last executing test programs: 11m43.594968424s ago: executing program 32 (id=1843): r0 = fsopen(&(0x7f0000000080)='cgroup\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syslog(0x2, &(0x7f0000002e80)=""/44, 0x2c) 11m43.212190563s ago: executing program 3 (id=1845): socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0), 0x111, 0x8}}, 0x20) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r2, 0x4236}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x8000001, 0x0, 0x2, 0x1}}, 0x20) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 11m43.119765628s ago: executing program 3 (id=1847): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r1 = memfd_create(&(0x7f0000000740)='yq\xd4\x83\aDr\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98)\xba\x1c#\xae\xd5\vS7\xc9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc4\x19\x9f\xd9?!\xfdH\x11\x19\xf4aX8!\x8c\xedn\x17N\x00`\x18\x00\x00\x00\xfb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1b\xd3\x90\xaa\x0e4+\x9f\xdd\xe4\x17\xfe\x7f\x9d\xa50x0, 0x29, 0x3, 0x8d, 0x6, 0x1, @private1, @empty, 0x7800, 0x0, 0xef5e, 0x5}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000100)={@multicast2, @rand_addr, 0x0}, &(0x7f0000000140)=0xc) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, 0x0, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [@ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x40810}, 0x8040) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000280)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r3 = accept4$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000300)=0x1c, 0x80800) setsockopt$CAN_RAW_RECV_OWN_MSGS(r2, 0x65, 0x4, &(0x7f0000000340)=0x1, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000380)={{{@in=@local, @in=@empty}}, {{@in6=@private0}, 0x0, @in6=@mcast1}}, &(0x7f0000000480)=0xe8) memfd_create(&(0x7f00000004c0)='%/$&!-:,+\x00', 0x1) r4 = socket$can_bcm(0x1d, 0x2, 0x2) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), r2) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000000ec0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20000008}, 0xc, &(0x7f0000000e80)={&(0x7f0000000580)={0x8d0, r5, 0x800, 0x70bd29, 0x25dfdbfc, {}, [@ETHTOOL_A_FEATURES_WANTED={0x4e8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x38, 0x3, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xe, 0x2, '%/$&!-:,+\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}]}]}, @ETHTOOL_A_BITSET_VALUE={0x50, 0x4, "67c1ab01f4859d62a831a766eb7605a74f3f4d3014a8b604a50e4c6afc0b5f7fb8e5d1cfd914e3500c7584c807d8ea999dfe75bb6ec2d362eac9f64534c056da7e092b52caf87d05a7eea996"}, @ETHTOOL_A_BITSET_BITS={0x68, 0x3, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xae}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '\xa8\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'syztnl2\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xffffff60}]}]}, @ETHTOOL_A_BITSET_BITS={0xbc, 0x3, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '\n\'\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x28}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x96}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '{#\x00'}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'syztnl2\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x401}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '\'%\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xf43}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '#]\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, '^*:\'\\\x9c\v\x00'}]}]}, @ETHTOOL_A_BITSET_VALUE={0xb9, 0x4, "7852bfbc55b48a39a2b73e20df3e9396fa64cb714bef6ad07e4ca172a96eae8127bd95da3a16ea951f6e2dfa9d05a6487f31c308ff1e16b3eba6a1d1805a04cfa12ac0e98424a73c16841c35c6b993fea9c86aa55841df1018d8ebbf0dd65b0799d24267cb1489452a2ed734e2987a7470977304bebb1e0035eeaad50d959202ba1b6cca6018a95b073b803a520e40dc60b9608bcc6e9bf3c22b298785c68a175f49b7aa00d21f8559129d10a945082045d26b01d5"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x8}, @ETHTOOL_A_BITSET_SIZE={0x8}, @ETHTOOL_A_BITSET_BITS={0xc4, 0x3, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xa}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ip6tnl0\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'syztnl2\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xa28}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '/\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_NAME={0xe, 0x2, '%/$&!-:,+\x00'}]}, {0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1841}]}, {0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '&\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_MASK={0xf1, 0x5, "0a8fbfa7b38d1475c820d79cebec0fa1a8ca8b94e9fc9b75cf925cf54ecbb7fa4f2df65ab79e12ef475bdc1e142f14a3234e1d179f80c5c3435ebfdb9e64843b01627f765ae537d712568454916813c81edc386058f64d25bd56c39232b963c67fbc3c255f46b066e281defc9ed6319e7b06fa4c629d8b97b304dea0a71cd964c4bff5bf73830ffe30d7f204e71cd7d4c4ecf4de0c4aae92507e7455de6b1afb7f87ebc7339e559a790f4605c243b90cd4299e66624ae760d11699c165f4b38e721d2f0068a9ab88dcbf7eee2e41cdd04d1a8454d49603c7c0b101c574fe5a45092792726c84d2dc31f9ee16b4"}, @ETHTOOL_A_BITSET_BITS={0xb4, 0x3, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '#\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xfffffbff}, @ETHTOOL_A_BITSET_BIT_NAME={0x13, 0x2, '\x96%{`/$-&]&(,!]\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '!@\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xe, 0x2, '%/$&!-:,+\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'syztnl2\x00'}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}]}, {0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xc}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}]}, @ETHTOOL_A_FEATURES_HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_FEATURES_WANTED={0x164, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x8e, 0x4, "adaf5641d267b619f5785ba1fdf735d284e06b9b426ea3b113d2ad7bdca71010a0bd13fafac95eae666510605c3f68c1f6983c9f63f8830f9966b9b4c2a883ad432ee589c96b99aef15a627598573d494a71da6af8e8f99cf5b4fb7ddffba0e566dbc4439ff37211b102addfdc0cb27e92ad0d270acce4856c20908b8e457804c3160c01f9d4d15aab87"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x100}, @ETHTOOL_A_BITSET_VALUE={0x92, 0x4, "30e335a01eff25c9779fd281c3fbd0a49b4b73179bff179702da7c24504286fe8706b1b02fb34a4a334770196e91dfb74b77f2f288ced0cdc556bee62a1ff4378b8b5551db7e8f14cda292f87d0caccaa222741ec27623f7a38ee6ed550a57ca530c358e1f266727d498c226ef619e3bbef5e0c0d6344a2b9e84839f3803337acd303700bff58385a5df9a9cb4ac"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x9}, @ETHTOOL_A_BITSET_BITS={0x2c, 0x3, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'syztnl2\x00'}]}]}]}, @ETHTOOL_A_FEATURES_WANTED={0x224, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0x102, 0x5, "341802a85b7b66db41e2cf6c9c2ae51fddf752fdc651991fd7b4975f38d1cce242c527070843b8674383a20f3aae9e356c156e92ba43944a3a21e95631e9edd7cd0ac172910e4b749dcf199db3169405cf4df7e3960daa4f6cee2a73ba1bdf4153bc730b06bb731586e5aee083ddc8637691ffe43441c2064fd2d05f5f32423880ef7e77de84981fe163fc2deb9f0d0ce58398f60a5791b47c7c5f9d9640ac6d5845fbdf78a535d48bba067b15a28f45b1eda2a9a17f7fb8b1f5b8cdaedadea77cb1b2856f7965125f6e47ac846027c19387c87b0e43fdc335e0d6320711c6373043f24f0df89425a75c9f4b5126839b9fbb15146d052acfc4150cc2997a"}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x118, 0x3, 0x0, 0x1, [{0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'syztnl2\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x11, 0x2, 'team_slave_0\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7fffffff}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '-/}\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, '\']:{$\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xe, 0x2, '%/$&!-:,+\x00'}]}, {0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x11, 0x2, 'team_slave_0\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5c}, @ETHTOOL_A_BITSET_BIT_NAME={0xe, 0x2, '%/$&!