STATUS ================= [ 382.568531][ T7908] vivid-008: Enable Output Cropping: true [ 382.590780][ T7908] vivid-008: Enable Output Composing: true [ 382.615522][ T7908] vivid-008: Enable Output Scaler: true [ 382.633118][ T7851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 382.634762][ T7908] vivid-008: Tx RGB Quantization Range: Automatic [ 382.665584][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 382.680397][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 382.688049][ T7908] vivid-008: Transmit Mode: HDMI [ 382.719234][ T7908] vivid-008: Display Present: true inactive [ 382.729733][ T7908] vivid-008: Hotplug Present: 0x00000001 [ 382.732193][ T7851] 8021q: adding VLAN 0 to HW filter on device team0 [ 382.752851][ T7908] vivid-008: RxSense Present: 0x00000001 [ 382.758628][ T7908] vivid-008: EDID Present: 0x00000001 [ 382.771354][ T7908] vivid-008: ================== END STATUS ================== [ 382.771396][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 382.833072][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 382.883414][ T4336] bridge0: port 1(bridge_slave_0) entered blocking state [ 382.890599][ T4336] bridge0: port 1(bridge_slave_0) entered forwarding state [ 382.923104][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 382.963300][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 382.976638][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 383.000694][ T4249] bridge0: port 2(bridge_slave_1) entered blocking state [ 383.007900][ T4249] bridge0: port 2(bridge_slave_1) entered forwarding state [ 383.060958][ T7851] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 383.091967][ T7851] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 383.133557][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 383.155421][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 383.210042][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 383.293303][ T4225] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 383.421392][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 383.554682][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 383.623019][ T4225] usb 2-1: Using ep0 maxpacket: 32 [ 383.709336][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 383.761585][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 383.770218][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 383.772913][ T4225] usb 2-1: config 9 has an invalid interface number: 27 but max is 0 [ 383.779107][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 383.795803][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 383.813523][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 383.824085][ T4225] usb 2-1: config 9 has no interface number 0 [ 383.830214][ T4225] usb 2-1: config 9 interface 27 has no altsetting 0 [ 383.838189][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 384.042914][ T4225] usb 2-1: New USB device found, idVendor=413c, idProduct=8196, bcdDevice=71.fa [ 384.087730][ T4225] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 384.096438][ T4225] usb 2-1: Product: syz [ 384.101306][ T4225] usb 2-1: Manufacturer: syz [ 384.106401][ T4225] usb 2-1: SerialNumber: syz [ 384.201995][ T4230] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 384.212343][ T4230] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 384.227390][ T7851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 384.332856][ T4272] Bluetooth: hci3: command 0x040f tx timeout [ 384.469530][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 384.486158][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 384.510299][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 384.513665][ T4225] qmi_wwan: probe of 2-1:9.27 failed with error -22 [ 384.525424][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 384.544265][ T7851] device veth0_vlan entered promiscuous mode [ 384.552994][ T4225] usb 2-1: USB disconnect, device number 23 [ 384.560135][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 384.569237][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 384.588320][ T7851] device veth1_vlan entered promiscuous mode [ 384.617120][ T4230] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 384.641204][ T4230] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 384.652420][ T4230] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 384.667984][ T4230] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 384.680374][ T7851] device veth0_macvtap entered promiscuous mode [ 384.694859][ T7851] device veth1_macvtap entered promiscuous mode [ 384.712074][ T7851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 384.742044][ T7851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 384.753236][ T7851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 384.765034][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x4255 instead [ 384.776332][ T7851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 384.786655][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0001 instead [ 384.800189][ T7851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 384.811200][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0xb91b instead [ 384.824032][ T7851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 384.834971][ T7851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 384.846595][ T7851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 384.859015][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000003c: 0x7508 instead [ 384.869892][ T7851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 384.883143][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000040: 0x4255 instead [ 384.894278][ T7851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 384.898046][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000044: 0x0101 instead [ 384.918543][ T7851] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 384.921776][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000048: 0xff7f instead [ 384.931155][ T7851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 384.952949][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000007c: 0xb365 instead [ 384.966550][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000128: 0x16f1 instead [ 385.056798][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000001d4: 0x16f1 instead [ 385.068164][ T7939] jffs2: Further such events for this erase block will not be printed [ 385.077468][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001000: 0x4255 instead [ 385.081601][ T7851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 385.088262][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001004: 0x0001 instead [ 385.116700][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001018: 0xb91b instead [ 385.555030][ T7851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 385.562842][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000103c: 0x7508 instead [ 385.567803][ T7851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 385.588826][ T7851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 385.599443][ T7851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 385.609567][ T7851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 385.624344][ T7851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 385.636347][ T7851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 385.647254][ T7851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 385.680018][ T7851] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 385.687580][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001040: 0x4255 instead [ 385.739384][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 385.777205][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 385.967116][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 386.023032][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001044: 0x0101 instead [ 386.166907][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 386.176716][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001048: 0xff7f instead [ 386.188275][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 386.196790][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000107c: 0xef7b instead [ 386.273637][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001128: 0x16f1 instead [ 386.296788][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 386.317579][ T7851] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.327149][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000011d4: 0x16f1 instead [ 386.448904][ T7851] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.484211][ T7851] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.495957][ T7939] jffs2: Further such events for this erase block will not be printed [ 386.570410][ T7851] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.589919][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002000: 0x4255 instead [ 386.699642][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002004: 0x0001 instead [ 386.871225][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002018: 0xb91b instead [ 386.943790][ T4225] Bluetooth: hci3: command 0x0419 tx timeout [ 386.954680][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000203c: 0xbe37 instead [ 387.022960][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003000: 0x4255 instead [ 387.058037][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003004: 0x0001 instead [ 387.122900][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003018: 0xb91b instead [ 387.573024][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000303c: 0xbe37 instead [ 387.585456][ T4254] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 387.617042][ T4254] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 387.624813][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004000: 0x4255 instead [ 387.672861][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004004: 0x0001 instead [ 387.694148][ T4254] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 387.709168][ T4254] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 387.733430][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004018: 0xb91b instead [ 387.771081][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000403c: 0xbe37 instead [ 387.817880][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005000: 0x4255 instead [ 387.862156][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005004: 0x0001 instead [ 387.907567][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005018: 0xb91b instead [ 387.961538][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000503c: 0xbe37 instead [ 388.008309][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006000: 0x4255 instead [ 388.070653][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006004: 0x0001 instead [ 388.085841][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 388.146031][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 388.152904][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006018: 0xb91b instead [ 388.170219][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000603c: 0xbe37 instead [ 388.198720][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007000: 0x4255 instead [ 388.222473][ T7963] binder: 7962:7963 ioctl c0306201 0 returned -14 [ 388.232448][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007004: 0x0001 instead [ 388.253543][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007018: 0xb91b instead [ 388.275546][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000703c: 0xbe37 instead [ 388.297807][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008000: 0x4255 instead [ 388.324472][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008004: 0x0001 instead [ 388.350846][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008018: 0xb91b instead [ 388.374725][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000803c: 0xbe37 instead [ 388.473335][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009000: 0x4255 instead [ 388.510889][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009004: 0x0001 instead [ 389.944452][ T7970] netlink: 8 bytes leftover after parsing attributes in process `syz.3.987'. [ 389.967573][ T4225] Bluetooth: hci3: command 0x0406 tx timeout [ 389.981795][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009018: 0xb91b instead [ 390.032951][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000903c: 0xbe37 instead [ 390.189343][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a000: 0x4255 instead [ 390.212884][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a004: 0x0001 instead [ 390.547497][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a018: 0xb91b instead [ 391.048971][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a03c: 0xbe37 instead [ 391.916086][ T7987] fuse: Bad value for 'fd' [ 392.832756][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b000: 0x4255 instead [ 392.947870][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b004: 0x0001 instead [ 393.356059][ T7998] ubi: mtd0 is already attached to ubi0 [ 393.363469][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b018: 0xb91b instead [ 393.404927][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b03c: 0xbe37 instead [ 393.588659][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c000: 0x4255 instead [ 393.601606][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c004: 0x0001 instead [ 393.616776][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c018: 0xb91b instead [ 393.630099][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c03c: 0xbe37 instead [ 393.641793][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d000: 0x4255 instead [ 393.677462][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d004: 0x0001 instead [ 393.799016][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d018: 0xb91b instead [ 394.031924][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d03c: 0xbe37 instead [ 394.314024][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e000: 0x4255 instead [ 394.379668][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e004: 0x0001 instead [ 