last executing test programs: 6m19.081346097s ago: executing program 0 (id=1973): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000180)) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f00000001c0), r1) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) write$nci(r0, &(0x7f0000000340)=@NCI_OP_RF_DEACTIVATE_NTF={0x1, 0x0, 0x3, 0x6, 0x2, {0xd, 0x4}}, 0x5) 6m18.772851893s ago: executing program 0 (id=1979): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000940)={&(0x7f0000000980)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x2, [@int={0x0, 0x0, 0x0, 0x1, 0x5, 0x8}]}}, 0x0, 0x2a, 0x0, 0x0, 0xfffffffd}, 0x28) socket$inet6_tcp(0xa, 0x1, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$alg(0x26, 0x5, 0x0) pselect6(0x40, &(0x7f0000000680)={0x2, 0x0, 0x0, 0x80000000000, 0x0, 0xfffffffffffff30a, 0x5}, &(0x7f00000006c0)={0x1e, 0x0, 0x4fe9, 0x0, 0xffffffff, 0x4, 0xfffffffffffffffe, 0xffffffffffffffef}, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x240, 0x0) close(r1) socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000001c0)={'syzkaller0\x00', @multicast}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000008050000010b", @ANYRES32=r2], 0x97) 6m18.434131327s ago: executing program 0 (id=1984): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000a80)=ANY=[@ANYBLOB="140000001000010000000001000000000a00000a48000000060a0b040000000000000000020000001c0004801800018008000100666962000c00028008000240000000eb0900010073797a300000000009000200"], 0x70}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 6m18.307765219s ago: executing program 0 (id=1986): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x185093, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x11050ca, 0x0) umount2(&(0x7f00000002c0)='./file0/../file0\x00', 0xa) 6m18.12737754s ago: executing program 0 (id=1989): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./proc\x00', &(0x7f0000000540)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./proc/irq/default_smp_affinity\x00', 0x1, 0x0) write(r0, 0x0, 0x3c) 6m17.683984469s ago: executing program 0 (id=1994): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40001d4}, 0x8840) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='270', 0x3) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000340)={0x7, "b546eb0000001c531841b8b7055e000000000000000800"}) socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000140)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00U\x00', 0x8, 0x3a, 0xff, @local, @remote, {[], @echo_request={0x80, 0x0, 0x0, 0x8, 0x7}}}}}}, 0x0) 6m16.966395234s ago: executing program 32 (id=1994): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40001d4}, 0x8840) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='270', 0x3) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000340)={0x7, "b546eb0000001c531841b8b7055e000000000000000800"}) socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000140)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00U\x00', 0x8, 0x3a, 0xff, @local, @remote, {[], @echo_request={0x80, 0x0, 0x0, 0x8, 0x7}}}}}}, 0x0) 3m50.340198871s ago: executing program 2 (id=2870): r0 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000000)=0x100000001, 0x4) bind$inet(r0, 0x0, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @loopback}, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='27', 0x2) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000001c0)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) r2 = syz_create_resource$futex(0x0) futex$unlock_wake_list32(r2, 0x681, 0xff, 0x0, 0x0, 0x3) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x4) 3m49.851146009s ago: executing program 2 (id=2872): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2e, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x675f, 0x9, 0x3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00'}) sendmsg$nl_route_sched(r7, 0x0, 0x8080) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000480), 0x56) sendmsg$kcm(r6, &(0x7f00000004c0)={&(0x7f0000000500)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000580)=[{&(0x7f00000005c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 3m49.491232161s ago: executing program 2 (id=2877): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) openat$rtc(0xffffffffffffff9c, &(0x7f0000000780), 0x140, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000680)=0x3) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0xc1101, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000700)=0x1) ioctl$PPPIOCSFLAGS1(r1, 0x80047453, &(0x7f0000000740)=0xc410056) 3m49.318642363s ago: executing program 2 (id=2879): mkdirat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0\x00', 0x0) mount$bind(&(0x7f0000000ac0)='.\x00', &(0x7f0000000b00)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000b40)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000b80)='./file0/../file0\x00', &(0x7f0000000bc0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000c40)='./file0/file0\x00', &(0x7f0000000c80)='./file0\x00', 0x0, 0x38ff817, 0x0) mount(0x0, &(0x7f0000000cc0)='./file0\x00', &(0x7f0000000d00)='sysfs\x00', 0x0, 0x0) 3m48.833539658s ago: executing program 2 (id=2881): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r0, &(0x7f0000000380)=0x1ca, 0x12) 3m48.691419156s ago: executing program 2 (id=2882): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a80)={{0x14}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3cd2e7b3d6526bf5}}}, 0x68}}, 0x0) r1 = socket$kcm(0x2, 0x3, 0x84) sendmsg$inet(r1, &(0x7f0000001000)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, &(0x7f0000000080)=[{&(0x7f0000004fc0)="5346f7f875528ef24043c68e04180a332e94ee4784fffee263c06f2d924e8699b6af71aa257b5a316af31628e5148c7012f4d55ce4c29fea9e5b0b61fdf0b2dc866fa81b4e775e235eaebe330e16114548f147b8a966bf1f1fc6c24b9d47d349c87c3f789d2ba608cd25b17b6c80a7f0ceb4a06ff270ff8c9f0d3a19133f1fdfd51b767b8cef1f36e5490c5df5fcb378a6fb6eb5d8aaf7791ce81f61a05e1ebdd1789eb70ac1f3dfed378f6f3e237120052113a75ab977796117f7e7b2d6ee499f51dc070c820d10a0eaef4fc94ddc648bafae070caf70c465267497b3de963df649e113e2060c82b057abfae0798d424c81aeb42796189eb0936a2c547a5c4d6351ed786c75beb926113bd4294a982980afed3f9cf390f304611db4c6d7b64d64f38db5fde5cf7cadb20af9987758f91b51f49c697013b710e0218660671d0051ddd7fb7f5eb72a34f469b2e20600000091817eb5b952af43d1a40f4770e7220fcdfe25d3e9747e2af76ece5922724840afdba6f6f9e1d11db8561e8e836413ee04d6e084700ec1ac0e00569f0e4d4844f4710299aabbef615c33e276544669ce074528938ec0cc6d2af1ce7a47a64ad676f08507aa08d4210f979ef4aacfa4d524c9952d4743d65c3c527302942a8880116ce7ebc6c84778346f02c806bb466db7d313d7ebc7ea87823d4a8de0b697929fb3277012327827801f75ca3c5776d1a81acb160007f73148dfaf05ab7eed5a0e603ac468eb2bcd9de5f140758e74c20a9931187e0cbc857aa62a4cec8a62f7e31af3a78cdb8608551cdd68e83aebb3c9e05519184ff996c336553fa6bf16865cd6c4eacf1e360b029cdae41070f569a15bfd30f671c0a2fd183ea0eaae427505d56994ccfd0737aae3abbc45f56710d2e3f2662bf4514044f74e03cde28fa1783970d3c676cb23cb1923a9feb233267ef663936ccf25f7597a2270724527bf468d22786d0548b25582180b72c51742c4e5c373a1008dd4cfba508e8f3f8ec35e6f1375a11b1fbe2dc09e9fe609e80112c8f5c895c922cd547def707b7252d7afa0030d008b1dd10fd4a56e30237a6e0229fb4562cb8df3d4e64b28e15c075e59554e9d61a6065d49c1e765a49195cf5d6b1e2b6192447817fedfe41fcdf9a4fc5af567906e4b6453da7b97eac255cc253d7bceba09f67da4815438583c6843366b76d9e9277558e48681e9cfa920b47aea0e5c46ef86ea7f1ef534cf7565b24b833ba2cbfe60e6271614850dd68f2a8a6be4f315b83abb8e2699ed8e2a4b3506f9dacbb180c4deeef7489f49faf34cdf4e91a402956564f854d71c892e4aada1c91647ce45d4834d000e8d5be1773ecae388e511228977a69d4cc67fbab60ee1555a219e41eebc31807a87d9cbe88a8b05959e1a988f6ea6ed73a6ac1ec2f3d74d73eaa91a39308e008b7fa1ecc2a020d950a777c0d8d131416ef55a4ec041113df65ba4aea92fcb3e2268510f316bd17f04993b6473338fe7c08fd9874e743a31582162232c7d6c614e7b3513abcc0feb99b2c9111300004fe291f5bd682c039183e61c1fdac90b2a015939a8d10b07a05e99e5772b4b9329275cef8de2b066d4e4d421e4a0a69cdd8f674b12f5b3fa764e4b1e9f4d767e252e37577813a03f18da16d598fddcf4be590d9f65f64c647cb2f330a614fe688d3d80182ed8aa59905a1cb0d3f034d927e070d71f56ee8e5c5bdf23c4f85c7a17834467bd6cf58218868fe53e3675c130bbe44bea271fa67999a0dc3dbf7c40dbba6e7d6cc0936bd8d466a1f041883c093a3a60743d0549b1a989a2fa41ff978388014434909053e279a21e7866bd4efb4a9f46b7a8b0d1d84d83020e9e68936ca3de030269784aa29a3e25146cd5b03d21ca82f961be925c9ad487fb24b1e35c2d043ee4b6a4aaf811c4308a6ced6b4c45e7513a3f0e1421cb3b0fd8571a7085c9a4b454e4ee8b44767428666cd108b78369b871ab32f36943e24976f4bb6bd4068cc19585a2de791e3f950d220b28f4ba268d8c9dbccc1a705b1b1c30881babdbc8cc4cf97b801e4d410fd7c61b34b1f1265b9d114c99fb469914a213bb289c5bdf5af3835d089a2300"/1513, 0x5e9}, {&(0x7f0000000600)="3001fb90647586f4601659c5ad2644b99bfd65452e947b394c96c29278d097c5f170d77283a744139d2ce2a2f4bb5bb37e7396e7bac14056f25d17145e73bc2461b20ea3fce771f1b32d1585e8a456763cfafcf7189145a6e261af6232014cbf8a0f898bf6d14136874b6a1fd7caf8ec9966b0419be0420dc6e247d1a44f038ae29eb4bc67d6a04e80dfb7715ebafaa20fcbc57ade23cba05da1fbe4bba675b742472eebaabf356adc99866930e146125a272cef5baf5dfad4a28a01208d9908183ab2085a781e531f1bed4ac9c245ec19be383047656a7d857d364e6f69eccea5aca3964f", 0xe5}, {&(0x7f0000000b00)="79dfe4263f037de282e588f3c773eca5f0c383e7425d1573aa90a44223bfeced3ff85afe9d0c0b3b5a7ed7fcdb96a3934fe7af73ee25d5d36ba42e2a858c3d134299abc0393e031db435b2156e55eb2b2b2e0300e0706dfc5c4ec73ba929ffe8a7bb7ce55d95fb6e58560c45d96a58a13aa944b98c481a82927ec071b272b4592616116116527fd2dbc0dfd540810275770aa531098c572f714f6852063afc8358fb33cc7ef5c52565d586cfe6805bb8a95460b32b4e26bea604e534d8983790b5e2a180fed88108b0f5a499d5f80b4e4047d9ecc03d21856a4ec0d0d41496d99dddfa9098d327d9559e82fceb2b1b1c7be309200691488d6616780cd4e9020865ef41a22175dc52d35dac1232ae1164d7fee64a50651978436207fca4a9026a8a903e7857324459b7e8a143e6fdac0823c8d1a3ac864ad2d0402344aee2511247e716436fe118e65455da74ef25627785638dfa4bf365840fe12fbf73f0d42bcc66efc8693855156f6151e49471e1b7cccbfb01344f76cca177551c73147c32615b53f74a0b7c7ac25b86a01ce3", 0x18e}, {&(0x7f0000000cc0)="f2a0f0f863621b483b19e7ecfce0d34e53fbf295927214684f4d69e90f0ec506442d2126c3f5ab0cdfd79dc1815274c3ee57068b3793c25fab48eb353478689f452328afb023f75f93229060bc2c82dd05d1e8c3a549a06e280ca4eaf77b4aed57a0c5f6120d25a3d5121895638ec5e2e600000000f5be12a64e075c60dd63e0b00e8f42bfb7671a56925477029cec7e7f16b358404edfb5e7a055fdeb2ba044d0d54e341d1d1ef1eb2c317f587f591626ceed08555ca0b2f31a3e7bf5ba7541db275e6a6b6501b87cc74c4804f6da7d3de93327287204cc97f9cb747576d2ab23a6e35c6da6b3240c92ae18b31cb6e7bc60066994e2cb401c76b1840d3e231621355f10ff35ea91ffd463228d000000000000000e454d3c36efee949f6311c6ad78b5a8f091d2ebb008925107e4a4584dab83f7f0cb5ad94266e71e2b7aaa01cf4f9f5e1d52e1e5086e9633cbee8126a20000", 0x153}, {&(0x7f0000000700)="15c84609b06c6d85a5ca6f3a9a242f214aee4e7093161b717090c0c852a05393abd8992d91576f57bbd3488e85d8456d6c6c09de5c5228ee18819665861f01a2823a7cfa8e9260a5fe3921638db2dc5156149f86916810f913a944e1c8cd7fccb63f37900c5b287016e512b050ca214125b2217260c9ce3019e88b80985402ff7ca34be17e0dbda4f028cec9973a2b9eed83", 0x92}], 0x5, &(0x7f0000000580)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @loopback}}}], 0x20}, 0x0) 3m48.084275486s ago: executing program 33 (id=2882): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a80)={{0x14}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3cd2e7b3d6526bf5}}}, 0x68}}, 0x0) r1 = socket$kcm(0x2, 0x3, 0x84) sendmsg$inet(r1, &(0x7f0000001000)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, &(0x7f0000000080)=[{&(0x7f0000004fc0)="5346f7f875528ef24043c68e04180a332e94ee4784fffee263c06f2d924e8699b6af71aa257b5a316af31628e5148c7012f4d55ce4c29fea9e5b0b61fdf0b2dc866fa81b4e775e235eaebe330e16114548f147b8a966bf1f1fc6c24b9d47d349c87c3f789d2ba608cd25b17b6c80a7f0ceb4a06ff270ff8c9f0d3a19133f1fdfd51b767b8cef1f36e5490c5df5fcb378a6fb6eb5d8aaf7791ce81f61a05e1ebdd1789eb70ac1f3dfed378f6f3e237120052113a75ab977796117f7e7b2d6ee499f51dc070c820d10a0eaef4fc94ddc648bafae070caf70c465267497b3de963df649e113e2060c82b057abfae0798d424c81aeb42796189eb0936a2c547a5c4d6351ed786c75beb926113bd4294a982980afed3f9cf390f304611db4c6d7b64d64f38db5fde5cf7cadb20af9987758f91b51f49c697013b710e0218660671d0051ddd7fb7f5eb72a34f469b2e20600000091817eb5b952af43d1a40f4770e7220fcdfe25d3e9747e2af76ece5922724840afdba6f6f9e1d11db8561e8e836413ee04d6e084700ec1ac0e00569f0e4d4844f4710299aabbef615c33e276544669ce074528938ec0cc6d2af1ce7a47a64ad676f08507aa08d4210f979ef4aacfa4d524c9952d4743d65c3c527302942a8880116ce7ebc6c84778346f02c806bb466db7d313d7ebc7ea87823d4a8de0b697929fb3277012327827801f75ca3c5776d1a81acb160007f73148dfaf05ab7eed5a0e603ac468eb2bcd9de5f140758e74c20a9931187e0cbc857aa62a4cec8a62f7e31af3a78cdb8608551cdd68e83aebb3c9e05519184ff996c336553fa6bf16865cd6c4eacf1e360b029cdae41070f569a15bfd30f671c0a2fd183ea0eaae427505d56994ccfd0737aae3abbc45f56710d2e3f2662bf4514044f74e03cde28fa1783970d3c676cb23cb1923a9feb233267ef663936ccf25f7597a2270724527bf468d22786d0548b25582180b72c51742c4e5c373a1008dd4cfba508e8f3f8ec35e6f1375a11b1fbe2dc09e9fe609e80112c8f5c895c922cd547def707b7252d7afa0030d008b1dd10fd4a56e30237a6e0229fb4562cb8df3d4e64b28e15c075e59554e9d61a6065d49c1e765a49195cf5d6b1e2b6192447817fedfe41fcdf9a4fc5af567906e4b6453da7b97eac255cc253d7bceba09f67da4815438583c6843366b76d9e9277558e48681e9cfa920b47aea0e5c46ef86ea7f1ef534cf7565b24b833ba2cbfe60e6271614850dd68f2a8a6be4f315b83abb8e2699ed8e2a4b3506f9dacbb180c4deeef7489f49faf34cdf4e91a402956564f854d71c892e4aada1c91647ce45d4834d000e8d5be1773ecae388e511228977a69d4cc67fbab60ee1555a219e41eebc31807a87d9cbe88a8b05959e1a988f6ea6ed73a6ac1ec2f3d74d73eaa91a39308e008b7fa1ecc2a020d950a777c0d8d131416ef55a4ec041113df65ba4aea92fcb3e2268510f316bd17f04993b6473338fe7c08fd9874e743a31582162232c7d6c614e7b3513abcc0feb99b2c9111300004fe291f5bd682c039183e61c1fdac90b2a015939a8d10b07a05e99e5772b4b9329275cef8de2b066d4e4d421e4a0a69cdd8f674b12f5b3fa764e4b1e9f4d767e252e37577813a03f18da16d598fddcf4be590d9f65f64c647cb2f330a614fe688d3d80182ed8aa59905a1cb0d3f034d927e070d71f56ee8e5c5bdf23c4f85c7a17834467bd6cf58218868fe53e3675c130bbe44bea271fa67999a0dc3dbf7c40dbba6e7d6cc0936bd8d466a1f041883c093a3a60743d0549b1a989a2fa41ff978388014434909053e279a21e7866bd4efb4a9f46b7a8b0d1d84d83020e9e68936ca3de030269784aa29a3e25146cd5b03d21ca82f961be925c9ad487fb24b1e35c2d043ee4b6a4aaf811c4308a6ced6b4c45e7513a3f0e1421cb3b0fd8571a7085c9a4b454e4ee8b44767428666cd108b78369b871ab32f36943e24976f4bb6bd4068cc19585a2de791e3f950d220b28f4ba268d8c9dbccc1a705b1b1c30881babdbc8cc4cf97b801e4d410fd7c61b34b1f1265b9d114c99fb469914a213bb289c5bdf5af3835d089a2300"/1513, 0x5e9}, {&(0x7f0000000600)="3001fb90647586f4601659c5ad2644b99bfd65452e947b394c96c29278d097c5f170d77283a744139d2ce2a2f4bb5bb37e7396e7bac14056f25d17145e73bc2461b20ea3fce771f1b32d1585e8a456763cfafcf7189145a6e261af6232014cbf8a0f898bf6d14136874b6a1fd7caf8ec9966b0419be0420dc6e247d1a44f038ae29eb4bc67d6a04e80dfb7715ebafaa20fcbc57ade23cba05da1fbe4bba675b742472eebaabf356adc99866930e146125a272cef5baf5dfad4a28a01208d9908183ab2085a781e531f1bed4ac9c245ec19be383047656a7d857d364e6f69eccea5aca3964f", 0xe5}, {&(0x7f0000000b00)="79dfe4263f037de282e588f3c773eca5f0c383e7425d1573aa90a44223bfeced3ff85afe9d0c0b3b5a7ed7fcdb96a3934fe7af73ee25d5d36ba42e2a858c3d134299abc0393e031db435b2156e55eb2b2b2e0300e0706dfc5c4ec73ba929ffe8a7bb7ce55d95fb6e58560c45d96a58a13aa944b98c481a82927ec071b272b4592616116116527fd2dbc0dfd540810275770aa531098c572f714f6852063afc8358fb33cc7ef5c52565d586cfe6805bb8a95460b32b4e26bea604e534d8983790b5e2a180fed88108b0f5a499d5f80b4e4047d9ecc03d21856a4ec0d0d41496d99dddfa9098d327d9559e82fceb2b1b1c7be309200691488d6616780cd4e9020865ef41a22175dc52d35dac1232ae1164d7fee64a50651978436207fca4a9026a8a903e7857324459b7e8a143e6fdac0823c8d1a3ac864ad2d0402344aee2511247e716436fe118e65455da74ef25627785638dfa4bf365840fe12fbf73f0d42bcc66efc8693855156f6151e49471e1b7cccbfb01344f76cca177551c73147c32615b53f74a0b7c7ac25b86a01ce3", 0x18e}, {&(0x7f0000000cc0)="f2a0f0f863621b483b19e7ecfce0d34e53fbf295927214684f4d69e90f0ec506442d2126c3f5ab0cdfd79dc1815274c3ee57068b3793c25fab48eb353478689f452328afb023f75f93229060bc2c82dd05d1e8c3a549a06e280ca4eaf77b4aed57a0c5f6120d25a3d5121895638ec5e2e600000000f5be12a64e075c60dd63e0b00e8f42bfb7671a56925477029cec7e7f16b358404edfb5e7a055fdeb2ba044d0d54e341d1d1ef1eb2c317f587f591626ceed08555ca0b2f31a3e7bf5ba7541db275e6a6b6501b87cc74c4804f6da7d3de93327287204cc97f9cb747576d2ab23a6e35c6da6b3240c92ae18b31cb6e7bc60066994e2cb401c76b1840d3e231621355f10ff35ea91ffd463228d000000000000000e454d3c36efee949f6311c6ad78b5a8f091d2ebb008925107e4a4584dab83f7f0cb5ad94266e71e2b7aaa01cf4f9f5e1d52e1e5086e9633cbee8126a20000", 0x153}, {&(0x7f0000000700)="15c84609b06c6d85a5ca6f3a9a242f214aee4e7093161b717090c0c852a05393abd8992d91576f57bbd3488e85d8456d6c6c09de5c5228ee18819665861f01a2823a7cfa8e9260a5fe3921638db2dc5156149f86916810f913a944e1c8cd7fccb63f37900c5b287016e512b050ca214125b2217260c9ce3019e88b80985402ff7ca34be17e0dbda4f028cec9973a2b9eed83", 0x92}], 0x5, &(0x7f0000000580)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @loopback}}}], 0x20}, 0x0) 3m22.276727412s ago: executing program 5 (id=3079): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r0, &(0x7f00000005c0)={&(0x7f0000000600)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x34044840) sendmmsg(r0, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000700)="c6", 0x1}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x8481) 3m22.168554533s ago: executing program 5 (id=3081): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x24000044) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet(r1, &(0x7f0000000240)={0x2, 0x0, @loopback}, 0x10) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, 0x0) read$FUSE(r0, &(0x7f0000000440)={0x2020, 0x0, 0x0, 0x0}, 0x2020) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, 0x0, &(0x7f0000002580)) setresuid(0x0, r2, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x2, 0x0, @loopback}, 0x10) 3m22.116370211s ago: executing program 5 (id=3083): openat$sw_sync(0xffffffffffffff9c, &(0x7f00000000c0), 0x62601, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x15) mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESOCT, @ANYBLOB=',wfdno=', @ANYRESOCT=r0]) 3m22.080785188s ago: executing program 5 (id=3084): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = syz_io_uring_setup(0xf00, &(0x7f00000004c0)={0x0, 0x4961, 0x10000, 0x0, 0x4e}, &(0x7f0000000380)=0x0, &(0x7f00000003c0)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000440)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 3m21.97347264s ago: executing program 5 (id=3085): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000002980)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x4001ffe, 0xa68d7c519dc00fb1, 0x7, 0x6, 0x1, 0xe, 0x0, 0x0, 0x40}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000008380)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006340)={0x20, 0x0, 0x68cc, {0x0, 