-:,+\x00'}]}, {0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '\\(\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8b0}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, '-/$-\xea]\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x4}, {0x4}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x11, 0x2, 'team_slave_0\x00'}]}]}]}, @ETHTOOL_A_FEATURES_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}]}, 0x8d0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_open_dev$sndmidi(&(0x7f0000000f00), 0x5000000000000000, 0x2) syz_io_uring_setup(0x12d7, &(0x7f0000000f40)={0x0, 0xacf8, 0x4, 0x0, 0x0, 0x0, r2}, &(0x7f0000000fc0)=0x0, &(0x7f0000001000), &(0x7f0000001040)) syz_ublk_setup_io_uring(0x7766, &(0x7f0000001080)={0x0, 0x505c, 0x10, 0x3, 0x17c, 0x0, r2}, &(0x7f0000001100), &(0x7f0000001140)=0x0, &(0x7f0000001180)) r8 = syz_io_uring_complete(r6, r7) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000011c0)) recvmsg$kcm(r8, &(0x7f0000001580)={&(0x7f0000001200)=@qipcrtr, 0x80, &(0x7f0000001440)=[{&(0x7f0000001280)=""/39, 0x27}, {&(0x7f00000012c0)=""/136, 0x88}, {&(0x7f0000001380)=""/6, 0x6}, {&(0x7f00000013c0)=""/65, 0x41}], 0x4, &(0x7f0000001480)=""/240, 0xf0}, 0x40002001) r9 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000015c0), 0x2000, 0x0) ioctl$KDADDIO(r9, 0x4b34, 0x5) syz_clone(0x800, &(0x7f0000001600)="7803a532d495b4a83b0492345a247bf7bcb0563dd9d022a89a22ce39b7398654c75f65de9fdc4f78640e7a6c703bd9df8c4029eed1f6bb4eea21ad9e4434ee0a8ef61ddefd7451802c1d684eae65472ee5ee0a754b970fb64baaa5bc29c7e2b3d806cfb03e657926e6eca9af450608b95de966a885d2a6c5b4e2b062bcd53e6934c7c2ad40772dd2b225f665d23e1f29ceb9fcbc85343b3a290450aa2c59b03d527a7c4806c1545ea958f766fd1ef27c18f8c27d90c9d9d7a186bc9f43c23c040af34cbb382617b332930f7bd79b660c", 0xd0, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780)="95ed54654cd6e9bd553413ad976f7fe3d536b45717e28d6a3978a48f7962e13575ebbfe12f0bf521b093c16f0c0fe249f670237be3946a79a7de0c72ec3f90715173e816982d7c24872aefdde934bb56cf37f33795b9cdbe535141e196909ded16f233b23f8984619e1638f97df4bb330ba961c80197bc62024d83681546516be41ccd4be46948cde2ed16aff1bfc9d0bc01ee923554e6af57e7e67a6b54857c1b") ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x541c, &(0x7f0000001840)) ioctl$OCFS2_IOC_GROUP_ADD(r9, 0x40186f02, &(0x7f0000001880)={0x9, 0x1, 0x1, 0x1}) clock_adjtime(0x1, &(0x7f00000018c0)={0x5, 0x0, 0xfffffffffffffffd, 0x2, 0x40, 0x7fffffff, 0x7fff, 0x5c, 0x4, 0x5ef3, 0xfffffffffffffffa, 0x4, 0x1, 0x80, 0x400, 0x6, 0x5, 0xd, 0x7, 0x7, 0x1, 0x3, 0x0, 0x6, 0x4, 0xf38e}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r2, 0x3b87, &(0x7f00000019c0)={0x18, 0x1, 0x1, 0x0, 0x0, 0x10}) r10 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCSETD(r10, 0x5423, &(0x7f0000001a00)=0x1) ioctl$SIOCX25GDTEFACILITIES(r2, 0x89ea, &(0x7f0000001a40)) ioctl$BTRFS_IOC_DEFRAG(r4, 0x50009402, 0x0) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000001ac0), r2) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r8, &(0x7f0000001cc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x8000008}, 0xc, &(0x7f0000001c80)={&(0x7f0000001b00)={0x150, r11, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x7}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}]}, 0x150}, 0x1, 0x0, 0x0, 0x800}, 0x4) 11m37.127317113s ago: executing program 0 (id=1873): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x50) fstatfs(r0, &(0x7f0000000280)=""/137) 11m36.911868363s ago: executing program 0 (id=1874): r0 = openat$pidfd(0xffffffffffffff9c, 0x0, 0x101100, 0x0) pidfd_send_signal(r0, 0x38, 0x0, 0x0) r1 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000880)={0x34, &(0x7f00000006c0)={0x40, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, &(0x7f0000000100)={0x14, &(0x7f0000000040)={0x0, 0x58cd07f1514132f0, 0x57, {0x57, 0x23, "5c140093112c0104292c45fbdf099fb7f69a55dca3445cc384b8b4cc28ac0a6318ea0234735db926aba713fff8ede3375ac38a755604a5abef76cb58ed580edc0a3ac4c4badddf6dcbec9a46eb4b176ebe7df00e7a"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x412}}}, &(0x7f00000002c0)={0x34, &(0x7f0000000140)={0x20, 0xd, 0x36, "819f06e65c18e33e0725e287793e89149a95223a6c87978388dedef8a2f43e7c0f552c0547bbdf324b54f7af8e7f14d58417f2835011"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x3}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000200)={0xc0, 0xa1, 0x4, 0x72c0}, &(0x7f0000000240)={0x40, 0xa0, 0x4, 0x3}, &(0x7f0000000280)={0xc0, 0xa2, 0x2f, "dd8ad56814a8c7b60d56bd67b9ecde4904fd74ded0693e718599a92f528c4fa4ce002fe6751006b689cbcd2c0fdc50"}}) 11m33.631550679s ago: executing program 0 (id=1880): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2280, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x800, 0x1) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x163042) r4 = accept$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000200)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000240)={'batadv_slave_0\x00'}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000100), 0x13f, 0x4}}, 0x20) ioctl$USBDEVFS_CLAIM_PORT(r3, 0x80045518, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000280)={0x56}) r5 = syz_open_dev$vcsn(&(0x7f0000000040), 0x1, 0x10000) ioctl$F2FS_IOC_DEFRAGMENT(r5, 0xc010f508, &(0x7f0000000080)={0x2, 0x3}) 11m18.045379195s ago: executing program 34 (id=1880): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2280, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x800, 0x1) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x163042) r4 = accept$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000200)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000240)={'batadv_slave_0\x00'}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000100), 0x13f, 0x4}}, 0x20) ioctl$USBDEVFS_CLAIM_PORT(r3, 0x80045518, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000280)={0x56}) r5 = syz_open_dev$vcsn(&(0x7f0000000040), 0x1, 0x10000) ioctl$F2FS_IOC_DEFRAGMENT(r5, 0xc010f508, &(0x7f0000000080)={0x2, 0x3}) 9m24.335750774s ago: executing program 1 (id=2788): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009e173610ef171e7206de0102030109021200010000000009040000000206"], 0x0) r1 = memfd_create(&(0x7f0000001780)='[\vx\'\xa5)\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\x01\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xc7\x91%||\xa0\x8ez\xadT\xc0\f\xe5\x89\xbf3:\x99\x1e\xbd`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x9d\x83\xcd\b\xd1\x02R\x9b7\xaf\xb7o\x01\xf9\x15\xb8KB\x04\x06\xa5\xea\x0ft\xbb\x1er\x14\xdb\xd1\xcd\xfd\x00'/146, 0x1) ioctl$NILFS_IOCTL_GET_BDESCS(0xffffffffffffffff, 0xc0186e87, &(0x7f0000000a80)={&(0x7f0000000980)=[{0x4, 0x5, 0x6, 0x6, 0x5}, {0xe69, 0xf, 0x70a, 0x8, 0x9}, {0xc, 0x6b9, 0x4, 0x1350, 0x200}, {0x6aa, 0x2, 0x9, 0x3, 0x2}, {0x7fffffffffffffff, 0xfffffffffffffffc, 0x5, 0xc, 0x3}], 0x5, 0x28, 0x3, 0x7}) write$binfmt_script(r1, &(0x7f0000000040)={'#! ', './file0'}, 0xb) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f0000000500)=@ethtool_per_queue_op={0x4b, 0xe, [0xffffffff, 0x3, 0x7fff, 0x10001, 0x800, 0x6, 0x5, 0x6, 0x80, 0x7, 0x0, 0x9, 0x2, 0x8, 0x7f, 0x4, 0x3, 0x6, 0x4, 0x5, 0xd33, 0x1, 0x0, 0xaf, 0x7, 0x1, 0x2, 0x1, 0x0, 0x3, 0x67ae, 0x67, 0xe, 0xffff08c6, 0xbb, 0x80, 0x4, 0xfffffff7, 0x79, 0x4, 0x80, 0x0, 0x2, 0x7, 0x5, 0x1ff, 0x2, 0x173, 0x1c00, 0x28e8, 0x9, 0x6, 0x5, 0x1, 0x3, 0x7, 0x9, 0x1, 0x10000, 0x5, 0x4, 0x3, 0x7, 0x8, 0x2, 0x0, 0x1000, 0xe, 0x4, 0x4, 0x8, 0x845, 0x3, 0x81, 0x20, 0x9, 0xff, 0x1, 0x5, 0x80000000, 0xf, 0x7fffffff, 0x0, 0x40, 0x5000000, 0x6e7, 0x658, 0x2, 0x8, 0x7, 0x15fa, 0x9, 0x8, 0x16a9, 0xfffffff9, 0x8, 0x401, 0x5, 0x9, 0x5, 0x590, 0x7, 0x8, 0x9, 0x4, 0x0, 0xa, 0x4, 0x6df, 0x2, 0x9, 0xfff, 0x8, 0x6, 0x1, 0x5, 0xffff, 0x1ff, 0x2, 0x446, 0x3, 0x3, 0x3, 0x1, 0x6a, 0x5, 0x9, 0x3]}}) r3 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000900)='syz1\x00', 0x200002, 0x0) faccessat(0xffffffffffffffff, 0x0, 0x41) mkdirat$cgroup(r3, &(0x7f0000000940)='syz0\x00', 0x1ff) ioctl$VHOST_VDPA_SET_STATUS(0xffffffffffffffff, 0x4001af72, &(0x7f00000008c0)=0x9e) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x74}, 0x1, 0x0, 0x0, 0x44000}, 0x4) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000100)={0x40, 0x5, 0xed, {0xed, 0x9, "5d94a036db05fa2e23e267919a36b78e2e588ff020cc257bf4958f2632e63b1f4b6e57bae8a55b312382a54891127eb892f03eb74bd8238aff5e08ab261be04169899dab5324e737809fec8c0513471a2603fa224b1fb1f2d59679e8c191d0d576e05901ec63b0f732f3dbb2309ed0642ffd4b8278df23fa19d2470318533030b577dd342b3b3a3522fb9ff172e3be1b3348836e485a1b26bcec477e162251d52f0091bd13743fd3166ad1e76f1c4af07e38afb1765873af2d18afdb398cfa412597f7cd51c3761e5faa34841e523f1617501f9e8a941e43ad8b690cec8640a8def3f87a76c2b412028ad9"}}, &(0x7f0000000200)=ANY=[@ANYBLOB="00040304bc"], &(0x7f0000000240)={0x0, 0xf, 0x60, {0x5, 0xf, 0x60, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0x92, "a38167023070684cfb271015e86974a2"}, @generic={0x2a, 0x10, 0x1, "3fc8a815544baa207350a3e40c7e8054f7a0cd5ceabba992074fe013b61c6aa4c2192940759d0f"}, @generic={0x1d, 0x10, 0x2, "c396ffc73e6227a5537d542457d3630029c2ae1c650623902bfb"}]}}, &(0x7f00000002c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x60, 0x25, 0x4, "0e0a6e4c", "df7916a4"}}, &(0x7f0000000300)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x8, 0x1, 0x0, 0xbc, 0x8, 0x951, 0x1000}}}, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x20, 0x5, 0x95, "261d539009ac07a84dc6f719498408a1badc1259fc453531bc267d689e3ba5962ce06aff91ef71c9a4739c7bc07fb30e12467fb80cc1145df1875c3604dba95a5d24f43c12a16fdd73e7e2e8eb72b881082d33be3c48f54c32acf3595c616591c7f04cbdb0c25f3f1df734d6c98ad58a52e4b1e3083be746ed4cf54df15edfbd950af2f1892be1c73c0684f43d8b81464229026e34"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x11}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x8}, &(0x7f00000004c0)={0x20, 0x0, 0x4, {0x2, 0x1}}, &(0x7f0000000500)={0x20, 0x0, 0x8, {0x140, 0x20, [0xf]}}, &(0x7f0000000540)={0x40, 0x7, 0x2, 0x9}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0cf2"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x8}, &(0x7f0000000640)={0x40, 0x13, 0x6, @multicast}, &(0x7f0000000680)={0x40, 0x17, 0x6, @multicast}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "67de"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x5}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x98}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x81}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000040)={0x44, &(0x7f00000000c0)=ANY=[@ANYBLOB="2006d50300005526024b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 9m20.356947168s ago: executing program 1 (id=2823): syz_usb_connect(0x2, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x38, 0xe1, 0xd, 0x8, 0x13d8, 0x1, 0x324c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x22, 