394.438810][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e018: 0xb91b instead [ 394.481323][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e03c: 0xbe37 instead [ 394.509778][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f000: 0x4255 instead [ 394.545785][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f004: 0x0001 instead [ 394.579494][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f018: 0xb91b instead [ 394.614362][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f03c: 0xbe37 instead [ 394.648916][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x4255 instead [ 394.669736][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0x0001 instead [ 394.695379][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0xb91b instead [ 394.891318][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001003c: 0xbe37 instead [ 395.180147][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011000: 0x4255 instead [ 395.241637][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011004: 0x0001 instead [ 395.301791][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011018: 0xb91b instead [ 395.535349][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001103c: 0xbe37 instead [ 395.903988][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012000: 0x4255 instead [ 395.964356][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012004: 0x0001 instead [ 396.061033][ T8029] fuse: Bad value for 'fd' [ 396.068626][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012018: 0xb91b instead [ 396.135022][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001203c: 0xbe37 instead [ 396.194141][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013000: 0x4255 instead [ 396.298035][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013004: 0x0001 instead [ 396.462795][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013018: 0xb91b instead [ 396.672791][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001303c: 0xbe37 instead [ 396.709292][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014000: 0x4255 instead [ 397.390563][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014004: 0x0001 instead [ 397.527740][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014018: 0xb91b instead [ 397.762582][ T8038] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1003'. [ 397.838188][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001403c: 0xbe37 instead [ 398.028249][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015000: 0x4255 instead [ 398.039411][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015004: 0x0001 instead [ 398.057643][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015018: 0xb91b instead [ 398.068874][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001503c: 0xbe37 instead [ 398.602942][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016000: 0x4255 instead [ 398.617128][ T8036] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1003'. [ 398.636858][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016004: 0x0001 instead [ 398.652161][ T8036] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1003'. [ 398.652833][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016018: 0xb91b instead [ 398.682210][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001603c: 0xbe37 instead [ 398.699769][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017000: 0x4255 instead [ 398.715326][ T8036] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1003'. [ 398.727842][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017004: 0x0001 instead [ 398.751169][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017018: 0xb91b instead [ 398.767628][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001703c: 0xbe37 instead [ 398.815851][ T8036] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1003'. [ 398.835318][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0x4255 instead [ 398.855249][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0x0001 instead [ 398.870103][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0xb91b instead [ 398.889337][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001803c: 0xbe37 instead [ 398.901892][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x4255 instead [ 398.918868][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0x0001 instead [ 398.952531][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0xb91b instead [ 398.994651][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001903c: 0xbe37 instead [ 399.022282][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x4255 instead [ 399.050748][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x0001 instead [ 399.069950][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0xb91b instead [ 399.086402][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a03c: 0xbe37 instead [ 399.166060][ T8054] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 399.168915][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x4255 instead [ 399.207849][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x0001 instead [ 399.219899][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0xb91b instead [ 399.236534][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b03c: 0xbe37 instead [ 399.575314][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0x4255 instead [ 399.978403][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x0001 instead [ 400.034532][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0xb91b instead [ 400.120208][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c03c: 0xbe37 instead [ 400.164520][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0x4255 instead [ 400.191421][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x0001 instead [ 400.310077][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0xb91b instead [ 400.333486][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d03c: 0xbe37 instead [ 400.345380][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0x4255 instead [ 400.673238][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x0001 instead [ 400.993211][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0xb91b instead [ 401.046048][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0xbe37 instead [ 401.112803][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead [ 401.124754][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead [ 401.135259][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0xb91b instead [ 401.146750][ T7939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0xbe37 instead [ 401.175876][ T7939] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 401.240913][ T7939] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 402.091930][ T8084] fuse: Bad value for 'fd' [ 402.950042][ T7939] bridge0: port 3(syz_tun) entered disabled state [ 403.024555][ T7939] device syz_tun left promiscuous mode [ 403.031742][ T7939] bridge0: port 3(syz_tun) entered disabled state [ 404.028997][ T4282] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 404.194914][ T8080] chnl_net:caif_netlink_parms(): no params data found [ 404.272563][ T4282] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 404.444918][ T4282] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 404.626289][ T4268] Bluetooth: hci5: command 0x0409 tx timeout [ 405.398466][ T4282] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 405.936207][ T8080] bridge0: port 1(bridge_slave_0) entered blocking state [ 406.524769][ T8080] bridge0: port 1(bridge_slave_0) entered disabled state [ 406.535250][ T8080] device bridge_slave_0 entered promiscuous mode [ 406.559695][ T8153] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 406.586782][ T8080] bridge0: port 2(bridge_slave_1) entered blocking state [ 406.652806][ T13] Bluetooth: hci5: command 0x041b tx timeout [ 406.665576][ T8153] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 406.706905][ T8080] bridge0: port 2(bridge_slave_1) entered disabled state [ 406.858476][ T8080] device bridge_slave_1 entered promiscuous mode [ 407.562043][ T8080] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 407.573011][ T8164] syz.7.1033 uses obsolete (PF_INET,SOCK_PACKET) [ 407.722101][ T8080] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 408.299603][ T8080] team0: Port device team_slave_0 added [ 408.337169][ T8080] team0: Port device team_slave_1 added [ 408.562456][ T8080] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 408.585069][ T8080] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 408.742975][ T7] Bluetooth: hci5: command 0x040f tx timeout [ 409.388364][ T8080] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 409.627971][ T8080] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 409.663922][ T8080] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 409.909382][ T8080] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 410.812757][ T7] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 411.670762][ T4268] Bluetooth: hci5: command 0x0419 tx timeout [ 411.727920][ T8197] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1038'. [ 411.794145][ T8080] device hsr_slave_0 entered promiscuous mode [ 411.823509][ T8080] device hsr_slave_1 entered promiscuous mode [ 411.852559][ T8080] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 411.876062][ T8080] Cannot create hsr debugfs directory [ 411.912802][ T7] usb 7-1: Using ep0 maxpacket: 32 [ 412.063030][ T7] usb 7-1: config 9 has an invalid interface number: 27 but max is 0 [ 412.094128][ T7] usb 7-1: config 9 has no interface number 0 [ 412.100288][ T7] usb 7-1: config 9 interface 27 has no altsetting 0 [ 412.432967][ T7] usb 7-1: New USB device found, idVendor=413c, idProduct=8196, bcdDevice=71.fa [ 412.599196][ T7] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.626524][ T7] usb 7-1: Product: syz [ 412.635084][ T7] usb 7-1: Manufacturer: syz [ 412.641880][ T7] usb 7-1: SerialNumber: syz [ 413.572842][ T7] usb 7-1: can't set config #9, error -71 [ 413.585933][ T8232] binder: BINDER_SET_CONTEXT_MGR already set [ 413.691073][ T7] usb 7-1: USB disconnect, device number 9 [ 413.734793][ T8232] binder: 8231:8232 ioctl 4018620d 200000004a80 returned -16 [ 414.617158][ T8080] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 414.695323][ T8250] ubi: mtd0 is already attached to ubi0 [ 416.767816][ T8080] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 416.799157][ T8270] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1051'. [ 416.841201][ T8080] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 416.922835][ T4268] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 416.925509][ T8080] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 416.974946][ T4282] device hsr_slave_0 left promiscuous mode [ 417.002400][ T4282] device hsr_slave_1 left promiscuous mode [ 417.037121][ T4282] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 417.079240][ T4282] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 417.107416][ T4282] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 417.136177][ T4282] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 417.205343][ T4282] device bridge_slave_1 left promiscuous mode [ 417.217557][ T4282] bridge0: port 2(bridge_slave_1) entered disabled state [ 417.228767][ T4282] device bridge_slave_0 left promiscuous mode [ 417.241269][ T4282] bridge0: port 1(bridge_slave_0) entered disabled state [ 417.267001][ T4282] device veth1_macvtap left promiscuous mode [ 417.273935][ T4282] device veth0_macvtap left promiscuous mode [ 417.286840][ T4282] device veth1_vlan left promiscuous mode [ 417.300848][ T4282] device veth0_vlan left promiscuous mode [ 418.182838][ T4268] usb 8-1: New USB device found, idVendor=046d, idProduct=c52b, bcdDevice=24.00 [ 418.191957][ T4268] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 418.958992][ T4194] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 418.968860][ T4194] CPU: 1 PID: 4194 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 418.976393][ T4194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 418.986433][ T4194] Workqueue: hci3 hci_rx_work [ 418.991114][ T4194] Call Trace: [ 418.994374][ T4194] [ 418.997286][ T4194] dump_stack_lvl+0x188/0x250 [ 419.001942][ T4194] ? show_regs_print_info+0x20/0x20 [ 419.007119][ T4194] ? load_image+0x410/0x410 [ 419.011606][ T4194] sysfs_create_dir_ns+0x26a/0x290 [ 419.016696][ T4194] ? sysfs_warn_dup+0xa0/0xa0 [ 419.021347][ T4194] ? kthread+0x42e/0x520 [ 419.025580][ T4194] ? do_raw_spin_unlock+0x11d/0x230 [ 419.030799][ T4194] kobject_add_internal+0x5ba/0xcd0 [ 419.036017][ T4194] kobject_add+0x160/0x230 [ 419.040453][ T4194] ? kobject_init+0x1c0/0x1c0 [ 419.045139][ T4194] ? __raw_spin_lock_init+0x41/0x100 [ 419.050440][ T4194] ? klist_children_get+0x50/0x50 [ 419.055476][ T4194] ? get_device_parent+0x121/0x3e0 [ 419.060599][ T4194] device_add+0x470/0x1050 [ 419.065022][ T4194] ? device_initialize+0x2a5/0x4d0 [ 419.070121][ T4194] hci_conn_add_sysfs+0xd1/0x1e0 [ 419.073305][ T4268] usb 8-1: can't set config #1, error -71 [ 419.075077][ T4194] le_conn_complete_evt+0xc55/0x14d0 [ 419.086072][ T4194] ? cs_le_create_conn+0x5e0/0x5e0 [ 419.091174][ T4194] ? __mutex_trylock_common+0x15c/0x260 [ 419.096708][ T4194] hci_le_meta_evt+0x285/0x3ca0 [ 419.101778][ T4194] ? hci_event_packet+0x363/0x1310 [ 419.106891][ T4194] ? __lock_acquire+0x7d40/0x7d40 [ 419.111924][ T4194] ? hci_remote_host_features_evt+0x240/0x240 [ 419.118014][ T4194] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 419.123635][ T4194] ? mark_lock+0x94/0x320 [ 419.128052][ T4194] ? mutex_unlock+0x10/0x10 [ 419.132631][ T4194] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 419.138604][ T4194] ? lock_chain_count+0x20/0x20 [ 419.143472][ T4194] ? __rwlock_init+0x140/0x140 [ 419.148235][ T4194] hci_event_packet+0xe0b/0x1310 [ 419.153168][ T4194] ? _raw_spin_unlock+0x40/0x40 [ 419.158018][ T4194] ? rcu_lock_release+0x20/0x20 [ 419.162872][ T4194] ? hci_send_to_monitor+0x9c/0x4a0 [ 419.168080][ T4194] hci_rx_work+0x255/0xa10 [ 419.172491][ T4194] process_one_work+0x867/0xff0 [ 419.177351][ T4194] ? worker_detach_from_pool+0x240/0x240 [ 419.182973][ T4194] ? lockdep_hardirqs_off+0x70/0x100 [ 419.188261][ T4194] ? _raw_spin_lock_irq+0xb7/0xf0 [ 419.193274][ T4194] ? _raw_spin_lock_irqsave+0x100/0x100 [ 419.198799][ T4194] ? wq_worker_running+0x97/0x170 [ 419.203806][ T4194] worker_thread+0xad7/0x12a0 [ 419.208471][ T4194] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 419.214345][ T4194] kthread+0x42e/0x520 [ 419.218391][ T4194] ? rcu_lock_release+0x20/0x20 [ 419.223250][ T4194] ? kthread_blkcg+0xd0/0xd0 [ 419.227823][ T4194] ret_from_fork+0x1f/0x30 [ 419.232224][ T4194] [ 419.242779][ T4194] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 419.256543][ T4194] Bluetooth: hci3: failed to register connection device [ 419.294049][ T4268] usb 8-1: USB disconnect, device number 2 [ 419.718491][ T4282] team0 (unregistering): Port device team_slave_1 removed [ 419.763997][ T4282] team0 (unregistering): Port device team_slave_0 removed [ 419.815932][ T4282] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 419.842070][ T4282] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 419.922805][ T4272] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 419.996842][ T4282] bond0 (unregistering): Released all slaves [ 420.172829][ T4272] usb 7-1: Using ep0 maxpacket: 32 [ 420.193910][ T8080] 8021q: adding VLAN 0 to HW filter on device bond0 [ 420.234211][ T7263] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 420.263332][ T7263] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 420.298188][ T4272] usb 7-1: config 9 has an invalid interface number: 27 but max is 0 [ 420.325061][ T4272] usb 7-1: config 9 has no interface number 0 [ 420.354936][ T4272] usb 7-1: config 9 interface 27 has no altsetting 0 [ 420.784391][ T4272] usb 7-1: New USB device found, idVendor=413c, idProduct=8196, bcdDevice=71.fa [ 420.813949][ T4272] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.852575][ T4272] usb 7-1: Product: syz [ 420.872963][ T4272] usb 7-1: Manufacturer: syz [ 420.887875][ T4272] usb 7-1: SerialNumber: syz [ 421.283786][ T4272] qmi_wwan: probe of 7-1:9.27 failed with error -22 [ 421.315979][ T4272] usb 7-1: USB disconnect, device number 10 [ 421.655034][ T8080] 8021q: adding VLAN 0 to HW filter on device team0 [ 421.705596][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 421.783290][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 421.926106][ T4254] bridge0: port 1(bridge_slave_0) entered blocking state [ 421.933245][ T4254] bridge0: port 1(bridge_slave_0) entered forwarding state [ 422.147371][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 422.394029][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 422.448060][ T4254] bridge0: port 2(bridge_slave_1) entered blocking state [ 422.455258][ T4254] bridge0: port 2(bridge_slave_1) entered forwarding state [ 422.538160][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 422.723903][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 422.906930][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 423.624283][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 423.783032][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 424.436429][ T8345] binder: 8344:8345 ioctl c0306201 0 returned -14 [ 424.488388][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 424.538737][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 424.656913][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 424.718380][ T8351] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 424.849229][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 424.991143][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 425.138264][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 425.263658][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 425.391888][ T8080] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 425.595993][ T4190] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 425.605909][ T4190] CPU: 1 PID: 4190 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 425.613471][ T4190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 425.623530][ T4190] Workqueue: hci1 hci_rx_work [ 425.628221][ T4190] Call Trace: [ 425.631495][ T4190] [ 425.634422][ T4190] dump_stack_lvl+0x188/0x250 [ 425.639101][ T4190] ? show_regs_print_info+0x20/0x20 [ 425.644295][ T4190] ? load_image+0x410/0x410 [ 425.648817][ T4190] sysfs_create_dir_ns+0x26a/0x290 [ 425.653926][ T4190] ? sysfs_warn_dup+0xa0/0xa0 [ 425.658599][ T4190] ? kthread+0x42e/0x520 [ 425.662839][ T4190] ? do_raw_spin_unlock+0x11d/0x230 [ 425.668038][ T4190] kobject_add_internal+0x5ba/0xcd0 [ 425.673283][ T4190] kobject_add+0x160/0x230 [ 425.677704][ T4190] ? kobject_init+0x1c0/0x1c0 [ 425.682384][ T4190] ? __raw_spin_lock_init+0x41/0x100 [ 425.687669][ T4190] ? klist_children_get+0x50/0x50 [ 425.692693][ T4190] ? get_device_parent+0x121/0x3e0 [ 425.697811][ T4190] device_add+0x470/0x1050 [ 425.702242][ T4190] ? device_initialize+0x2a5/0x4d0 [ 425.707357][ T4190] hci_conn_add_sysfs+0xd1/0x1e0 [ 425.712300][ T4190] le_conn_complete_evt+0xc55/0x14d0 [ 425.717598][ T4190] ? cs_le_create_conn+0x5e0/0x5e0 [ 425.722717][ T4190] ? __mutex_trylock_common+0x15c/0x260 [ 425.728270][ T4190] hci_le_meta_evt+0x285/0x3ca0 [ 425.733122][ T4190] ? hci_event_packet+0x363/0x1310 [ 425.738234][ T4190] ? __lock_acquire+0x7d40/0x7d40 [ 425.743270][ T4190] ? hci_remote_host_features_evt+0x240/0x240 [ 425.749336][ T4190] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 425.755054][ T4190] ? mark_lock+0x94/0x320 [ 425.759381][ T4190] ? mutex_unlock+0x10/0x10 [ 425.763883][ T4190] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 425.769871][ T4190] ? lock_chain_count+0x20/0x20 [ 425.774737][ T4190] ? __rwlock_init+0x140/0x140 [ 425.779504][ T4190] hci_event_packet+0xe0b/0x1310 [ 425.784446][ T4190] ? _raw_spin_unlock+0x40/0x40 [ 425.789296][ T4190] ? rcu_lock_release+0x20/0x20 [ 425.794146][ T4190] ? hci_send_to_monitor+0x9c/0x4a0 [ 425.799359][ T4190] hci_rx_work+0x255/0xa10 [ 425.803796][ T4190] process_one_work+0x867/0xff0 [ 425.808662][ T4190] ? worker_detach_from_pool+0x240/0x240 [ 425.814293][ T4190] ? lockdep_hardirqs_off+0x70/0x100 [ 425.819591][ T4190] ? _raw_spin_lock_irq+0xb7/0xf0 [ 425.824619][ T4190] ? _raw_spin_lock_irqsave+0x100/0x100 [ 425.830168][ T4190] ? wq_worker_running+0x97/0x170 [ 425.835196][ T4190] worker_thread+0xad7/0x12a0 [ 425.839909][ T4190] kthread+0x42e/0x520 [ 425.843977][ T4190] ? rcu_lock_release+0x20/0x20 [ 425.848826][ T4190] ? kthread_blkcg+0xd0/0xd0 [ 425.853415][ T4190] ret_from_fork+0x1f/0x30 [ 425.857846][ T4190] [ 425.879728][ T4190] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 425.894122][ T4190] Bluetooth: hci1: failed to register connection device [ 428.185229][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 428.213179][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 428.234054][ T8080] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 428.734263][ T4229] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 428.898674][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 428.965109][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 429.172598][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 429.213069][ T4229] usb 8-1: New USB device found, idVendor=046d, idProduct=c52b, bcdDevice=24.00 [ 429.275120][ T4229] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 429.343291][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 429.462744][ T4229] usb 8-1: Product: syz [ 429.502485][ T4229] usb 8-1: Manufacturer: syz [ 429.635653][ T8080] device veth0_vlan entered promiscuous mode [ 429.653222][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 429.661574][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 429.679933][ T8080] device veth1_vlan entered promiscuous mode [ 430.022141][ T4229] logitech-djreceiver 0003:046D:C52B.0006: unknown main item tag 0x0 [ 430.196931][ T4229] logitech-djreceiver 0003:046D:C52B.0006: unknown main item tag 0x0 [ 430.369723][ T4229] logitech-djreceiver 0003:046D:C52B.0006: unknown main item tag 0x0 [ 430.378173][ T4229] logitech-djreceiver 0003:046D:C52B.0006: unknown main item tag 0x0 [ 430.390007][ T4229] logitech-djreceiver 0003:046D:C52B.0006: unknown main item tag 0x0 [ 430.402833][ T4229] logitech-djreceiver 0003:046D:C52B.0006: unbalanced collection at end of report description [ 430.414981][ T4229] logitech-djreceiver 0003:046D:C52B.0006: logi_dj_probe: parse failed [ 430.438148][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x4255 instead [ 430.452818][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0001 instead [ 430.489385][ T4229] logitech-djreceiver: probe of 0003:046D:C52B.0006 failed with error -22 [ 430.502792][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0xb91b instead [ 430.523736][ T4374] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 430.532582][ T4374] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 430.536711][ T4229] usb 8-1: USB disconnect, device number 3 [ 430.577352][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000003c: 0x7508 instead [ 430.596276][ T8080] device veth0_macvtap entered promiscuous mode [ 430.630058][ T8080] device veth1_macvtap entered promiscuous mode [ 430.645793][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000040: 0x4255 instead [ 430.656943][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000044: 0x0101 instead [ 430.677274][ T4285] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 430.697079][ T4285] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 430.706878][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000048: 0xff7f instead [ 430.752405][ T8080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 430.778241][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000007c: 0xb365 instead [ 430.809698][ T4194] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 430.820132][ T4194] CPU: 1 PID: 4194 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 430.827686][ T4194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 430.837730][ T4194] Workqueue: hci0 hci_rx_work [ 430.842400][ T4194] Call Trace: [ 430.845675][ T4194] [ 430.848590][ T4194] dump_stack_lvl+0x188/0x250 [ 430.853252][ T4194] ? show_regs_print_info+0x20/0x20 [ 430.858433][ T4194] ? load_image+0x410/0x410 [ 430.862939][ T4194] sysfs_create_dir_ns+0x26a/0x290 [ 430.868051][ T4194] ? sysfs_warn_dup+0xa0/0xa0 [ 430.872723][ T4194] ? kthread+0x42e/0x520 [ 430.876973][ T4194] ? do_raw_spin_unlock+0x11d/0x230 [ 430.882187][ T4194] kobject_add_internal+0x5ba/0xcd0 [ 430.887397][ T4194] kobject_add+0x160/0x230 [ 430.888898][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000128: 0x16f1 instead [ 430.891846][ T4194] ? kobject_init+0x1c0/0x1c0 [ 430.891872][ T4194] ? __raw_spin_lock_init+0x41/0x100 [ 430.912115][ T4194] ? klist_children_get+0x50/0x50 [ 430.917122][ T4194] ? get_device_parent+0x121/0x3e0 [ 430.922222][ T4194] device_add+0x470/0x1050 [ 430.926636][ T4194] ? device_initialize+0x2a5/0x4d0 [ 430.931753][ T4194] hci_conn_add_sysfs+0xd1/0x1e0 [ 430.936675][ T4194] le_conn_complete_evt+0xc55/0x14d0 [ 430.941949][ T4194] ? cs_le_create_conn+0x5e0/0x5e0 [ 430.947067][ T4194] ? __mutex_trylock_common+0x15c/0x260 [ 430.952598][ T4194] hci_le_meta_evt+0x285/0x3ca0 [ 430.957428][ T4194] ? hci_event_packet+0x363/0x1310 [ 430.962608][ T4194] ? __lock_acquire+0x7d40/0x7d40 [ 430.967618][ T4194] ? hci_remote_host_features_evt+0x240/0x240 [ 430.973672][ T4194] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 430.979301][ T4194] ? mark_lock+0x94/0x320 [ 430.983619][ T4194] ? mutex_unlock+0x10/0x10 [ 430.988122][ T4194] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 430.994100][ T4194] ? lock_chain_count+0x20/0x20 [ 430.998937][ T4194] ? __rwlock_init+0x140/0x140 [ 431.003685][ T4194] hci_event_packet+0xe0b/0x1310 [ 431.008608][ T4194] ? _raw_spin_unlock+0x40/0x40 [ 431.013445][ T4194] ? rcu_lock_release+0x20/0x20 [ 431.018278][ T4194] ? hci_send_to_monitor+0x9c/0x4a0 [ 431.023467][ T4194] hci_rx_work+0x255/0xa10 [ 431.027880][ T4194] process_one_work+0x867/0xff0 [ 431.032724][ T4194] ? worker_detach_from_pool+0x240/0x240 [ 431.038335][ T4194] ? lockdep_hardirqs_off+0x70/0x100 [ 431.043626][ T4194] ? _raw_spin_lock_irq+0xb7/0xf0 [ 431.048635][ T4194] ? _raw_spin_lock_irqsave+0x100/0x100 [ 431.054201][ T4194] ? wq_worker_running+0x97/0x170 [ 431.059204][ T4194] worker_thread+0xad7/0x12a0 [ 431.063873][ T4194] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 431.069759][ T4194] kthread+0x42e/0x520 [ 431.073829][ T4194] ? rcu_lock_release+0x20/0x20 [ 431.078684][ T4194] ? kthread_blkcg+0xd0/0xd0 [ 431.083256][ T4194] ret_from_fork+0x1f/0x30 [ 431.087673][ T4194] [ 431.094521][ T4194] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 431.107808][ T4194] Bluetooth: hci0: failed to register connection device [ 431.114998][ T8080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 431.125489][ T8080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 431.136275][ T8080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 431.146130][ T8080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 431.160194][ T8080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 431.170104][ T8080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 431.184300][ T8080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 431.195385][ T8080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 431.206981][ T8080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 431.225435][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000001d4: 0x16f1 instead [ 431.236768][ T8415] jffs2: Further such events for this erase block will not be printed [ 431.247599][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001000: 0x4255 instead [ 431.258124][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001004: 0x0001 instead [ 431.268743][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001018: 0xb91b instead [ 431.451948][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000103c: 0x7508 instead [ 431.651574][ T8080] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 