0x14}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x12) write$UHID_INPUT(r2, &(0x7f0000000440)={0x8, {"77b7cb7d9c4a8c4dc078e5186e5878eb2a4c66c7249cd95fe846e14abfacf66ca7584a26186075be2f6f0f57c6e96e096030bf0d2743671ae99cfd1217d1155f6df84c5d319ba1cbc143338007a959578a6f02b6f71ccdb3c53c887d1dc88f43004c4e2a3f730458798221cb214f6e4a9ddee49e0915bf5fc2d0218565fae733bea8d793eb63de1f0dc73a0ecebecbfc55a9ce41d0638cd3ffd993f6b2ef4031103e6103302c056421bbc500ece3fea7e0c64354e661f62e42658c9d85e7d81c66a345b78103702bb92c4d265115148e2345871be8a79a8d215c6d373c9801dd002cf19b0a0da82e8f73561d151a6e521732b2d26d05157bbc7aaa1c85425d5a2aa0727ee702a1f73694cf2f0ff637ea909b418c461be78e4b3646c12beef1476048250388f2720e353483469196cdea3f338e4cb778009b5e596fb05fa861d9879538a8c575e94a10d775280767f19e77992dd21a47469e995e1052ae29a62c18586d28714d340168597127184062c76d3be77c3584d679472574a098a19efb1e875f23ac16d1732edb57693fc22b04fc601a2623c4f939568d775f84a4e2ffca8f0c5f33d81a347326bb3024d9bd2e16b8a26d21150b39bb0a660b61211f3a312c22af37062298d0a2d6162fe692eb363e988db75429999c1f0792feae2084db70d6c91f333f40b41474fa7a1a97232b656ff9ec473a33d28c74cd5777b8900aab3a64924659d7ccfb02a7a63194d6c998260a85e5f38723f4b6f9c69d67c4f4b8a88852351ade349e4e863b0813eb4a6ab01e5fcd70642c12877b992fdbea27399387ec666542f094648e63e5ade537a75824b41df207f94795427f023469564217c91ca69506177e767eaa2714d0787f2092c54bad1d474aa431d40ead0a20b76200ddab4305e8577c3b8907abfe2cde9487671431ba0f2bed6f3b542299fc49be4bc1c590bb7c8a0e7f09ddfb6d6ecc46037b008bdf70fba4d8f8b41dbd7a65e3e2e1266d85bbdcd5885bcf6bbc1815ca2cc4f765e468f1273b11171a50930ed184f196733660d72ed650caaa762daab1a62cac073e19470b27eabb4ca8618d68a026f2ac5bef988c61b0561f99564e0021c688749c3c5999878e7f4dfb790f4fa80df610adb3701b070edb2b8a097cd39130edc33c3aa1d58a1e3ce614183c06ba2c07fc00d7822f9d950882f31cd90c008d02e122bd9bb0ead0c140d885aa2640275615289cc877a538b7ecc50497cf5de50435e13c5e3fa26d9c6e75199e83a9843759e252cb9136c8a1f9ec3eae031a78dd47a15f5707dce4eae0329465875afd515e42928454f5d72cf399322a1bd893086429198cdcbca8af0913c6dcf4b851b002f439e223bd195b7c8af961e11866b79fb4aa307c6e29f9cb8a4478397742956a93c0c05b67fe3d1c16b0ae34f549ead0cac4d836b27a33c975063a09e57e46e07a65d4783001a7e9636004fb8ab5312b676655a4ed83d09050c579fd3727e821453e1370c96e216a843a129d07fc368fadcdbb031ab62f5f07fae045f3c5702d7751af9c50a5b66011798835f302663bcf8c4c5086154e988c9e573e9e46e6d9ae1ec042561b65970970acb4ab251bde381d52c23d429f7be17dad20229200e26a7f8be47bab8188b8e0c9bde276f49c85f5d9462a65a38b2026d136f080de203836c3e56bc291d018d9ec893c77ef59578927c7d3f70c9649dc49f4387f290f7ba8900b87e3bd808293e66eba04fecd493edd14f7cbc6659c425c62bfc4a9bc870b276c0675d4f8f869d800a08b74507abfad3096bc20d619606ef9f6bbd9a64d54d258409076a038414c3d85e50a26517609ad70e51e6564c843e7dcb022b7e7443cdeffbdef8da96690a5c22f8dcd8936664e81e08871fe920b978e9e706df084fb9253e460a58cb1ac86729fccae46bf5cd6870bf15ec19ee2285be5aec22a6718ae00dd35e7efdb9e780426bb821607b848d1d669611119c055c2a136c991a9385ad1186e2a855e513e5110563c1d0b551603b79195a0f4e684e9ea73f473082477db32e897a8fa32d2c3f26101ded3e7adb62c026a55c2ff2cb1938d18f51f00cdff8ae4d29ae1aca6da3db40a4cdae833782452329921168ff2f15de11f14cf13dc98c5b2a34b4676da9d0b4b1bdf130450f056078c5df032fdf1e9b6e2ff13a208c3b0ba09437b478cfe1f03bfd9318e00f09a8a661436058e35e8ff603399c6c7cc61a95fc5aa5c4d9350d76217c1aa07f88979d1219f08e85899218d4a91ce4dbffc9f22acc700e0796e3b32c8bbae0c87aed5abc6bb9105b88047131b378cd72ff455bfc6996cde8d101629800b0631d16e86ad69d9d6a0ed4700c1297881b6f340ee9b23b6c852f930e3964dac52100078752565a44503c13dcd8dcca8a5bcb917a30e282ad98750254280c058ab8d29cb7535ff38d019a9cc101f9e163ec81cc40cda0277aa52cc71c53548e23e109f06c6504801cf39da201e8ad7be63def9ad0b1263def806e78de3d6f95bfa798024e5d8758136f6b9bd4381dfc57fc6e2c06ee079e72caaed4b40400ac6e79a1459f9965237b4c6b50e9bac50e5b972be701d1d4d83f0098d03313e3d4791928d31fdebbb276920f750d8e38984c720dcf081e3a92240935ca814e03b7b278a6d9615ff91a6bdbcba1fbc900420fb3f8327e617f804417710dfd2bd1dc9a871f694581d03ad751d0144f75b655e0bc4205e17ec3e0e9b052dbad1372778fa623f643f80a7ba4467c267216792df003771a50426d2ec16e5d06f848deaa330b0ae18d941f05186bf35134faa996e5988c211bb50d4783cf7d42ce217d7e6e814327dd5259b57394c8895036f6da2b3577ec98b24a18652df8f173d2adfeec11b708e4d00f9e7c8e27adb01ebfa71362c6117ccdf0b47442958ba9b16688c7cacc94c1630e0a698bf3705406040d7c5717fe7f4db43f912f17ac05a7594835ddec5f10a3e33dd75e2676e22460e5124295740d548323202072c436cb7f78dd4b776e37cded3dc1f327d128b13f4de84eb3a279f597bd833bcdbbedf95c19321ecda0d8efb4dfd9376600f3f0557e49074d3a0f41ec85ffb096dd8a60f1c0f66034d9a2f398c46f6f39f4f481cc8f5c5b95fde87ec48a89bbdd6fd99e92241ec87e54650cbe263f1cf651783a0c5777b5fa503d7a0db5d2f13cf4c3ccfb69fa02af648be2429aa18293fd5ed0c8f589ddb542019f9dc63a9337d6b2c501cc0b3b3cff3eef0c8e78a131d5da50ad384aa7b33139d762bd36e1908bd5cc244a5fe60f8d64dcb17db60eef669d93a2da7559870d52718a88bf86430fd3a89427fe7647745373cdc1333ec11994a3134f862568bd1036d1d2ce45d6f4a441ca108caa44d3d194bca6829bcc56fc54b7d7654b778e4c4f6c500870c7dbd5295d9db78994434bef2912f9ee8ca776a2f7b7b06e05cf82adc7e3e07207a914d7d4de8761ea6d18caf463280f35945bc3093e42f43f4ce7dd95bcdd9539cb32f8398f080334f75de1892056456dd928d9d0a1e8170afcc5e49d023db01af37d5a1696de872f3fe21da4d517b3158c7a8a12dc164c0890e35fc32c4b046e4110c158489bbdc4094a1c0b421ca6c9a9ed3bf301cf82459d41ac0dddfcc5a83a1eb8fae033558930d558ec7b192a42c5767f5319e2ec071b326224454d3351ad980b12016bb871645fbc270e1d781f9336da82cf6d6652e0369d9c32ef3c3034fc42920f513d2e5d9d2fd55e60f5e3871353f8dd8352cbb191c24930e92827660862ed8f9221d038f15a59c5dbfbf12be1e936c9f4df780390f02eca32119a924edffb3d85acbd166375eb9f4206e8e9dd85bcf7212ce5f7c1abee24939ac36c5fdb3be689ca62671ad51b67bff566527c624611cdcba5aefce5af0c5c14014bc284f312c0a5b7d3ec8ab46639a3b10ef3d2d85fae2bc13e81de93a495be80affd7c4b193c5b15bb947c24329b84f952c2ed50b4a431abbc780e9684fdfa06a3388f6001da4dd6baaa0fc24ceaf32710742b0062962db5b6bad30ebf7c562f169261e95d1c8240830d750cc5c7d120a07e5100abdf20fa8303ed8251a1555ec26848969dfaaa5581df432c04d421020a95997aeca7047e5824ffdd0c4ff171b95337ae58b392d0209e53400f4fc89eb509bb4d52e9292f32ba8bd3094c2f0bd4c4761125404c53db775ec151f9033b3f35621f7152fe59dd5d4548a9e5190b8d3b97a639916600b78c8e4270b05fe1cfb117a2a131f148aeb6773513e877d14b8bca0ffdab520ef19e160898fae8bb77feca3cb370c6753a71b46ea4e8414cd5d6c8b15fb18888d9f97631bbb3cb42ec6306ba8e1d7ba80d892a28f1d7c5402c5b0c6c68b7d938f9adf12eecca5bc32f8d19314818d54aac9f3702000d05e6947a8ab1def9c56d97c45fb8266281d29990b54e0fa9252323e2d0a147da36224171d6a9ac59a32a449f1f3f9ef87aff3c0e5b5a56103047a73ded1128ca7c5b20b38089ae42304543b1017ae63692b6f838b6518134cabe1292b2988d32916626c01bbca90b6a9d8efed189f0815bb242af57357e9ba32c8a690391a08e29482771d76170be815bf6fd2293a99fc8a01ee12475398c6d27a289d5bf3b98d7b5fa22ae9734c3023a3a09003d111fd9a3b334b293f4dd2355afe1ccd03aba957b0a57e9f7b2503dece8b06d53b0abd13b2a6b93bfd28ca7805a75d7aad5568737a2b7aeed34487fd2b2e29491d8f74e27bc8e912e3a246d8825ef4d0d8b00dba795a4802bf1edd0b9372753ad4bb3ce04da7742da6ffabaf3ef7668045dd4f321d015ebce8a6abed0b7a007034cdcc388e52ec28b4dedf56f924335942d890f1e37bb6e6d24a3f6eae1a6f02a0c1be19cdf4bb3f31fdbf7f6f026bfc0f73c55a9595a22136e13855dbb879f88606e6341e487c0b79bca05ed917c71333b45d02e2a9b35f53028f1350bcd950865d19023ddc0ecc418853ce970e6ca3ed39b118203569f7d38cc6c8db605d9d4fef4278cbfa56ff1706df244e4b5ec1989302bbe783945e7d43120fedd0eb31ec93de5d4b06c776b5ab0ba0b3a2df90738d9a76e66b211cd51489d6f0cd8c8485b253846f8ba5a402f35912e992a17b87a50c889a3769e9ec98c335f163be7e60863cc43965fd1339cc8631b2aeb95f8958d00a3eba338a29bf88394ed65a823c81927df94d6c079ebf602cc69e1d8f8db121cefe3e18b3b431716ff0d9362226e894c2eab40ecb67609ee937a28b90037020286075a0d92ece5399fcb5fdee633891eff4a0ea821bc9336b9308c38e7529690a4c3bb217d014ef44a8ca0ac003bb6451c3c75e59c0560609862e8eebdc2e23cb0e75e4a9b0648da709a8261b065665209cab9b810b1f37a7f2078ae6717906a5e4cdb6218fcdafb7133b64fec9ad4f26e5dcf7ec473876dbb67d09053acf2760d4697ddf819ec0ca0f85cc1a2a6f189c65f9b374b59be703fe8d287f3e122eb327997418f13216fdb37a96738c853f48bbe661a836bece1d340d30c1290adeec6ab80579393daa54bcb983f569466c82b0f7f631b2f3378de1ac5008d7a4f50ca8733c404c25bd8b5af0e73a1e01939c97e850fc56fa09f3cee4aa0ed233a30d1c32b7ceea456b315cacdc5f4b3f516ed0d5a246d8da7d9190623642ccb26aaff0525dd229c6b73ee59378f75c4162f75d396366f5b06ae968db244c9993ad47cd79ad31a300c5b424f6302ead9b48f0c0cab516a670e3fcaa75a5358fcbb1fab63eccd263437413606cff10", 0x1000}}, 0x1006) 3m21.766047054s ago: executing program 5 (id=3086): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x5}, {0x6, 0x3, 0x0, 0xf00}]}) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000580)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x239, 0xa8}}, './file0\x00'}) 3m21.647302043s ago: executing program 34 (id=3086): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x5}, {0x6, 0x3, 0x0, 0xf00}]}) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000580)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x239, 0xa8}}, './file0\x00'}) 1m4.97775505s ago: executing program 6 (id=4064): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x13, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020200008500000072000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000"], &(0x7f0000000200)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0x22, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000480)={r0, 0xfca804a0, 0xe, 0x0, &(0x7f0000000880)="2e98d1dc0608000000c59218e7c8", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1m4.671023167s ago: executing program 6 (id=4067): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000980)=@newsa={0xf0, 0x1a, 0x7, 0x70bd2a, 0x0, {{@in=@rand_addr=0x64010100, @in=@multicast1, 0xffff, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0xfeffff7f00000001, 0x0, 0x60000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0x2, 0x2, 0x0, 0x70}}, 0xf0}}, 0x0) 1m4.41040871s ago: executing program 6 (id=4070): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000440)={0x2, 0x15, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='yeah', 0x4) listen(r0, 0x5) socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000005c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) connect$inet(r1, &(0x7f00000009c0)={0x2, 0x15, @loopback}, 0x10) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000b00)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x4001010}, 0x40) 1m2.793587551s ago: executing program 6 (id=4078): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="1c000000010401010000000000000000010004000500010001"], 0x1c}, 0x1, 0x0, 0x0, 0x60000081}, 0x800) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYBLOB="240000000104010200000180002000000100000008000540efffffff0500010001"], 0x24}}, 0x0) close(0x4) 1m2.132875331s ago: executing program 6 (id=4082): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c00000010000500"/20, @ANYRES32=0x0, @ANYBLOB="01000000010000001400030073797a6b616c6c6572300000000000000800", @ANYRES32=r3], 0x3c}}, 0x0) write(r0, &(0x7f0000000200)="ffffffffffff00112233445543050004", 0x10) 1m0.344998601s ago: executing program 6 (id=4089): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, 0x0, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfffd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x40, 0x8, 0x0, 0xcd6, 0x0, 0x7fffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000640)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000680)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000006c0)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000700)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000740)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 48.116716603s ago: executing program 4 (id=4097): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) close(r0) socket$netlink(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb4147000001000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe68db8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3542646bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000380)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='&'], 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000007c0)={0x0}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x41000, 0x27, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700), 0x10, 0x10}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x20000281}], 0x1}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) 46.760371592s ago: executing program 4 (id=4099): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c00000010000500"/20, @ANYRES32=0x0, @ANYBLOB="01000000010000001400030073797a6b616c6c6572300000000000000800", @ANYRES32=r3], 0x3c}}, 0x0) write(r0, &(0x7f0000000200)="ffffffffffff00112233445543050004", 0x10) 44.989381632s ago: executing program 35 (id=4089): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, 0x0, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfffd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x40, 0x8, 0x0, 0xcd6, 0x0, 0x7fffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000640)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000680)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000006c0)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000700)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000740)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 37.189375486s ago: executing program 4 (id=4104): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d1}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0xfffffffd, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56561, 0x70bd2a, 0x25dfdbfa, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0x0, 0x8}, {0xc, 0xffff}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x24048090) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r5, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 35.220057021s ago: executing program 4 (id=4110): mkdir(&(0x7f0000000000)='./file0\x00', 0x1cb) mount$bpf(0x200000000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000280)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x84000, 0x0) mkdir(&(0x7f0000000380)='./file0/../file0\x00', 0x190) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x0, &(0x7f0000000ac0)='./file0/../file0\x00', 0x0, 0x44000, 0x0) 33.813571575s ago: executing program 4 (id=4114): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d0102030109021200010000000009"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000040)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f0000000300)={0x40, 0x31}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000340)={0x2c, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x40, 0x31}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 29.453603548s ago: executing program 4 (id=4127): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, 0x0, 0x24000800) 27.144873968s ago: executing program 36 (id=4127): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, 0x0, 0x24000800) 18.755019914s ago: executing program 3 (id=4144): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000280)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe0}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x3, 0x101, 0x1}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x2000c080) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000003c0)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 14.459980494s ago: executing program 3 (id=4148): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="500000000001010400000000141a000002000010240001801400018008000100e000000108000200e00000010c00028005000100000000001800028014000180080001"], 0x50}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a1b000000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0x122}}, 0x0) 14.204682339s ago: executing program 7 (id=4149): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x30, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}, @NFQA_CFG_QUEUE_MAXLEN={0x8}]}, 0x30}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000002640)=@filter={'filter\x00', 0xe, 0x4, 0x298, 0xffffffff, 0x0, 0xd0, 0x168, 0xffffffff, 0xffffffff, 0xd0, 0x168, 0x200, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x0, 0x7fffffff, 0x0, 0x1517f, 0xffffffff, 0xfe}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffc}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x1000) syz_emit_ethernet(0x6a, &(0x7f0000002940)={@local, @random="fad1e048716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "3ce7b9286b574dc2720ef6057772f09df9d3421eee34e003", "047b90670593e17881953d1e429031066797feb6632a4cea988cc9256fe11df4"}}}}}}, 0x0) 12.369556073s ago: executing program 3 (id=4151): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) unshare(0x4000400) add_key$keyring(0x0, &(0x7f0000000000)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r2, 0x20) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000001c0)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000200)={0x1d, r3, 0x0, {0x1}}, 0x18) writev(r1, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000300), 0x800001d, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/diskstats\x00', 0x0, 0x0) write$cgroup_devices(r4, &(0x7f0000000380)=ANY=[@ANYBLOB="04000000000000"], 0x9) syz_open_dev$vim2m(&(0x7f00000003c0), 0x800, 0x2) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r1, 0x8010661b, &(0x7f0000000400)) r5 = syz_open_dev$vim2m(0x0, 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000480)={0xf0f023}) r6 = syz_open_dev$vim2m(&(0x7f00000004c0), 0x800, 0x2) r7 = syz_open_dev$video(&(0x7f0000000500), 0x8, 0x0) ioctl$VIDIOC_S_SELECTION(r7, 0xc040565f, &(0x7f0000000540)={0xa, 0x0, 0x3, {0xa, 0x1000, 0x4, 0x2}}) ioctl$vim2m_VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f0000000580)={0x2, @win={{0x6, 0x1, 0x1ff, 0x70}, 0x5, 0x4, 0x0, 0x2, 0x0, 0x1}}) syz_open_procfs(0x0, &(0x7f00000006c0)='net/udp\x00') sendfile(r0, r4, 0x0, 0x106f) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x802, 0x0) 12.115528132s ago: executing program 7 (id=4152): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x1, 0x16, &(0x7f0000000380)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf670000000000001507"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffff7}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0xf0f, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313b, 0xffffffffffffffff, 0x0, 0x0, &(0x7f00000003c0)}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110c230000) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) 10.255533247s ago: executing program 3 (id=4154): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x4}, [@call={0x85, 0x0, 0x0, 0xbc}]}, &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r3, r2, 0x25, 0x4, @void}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newlink={0x4c, 0x10, 0x503, 0xfffffffc, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0x2}, @IFLA_XFRM_LINK={0x8, 0x1, 0x2}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 9.084034032s ago: executing program 1 (id=4155): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1400000010000100000000000000000000000a0020000000000a01000000000000000000050000000900010073797a300000000064000000120a01000000000000000000050000000900010073797a30000000000900020073797a3100000000080003000000000a30"], 0xb0}, 0x1, 0x0, 0x0, 0x20004081}, 0x40800) 8.254842747s ago: executing program 1 (id=4156): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000800), 0x8a002, 0x0) write$rfkill(r0, &(0x7f0000000840)={0x0, 0x0, 0x2, 0x0, 0x1}, 0xcb) 7.085267909s ago: executing program 1 (id=4157): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000280)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe0}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x3, 0x101, 0x1}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x2000c080) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000003c0)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 4.172815498s ago: executing program 7 (id=4158): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) close(r0) socket$netlink(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb4147000001000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe68db8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3542646bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000380)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='&'], 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000007c0)={0x0}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x41000, 0x27, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700), 0x10, 0x10}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x20000281}], 0x1}, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) 4.065505066s ago: executing program 3 (id=4159): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) close(r1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d1}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000600), 0x56) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0xfffffffd, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56561, 0x70bd2a, 0x25dfdbfa, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0x0, 0x8}, {0xc, 0xffff}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x24048090) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r5, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 3.648435945s ago: executing program 1 (id=4160): r0 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85512, 0x0) 2.141540001s ago: executing program 1 (id=4161): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) pidfd_send_signal(r0, 0x19, 0x0, 0x0) 1.914900807s ago: executing program 7 (id=4162): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) unshare(0x4000400) add_key$keyring(0x0, &(0x7f0000000000)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r2, 0x20) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000001c0)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000200)={0x1d, r3, 0x0, {0x1}}, 0x18) writev(r1, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000300), 0x800001d, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/diskstats\x00', 0x0, 0x0) write$cgroup_devices(r4, &(0x7f0000000380)=ANY=[@ANYBLOB="04000000000000"], 0x9) syz_open_dev$vim2m(&(0x7f00000003c0), 0x800, 0x2) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r1, 0x8010661b, &(0x7f0000000400)) r5 = syz_open_dev$vim2m(&(0x7f0000000440), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, 0x0) r6 = syz_open_dev$vim2m(&(0x7f00000004c0), 0x800, 0x2) r7 = syz_open_dev$video(&(0x7f0000000500), 0x8, 0x0) ioctl$VIDIOC_S_SELECTION(r7, 0xc040565f, &(0x7f0000000540)={0xa, 0x0, 0x3, {0xa, 0x1000, 0x4, 0x2}}) ioctl$vim2m_VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f0000000580)={0x2, @win={{0x6, 0x1, 0x1ff, 0x70}, 0x5, 0x4, 0x0, 0x2, 0x0, 0x1}}) syz_open_procfs(0x0, &(0x7f00000006c0)='net/udp\x00') sendfile(r0, r4, 0x0, 0x106f) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x802, 0x0) 1.397752088s ago: executing program 3 (id=4163): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_pts(r1, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f00000003c0)=0x8d) pipe(0x0) mlock(&(0x7f0000400000/0xc00000)=nil, 0xc00000) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) munlockall() syz_open_procfs(0x0, 0x0) fanotify_mark(0xffffffffffffffff, 0x1, 0x8000039, 0xffffffffffffffff, 0x0) syz_kvm_add_vcpu$x86(0x0, 0x0) 1.12892414s ago: executing program 1 (id=4164): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42202) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0x257, @time={0x65757100, 0x5}, 0x0, {}, 0x67, 0x2}) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000200)={0x3, "b17da9c3fad47fcc0b0a3379d45ccbcae464b86d6e2bd5e9c154653a2c9ef49f"}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r4 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000004c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000005c0)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000600)={'wlan0\x00', 0x1}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20000900) openat$ptmx(0xffffffffffffff9c, 0x0, 0x41, 0x0) pipe2$9p(&(0x7f0000000740), 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8f, 0x1000000, 0x12, 0xffffffffffffffff, 0x0) socket$nl_audit(0x10, 0x3, 0x9) sendmsg$NL80211_CMD_DEL_INTERFACE(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)={0x1c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x0) 914.537825ms ago: executing program 7 (id=4165): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000580)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000008c0)=@newqdisc={0x50, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x0, 0x57b2}, [@TCA_NETEM_LOSS={0x4}]}}}]}, 0x50}}, 0x0) 0s ago: executing program 7 (id=4166): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x1, 0x16, &(0x7f0000000380)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf670000000000001507"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffff7}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0xf0f, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313b, 0xffffffffffffffff, 0x0, 0x0, &(0x7f00000003c0)}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110c230000) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) kernel console output (not intermixed with test programs): [T15836] ? __pfx___sys_socket+0x10/0x10 [ 559.807650][T15836] __x64_sys_socket+0x72/0xb0 [ 559.807667][T15836] ? lockdep_hardirqs_on+0x7d/0x110 [ 559.807686][T15836] do_syscall_64+0x123/0x790 [ 559.807705][T15836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.807718][T15836] RIP: 0033:0x7f624679e559 [ 559.807730][T15836] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 559.807741][T15836] RSP: 002b:00007f62476a4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 559.807754][T15836] RAX: ffffffffffffffda RBX: 00007f6246a25fa0 RCX: 00007f624679e559 [ 559.807762][T15836] RDX: 000000000000000c RSI: 0000000000000003 RDI: 0000000000000010 [ 559.807769][T15836] RBP: 00007f6246835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 559.807777][T15836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 559.807785][T15836] R13: 00007f6246a26038 R14: 00007f6246a25fa0 R15: 00007ffe508ab5e8 [ 559.807801][T15836] [ 559.807822][T15836] socket: no more sockets [ 560.099692][ T30] audit: type=1400 audit(2000000237.223:701): avc: denied { ioctl } for pid=15837 comm="syz.3.3301" path="socket:[60093]" dev="sockfs" ino=60093 ioctlcmd=0x8940 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 560.162627][T11758] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 560.174927][T11758] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 560.483423][T15847] FAULT_INJECTION: forcing a failure. [ 560.483423][T15847] name failslab, interval 1, probability 0, space 0, times 0 [ 560.483448][T15847] CPU: 1 UID: 0 PID: 15847 Comm: syz.3.3305 Tainted: G L syzkaller #0 PREEMPT(full) [ 560.483465][T15847] Tainted: [L]=SOFTLOCKUP [ 560.483470][T15847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 560.483478][T15847] Call Trace: [ 560.483483][T15847] [ 560.483489][T15847] dump_stack_lvl+0x100/0x190 [ 560.483512][T15847] should_fail_ex.cold+0x5/0xa [ 560.483528][T15847] ? is_bpf_text_address+0x94/0x1a0 [ 560.483549][T15847] should_failslab+0xc2/0x120 [ 560.483568][T15847] __kmalloc_noprof+0xfc/0x840 [ 560.483583][T15847] ? arch_stack_walk+0xa6/0xf0 [ 560.483599][T15847] ? rds_message_alloc+0x48/0x220 [ 560.483622][T15847] rds_message_alloc+0x48/0x220 [ 560.483641][T15847] rds_send_probe.constprop.0+0xa3/0xc90 [ 560.483655][T15847] ? stack_trace_save+0x8e/0xc0 [ 560.483669][T15847] ? __pfx_stack_trace_save+0x10/0x10 [ 560.483684][T15847] ? __pfx_rds_send_probe.constprop.0+0x10/0x10 [ 560.483709][T15847] rds_recv_incoming+0xc0b/0x12b0 [ 560.483725][T15847] ? __pfx_rds_recv_incoming+0x10/0x10 [ 560.483739][T15847] ? do_raw_spin_lock+0x128/0x260 [ 560.483758][T15847] ? find_held_lock+0x2b/0x80 [ 560.483780][T15847] rds_loop_xmit+0x11a/0x2e0 [ 560.483795][T15847] ? __pfx_rds_loop_xmit+0x10/0x10 [ 560.483811][T15847] rds_send_xmit+0x112c/0x2980 [ 560.483832][T15847] ? rcu_is_watching+0x13/0xc0 [ 560.483853][T15847] ? __pfx_rds_send_xmit+0x10/0x10 [ 560.483878][T15847] rds_sendmsg+0x2ed7/0x34d0 [ 560.483900][T15847] ? __pfx_rds_sendmsg+0x10/0x10 [ 560.483917][T15847] ? __might_fault+0xc5/0x140 [ 560.483935][T15847] ? selinux_socket_sendmsg+0x198/0x2f0 [ 560.483956][T15847] ? __sys_sendto+0x48b/0x4e0 [ 560.483968][T15847] __sys_sendto+0x48b/0x4e0 [ 560.483979][T15847] ? __pfx_rds_sendmsg+0x10/0x10 [ 560.483993][T15847] ? __pfx___sys_sendto+0x10/0x10 [ 560.484017][T15847] ? __fget_files+0x21f/0x3d0 [ 560.484041][T15847] ? xfd_validate_state+0x129/0x190 [ 560.484058][T15847] __x64_sys_sendto+0xe0/0x1c0 [ 560.484069][T15847] ? do_syscall_64+0xae/0x790 [ 560.484086][T15847] ? lockdep_hardirqs_on+0x7d/0x110 [ 560.484103][T15847] do_syscall_64+0x123/0x790 [ 560.484122][T15847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.484136][T15847] RIP: 0033:0x7f3beaf9e559 [ 560.484147][T15847] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 560.484159][T15847] RSP: 002b:00007f3bebf43028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 560.484171][T15847] RAX: ffffffffffffffda RBX: 00007f3beb225fa0 RCX: 00007f3beaf9e559 [ 560.484180][T15847] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 560.484187][T15847] RBP: 00007f3beb035ad8 R08: 0000200000000300 R09: 0000000000000010 [ 560.484195][T15847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 560.484203][T15847] R13: 00007f3beb226038 R14: 00007f3beb225fa0 R15: 00007fff1203a958 [ 560.484223][T15847] [ 560.838432][T11983] usb 8-1: USB disconnect, device number 5 [ 560.852642][T15851] usb 8-1: Couldn't submit interrupt_in_urb -19 [ 560.885970][T11983] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 560.957659][T15850] TC_ACT_REPEAT abuse ? [ 561.224572][T15879] ip_tables: iptables: counters copy to user failed while replacing table [ 561.328640][T15885] FAULT_INJECTION: forcing a failure. [ 561.328640][T15885] name failslab, interval 1, probability 0, space 0, times 0 [ 561.328667][T15885] CPU: 1 UID: 0 PID: 15885 Comm: syz.1.3312 Tainted: G L syzkaller #0 PREEMPT(full) [ 561.328685][T15885] Tainted: [L]=SOFTLOCKUP [ 561.328690][T15885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 561.328698][T15885] Call Trace: [ 561.328703][T15885] [ 561.328709][T15885] dump_stack_lvl+0x100/0x190 [ 561.328733][T15885] should_fail_ex.cold+0x5/0xa [ 561.328751][T15885] should_failslab+0xc2/0x120 [ 561.328770][T15885] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 561.328787][T15885] ? sock_alloc_inode+0x26/0x2c0 [ 561.328804][T15885] ? __pfx_sock_alloc_inode+0x10/0x10 [ 561.328829][T15885] sock_alloc_inode+0x26/0x2c0 [ 561.328844][T15885] ? __pfx_sock_alloc_inode+0x10/0x10 [ 561.328859][T15885] alloc_inode+0x68/0x250 [ 561.328875][T15885] sock_alloc+0x44/0x280 [ 561.328889][T15885] ? security_socket_create+0x7f/0x250 [ 561.328907][T15885] __sock_create+0xc2/0x860 [ 561.328926][T15885] __sys_socket+0x14d/0x260 [ 561.328943][T15885] ? __pfx___sys_socket+0x10/0x10 [ 561.328965][T15885] __x64_sys_socket+0x72/0xb0 [ 561.328981][T15885] ? lockdep_hardirqs_on+0x7d/0x110 [ 561.328999][T15885] do_syscall_64+0x123/0x790 [ 561.329018][T15885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 561.329031][T15885] RIP: 0033:0x7f624679e559 [ 561.329043][T15885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 561.329055][T15885] RSP: 002b:00007f62476a4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 561.329067][T15885] RAX: ffffffffffffffda RBX: 00007f6246a25fa0 RCX: 00007f624679e559 [ 561.329075][T15885] RDX: 000000000000000c RSI: 0000000000000003 RDI: 0000000000000010 [ 561.329083][T15885] RBP: 00007f6246835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 561.329090][T15885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 561.329097][T15885] R13: 00007f6246a26038 R14: 00007f6246a25fa0 R15: 00007ffe508ab5e8 [ 561.329114][T15885] [ 561.329121][T15885] socket: no more sockets [ 561.780739][ T30] audit: type=1400 audit(2000000238.903:702): avc: denied { ioctl } for pid=15893 comm="syz.4.3315" path="socket:[60245]" dev="sockfs" ino=60245 ioctlcmd=0x7437 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 561.841611][ T30] audit: type=1400 audit(2000000238.963:703): avc: denied { write } for pid=15893 comm="syz.4.3315" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 561.889255][ T30] audit: type=1400 audit(2000000239.013:704): avc: denied { setopt } for pid=15893 comm="syz.4.3315" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 561.929524][ T30] audit: type=1400 audit(2000000239.053:705): avc: denied { getopt } for pid=15893 comm="syz.4.3315" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 561.933087][T15894] netlink: 576 bytes leftover after parsing attributes in process `syz.4.3315'. [ 562.113023][T15901] FAULT_INJECTION: forcing a failure. [ 562.113023][T15901] name failslab, interval 1, probability 0, space 0, times 0 [ 562.113049][T15901] CPU: 1 UID: 0 PID: 15901 Comm: syz.3.3317 Tainted: G L syzkaller #0 PREEMPT(full) [ 562.113069][T15901] Tainted: [L]=SOFTLOCKUP [ 562.113073][T15901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 562.113081][T15901] Call Trace: [ 562.113086][T15901] [ 562.113092][T15901] dump_stack_lvl+0x100/0x190 [ 562.113116][T15901] should_fail_ex.cold+0x5/0xa [ 562.113132][T15901] ? is_bpf_text_address+0x94/0x1a0 [ 562.113152][T15901] should_failslab+0xc2/0x120 [ 562.113170][T15901] __kmalloc_noprof+0xfc/0x840 [ 562.113185][T15901] ? arch_stack_walk+0xa6/0xf0 [ 562.113204][T15901] ? rds_message_alloc+0x48/0x220 [ 562.113226][T15901] rds_message_alloc+0x48/0x220 [ 562.113245][T15901] rds_send_probe.constprop.0+0xa3/0xc90 [ 562.113259][T15901] ? stack_trace_save+0x8e/0xc0 [ 562.113273][T15901] ? __pfx_stack_trace_save+0x10/0x10 [ 562.113288][T15901] ? __pfx_rds_send_probe.constprop.0+0x10/0x10 [ 562.113310][T15901] rds_recv_incoming+0xc0b/0x12b0 [ 562.113325][T15901] ? __pfx_rds_recv_incoming+0x10/0x10 [ 562.113338][T15901] ? do_raw_spin_lock+0x128/0x260 [ 562.113356][T15901] ? find_held_lock+0x2b/0x80 [ 562.113376][T15901] rds_loop_xmit+0x11a/0x2e0 [ 562.113391][T15901] ? __pfx_rds_loop_xmit+0x10/0x10 [ 562.113407][T15901] rds_send_xmit+0x112c/0x2980 [ 562.113425][T15901] ? rcu_is_watching+0x13/0xc0 [ 562.113446][T15901] ? __pfx_rds_send_xmit+0x10/0x10 [ 562.113465][T15901] rds_sendmsg+0x2ed7/0x34d0 [ 562.113485][T15901] ? __pfx_rds_sendmsg+0x10/0x10 [ 562.113502][T15901] ? __might_fault+0xc5/0x140 [ 562.113519][T15901] ? selinux_socket_sendmsg+0x198/0x2f0 [ 562.113539][T15901] ? __sys_sendto+0x48b/0x4e0 [ 562.113550][T15901] __sys_sendto+0x48b/0x4e0 [ 562.113560][T15901] ? __pfx_rds_sendmsg+0x10/0x10 [ 562.113574][T15901] ? __pfx___sys_sendto+0x10/0x10 [ 562.113598][T15901] ? __fget_files+0x21f/0x3d0 [ 562.113621][T15901] ? xfd_validate_state+0x129/0x190 [ 562.113638][T15901] __x64_sys_sendto+0xe0/0x1c0 [ 562.113649][T15901] ? do_syscall_64+0xae/0x790 [ 562.113667][T15901] ? lockdep_hardirqs_on+0x7d/0x110 [ 562.113685][T15901] do_syscall_64+0x123/0x790 [ 562.113704][T15901] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.113717][T15901] RIP: 0033:0x7f3beaf9e559 [ 562.113728][T15901] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 562.113740][T15901] RSP: 002b:00007f3bebf43028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 562.113761][T15901] RAX: ffffffffffffffda RBX: 00007f3beb225fa0 RCX: 00007f3beaf9e559 [ 562.113770][T15901] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 562.113778][T15901] RBP: 00007f3beb035ad8 R08: 0000200000000300 R09: 0000000000000010 [ 562.113786][T15901] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 562.113794][T15901] R13: 00007f3beb226038 R14: 00007f3beb225fa0 R15: 00007fff1203a958 [ 562.113812][T15901] [ 562.671585][T15910] 0x000000000000-0x000000010000 : "" [ 562.696584][T15913] xt_connbytes: Forcing CT accounting to be enabled [ 562.705062][T15910] ftl_cs: FTL header not found. [ 562.821510][T15910] FAULT_INJECTION: forcing a failure. [ 562.821510][T15910] name failslab, interval 1, probability 0, space 0, times 0 [ 562.821534][T15910] CPU: 1 UID: 0 PID: 15910 Comm: syz.6.3319 Tainted: G L syzkaller #0 PREEMPT(full) [ 562.821553][T15910] Tainted: [L]=SOFTLOCKUP [ 562.821558][T15910] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 562.821566][T15910] Call Trace: [ 562.821571][T15910] [ 562.821577][T15910] dump_stack_lvl+0x100/0x190 [ 562.821600][T15910] should_fail_ex.cold+0x5/0xa [ 562.821620][T15910] should_failslab+0xc2/0x120 [ 562.821639][T15910] kmem_cache_alloc_noprof+0x92/0x6a0 [ 562.821656][T15910] ? __kernfs_new_node+0xd2/0xa10 [ 562.821674][T15910] __kernfs_new_node+0xd2/0xa10 [ 562.821690][T15910] ? __pfx___kernfs_new_node+0x10/0x10 [ 562.821706][T15910] ? lock_acquire+0x1d1/0x380 [ 562.821724][T15910] ? kernfs_root+0x23/0x2a0 [ 562.821738][T15910] ? find_held_lock+0x2b/0x80 [ 562.821757][T15910] ? kernfs_root+0xee/0x2a0 [ 562.821775][T15910] ? kernfs_root+0xee/0x2a0 [ 562.821793][T15910] kernfs_new_node+0x117/0x150 [ 562.821811][T15910] __kernfs_create_file+0x53/0x350 [ 562.821831][T15910] sysfs_add_file_mode_ns+0x207/0x3c0 [ 562.821856][T15910] internal_create_group+0x593/0xfb0 [ 562.821873][T15910] ? kernfs_create_dir_ns+0x16f/0x2b0 [ 562.821889][T15910] ? __pfx_internal_create_group+0x10/0x10 [ 562.821903][T15910] ? sysfs_create_dir_ns+0x14c/0x2b0 [ 562.821915][T15910] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 562.821928][T15910] ? sysfs_create_dir_ns+0x14c/0x2b0 [ 562.821941][T15910] internal_create_groups+0x9d/0x150 [ 562.821956][T15910] kobject_add_internal+0x317/0x930 [ 562.821974][T15910] kobject_add+0x16a/0x1e0 [ 562.821988][T15910] ? __pfx_kobject_add+0x10/0x10 [ 562.822003][T15910] ? __pfx_kobject_add+0x10/0x10 [ 562.822023][T15910] blk_register_queue+0x8d/0x630 [ 562.822043][T15910] __add_disk+0x7dd/0xf10 [ 562.822061][T15910] add_disk_fwnode+0x118/0x480 [ 562.822077][T15910] add_mtd_blktrans_dev+0xd0b/0x1520 [ 562.822098][T15910] ? __pfx_add_mtd_blktrans_dev+0x10/0x10 [ 562.822127][T15910] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 562.822141][T15910] ? mtdblock_add_mtd+0x4a/0x270 [ 562.822162][T15910] mtdblock_add_mtd+0x1cc/0x270 [ 562.822179][T15910] blktrans_notify_add+0xa2/0xf0 [ 562.822196][T15910] add_mtd_device+0xb6d/0x1820 [ 562.822213][T15910] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 562.822233][T15910] ? __pfx_add_mtd_device+0x10/0x10 [ 562.822251][T15910] mtd_add_partition+0x376/0x6a0 [ 562.822268][T15910] ? __pfx_mtd_add_partition+0x10/0x10 [ 562.822282][T15910] ? __might_fault+0xc5/0x140 [ 562.822294][T15910] ? __might_fault+0xc5/0x140 [ 562.822314][T15910] mtdchar_blkpg_ioctl+0x207/0x250 [ 562.822329][T15910] ? __pfx_mtdchar_blkpg_ioctl+0x10/0x10 [ 562.822361][T15910] mtdchar_ioctl+0x1670/0x1fd0 [ 562.822380][T15910] ? __pfx_mtdchar_ioctl+0x10/0x10 [ 562.822397][T15910] ? lock_acquire+0x1d1/0x380 [ 562.822410][T15910] ? mtdchar_unlocked_ioctl+0xa2/0xf0 [ 562.822430][T15910] ? rcu_is_watching+0x13/0xc0 [ 562.822448][T15910] ? trace_contention_end+0x126/0x160 [ 562.822465][T15910] ? mtdchar_unlocked_ioctl+0xa2/0xf0 [ 562.822482][T15910] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 562.822497][T15910] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 562.822517][T15910] ? __pfx___mutex_lock+0x10/0x10 [ 562.822536][T15910] ? __fget_files+0x34/0x3d0 [ 562.822564][T15910] mtdchar_unlocked_ioctl+0xb0/0xf0 [ 562.822580][T15910] ? __pfx_mtdchar_unlocked_ioctl+0x10/0x10 [ 562.822598][T15910] __x64_sys_ioctl+0x18e/0x210 [ 562.822614][T15910] do_syscall_64+0x123/0x790 [ 562.822634][T15910] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.822647][T15910] RIP: 0033:0x7f0d6e39e559 [ 562.822659][T15910] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 562.822671][T15910] RSP: 002b:00007f0d6f293028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 562.822683][T15910] RAX: ffffffffffffffda RBX: 00007f0d6e625fa0 RCX: 00007f0d6e39e559 [ 562.822692][T15910] RDX: 0000200000000a80 RSI: 0000000000001269 RDI: 0000000000000008 [ 562.822700][T15910] RBP: 00007f0d6e435ad8 R08: 0000000000000000 R09: 0000000000000000 [ 562.822708][T15910] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 562.822716][T15910] R13: 00007f0d6e626038 R14: 00007f0d6e625fa0 R15: 00007ffdd8efdb18 [ 562.822734][T15910] [ 562.831389][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.831421][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.358598][T15910] kobject: kobject_add_internal failed for queue (error: -12 parent: mtdblock2) [ 563.562337][T15925] ip_tables: iptables: counters copy to user failed while replacing table [ 563.646914][T11983] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 563.796915][T11983] usb 4-1: Using ep0 maxpacket: 32 [ 563.801526][T11983] usb 4-1: unable to get BOS descriptor or descriptor too short [ 563.801555][T11983] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 563.805307][T11983] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 563.805323][T11983] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 563.805335][T11983] usb 4-1: config 14 has no interface number 0 [ 563.805345][T11983] usb 4-1: config 14 has no interface number 1 [ 563.805376][T11983] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 563.806903][T11983] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 563.807628][T11983] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 563.807646][T11983] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 563.807663][T11983] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 563.807678][T11983] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 563.807697][T11983] usb 4-1: config 14 interface 57 has no altsetting 0 [ 563.807708][T11983] usb 4-1: config 14 interface 228 has no altsetting 0 [ 563.945946][T11983] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.945964][T11983] usb 4-1: Product: syz [ 563.945973][T11983] usb 4-1: Manufacturer: syz [ 563.945982][T11983] usb 4-1: SerialNumber: syz [ 564.376137][T11758] usb 8-1: new full-speed USB device number 6 using dummy_hcd [ 564.397322][ T30] audit: type=1400 audit(2000000241.523:706): avc: denied { read } for pid=15951 comm="syz.4.3337" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 564.428680][T11983] legousbtower 4-1:14.57: interrupt endpoints not found [ 564.527111][T11758] usb 8-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 564.530183][T11758] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.530200][T11758] usb 8-1: Product: syz [ 564.530222][T11758] usb 8-1: Manufacturer: syz [ 564.530231][T11758] usb 8-1: SerialNumber: syz [ 564.574952][T11758] usb 8-1: config 0 descriptor?? [ 564.800243][T11758] usb 8-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 564.836460][T11983] legousbtower 4-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 564.838623][T11983] legousbtower 4-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 564.963053][ T30] audit: type=1400 audit(2000000242.083:707): avc: denied { read } for pid=15962 comm="syz.4.3342" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 565.118416][T15965] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3342'. [ 565.158328][T15967] FAULT_INJECTION: forcing a failure. [ 565.158328][T15967] name fail_futex, interval 1, probability 0, space 0, times 0 [ 565.158353][T15967] CPU: 1 UID: 0 PID: 15967 Comm: syz.1.3343 Tainted: G L syzkaller #0 PREEMPT(full) [ 565.158371][T15967] Tainted: [L]=SOFTLOCKUP [ 565.158376][T15967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 565.158384][T15967] Call Trace: [ 565.158388][T15967] [ 565.158394][T15967] dump_stack_lvl+0x100/0x190 [ 565.158420][T15967] should_fail_ex.cold+0x5/0xa [ 565.158440][T15967] get_futex_key+0x1c9/0x13e0 [ 565.158461][T15967] ? __pfx_get_futex_key+0x10/0x10 [ 565.158477][T15967] ? futex_wake+0x4ea/0x5e0 [ 565.158494][T15967] futex_wake+0xf4/0x5e0 [ 565.158509][T15967] ? __pfx_futex_wake+0x10/0x10 [ 565.158523][T15967] ? clockevents_program_event+0x1ef/0x820 [ 565.158545][T15967] ? hrtimer_bases_first+0x1a0/0x210 [ 565.158563][T15967] ? __pfx_clockevents_program_event+0x10/0x10 [ 565.158592][T15967] do_futex+0x2b2/0x440 [ 565.158612][T15967] ? __pfx_do_futex+0x10/0x10 [ 565.158631][T15967] ? find_held_lock+0x2b/0x80 [ 565.158652][T15967] ? handle_softirqs+0x1e6/0x9d0 [ 565.158669][T15967] __x64_sys_futex+0x34f/0x4d0 [ 565.158689][T15967] ? __pfx___x64_sys_futex+0x10/0x10 [ 565.158714][T15967] do_syscall_64+0x123/0x790 [ 