0xff, 0x40, 0x4, "", [{{0x9, 0x4, 0x74, 0x3, 0x0, 0x34, 0xa3, 0xf1, 0x63}}]}}]}}, 0x0) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x271c, 0x0, &(0x7f0000000000)) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='task\x00') r2 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r3, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r3, 0x5411, 0x0) gettid() timer_settime(0x0, 0x0, &(0x7f00000002c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r4, 0x107, 0xa, 0x0, 0x0) setsockopt$packet_tx_ring(r4, 0x107, 0xd, 0x0, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x4000) pipe2(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) tee(r5, r6, 0xfffffffffffffc01, 0x0) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r2, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x0, 0x4}) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r2, 0x40146f2c, &(0x7f0000000000)={0x101, 0x0, 0x2, 0x1, 0x4}) getdents64(r1, &(0x7f0000000000)=""/90, 0x5a) r7 = openat$dma_heap(0xffffff9c, &(0x7f0000000440), 0x40, 0x0) ioctl$FS_IOC_GETFLAGS(r7, 0x80046601, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="4701", 0x1c, 0x81, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0xe, 0x6, @multicast}, 0x14) sendmsg$nl_xfrm(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x84200022}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)=@flushsa={0x19c, 0x1c, 0x300, 0x70bd2d, 0x25dfdbfe, {0x3c}, [@lastused={0xc}, @user_kmaddress={0x2c, 0x13, {@in6=@mcast1, @in=@remote, 0x0, 0xa}}, @algo_crypt={0x61, 0x2, {{'xchacha20\x00'}, 0xc8, "7f677d5b797a747a8fa446133932ffaf6446eebfdde916712d"}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x7}, @sa={0xe4, 0x6, {{@in6=@mcast2, @in6=@loopback, 0x4e22, 0x9, 0x4e22, 0xeed, 0x2, 0x80, 0x80, 0x33, 0x0, 0xffffffffffffffff}, {@in=@remote, 0x4d5, 0x33}, @in6=@ipv4={'\x00', '\xff\xff', @empty}, {0x7ff, 0xfffffffffffffff7, 0x5, 0x3, 0x10001, 0x6, 0xf9, 0x5}, {0x8, 0x4, 0x8, 0x39a}, {0x8a, 0x6, 0x4}, 0x70bd25, 0x3505, 0x2, 0x2, 0x6, 0x2}}]}, 0x19c}, 0x1, 0x0, 0x0, 0x20004060}, 0x41) 9m17.173131996s ago: executing program 1 (id=2861): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) setxattr$system_posix_acl(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000380)='system.posix_acl_default\x00', &(0x7f00000003c0)={{}, {0x1, 0x5}, [], {0x4, 0x4}, [{0x8, 0x2}, {0x8, 0x2}, {0x8, 0x5}, {0x8, 0x2}], {0x10, 0x5}, {0x20, 0x2}}, 0x44, 0x2) 9m16.220817531s ago: executing program 1 (id=2872): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'ip_vti0\x00', &(0x7f0000000040)=@ethtool_sfeatures={0x3b, 0x2, [{0xffffffff, 0x468b}, {0xa3, 0x8}]}}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0xfffffffd, @loopback, 0x3}, 0x1c) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCAUSEDIAG(r2, 0x89ec, &(0x7f0000000e80)={0x0, 0x9}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) capset(&(0x7f00000001c0)={0x19980330}, &(0x7f0000000200)={0x200003, 0x200003, 0x101, 0x6, 0x7, 0x8}) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0xc03, 0x0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000080)={{0x1000, 0x7, 0x0, 0x9}, 'syz1\x00', 0x9}) ioctl$UI_SET_FFBIT(r4, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r4, 0x5501) ioctl$VIDIOC_QUERY_EXT_CTRL(0xffffffffffffffff, 0xc0e85667, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) syz_pidfd_open(0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) r5 = open(&(0x7f00009e1000)='./file0\x00', 0x161841, 0x1d2) r6 = syz_open_dev$sg(&(0x7f0000000540), 0xb4, 0x42) ioctl$SCSI_IOCTL_SEND_COMMAND(r6, 0x5393, &(0x7f0000000280)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX]) fcntl$setlease(r5, 0x400, 0x0) setxattr$trusted_overlay_opaque(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, 0x0, 0x1) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r9, r9, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x61, &(0x7f0000000140)=[@cr4={0x1, 0x40be6}], 0x1) r10 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r10, 0x8933, &(0x7f0000000200)={'vxcan0\x00', 0x0}) bind$can_j1939(r10, &(0x7f0000000180)={0x1d, r11, 0x0, {0x0, 0x0, 0x1}, 0x2}, 0x18) 9m15.095312864s ago: executing program 1 (id=2885): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4090}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 9m14.698196768s ago: executing program 1 (id=2892): syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000480)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000fbdbdf250900000005000800010000000800010001000000050007"], 0x2c}, 0x1, 0x0, 0x0, 0x8081}, 0x20000800) socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect$uac1(0x1, 0xdc, &(0x7f0000000000)=ANY=[], 0x0) 8m59.578058981s ago: executing program 35 (id=2892): syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000480)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000fbdbdf250900000005000800010000000800010001000000050007"], 0x2c}, 0x1, 0x0, 0x0, 0x8081}, 0x20000800) socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect$uac1(0x1, 0xdc, &(0x7f0000000000)=ANY=[], 0x0) 7m8.767473406s ago: executing program 7 (id=3357): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000940)={0x34, &(0x7f0000000c80)={0x40, 0xb, 0x1, "9b"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000880)={0x34, &(0x7f00000006c0)={0x40, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) 7m6.067872051s ago: executing program 7 (id=3365): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000005e00010100000200fe683992d2006167"], 0x1c}], 0x1, 0x0, 0x0, 0x1}, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000080)=0xc) mount$tmpfs(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0xe0001, &(0x7f0000000480)={[{@grpquota_block_hardlimit}], [{@subj_type={'subj_type', 0x3d, 'tmpfs\x00'}}, {@fowner_lt={'fowner<', r4}}, {@euid_eq={'euid', 0x3d, r4}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}, {@fsname={'fsname', 0x3d, 'batadv0\x00'}}, {@fscontext={'fscontext', 0x3d, 'root'}}, {@fsname={'fsname', 0x3d, 'batadv\x00'}}, {@appraise_type}, {@fsuuid={'fsuuid', 0x3d, {[0x31, 0x32, 0x33, 0x34, 0x0, 0x63, 0x64, 0x65], 0x2d, [0x30, 0x35, 0x37, 0x7b], 0x2d, [0x31, 0x36, 0x37, 0x32], 0x2d, [0x36, 0x31, 0x35, 0x33], 0x2d, [0x38, 0x8b159501a14d0dd3, 0x61, 0x32, 0x66, 0x32, 0x31, 0x64]}}}]}) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) umount2(&(0x7f0000000240)='./file0\x00', 0x0) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)={0x1c, r7, 0x303, 0x70bd28, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000808bd70004008008cf001040069"], 0x24}, 0x1, 0x0, 0x0, 0x40801}, 0x4) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x1) r8 = dup(r1) write$cgroup_subtree(r8, &(0x7f00000005c0)=ANY=[], 0x32600) write$P9_RCREATE(r8, &(0x7f0000000080)={0x18, 0x73, 0x2, {{0x0, 0xfffffffe, 0x7}, 0x1}}, 0x18) 7m5.133063297s ago: executing program 7 (id=3368): r0 = socket$unix(0x1, 0x2, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) connect$unix(r0, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) 7m5.090651761s ago: executing program 7 (id=3369): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) (async) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) (async) mount$bpf(0x200000000000, &(0x7f0000000100)='./file0\x00', 0x0, 0xb7848, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x9, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x8000, 0xfffff800, 0x1, 0x9, {0x31, 0x7, 0x449, 0x33e5, 0x7, 0x7f, 0x9, 0x6, 0xb96d, 0x2e2f, 0x0, 0x292, 0xccd5, 0xb2, "d98a2d9ffc1092e54c4ede0ca0303888bda2e1e44a234c1330d023cf597b7ba9"}}) 7m5.003599503s ago: executing program 7 (id=3370): r0 = socket$unix(0x1, 0x2, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) connect$unix(r0, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) (fail_nth: 1) 7m4.199941871s ago: executing program 7 (id=3374): syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba"], 0x0) (async) syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x267, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x8, 0x80, 0x6, "", [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x1, 0x0, 0x8, {0x9, 0x21, 0x538, 0x5, 0x1, {0x22, 0x8ce}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x2, 0x9, 0x7}}}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x201, 0x28, 0xd, 0x5, 0x20, 0x3}, 0x1a, &(0x7f0000000080)={0x5, 0xf, 0x1a, 0x2, [@wireless={0xb, 0x10, 0x1, 0x2, 0x8, 0x96, 0x5, 0x3, 0x2a}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x4, 0x81, 0x2c, 0x1}]}, 0x8, [{0xaa, &(0x7f0000000100)=@string={0xaa, 0x3, "e55c4440c05f001a8e3e329e99d12dc50ae7bdc7c481ba846acc2013efd25b80e6e4b4bdad4440e6530826bf324ef1f2ede0bcdf2d2492c54e828cfef4b46b0c34c2a7f0d31284b42a703686f3cbac5e333a63fd92314cdec5dd735380df8ad296c3f0fda7a3c46d9b81041207f031eac88d3943e2ba38bbf5fbf70ca92e655c0ec3375849d1ea57b05b74bee663355c5a78a32e189dff717dd4b67faad6f552c3c5ecb4bd8d9da2"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x1401}}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x408}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x816}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x40e}}, {0xe, &(0x7f00000002c0)=@string={0xe, 0x3, "ea5bc6a364d4e48a75a92939"}}, {0x39, &(0x7f0000000300)=@string={0x39, 0x3, "f6c6120885dc571a999227d62ddc326afef4f82b33933811055205f32f678839f1fa773b45b4e29c03a0878eaf00d379446c56622cccdd"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x409}}]}) (async) socket$inet6_icmp(0xa, 