431.693132][ T5962] Bluetooth: hci4: command 0x0406 tx timeout [ 431.701653][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001040: 0x4255 instead [ 431.752854][ T8080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 431.802857][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001044: 0x0101 instead [ 431.833943][ T8080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 431.889822][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001048: 0xff7f instead [ 431.920862][ T8080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 431.958141][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000107c: 0xef7b instead [ 432.003846][ T8080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 432.054557][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001128: 0x16f1 instead [ 432.109040][ T8080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 432.149516][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000011d4: 0x16f1 instead [ 432.212760][ T8080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 432.222617][ T8080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 432.233340][ T8415] jffs2: Further such events for this erase block will not be printed [ 432.241865][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002000: 0x4255 instead [ 432.268748][ T8080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 432.312710][ T8080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 432.323400][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002004: 0x0001 instead [ 432.342757][ T8080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 432.364014][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002018: 0xb91b instead [ 432.378473][ T8080] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 432.409002][ T7263] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 432.428986][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000203c: 0xbe37 instead [ 432.440971][ T7263] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 432.463812][ T7263] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 432.478994][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003000: 0x4255 instead [ 432.510035][ T7263] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 432.518269][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003004: 0x0001 instead [ 432.546971][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003018: 0xb91b instead [ 432.559530][ T8080] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.586588][ T8080] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.606517][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000303c: 0xbe37 instead [ 432.628806][ T8080] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.649120][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004000: 0x4255 instead [ 432.659996][ T8080] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.713943][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004004: 0x0001 instead [ 432.772777][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004018: 0xb91b instead [ 432.811393][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000403c: 0xbe37 instead [ 432.858203][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 432.866530][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005000: 0x4255 instead [ 432.900679][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 432.912900][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005004: 0x0001 instead [ 432.964311][ T4374] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 432.972145][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005018: 0xb91b instead [ 432.999438][ T4275] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 433.032935][ T4275] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 433.041618][ T4275] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 433.049267][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000503c: 0xbe37 instead [ 433.091237][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006000: 0x4255 instead [ 433.122341][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006004: 0x0001 instead [ 433.168963][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006018: 0xb91b instead [ 433.214107][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000603c: 0xbe37 instead [ 433.263574][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007000: 0x4255 instead [ 433.736711][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007004: 0x0001 instead [ 433.777819][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007018: 0xb91b instead [ 433.809638][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000703c: 0xbe37 instead [ 433.857294][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008000: 0x4255 instead [ 433.922865][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008004: 0x0001 instead [ 433.982031][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008018: 0xb91b instead [ 434.042919][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000803c: 0xbe37 instead [ 434.083366][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009000: 0x4255 instead [ 434.135279][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009004: 0x0001 instead [ 434.189804][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009018: 0xb91b instead [ 434.215228][ T8459] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1086'. [ 434.259225][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000903c: 0xbe37 instead [ 434.297150][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a000: 0x4255 instead [ 434.341272][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a004: 0x0001 instead [ 434.367185][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a018: 0xb91b instead [ 434.454121][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a03c: 0xbe37 instead [ 434.488630][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b000: 0x4255 instead [ 434.499725][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b004: 0x0001 instead [ 434.522912][ T5962] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 434.552278][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b018: 0xb91b instead [ 434.574755][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b03c: 0xbe37 instead [ 434.757262][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c000: 0x4255 instead [ 434.775939][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c004: 0x0001 instead [ 434.794514][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c018: 0xb91b instead [ 434.811823][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c03c: 0xbe37 instead [ 434.841937][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d000: 0x4255 instead [ 434.882854][ T5962] usb 2-1: Using ep0 maxpacket: 32 [ 434.922056][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d004: 0x0001 instead [ 435.013306][ T5962] usb 2-1: config 9 has an invalid interface number: 27 but max is 0 [ 435.076498][ T5962] usb 2-1: config 9 has no interface number 0 [ 435.152469][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d018: 0xb91b instead [ 435.181823][ T5962] usb 2-1: config 9 interface 27 has no altsetting 0 [ 435.319138][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d03c: 0xbe37 instead [ 435.389834][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e000: 0x4255 instead [ 435.400343][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e004: 0x0001 instead [ 435.416720][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e018: 0xb91b instead [ 435.433341][ T5962] usb 2-1: New USB device found, idVendor=413c, idProduct=8196, bcdDevice=71.fa [ 435.501416][ T5962] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.510366][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e03c: 0xbe37 instead [ 435.552868][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f000: 0x4255 instead [ 435.558127][ T5962] usb 2-1: Product: syz [ 435.572706][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f004: 0x0001 instead [ 435.584321][ T8483] device syzkaller0 entered promiscuous mode [ 435.591143][ T5962] usb 2-1: Manufacturer: syz [ 435.597523][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f018: 0xb91b instead [ 435.610809][ T5962] usb 2-1: SerialNumber: syz [ 435.615055][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f03c: 0xbe37 instead [ 435.626287][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x4255 instead [ 435.640499][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0x0001 instead [ 435.651757][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0xb91b instead [ 435.667023][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001003c: 0xbe37 instead [ 435.679101][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011000: 0x4255 instead [ 435.696652][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011004: 0x0001 instead [ 435.712344][ T8485] ubi: mtd0 is already attached to ubi0 [ 435.723676][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011018: 0xb91b instead [ 435.741390][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001103c: 0xbe37 instead [ 435.760092][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012000: 0x4255 instead [ 435.779522][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012004: 0x0001 instead [ 435.791046][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012018: 0xb91b instead [ 435.814269][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001203c: 0xbe37 instead [ 435.840594][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013000: 0x4255 instead [ 435.851426][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013004: 0x0001 instead [ 435.871510][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013018: 0xb91b instead [ 435.890361][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001303c: 0xbe37 instead [ 435.913985][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014000: 0x4255 instead [ 435.931226][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014004: 0x0001 instead [ 435.952908][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014018: 0xb91b instead [ 435.975241][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001403c: 0xbe37 instead [ 435.993538][ T5962] qmi_wwan: probe of 2-1:9.27 failed with error -22 [ 436.001620][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015000: 0x4255 instead [ 436.029147][ T5962] usb 2-1: USB disconnect, device number 24 [ 436.057793][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015004: 0x0001 instead [ 436.536070][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015018: 0xb91b instead [ 436.594049][ T4190] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 436.604753][ T4190] CPU: 1 PID: 4190 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 436.612323][ T4190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 436.622479][ T4190] Workqueue: hci3 hci_rx_work [ 436.627182][ T4190] Call Trace: [ 436.630468][ T4190] [ 436.633443][ T4190] dump_stack_lvl+0x188/0x250 [ 436.638139][ T4190] ? show_regs_print_info+0x20/0x20 [ 436.643344][ T4190] ? load_image+0x410/0x410 [ 436.647867][ T4190] sysfs_create_dir_ns+0x26a/0x290 [ 436.653029][ T4190] ? sysfs_warn_dup+0xa0/0xa0 [ 436.657891][ T4190] ? kthread+0x42e/0x520 [ 436.662147][ T4190] ? do_raw_spin_unlock+0x11d/0x230 [ 436.667376][ T4190] kobject_add_internal+0x5ba/0xcd0 [ 436.672603][ T4190] kobject_add+0x160/0x230 [ 436.678081][ T4190] ? kobject_init+0x1c0/0x1c0 [ 436.682807][ T4190] ? __raw_spin_lock_init+0x41/0x100 [ 436.688103][ T4190] ? klist_children_get+0x50/0x50 [ 436.693142][ T4190] ? get_device_parent+0x121/0x3e0 [ 436.698283][ T4190] device_add+0x470/0x1050 [ 436.702716][ T4190] ? device_initialize+0x2a5/0x4d0 [ 436.707840][ T4190] hci_conn_add_sysfs+0xd1/0x1e0 [ 436.712790][ T4190] le_conn_complete_evt+0xc55/0x14d0 [ 436.718092][ T4190] ? cs_le_create_conn+0x5e0/0x5e0 [ 436.723221][ T4190] ? __mutex_trylock_common+0x15c/0x260 [ 436.728780][ T4190] hci_le_meta_evt+0x285/0x3ca0 [ 436.733636][ T4190] ? hci_event_packet+0x363/0x1310 [ 436.739628][ T4190] ? __lock_acquire+0x7d40/0x7d40 [ 436.744767][ T4190] ? hci_remote_host_features_evt+0x240/0x240 [ 436.750852][ T4190] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 436.756495][ T4190] ? mark_lock+0x94/0x320 [ 436.760838][ T4190] ? mutex_unlock+0x10/0x10 [ 436.765356][ T4190] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 436.771352][ T4190] ? lock_chain_count+0x20/0x20 [ 436.776216][ T4190] ? __rwlock_init+0x140/0x140 [ 436.781034][ T4190] hci_event_packet+0xe0b/0x1310 [ 436.785999][ T4190] ? _raw_spin_unlock+0x40/0x40 [ 436.790867][ T4190] ? rcu_lock_release+0x20/0x20 [ 436.795732][ T4190] ? hci_send_to_monitor+0x9c/0x4a0 [ 436.800943][ T4190] hci_rx_work+0x255/0xa10 [ 436.805386][ T4190] process_one_work+0x867/0xff0 [ 436.810259][ T4190] ? worker_detach_from_pool+0x240/0x240 [ 436.815901][ T4190] ? lockdep_hardirqs_off+0x70/0x100 [ 436.821206][ T4190] ? _raw_spin_lock_irq+0xb7/0xf0 [ 436.826243][ T4190] ? _raw_spin_lock_irqsave+0x100/0x100 [ 436.831809][ T4190] ? wq_worker_running+0x97/0x170 [ 436.836848][ T4190] worker_thread+0xad7/0x12a0 [ 436.841561][ T4190] kthread+0x42e/0x520 [ 436.845635][ T4190] ? rcu_lock_release+0x20/0x20 [ 436.850495][ T4190] ? kthread_blkcg+0xd0/0xd0 [ 436.855092][ T4190] ret_from_fork+0x1f/0x30 [ 436.859534][ T4190] [ 436.878695][ T4190] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 436.894039][ T4190] Bluetooth: hci3: failed to register connection device [ 436.911096][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001503c: 0xbe37 instead [ 436.964317][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016000: 0x4255 instead [ 437.141009][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016004: 0x0001 instead [ 437.152058][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016018: 0xb91b instead [ 437.163643][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001603c: 0xbe37 instead [ 437.187626][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017000: 0x4255 instead [ 437.232301][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017004: 0x0001 instead [ 