565.158734][T15967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.158747][T15967] RIP: 0033:0x7f624679e559 [ 565.158760][T15967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 565.158772][T15967] RSP: 002b:00007f62476a40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 565.158785][T15967] RAX: ffffffffffffffda RBX: 00007f6246a25fa8 RCX: 00007f624679e559 [ 565.158793][T15967] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f6246a25fac [ 565.158801][T15967] RBP: 00007f6246a25fa0 R08: 0000000000000001 R09: 0000000000000000 [ 565.158808][T15967] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 565.158816][T15967] R13: 00007f6246a26038 R14: 00007ffe508ab500 R15: 00007ffe508ab5e8 [ 565.158833][T15967] [ 565.419689][ C1] usb 4-1: tower_interrupt_in_callback: usb_submit_urb failed (-19) [ 565.419716][ T1230] usb 4-1: USB disconnect, device number 125 [ 565.448502][T15969] usb 4-1: Couldn't submit interrupt_out_urb -19 [ 565.451228][ T1230] legousbtower 4-1:14.228: LEGO USB Tower #-160 now disconnected [ 565.617251][T11758] dvb_usb_rtl28xxu 8-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 566.721754][T16009] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 566.832537][T16011] syzkaller0: entered promiscuous mode [ 566.832552][T16011] syzkaller0: entered allmulticast mode [ 566.849890][ T30] audit: type=1400 audit(2000000243.973:708): avc: denied { setopt } for pid=16001 comm="syz.1.3356" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 567.177311][ T5606] usb 8-1: USB disconnect, device number 6 [ 567.326813][T11758] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 567.381142][T16031] fuse: Bad value for 'fd' [ 567.476289][T11758] usb 4-1: Using ep0 maxpacket: 32 [ 567.484681][T11758] usb 4-1: unable to get BOS descriptor or descriptor too short [ 567.484709][T11758] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 567.487496][T11758] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 567.487513][T11758] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 567.487527][T11758] usb 4-1: config 14 has no interface number 0 [ 567.487536][T11758] usb 4-1: config 14 has no interface number 1 [ 567.487568][T11758] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 567.487583][T11758] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 567.487598][T11758] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 567.487613][T11758] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 567.487629][T11758] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 567.487644][T11758] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 567.487660][T11758] usb 4-1: config 14 interface 57 has no altsetting 0 [ 567.487670][T11758] usb 4-1: config 14 interface 228 has no altsetting 0 [ 567.636424][T11758] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.636441][T11758] usb 4-1: Product: syz [ 567.636451][T11758] usb 4-1: Manufacturer: syz [ 567.636459][T11758] usb 4-1: SerialNumber: syz [ 567.752501][T16038] syzkaller0: entered promiscuous mode [ 567.752517][T16038] syzkaller0: entered allmulticast mode [ 568.003848][T16044] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3373'. [ 568.059598][T11758] legousbtower 4-1:14.57: interrupt endpoints not found [ 568.111247][T16045] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3373'. [ 568.447227][ T1230] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 568.470629][T11758] legousbtower 4-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 568.472945][T11758] legousbtower 4-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 568.596984][ T1230] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 568.600271][ T1230] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 568.600287][ T1230] usb 5-1: Product: syz [ 568.600296][ T1230] usb 5-1: Manufacturer: syz [ 568.600305][ T1230] usb 5-1: SerialNumber: syz [ 568.648345][ T1230] usb 5-1: config 0 descriptor?? [ 568.732509][T16062] syzkaller0: entered promiscuous mode [ 568.732525][T16062] syzkaller0: entered allmulticast mode [ 568.861585][ T1230] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 569.060373][T11758] usb 4-1: USB disconnect, device number 126 [ 569.060468][ C1] usb 4-1: tower_interrupt_in_callback: usb_submit_urb failed (-19) [ 569.099110][T11758] legousbtower 4-1:14.228: LEGO USB Tower #-160 now disconnected [ 569.392667][T16081] syzkaller0: entered promiscuous mode [ 569.392683][T16081] syzkaller0: entered allmulticast mode [ 569.414716][T16083] netlink: 'syz.1.3390': attribute type 1 has an invalid length. [ 569.453548][T16083] 8021q: adding VLAN 0 to HW filter on device bond1 [ 569.473718][T16083] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 569.491757][T16083] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3390'. [ 569.507608][ T1230] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 569.516639][T16083] bridge2: entered promiscuous mode [ 569.562810][T16083] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 569.720851][T16095] syzkaller0: entered promiscuous mode [ 569.720866][T16095] syzkaller0: entered allmulticast mode [ 569.913009][T16103] Driver unsupported XDP return value 0 on prog (id 84) dev N/A, expect packet loss! [ 569.992985][ T30] audit: type=1400 audit(2000000247.113:709): avc: denied { bind } for pid=16106 comm="syz.1.3400" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 570.028851][ T30] audit: type=1400 audit(2000000247.153:710): avc: denied { write } for pid=16106 comm="syz.1.3400" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 570.418118][T16131] netlink: 'syz.6.3409': attribute type 29 has an invalid length. [ 570.423385][T16130] syzkaller0: entered promiscuous mode [ 570.423399][T16130] syzkaller0: entered allmulticast mode [ 570.507883][ T1230] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 570.586444][T16138] 0x000000000000-0x000000010000 : "" [ 570.593000][T16138] ftl_cs: FTL header not found. [ 570.615124][T16138] FAULT_INJECTION: forcing a failure. [ 570.615124][T16138] name failslab, interval 1, probability 0, space 0, times 0 [ 570.615154][T16138] CPU: 1 UID: 0 PID: 16138 Comm: syz.1.3412 Tainted: G L syzkaller #0 PREEMPT(full) [ 570.615174][T16138] Tainted: [L]=SOFTLOCKUP [ 570.615179][T16138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 570.615188][T16138] Call Trace: [ 570.615193][T16138] [ 570.615199][T16138] dump_stack_lvl+0x100/0x190 [ 570.615222][T16138] should_fail_ex.cold+0x5/0xa [ 570.615241][T16138] should_failslab+0xc2/0x120 [ 570.615261][T16138] kmem_cache_alloc_noprof+0x92/0x6a0 [ 570.615278][T16138] ? __kernfs_new_node+0xd2/0xa10 [ 570.615296][T16138] __kernfs_new_node+0xd2/0xa10 [ 570.615313][T16138] ? __pfx___kernfs_new_node+0x10/0x10 [ 570.615329][T16138] ? lock_acquire+0x1d1/0x380 [ 570.615345][T16138] ? kernfs_root+0x23/0x2a0 [ 570.615358][T16138] ? find_held_lock+0x2b/0x80 [ 570.615377][T16138] ? kernfs_root+0xee/0x2a0 [ 570.615389][T16138] ? kernfs_root+0xee/0x2a0 [ 570.615405][T16138] kernfs_new_node+0x117/0x150 [ 570.615423][T16138] __kernfs_create_file+0x53/0x350 [ 570.615442][T16138] sysfs_add_file_mode_ns+0x207/0x3c0 [ 570.615465][T16138] internal_create_group+0x593/0xfb0 [ 570.615482][T16138] ? kernfs_create_dir_ns+0x16f/0x2b0 [ 570.615497][T16138] ? __pfx_internal_create_group+0x10/0x10 [ 570.615512][T16138] ? sysfs_create_dir_ns+0x14c/0x2b0 [ 570.615524][T16138] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 570.615536][T16138] ? sysfs_create_dir_ns+0x14c/0x2b0 [ 570.615550][T16138] internal_create_groups+0x9d/0x150 [ 570.615565][T16138] kobject_add_internal+0x317/0x930 [ 570.615583][T16138] kobject_add+0x16a/0x1e0 [ 570.615597][T16138] ? __pfx_kobject_add+0x10/0x10 [ 570.615612][T16138] ? __pfx_kobject_add+0x10/0x10 [ 570.615633][T16138] blk_register_queue+0x8d/0x630 [ 570.615653][T16138] __add_disk+0x7dd/0xf10 [ 570.615670][T16138] add_disk_fwnode+0x118/0x480 [ 570.615687][T16138] add_mtd_blktrans_dev+0xd0b/0x1520 [ 570.615709][T16138] ? __pfx_add_mtd_blktrans_dev+0x10/0x10 [ 570.615737][T16138] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 570.615751][T16138] ? mtdblock_add_mtd+0x4a/0x270 [ 570.615773][T16138] mtdblock_add_mtd+0x1cc/0x270 [ 570.615792][T16138] blktrans_notify_add+0xa2/0xf0 [ 570.615809][T16138] add_mtd_device+0xb6d/0x1820 [ 570.615825][T16138] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 570.615845][T16138] ? __pfx_add_mtd_device+0x10/0x10 [ 570.615863][T16138] mtd_add_partition+0x376/0x6a0 [ 570.615880][T16138] ? __pfx_mtd_add_partition+0x10/0x10 [ 570.615894][T16138] ? __might_fault+0xc5/0x140 [ 570.615907][T16138] ? __might_fault+0xc5/0x140 [ 570.615927][T16138] mtdchar_blkpg_ioctl+0x207/0x250 [ 570.615943][T16138] ? __pfx_mtdchar_blkpg_ioctl+0x10/0x10 [ 570.615974][T16138] mtdchar_ioctl+0x1670/0x1fd0 [ 570.615993][T16138] ? __pfx_mtdchar_ioctl+0x10/0x10 [ 570.616010][T16138] ? lock_acquire+0x1d1/0x380 [ 570.616024][T16138] ? mtdchar_unlocked_ioctl+0xa2/0xf0 [ 570.616044][T16138] ? rcu_is_watching+0x13/0xc0 [ 570.616062][T16138] ? trace_contention_end+0x126/0x160 [ 570.616080][T16138] ? mtdchar_unlocked_ioctl+0xa2/0xf0 [ 570.616099][T16138] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 570.616123][T16138] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 570.616153][T16138] ? __pfx___mutex_lock+0x10/0x10 [ 570.616173][T16138] ? __fget_files+0x34/0x3d0 [ 570.616201][T16138] mtdchar_unlocked_ioctl+0xb0/0xf0 [ 570.616217][T16138] ? __pfx_mtdchar_unlocked_ioctl+0x10/0x10 [ 570.616234][T16138] __x64_sys_ioctl+0x18e/0x210 [ 570.616251][T16138] do_syscall_64+0x123/0x790 [ 570.616270][T16138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 570.616284][T16138] RIP: 0033:0x7f624679e559 [ 570.616295][T16138] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 570.616307][T16138] RSP: 002b:00007f62476a4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 570.616319][T16138] RAX: ffffffffffffffda RBX: 00007f6246a25fa0 RCX: 00007f624679e559 [ 570.616328][T16138] RDX: 0000200000000a80 RSI: 0000000000001269 RDI: 0000000000000007 [ 570.616336][T16138] RBP: 00007f6246835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 570.616344][T16138] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 570.616352][T16138] R13: 00007f6246a26038 R14: 00007f6246a25fa0 R15: 00007ffe508ab5e8 [ 570.616370][T16138] [ 570.658660][ T1230] usb 8-1: Using ep0 maxpacket: 32 [ 570.677038][ T1230] usb 8-1: unable to get BOS descriptor or descriptor too short [ 570.677067][ T1230] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 570.706404][ T1230] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 570.706421][ T1230] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 570.706433][ T1230] usb 8-1: config 14 has no interface number 0 [ 570.706443][ T1230] usb 8-1: config 14 has no interface number 1 [ 570.706476][ T1230] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 570.706490][ T1230] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 570.706505][ T1230] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 570.706520][ T1230] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 570.706535][ T1230] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 570.706551][ T1230] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 570.706567][ T1230] usb 8-1: config 14 interface 57 has no altsetting 0 [ 570.706578][ T1230] usb 8-1: config 14 interface 228 has no altsetting 0 [ 570.972870][ T1230] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.972887][ T1230] usb 8-1: Product: syz [ 570.972897][ T1230] usb 8-1: Manufacturer: syz [ 570.972906][ T1230] usb 8-1: SerialNumber: syz [ 571.349352][T16138] kobject: kobject_add_internal failed for queue (error: -12 parent: mtdblock3) [ 571.512136][T11758] usb 5-1: USB disconnect, device number 4 [ 571.698482][ T1230] legousbtower 8-1:14.57: interrupt endpoints not found [ 571.897114][T16160] ip_tables: iptables: counters copy to user failed while replacing table [ 571.986978][ T30] audit: type=1400 audit(2000000249.113:711): avc: denied { listen } for pid=16164 comm="syz.1.3425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 572.103130][ T1230] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 572.104141][ T1230] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 572.146445][T11758] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 572.295507][T11758] usb 7-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 572.296367][T11758] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 572.296392][T11758] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 572.296406][T11758] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 572.296420][T11758] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 572.296445][T11758] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 572.327755][ T5606] usb 2-1: new full-speed USB device number 107 using dummy_hcd [ 572.526578][ T5606] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 572.529079][ T5606] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 572.529096][ T5606] usb 2-1: Product: syz [ 572.529105][ T5606] usb 2-1: Manufacturer: syz [ 572.529114][ T5606] usb 2-1: SerialNumber: syz [ 572.554812][ T5606] usb 2-1: config 0 descriptor?? [ 572.601587][T16184] block nbd0: not configured, cannot reconfigure [ 572.669871][ T1230] usb 8-1: USB disconnect, device number 7 [ 572.669965][ C1] usb 8-1: tower_interrupt_in_callback: usb_submit_urb failed (-19) [ 572.700710][ T1230] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 572.780252][ T5606] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 572.985688][ T5710] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 572.987717][T16191] syzkaller0: entered promiscuous mode [ 572.987732][T16191] syzkaller0: entered allmulticast mode [ 573.135296][ T5710] usb 5-1: Using ep0 maxpacket: 32 [ 573.141774][ T5710] usb 5-1: New USB device found, idVendor=044e, idProduct=120b, bcdDevice= 0.00 [ 573.143190][ T5710] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 573.143223][ T5710] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 573.143289][ T5710] usb 5-1: config 0 interface 0 has no altsetting 0 [ 573.143323][ T5710] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 573.221250][ T5710] usb 5-1: config 0 descriptor?? [ 573.327468][ C1] raw-gadget.1 gadget.6: ignoring, device is not running [ 573.327594][T11758] gud 7-1:1.0: USB-1: Failed to add properties (ret=-32) [ 573.327620][T11758] gud 7-1:1.0: Failed to get connectors (error=-32) [ 573.327636][T11758] gud 7-1:1.0: probe with driver gud failed with error -32 [ 573.385798][T11758] usb 7-1: USB disconnect, device number 2 [ 573.413034][ T5606] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 573.580007][ T30] audit: type=1400 audit(2000000250.704:712): avc: denied { setopt } for pid=16198 comm="syz.7.3441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 574.155376][T16217] syzkaller0: entered promiscuous mode [ 574.155394][T16217] syzkaller0: entered allmulticast mode [ 574.372481][ T30] audit: type=1400 audit(2000000251.494:713): avc: denied { write } for pid=16227 comm="syz.6.3453" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 574.531756][T16239] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 574.557458][T16238] FAULT_INJECTION: forcing a failure. [ 574.557458][T16238] name failslab, interval 1, probability 0, space 0, times 0 [ 574.557486][T16238] CPU: 1 UID: 0 PID: 16238 Comm: syz.3.3457 Tainted: G L syzkaller #0 PREEMPT(full) [ 574.557506][T16238] Tainted: [L]=SOFTLOCKUP [ 574.557511][T16238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 574.557520][T16238] Call Trace: [ 574.557525][T16238] [ 574.557532][T16238] dump_stack_lvl+0x100/0x190 [ 574.557558][T16238] should_fail_ex.cold+0x5/0xa [ 574.557577][T16238] should_failslab+0xc2/0x120 [ 574.557597][T16238] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 574.557616][T16238] ? sock_alloc_inode+0x26/0x2c0 [ 574.557633][T16238] ? __pfx_sock_alloc_inode+0x10/0x10 [ 574.557649][T16238] sock_alloc_inode+0x26/0x2c0 [ 574.557663][T16238] ? __pfx_sock_alloc_inode+0x10/0x10 [ 574.557678][T16238] alloc_inode+0x68/0x250 [ 574.557693][T16238] sock_alloc+0x44/0x280 [ 574.557707][T16238] ? security_socket_create+0x7f/0x250 [ 574.557724][T16238] __sock_create+0xc2/0x860 [ 574.557743][T16238] __sys_socket+0x14d/0x260 [ 574.557760][T16238] ? __pfx___sys_socket+0x10/0x10 [ 574.557783][T16238] __x64_sys_socket+0x72/0xb0 [ 574.557801][T16238] ? lockdep_hardirqs_on+0x7d/0x110 [ 574.557820][T16238] do_syscall_64+0x123/0x790 [ 574.557839][T16238] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 574.557853][T16238] RIP: 0033:0x7f3beaf9e559 [ 574.557871][T16238] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 574.557885][T16238] RSP: 002b:00007f3bebf43028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 574.557898][T16238] RAX: ffffffffffffffda RBX: 00007f3beb225fa0 RCX: 00007f3beaf9e559 [ 574.557908][T16238] RDX: 000000000000000c RSI: 0000000000000003 RDI: 0000000000000010 [ 574.557916][T16238] RBP: 00007f3beb035ad8 R08: 0000000000000000 R09: 0000000000000000 [ 574.557924][T16238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 574.557932][T16238] R13: 00007f3beb226038 R14: 00007f3beb225fa0 R15: 00007fff1203a958 [ 574.557951][T16238] [ 574.557983][T16238] socket: no more sockets [ 574.883637][T16244] netlink: 72 bytes leftover after parsing attributes in process `syz.7.3460'. [ 574.902426][T16242] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3459'. [ 575.079974][T16251] syzkaller0: entered promiscuous mode [ 575.079991][T16251] syzkaller0: entered allmulticast mode [ 575.146110][T11758] usb 2-1: USB disconnect, device number 107 [ 575.626295][ T5710] hid-alps 0003:044E:120B.0022: failed read register (-32) [ 575.626345][ T5710] hid-alps 0003:044E:120B.0022: failed U1_PITCH_SENS_X (-32) [ 575.631004][ T5710] hid-alps 0003:044E:120B.0022: hidraw0: USB HID v80.00 Joystick [HID 044e:120b] on usb-dummy_hcd.4-1/input0 [ 575.670067][ T5710] usb 5-1: USB disconnect, device number 5 [ 575.831628][T16273] fido_id[16273]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 575.948453][ T30] audit: type=1400 audit(2000000253.074:714): avc: denied { remount } for pid=16275 comm="syz.1.3472" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 576.099332][T16281] binder: 16279:16281 ioctl c0306201 200000000100 returned -14 [ 576.115954][T16281] binder: 16279:16281 ioctl c0306201 200000000200 returned -14 [ 576.341892][T16290] syzkaller0: entered promiscuous mode [ 576.341909][T16290] syzkaller0: entered allmulticast mode [ 576.534824][T11758] usb 2-1: new full-speed USB device number 108 using dummy_hcd [ 576.686779][T11758] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 576.693498][T11758] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.693517][T11758] usb 2-1: Product: syz [ 576.693526][T11758] usb 2-1: Manufacturer: syz [ 576.693536][T11758] usb 2-1: SerialNumber: syz [ 576.765588][T11758] usb 2-1: config 0 descriptor?? [ 576.783788][ T5601] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 576.794518][ T5601] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 576.804055][ T5601] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 576.816174][ T5601] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 576.816604][ T5601] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 576.981749][T11758] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 577.261058][T16313] binder: 16312:16313 ioctl c0306201 200000000100 returned -14 [ 577.264333][T16313] binder: 16312:16313 ioctl c0306201 200000000200 returned -14 [ 577.557328][T16299] rxe_eth0 speed is unknown, defaulting to 1000 [ 577.624562][T11758] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 577.635247][ T5811] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 577.635325][ T5710] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 577.762859][T16299] vcan0 speed is unknown, defaulting to 1000 [ 577.784756][ T5710] usb 7-1: Using ep0 maxpacket: 32 [ 577.785375][ T5811] usb 5-1: Using ep0 maxpacket: 32 [ 577.785513][ T5710] usb 7-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 577.786439][ T5710] usb 7-1: config 0 has an invalid interface number: 184 but max is 0 [ 577.786455][ T5710] usb 7-1: config 0 has no interface number 0 [ 577.786477][ T5710] usb 7-1: config 0 interface 184 has no altsetting 0 [ 577.787309][ T5811] usb 5-1: unable to get BOS descriptor or descriptor too short [ 577.787363][ T5811] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 577.788283][ T5710] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.788297][ T5710] usb 7-1: Product: syz [ 577.788306][ T5710] usb 7-1: Manufacturer: syz [ 577.788316][ T5710] usb 7-1: SerialNumber: syz [ 577.788411][ T5811] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 577.788424][ T5811] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 577.788436][ T5811] usb 5-1: config 14 has no interface number 0 [ 577.788446][ T5811] usb 5-1: config 14 has no interface number 1 [ 577.788483][ T5811] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 577.788498][ T5811] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 577.788512][ T5811] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 577.788528][ T5811] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 577.788544][ T5811] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 577.788560][ T5811] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 577.788576][ T5811] usb 5-1: config 14 interface 57 has no altsetting 0 [ 577.788587][ T5811] usb 5-1: config 14 interface 228 has no altsetting 0 [ 577.793037][ T5811] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.793052][ T5811] usb 5-1: Product: syz [ 577.793061][ T5811] usb 5-1: Manufacturer: syz [ 577.793070][ T5811] usb 5-1: SerialNumber: syz [ 577.794520][ T5710] usb 7-1: config 0 descriptor?? [ 578.084214][T16329] pimreg: entered allmulticast mode [ 578.109996][T16328] pimreg: left allmulticast mode [ 578.460788][ T5811] legousbtower 5-1:14.57: interrupt endpoints not found [ 578.523941][ T5710] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 578.523963][ T5710] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 578.582429][T16299] bridge0: port 1(bridge_slave_0) entered blocking state [ 578.582536][T16299] bridge0: port 1(bridge_slave_0) entered disabled state [ 578.582641][T16299] bridge_slave_0: entered allmulticast mode [ 578.607851][T16299] bridge_slave_0: entered promiscuous mode [ 578.619017][T16299] bridge0: port 2(bridge_slave_1) entered blocking state [ 578.619068][T16299] bridge0: port 2(bridge_slave_1) entered disabled state [ 578.619157][T16299] bridge_slave_1: entered allmulticast mode [ 578.620864][T16299] bridge_slave_1: entered promiscuous mode [ 578.691574][T16299] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 578.709782][T16299] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 578.774247][T16299] team0: Port device team_slave_0 added [ 578.784047][T16299] team0: Port device team_slave_1 added [ 578.833966][T16299] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 578.833981][T16299] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 578.833996][T16299] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 578.887933][T16299] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 578.887963][T16299] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 578.887979][T16299] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 578.890699][ T5811] legousbtower 5-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 578.891991][ T5811] legousbtower 5-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 578.929203][T14237] Bluetooth: hci4: command tx timeout [ 579.028411][T16299] hsr_slave_0: entered promiscuous mode [ 579.029066][T16299] hsr_slave_1: entered promiscuous mode [ 579.029508][T16299] debugfs: 'hsr0' already exists in 'hsr' [ 579.029521][T16299] Cannot create hsr debugfs directory [ 579.200689][T16299] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.270874][T11758] usb 2-1: USB disconnect, device number 108 [ 579.380400][ T5710] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 579.380422][ T5710] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 579.380435][ T5710] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 579.380567][ T5710] smsc75xx 7-1:0.184: probe with driver smsc75xx failed with error -32 [ 579.442578][T16299] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.479098][ T5710] usb 5-1: USB disconnect, device number 6 [ 579.479209][ C1] usb 5-1: tower_interrupt_in_callback: usb_submit_urb failed (-19) [ 579.521248][ T5710] legousbtower 5-1:14.228: LEGO USB Tower #-160 now disconnected [ 579.563815][T16354] Bluetooth: MGMT ver 1.23 [ 579.609188][T16299] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.740105][T16299] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.780990][T16361] syzkaller0: entered promiscuous mode [ 579.781007][T16361] syzkaller0: entered allmulticast mode [ 580.052086][T16299] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 580.066520][T16299] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 580.067081][T16299] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 580.073975][T16299] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 580.099163][T16299] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 580.116390][T16299] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 580.117522][T16299] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 580.123829][T16299] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 580.273637][T16299] 8021q: adding VLAN 0 to HW filter on device bond0 [ 580.300238][T16299] 8021q: adding VLAN 0 to HW filter on device team0 [ 580.319475][T11757] bridge0: port 1(bridge_slave_0) entered blocking state [ 580.319531][T11757] bridge0: port 1(bridge_slave_0) entered forwarding state [ 580.348650][T11757] bridge0: port 2(bridge_slave_1) entered blocking state [ 580.348705][T11757] bridge0: port 2(bridge_slave_1) entered forwarding state [ 580.450825][T11758] usb 7-1: USB disconnect, device number 3 [ 580.474593][ T5811] usb 2-1: new full-speed USB device number 109 using dummy_hcd [ 580.627074][ T5811] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 580.632167][ T5811] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 580.632185][ T5811] usb 2-1: Product: syz [ 580.632194][ T5811] usb 2-1: Manufacturer: syz [ 580.632203][ T5811] usb 2-1: SerialNumber: syz [ 580.667138][ T5811] usb 2-1: config 0 descriptor?? [ 580.898075][ T5811] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 580.945006][T16404] fuseblk: Bad value for 'fd' [ 580.986790][ T5601] Bluetooth: hci4: command tx timeout [ 581.095597][ T1230] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 581.173434][T16299] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 581.203199][T16414] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=16414 comm=syz.7.3515 [ 581.203219][T16414] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=16414 comm=syz.7.3515 [ 581.255769][ T1230] usb 5-1: Using ep0 maxpacket: 32 [ 581.256207][ T1230] usb 5-1: New USB device found, idVendor=044e, idProduct=120b, bcdDevice= 0.00 [ 581.257407][ T1230] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 581.257432][ T1230] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 581.257462][ T1230] usb 5-1: config 0 interface 0 has no altsetting 0 [ 581.257481][ T1230] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 581.271740][ T1230] usb 5-1: config 0 descriptor?? [ 581.354441][T16299] veth0_vlan: entered promiscuous mode [ 581.383523][T16299] veth1_vlan: entered promiscuous mode [ 581.458179][T16299] veth0_macvtap: entered promiscuous mode [ 581.488835][T16299] veth1_macvtap: entered promiscuous mode [ 581.548113][ T5811] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 581.571660][T16299] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 581.588871][T16299] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 581.612177][T11757] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.612329][T11757] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.625259][ T5601] Bluetooth: hci2: command 0x0401 tx timeout [ 581.625384][T14237] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 581.627958][T15872] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.628141][T15872] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.765072][T11758] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 581.847792][T11757] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 581.847804][T11757] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 581.914165][T15868] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 581.914180][T15868] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 581.932463][T11758] usb 7-1: Using ep0 maxpacket: 32 [ 581.938872][T11758] usb 7-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 581.953146][T11758] usb 7-1: config 0 has an invalid interface number: 184 but max is 0 [ 581.953165][T11758] usb 7-1: config 0 has no interface number 0 [ 581.953203][T11758] usb 7-1: config 0 interface 184 has no altsetting 0 [ 581.987680][T11758] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 581.987697][T11758] usb 7-1: Product: syz [ 581.987706][T11758] usb 7-1: Manufacturer: syz [ 581.987716][T11758] usb 7-1: SerialNumber: syz [ 581.994247][T11758] usb 7-1: config 0 descriptor?? [ 582.083477][T16425] xt_hashlimit: size too large, truncated to 1048576 [ 582.329570][T16434] syzkaller0: entered promiscuous mode [ 582.329604][T16434] syzkaller0: entered allmulticast mode [ 582.609628][T11758] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 582.609651][T11758] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 582.743917][T16447] syzkaller0: entered promiscuous mode [ 582.743933][T16447] syzkaller0: entered allmulticast mode [ 582.765644][T16447] tipc: Started in network mode [ 582.765664][T16447] tipc: Node identity 1a09de3c97ec, cluster identity 4711 [ 582.766096][T16447] tipc: Enabled bearer , priority 0 [ 582.767481][T16446] tipc: Resetting bearer [ 582.811190][T16446] tipc: Disabling bearer [ 583.064890][T14237] Bluetooth: hci4: command tx timeout [ 583.275864][ T5606] usb 2-1: USB disconnect, device number 109 [ 583.414071][T11758] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 583.414093][T11758] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 583.414106][T11758] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 583.414272][T11758] smsc75xx 7-1:0.184: probe with driver smsc75xx failed with error -61 [ 583.612121][ T1230] hid-alps 0003:044E:120B.0023: failed read register (-32) [ 583.612170][ T1230] hid-alps 0003:044E:120B.0023: failed U1_PITCH_SENS_X (-32) [ 583.651860][ T1230] hid-alps 0003:044E:120B.0023: hidraw0: USB HID v80.00 Joystick [HID 044e:120b] on usb-dummy_hcd.4-1/input0 [ 583.675919][ T1230] usb 5-1: USB disconnect, device number 7 [ 583.811180][T16474] fido_id[16474]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 583.927718][T16478] syzkaller0: entered promiscuous mode [ 583.927734][T16478] syzkaller0: entered allmulticast mode [ 584.063738][T16485] syzkaller0: entered promiscuous mode [ 584.063753][T16485] syzkaller0: entered allmulticast mode [ 584.349332][ T30] audit: type=1400 audit(2000000261.474:715): avc: denied { setopt } for pid=16496 comm="syz.3.3548" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 584.434404][ T1230] usb 2-1: new full-speed USB device number 110 using dummy_hcd [ 584.592418][ T1230] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 584.609550][ T1230] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 584.609569][ T1230] usb 2-1: Product: syz [ 584.609578][ T1230] usb 2-1: Manufacturer: syz [ 584.609587][ T1230] usb 2-1: SerialNumber: syz [ 584.611308][ T1230] usb 2-1: config 0 descriptor?? [ 584.681629][T16514] ipvlan2: entered promiscuous mode [ 584.711577][ T5710] usb 7-1: USB disconnect, device number 4 [ 584.749138][T16514] team0: Device ipvlan2 failed to register rx_handler [ 584.845717][ T1230] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 584.846669][T16519] binder: 16516:16519 ioctl c0306201 0 returned -14 [ 584.873081][T16519] binder: 16516:16519 ioctl c0306201 200000000200 returned -14 [ 585.067714][ T30] audit: type=1400 audit(2000000262.194:716): avc: denied { write } for pid=16500 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 585.099637][T16526] syzkaller0: entered promiscuous mode [ 585.099652][T16526] syzkaller0: entered allmulticast mode [ 585.147038][T14237] Bluetooth: hci4: command tx timeout [ 585.321789][ T30] audit: type=1400 audit(2000000262.444:717): avc: denied { write } for pid=16533 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 585.432912][T16538] syzkaller0: entered promiscuous mode [ 585.432941][T16538] syzkaller0: entered allmulticast mode [ 585.686669][T16548] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3565'. [ 585.797893][T16551] syzkaller0: entered promiscuous mode [ 585.797909][T16551] syzkaller0: entered allmulticast mode [ 585.851571][T16556] binder: 16554:16556 ioctl c0306201 200000000200 returned -14 [ 585.872688][ T1230] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 586.263612][ T30] audit: type=1400 audit(2000000263.384:718): avc: denied { write } for pid=16544 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 586.509276][ T30] audit: type=1400 audit(2000000263.634:719): avc: denied { write } for pid=16581 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 586.621305][T16586] syzkaller0: entered promiscuous mode [ 586.621321][T16586] syzkaller0: entered allmulticast mode [ 586.624529][ T1230] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 586.788034][ T1230] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 586.791957][ T1230] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 586.815137][ T1230] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 586.815154][ T1230] usb 5-1: Product: syz [ 586.815164][ T1230] usb 5-1: Manufacturer: syz [ 586.815173][ T1230] usb 5-1: SerialNumber: syz [ 586.844816][ T1230] usb 5-1: config 0 descriptor?? [ 586.900527][T16597] binder: 16596:16597 ioctl c0306201 200000000200 returned -14 [ 587.248152][ T30] audit: type=1400 audit(2000000264.374:720): avc: denied { write } for pid=16589 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 587.284494][ T1230] usb 2-1: USB disconnect, device number 110 [ 587.448968][T16616] 0x000000000000-0x000000010000 : "" [ 587.460702][T16616] ftl_cs: FTL header not found. [ 587.587919][ T30] audit: type=1400 audit(2000000264.714:721): avc: denied { write } for pid=16619 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 587.760676][T16626] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3586'. [ 587.760696][T16626] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3586'. [ 588.078695][ T30] audit: type=1400 audit(2000000265.204:722): avc: denied { map } for pid=16632 comm="syz.7.3589" path="socket:[63493]" dev="sockfs" ino=63493 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 588.128960][T16638] binder: 16637:16638 ioctl c0306201 200000000200 returned -14 [ 588.267114][T16647] syzkaller0: entered promiscuous mode [ 588.267130][T16647] syzkaller0: entered allmulticast mode [ 588.429895][ T30] audit: type=1400 audit(2000000265.554:723): avc: denied { connect } for pid=16653 comm="syz.1.3595" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 588.458348][ T30] audit: type=1400 audit(2000000265.584:724): avc: denied { write } for pid=16653 comm="syz.1.3595" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 588.512705][T16654] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3595'. [ 588.532959][T16654] syzkaller0: entered promiscuous mode [ 588.532974][T16654] syzkaller0: entered allmulticast mode [ 588.749833][T16663] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 588.811390][T16667] syzkaller0: entered promiscuous mode [ 588.811406][T16667] syzkaller0: entered allmulticast mode [ 588.910617][T16670] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3601'. [ 588.932555][T16672] binder: 16669:16672 ioctl c0306201 200000000200 returned -14 [ 589.054922][T16677] 9pnet_fd: Insufficient options for proto=fd [ 589.096945][T16680] syzkaller0: entered promiscuous mode [ 589.096960][T16680] syzkaller0: entered allmulticast mode [ 589.360814][T16691] netlink: 56 bytes leftover after parsing attributes in process `syz.6.3609'. [ 589.363562][T16691] syzkaller0: entered promiscuous mode [ 589.363576][T16691] syzkaller0: entered allmulticast mode [ 589.407890][T16693] 0x000000000000-0x000000010000 : "" [ 589.458004][T16693] ftl_cs: FTL header not found. [ 589.478260][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 589.478278][ T30] audit: type=1400 audit(2000000266.594:727): avc: denied { connect } for pid=16684 comm="syz.7.3608" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 589.599234][ T1230] usb 5-1: USB disconnect, device number 8 [ 589.834199][T16702] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3613'. [ 589.842052][T16702] syzkaller0: entered promiscuous mode [ 589.842067][T16702] syzkaller0: entered allmulticast mode [ 589.868631][T16704] syzkaller0: entered promiscuous mode [ 589.868646][T16704] syzkaller0: entered allmulticast mode [ 589.902092][T16709] binder: 16706:16709 ioctl c0306201 200000000200 returned -14 [ 590.287954][T16710] syzkaller0: entered promiscuous mode [ 590.287970][T16710] syzkaller0: entered allmulticast mode [ 592.530388][T16715] pimreg: entered allmulticast mode [ 592.542370][T16731] syzkaller0: entered promiscuous mode [ 592.542385][T16731] syzkaller0: entered allmulticast mode [ 592.596952][T16715] pimreg: left allmulticast mode [ 592.812062][ T30] audit: type=1400 audit(2000000269.925:728): avc: denied { name_bind } for pid=16748 comm="syz.4.3623" src=128 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 593.171261][T16766] syzkaller0: entered promiscuous mode [ 593.171277][T16766] syzkaller0: entered allmulticast mode [ 593.197683][T16769] syzkaller0: entered promiscuous mode [ 593.197698][T16769] syzkaller0: entered allmulticast mode [ 593.537248][T16789] FAULT_INJECTION: forcing a failure. [ 593.537248][T16789] name fail_futex, interval 1, probability 0, space 0, times 0 [ 593.537272][T16789] CPU: 1 UID: 0 PID: 16789 Comm: syz.3.3640 Tainted: G L syzkaller #0 PREEMPT(full) [ 593.537290][T16789] Tainted: [L]=SOFTLOCKUP [ 593.537294][T16789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 593.537302][T16789] Call Trace: [ 593.537306][T16789] [ 593.537311][T16789] dump_stack_lvl+0x100/0x190 [ 593.537334][T16789] should_fail_ex.cold+0x5/0xa [ 593.537352][T16789] get_futex_key+0xf62/0x13e0 [ 593.537371][T16789] ? __pfx_get_futex_key+0x10/0x10 [ 593.537387][T16789] ? __mutex_unlock_slowpath+0x35d/0x930 [ 593.537409][T16789] futex_wake+0xf4/0x5e0 [ 593.537430][T16789] ? __pfx_futex_wake+0x10/0x10 [ 593.537445][T16789] ? lock_acquire+0x1d1/0x380 [ 593.537459][T16789] ? detach_task_ctx_data+0x83/0x490 [ 593.537475][T16789] do_futex+0x2b2/0x440 [ 593.537494][T16789] ? __pfx_do_futex+0x10/0x10 [ 593.537509][T16789] ? __might_fault+0xc5/0x140 [ 593.537526][T16789] mm_exit_exec_release+0x256/0x2f0 [ 593.537541][T16789] do_exit+0x707/0x2a60 [ 593.537556][T16789] ? lock_acquire+0x1d1/0x380 [ 593.537568][T16789] ? cgroup1_freezing+0x27/0x3b0 [ 593.537582][T16789] ? find_held_lock+0x2b/0x80 [ 593.537600][T16789] ? __pfx_do_exit+0x10/0x10 [ 593.537616][T16789] ? find_held_lock+0x2b/0x80 [ 593.537633][T16789] ? get_signal+0x7e0/0x21e0 [ 593.537648][T16789] do_group_exit+0xd5/0x2a0 [ 593.537665][T16789] get_signal+0x1ec7/0x21e0 [ 593.537682][T16789] ? find_held_lock+0x2b/0x80 [ 593.537702][T16789] ? __pfx_get_signal+0x10/0x10 [ 593.537716][T16789] ? do_futex+0x190/0x440 [ 593.537734][T16789] arch_do_signal_or_restart+0x91/0x7e0 [ 593.537754][T16789] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 593.537780][T16789] exit_to_user_mode_loop+0x139/0x700 [ 593.537796][T16789] ? rcu_is_watching+0x13/0xc0 [ 593.537815][T16789] do_syscall_64+0x661/0x790 [ 593.537834][T16789] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.537847][T16789] RIP: 0033:0x7fd4c339e559 [ 593.537858][T16789] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 593.537869][T16789] RSP: 002b:00007fd4c42460e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 593.537881][T16789] RAX: fffffffffffffe00 RBX: 00007fd4c3625fa8 RCX: 00007fd4c339e559 [ 593.537889][T16789] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fd4c3625fa8 [ 593.537896][T16789] RBP: 00007fd4c3625fa0 R08: 0000000000000000 R09: 0000000000000000 [ 593.537903][T16789] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 593.537910][T16789] R13: 00007fd4c3626038 R14: 00007ffedbe8e770 R15: 00007ffedbe8e858 [ 593.537927][T16789] [ 594.229043][T16805] ipvlan2: entered promiscuous mode [ 594.233814][ T1230] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 594.347739][T16807] syzkaller0: entered promiscuous mode [ 594.347755][T16807] syzkaller0: entered allmulticast mode [ 594.383852][ T1230] usb 4-1: Using ep0 maxpacket: 32 [ 594.389729][ T1230] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 594.390954][ T1230] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 594.390971][ T1230] usb 4-1: config 0 has no interface number 0 [ 594.390995][ T1230] usb 4-1: config 0 interface 184 has no altsetting 0 [ 594.392555][ T1230] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 594.392571][ T1230] usb 4-1: Product: syz [ 594.392580][ T1230] usb 4-1: Manufacturer: syz [ 594.392589][ T1230] usb 4-1: SerialNumber: syz [ 594.451263][ T1230] usb 4-1: config 0 descriptor?? [ 594.786430][T16814] syzkaller0: entered promiscuous mode [ 594.786446][T16814] syzkaller0: entered allmulticast mode [ 594.940135][T16819] TC_ACT_REPEAT abuse ? [ 595.082177][ T1230] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 595.082199][ T1230] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 595.235052][T16831] netlink: 'syz.7.3659': attribute type 1 has an invalid length. [ 595.235068][T16831] netlink: 224 bytes leftover after parsing attributes in process `syz.7.3659'. [ 595.235087][T16831] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3659'. [ 595.482128][T16842] syzkaller0: entered promiscuous mode [ 595.482143][T16842] syzkaller0: entered allmulticast mode [ 595.557968][T16844] syzkaller0: entered promiscuous mode [ 595.557984][T16844] syzkaller0: entered allmulticast mode [ 595.912454][ T1230] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 595.912476][ T1230] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 595.912489][ T1230] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 595.912613][ T1230] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -61 [ 596.310828][T16847] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3666'. [ 596.487258][T16858] fuse: Bad value for 'fd' [ 596.623952][ T5710] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 596.773992][ T5710] usb 8-1: Using ep0 maxpacket: 32 [ 596.775446][ T5710] usb 8-1: unable to get BOS descriptor or descriptor too short [ 596.775472][ T5710] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 596.776272][ T5710] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 596.776288][ T5710] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 596.776300][ T5710] usb 8-1: config 14 has no interface number 0 [ 596.776310][ T5710] usb 8-1: config 14 has no interface number 1 [ 596.776342][ T5710] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 596.776355][ T5710] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 596.776369][ T5710] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 596.776384][ T5710] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 596.776400][ T5710] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 596.776416][ T5710] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 596.776446][ T5710] usb 8-1: config 14 interface 57 has no altsetting 0 [ 596.776457][ T5710] usb 8-1: config 14 interface 228 has no altsetting 0 [ 596.778367][ T5710] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 596.778383][ T5710] usb 8-1: Product: syz [ 596.778392][ T5710] usb 8-1: Manufacturer: syz [ 596.778401][ T5710] usb 8-1: SerialNumber: syz [ 597.159893][T16890] batman_adv: batadv0: Adding interface: syzkaller0 [ 597.159906][T16890] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 597.159924][T16890] batman_adv: batadv0: Interface activated: syzkaller0 [ 597.162880][T16889] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 597.225561][ T5710] legousbtower 8-1:14.57: interrupt endpoints not found [ 597.257165][ T1230] usb 4-1: USB disconnect, device number 127 [ 597.277557][T16889] batman_adv: batadv0: Removing interface: syzkaller0 [ 597.492932][T16898] 0x000000000000-0x000000010000 : "" [ 597.511165][T16898] ftl_cs: FTL header not found. [ 597.643161][ T5710] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 597.654783][ T5710] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 597.849543][T16910] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3692'. [ 597.968322][T16912] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3693'. [ 597.989298][T16914] syzkaller0: entered promiscuous mode [ 597.989311][T16914] syzkaller0: entered allmulticast mode [ 598.208091][T11983] usb 8-1: USB disconnect, device number 8 [ 598.208124][ C1] usb 8-1: tower_interrupt_in_callback: usb_submit_urb failed (-19) [ 598.211807][T11983] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 598.448374][T16931] device-mapper: ioctl: Invalid data size in the ioctl structure: 3518044984 [ 598.472639][T16931] device-mapper: ioctl: Invalid ioctl structure: name U, dev 42744cd223460000 [ 598.869217][T16952] binder: 16951:16952 ioctl c0306201 200000000100 returned -14 [ 598.896297][T16952] binder: 16951:16952 ioctl c0306201 200000000200 returned -14 [ 599.382952][T16971] device-mapper: ioctl: Invalid data size in the ioctl structure: 3518044984 [ 599.403738][T16971] device-mapper: ioctl: Invalid ioctl structure: name U, dev 42744cd223460000 [ 599.445338][ T30] audit: type=1400 audit(2000000276.565:729): avc: denied { write } for pid=16947 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 599.547541][T16983] 0x000000000000-0x000000010000 : "" [ 599.561497][T16983] ftl_cs: FTL header not found. [ 599.810146][ T30] audit: type=1400 audit(2000000276.925:730): avc: denied { write } for pid=16988 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 600.083706][T11983] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 600.235579][T11983] usb 8-1: Using ep0 maxpacket: 32 [ 600.237192][T11983] usb 8-1: unable to get BOS descriptor or descriptor too short [ 600.237218][T11983] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 600.237960][T11983] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 600.237975][T11983] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 600.237987][T11983] usb 8-1: config 14 has no interface number 0 [ 600.237998][T11983] usb 8-1: config 14 has no interface number 1 [ 600.238029][T11983] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 600.238043][T11983] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 600.238057][T11983] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 600.238073][T11983] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 600.238088][T11983] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 600.238104][T11983] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 600.238120][T11983] usb 8-1: config 14 interface 57 has no altsetting 0 [ 600.238130][T11983] usb 8-1: config 14 interface 228 has no altsetting 0 [ 600.239599][T11983] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 600.239614][T11983] usb 8-1: Product: syz [ 600.239623][T11983] usb 8-1: Manufacturer: syz [ 600.239632][T11983] usb 8-1: SerialNumber: syz [ 600.474385][T17012] syzkaller0: entered promiscuous mode [ 600.474399][T17012] syzkaller0: entered allmulticast mode [ 600.501260][T17012] tipc: Started in network mode [ 600.501276][T17012] tipc: Node identity be81590cf1f5, cluster identity 4711 [ 600.520375][T17012] tipc: Enabled bearer , priority 0 [ 600.538352][T17012] tipc: Resetting bearer [ 600.550540][T17011] tipc: Resetting bearer [ 600.572362][T17011] tipc: Disabling bearer [ 600.596440][T17014] device-mapper: ioctl: Invalid data size in the ioctl structure: 3506438456 [ 600.597484][T17014] device-mapper: ioctl: Invalid ioctl structure: name U, dev 42744cd223460000 [ 600.815409][T17024] ip_tables: iptables: counters copy to user failed while replacing table [ 600.836135][T11983] legousbtower 8-1:14.57: interrupt endpoints not found [ 600.842478][T17025] IPVS: set_ctl: invalid protocol: 135 0.0.0.0:20000 [ 601.245439][T11983] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 601.246598][T11983] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 601.566494][T17046] device-mapper: ioctl: Invalid data size in the ioctl structure: 3506438456 [ 601.566765][T17046] device-mapper: ioctl: Invalid ioctl structure: name U, dev 42744cd223460000 [ 601.734717][T17049] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3742'. [ 601.739539][T17049] syzkaller0: entered promiscuous mode [ 601.739551][T17049] syzkaller0: entered allmulticast mode [ 601.802032][T11983] usb 8-1: USB disconnect, device number 9 [ 601.802104][ C1] usb 8-1: tower_interrupt_in_callback: usb_submit_urb failed (-19) [ 601.805739][T11983] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 601.933440][ T1230] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 602.022093][T17062] FAULT_INJECTION: forcing a failure. [ 602.022093][T17062] name fail_futex, interval 1, probability 0, space 0, times 0 [ 602.022117][T17062] CPU: 1 UID: 0 PID: 17062 Comm: syz.4.3748 Tainted: G L syzkaller #0 PREEMPT(full) [ 602.022134][T17062] Tainted: [L]=SOFTLOCKUP [ 602.022139][T17062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 602.022147][T17062] Call Trace: [ 602.022152][T17062] [ 602.022157][T17062] dump_stack_lvl+0x100/0x190 [ 602.022179][T17062] should_fail_ex.cold+0x5/0xa [ 602.022198][T17062] get_futex_key+0x1c9/0x13e0 [ 602.022218][T17062] ? __pfx_get_futex_key+0x10/0x10 [ 602.022235][T17062] ? ___sys_sendmsg+0x127/0x1e0 [ 602.022254][T17062] futex_wake+0xf4/0x5e0 [ 602.022266][T17062] ? futex_wait+0x11e/0x370 [ 602.022282][T17062] ? __pfx_futex_wake+0x10/0x10 [ 602.022298][T17062] ? find_held_lock+0x2b/0x80 [ 602.022320][T17062] do_futex+0x2b2/0x440 [ 602.022339][T17062] ? __pfx_do_futex+0x10/0x10 [ 602.022358][T17062] ? fput+0x7c/0x100 [ 602.022377][T17062] __x64_sys_futex+0x34f/0x4d0 [ 602.022397][T17062] ? __pfx___x64_sys_futex+0x10/0x10 [ 602.022422][T17062] do_syscall_64+0x123/0x790 [ 602.022442][T17062] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 602.022455][T17062] RIP: 0033:0x7f6ddfd9e559 [ 602.022466][T17062] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 602.022478][T17062] RSP: 002b:00007f6de0bcf0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 602.022491][T17062] RAX: ffffffffffffffda RBX: 00007f6de0025fa8 RCX: 00007f6ddfd9e559 [ 602.022499][T17062] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f6de0025fac [ 602.022507][T17062] RBP: 00007f6de0025fa0 R08: 0000000000000001 R09: 0000000000000000 [ 602.022515][T17062] R10: 0000000000000038 R11: 0000000000000246 R12: 0000000000000000 [ 602.022522][T17062] R13: 00007f6de0026038 R14: 00007ffdb1c8ba30 R15: 00007ffdb1c8bb18 [ 602.022539][T17062] [ 602.087203][ T1230] usb 4-1: Using ep0 maxpacket: 32 [ 602.097629][ T1230] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 602.107514][ T1230] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 602.107530][ T1230] usb 4-1: config 0 has no interface number 0 [ 602.107553][ T1230] usb 4-1: config 0 interface 184 has no altsetting 0 [ 602.126773][ T1230] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 602.126787][ T1230] usb 4-1: Product: syz [ 602.126796][ T1230] usb 4-1: Manufacturer: syz [ 602.126805][ T1230] usb 4-1: SerialNumber: syz [ 602.128309][ T1230] usb 4-1: config 0 descriptor?? [ 602.469398][T17072] netlink: 'syz.6.3750': attribute type 29 has an invalid length. [ 602.756922][ T1230] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 602.756942][ T1230] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 602.759373][T17081] syzkaller0: entered promiscuous mode [ 602.759385][T17081] syzkaller0: entered allmulticast mode [ 602.763095][T17081] tipc: Started in network mode [ 602.763110][T17081] tipc: Node identity ba7be6e81d1d, cluster identity 4711 [ 602.812122][T17081] tipc: Enabled bearer , priority 0 [ 602.812988][T17080] tipc: Resetting bearer [ 602.847105][T17080] tipc: Disabling bearer [ 603.562967][ T1230] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 603.562988][ T1230] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 603.563001][ T1230] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 603.563124][ T1230] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -61 [ 603.933473][ T5710] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 604.039973][T17116] syzkaller0: entered promiscuous mode [ 604.039988][T17116] syzkaller0: entered allmulticast mode [ 604.083442][ T5710] usb 5-1: Using ep0 maxpacket: 32 [ 604.084972][ T5710] usb 5-1: unable to get BOS descriptor or descriptor too short [ 604.084998][ T5710] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 604.086709][ T5710] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 604.086723][ T5710] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 604.086735][ T5710] usb 5-1: config 14 has no interface number 0 [ 604.086745][ T5710] usb 5-1: config 14 has no interface number 1 [ 604.086777][ T5710] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 604.086791][ T5710] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 604.086805][ T5710] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 604.086820][ T5710] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 604.086835][ T5710] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 604.086851][ T5710] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 604.086866][ T5710] usb 5-1: config 14 interface 57 has no altsetting 0 [ 604.086876][ T5710] usb 5-1: config 14 interface 228 has no altsetting 0 [ 604.088488][ T5710] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.088502][ T5710] usb 5-1: Product: syz [ 604.088511][ T5710] usb 5-1: Manufacturer: syz [ 604.088520][ T5710] usb 5-1: SerialNumber: syz [ 604.663952][ T5710] legousbtower 5-1:14.57: interrupt endpoints not found [ 604.822467][T17121] binder: 17119:17121 ioctl c0306201 200000000100 returned -14 [ 604.842871][T17121] binder: 17119:17121 ioctl c0306201 200000000200 returned -14 [ 604.897268][ T1230] usb 4-1: USB disconnect, device number 2 [ 605.068944][ T5710] legousbtower 5-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 605.070581][ T5710] legousbtower 5-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 605.127996][T17135] netlink: 20 bytes leftover after parsing attributes in process `syz.7.3776'. [ 605.637129][ T5710] usb 5-1: USB disconnect, device number 9 [ 605.637187][ C1] usb 5-1: tower_interrupt_in_callback: usb_submit_urb failed (-19) [ 605.662913][ T5710] legousbtower 5-1:14.228: LEGO USB Tower #-160 now disconnected [ 605.722284][T17152] syzkaller0: entered promiscuous mode [ 605.722299][T17152] syzkaller0: entered allmulticast mode [ 605.852934][T17155] syzkaller0: entered promiscuous mode [ 605.852949][T17155] syzkaller0: entered allmulticast mode [ 606.049093][T17161] syzkaller0: entered promiscuous mode [ 606.049109][T17161] syzkaller0: entered allmulticast mode [ 606.073144][T17161] tipc: Enabled bearer , priority 0 [ 606.076484][T17160] tipc: Resetting bearer [ 606.138716][T17160] tipc: Disabling bearer [ 606.159234][T17167] block nbd0: not configured, cannot reconfigure [ 606.298444][T17171] sit1: entered allmulticast mode [ 606.314184][T17174] ip_tables: iptables: counters copy to user failed while replacing table [ 606.517773][T17181] device-mapper: ioctl: Invalid ioctl structure: name U, dev 42744cd223460000 [ 606.690155][T17188] syzkaller0: entered promiscuous mode [ 606.690170][T17188] syzkaller0: entered allmulticast mode [ 606.876729][ T30] audit: type=1400 audit(2000000283.995:731): avc: denied { ioctl } for pid=17197 comm="syz.7.3799" path="socket:[65677]" dev="sockfs" ino=65677 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 606.877587][ T30] audit: type=1400 audit(2000000283.995:732): avc: denied { write } for pid=17197 comm="syz.7.3799" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 607.023657][T17203] syzkaller0: entered promiscuous mode [ 607.023671][T17203] syzkaller0: entered allmulticast mode [ 607.030714][T17203] tipc: Started in network mode [ 607.030730][T17203] tipc: Node identity 4ef06742dbee, cluster identity 4711 [ 607.032450][T17203] tipc: Enabled bearer , priority 0 [ 607.079845][T17202] tipc: Resetting bearer [ 607.124523][ T30] audit: type=1400 audit(2000000284.245:733): avc: denied { bind } for pid=17204 comm="syz.3.3802" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 607.127264][T17202] tipc: Disabling bearer [ 607.164637][ T30] audit: type=1400 audit(2000000284.295:734): avc: denied { map } for pid=17204 comm="syz.3.3802" path="socket:[65716]" dev="sockfs" ino=65716 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 607.164772][ T30] audit: type=1400 audit(2000000284.295:735): avc: denied { read write } for pid=17204 comm="syz.3.3802" path="socket:[65716]" dev="sockfs" ino=65716 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 607.306407][ T30] audit: type=1400 audit(2000000284.425:736): avc: denied { append } for pid=17211 comm="syz.6.3805" name="ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 607.524664][T11983] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 607.673324][T11983] usb 8-1: Using ep0 maxpacket: 32 [ 607.675801][T11983] usb 8-1: unable to get BOS descriptor or descriptor too short [ 607.675828][T11983] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 607.676575][T11983] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 607.676589][T11983] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 607.676602][T11983] usb 8-1: config 14 has no interface number 0 [ 607.676612][T11983] usb 8-1: config 14 has no interface number 1 [ 607.676643][T11983] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 607.676656][T11983] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 607.676670][T11983] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 607.676686][T11983] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 607.676701][T11983] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 607.676716][T11983] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 607.676732][T11983] usb 8-1: config 14 interface 57 has no altsetting 0 [ 607.676743][T11983] usb 8-1: config 14 interface 228 has no altsetting 0 [ 607.678589][T11983] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 607.678604][T11983] usb 8-1: Product: syz [ 607.678614][T11983] usb 8-1: Manufacturer: syz [ 607.678640][T11983] usb 8-1: SerialNumber: syz [ 607.917351][T17213] bond1: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 607.949839][T17213] bond1 (unregistering): Released all slaves [ 608.100822][T17227] ip_tables: iptables: counters copy to user failed while replacing table [ 608.164558][T17229] device-mapper: ioctl: Invalid ioctl structure: name U, dev 42744cd223460000 [ 608.287736][T11983] legousbtower 8-1:14.57: interrupt endpoints not found [ 608.690971][T11983] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 608.725225][T11983] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 608.813756][T17247] syzkaller0: entered promiscuous mode [ 608.813771][T17247] syzkaller0: entered allmulticast mode [ 608.846207][T17247] tipc: Enabled bearer , priority 0 [ 608.850689][T17246] tipc: Resetting bearer [ 608.902693][T17251] gadgetfs: bound to dummy_udc driver [ 608.928001][T17246] tipc: Disabling bearer [ 609.044920][T17256] device-mapper: ioctl: Invalid ioctl structure: name U, dev 42744cd223460000 [ 609.068114][T17258] 0x000000000000-0x000000010000 : "" [ 609.084041][T17258] ftl_cs: FTL header not found. [ 609.258639][T11983] usb 8-1: USB disconnect, device number 10 [ 609.258697][ C1] usb 8-1: tower_interrupt_in_callback: usb_submit_urb failed (-19) [ 609.295874][T11983] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 609.413210][ T1230] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 609.417718][T17275] batman_adv: batadv0: Adding interface: syzkaller0 [ 609.417728][T17275] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 609.417745][T17275] batman_adv: batadv0: Interface activated: syzkaller0 [ 609.419378][T17275] tipc: Started in network mode [ 609.419393][T17275] tipc: Node identity aaa95f9a7cca, cluster identity 4711 [ 609.419600][T17275] tipc: Enabled bearer , priority 10 [ 609.420644][T17274] tipc: Resetting bearer [ 609.420661][T17274] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 609.531982][T17274] tipc: Disabling bearer [ 609.532079][T17274] batman_adv: batadv0: Removing interface: syzkaller0 [ 609.563907][ T1230] usb 5-1: Using ep0 maxpacket: 32 [ 609.564684][ T1230] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 609.565547][ T1230] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 609.565562][ T1230] usb 5-1: config 0 has no interface number 0 [ 609.565585][ T1230] usb 5-1: config 0 interface 184 has no altsetting 0 [ 609.567238][ T1230] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.567252][ T1230] usb 5-1: Product: syz [ 609.567261][ T1230] usb 5-1: Manufacturer: syz [ 609.567270][ T1230] usb 5-1: SerialNumber: syz [ 609.571168][ T1230] usb 5-1: config 0 descriptor?? [ 609.671677][T17277] netlink: 96 bytes leftover after parsing attributes in process `syz.6.3828'. [ 609.810543][T17281] gadgetfs: bound to dummy_udc driver [ 609.920719][T17285] syzkaller0: entered promiscuous mode [ 609.920734][T17285] syzkaller0: entered allmulticast mode [ 609.939121][T17285] tipc: Enabled bearer , priority 0 [ 609.941547][T17284] tipc: Resetting bearer [ 609.990112][T17284] tipc: Disabling bearer [ 610.031326][T17287] device-mapper: ioctl: Invalid ioctl structure: name U, dev 42744cd223460000 [ 610.159396][T17290] ip6gre1: entered allmulticast mode [ 610.206166][ T1230] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 610.206186][ T1230] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 610.339127][ T30] audit: type=1400 audit(2000000287.456:737): avc: denied { read } for pid=17298 comm="syz.3.3839" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 610.456218][T17306] gadgetfs: bound to dummy_udc driver [ 610.552192][T17310] binder: 17309:17310 ioctl c0306201 200000000100 returned -14 [ 610.564787][T17310] binder: 17309:17310 ioctl c0306201 200000000200 returned -14 [ 610.996788][T17318] syzkaller0: entered promiscuous mode [ 610.996808][T17318] syzkaller0: entered allmulticast mode [ 611.015581][T17318] tipc: Enabled bearer , priority 0 [ 611.017650][ T1230] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 611.017668][ T1230] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 611.017682][ T1230] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 611.017793][T17317] tipc: Resetting bearer [ 611.017984][ T1230] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -61 [ 611.152229][T17317] tipc: Disabling bearer [ 611.270500][T17326] netlink: 56 bytes leftover after parsing attributes in process `syz.6.3850'. [ 611.359224][T17326] syzkaller0: entered promiscuous mode [ 611.360388][T17326] syzkaller0: entered allmulticast mode [ 611.438681][T17334] FAULT_INJECTION: forcing a failure. [ 611.438681][T17334] name failslab, interval 1, probability 0, space 0, times 0 [ 611.438705][T17334] CPU: 1 UID: 0 PID: 17334 Comm: syz.1.3853 Tainted: G L syzkaller #0 PREEMPT(full) [ 611.438724][T17334] Tainted: [L]=SOFTLOCKUP [ 611.438729][T17334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 611.438737][T17334] Call Trace: [ 611.438743][T17334] [ 611.438748][T17334] dump_stack_lvl+0x100/0x190 [ 611.438776][T17334] should_fail_ex.cold+0x5/0xa [ 611.438794][T17334] should_failslab+0xc2/0x120 [ 611.438814][T17334] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 611.438831][T17334] ? alloc_inode+0x183/0x250 [ 611.438850][T17334] alloc_inode+0x183/0x250 [ 611.438865][T17334] alloc_anon_inode+0x2a/0x3e0 [ 611.438879][T17334] anon_inode_make_secure_inode+0x2f/0x140 [ 611.438897][T17334] __anon_inode_getfile+0x1cf/0x280 [ 611.438912][T17334] ? _copy_to_user+0xaf/0xd0 [ 611.438931][T17334] io_uring_setup.cold+0x1982/0x1c7e [ 611.438947][T17334] ? __pfx_io_uring_setup+0x10/0x10 [ 611.438966][T17334] ? find_held_lock+0x2b/0x80 [ 611.439000][T17334] ? xfd_validate_state+0x129/0x190 [ 611.439019][T17334] __x64_sys_io_uring_setup+0xc2/0x170 [ 611.439038][T17334] do_syscall_64+0x123/0x790 [ 611.439065][T17334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 611.439079][T17334] RIP: 0033:0x7f624679e559 [ 611.439091][T17334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 611.439103][T17334] RSP: 002b:00007f62476a3fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 611.439115][T17334] RAX: ffffffffffffffda RBX: 0000200000000240 RCX: 00007f624679e559 [ 611.439124][T17334] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000003a07 [ 611.439131][T17334] RBP: 00007f6246835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 611.439139][T17334] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 611.439147][T17334] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffe508ab5e8 [ 611.439163][T17334] [ 611.441960][T17334] 0x000000000000-0x000000010000 : "" [ 611.694240][T17334] ftl_cs: FTL header not found. [ 612.261932][ T1230] usb 5-1: USB disconnect, device number 10 [ 614.133168][T17357] syzkaller0: entered promiscuous mode [ 614.133185][T17357] syzkaller0: entered allmulticast mode [ 614.134456][T17370] sch_tbf: burst 0 is lower than device lo mtu (1296) ! [ 614.290001][T17376] ip_tables: iptables: counters copy to user failed while replacing table [ 614.324491][T17379] FAULT_INJECTION: forcing a failure. [ 614.324491][T17379] name failslab, interval 1, probability 0, space 0, times 0 [ 614.324513][T17379] CPU: 1 UID: 0 PID: 17379 Comm: syz.3.3865 Tainted: G L syzkaller #0 PREEMPT(full) [ 614.324531][T17379] Tainted: [L]=SOFTLOCKUP [ 614.324536][T17379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 614.324544][T17379] Call Trace: [ 614.324549][T17379] [ 614.324554][T17379] dump_stack_lvl+0x100/0x190 [ 614.324578][T17379] should_fail_ex.cold+0x5/0xa [ 614.324594][T17379] ? __netlink_lookup+0x692/0x950 [ 614.324614][T17379] should_failslab+0xc2/0x120 [ 614.324634][T17379] kmem_cache_alloc_noprof+0x92/0x6a0 [ 614.324651][T17379] ? skb_clone+0x190/0x400 [ 614.324667][T17379] skb_clone+0x190/0x400 [ 614.324680][T17379] netlink_deliver_tap+0xaed/0xcc0 [ 614.324704][T17379] netlink_unicast+0x6ff/0x950 [ 614.324719][T17379] ? __pfx_netlink_unicast+0x10/0x10 [ 614.324736][T17379] netlink_sendmsg+0x8b0/0xda0 [ 614.324750][T17379] ? __pfx_netlink_sendmsg+0x10/0x10 [ 614.324764][T17379] ? selinux_socket_sendmsg+0x198/0x2f0 [ 614.324785][T17379] ____sys_sendmsg+0xa4d/0xbe0 [ 614.324799][T17379] ? __pfx_netlink_sendmsg+0x10/0x10 [ 614.324813][T17379] ? __pfx_____sys_sendmsg+0x10/0x10 [ 614.324839][T17379] ___sys_sendmsg+0x190/0x1e0 [ 614.324858][T17379] ? __pfx____sys_sendmsg+0x10/0x10 [ 614.324876][T17379] ? futex_wait+0x11e/0x370 [ 614.324896][T17379] ? find_held_lock+0x2b/0x80 [ 614.324925][T17379] __sys_sendmsg+0x160/0x210 [ 614.324939][T17379] ? __pfx___sys_sendmsg+0x10/0x10 [ 614.324961][T17379] do_syscall_64+0x123/0x790 [ 614.324981][T17379] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 614.324994][T17379] RIP: 0033:0x7fd4c339e559 [ 614.325005][T17379] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 614.325018][T17379] RSP: 002b:00007fd4c4246028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 614.325032][T17379] RAX: ffffffffffffffda RBX: 00007fd4c3625fa0 RCX: 00007fd4c339e559 [ 614.325041][T17379] RDX: 0000000000000000 RSI: 00002000000004c0 RDI: 0000000000000005 [ 614.325049][T17379] RBP: 00007fd4c3435ad8 R08: 0000000000000000 R09: 0000000000000000 [ 614.325056][T17379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 614.325063][T17379] R13: 00007fd4c3626038 R14: 00007fd4c3625fa0 R15: 00007ffedbe8e858 [ 614.325080][T17379] [ 614.786567][T17389] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3869'. [ 615.080202][ T30] audit: type=1400 audit(2000000292.196:738): avc: denied { bind } for pid=17408 comm="syz.1.3877" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 615.111504][T17409] syzkaller0: entered promiscuous mode [ 615.111519][T17409] syzkaller0: entered allmulticast mode [ 615.461761][ T30] audit: type=1400 audit(2000000292.576:739): avc: denied { ioctl } for pid=17422 comm="syz.4.3884" path="socket:[66633]" dev="sockfs" ino=66633 ioctlcmd=0x9441 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 615.558213][T17430] netlink: 100 bytes leftover after parsing attributes in process `syz.4.3884'. [ 615.778101][T17440] netlink: 20 bytes leftover after parsing attributes in process `syz.7.3889'. [ 615.980158][T17453] 0x000000000000-0x000000010000 : "" [ 616.012549][T17453] ftl_cs: FTL header not found. [ 616.037149][T17453] FAULT_INJECTION: forcing a failure. [ 616.037149][T17453] name failslab, interval 1, probability 0, space 0, times 0 [ 616.037169][T17453] CPU: 1 UID: 0 PID: 17453 Comm: syz.3.3896 Tainted: G L syzkaller #0 PREEMPT(full) [ 616.037187][T17453] Tainted: [L]=SOFTLOCKUP [ 616.037193][T17453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 616.037201][T17453] Call Trace: [ 616.037213][T17453] [ 616.037219][T17453] dump_stack_lvl+0x100/0x190 [ 616.037243][T17453] should_fail_ex.cold+0x5/0xa [ 616.037263][T17453] should_failslab+0xc2/0x120 [ 616.037282][T17453] kmem_cache_alloc_noprof+0x92/0x6a0 [ 616.037301][T17453] ? __kernfs_new_node+0xd2/0xa10 [ 616.037318][T17453] __kernfs_new_node+0xd2/0xa10 [ 616.037335][T17453] ? __pfx___kernfs_new_node+0x10/0x10 [ 616.037351][T17453] ? lock_acquire+0x1d1/0x380 [ 616.037366][T17453] ? kernfs_root+0x23/0x2a0 [ 616.037379][T17453] ? find_held_lock+0x2b/0x80 [ 616.037398][T17453] ? kernfs_root+0xee/0x2a0 [ 616.037410][T17453] ? kernfs_root+0xee/0x2a0 [ 616.037427][T17453] kernfs_new_node+0x117/0x150 [ 616.037444][T17453] __kernfs_create_file+0x53/0x350 [ 616.037463][T17453] sysfs_add_file_mode_ns+0x207/0x3c0 [ 616.037487][T17453] internal_create_group+0x593/0xfb0 [ 616.037503][T17453] ? kernfs_create_dir_ns+0x16f/0x2b0 [ 616.037519][T17453] ? __pfx_internal_create_group+0x10/0x10 [ 616.037533][T17453] ? sysfs_create_dir_ns+0x14c/0x2b0 [ 616.037545][T17453] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 616.037557][T17453] ? sysfs_create_dir_ns+0x14c/0x2b0 [ 616.037571][T17453] internal_create_groups+0x9d/0x150 [ 616.037586][T17453] kobject_add_internal+0x317/0x930 [ 616.037604][T17453] kobject_add+0x16a/0x1e0 [ 616.037618][T17453] ? __pfx_kobject_add+0x10/0x10 [ 616.037633][T17453] ? __pfx_kobject_add+0x10/0x10 [ 616.037653][T17453] blk_register_queue+0x8d/0x630 [ 616.037673][T17453] __add_disk+0x7dd/0xf10 [ 616.037691][T17453] add_disk_fwnode+0x118/0x480 [ 616.037707][T17453] add_mtd_blktrans_dev+0xd0b/0x1520 [ 616.037728][T17453] ? __pfx_add_mtd_blktrans_dev+0x10/0x10 [ 616.037756][T17453] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 616.037770][T17453] ? mtdblock_add_mtd+0x4a/0x270 [ 616.037791][T17453] mtdblock_add_mtd+0x1cc/0x270 [ 616.037808][T17453] blktrans_notify_add+0xa2/0xf0 [ 616.037825][T17453] add_mtd_device+0xb6d/0x1820 [ 616.037842][T17453] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 616.037861][T17453] ? __pfx_add_mtd_device+0x10/0x10 [ 616.037880][T17453] mtd_add_partition+0x376/0x6a0 [ 616.037896][T17453] ? __pfx_mtd_add_partition+0x10/0x10 [ 616.037910][T17453] ? __might_fault+0xc5/0x140 [ 616.037923][T17453] ? __might_fault+0xc5/0x140 [ 616.037943][T17453] mtdchar_blkpg_ioctl+0x207/0x250 [ 616.037958][T17453] ? __pfx_mtdchar_blkpg_ioctl+0x10/0x10 [ 616.037990][T17453] mtdchar_ioctl+0x1670/0x1fd0 [ 616.038009][T17453] ? __pfx_mtdchar_ioctl+0x10/0x10 [ 616.038026][T17453] ? lock_acquire+0x1d1/0x380 [ 616.038040][T17453] ? mtdchar_unlocked_ioctl+0xa2/0xf0 [ 616.038060][T17453] ? rcu_is_watching+0x13/0xc0 [ 616.038078][T17453] ? trace_contention_end+0x126/0x160 [ 616.038095][T17453] ? mtdchar_unlocked_ioctl+0xa2/0xf0 [ 616.038112][T17453] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 616.038126][T17453] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 616.038147][T17453] ? __pfx___mutex_lock+0x10/0x10 [ 616.038166][T17453] ? __fget_files+0x34/0x3d0 [ 616.038194][T17453] mtdchar_unlocked_ioctl+0xb0/0xf0 [ 616.038216][T17453] ? __pfx_mtdchar_unlocked_ioctl+0x10/0x10 [ 616.038235][T17453] __x64_sys_ioctl+0x18e/0x210 [ 616.038252][T17453] do_syscall_64+0x123/0x790 [ 616.038273][T17453] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 616.038286][T17453] RIP: 0033:0x7fd4c339e559 [ 616.038297][T17453] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 616.038308][T17453] RSP: 002b:00007fd4c4246028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 616.038321][T17453] RAX: ffffffffffffffda RBX: 00007fd4c3625fa0 RCX: 00007fd4c339e559 [ 616.038330][T17453] RDX: 0000200000000a80 RSI: 0000000000001269 RDI: 0000000000000007 [ 616.038338][T17453] RBP: 00007fd4c3435ad8 R08: 0000000000000000 R09: 0000000000000000 [ 616.038346][T17453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 616.038354][T17453] R13: 00007fd4c3626038 R14: 00007fd4c3625fa0 R15: 00007ffedbe8e858 [ 616.038373][T17453] [ 616.076522][T17453] kobject: kobject_add_internal failed for queue (error: -12 parent: mtdblock10) [ 616.110485][ T5601] Bluetooth: hci5: command 0x0406 tx timeout [ 616.731101][T17458] pimreg: entered allmulticast mode [ 616.884247][T17454] pimreg: left allmulticast mode [ 617.764983][T17508] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3917'. [ 617.765002][T17508] openvswitch: netlink: Invalid VLAN frame [ 618.092373][T17513] pimreg: entered allmulticast mode [ 618.161618][T17512] pimreg: left allmulticast mode [ 620.823664][T17558] openvswitch: netlink: IP tunnel TTL not specified. [ 620.823683][T17558] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 620.948372][T17552] syzkaller0: entered promiscuous mode [ 620.948469][T17552] syzkaller0: entered allmulticast mode [ 621.135169][T11758] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 621.264574][T11758] usb 5-1: device descriptor read/64, error -71 [ 621.784588][T11758] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 622.088767][T11758] usb 5-1: device descriptor read/64, error -71 [ 622.222327][T11758] usb usb5-port1: attempt power cycle [ 622.760511][T11758] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 622.852655][T11758] usb 5-1: device descriptor read/8, error -71 [ 623.198726][T11758] usb 5-1: new full-speed USB device number 14 using dummy_hcd [ 623.227272][T11758] usb 5-1: device descriptor read/8, error -71 [ 623.286548][T17575] fuse: Unknown parameter 'grou00000000000000000000' [ 623.335473][T11758] usb usb5-port1: unable to enumerate USB device [ 624.268567][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.268685][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.502725][T17590] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3944'. [ 632.674612][T17592] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3943'. [ 634.161628][T11758] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 634.343007][T11758] usb 7-1: device descriptor read/64, error -71 [ 634.461192][T17622] device-mapper: ioctl: Invalid ioctl structure: name U, dev 42744cd223460000 [ 634.601654][T11758] usb 7-1: new full-speed USB device number 6 using dummy_hcd [ 634.811481][T11758] usb 7-1: device descriptor read/64, error -71 [ 634.943245][T11758] usb usb7-port1: attempt power cycle [ 635.324655][T11758] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 635.378229][T11758] usb 7-1: device descriptor read/8, error -71 [ 635.623507][T11758] usb 7-1: new full-speed USB device number 8 using dummy_hcd [ 635.649556][T11758] usb 7-1: device descriptor read/8, error -71 [ 635.752887][T11758] usb usb7-port1: unable to enumerate USB device [ 636.581739][ T5601] Bluetooth: hci2: command 0x0401 tx timeout [ 639.906072][T17647] syzkaller0: entered promiscuous mode [ 639.906166][T17647] syzkaller0: entered allmulticast mode [ 641.164840][T17663] device-mapper: ioctl: Invalid ioctl structure: name U, dev 42744cd223460000 [ 641.414687][ T30] audit: type=1400 audit(2000000318.537:740): avc: denied { shutdown } for pid=17666 comm="syz.3.3967" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 641.639551][T17651] virtio_blk virtio3: 1/0/0 default/read/poll queues [ 641.679691][T17651] virtio_blk virtio3: [vda] 262144 512-byte logical blocks (134 MB/128 MiB) [ 643.057694][T17651] vda: unable to read partition table [ 647.730391][T17707] syzkaller0: entered promiscuous mode [ 647.730486][T17707] syzkaller0: entered allmulticast mode [ 648.028607][T17712] ip_tables: iptables: counters copy to user failed while replacing table [ 648.279962][T17707] tipc: Enabled bearer , priority 0 [ 648.288864][T17708] tipc: Enabled bearer , priority 0 [ 648.367295][T17708] tipc: Resetting bearer [ 648.534225][T17706] tipc: Disabling bearer [ 648.685207][T17705] tipc: Resetting bearer [ 650.329274][T17705] tipc: Disabling bearer [ 650.410101][ T1230] tipc: Node number set to 2808538856 [ 650.458525][T17730] tipc: Enabled bearer , priority 0 [ 650.711074][T17725] tipc: Disabling bearer [ 650.785678][T17720] syzkaller0: entered promiscuous mode [ 650.785773][T17720] syzkaller0: entered allmulticast mode [ 650.813776][T17722] tipc: Enabled bearer , priority 0 [ 650.909446][T17724] tipc: Resetting bearer [ 651.141386][T17719] tipc: Resetting bearer [ 651.335989][T17719] tipc: Disabling bearer [ 651.436994][T17744] syzkaller0: entered promiscuous mode [ 651.437094][T17744] syzkaller0: entered allmulticast mode [ 651.917301][T17755] syzkaller0: entered promiscuous mode [ 651.917395][T17755] syzkaller0: entered allmulticast mode [ 652.193937][T11983] usb 7-1: new full-speed USB device number 9 using dummy_hcd [ 652.378394][T11983] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 652.378422][T11983] usb 7-1: no configurations [ 652.378430][T11983] usb 7-1: can't read configurations, error -22 [ 652.524293][T17771] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 652.540480][T11983] usb 7-1: new full-speed USB device number 10 using dummy_hcd [ 652.690870][T11983] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 652.690898][T11983] usb 7-1: no configurations [ 652.690906][T11983] usb 7-1: can't read configurations, error -22 [ 652.691177][T11983] usb usb7-port1: attempt power cycle [ 652.776193][T15875] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x82 [ 653.189631][T11983] usb 7-1: new full-speed USB device number 11 using dummy_hcd [ 653.271345][T11983] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 653.271372][T11983] usb 7-1: no configurations [ 653.271379][T11983] usb 7-1: can't read configurations, error -22 [ 653.528862][T11983] usb 7-1: new full-speed USB device number 12 using dummy_hcd [ 653.605708][T11983] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 653.605733][T11983] usb 7-1: no configurations [ 653.605741][T11983] usb 7-1: can't read configurations, error -22 [ 653.621705][T11983] usb usb7-port1: unable to enumerate USB device [ 653.741448][T17779] netlink: 'syz.1.4000': attribute type 3 has an invalid length. [ 653.744603][T17779] netlink: 'syz.1.4000': attribute type 3 has an invalid length. [ 655.386975][T17768] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 656.691575][T17791] FAULT_INJECTION: forcing a failure. [ 656.691575][T17791] name fail_futex, interval 1, probability 0, space 0, times 0 [ 656.691602][T17791] CPU: 1 UID: 0 PID: 17791 Comm: syz.1.4006 Tainted: G L syzkaller #0 PREEMPT(full) [ 656.691635][T17791] Tainted: [L]=SOFTLOCKUP [ 656.691644][T17791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 656.691665][T17791] Call Trace: [ 656.691670][T17791] [ 656.691675][T17791] dump_stack_lvl+0x100/0x190 [ 656.691698][T17791] should_fail_ex.cold+0x5/0xa [ 656.691716][T17791] get_futex_key+0x1c9/0x13e0 [ 656.691735][T17791] ? __pfx_get_futex_key+0x10/0x10 [ 656.691751][T17791] ? __mutex_unlock_slowpath+0x35d/0x930 [ 656.691774][T17791] futex_wake+0xf4/0x5e0 [ 656.691789][T17791] ? __pfx_futex_wake+0x10/0x10 [ 656.691804][T17791] ? lock_acquire+0x1d1/0x380 [ 656.691818][T17791] ? detach_task_ctx_data+0x83/0x490 [ 656.691833][T17791] do_futex+0x2b2/0x440 [ 656.691851][T17791] ? __pfx_do_futex+0x10/0x10 [ 656.691866][T17791] ? __might_fault+0xc5/0x140 [ 656.691882][T17791] mm_exit_exec_release+0x256/0x2f0 [ 656.691898][T17791] do_exit+0x707/0x2a60 [ 656.691912][T17791] ? lock_acquire+0x1d1/0x380 [ 656.691925][T17791] ? cgroup1_freezing+0x27/0x3b0 [ 656.691938][T17791] ? find_held_lock+0x2b/0x80 [ 656.691956][T17791] ? __pfx_do_exit+0x10/0x10 [ 656.691972][T17791] ? find_held_lock+0x2b/0x80 [ 656.691988][T17791] ? get_signal+0x7e0/0x21e0 [ 656.692003][T17791] do_group_exit+0xd5/0x2a0 [ 656.692020][T17791] get_signal+0x1ec7/0x21e0 [ 656.692037][T17791] ? find_held_lock+0x2b/0x80 [ 656.692055][T17791] ? __pfx_get_signal+0x10/0x10 [ 656.692069][T17791] ? do_futex+0x190/0x440 [ 656.692088][T17791] arch_do_signal_or_restart+0x91/0x7e0 [ 656.692107][T17791] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 656.692134][T17791] exit_to_user_mode_loop+0x139/0x700 [ 656.692150][T17791] ? rcu_is_watching+0x13/0xc0 [ 656.692169][T17791] do_syscall_64+0x661/0x790 [ 656.692188][T17791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 656.692200][T17791] RIP: 0033:0x7f624679e559 [ 656.692210][T17791] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 656.692221][T17791] RSP: 002b:00007f62476a40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 656.692233][T17791] RAX: fffffffffffffe00 RBX: 00007f6246a25fa8 RCX: 00007f624679e559 [ 656.692241][T17791] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f6246a25fa8 [ 656.692249][T17791] RBP: 00007f6246a25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 656.692256][T17791] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 656.692263][T17791] R13: 00007f6246a26038 R14: 00007ffe508ab500 R15: 00007ffe508ab5e8 [ 656.692279][T17791] [ 658.552814][T17801] syzkaller0: entered promiscuous mode [ 658.552908][T17801] syzkaller0: entered allmulticast mode [ 662.649394][T17854] syzkaller0: entered promiscuous mode [ 662.649488][T17854] syzkaller0: entered allmulticast mode [ 667.103298][T17902] netlink: 'syz.7.4040': attribute type 3 has an invalid length. [ 669.558730][ T30] audit: type=1800 audit(2000000346.679:741): pid=17936 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t op=collect_data cause=failed comm="syz.3.4049" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 669.592288][ T30] audit: type=1400 audit(2000000346.679:742): avc: denied { firmware_load } for pid=17933 comm="syz.3.4049" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 669.592511][T17936] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 669.592534][T17936] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 669.593024][T17936] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 669.593040][ T30] audit: type=1400 audit(2000000346.719:743): avc: denied { firmware_load } for pid=17933 comm="syz.3.4049" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 669.793337][T17953] netlink: 'syz.4.4054': attribute type 3 has an invalid length. [ 671.661107][T17976] device-mapper: ioctl: Invalid ioctl structure: name U, dev 42744cd22346570d [ 672.719863][T17989] IPv6: NLM_F_CREATE should be specified when creating new route [ 672.720247][T17989] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 672.720256][T17989] IPv6: NLM_F_CREATE should be set when creating new route [ 672.784694][T17993] netlink: 'syz.7.4066': attribute type 29 has an invalid length. [ 672.991836][T17994] netlink: 