0x2, 0x3a) 7m4.030862348s ago: executing program 36 (id=3374): syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba"], 0x0) (async) syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x267, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x8, 0x80, 0x6, "", [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x1, 0x0, 0x8, {0x9, 0x21, 0x538, 0x5, 0x1, {0x22, 0x8ce}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x2, 0x9, 0x7}}}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x201, 0x28, 0xd, 0x5, 0x20, 0x3}, 0x1a, &(0x7f0000000080)={0x5, 0xf, 0x1a, 0x2, [@wireless={0xb, 0x10, 0x1, 0x2, 0x8, 0x96, 0x5, 0x3, 0x2a}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x4, 0x81, 0x2c, 0x1}]}, 0x8, [{0xaa, &(0x7f0000000100)=@string={0xaa, 0x3, "e55c4440c05f001a8e3e329e99d12dc50ae7bdc7c481ba846acc2013efd25b80e6e4b4bdad4440e6530826bf324ef1f2ede0bcdf2d2492c54e828cfef4b46b0c34c2a7f0d31284b42a703686f3cbac5e333a63fd92314cdec5dd735380df8ad296c3f0fda7a3c46d9b81041207f031eac88d3943e2ba38bbf5fbf70ca92e655c0ec3375849d1ea57b05b74bee663355c5a78a32e189dff717dd4b67faad6f552c3c5ecb4bd8d9da2"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x1401}}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x408}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x816}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x40e}}, {0xe, &(0x7f00000002c0)=@string={0xe, 0x3, "ea5bc6a364d4e48a75a92939"}}, {0x39, &(0x7f0000000300)=@string={0x39, 0x3, "f6c6120885dc571a999227d62ddc326afef4f82b33933811055205f32f678839f1fa773b45b4e29c03a0878eaf00d379446c56622cccdd"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x409}}]}) (async) socket$inet6_icmp(0xa, 0x2, 0x3a) 5m37.366990544s ago: executing program 5 (id=3877): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022400010000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b45"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000280)={0x3, 0x100, 0x10000000, 0x4, 0x80000, 0x3}) 5m34.291374503s ago: executing program 5 (id=3906): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan0\x00', 0x0}) sendmsg$can_raw(r0, &(0x7f0000000180)={&(0x7f00000005c0)={0x1d, r1}, 0x10, &(0x7f0000000000)={&(0x7f0000000200)=@can={{0x1, 0x0, 0x1}, 0x0, 0x1, 0x0, 0x0, "f1a9480e2a5f8784"}, 0x10}, 0x1, 0x0, 0x0, 0xa0}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bb", 0x48}], 0x1}], 0x1, 0x40800) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4000) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0xa0}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) 5m34.017833697s ago: executing program 5 (id=3910): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000000)={0x0, 0x5, 0x400}, 0x8) (async, rerun: 64) fchdir(r0) (async, rerun: 64) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x109000, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r1, 0xc0189379, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) ioctl$PPPOEIOCSFWD(r2, 0x4008b100, &(0x7f00000000c0)={0x18, 0x0, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2b}, 'ipvlan1\x00'}}) (async) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000100)) ioctl$int_in(r1, 0x5421, &(0x7f0000000140)=0x7ff) (async) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000000200)=0xc) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x2, 0x31c, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000240], 0x0, &(0x7f0000000180), &(0x7f0000000240)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{0x3, 0x0, 0x600, 'pimreg\x00', 'ip6_vti0\x00', 'gretap0\x00', 'veth1_vlan\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, [0x0, 0x0, 0xff, 0x0, 0xff, 0xff], @dev={'\xaa\xaa\xaa\xaa\xaa', 0x10}, [0x0, 0x0, 0x0, 0xff, 0x0, 0xc11821d19aaba05], 0xde, 0x12e, 0x176, [@owner={{'owner\x00', 0x0, 0x18}, {{0x0, 0xee01, 0xee01, r4, 0x2, 0xa}}}, @cpu={{'cpu\x00', 0x0, 0x8}, {{0xfffffff9}}}], [@common=@log={'log\x00', 0x28, {{0xb9, "feab04370da638786ba318f4868da2f0a93f200553c8ed8bcb83845c715e", 0x6}}}], @common=@ERROR={'ERROR\x00', 0x20, {"65438f131b674a78f2ad5ceebec015305d01771a951c862dd76c912486be"}}}, {0x3, 0x20, 0xa00, 'pim6reg\x00', 'ip6gretap0\x00', 'batadv_slave_1\x00', 'wlan0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, [0xff, 0xff, 0x0, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x80, 0xff, 0xff, 0xff], 0xe6, 0xe6, 0x116, [@limit={{'limit\x00', 0x0, 0x20}, {{0xe, 0x5, 0x1, 0x7, 0x0, 0x2}}}, @cgroup0={{'cgroup\x00', 0x0, 0x8}, {{0x0, 0x1}}}], [], @common=@STANDARD={'\x00', 0x8, {0xfffffffffffffffd}}}]}]}, 0x394) (async) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) write$bt_hci(r2, &(0x7f0000000600)={0x1, @pin_code_neg_reply={{0x40e, 0x6}, {@none}}}, 0xa) (async, rerun: 32) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000640), r5) (async) syz_genetlink_get_family_id$nfc(&(0x7f0000000680), r5) (async) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_SET(r6, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x30, 0x1402, 0x4, 0x70bd2c, 0x25dfdbfd, "", [@RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r2}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz1\x00'}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz0\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x4008805}, 0x4004080) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f00000007c0)=r3) ioctl$vim2m_VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000000880)=@multiplanar_overlay={0x80f5, 0x1, 0x4, 0x1, 0x3, {0x77359400}, {0x1, 0x2, 0x81, 0xa, 0xca, 0x7, "064b18be"}, 0x4, 0x3, {&(0x7f0000000800)=[{0x81, 0x7, {0x2}, 0x5}, {0xfffffffa, 0x7, {0x9}, 0x4}]}, 0xfffffffe, 0x0, r2}) r7 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000900), r5) (async, rerun: 64) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000980), r5) (rerun: 64) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r5, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x3c, r8, 0x800, 0x70bd2a, 0x25dfdbfc, {}, [@NL802154_ATTR_MIN_BE={0x5, 0x11, 0x3}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x6}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0xe2}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x7}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0x81}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000001}, 0x20008050) (async) ioctl$SIOCGETSGCNT_IN6(r6, 0x89e1, &(0x7f0000000a80)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2={0xfc, 0x2, '\x00', 0x1}}) (async) getpeername$l2tp(r2, &(0x7f0000000ac0)={0x2, 0x0, @loopback}, &(0x7f0000000b00)=0x10) (async, rerun: 32) sendmsg$NLBL_CALIPSO_C_LIST(r5, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000b80)={0x5c, r7, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x40) (rerun: 32) r9 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000cc0), r5) sendmsg$NLBL_CIPSOV4_C_ADD(r5, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x482083}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0xc4, r9, 0x4, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xfb18ccb}]}, {0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x739b6d03}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3fd51210}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3973c513}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x64b43c58}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73139b1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x199acad3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3327061a}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5d0ae26f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x394a623c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2bed4724}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x67}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x16d0a0a7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xfa}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x559e46ed}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x91}]}]}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}]}, 0xc4}, 0x1, 0x0, 0x0, 0x20040050}, 0x801) (async) recvmsg$can_bcm(r2, &(0x7f00000025c0)={&(0x7f0000000e80)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000002500)=[{&(0x7f0000000f00)=""/83, 0x53}, {&(0x7f0000000f80)=""/237, 0xed}, {&(0x7f0000001080)=""/77, 0x4d}, {&(0x7f0000001100)=""/40, 0x28}, {&(0x7f0000001140)=""/195, 0xc3}, {&(0x7f0000001240)=""/248, 0xf8}, {&(0x7f0000001340)=""/253, 0xfd}, {&(0x7f0000001440)=""/74, 0x4a}, {&(0x7f00000014c0)=""/4096, 0x1000}, {&(0x7f00000024c0)=""/41, 0x29}], 0xa}, 0x20000) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f0000002600)={0x2, 0x9, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) (async) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f00000036c0)={0x0, 0x2}, 0x8) 5m33.901574724s ago: executing program 5 (id=3914): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x200000000000, &(0x7f0000000100)='./file0\x00', 0x0, 0xb7848, 0x0) (fail_nth: 1) 5m33.795739728s ago: executing program 5 (id=3917): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi1\x00', 0x20043, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000140)={'8255\x00', [0x9000, 0x0, 0xa1a, 0x4, 0x4, 0x800afa3, 0x4, 0x8, 0x5857, 0x2, 0x7, 0x9, 0x1, 0x5, 0x6, 0x501, 0x0, 0x4, 0x2, 0xa, 0x8, 0xcaa2, 0x1003, 0x20001e5b, 0x2000003, 0xe69, 0x2, 0x4, 0x4086, 