437.265935][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017018: 0xb91b instead [ 437.354634][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001703c: 0xbe37 instead [ 437.392960][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0x4255 instead [ 438.143481][ T7240] Bluetooth: hci0: command 0x2016 tx timeout [ 438.247679][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0x0001 instead [ 438.323865][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0xb91b instead [ 438.344796][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001803c: 0xbe37 instead [ 438.452916][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x4255 instead [ 439.277505][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0x0001 instead [ 439.377784][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0xb91b instead [ 439.403738][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001903c: 0xbe37 instead [ 439.422890][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x4255 instead [ 439.623858][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x0001 instead [ 439.893998][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0xb91b instead [ 440.149013][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a03c: 0xbe37 instead [ 440.521658][ T8546] IPVS: dh: UDP 127.0.0.1:21 - no destination available [ 440.583511][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x4255 instead [ 440.608669][ T1420] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.616009][ T1420] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.644487][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x0001 instead [ 440.716123][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0xb91b instead [ 440.724597][ T8552] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 440.770171][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b03c: 0xbe37 instead [ 440.811269][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0x4255 instead [ 440.838479][ T8552] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 440.876982][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x0001 instead [ 440.910141][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0xb91b instead [ 440.950894][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c03c: 0xbe37 instead [ 440.990661][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0x4255 instead [ 441.049688][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x0001 instead [ 441.080566][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0xb91b instead [ 441.115824][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d03c: 0xbe37 instead [ 441.156195][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0x4255 instead [ 441.168586][ T5962] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 441.294768][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x0001 instead [ 441.411857][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0xb91b instead [ 441.432817][ T5962] usb 9-1: Using ep0 maxpacket: 32 [ 441.536416][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0xbe37 instead [ 441.553042][ T5962] usb 9-1: config 9 has an invalid interface number: 27 but max is 0 [ 441.585626][ T5962] usb 9-1: config 9 has no interface number 0 [ 441.648756][ T5962] usb 9-1: config 9 interface 27 has no altsetting 0 [ 441.679982][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead [ 441.845108][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead [ 441.893231][ T5962] usb 9-1: New USB device found, idVendor=413c, idProduct=8196, bcdDevice=71.fa [ 441.936630][ T5962] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 441.997737][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0xb91b instead [ 442.036085][ T5962] usb 9-1: Product: syz [ 442.091012][ T5962] usb 9-1: Manufacturer: syz [ 442.129277][ T8415] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0xbe37 instead [ 442.151587][ T5962] usb 9-1: SerialNumber: syz [ 442.251941][ T8415] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 442.318961][ T8415] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 442.428889][ T4190] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 442.438879][ T4190] CPU: 1 PID: 4190 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 442.446441][ T4190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 442.456507][ T4190] Workqueue: hci4 hci_rx_work [ 442.461198][ T4190] Call Trace: [ 442.465184][ T4190] [ 442.469412][ T4190] dump_stack_lvl+0x188/0x250 [ 442.474732][ T4190] ? show_regs_print_info+0x20/0x20 [ 442.481424][ T4190] ? load_image+0x410/0x410 [ 442.486345][ T4190] sysfs_create_dir_ns+0x26a/0x290 [ 442.491486][ T4190] ? sysfs_warn_dup+0xa0/0xa0 [ 442.496291][ T4190] ? kthread+0x42e/0x520 [ 442.500558][ T4190] ? do_raw_spin_unlock+0x11d/0x230 [ 442.505778][ T4190] kobject_add_internal+0x5ba/0xcd0 [ 442.511175][ T4190] kobject_add+0x160/0x230 [ 442.516350][ T4190] ? kobject_init+0x1c0/0x1c0 [ 442.521060][ T4190] ? __raw_spin_lock_init+0x41/0x100 [ 442.526371][ T4190] ? klist_children_get+0x50/0x50 [ 442.531419][ T4190] ? get_device_parent+0x121/0x3e0 [ 442.536558][ T4190] device_add+0x470/0x1050 [ 442.541007][ T4190] ? device_initialize+0x2a5/0x4d0 [ 442.546226][ T4190] hci_conn_add_sysfs+0xd1/0x1e0 [ 442.551191][ T4190] le_conn_complete_evt+0xc55/0x14d0 [ 442.556505][ T4190] ? cs_le_create_conn+0x5e0/0x5e0 [ 442.561632][ T4190] ? __mutex_trylock_common+0x15c/0x260 [ 442.567397][ T4190] hci_le_meta_evt+0x285/0x3ca0 [ 442.572254][ T4190] ? hci_event_packet+0x363/0x1310 [ 442.577356][ T4190] ? __lock_acquire+0x7d40/0x7d40 [ 442.582376][ T4190] ? hci_remote_host_features_evt+0x240/0x240 [ 442.588428][ T4190] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 442.594051][ T4190] ? mark_lock+0x94/0x320 [ 442.598378][ T4190] ? mutex_unlock+0x10/0x10 [ 442.602889][ T4190] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 442.608992][ T4190] ? lock_chain_count+0x20/0x20 [ 442.613846][ T4190] ? __rwlock_init+0x140/0x140 [ 442.618611][ T4190] hci_event_packet+0xe0b/0x1310 [ 442.623597][ T4190] ? _raw_spin_unlock+0x40/0x40 [ 442.628528][ T4190] ? rcu_lock_release+0x20/0x20 [ 442.633373][ T4190] ? hci_send_to_monitor+0x9c/0x4a0 [ 442.638978][ T4190] hci_rx_work+0x255/0xa10 [ 442.643482][ T4190] process_one_work+0x867/0xff0 [ 442.648700][ T4190] ? worker_detach_from_pool+0x240/0x240 [ 442.654434][ T4190] ? lockdep_hardirqs_off+0x70/0x100 [ 442.659716][ T4190] ? _raw_spin_lock_irq+0xb7/0xf0 [ 442.664731][ T4190] ? _raw_spin_lock_irqsave+0x100/0x100 [ 442.670265][ T4190] ? wq_worker_running+0x97/0x170 [ 442.675392][ T4190] worker_thread+0xad7/0x12a0 [ 442.680387][ T4190] kthread+0x42e/0x520 [ 442.684461][ T4190] ? rcu_lock_release+0x20/0x20 [ 442.689581][ T4190] ? kthread_blkcg+0xd0/0xd0 [ 442.694446][ T4190] ret_from_fork+0x1f/0x30 [ 442.698877][ T4190] [ 442.705357][ T4190] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 442.718898][ T4190] Bluetooth: hci4: failed to register connection device [ 442.773522][ T5962] qmi_wwan: probe of 9-1:9.27 failed with error -22 [ 442.788017][ T5962] usb 9-1: USB disconnect, device number 2 [ 444.394741][ T8622] IPVS: dh: UDP 127.0.0.1:21 - no destination available [ 444.671061][ T4190] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 444.681048][ T4190] CPU: 1 PID: 4190 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 444.688618][ T4190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 444.698692][ T4190] Workqueue: hci1 hci_rx_work [ 444.703494][ T4190] Call Trace: [ 444.706788][ T4190] [ 444.709739][ T4190] dump_stack_lvl+0x188/0x250 [ 444.714792][ T4190] ? show_regs_print_info+0x20/0x20 [ 444.720191][ T4190] ? load_image+0x410/0x410 [ 444.724828][ T4190] sysfs_create_dir_ns+0x26a/0x290 [ 444.729972][ T4190] ? sysfs_warn_dup+0xa0/0xa0 [ 444.734675][ T4190] ? kthread+0x42e/0x520 [ 444.738952][ T4190] ? do_raw_spin_unlock+0x11d/0x230 [ 444.744182][ T4190] kobject_add_internal+0x5ba/0xcd0 [ 444.749412][ T4190] kobject_add+0x160/0x230 [ 444.753846][ T4190] ? kobject_init+0x1c0/0x1c0 [ 444.758547][ T4190] ? __raw_spin_lock_init+0x41/0x100 [ 444.763875][ T4190] ? klist_children_get+0x50/0x50 [ 444.768934][ T4190] ? get_device_parent+0x121/0x3e0 [ 444.774158][ T4190] device_add+0x470/0x1050 [ 444.778593][ T4190] ? device_initialize+0x2a5/0x4d0 [ 444.783734][ T4190] hci_conn_add_sysfs+0xd1/0x1e0 [ 444.788703][ T4190] le_conn_complete_evt+0xc55/0x14d0 [ 444.794020][ T4190] ? cs_le_create_conn+0x5e0/0x5e0 [ 444.799157][ T4190] ? __mutex_trylock_common+0x15c/0x260 [ 444.804774][ T4190] hci_le_meta_evt+0x285/0x3ca0 [ 444.809650][ T4190] ? hci_event_packet+0x363/0x1310 [ 444.814780][ T4190] ? __lock_acquire+0x7d40/0x7d40 [ 444.819885][ T4190] ? hci_remote_host_features_evt+0x240/0x240 [ 444.825976][ T4190] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 444.831634][ T4190] ? mark_lock+0x94/0x320 [ 444.835982][ T4190] ? mutex_unlock+0x10/0x10 [ 444.840509][ T4190] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 444.846515][ T4190] ? lock_chain_count+0x20/0x20 [ 444.851390][ T4190] ? __rwlock_init+0x140/0x140 [ 444.856181][ T4190] hci_event_packet+0xe0b/0x1310 [ 444.861180][ T4190] ? _raw_spin_unlock+0x40/0x40 [ 444.866171][ T4190] ? rcu_lock_release+0x20/0x20 [ 444.871048][ T4190] ? hci_send_to_monitor+0x9c/0x4a0 [ 444.876282][ T4190] hci_rx_work+0x255/0xa10 [ 444.880824][ T4190] process_one_work+0x867/0xff0 [ 444.885719][ T4190] ? worker_detach_from_pool+0x240/0x240 [ 444.891378][ T4190] ? lockdep_hardirqs_off+0x70/0x100 [ 444.896783][ T4190] ? _raw_spin_lock_irq+0xb7/0xf0 [ 444.901837][ T4190] ? _raw_spin_lock_irqsave+0x100/0x100 [ 444.907427][ T4190] ? wq_worker_running+0x97/0x170 [ 444.912564][ T4190] worker_thread+0xad7/0x12a0 [ 444.917292][ T4190] kthread+0x42e/0x520 [ 444.921374][ T4190] ? rcu_lock_release+0x20/0x20 [ 444.926241][ T4190] ? kthread_blkcg+0xd0/0xd0 [ 444.930843][ T4190] ret_from_fork+0x1f/0x30 [ 444.935292][ T4190] [ 444.938405][ C1] vkms_vblank_simulate: vblank timer overrun [ 445.028242][ T4190] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 445.042234][ T4190] Bluetooth: hci1: failed to register connection device [ 445.054435][ T8627] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1122'. [ 445.064751][ T8627] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1122'. [ 445.073833][ T8627] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1122'. [ 445.082986][ T8627] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1122'. [ 445.091953][ T8627] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1122'. [ 445.120214][ T8633] netlink: 'syz.8.1124': attribute type 1 has an invalid length. [ 445.142415][ T8633] netlink: 'syz.8.1124': attribute type 2 has an invalid length. [ 445.865434][ T4225] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 447.642782][ T4225] usb 7-1: Using ep0 maxpacket: 32 [ 447.782809][ T4225] usb 7-1: config 9 has an invalid interface number: 27 but max is 0 [ 448.483169][ T4225] usb 7-1: config 9 has no interface number 0 [ 448.525412][ T8676] netlink: 32 bytes leftover after parsing attributes in process `syz.6.1135'. [ 448.558973][ T4225] usb 7-1: config 9 interface 27 has no altsetting 0 [ 448.602843][ T4225] usb 7-1: string descriptor 0 read error: -71 [ 448.609114][ T4225] usb 7-1: New USB device found, idVendor=413c, idProduct=8196, bcdDevice=71.fa [ 448.742989][ T4225] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.782885][ T4225] usb 7-1: can't set config #9, error -71 [ 448.811984][ T4225] usb 7-1: USB disconnect, device number 11 [ 449.985072][ T8703] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1141'. [ 449.997730][ T8703] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1141'. [ 450.008382][ T8703] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1141'. [ 450.018827][ T8703] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1141'. [ 451.560260][ T8714] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 451.603019][ T8714] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 451.892758][ T4272] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 452.152805][ T4272] usb 9-1: Using ep0 maxpacket: 32 [ 452.303144][ T4272] usb 9-1: config 9 has an invalid interface number: 27 but max is 0 [ 452.346107][ T4272] usb 9-1: config 9 has no interface number 0 [ 452.724898][ T4272] usb 9-1: config 9 interface 27 has no altsetting 0 [ 452.972870][ T4272] usb 9-1: New USB device found, idVendor=413c, idProduct=8196, bcdDevice=71.fa [ 453.052417][ T4272] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.064437][ T4272] usb 9-1: Product: syz [ 453.519099][ T4272] usb 9-1: Manufacturer: syz [ 453.550049][ T4272] usb 9-1: SerialNumber: syz [ 453.914388][ T4272] qmi_wwan: probe of 9-1:9.27 failed with error -22 [ 455.605886][ T4272] usb 9-1: USB disconnect, device number 3 [ 455.952490][ T8765] device-mapper: ioctl: Unable to rename non-existent device, t to j [ 456.037606][ T4194] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 456.047411][ T4194] CPU: 1 PID: 4194 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 456.054970][ T4194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 456.056544][ T8764] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 456.065034][ T4194] Workqueue: hci1 hci_rx_work [ 456.065070][ T4194] Call Trace: [ 456.065078][ T4194] [ 456.065086][ T4194] dump_stack_lvl+0x188/0x250 [ 456.088492][ T4194] ? show_regs_print_info+0x20/0x20 [ 456.093712][ T4194] ? load_image+0x410/0x410 [ 456.098241][ T4194] sysfs_create_dir_ns+0x26a/0x290 [ 456.103384][ T4194] ? sysfs_warn_dup+0xa0/0xa0 [ 456.108070][ T4194] ? kthread+0x42e/0x520 [ 456.112322][ T4194] ? do_raw_spin_unlock+0x11d/0x230 [ 456.117535][ T4194] kobject_add_internal+0x5ba/0xcd0 [ 456.122748][ T4194] kobject_add+0x160/0x230 [ 456.127177][ T4194] ? kobject_init+0x1c0/0x1c0 [ 456.131861][ T4194] ? __raw_spin_lock_init+0x41/0x100 [ 456.137168][ T4194] ? klist_children_get+0x50/0x50 [ 456.142205][ T4194] ? get_device_parent+0x121/0x3e0 [ 456.147333][ T4194] device_add+0x470/0x1050 [ 456.151759][ T4194] ? device_initialize+0x2a5/0x4d0 [ 456.156885][ T4194] hci_conn_add_sysfs+0xd1/0x1e0 [ 456.161846][ T4194] le_conn_complete_evt+0xc55/0x14d0 [ 456.165938][ T8764] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 456.167143][ T4194] ? cs_le_create_conn+0x5e0/0x5e0 [ 456.167175][ T4194] ? __mutex_trylock_common+0x15c/0x260 [ 456.186308][ T4194] hci_le_meta_evt+0x285/0x3ca0 [ 456.191175][ T4194] ? hci_event_packet+0x363/0x1310 [ 456.196301][ T4194] ? __lock_acquire+0x7d40/0x7d40 [ 456.201346][ T4194] ? hci_remote_host_features_evt+0x240/0x240 [ 456.207428][ T4194] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 456.213076][ T4194] ? mark_lock+0x94/0x320 [ 456.217415][ T4194] ? mutex_unlock+0x10/0x10 [ 456.221929][ T4194] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 456.227920][ T4194] ? lock_chain_count+0x20/0x20 [ 456.232782][ T4194] ? __rwlock_init+0x140/0x140 [ 456.237560][ T4194] hci_event_packet+0xe0b/0x1310 [ 456.242550][ T4194] ? _raw_spin_unlock+0x40/0x40 [ 456.247416][ T4194] ? rcu_lock_release+0x20/0x20 [ 456.252283][ T4194] ? hci_send_to_monitor+0x9c/0x4a0 [ 456.257498][ T4194] hci_rx_work+0x255/0xa10 [ 456.261941][ T4194] process_one_work+0x867/0xff0 [ 456.266811][ T4194] ? worker_detach_from_pool+0x240/0x240 [ 456.272446][ T4194] ? lockdep_hardirqs_off+0x70/0x100 [ 456.277744][ T4194] ? _raw_spin_lock_irq+0xb7/0xf0 [ 456.282780][ T4194] ? _raw_spin_lock_irqsave+0x100/0x100 [ 456.288333][ T4194] ? wq_worker_running+0x97/0x170 [ 456.293352][ T4194] worker_thread+0xad7/0x12a0 [ 456.298050][ T4194] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 456.303956][ T4194] kthread+0x42e/0x520 [ 456.308028][ T4194] ? rcu_lock_release+0x20/0x20 [ 456.312864][ T4194] ? kthread_blkcg+0xd0/0xd0 [ 456.317442][ T4194] ret_from_fork+0x1f/0x30 [ 456.321853][ T4194] [ 456.327862][ T4194] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 456.341171][ T4194] Bluetooth: hci1: failed to register connection device [ 458.172798][ T4272] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 458.836077][ T8814] __nla_validate_parse: 1 callbacks suppressed [ 458.836088][ T8814] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1170'. [ 458.852601][ T8814] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1170'. [ 458.861775][ T8814] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1170'. [ 458.870880][ T8814] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1170'. [ 458.880084][ T8814] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1170'. [ 458.914770][ T8821] ubi: mtd0 is already attached to ubi0 [ 459.013760][ T4272] usb 7-1: Using ep0 maxpacket: 32 [ 459.113129][ T8818] crypto_alloc_aead failed rc=-4 [ 459.132957][ T4272] usb 7-1: config 9 has an invalid interface number: 27 but max is 0 [ 459.148745][ T4272] usb 7-1: config 9 has no interface number 0 [ 459.172752][ T4272] usb 7-1: config 9 interface 27 has no altsetting 0 [ 459.234996][ T8839] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1172'. [ 459.467489][ T4272] usb 7-1: New USB device found, idVendor=413c, idProduct=8196, bcdDevice=71.fa [ 459.478008][ T4272] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.496801][ T4272] usb 7-1: Product: syz [ 459.503627][ T4272] usb 7-1: Manufacturer: syz [ 459.531851][ T4272] usb 7-1: SerialNumber: syz [ 460.537330][ T4272] qmi_wwan: probe of 7-1:9.27 failed with error -22 [ 460.630443][ T4272] usb 7-1: USB disconnect, device number 12 [ 460.672187][ T8865] binder: BINDER_SET_CONTEXT_MGR already set [ 460.721069][ T8865] binder: 8862:8865 ioctl 4018620d 200000004a80 returned -16 [ 460.792928][ T4190] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 460.802525][ T4190] CPU: 1 PID: 4190 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 460.810084][ T4190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 460.820153][ T4190] Workqueue: hci0 hci_rx_work [ 460.824860][ T4190] Call Trace: [ 460.828148][ T4190] [ 460.831088][ T4190] dump_stack_lvl+0x188/0x250 [ 460.835779][ T4190] ? show_regs_print_info+0x20/0x20 [ 460.840986][ T4190] ? load_image+0x410/0x410 [ 460.845510][ T4190] sysfs_create_dir_ns+0x26a/0x290 [ 460.850634][ T4190] ? sysfs_warn_dup+0xa0/0xa0 [ 460.855314][ T4190] ? kthread+0x42e/0x520 [ 460.859567][ T4190] ? do_raw_spin_unlock+0x11d/0x230 [ 460.864779][ T4190] kobject_add_internal+0x5ba/0xcd0 [ 460.869991][ T4190] kobject_add+0x160/0x230 [ 460.874418][ T4190] ? kobject_init+0x1c0/0x1c0 [ 460.879098][ T4190] ? __raw_spin_lock_init+0x41/0x100 [ 460.884387][ T4190] ? klist_children_get+0x50/0x50 [ 460.889426][ T4190] ? get_device_parent+0x121/0x3e0 [ 460.894545][ T4190] device_add+0x470/0x1050 [ 460.898975][ T4190] ? device_initialize+0x2a5/0x4d0 [ 460.904095][ T4190] hci_conn_add_sysfs+0xd1/0x1e0 [ 460.909050][ T4190] le_conn_complete_evt+0xc55/0x14d0 [ 460.914356][ T4190] ? cs_le_create_conn+0x5e0/0x5e0 [ 460.919483][ T4190] ? __mutex_trylock_common+0x15c/0x260 [ 460.925047][ T4190] hci_le_meta_evt+0x285/0x3ca0 [ 460.929911][ T4190] ? hci_event_packet+0x363/0x1310 [ 460.935037][ T4190] ? __lock_acquire+0x7d40/0x7d40 [ 460.940082][ T4190] ? hci_remote_host_features_evt+0x240/0x240 [ 460.946175][ T4190] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 460.951824][ T4190] ? mark_lock+0x94/0x320 [ 460.956161][ T4190] ? mutex_unlock+0x10/0x10 [ 460.960677][ T4190] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 460.966670][ T4190] ? lock_chain_count+0x20/0x20 [ 460.971534][ T4190] ? __rwlock_init+0x140/0x140 [ 460.976306][ T4190] hci_event_packet+0xe0b/0x1310 [ 460.981257][ T4190] ? _raw_spin_unlock+0x40/0x40 [ 460.986120][ T4190] ? rcu_lock_release+0x20/0x20 [ 460.990984][ T4190] ? hci_send_to_monitor+0x9c/0x4a0 [ 460.996212][ T4190] hci_rx_work+0x255/0xa10 [ 461.000650][ T4190] process_one_work+0x867/0xff0 [ 461.005525][ T4190] ? worker_detach_from_pool+0x240/0x240 [ 461.011162][ T4190] ? lockdep_hardirqs_off+0x70/0x100 [ 461.016462][ T4190] ? _raw_spin_lock_irq+0xb7/0xf0 [ 461.021491][ T4190] ? _raw_spin_lock_irqsave+0x100/0x100 [ 461.027046][ T4190] ? wq_worker_running+0x97/0x170 [ 461.032092][ T4190] worker_thread+0xad7/0x12a0 [ 461.036807][ T4190] kthread+0x42e/0x520 [ 461.040882][ T4190] ? rcu_lock_release+0x20/0x20 [ 461.045747][ T4190] ? kthread_blkcg+0xd0/0xd0 [ 461.050348][ T4190] ret_from_fork+0x1f/0x30 [ 461.054791][ T4190] [ 461.065710][ T4190] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 461.079019][ T4190] Bluetooth: hci0: failed to register connection device [ 464.284883][ T7240] Bluetooth: hci1: command 0x0406 tx timeout [ 465.742743][ T5962] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 465.881487][ T8935] IPVS: dh: UDP 127.0.0.1:21 - no destination available [ 465.957705][ T4190] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 465.967664][ T4190] CPU: 1 PID: 4190 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 465.975233][ T4190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 465.985302][ T4190] Workqueue: hci1 hci_rx_work [ 465.990001][ T4190] Call Trace: [ 465.993329][ T4190] [ 465.996264][ T4190] dump_stack_lvl+0x188/0x250 [ 466.000965][ T4190] ? show_regs_print_info+0x20/0x20 [ 466.006207][ T4190] ? load_image+0x410/0x410 [ 466.010738][ T4190] sysfs_create_dir_ns+0x26a/0x290 [ 466.015871][ T4190] ? sysfs_warn_dup+0xa0/0xa0 [ 466.020565][ T4190] ? kthread+0x42e/0x520 [ 466.024820][ T4190] ? do_raw_spin_unlock+0x11d/0x230 [ 466.030031][ T4190] kobject_add_internal+0x5ba/0xcd0 [ 466.035238][ T4190] kobject_add+0x160/0x230 [ 466.039670][ T4190] ? kobject_init+0x1c0/0x1c0 [ 466.044370][ T4190] ? __raw_spin_lock_init+0x41/0x100 [ 466.049667][ T4190] ? klist_children_get+0x50/0x50 [ 466.054706][ T4190] ? get_device_parent+0x121/0x3e0 [ 466.059849][ T4190] device_add+0x470/0x1050 [ 466.064268][ T4190] ? device_initialize+0x2a5/0x4d0 [ 466.069396][ T4190] hci_conn_add_sysfs+0xd1/0x1e0 [ 466.074349][ T4190] le_conn_complete_evt+0xc55/0x14d0 [ 466.079636][ T4190] ? cs_le_create_conn+0x5e0/0x5e0 [ 466.084739][ T4190] ? __mutex_trylock_common+0x15c/0x260 [ 466.090277][ T4190] hci_le_meta_evt+0x285/0x3ca0 [ 466.095117][ T4190] ? hci_event_packet+0x363/0x1310 [ 466.100217][ T4190] ? __lock_acquire+0x7d40/0x7d40 [ 466.105239][ T4190] ? hci_remote_host_features_evt+0x240/0x240 [ 466.111295][ T4190] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 466.116911][ T4190] ? mark_lock+0x94/0x320 [ 466.121231][ T4190] ? mutex_unlock+0x10/0x10 [ 466.125718][ T4190] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 466.131688][ T4190] ? lock_chain_count+0x20/0x20 [ 466.136523][ T4190] ? __rwlock_init+0x140/0x140 [ 466.141275][ T4190] hci_event_packet+0xe0b/0x1310 [ 466.146203][ T4190] ? _raw_spin_unlock+0x40/0x40 [ 466.151044][ T4190] ? rcu_lock_release+0x20/0x20 [ 466.155884][ T4190] ? hci_send_to_monitor+0x9c/0x4a0 [ 466.161074][ T4190] hci_rx_work+0x255/0xa10 [ 466.165487][ T4190] process_one_work+0x867/0xff0 [ 466.170333][ T4190] ? worker_detach_from_pool+0x240/0x240 [ 466.175946][ T4190] ? lockdep_hardirqs_off+0x70/0x100 [ 466.181218][ T4190] ? _raw_spin_lock_irq+0xb7/0xf0 [ 466.186227][ T4190] ? _raw_spin_lock_irqsave+0x100/0x100 [ 466.191759][ T4190] ? wq_worker_running+0x97/0x170 [ 466.196770][ T4190] worker_thread+0xad7/0x12a0 [ 466.201458][ T4190] kthread+0x42e/0x520 [ 466.205508][ T4190] ? rcu_lock_release+0x20/0x20 [ 466.210346][ T4190] ? kthread_blkcg+0xd0/0xd0 [ 466.214933][ T4190] ret_from_fork+0x1f/0x30 [ 466.219372][ T4190] [ 466.229035][ T4190] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 466.244234][ T4190] Bluetooth: hci1: failed to register connection device [ 466.253035][ T5962] usb 7-1: Using ep0 maxpacket: 32 [ 466.373038][ T5962] usb 7-1: config 9 has an invalid interface number: 27 but max is 0 [ 466.381294][ T5962] usb 7-1: config 9 has no interface number 0 [ 466.420155][ T5962] usb 7-1: config 9 interface 27 has no altsetting 0 [ 467.115400][ T5962] usb 7-1: New USB device found, idVendor=413c, idProduct=8196, bcdDevice=71.fa [ 467.131701][ T5962] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.161273][ T5962] usb 7-1: Product: syz [ 467.280414][ T5962] usb 7-1: Manufacturer: syz [ 467.612921][ T5962] usb 7-1: SerialNumber: syz [ 467.973615][ T5962] qmi_wwan: probe of 7-1:9.27 failed with error -22 [ 468.009490][ T5962] usb 7-1: USB disconnect, device number 13 [ 468.243194][ T8986] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1201'. [ 468.256066][ T8986] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1201'. [ 468.266670][ T8986] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1201'. [ 468.277578][ T8986] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1201'. [ 468.287385][ T8986] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1201'. [ 470.754344][ T9006] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1205'. [ 472.587234][ T5962] Bluetooth: hci1: command 0x0406 tx timeout [ 473.726324][ T9027] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 474.380226][ T9042] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1213'. [ 474.394948][ T9042] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1213'. [ 474.406189][ T9042] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1213'. [ 474.417137][ T9042] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1213'. [ 474.426969][ T9042] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1213'. [ 476.667752][ T9064] IPVS: dh: UDP 127.0.0.1:21 - no destination available [ 477.930331][ T9097] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 478.461642][ T9115] fuse: Bad value for 'fd' [ 478.569478][ T9119] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1228'. [ 478.581755][ T9119] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1228'. [ 478.593862][ T9119] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1228'. [ 478.604951][ T9119] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1228'. [ 478.614848][ T9119] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1228'. [ 479.735536][ T9125] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1231'. [ 480.973890][ T9155] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 481.586622][ T9161] fuse: Bad value for 'fd' [ 481.913470][ T9173] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1244'. [ 481.924444][ T9173] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1244'. [ 481.933677][ T9173] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1244'. [ 481.942816][ T9173] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1244'. [ 481.951797][ T9173] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1244'. [ 482.114869][ T9180] IPVS: dh: UDP 127.0.0.1:21 - no destination available [ 486.075985][ T9248] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 486.130177][ T9] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.388861][ T9] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.933490][ T9] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 488.079017][ T9] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.391405][ T9279] IPVS: dh: UDP 127.0.0.1:21 - no destination available [ 489.435998][ T9276] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1269'. [ 489.449960][ T9276] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1269'. [ 489.460456][ T9276] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1269'. [ 489.470508][ T9276] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1269'. [ 489.480145][ T9276] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1269'. [ 490.769314][ T9296] FAULT_INJECTION: forcing a failure. [ 490.769314][ T9296] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 490.783644][ T9296] CPU: 0 PID: 9296 Comm: syz.6.1273 Not tainted syzkaller #0 [ 490.791042][ T9296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 490.801181][ T9296] Call Trace: [ 490.804473][ T9296] [ 490.807410][ T9296] dump_stack_lvl+0x188/0x250 [ 490.812284][ T9296] ? show_regs_print_info+0x20/0x20 [ 490.817495][ T9296] ? load_image+0x410/0x410 [ 490.822023][ T9296] ? uncharge_page+0x490/0x490 [ 490.827080][ T9296] should_fail+0x383/0x4b0 [ 490.831643][ T9296] prepare_alloc_pages+0x1e3/0x5b0 [ 490.836874][ T9296] __alloc_pages+0x11b/0x480 [ 490.841489][ T9296] ? zone_statistics+0x170/0x170 [ 490.846452][ T9296] ? rcu_lock_acquire+0x30/0x30 [ 490.851322][ T9296] ? alloc_pages+0x452/0x560 [ 490.856026][ T9296] __get_free_pages+0x8/0x30 [ 490.860603][ T9296] __tlb_remove_page_size+0x1f2/0x3f0 [ 490.865962][ T9296] unmap_page_range+0xfcf/0x2410 [ 490.870905][ T9296] unmap_vmas+0x131/0x250 [ 490.875218][ T9296] ? unmap_page_range+0x2410/0x2410 [ 490.880396][ T9296] ? __mutex_lock_common+0x435/0x2400 [ 490.885787][ T9296] ? exit_mm_release+0x16/0x30 [ 490.890605][ T9296] exit_mmap+0x3b9/0x640 [ 490.894835][ T9296] ? vm_brk+0x20/0x20 [ 490.898811][ T9296] ? uprobe_clear_state+0x2f6/0x460 [ 490.904019][ T9296] __mmput+0x115/0x390 [ 490.908071][ T9296] exit_mm+0x632/0x7b0 [ 490.912292][ T9296] ? perf_pmu_migrate_context+0xb70/0xb70 [ 490.918097][ T9296] ? do_exit+0x2110/0x2110 [ 490.922504][ T9296] ? __ia32_sys_timer_delete+0x40/0x40 [ 490.928059][ T9296] ? hrtimer_try_to_cancel+0x3d6/0x420 [ 490.933563][ T9296] ? tty_audit_exit+0x149/0x1f0 [ 490.938455][ T9296] do_exit+0x5b8/0x2110 [ 490.942596][ T9296] ? put_task_struct+0x80/0x80 [ 490.947356][ T9296] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 490.953415][ T9296] ? _raw_spin_lock_irq+0xb7/0xf0 [ 490.958437][ T9296] do_group_exit+0x12c/0x2f0 [ 490.963023][ T9296] ? lockdep_hardirqs_on+0x94/0x140 [ 490.968210][ T9296] get_signal+0x7eb/0x12e0 [ 490.972686][ T9296] arch_do_signal_or_restart+0xe6/0x12a0 [ 490.978348][ T9296] ? rcu_lock_release+0x9/0x20 [ 490.983132][ T9296] ? futex_exit_release+0x1c0/0x1c0 [ 490.988343][ T9296] ? get_sigframe_size+0x10/0x10 [ 490.993269][ T9296] ? __context_tracking_exit+0x4c/0x80 [ 490.998719][ T9296] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 491.004684][ T9296] ? exit_to_user_mode_loop+0x3b/0x130 [ 491.010255][ T9296] exit_to_user_mode_loop+0x9e/0x130 [ 491.015548][ T9296] exit_to_user_mode_prepare+0xee/0x180 [ 491.021097][ T9296] syscall_exit_to_user_mode+0x16/0x40 [ 491.026542][ T9296] do_syscall_64+0x58/0xa0 [ 491.030943][ T9296] ? clear_bhb_loop+0x30/0x80 [ 491.035607][ T9296] ? clear_bhb_loop+0x30/0x80 [ 491.040271][ T9296] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 491.046181][ T9296] RIP: 0033:0x7f711c97e1d9 [ 491.050584][ T9296] Code: Unable to access opcode bytes at RIP 0x7f711c97e1af. [ 491.057925][ T9296] RSP: 002b:00007f711abd60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 491.066344][ T9296] RAX: fffffffffffffe00 RBX: 00007f711cc05fa8 RCX: 00007f711c97e1d9 [ 491.074298][ T9296] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f711cc05fa8 [ 491.082253][ T9296] RBP: 00007f711cc05fa0 R08: 0000000000000000 R09: 0000000000000000 [ 491.090218][ T9296] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 491.098170][ T9296] R13: 00007f711cc06038 R14: 00007fff9d96ab30 R15: 00007fff9d96ac18 [ 491.106149][ T9296] [ 492.705278][ T9311] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 493.491658][ T9326] comedi comedi0: bad chanlist[0]=0x00000000 chan=0 range length=4 [ 494.663395][ T9] device hsr_slave_0 left promiscuous mode [ 494.673446][ T9] device hsr_slave_1 left promiscuous mode [ 494.701572][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 494.738970][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 494.782141][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 494.832106][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 494.867958][ T9] device bridge_slave_1 left promiscuous mode [ 495.061999][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 495.087284][ T9] device bridge_slave_0 left promiscuous mode [ 495.109080][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 495.170720][ T9] device veth1_macvtap left promiscuous mode [ 495.199642][ T9] device veth0_macvtap left promiscuous mode [ 495.231310][ T9] device veth1_vlan left promiscuous mode [ 495.260575][ T9] device veth0_vlan left promiscuous mode [ 495.495808][ T9] duŅ&B. (unregistering): Released all slaves [ 497.508835][ T9] team0 (unregistering): Port device team_slave_1 removed [ 497.553349][ T9] team0 (unregistering): Port device team_slave_0 removed [ 497.677467][ T9387] ubi: mtd0 is already attached to ubi0 [ 497.835111][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 497.905864][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 498.185121][ T9] bond0 (unregistering): Released all slaves [ 499.134227][ T9383] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1294'. [ 499.803083][ T9411] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 500.128756][ T9415] tipc: Enabling of bearer rejected, failed to enable media [ 501.300614][ T1420] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.308207][ T1420] ieee802154 phy1 wpan1: encryption failed: -22 [ 503.414578][ T21] Bluetooth: hci3: command 0x0406 tx timeout [ 505.817978][ T9476] ubi: mtd0 is already attached to ubi0 [ 506.374961][ T9486] tipc: Enabling of bearer rejected, failed to enable media [ 506.918661][ T9500] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1316'. [ 506.930444][ T9500] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1316'. [ 506.941196][ T9500] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1316'. [ 506.951499][ T9500] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1316'. [ 506.962259][ T9500] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1316'. [ 509.878856][ T25] audit: type=1400 audit(1791541493.041:16): apparmor="DENIED" operation="setprocattr" info="fscreate" error=-22 profile="unconfined" pid=9512 comm="syz.7.1319" [ 510.603533][ T4194] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 510.613242][ T4194] CPU: 1 PID: 4194 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 510.620799][ T4194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 510.630863][ T4194] Workqueue: hci0 hci_rx_work [ 510.635671][ T4194] Call Trace: [ 510.638954][ T4194] [ 510.641887][ T4194] dump_stack_lvl+0x188/0x250 [ 510.646580][ T4194] ? show_regs_print_info+0x20/0x20 [ 510.651782][ T4194] ? load_image+0x410/0x410 [ 510.656297][ T4194] sysfs_create_dir_ns+0x26a/0x290 [ 510.661516][ T4194] ? sysfs_warn_dup+0xa0/0xa0 [ 510.666207][ T4194] ? kthread+0x42e/0x520 [ 510.670545][ T4194] ? do_raw_spin_unlock+0x11d/0x230 [ 510.675784][ T4194] kobject_add_internal+0x5ba/0xcd0 [ 510.681087][ T4194] kobject_add+0x160/0x230 [ 510.685521][ T4194] ? kobject_init+0x1c0/0x1c0 [ 510.690212][ T4194] ? __raw_spin_lock_init+0x41/0x100 [ 510.695508][ T4194] ? klist_children_get+0x50/0x50 [ 510.700633][ T4194] ? get_device_parent+0x121/0x3e0 [ 510.705756][ T4194] device_add+0x470/0x1050 [ 510.710173][ T4194] ? device_initialize+0x2a5/0x4d0 [ 510.715267][ T4194] hci_conn_add_sysfs+0xd1/0x1e0 [ 510.720281][ T4194] le_conn_complete_evt+0xc55/0x14d0 [ 510.725560][ T4194] ? cs_le_create_conn+0x5e0/0x5e0 [ 510.730675][ T4194] ? __mutex_trylock_common+0x15c/0x260 [ 510.736205][ T4194] hci_le_meta_evt+0x285/0x3ca0 [ 510.741040][ T4194] ? hci_event_packet+0x363/0x1310 [ 510.746132][ T4194] ? __lock_acquire+0x7d40/0x7d40 [ 510.751159][ T4194] ? hci_remote_host_features_evt+0x240/0x240 [ 510.757204][ T4194] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 510.762816][ T4194] ? mark_lock+0x94/0x320 [ 510.767124][ T4194] ? mutex_unlock+0x10/0x10 [ 510.771605][ T4194] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 510.777568][ T4194] ? lock_chain_count+0x20/0x20 [ 510.782402][ T4194] ? __rwlock_init+0x140/0x140 [ 510.787145][ T4194] hci_event_packet+0xe0b/0x1310 [ 510.792155][ T4194] ? _raw_spin_unlock+0x40/0x40 [ 510.797115][ T4194] ? rcu_lock_release+0x20/0x20 [ 510.802052][ T4194] ? hci_send_to_monitor+0x9c/0x4a0 [ 510.807239][ T4194] hci_rx_work+0x255/0xa10 [ 510.811650][ T4194] process_one_work+0x867/0xff0 [ 510.816493][ T4194] ? worker_detach_from_pool+0x240/0x240 [ 510.822132][ T4194] ? lockdep_hardirqs_off+0x70/0x100 [ 510.827422][ T4194] ? _raw_spin_lock_irq+0xb7/0xf0 [ 510.832467][ T4194] ? _raw_spin_lock_irqsave+0x100/0x100 [ 510.838020][ T4194] ? wq_worker_running+0x97/0x170 [ 510.843051][ T4194] worker_thread+0xad7/0x12a0 [ 510.847722][ T4194] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 510.853604][ T4194] kthread+0x42e/0x520 [ 510.857654][ T4194] ? rcu_lock_release+0x20/0x20 [ 510.862484][ T4194] ? kthread_blkcg+0xd0/0xd0 [ 510.867057][ T4194] ret_from_fork+0x1f/0x30 [ 510.871560][ T4194] [ 510.882823][ T4194] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 510.899043][ T4194] Bluetooth: hci0: failed to register connection device [ 514.436670][ T9553] tipc: Enabling of bearer rejected, failed to enable media [ 516.493804][ T9544] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 516.510161][ T9566] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1329'. [ 516.522131][ T9566] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1329'. [ 516.533318][ T9566] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1329'. [ 516.544095][ T9566] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1329'. [ 516.553711][ T9566] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1329'. [ 517.682779][ T5962] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 519.178087][ T4194] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 519.188499][ T4194] CPU: 1 PID: 4194 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 519.196069][ T4194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 519.206133][ T4194] Workqueue: hci1 hci_rx_work [ 519.210831][ T4194] Call Trace: [ 519.214117][ T4194] [ 519.217050][ T4194] dump_stack_lvl+0x188/0x250 [ 519.221745][ T4194] ? show_regs_print_info+0x20/0x20 [ 519.226953][ T4194] ? load_image+0x410/0x410 [ 519.231520][ T4194] sysfs_create_dir_ns+0x26a/0x290 [ 519.236651][ T4194] ? sysfs_warn_dup+0xa0/0xa0 [ 519.241347][ T4194] ? kthread+0x42e/0x520 [ 519.245700][ T4194] ? do_raw_spin_unlock+0x11d/0x230 [ 519.250910][ T4194] kobject_add_internal+0x5ba/0xcd0 [ 519.256119][ T4194] kobject_add+0x160/0x230 [ 519.260525][ T4194] ? kobject_init+0x1c0/0x1c0 [ 519.265185][ T4194] ? __raw_spin_lock_init+0x41/0x100 [ 519.270452][ T4194] ? klist_children_get+0x50/0x50 [ 519.275480][ T4194] ? get_device_parent+0x121/0x3e0 [ 519.280573][ T4194] device_add+0x470/0x1050 [ 519.284970][ T4194] ? device_initialize+0x2a5/0x4d0 [ 519.290061][ T4194] hci_conn_add_sysfs+0xd1/0x1e0 [ 519.294990][ T4194] le_conn_complete_evt+0xc55/0x14d0 [ 519.300277][ T4194] ? cs_le_create_conn+0x5e0/0x5e0 [ 519.305389][ T4194] ? __mutex_trylock_common+0x15c/0x260 [ 519.310933][ T4194] hci_le_meta_evt+0x285/0x3ca0 [ 519.315777][ T4194] ? hci_event_packet+0x363/0x1310 [ 519.320875][ T4194] ? __lock_acquire+0x7d40/0x7d40 [ 519.325891][ T4194] ? hci_remote_host_features_evt+0x240/0x240 [ 519.331958][ T4194] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 519.337595][ T4194] ? mark_lock+0x94/0x320 [ 519.341927][ T4194] ? mutex_unlock+0x10/0x10 [ 519.346415][ T4194] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 519.352387][ T4194] ? lock_chain_count+0x20/0x20 [ 519.357401][ T4194] ? __rwlock_init+0x140/0x140 [ 519.362149][ T4194] hci_event_packet+0xe0b/0x1310 [ 519.367078][ T4194] ? _raw_spin_unlock+0x40/0x40 [ 519.371912][ T4194] ? rcu_lock_release+0x20/0x20 [ 519.376754][ T4194] ? hci_send_to_monitor+0x9c/0x4a0 [ 519.381939][ T4194] hci_rx_work+0x255/0xa10 [ 519.386353][ T4194] process_one_work+0x867/0xff0 [ 519.391200][ T4194] ? worker_detach_from_pool+0x240/0x240 [ 519.396815][ T4194] ? lockdep_hardirqs_off+0x70/0x100 [ 519.402090][ T4194] ? _raw_spin_lock_irq+0xb7/0xf0 [ 519.407099][ T4194] ? _raw_spin_lock_irqsave+0x100/0x100 [ 519.412635][ T4194] ? wq_worker_running+0x97/0x170 [ 519.417648][ T4194] worker_thread+0xad7/0x12a0 [ 519.422322][ T4194] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 519.428209][ T4194] kthread+0x42e/0x520 [ 519.432266][ T4194] ? rcu_lock_release+0x20/0x20 [ 519.437098][ T4194] ? kthread_blkcg+0xd0/0xd0 [ 519.441670][ T4194] ret_from_fork+0x1f/0x30 [ 519.446085][ T4194] [ 519.449182][ C1] vkms_vblank_simulate: vblank timer overrun [ 519.460213][ T4194] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 519.474343][ T4194] Bluetooth: hci1: failed to register connection device [ 519.593059][ T5962] usb 8-1: New USB device found, idVendor=046d, idProduct=c52b, bcdDevice=24.00 [ 519.602763][ T5962] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 519.613026][ T5962] usb 8-1: Product: syz [ 519.617211][ T5962] usb 8-1: Manufacturer: syz [ 520.189124][ T5962] logitech-djreceiver 0003:046D:C52B.0007: hiddev0,hidraw0: USB HID v1.11 Device [syz syz] on usb-dummy_hcd.7-1/input0 [ 520.625961][ T5962] logitech-djreceiver 0003:046D:C52B.0007: logi_dj_recv_send_report: unable to find dj report [ 520.687949][ T5962] logitech-djreceiver 0003:046D:C52B.0007: logi_dj_recv_switch_to_dj_mode error:-19 [ 520.739016][ T5962] usb 8-1: USB disconnect, device number 4 [ 520.977165][ T9615] fido_id[9615]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.7/usb8/report_descriptor': No such file or directory [ 520.995807][ T9621] tipc: Enabling of bearer rejected, failed to enable media [ 521.262230][ T9629] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 524.564192][ T9648] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1348'. [ 524.645566][ T9648] tipc: Invalid UDP bearer configuration [ 524.646157][ T9648] tipc: Enabling of bearer rejected, failed to enable media [ 524.779644][ T4190] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 524.789625][ T4190] CPU: 1 PID: 4190 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 524.797214][ T4190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 524.807278][ T4190] Workqueue: hci4 hci_rx_work [ 524.812156][ T4190] Call Trace: [ 524.815432][ T4190] [ 524.818364][ T4190] dump_stack_lvl+0x188/0x250 [ 524.823137][ T4190] ? show_regs_print_info+0x20/0x20 [ 524.828436][ T4190] ? load_image+0x410/0x410 [ 524.833125][ T4190] sysfs_create_dir_ns+0x26a/0x290 [ 524.838242][ T4190] ? sysfs_warn_dup+0xa0/0xa0 [ 524.844757][ T4190] ? lockdep_hardirqs_on+0x94/0x140 [ 524.850835][ T4190] ? do_raw_spin_unlock+0x11d/0x230 [ 524.856933][ T4190] kobject_add_internal+0x5ba/0xcd0 [ 524.863346][ T4190] kobject_add+0x160/0x230 [ 524.869582][ T4190] ? kobject_init+0x1c0/0x1c0 [ 524.874978][ T4190] ? __raw_spin_lock_init+0x41/0x100 [ 524.880800][ T4190] ? klist_children_get+0x50/0x50 [ 524.889262][ T4190] ? get_device_parent+0x121/0x3e0 [ 524.895452][ T4190] device_add+0x470/0x1050 [ 524.900428][ T4190] hci_conn_add_sysfs+0xd1/0x1e0 [ 524.910044][ T4190] le_conn_complete_evt+0xc55/0x14d0 [ 524.918444][ T4190] ? cs_le_create_conn+0x5e0/0x5e0 [ 524.925146][ T4190] ? preempt_schedule_common+0xa5/0xd0 [ 524.934663][ T4190] ? preempt_schedule+0xbc/0xd0 [ 524.944478][ T4190] ? schedule_preempt_disabled+0x20/0x20 [ 524.952846][ T4190] ? __mutex_trylock_common+0x15c/0x260 [ 524.961747][ T4190] hci_le_meta_evt+0x285/0x3ca0 [ 524.969237][ T4190] ? hci_event_packet+0x363/0x1310 [ 524.975585][ T4190] ? __lock_acquire+0x7d40/0x7d40 [ 524.982313][ T4190] ? hci_remote_host_features_evt+0x240/0x240 [ 524.989278][ T4190] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 524.995117][ T4190] ? mark_lock+0x94/0x320 [ 524.999866][ T4190] ? mutex_unlock+0x10/0x10 [ 525.004472][ T4190] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 525.010662][ T4190] ? lock_chain_count+0x20/0x20 [ 525.015519][ T4190] ? __rwlock_init+0x140/0x140 [ 525.020283][ T4190] hci_event_packet+0xe0b/0x1310 [ 525.028045][ T4190] ? _raw_spin_unlock+0x40/0x40 [ 525.034223][ T4190] ? rcu_lock_release+0x20/0x20 [ 525.040003][ T4190] ? hci_send_to_monitor+0x9c/0x4a0 [ 525.047767][ T4190] hci_rx_work+0x255/0xa10 [ 525.053444][ T4190] process_one_work+0x867/0xff0 [ 525.058537][ T4190] ? worker_detach_from_pool+0x240/0x240 [ 525.064178][ T4190] ? lockdep_hardirqs_off+0x70/0x100 [ 525.069663][ T4190] ? _raw_spin_lock_irq+0xb7/0xf0 [ 525.074701][ T4190] ? _raw_spin_lock_irqsave+0x100/0x100 [ 525.080341][ T4190] ? wq_worker_running+0x97/0x170 [ 525.085371][ T4190] worker_thread+0xad7/0x12a0 [ 525.090083][ T4190] kthread+0x42e/0x520 [ 525.094165][ T4190] ? rcu_lock_release+0x20/0x20 [ 525.099633][ T4190] ? kthread_blkcg+0xd0/0xd0 [ 525.105355][ T4190] ret_from_fork+0x1f/0x30 [ 525.109896][ T4190] [ 525.141038][ T4190] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 525.155813][ T4190] Bluetooth: hci4: failed to register connection device [ 526.210033][ T21] Bluetooth: hci1: command 0x0406 tx timeout [ 529.378127][ T2305] Bluetooth: hci5: command 0x0406 tx timeout [ 529.451290][ T9703] tipc: Enabling of bearer rejected, failed to enable media [ 531.292724][ T4272] Bluetooth: hci4: command 0x0406 tx timeout [ 531.432044][ T4190] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:201' [ 531.442675][ T4190] CPU: 1 PID: 4190 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 531.450238][ T4190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 531.460299][ T4190] Workqueue: hci5 hci_rx_work [ 531.465008][ T4190] Call Trace: [ 531.468294][ T4190] [ 531.471221][ T4190] dump_stack_lvl+0x188/0x250 [ 531.475908][ T4190] ? show_regs_print_info+0x20/0x20 [ 531.481117][ T4190] ? load_image+0x410/0x410 [ 531.485637][ T4190] sysfs_create_dir_ns+0x26a/0x290 [ 531.490774][ T4190] ? sysfs_warn_dup+0xa0/0xa0 [ 531.495465][ T4190] ? kthread+0x42e/0x520 [ 531.499714][ T4190] ? do_raw_spin_unlock+0x11d/0x230 [ 531.504895][ T4190] kobject_add_internal+0x5ba/0xcd0 [ 531.510080][ T4190] kobject_add+0x160/0x230 [ 531.514499][ T4190] ? kobject_init+0x1c0/0x1c0 [ 531.520446][ T4190] ? __raw_spin_lock_init+0x41/0x100 [ 531.525752][ T4190] ? klist_children_get+0x50/0x50 [ 531.530808][ T4190] ? get_device_parent+0x121/0x3e0 [ 531.535926][ T4190] device_add+0x470/0x1050 [ 531.540342][ T4190] ? device_initialize+0x2a5/0x4d0 [ 531.545443][ T4190] hci_conn_add_sysfs+0xd1/0x1e0 [ 531.550400][ T4190] le_conn_complete_evt+0xc55/0x14d0 [ 531.555694][ T4190] ? cs_le_create_conn+0x5e0/0x5e0 [ 531.560878][ T4190] ? __mutex_trylock_common+0x15c/0x260 [ 531.566409][ T4190] hci_le_meta_evt+0x285/0x3ca0 [ 531.571245][ T4190] ? hci_event_packet+0x363/0x1310 [ 531.576513][ T4190] ? __lock_acquire+0x7d40/0x7d40 [ 531.581530][ T4190] ? hci_remote_host_features_evt+0x240/0x240 [ 531.587589][ T4190] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 531.593209][ T4190] ? mark_lock+0x94/0x320 [ 531.597521][ T4190] ? mutex_unlock+0x10/0x10 [ 531.602005][ T4190] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 531.607991][ T4190] ? lock_chain_count+0x20/0x20 [ 531.612823][ T4190] ? __rwlock_init+0x140/0x140 [ 531.617570][ T4190] hci_event_packet+0xe0b/0x1310 [ 531.622514][ T4190] ? _raw_spin_unlock+0x40/0x40 [ 531.627347][ T4190] ? rcu_lock_release+0x20/0x20 [ 531.632207][ T4190] ? hci_send_to_monitor+0x9c/0x4a0 [ 531.637388][ T4190] hci_rx_work+0x255/0xa10 [ 531.641791][ T4190] process_one_work+0x867/0xff0 [ 531.647253][ T4190] ? worker_detach_from_pool+0x240/0x240 [ 531.652873][ T4190] ? lockdep_hardirqs_off+0x70/0x100 [ 531.658149][ T4190] ? _raw_spin_lock_irq+0xb7/0xf0 [ 531.663163][ T4190] ? _raw_spin_lock_irqsave+0x100/0x100 [ 531.668701][ T4190] ? wq_worker_running+0x97/0x170 [ 531.673704][ T4190] worker_thread+0xad7/0x12a0 [ 531.678390][ T4190] kthread+0x42e/0x520 [ 531.682464][ T4190] ? rcu_lock_release+0x20/0x20 [ 531.687295][ T4190] ? kthread_blkcg+0xd0/0xd0 [ 531.691867][ T4190] ret_from_fork+0x1f/0x30 [ 531.696270][ T4190] [ 531.712822][ T4190] kobject_add_internal failed for hci5:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 531.726201][ T4190] Bluetooth: hci5: failed to register connection device [ 532.281306][ T9747] ip_tables: iptables: counters copy to user failed while replacing table [ 535.828867][ T9770] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1374'. [ 535.841055][ T9770] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1374'. [ 535.851443][ T9770] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1374'. [ 535.861554][ T9770] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1374'. [ 535.871182][ T9770] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1374'. [ 536.587649][ T9772] tipc: Enabling of bearer rejected, failed to enable media [ 537.925791][ T26] Bluetooth: hci5: command 0x0406 tx timeout [ 540.147139][ T9808] fuse: Bad value for 'fd' [ 540.290730][ T9812] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1386'. [ 540.364385][ T9812] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 541.793156][ T9812] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 541.924586][ T9815] [ 541.926929][ T9815] ====================================================== [ 541.933921][ T9815] WARNING: possible circular locking dependency detected [ 541.940982][ T9815] syzkaller #0 Not tainted [ 541.945377][ T9815] ------------------------------------------------------ [ 541.952371][ T9815] syz.7.1387/9815 is trying to acquire lock: [ 541.958327][ T9815] ffff888073609a10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x82/0x210 [ 541.968234][ T9815] [ 541.968234][ T9815] but task is already holding lock: [ 541.975578][ T9815] ffff888023424d40 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_wext_siwgenie+0xd4/0x3f0 [ 541.984896][ T9815] [ 541.984896][ T9815] which lock already depends on the new lock. [ 541.984896][ T9815] [ 541.995296][ T9815] [ 541.995296][ T9815] the existing dependency chain (in reverse order) is: [ 542.004310][ T9815] [ 542.004310][ T9815] -> #2 (&wdev->mtx){+.+.}-{3:3}: [ 542.011538][ T9815] __mutex_lock_common+0x1e5/0x2400 [ 542.017245][ T9815] mutex_lock_nested+0x17/0x20 [ 542.022517][ T9815] nl80211_send_iface+0x773/0xe00 [ 542.028101][ T9815] nl80211_dump_interface+0x39f/0x560 [ 542.033977][ T9815] netlink_dump+0x6d2/0xdd0 [ 542.039061][ T9815] __netlink_dump_start+0x4e4/0x720 [ 542.044773][ T9815] genl_rcv_msg+0xbc7/0xfa0 [ 542.049775][ T9815] netlink_rcv_skb+0x1e9/0x430 [ 542.055040][ T9815] genl_rcv+0x24/0x40 [ 542.059519][ T9815] netlink_unicast+0x78f/0x940 [ 542.064847][ T9815] netlink_sendmsg+0x8ba/0xbe0 [ 542.070129][ T9815] ____sys_sendmsg+0x5be/0x8f0 [ 542.075412][ T9815] ___sys_sendmsg+0x236/0x2e0 [ 542.080592][ T9815] __se_sys_sendmsg+0x1b7/0x2a0 [ 542.085941][ T9815] do_syscall_64+0x4c/0xa0 [ 542.090858][ T9815] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 542.097253][ T9815] [ 542.097253][ T9815] -> #1 (rtnl_mutex){+.+.}-{3:3}: [ 542.104431][ T9815] __mutex_lock_common+0x1e5/0x2400 [ 542.110126][ T9815] mutex_lock_nested+0x17/0x20 [ 542.115385][ T9815] ip6mr_sk_done+0xaa/0x2b0 [ 542.120494][ T9815] rawv6_close+0x62/0x90 [ 542.125240][ T9815] inet_release+0x139/0x180 [ 542.130329][ T9815] sock_close+0xbf/0x210 [ 542.135069][ T9815] __fput+0x212/0x8c0 [ 542.139631][ T9815] task_work_run+0x125/0x1a0 [ 542.144716][ T9815] exit_to_user_mode_loop+0x10f/0x130 [ 542.150607][ T9815] exit_to_user_mode_prepare+0xee/0x180 [ 542.156645][ T9815] syscall_exit_to_user_mode+0x16/0x40 [ 542.162599][ T9815] do_syscall_64+0x58/0xa0 [ 542.167526][ T9815] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 542.173918][ T9815] [ 542.173918][ T9815] -> #0 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}: [ 542.182575][ T9815] __lock_acquire+0x38f7/0x7d40 [ 542.187927][ T9815] lock_acquire+0x19f/0x400 [ 542.192926][ T9815] down_write+0x38/0x60 [ 542.197577][ T9815] sock_close+0x82/0x210 [ 542.202320][ T9815] __fput+0x212/0x8c0 [ 542.206799][ T9815] task_work_run+0x125/0x1a0 [ 542.211884][ T9815] get_signal+0x123e/0x12e0 [ 542.216881][ T9815] arch_do_signal_or_restart+0xe6/0x12a0 [ 542.223014][ T9815] exit_to_user_mode_loop+0x9e/0x130 [ 542.228817][ T9815] exit_to_user_mode_prepare+0xee/0x180 [ 542.234868][ T9815] syscall_exit_to_user_mode+0x16/0x40 [ 542.240830][ T9815] do_syscall_64+0x58/0xa0 [ 542.245752][ T9815] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 542.252150][ T9815] [ 542.252150][ T9815] other info that might help us debug this: [ 542.252150][ T9815] [ 542.262351][ T9815] Chain exists of: [ 542.262351][ T9815] &sb->s_type->i_mutex_key#11 --> rtnl_mutex --> &wdev->mtx [ 542.262351][ T9815] [ 542.275526][ T9815] Possible unsafe locking scenario: [ 542.275526][ T9815] [ 542.282955][ T9815] CPU0 CPU1 [ 542.288316][ T9815] ---- ---- [ 542.293659][ T9815] lock(&wdev->mtx); [ 542.297615][ T9815] lock(rtnl_mutex); [ 542.304090][ T9815] lock(&wdev->mtx); [ 542.310842][ T9815] lock(&sb->s_type->i_mutex_key#11); [ 542.316288][ T9815] [ 542.316288][ T9815] *** DEADLOCK *** [ 542.316288][ T9815] [ 542.324420][ T9815] 1 lock held by syz.7.1387/9815: [ 542.329419][ T9815] #0: ffff888023424d40 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_wext_siwgenie+0xd4/0x3f0 [ 542.339146][ T9815] [ 542.339146][ T9815] stack backtrace: [ 542.345013][ T9815] CPU: 0 PID: 9815 Comm: syz.7.1387 Not tainted syzkaller #0 [ 542.352443][ T9815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 542.362474][ T9815] Call Trace: [ 542.365732][ T9815] [ 542.368639][ T9815] dump_stack_lvl+0x188/0x250 [ 542.373293][ T9815] ? load_image+0x410/0x410 [ 542.377873][ T9815] ? show_regs_print_info+0x20/0x20 [ 542.383051][ T9815] ? print_circular_bug+0x12b/0x1a0 [ 542.388228][ T9815] check_noncircular+0x2f8/0x400 [ 542.393142][ T9815] ? look_up_lock_class+0x71/0x110 [ 542.398230][ T9815] ? print_deadlock_bug+0x5d0/0x5d0 [ 542.403401][ T9815] ? lockdep_lock+0xf1/0x1f0 [ 542.407968][ T9815] ? mark_lock+0x94/0x320 [ 542.412283][ T9815] ? _find_first_zero_bit+0xd1/0xf0 [ 542.417483][ T9815] __lock_acquire+0x38f7/0x7d40 [ 542.422315][ T9815] ? finish_lock_switch+0x12d/0x290 [ 542.427548][ T9815] ? verify_lock_unused+0x140/0x140 [ 542.432725][ T9815] ? locks_remove_file+0x372/0xe80 [ 542.437890][ T9815] ? __schedule+0x11cb/0x4350 [ 542.442553][ T9815] ? locks_remove_posix+0x600/0x600 [ 542.447734][ T9815] lock_acquire+0x19f/0x400 [ 542.452221][ T9815] ? sock_close+0x82/0x210 [ 542.456874][ T9815] ? __might_sleep+0xf0/0xf0 [ 542.461444][ T9815] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 542.467414][ T9815] ? read_lock_is_recursive+0x10/0x10 [ 542.472769][ T9815] ? __might_sleep+0xf0/0xf0 [ 542.477357][ T9815] ? preempt_schedule+0xbc/0xd0 [ 542.482221][ T9815] ? preempt_schedule_common+0xa5/0xd0 [ 542.487873][ T9815] down_write+0x38/0x60 [ 542.492016][ T9815] ? sock_close+0x82/0x210 [ 542.496423][ T9815] sock_close+0x82/0x210 [ 542.500658][ T9815] ? sock_mmap+0x90/0x90 [ 542.504903][ T9815] __fput+0x212/0x8c0 [ 542.509656][ T9815] task_work_run+0x125/0x1a0 [ 542.514824][ T9815] get_signal+0x123e/0x12e0 [ 542.520502][ T9815] ? kasan_save_stack+0x4b/0x60 [ 542.525780][ T9815] ? kasan_save_stack+0x35/0x60 [ 542.531937][ T9815] ? kasan_record_aux_stack+0xb8/0x100 [ 542.537567][ T9815] ? task_work_add+0x2f/0x1d0 [ 542.543145][ T9815] ? fput_many+0xde/0x1a0 [ 542.547476][ T9815] ? __se_sys_ioctl+0x157/0x170 [ 542.552346][ T9815] ? do_syscall_64+0x4c/0xa0 [ 542.556932][ T9815] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 542.562995][ T9815] arch_do_signal_or_restart+0xe6/0x12a0 [ 542.568617][ T9815] ? get_sigframe_size+0x10/0x10 [ 542.573531][ T9815] ? mark_lock+0x94/0x320 [ 542.577840][ T9815] ? kick_process+0xd4/0x140 [ 542.582490][ T9815] ? exit_to_user_mode_loop+0x3b/0x130 [ 542.587932][ T9815] exit_to_user_mode_loop+0x9e/0x130 [ 542.593205][ T9815] exit_to_user_mode_prepare+0xee/0x180 [ 542.598729][ T9815] syscall_exit_to_user_mode+0x16/0x40 [ 542.604163][ T9815] do_syscall_64+0x58/0xa0 [ 542.608573][ T9815] ? clear_bhb_loop+0x30/0x80 [ 542.613227][ T9815] ? clear_bhb_loop+0x30/0x80 [ 542.617881][ T9815] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 542.623748][ T9815] RIP: 0033:0x7fe8386051d9 [ 542.628164][ T9815] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 542.647747][ T9815] RSP: 002b:00007fe83685d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 542.656145][ T9815] RAX: ffffffffffffffea RBX: 00007fe83888cfa0 RCX: 00007fe8386051d9 [ 542.664095][ T9815] RDX: 0000200000000040 RSI: 0000000000008b30 RDI: 0000000000000004 [ 542.672049][ T9815] RBP: 00007fe83869c888 R08: 0000000000000000 R09: 0000000000000000 [ 542.679995][ T9815] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 542.687941][ T9815] R13: 00007fe83888d038 R14: 00007fe83888cfa0 R15: 00007ffc3d886ff8 [ 542.695911][ T9815] [ 542.720276][ T9820] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1388'. [ 543.266539][ T9834] ubi: mtd0 is already attached to ubi0