'syz.7.4066': attribute type 29 has an invalid length. [ 673.139784][T17999] syzkaller0: entered promiscuous mode [ 673.139877][T17999] syzkaller0: entered allmulticast mode [ 673.438631][T18003] netlink: 'syz.3.4069': attribute type 3 has an invalid length. [ 676.059572][T18038] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4083'. [ 677.034081][T18042] netlink: 'syz.1.4085': attribute type 3 has an invalid length. [ 678.014580][T18043] syzkaller0: entered promiscuous mode [ 678.014677][T18043] syzkaller0: entered allmulticast mode [ 678.189352][T18052] syzkaller0: entered promiscuous mode [ 678.189446][T18052] syzkaller0: entered allmulticast mode [ 678.466823][T18072] netlink: 'syz.1.4091': attribute type 29 has an invalid length. [ 685.715216][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.715329][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 688.792552][T18067] syzkaller0: entered promiscuous mode [ 688.792648][T18067] syzkaller0: entered allmulticast mode [ 692.883641][ T30] audit: type=1400 audit(2000000370.010:744): avc: denied { execmem } for pid=18112 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 693.130801][ T5601] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 693.133551][ T5601] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 693.134300][ T5601] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 693.135241][ T5601] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 693.135870][ T5601] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 695.218483][T14237] Bluetooth: hci3: command tx timeout [ 697.303267][T14237] Bluetooth: hci3: command tx timeout [ 699.377943][T14237] Bluetooth: hci3: command tx timeout [ 701.134029][T18128] syzkaller0: entered promiscuous mode [ 701.134124][T18128] syzkaller0: entered allmulticast mode [ 701.458107][T14237] Bluetooth: hci3: command tx timeout [ 702.179786][T18139] netlink: 'syz.1.4108': attribute type 3 has an invalid length. [ 702.180162][T18139] netlink: 'syz.1.4108': attribute type 3 has an invalid length. [ 703.725685][T18113] rxe_eth0 speed is unknown, defaulting to 1000 [ 704.941814][T15860] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 705.023789][T18113] vcan0 speed is unknown, defaulting to 1000 [ 705.074803][T18170] syzkaller0: entered promiscuous mode [ 705.074898][T18170] syzkaller0: entered allmulticast mode [ 705.286455][T15860] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 706.248380][T18151] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 707.001441][T15860] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 707.818990][T15860] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 708.720851][T18191] syz.3.4125 (18191) used greatest stack depth: 19864 bytes left [ 709.914836][T15860] bridge_slave_1: left allmulticast mode [ 709.915016][T15860] bridge_slave_1: left promiscuous mode [ 709.915451][T15860] bridge0: port 2(bridge_slave_1) entered disabled state [ 709.961758][T15860] bridge_slave_0: left allmulticast mode [ 709.961936][T15860] bridge_slave_0: left promiscuous mode [ 709.962368][T15860] bridge0: port 1(bridge_slave_0) entered disabled state [ 711.089194][T18204] netlink: 56 bytes leftover after parsing attributes in process `syz.7.4129'. [ 711.458349][T18206] ip_tables: iptables: counters copy to user failed while replacing table [ 713.770521][ T5601] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 714.030534][ T5601] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 714.074668][ T5601] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 714.246562][ T5601] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 714.315340][ T5601] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 714.660701][T15860] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 714.813862][ T30] audit: type=1400 audit(2000000391.941:745): avc: denied { write } for pid=18198 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 714.815844][T15860] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 715.053154][T15860] bond0 (unregistering): Released all slaves [ 715.159350][T11758] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 715.322048][T15860] tipc: Left network mode [ 715.341098][T11758] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 715.360153][T11758] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 715.397567][T11758] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 715.397596][T11758] usb 4-1: Product: syz [ 715.397615][T11758] usb 4-1: Manufacturer: syz [ 715.397634][T11758] usb 4-1: SerialNumber: syz [ 715.427608][T11758] usb 4-1: config 0 descriptor?? [ 715.648265][ T30] audit: type=1400 audit(2000000392.782:746): avc: denied { write } for pid=18244 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 715.977181][ T5263] 8021q: adding VLAN 0 to HW filter on device eth5 [ 716.667369][ T5601] Bluetooth: hci0: command tx timeout [ 716.998952][T18113] bridge0: port 1(bridge_slave_0) entered blocking state [ 716.999163][T18113] bridge0: port 1(bridge_slave_0) entered disabled state [ 716.999326][T18113] bridge_slave_0: entered allmulticast mode [ 717.004308][T18113] bridge_slave_0: entered promiscuous mode [ 717.138100][T18113] bridge0: port 2(bridge_slave_1) entered blocking state [ 717.138524][T18113] bridge0: port 2(bridge_slave_1) entered disabled state [ 717.300396][T18113] bridge_slave_1: entered allmulticast mode [ 717.367879][T18113] bridge_slave_1: entered promiscuous mode [ 717.661285][T18113] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 717.724245][T18113] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 718.152629][T11758] usb 4-1: USB disconnect, device number 3 [ 718.597280][T18279] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4142'. [ 718.597297][T18279] openvswitch: netlink: Flow key attr not present in new flow. [ 718.737270][ T5601] Bluetooth: hci0: command tx timeout [ 719.464418][T18113] team0: Port device team_slave_0 added [ 719.465608][T18221] rxe_eth0 speed is unknown, defaulting to 1000 [ 719.510360][T18113] team0: Port device team_slave_1 added [ 720.816762][ T5601] Bluetooth: hci0: command tx timeout [ 721.102619][ T30] audit: type=1400 audit(2000000398.232:747): avc: denied { connect } for pid=18284 comm="syz.1.4143" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 721.239729][T18289] tipc: Enabled bearer , priority 0 [ 721.246157][ T30] audit: type=1400 audit(2000000398.372:748): avc: denied { write } for pid=18265 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 721.464061][T18287] tipc: Disabling bearer [ 722.375140][T18113] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 722.375153][T18113] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 722.375168][T18113] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 722.377044][T18113] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 722.377053][T18113] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 722.377068][T18113] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 722.893626][T15860] hsr_slave_0: left promiscuous mode [ 722.904032][ T5601] Bluetooth: hci0: command tx timeout [ 722.913321][ T30] audit: type=1400 audit(2000000400.042:749): avc: denied { write } for pid=18314 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 722.942852][T15860] hsr_slave_1: left promiscuous mode [ 722.963228][T15860] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 722.963322][T15860] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 722.985515][T15860] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 722.985610][T15860] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 723.143566][T15860] veth1_macvtap: left promiscuous mode [ 723.143830][T15860] veth0_macvtap: left promiscuous mode [ 723.144873][T15860] veth1_vlan: left promiscuous mode [ 723.145602][T15860] veth0_vlan: left promiscuous mode [ 724.676898][T18323] ip_tables: iptables: counters copy to user failed while replacing table [ 727.740314][T18338] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4154'. [ 728.098719][ T30] audit: type=1400 audit(2000000405.232:750): avc: denied { append } for pid=18334 comm="syz.1.4153" name="001" dev="devtmpfs" ino=744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 729.631680][T15860] team0 (unregistering): Port device team_slave_1 removed [ 729.768881][T15860] team0 (unregistering): Port device team_slave_0 removed [ 732.935932][T18113] hsr_slave_0: entered promiscuous mode [ 732.937298][T18113] hsr_slave_1: entered promiscuous mode [ 732.943738][T18113] debugfs: 'hsr0' already exists in 'hsr' [ 732.943752][T18113] Cannot create hsr debugfs directory [ 732.947970][ T5263] 8021q: adding VLAN 0 to HW filter on device eth6 [ 733.166996][T18221] vcan0 speed is unknown, defaulting to 1000 [ 733.341194][T18347] tipc: Enabled bearer , priority 0 [ 733.521786][T18346] tipc: Disabling bearer [ 737.492476][T18379] ------------[ cut here ]------------ [ 737.492485][T18379] in_task() && kcov_mode_enabled(mode) [ 737.492494][T18379] WARNING: kernel/kcov.c:893 at kcov_remote_start+0x161/0x6d0, CPU#1: syz.1.4164/18379 [ 737.512991][T18379] Modules linked in: [ 737.516865][T18379] CPU: 1 UID: 0 PID: 18379 Comm: syz.1.4164 Tainted: G L syzkaller #0 PREEMPT(full) [ 737.527773][T18379] Tainted: [L]=SOFTLOCKUP [ 737.532070][T18379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 737.542096][T18379] RIP: 0010:kcov_remote_start+0x161/0x6d0 [ 737.547798][T18379] Code: 48 85 db 74 0e 4c 3b 33 74 6a 48 8b 5b 10 48 85 db 75 e9 48 c7 c7 80 6b e7 8f e8 3a 04 cb 09 eb 0c 81 e2 ff ff ff bf 74 a8 90 <0f> 0b 90 e8 37 24 c8 09 44 8b 15 90 ae 8e 1a 89 c0 48 03 2c c5 20 [ 737.567396][T18379] RSP: 0018:ffffc900049b6e80 EFLAGS: 00010002 [ 737.573436][T18379] RAX: 8000000000000200 RBX: ffff8880b8329220 RCX: 0000000000000001 [ 737.581379][T18379] RDX: 0000000000000002 RSI: ffffffff8e3bd91c RDI: ffffffff8c625680 [ 737.589321][T18379] RBP: ffffffff958e3220 R08: ffffffff97955658 R09: 000000000000004c [ 737.597265][T18379] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888038754b00 [ 737.605212][T18379] R13: 0000000000000200 R14: 0000000000000000 R15: 00000000ffffffff [ 737.613157][T18379] FS: 00007f62476a46c0(0000) GS:ffff888122a46000(0000) knlGS:0000000000000000 [ 737.622060][T18379] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 737.628617][T18379] CR2: 00007ffb5ee60018 CR3: 000000002e5fb000 CR4: 00000000003526f0 [ 737.636561][T18379] Call Trace: [ 737.639812][T18379] [ 737.642734][T18379] ieee80211_rx_list+0x576/0x2160 [ 737.647741][T18379] ? lock_acquire+0x1d1/0x380 [ 737.652394][T18379] ? ieee80211_rx_napi+0x9a/0x400 [ 737.657391][T18379] ? __pfx_ieee80211_rx_list+0x10/0x10 [ 737.662828][T18379] ieee80211_rx_napi+0xdc/0x400 [ 737.667653][T18379] ? __pfx_ieee80211_rx_napi+0x10/0x10 [ 737.673093][T18379] ? lockdep_hardirqs_on+0x7d/0x110 [ 737.678268][T18379] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 737.684062][T18379] ieee80211_handle_queued_frames+0xc8/0x120 [ 737.690021][T18379] ? ieee80211_stop_device+0x14/0x110 [ 737.695376][T18379] ieee80211_stop_device+0x32/0x110 [ 737.700574][T18379] ieee80211_do_stop+0x19fd/0x2bf0 [ 737.705677][T18379] ? __pfx_ieee80211_do_stop+0x10/0x10 [ 737.711113][T18379] ? do_raw_spin_lock+0x128/0x260 [ 737.716119][T18379] ? mark_held_locks+0x40/0x70 [ 737.720854][T18379] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 737.726639][T18379] ? __pfx_ieee80211_stop+0x10/0x10 [ 737.731811][T18379] ieee80211_stop+0x165/0x2f0 [ 737.736462][T18379] ? __pfx_ieee80211_stop+0x10/0x10 [ 737.741637][T18379] __dev_close_many+0x312/0x710 [ 737.746464][T18379] ? __pfx___dev_close_many+0x10/0x10 [ 737.751815][T18379] ? rcu_is_watching+0x13/0xc0 [ 737.756556][T18379] netif_close_many+0x243/0x810 [ 737.761385][T18379] ? find_held_lock+0x2b/0x80 [ 737.766039][T18379] ? nl80211_del_interface+0xb9/0x1a0 [ 737.771385][T18379] ? __pfx_netif_close_many+0x10/0x10 [ 737.776734][T18379] netif_close+0x17f/0x230 [ 737.781125][T18379] ? __pfx_netif_close+0x10/0x10 [ 737.786035][T18379] ? __nla_parse+0x40/0x60 [ 737.790428][T18379] dev_close+0xaa/0x240 [ 737.794557][T18379] nl80211_del_interface+0xf0/0x1a0 [ 737.799734][T18379] genl_family_rcv_msg_doit+0x214/0x300 [ 737.805257][T18379] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 737.811302][T18379] ? bpf_lsm_capable+0x9/0x10 [ 737.815952][T18379] ? security_capable+0x80/0x260 [ 737.820864][T18379] ? ns_capable+0xd2/0xf0 [ 737.825166][T18379] genl_rcv_msg+0x560/0x800 [ 737.829644][T18379] ? __pfx_genl_rcv_msg+0x10/0x10 [ 737.834640][T18379] ? __lock_acquire+0x5c0/0x1f40 [ 737.839548][T18379] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 737.844901][T18379] ? __pfx_nl80211_del_interface+0x10/0x10 [ 737.850678][T18379] ? __pfx_nl80211_post_doit+0x10/0x10 [ 737.856118][T18379] netlink_rcv_skb+0x159/0x420 [ 737.860851][T18379] ? __pfx_genl_rcv_msg+0x10/0x10 [ 737.865848][T18379] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 737.871110][T18379] ? netlink_deliver_tap+0x1ae/0xcc0 [ 737.876387][T18379] genl_rcv+0x28/0x40 [ 737.880341][T18379] netlink_unicast+0x65f/0x950 [ 737.885077][T18379] ? __pfx_netlink_unicast+0x10/0x10 [ 737.890332][T18379] ? __pfx_sock_has_perm+0x10/0x10 [ 737.895420][T18379] netlink_sendmsg+0x8b0/0xda0 [ 737.900165][T18379] ? __pfx_netlink_sendmsg+0x10/0x10 [ 737.905442][T18379] ? selinux_socket_sendmsg+0x198/0x2f0 [ 737.910982][T18379] ____sys_sendmsg+0xa4d/0xbe0 [ 737.915722][T18379] ? __pfx_netlink_sendmsg+0x10/0x10 [ 737.920977][T18379] ? __pfx_____sys_sendmsg+0x10/0x10 [ 737.926246][T18379] ___sys_sendmsg+0x190/0x1e0 [ 737.930902][T18379] ? __pfx____sys_sendmsg+0x10/0x10 [ 737.936077][T18379] ? futex_wait+0x11e/0x370 [ 737.940576][T18379] ? find_held_lock+0x2b/0x80 [ 737.945252][T18379] __sys_sendmsg+0x160/0x210 [ 737.949814][T18379] ? __pfx___sys_sendmsg+0x10/0x10 [ 737.954922][T18379] do_syscall_64+0x123/0x790 [ 737.959492][T18379] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.965356][T18379] RIP: 0033:0x7f624679e559 [ 737.969745][T18379] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 737.989319][T18379] RSP: 002b:00007f62476a4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 737.997700][T18379] RAX: ffffffffffffffda RBX: 00007f6246a25fa0 RCX: 00007f624679e559 [ 738.005646][T18379] RDX: 0000000000000000 RSI: 0000200000000880 RDI: 0000000000000004 [ 738.013589][T18379] RBP: 00007f6246835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 738.021530][T18379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 738.029472][T18379] R13: 00007f6246a26038 R14: 00007f6246a25fa0 R15: 00007ffe508ab5e8 [ 738.037424][T18379] [ 738.040418][T18379] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 738.047669][T18379] CPU: 1 UID: 0 PID: 18379 Comm: syz.1.4164 Tainted: G L syzkaller #0 PREEMPT(full) [ 738.058572][T18379] Tainted: [L]=SOFTLOCKUP [ 738.062865][T18379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 738.072889][T18379] Call Trace: [ 738.076140][T18379] [ 738.079044][T18379] dump_stack_lvl+0x100/0x190 [ 738.083699][T18379] vpanic+0x553/0x970 [ 738.087652][T18379] ? __pfx_vpanic+0x10/0x10 [ 738.092130][T18379] panic+0xd1/0xe0 [ 738.095822][T18379] ? __pfx_panic+0x10/0x10 [ 738.100215][T18379] check_panic_on_warn.cold+0x19/0x34 [ 738.105567][T18379] ? kcov_remote_start+0x161/0x6d0 [ 738.110672][T18379] __warn.cold+0x191/0x318 [ 738.115074][T18379] __report_bug+0x30f/0x440 [ 738.119555][T18379] ? kcov_remote_start+0x161/0x6d0 [ 738.124647][T18379] ? __pfx___report_bug+0x10/0x10 [ 738.129650][T18379] ? check_prev_add+0xfe/0xe60 [ 738.134387][T18379] ? check_prev_add+0xfe/0xe60 [ 738.139124][T18379] ? find_held_lock+0x2b/0x80 [ 738.143779][T18379] ? unwind_next_frame+0x3be/0x2090 [ 738.148955][T18379] ? __lock_acquire+0xe8b/0x1f40 [ 738.153866][T18379] ? kcov_remote_start+0x161/0x6d0 [ 738.158951][T18379] report_bug+0xb3/0x220 [ 738.163169][T18379] ? kcov_remote_start+0x161/0x6d0 [ 738.168252][T18379] handle_bug+0x16a/0x2a0 [ 738.172558][T18379] exc_invalid_op+0x17/0x50 [ 738.177032][T18379] asm_exc_invalid_op+0x1a/0x20 [ 738.181865][T18379] RIP: 0010:kcov_remote_start+0x161/0x6d0 [ 738.187563][T18379] Code: 48 85 db 74 0e 4c 3b 33 74 6a 48 8b 5b 10 48 85 db 75 e9 48 c7 c7 80 6b e7 8f e8 3a 04 cb 09 eb 0c 81 e2 ff ff ff bf 74 a8 90 <0f> 0b 90 e8 37 24 c8 09 44 8b 15 90 ae 8e 1a 89 c0 48 03 2c c5 20 [ 738.207138][T18379] RSP: 0018:ffffc900049b6e80 EFLAGS: 00010002 [ 738.213194][T18379] RAX: 8000000000000200 RBX: ffff8880b8329220 RCX: 0000000000000001 [ 738.221140][T18379] RDX: 0000000000000002 RSI: ffffffff8e3bd91c RDI: ffffffff8c625680 [ 738.229094][T18379] RBP: ffffffff958e3220 R08: ffffffff97955658 R09: 000000000000004c [ 738.237037][T18379] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888038754b00 [ 738.244980][T18379] R13: 0000000000000200 R14: 0000000000000000 R15: 00000000ffffffff [ 738.252934][T18379] ieee80211_rx_list+0x576/0x2160 [ 738.257954][T18379] ? lock_acquire+0x1d1/0x380 [ 738.262629][T18379] ? ieee80211_rx_napi+0x9a/0x400 [ 738.267628][T18379] ? __pfx_ieee80211_rx_list+0x10/0x10 [ 738.273069][T18379] ieee80211_rx_napi+0xdc/0x400 [ 738.277894][T18379] ? __pfx_ieee80211_rx_napi+0x10/0x10 [ 738.283325][T18379] ? lockdep_hardirqs_on+0x7d/0x110 [ 738.288514][T18379] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 738.294302][T18379] ieee80211_handle_queued_frames+0xc8/0x120 [ 738.300263][T18379] ? ieee80211_stop_device+0x14/0x110 [ 738.305622][T18379] ieee80211_stop_device+0x32/0x110 [ 738.310809][T18379] ieee80211_do_stop+0x19fd/0x2bf0 [ 738.315907][T18379] ? __pfx_ieee80211_do_stop+0x10/0x10 [ 738.321342][T18379] ? do_raw_spin_lock+0x128/0x260 [ 738.326351][T18379] ? mark_held_locks+0x40/0x70 [ 738.331088][T18379] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 738.336870][T18379] ? __pfx_ieee80211_stop+0x10/0x10 [ 738.342042][T18379] ieee80211_stop+0x165/0x2f0 [ 738.346694][T18379] ? __pfx_ieee80211_stop+0x10/0x10 [ 738.351863][T18379] __dev_close_many+0x312/0x710 [ 738.356691][T18379] ? __pfx___dev_close_many+0x10/0x10 [ 738.362036][T18379] ? rcu_is_watching+0x13/0xc0 [ 738.366779][T18379] netif_close_many+0x243/0x810 [ 738.371605][T18379] ? find_held_lock+0x2b/0x80 [ 738.376260][T18379] ? nl80211_del_interface+0xb9/0x1a0 [ 738.381618][T18379] ? __pfx_netif_close_many+0x10/0x10 [ 738.386970][T18379] netif_close+0x17f/0x230 [ 738.391363][T18379] ? __pfx_netif_close+0x10/0x10 [ 738.396276][T18379] ? __nla_parse+0x40/0x60 [ 738.400671][T18379] dev_close+0xaa/0x240 [ 738.404799][T18379] nl80211_del_interface+0xf0/0x1a0 [ 738.409973][T18379] genl_family_rcv_msg_doit+0x214/0x300 [ 738.415499][T18379] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 738.421555][T18379] ? bpf_lsm_capable+0x9/0x10 [ 738.426206][T18379] ? security_capable+0x80/0x260 [ 738.431120][T18379] ? ns_capable+0xd2/0xf0 [ 738.435422][T18379] genl_rcv_msg+0x560/0x800 [ 738.439902][T18379] ? __pfx_genl_rcv_msg+0x10/0x10 [ 738.444900][T18379] ? __lock_acquire+0x5c0/0x1f40 [ 738.449810][T18379] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 738.455158][T18379] ? __pfx_nl80211_del_interface+0x10/0x10 [ 738.460937][T18379] ? __pfx_nl80211_post_doit+0x10/0x10 [ 738.466382][T18379] netlink_rcv_skb+0x159/0x420 [ 738.471118][T18379] ? __pfx_genl_rcv_msg+0x10/0x10 [ 738.476119][T18379] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 738.481381][T18379] ? netlink_deliver_tap+0x1ae/0xcc0 [ 738.486660][T18379] genl_rcv+0x28/0x40 [ 738.490625][T18379] netlink_unicast+0x65f/0x950 [ 738.495373][T18379] ? __pfx_netlink_unicast+0x10/0x10 [ 738.500626][T18379] ? __pfx_sock_has_perm+0x10/0x10 [ 738.505717][T18379] netlink_sendmsg+0x8b0/0xda0 [ 738.510454][T18379] ? __pfx_netlink_sendmsg+0x10/0x10 [ 738.515717][T18379] ? selinux_socket_sendmsg+0x198/0x2f0 [ 738.521244][T18379] ____sys_sendmsg+0xa4d/0xbe0 [ 738.525995][T18379] ? __pfx_netlink_sendmsg+0x10/0x10 [ 738.531251][T18379] ? __pfx_____sys_sendmsg+0x10/0x10 [ 738.536519][T18379] ___sys_sendmsg+0x190/0x1e0 [ 738.541179][T18379] ? __pfx____sys_sendmsg+0x10/0x10 [ 738.546353][T18379] ? futex_wait+0x11e/0x370 [ 738.550834][T18379] ? find_held_lock+0x2b/0x80 [ 738.555512][T18379] __sys_sendmsg+0x160/0x210 [ 738.560079][T18379] ? __pfx___sys_sendmsg+0x10/0x10 [ 738.565170][T18379] do_syscall_64+0x123/0x790 [ 738.569738][T18379] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 738.575603][T18379] RIP: 0033:0x7f624679e559 [ 738.579991][T18379] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 738.599569][T18379] RSP: 002b:00007f62476a4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 738.607949][T18379] RAX: ffffffffffffffda RBX: 00007f6246a25fa0 RCX: 00007f624679e559 [ 738.615889][T18379] RDX: 0000000000000000 RSI: 0000200000000880 RDI: 0000000000000004 [ 738.623833][T18379] RBP: 00007f6246835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 738.631778][T18379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 738.639723][T18379] R13: 00007f6246a26038 R14: 00007f6246a25fa0 R15: 00007ffe508ab5e8 [ 738.647674][T18379] [ 738.650906][T18379] Kernel Offset: disabled [ 738.655213][T18379] Rebooting in 86400 seconds..