0x0, 0x4]}) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0xfa, 0x41b}}}, 0x7) (async) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYBLOB="04008e00080057001b0a000004006c0005"], 0x398}, 0x1, 0x0, 0x0, 0x4094}, 0x0) (async) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007292bd404020305582a80000000109021b0001000000000904000001df7fa9000905", @ANYBLOB="868f"], 0x0) 5m33.069143431s ago: executing program 5 (id=3929): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000dc0)={0x20, 0x16, 0x107, 0x70bd2c, 0x25dfdbfe, {0x1b, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @fd=r0}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) 5m32.862882943s ago: executing program 37 (id=3929): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000dc0)={0x20, 0x16, 0x107, 0x70bd2c, 0x25dfdbfe, {0x1b, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @fd=r0}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) 1m41.335328232s ago: executing program 8 (id=5483): r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x400800) sendto$inet(r0, &(0x7f0000000040)="e00693f68dde1b98f377b04a7de4e01d93215a1bfe80267ecd543f7e153d8b9e46cec1f5e5bd92fb942e895a673e381051e2e50e4e36badc5690f78f8ff59f03f2a6ab9f1678da6d99aa43f5eb251fe0dd54096fdf9ce189afbde5475a", 0x5d, 0x20004884, &(0x7f00000000c0)={0x2, 0x4e23, @loopback}, 0x10) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000100), 0x1a1103, 0x0) read(r1, &(0x7f0000000140)=""/191, 0xbf) (async) ioctl$OCFS2_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000200)={0x2, 0x0, 0x9, 0x1, 0x7ff, 0x9}) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) read$watch_queue(r2, &(0x7f0000000280)=""/228, 0xe4) (async) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000380)=0x3, &(0x7f00000003c0)=0x2) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x90, 0x2, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x4}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x7}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x8}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x1}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0xd}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x40c0}, 0x8004) ioctl$TFD_IOC_SET_TICKS(r3, 0x40085400, &(0x7f0000000580)=0xfffffffffffffff9) (async) sendmsg$AUDIT_USER_AVC(r3, &(0x7f0000001680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001640)={&(0x7f0000000600)={0x1010, 0x453, 0x1, 0x70bd28, 0x25dfdbff, "fe4bf52d1d6237a71fc5778b578d3a1a7020b717b9bd40811c58ca92049bb94d8793f0e40dda8de71e651c2ba1eacf1b8742cd10c5d6e5f1f6ee7c0a717921ddc30d82c536983ab46163c51bcf0ef7e5fdc25fcfacd4e2496e2c002a5d130df7ef1d8a1aeaa2bba93719df97da5b734136438a40dc8877c853625734d674a303fc9c041683bf17a0b720d58a6fb3dc7b05e04a1f9c3340538a75949377c04b794ed95c974f37b767b51721ac5c14b02e1b54c0c5bda393a4e12da995f722653163d5021b5062c1be7a5da757ecf6091aa848f1f20e624661527ab596ac0ad4ef3d840153fca538b90807abfffff704ade597c275d06c452710cca7eb8fddef14775bc019024f5ee431f0d8442df31da6183c63756e9aa686e2efac34d34058d3b2f3338350beee004d486e17b754be2213796273f34d5a696d75f002b3c4ab90fc29b13b2b69eb888f679ac868092daeca09ff4ef41a42eb1242018376c97e810edb00e304f623c2a528182d82ba441c43b7d51fa327c7dc56c1f14c5fd99b250ebe5d0663628819a3290c1d2303811fff4f06be84bb033310f7c982f5bf0350a2986fda5f06516d0961928d9d8175ca4f9a71dee07e93748d7f4e41465aac26b3fcadf208d2cc437596e1c126bddc85e3e0ae6451ea85eb0626b1c240ef4b9fe7e304079f4092a1f765cbf715d1182f36974899c494995af4f8d1c41b0089fd066c1b55b7926864836f09ecfa2f4935879c0c1ee8191e1d76100362b39d5971ace42be4de7be2b15cdbbb2c59059895790dfa3574704b5964ef35e04e9cda0acc4bbf92299f18448d10871ec82775e98cf12352e623788eaef28c8a57f0882bf9c0371cb12cc261b18ace5911b0e3efa1c6f3baa14477401a70bb1dc83c08ccb0339be3fa300ee64172ed92362ef52267dbcf23dd49537f0820347e9645e0452d81153c56bf706496d6139890eca4011302671baf424fc099098cefa0ab7865e7d9b45b819b28ca8e6c17289db99be2693e3c897b809a20a6cdcbb735c9c0d822e8f73223698b3d0cdbb121751c6a50803202a13bdf941d168bf943b7604a6608922e97d07bfb4f7116a52ed9cb2ea451c631d8f94b364a922d05010f6061ad0a89b75d81aad8987a1d68ef58bdb801b99ed73a4725dd352b117267362ef5d51a7b61f6daad2a546110ee34d75249bfa18fc08fff6ec7281034fc16fcb73cec444c0b25a24508aa7f8736b97d7597a0685d35a5b658b2a4515dbea29a698496e2d44943788f44c58889877371875e1b4513a78e30549a7c5c3175a157e2bff14c1917fa8cc8d1e3e7a3e89c87c4f3aa4e2cd0095799aa82a7985a89610e6eb3dd13e66b11d305f5e9b1360eaae5c8bc1cbdf9578349777e8c7fb8760138dfaaa1c744a0eb049a3e4ab3eaefbbb7e8c02728a77bed269c9c35d55da7e0796d0de8ef0d62a88d4c9e7ea91897c42c2b990079710e1664f089cec057eb8886f2e2a1feb939abc58eace073ee2bbfebe6458db8ed09470796debf2ce0a9dfa45d9fe4bea6767bdac6d49af70887384f5d2b6d6214258b74081f4c32d40934604f4f2cbde4782268d34a971a21f74646ecc388506bf33fc1627eba82e9ea56d6e7438594421321990a0e800c8918a732fffea4dc0abeb4c4e9a9b4be69d50f4c912b6605a5d02d4898278ce3503ec8cccb4be26f6bfd1e05567fd5732d408d0fefed6a864882351afa5b0c75f26b3a45fe107ad0ce87b089132065a4ceff4bb2b178efb8a1f3889130b9f17911efa5f75b468670ea21e93e83a25e7e3181349bfc15413c65fe3a5d8b3372486dee93857a8010500bbca5f74ee6a70a99b9423c911373b5d5f2aa3e2f7ef5e5e8f4a524685c20dd8835b946e63579ab2b24f480c3082d84ea1172d244a2b9714d56c54af5ddd2e75fe25610f7dd5f943abfe883b565bd9cfae5a087c37935f160aed56305a1165d96dec359b266779d1c3057a7f3f64d40adec9e1759dc9c237242a80ed8a1e25cce8939fece361ff274c0469c08197905d2e56cde184ab9a2f24127580c32ba2795a53ef571a95c88fa4cf505b80f98ed950e4226afd5070c2dabb524b0574aa02cffdbe8be4bb8cb178cd5bfdce0e5c3144717f54e9caaed173f87a9cef78b9646d147220e8ceb661a69d264e8a75f9d6b77e9ba216a46461bb94528464b411246bc97e5e032cccdd2cffd02385794f6bb1d8faaed3798de19439f0af9aed06c0d583c22bcbbfdae5cea2d84ce0a24657e7339538430e8649ae6dbdd40eb31d500d7380f6e797717182dcf3358deccdf49076fa3ae7686782bffeb131cb6df2eab1049911092398cdde934c745a6a0d09741a4520593d966c8db1c3eed80af3b49f5f434f519087ccc51e605aebd5f88d24a63ffd2692e2779ac0fa4c7757c8e2b5e5a74fd657c8eab27a177a838ef9f9fb70d123f09c37d804093e2c8416003e1d5cfa5a56a58f1f784829c6835ec8cb44d99e5f63f5842e3bfbed4bd80bdef82c80b009e025a13c2268c18d535fc3166741adf4a9a6f3ba5e3359db0cb17cb9a897c403af7de7486a8c93515b1d18a947bd69141eca8be380d15fb12b228627e6ba6a2ca53dc67de64f65083e866715f95ea6cdcae340f9e01e189cb557b0e8667b2bdf6e3af1ae5cf81d7f2812796d33b35c443e1c2e505acb24ab3682ed79beeffbd8956811f326e3c7d278f6bb421554f780f06772281820d9d246684280651878a887f3f058abd5bdf461b05994cbbc838d6af8a55d3929cdbe281a4bf6a285a5bdd32fe68e7612fc50984117674cce51dee3257dd3c818ba718be95857e6310c078b7a6dfaed7e886d916810ef07fed2981418dca33a0935a3d4a92ba15ed4c681c1631cc032a5cc6ee378590d5eea7244a57a54d55ea7f984a905c92d6a5698b88a62369889be8eead48b9addaddb02b1641040b203ccd798c6051fe8a706395ddfab8c04a0eccf1dbf7763ca99560f43f7540f3a6650ec5480f7fad43a7b8f8f8c7144f787066ca312bf2e6857022d4283d2acad32bf7c82234946d536a2015f70fae94b503aeeba2475fe9f42b99edf522349a63d178352bf8fc780c5d780c340db4d40daf07dca748cb029c40a40cba71e3daec659a9bcb78f0067185ca37b24ec7a283a3c5f4b9af60edc7dacc09d163ab2968d2754c7be8b3bc86bd5df5af28bf34c67148d14eb88f2dc722b61653521d6fbacb16d5078852cb03e4b4e3428abe5a1b1aa541179dd3640579ed1ed24a3eab7913ce233c6ac6b0ee2f63a58ac7e65075f76127d03a30fc49e4b8a9954c24a3aa1b7db1300e4c9b82a98356956e32fc90a2d935ae78ec054b23565ad4363c9b8009e28a7299e7f805b595fff79989031a327de4fa4540e6215e8702936803ba33ae0e169649f68d7002b15ccb06b1b0739c600d79f4bf29e929fc62029fcde7a1cafec19ecaa9dd559bce6440d18913ff5a22fc1e92695c0ef7c954ba681c53d5ef38d3312357526a4efd9bef698bc9a96e3c8c1df20ec341a7490e187434cd4f36ed785de887fcdcc798555f5383dd97a4509cdbe69dd412d6366cfb274a41b7d30e6c37d2e1957e4fac3e959257a72c15ab5cf00d229f86cb1c8b92cde091ecb7f588c3bc5d3e8d60d4ca51d0b3250ca8d8d8a84de03a7dd34d51d8e1a523d2009e7ae665c0ae5f5aa430613b2bd37b92a257c8b21c3c1b6fd204982338669c23fd1780403302f2988c7270060240c6dcd0d0c2f729bce7addae0579ce6deee9acbc87456d7178c8be90fa9b6d18c551c9cbc5f4ff6d06b212dc79ed012d1ed4015ed6dcaf249994cbfda5cbb6018f56dbcdab815075372b6900dd981c430780e1f6a0b9d3fad03c6f0c21ccfb895c43bba69fe2409ddc38c2225d819345ef4a1365fc1b160612e62bd401dc708e9d0fd2290bfbcd27b2775b48d7894ede6af10d97c94d85faa318ae26a79b0fc58f0bfb0b6b502d57dd5235b66af796c430dc6b176d5e11393245103cfd95a6f6435b1acaf3723a924185969a62efcf91bf882f553c15c0967f7dac9fd7998156b941ad1ec33769388d01570f7837eabe69e9168a9df1a7d2020cf52158f577d5380426515b553a5397cdfb65ebcaeb17c5395000c3a88a817eb4a5264a83ded5bd550c29b03a55320fb44347f5cce5a7ca7d2cecccaabeb797aee77c335d1cca274c676c4665acf3e6defa793119857e022d8f82e739f0e0c0907b587a66285df63f6f219b04c83600b8ac9832a1f89ec43d25250b2f4b17adf74e8ee2c8acaa7fb55afaf5380da498b2bc4bfe0ebafaab4cebec05b69992717f5d9f55e01a7ed40d20cf70efe346da1fbdf9dd39604d1482992e1d90c553fcbd3be4bd03a4216b14a53ce69e3a4553b6e5f1b430d27bf9a222a0998be1f85ebb0afc9f9b2da91bf481fd13a5e301b3d2e47c425c4d9cc3fa38709bf140c11d77c54068ada26d7fc49ee59b601b903ec3d5ae5e270e96a0b76ca28d11291339950aa082e6fd3be252b6da85a1bc225eb399c2b454d60bf5c74caa901c453b27b9f7596bb87a1d60f4a29967ee7e706e84df30fe76d3769c571def6059a5dc2d6f961179a14d91dbcf2a9ba269c5cf5b9e3e80c238d40737a2ebf6770876310ecf59a723afcabde08e08eb1a0a9c51d9b0c3b87be3e5cb8e811431c7946c974964a06207b4003a51871a877d562bd0cdea703b277233120fc603d17954dab373491bdfb6c8c2bc80d02929005e3e918cbeef99764049937b8e8a91480c945d3b7f8ae7de34bf7f7bcbdb3eac66a3a47faa03d275de79889a199c4b3a99a0861a62098c175211dc98bef593c0c9491e13432e3037ff71e339eadbfc33aca95de55ef0c343f52d41e1cb826014b7a36aa8d02f7d904288bcb401a7f2e056382ba00b43616c35ab9f4da2d60fd1f944c23c8eb97f814666e3f6877f309b1fc0708d53b62836665c1b7ab2a869349abd3d9a28d581ec64b902cb2bcffe442cfb448400c48904a11e816c43cc9c30cc3a85f542174f640957853b1d7ac595d8b22400b13d070588be1d07f5ed5a977498437633dde17b9d220267d109f1c16e36ec614932ea914fc029417ef7aed6319aeb7c1fd15e71bf5786f9a60524585b75ec88cb4dc25222fab948d6797fd955a13d1fe7cb88e6893f6abc67b7d0e546091513dd4969c2905d4d95cae91d3b2dd07aa5d85bd6c5779f365f21ed1334961d45db5f37db43ec20dd07df27c28a7df1fd14cb50b504266116f4047c2bebf6b00225a3dcbf08bdeba4a1460ebb98d357fc0e847795bdb9d27f89862371f122ba523a01df221d33b3e6a8956d1aa0b6bfff446302145f350cfcd2e755258a5dbde6c2a4c95878e9a0ab558206559ff04f59f81dd388ddeaad1458a8ee5ca88607623fecab72f7ee26b879ddb6e2b4045910b8dff23b7dd8ff4a6425d54db43d40b5a31c555782b93efdd1827cac6b872d928aafca0523755707cc2d756eb74c7299aac5b704fe3c6d4814f2912f2ef4bd4f9d5c73b9a647ee794a5d08411435fcea91b049d33cf6c380e1c6ff25370116c6ff840860dbf5a25d03a99c626205e143b3c1a8129f88342006785aed61732799f4bae8ae2b8d7f9c5b82707fcf2edb2d7c9fa32ef9b395ece2cf4318828f9b3fbc3986529d724685be4d9139454969726e08108ef7df866b3e8f19f43b4a30dd95684207118f26edd18491a0b74a14955e452656197c86eec8554769ed2dc856c6f212699af19664bcfd74e6abc81bef554b7f3fce8979fab73ea8c055ed4", ["", "", "", "", ""]}, 0x1010}, 0x1, 0x0, 0x0, 0x4015}, 0x4000) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f00000016c0)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_GET_DEV_STATS(r4, 0xc4089434, &(0x7f0000001ac0)={r5, 0x8, 0x0, [0x0, 0x28000000, 0x8, 0x5, 0x100], [0x3, 0x6, 0x5, 0x6f, 0x5, 0x7, 0x6, 0x8000, 0x6, 0x2, 0x3ff, 0xe5728cb, 0x8, 0x7f, 0x3f85, 0x8, 0x21da, 0xc0, 0xf, 0x7, 0x6, 0x6, 0x3ff, 0x2a3, 0x8, 0x1, 0x4, 0xffffffff, 0xa57, 0x5, 0x8000000000000001, 0x7ff, 0x5, 0x80000001, 0x4, 0xd, 0xbf9c, 0xffffffffffffffff, 0xffff, 0xc137, 0xffffffffffffffff, 0x7, 0x3, 0x4, 0x10001, 0x81, 0x31b3, 0x3, 0x7665, 0x2, 0x4, 0x5, 0x1be4, 0x96, 0x10, 0xd54, 0x5, 0x3, 0x1, 0xbb0f, 0x589d, 0x8, 0x9, 0x8000, 0x3a, 0x9, 0x101, 0x2, 0x100000000, 0x6, 0x1, 0x8, 0x7f, 0x2, 0x7ff, 0x5, 0xffffffffffffffff, 0xffff, 0x9, 0x0, 0x100000001, 0x7, 0x5, 0x8, 0x0, 0x0, 0x200, 0x8, 0xfffffffffffffff8, 0x2, 0xb, 0x8, 0x1, 0x3ce, 0x4e90, 0x4, 0xa, 0x10001, 0x9, 0x80, 0x1, 0x7, 0x4, 0x7fffffff, 0x7f, 0x10001, 0x0, 0x3a, 0x54b9, 0x7, 0x3, 0x8, 0x7f, 0x8, 0x8001, 0x9, 0x6, 0x30000, 0x5, 0xffffffffffffffff, 0x4]}) read$watch_queue(r2, &(0x7f0000001f00)=""/115, 0x73) (async) r6 = syz_socket_connect_nvme_tcp() sendto$inet_nvme_icreq_pdu(r6, &(0x7f0000001f80)={{0x0, 0x7, 0x80, 0xe}, 0x0, 0x0, 0x2, 0x5}, 0x80, 0x0, 0x0, 0x0) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000002000)) (async) close(r1) (async) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000021c0)={0x2, 0x1, &(0x7f0000002040)=""/223, &(0x7f0000002140)=""/12, &(0x7f0000002180)=""/42, 0x40000}) (async) pipe(&(0x7f0000002200)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000002240)=[{r8, 0x251}, {r4, 0x20}, {r3, 0x20}, {r1, 0x50}, {r1, 0x2000}, {r0, 0x2000}, {r1, 0xf672}], 0x7, &(0x7f0000002280)={0x77359400}, &(0x7f00000022c0)={[0x7]}, 0x8) (async) ioctl$XFS_IOC_DIOINFO(r8, 0x800c581e, &(0x7f0000002300)) (async) r9 = signalfd4(r0, &(0x7f0000002340)={[0x3]}, 0x8, 0x0) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000002380)={{r0}, 0x9, 0x668, 0x8}) (async) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r3, 0x2) (async) ioctl$vim2m_VIDIOC_S_CTRL(r7, 0xc008561c, &(0x7f00000023c0)={0x5, 0x7f}) (async) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000002400)={0x1, 0x2}, 0x2) (async) sendmsg$NFNL_MSG_CTHELPER_GET(r7, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000024c0)={&(0x7f0000002480)={0x28, 0x1, 0x9, 0x201, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x7}}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x80}]}, 0x28}, 0x1, 0x0, 0x0, 0x880}, 0x4) (async) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x1a, &(0x7f0000002580)={0x5, &(0x7f0000002540)=[{0x7, 0x4, 0xd, 0x7}, {0x7, 0xb7, 0x4, 0x1}, {0x7fff, 0x3, 0x1, 0x6}, {0x3, 0xff, 0x0, 0x7fff}, {0x9, 0x5, 0x8, 0x1}]}, 0x10) 1m40.791973819s ago: executing program 8 (id=5485): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, 0x0) (fail_nth: 1) 1m40.027870569s ago: executing program 8 (id=5492): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=ANY=[@ANYBLOB="5c01000010000100feffffff00010000fe880000000000000000000000000001fc010000000000000000000000000001000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c00000020010000000000000000000000000002000800000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000070000000000020002000000fcffffff000000002abd700004350000020001002000000000000000480003006465666c61746500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000240009000f00000000000000cbedf13d87ef000009000000000000000001"], 0x15c}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) openat(0xffffffffffffffff, &(0x7f0000000500)='./file0\x00', 0x280000, 0x20) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000940)=@newsa={0x140, 0x1a, 0x803, 0xfffffffe, 0x100, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x717, 0xe23, 0x5, 0xa, 0x0, 0x20, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, {0xfe, 0x6, 0xedcb, 0x10001, 0x8251c, 0x5, 0xfffffffffffffffc, 0x4}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0xfffffffe, 0x3f9}, 0x7e, 0x3505, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x5}]}, 0x140}}, 0x844) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') openat$cgroup(r3, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r2) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x14, r4, 0xba87317d461c07c9, 0x70bd3d, 0x4004}, 0x14}, 0x1, 0x0, 0x0, 0x40000c9}, 0x1000) 1m39.676442431s ago: executing program 8 (id=5494): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x18f881, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) 1m38.904163944s ago: executing program 8 (id=5495): socketpair$unix(0x1, 0x5, 0x0, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = dup(r1) write$UHID_INPUT(r2, &(0x7f0000002080)={0x200f, {"20e30a30ed0d09f91b5e070987f70e06d038e7ff7fc6e5539b0d3e0e8b089b3f363063030890e0879b0af8c6e70a9b334a959b669a240d0a0af3988f7ef319520100ffe8d178708c526db51b1b5b31070d0773090acd3b78130daa61d8e8040001000000b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19300305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f6709000000a141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a027d5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf050000008000000000f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b3f3f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7af1d0e54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c01008e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2f5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d21488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e1a63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e09d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a603336c00000077cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046ca5b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe6531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e6586df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59555e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0d8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb601203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f900000930dedf800", 0x1000}}, 0x1006) write(r0, &(0x7f0000000000)="1c0000001a94", 0x6) 1m35.911430822s ago: executing program 8 (id=5501): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r0) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x14, r1, 0xba87317d461c07c9, 0x70bd3d, 0x4004}, 0x14}, 0x1, 0x0, 0x0, 0x40000c9}, 0x1000) 1m35.607147117s ago: executing program 38 (id=5501): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r0) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x14, r1, 0xba87317d461c07c9, 0x70bd3d, 0x4004}, 0x14}, 0x1, 0x0, 0x0, 0x40000c9}, 0x1000) 1.474318601s ago: executing program 2 (id=6216): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB="020300030f0000002cbd7040fcdbdf2503000900800000001cdc0dca1d9f68846960e56de42944af030006000000000002004e22ac1414bb000000000000000002000100000000000000070705000080030005000000000002004e22ac14140a00000000000000000200"], 0x78}, 0x1, 0x7}, 0x2000c000) 1.352325632s ago: executing program 2 (id=6219): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x2b, 0x1, 0x1) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x5) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x4e22, @remote}, 0x10) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 1.342895662s ago: executing program 4 (id=6220): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x17d4}}, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) syz_open_dev$midi(0x0, 0x3, 0x4a243) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) r1 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000040)) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(0xffffffffffffffff, 0xc0884123, &(0x7f0000000280)={0x0, "728d0a484585ec93a59baeb6831b8ef110181595fe49bc4ac10b67b1b99eeeaa18e15a525115cc71983456358ceb7e1a6f926168ce0c3c2b0f3513a5f2674185", {0x800000000000004, 0x50000000000}}) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(0xffffffffffffffff, 0xc0884113, &(0x7f0000000080)={0x1, 0x0, 0xffff5f11, 0xfffd, 0xfffffffffffffff7, 0xb, 0xfffffffffffffffa, 0x1fe, 0x4a, 0x28, 0x4, 0x2}) 1.201224508s ago: executing program 2 (id=6222): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(ecb-aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="11da3cf44b1a8c3d8a39ccbd630e8ef9170ccf07ef1800322de53ae3", 0x1c) r1 = accept4(r0, 0x0, 0x0, 0x80000) sendmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000840)="aa88baa4b8c57dc7ef9e4b7de78abde557bdc3ae08f30409e36013f8114df67d25369710b323acbb19c16819f091c1d940cf980cfd5e47da864c585948e2348ab547c6c0b40edea9026a43c26e11797e447c7efc688a946cb2129b4a8bf970b43ef44bec66f062af971893e3cf8dba07", 0x70}], 0x1}, 0x24024894) recvmsg$can_j1939(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)=""/104, 0x68}, {&(0x7f0000002640)=""/4097, 0x1001}], 0x2, 0x0, 0xea}, 0x10021) 1.195440571s ago: executing program 6 (id=6223): r0 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000000c0)={0xdb, 0x1ff, 0xb}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x2, 0x5, 0x3}) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000340)={0x8, 0x8169, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000000c0)={0xdb, 0x1ff, 0xb}) r4 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x8, 0x2, 0x7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000400)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x49, 0x7fff, 0x4}) 1.098562195s ago: executing program 2 (id=6224): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x1d, &(0x7f0000000680)=0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) recvmmsg(r0, &(0x7f0000006fc0)=[{{0x0, 0x0, 0x0}, 0x400002}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)=""/72, 0x48}, 0x81}], 0x2, 0x20000020, 0x0) 1.092234559s ago: executing program 6 (id=6225): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x33ed0000) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r0, 0x0, 0x0, 0x4000000) 1.015070575s ago: executing program 6 (id=6226): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, 0x8) sendto$inet6(r0, &(0x7f0000001300)="92", 0x1, 0x10, &(0x7f0000000240)={0xa, 0x4e1c, 0xfffffffc, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, 0x0, 0x0) 632.636479ms ago: executing program 6 (id=6230): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x2b, 0x1, 0x1) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x5) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x4e22, @remote}, 0x10) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 631.640419ms ago: executing program 9 (id=6231): r0 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000004700)=""/4097, 0xe5c}, {&(0x7f0000002500)=""/4137, 0x1029}, {&(0x7f0000000200)=""/100, 0x64}, {&(0x7f0000000780)=""/175, 0xaf}, {&(0x7f0000000300)=""/184, 0xb8}], 0x5}, 0x10100) 531.506237ms ago: executing program 9 (id=6232): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(ecb-aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="11da3cf44b1a8c3d8a39ccbd630e8ef9170ccf07ef1800322de53ae3b183", 0x1e) r1 = accept4(r0, 0x0, 0x0, 0x80000) sendmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000840)="aa88baa4b8c57dc7ef9e4b7de78abde557bdc3ae08f30409e36013f8114df67d25369710b323acbb19c16819f091c1d940cf980cfd5e47da864c585948e2348ab547c6c0b40edea9026a43c26e11797e447c7efc688a946cb2129b4a8bf970b43ef44bec66f062af971893e3cf8dba07", 0x70}], 0x1}, 0x24024894) recvmsg$can_j1939(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)=""/104, 0x68}, {&(0x7f0000002640)=""/4097, 0x1001}], 0x2, 0x0, 0xea}, 0x10021) 521.319246ms ago: executing program 9 (id=6233): r0 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000000c0)={0xdb, 0x1ff, 0xb}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x2, 0x5, 0x3}) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000340)={0xda2, 0x8166, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000200)={0x200, 0x1fb, 0xc38}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000340)={0x8, 0x8169, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000000c0)={0xdb, 0x1ff, 0xb}) r4 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x8, 0x2, 0x7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000400)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x49, 0x7fff, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000140)={0x6, 0x1000, 0x800}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000002c0)={0x8, 0xd7, 0x8}) 515.23724ms ago: executing program 6 (id=6234): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x33ed0000) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r0, 0x0, 0x0, 0x4000000) 441.748324ms ago: executing program 6 (id=6235): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r1 = socket$kcm(0x29, 0x2, 0x0) sendmmsg$inet(r1, &(0x7f0000007ac0)=[{{&(0x7f0000000180)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000240)="2a69c258ca", 0x34000}, {0x0}], 0x2}}, {{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000480)="7349b402ed", 0x5}, {0x0, 0x11}], 0x2}}, {{0x0, 0x0, &(0x7f0000000b40)}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5, 0x40) connect$inet6(r0, &(0x7f0000000540)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) 440.615793ms ago: executing program 9 (id=6236): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB="020300030f0000002cbd7040fcdbdf2503000900800000001cdc0dca1d9f68846960e56de42944af030006000000000002004e22ac1414bb000000000000000002000100000000000000070705000080030005000000000002004e22ac14140a00000000000000000200"], 0x78}, 0x1, 0x7}, 0x2000c000) 393.83463ms ago: executing program 4 (id=6237): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d006a0f000000e8fe55a1290015000600142603600e120900040044000000a80016000a0001400200000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e97", 0xd7}], 0x1}, 0x0) 363.368216ms ago: executing program 9 (id=6238): syz_usb_control_io$uac2(0xffffffffffffffff, 0x0, 0x0) r0 = openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000040)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0)={0x0, 0x40}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000000)={0x2, 0x4}, 0x2) r1 = epoll_create(0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, 0x0) mknod$loop(0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = syz_open_dev$radio(&(0x7f0000000000), 0x0, 0x2) socketpair$unix(0x1, 0x3, 0x0, 0x0) r4 = dup2(r3, r3) ioctl$VIDIOC_LOG_STATUS(r4, 0x5646, 0x0) read$char_usb(r4, &(0x7f00000000c0)=""/192, 0xc0) epoll_pwait2(r1, &(0x7f0000000280)=[{}], 0x1, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) lstat(&(0x7f0000000100)='./file0/file0\x00', &(0x7f0000001440)) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmsg$alg(r6, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@assoc={0x18, 0x117, 0x4, 0x200}], 0x18}, 0x0) sendmsg$nl_route_sched_retired(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100)=@newqdisc={0x24, 0x24, 0x8, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0x3}, {0x0, 0x4}}}, 0x24}}, 0x0) 334.737547ms ago: executing program 4 (id=6239): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000c40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DISASSOCIATE(r0, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000c80)={0x30, r1, 0x7, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @random="a6d6ba247b16"}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x240c0}, 0x40) 200.715266ms ago: executing program 2 (id=6240): r0 = socket$kcm(0x29, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000007ac0)=[{{&(0x7f0000000180)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000240)="2a69c258ca", 0x5}, {0x0}], 0x2}}, {{0x0, 0x0, &(0x7f0000000940)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f0000000b40)}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5, 0x40) 135.556321ms ago: executing program 4 (id=6241): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(ecb-aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="11da3cf44b1a8c3d8a39ccbd630e8ef9170ccf07ef1800322de53ae3b183", 0x1e) r1 = accept4(r0, 0x0, 0x0, 0x80000) sendmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000840)="aa88baa4b8c57dc7ef9e4b7de78abde557bdc3ae08f30409e36013f8114df67d25369710b323acbb19c16819f091c1d940cf980cfd5e47da864c585948e2348ab547c6c0b40edea9026a43c26e11797e447c7efc688a946cb2129b4a8bf970b43ef44bec66f062af971893e3cf8dba07", 0x70}], 0x1}, 0x24024894) recvmsg$can_j1939(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)=""/104, 0x68}, {&(0x7f0000002640)=""/4097, 0x1001}], 0x2, 0x0, 0xea}, 0x10021) 134.02779ms ago: executing program 9 (id=6242): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x2b, 0x1, 0x1) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x5) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x4e22, @remote}, 0x10) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 97.556998ms ago: executing program 2 (id=6243): r0 = syz_open_procfs(0x0, &(0x7f0000000180)='wchan\x00') r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) pread64(r0, &(0x7f000001a240)=""/102400, 0x19000, 0x41e) 97.381963ms ago: executing program 4 (id=6244): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c020000", @ANYRES16=r1, @ANYBLOB="01000000000000000000010000001400020077673100000000000000000000000000f4010880700000804800098028a25880060001000a00000014000200fe8000000000000000000000000000aa05000300000000001c000080060001000200000008000200e0000001050003000000000024000100000000000000000000000000000000000000000000000000000000000000000080010080200004000a004e2000000005200100000000000000000000000000000800000006000500b01f00000800030006000000060005000500000008000a000100000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff200004000a004e200000040100000000000000000000ffffac14142a06000000240001000000000000000000000000000000000000000000000000000000000000000000d400", @ANYRES16=r0], 0x21c}}, 0x0) 0s ago: executing program 4 (id=6245): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x17d4}}, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) syz_open_dev$midi(0x0, 0x3, 0x4a243) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) r1 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000040)) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(0xffffffffffffffff, 0xc0884123, &(0x7f0000000280)={0x0, "728d0a484585ec93a59baeb6831b8ef110181595fe49bc4ac10b67b1b99eeeaa18e15a525115cc71983456358ceb7e1a6f926168ce0c3c2b0f3513a5f2674185", {0x800000000000004, 0x50000000000}}) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(0xffffffffffffffff, 0xc0884113, &(0x7f0000000080)={0x1, 0x0, 0xffff5f11, 0xfffd, 0xfffffffffffffff7, 0xb, 0xfffffffffffffffa, 0x1fe, 0x4a, 0x28, 0x4, 0x2}) kernel console output (not intermixed with test programs): AULT_INJECTION: forcing a failure. [ 958.172272][T22496] name failslab, interval 1, probability 0, space 0, times 0 [ 958.172303][T22496] CPU: 1 UID: 0 PID: 22496 Comm: syz.8.5447 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 958.172324][T22496] Tainted: [L]=SOFTLOCKUP [ 958.172329][T22496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 958.172339][T22496] Call Trace: [ 958.172345][T22496] [ 958.172352][T22496] dump_stack_lvl+0xe8/0x150 [ 958.172374][T22496] should_fail_ex+0x46b/0x600 [ 958.172399][T22496] should_failslab+0xa8/0x100 [ 958.172419][T22496] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 958.172437][T22496] ? __alloc_skb+0x1d0/0x7d0 [ 958.172455][T22496] ? lockdep_hardirqs_on+0x7a/0x110 [ 958.172480][T22496] __alloc_skb+0x1d0/0x7d0 [ 958.172499][T22496] netlink_sendmsg+0x5d4/0xb40 [ 958.172525][T22496] ? __pfx_netlink_sendmsg+0x10/0x10 [ 958.172546][T22496] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 958.172567][T22496] ? aa_sock_msg_perm+0x122/0x200 [ 958.172583][T22496] ? __pfx_netlink_sendmsg+0x10/0x10 [ 958.172601][T22496] sock_sendmsg_nosec+0x112/0x150 [ 958.172618][T22496] ____sys_sendmsg+0x55c/0x870 [ 958.172642][T22496] ? __pfx_____sys_sendmsg+0x10/0x10 [ 958.172670][T22496] ? import_iovec+0x73/0xa0 [ 958.172688][T22496] ___sys_sendmsg+0x2a5/0x360 [ 958.172705][T22496] ? __lock_acquire+0x6b5/0x2d10 [ 958.172725][T22496] ? __pfx____sys_sendmsg+0x10/0x10 [ 958.172766][T22496] ? __fget_files+0x2a/0x420 [ 958.172779][T22496] ? __fget_files+0x3a6/0x420 [ 958.172798][T22496] __x64_sys_sendmsg+0x1c3/0x2a0 [ 958.172827][T22496] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 958.172851][T22496] ? __pfx_ksys_write+0x10/0x10 [ 958.172872][T22496] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 958.172887][T22496] do_syscall_64+0x15f/0x560 [ 958.172905][T22496] ? trace_irq_disable+0x3b/0x140 [ 958.172920][T22496] ? clear_bhb_loop+0x40/0x90 [ 958.172936][T22496] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 958.172950][T22496] RIP: 0033:0x7fd08245ce59 [ 958.172964][T22496] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 958.172976][T22496] RSP: 002b:00007fd0806b6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 958.172991][T22496] RAX: ffffffffffffffda RBX: 00007fd0826d5fa0 RCX: 00007fd08245ce59 [ 958.173001][T22496] RDX: 0000000020008000 RSI: 0000200000000480 RDI: 0000000000000003 [ 958.173014][T22496] RBP: 00007fd0806b6090 R08: 0000000000000000 R09: 0000000000000000 [ 958.173022][T22496] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 958.173031][T22496] R13: 00007fd0826d6038 R14: 00007fd0826d5fa0 R15: 00007ffd17ef9f38 [ 958.173053][T22496] [ 958.197829][T22494] ptrace attach of "ci-upstream-rust-kasan-gce/syz-executor exec"[16509] was attempted by ""[22494] [ 958.386345][T22498] FAULT_INJECTION: forcing a failure. [ 958.386345][T22498] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 958.386380][T22498] CPU: 0 UID: 0 PID: 22498 Comm: syz.9.5448 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 958.386405][T22498] Tainted: [L]=SOFTLOCKUP [ 958.386412][T22498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 958.386422][T22498] Call Trace: [ 958.386430][T22498] [ 958.386437][T22498] dump_stack_lvl+0xe8/0x150 [ 958.386464][T22498] should_fail_ex+0x46b/0x600 [ 958.386493][T22498] _copy_from_user+0x2d/0xb0 [ 958.386512][T22498] ____sys_sendmsg+0x30d/0x870 [ 958.386541][T22498] ? __pfx_____sys_sendmsg+0x10/0x10 [ 958.386572][T22498] ? import_iovec+0x73/0xa0 [ 958.386593][T22498] ___sys_sendmsg+0x2a5/0x360 [ 958.386625][T22498] ? __lock_acquire+0x6b5/0x2d10 [ 958.386648][T22498] ? __pfx____sys_sendmsg+0x10/0x10 [ 958.386702][T22498] ? __fget_files+0x2a/0x420 [ 958.386719][T22498] ? __fget_files+0x3a6/0x420 [ 958.386744][T22498] __x64_sys_sendmsg+0x1c3/0x2a0 [ 958.386770][T22498] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 958.386801][T22498] ? __pfx_ksys_write+0x10/0x10 [ 958.386829][T22498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 958.386855][T22498] do_syscall_64+0x15f/0x560 [ 958.386878][T22498] ? trace_irq_disable+0x3b/0x140 [ 958.386897][T22498] ? clear_bhb_loop+0x40/0x90 [ 958.386922][T22498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 958.386939][T22498] RIP: 0033:0x7f521186ce59 [ 958.386956][T22498] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 958.386971][T22498] RSP: 002b:00007f520fabe028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 958.386991][T22498] RAX: ffffffffffffffda RBX: 00007f5211ae5fa0 RCX: 00007f521186ce59 [ 958.387005][T22498] RDX: 0000000000000000 RSI: 0000200000001000 RDI: 0000000000000004 [ 958.387017][T22498] RBP: 00007f520fabe090 R08: 0000000000000000 R09: 0000000000000000 [ 958.387028][T22498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 958.387039][T22498] R13: 00007f5211ae6038 R14: 00007f5211ae5fa0 R15: 00007fff609117d8 [ 958.387067][T22498] [ 958.821824][T22503] usb usb8: usbfs: process 22503 (syz.9.5450) did not claim interface 0 before use [ 958.923059][T22510] sctp: [Deprecated]: syz.6.5452 (pid 22510) Use of int in max_burst socket option deprecated. [ 958.923059][T22510] Use struct sctp_assoc_value instead [ 959.542167][T22529] fuse: Unknown parameter 'ª' [ 960.959284][T22554] FAULT_INJECTION: forcing a failure. [ 960.959284][T22554] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 960.959320][T22554] CPU: 1 UID: 0 PID: 22554 Comm: syz.9.5464 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 960.959345][T22554] Tainted: [L]=SOFTLOCKUP [ 960.959352][T22554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 960.959363][T22554] Call Trace: [ 960.959370][T22554] [ 960.959378][T22554] dump_stack_lvl+0xe8/0x150 [ 960.959405][T22554] should_fail_ex+0x46b/0x600 [ 960.959433][T22554] _copy_to_user+0x31/0xb0 [ 960.959455][T22554] do_fcntl+0xeee/0x19e0 [ 960.959479][T22554] ? __fget_files+0x2a/0x420 [ 960.959496][T22554] ? __pfx_do_fcntl+0x10/0x10 [ 960.959522][T22554] ? __fget_files+0x2a/0x420 [ 960.959541][T22554] ? __fget_files+0x2a/0x420 [ 960.959568][T22554] ? bpf_lsm_file_fcntl+0x9/0x20 [ 960.959594][T22554] __se_sys_fcntl+0xcb/0x160 [ 960.959612][T22554] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 960.959637][T22554] do_syscall_64+0x15f/0x560 [ 960.959659][T22554] ? trace_irq_disable+0x3b/0x140 [ 960.959677][T22554] ? clear_bhb_loop+0x40/0x90 [ 960.959697][T22554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 960.959714][T22554] RIP: 0033:0x7f521186ce59 [ 960.959730][T22554] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 960.959745][T22554] RSP: 002b:00007f520fabe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000048 [ 960.959765][T22554] RAX: ffffffffffffffda RBX: 00007f5211ae5fa0 RCX: 00007f521186ce59 [ 960.959778][T22554] RDX: 0000200000000140 RSI: 0000000000000024 RDI: 0000000000000003 [ 960.959790][T22554] RBP: 00007f520fabe090 R08: 0000000000000000 R09: 0000000000000000 [ 960.959801][T22554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 960.959812][T22554] R13: 00007f5211ae6038 R14: 00007f5211ae5fa0 R15: 00007fff609117d8 [ 960.959839][T22554] [ 960.985734][T22555] usb usb8: usbfs: process 22555 (syz.6.5462) did not claim interface 0 before use [ 961.321178][T22569] fuse: Unknown parameter 'ª' [ 961.350600][T22563] trusted_key: encrypted_key: master key parameter ' [ 961.350600][T22563] ' is invalid [ 961.590344][T22581] FAULT_INJECTION: forcing a failure. [ 961.590344][T22581] name failslab, interval 1, probability 0, space 0, times 0 [ 961.590378][T22581] CPU: 1 UID: 0 PID: 22581 Comm: syz.9.5470 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 961.590403][T22581] Tainted: [L]=SOFTLOCKUP [ 961.590410][T22581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 961.590421][T22581] Call Trace: [ 961.590429][T22581] [ 961.590437][T22581] dump_stack_lvl+0xe8/0x150 [ 961.590465][T22581] should_fail_ex+0x46b/0x600 [ 961.590499][T22581] should_failslab+0xa8/0x100 [ 961.590522][T22581] kmem_cache_alloc_noprof+0x87/0x680 [ 961.590543][T22581] ? dst_alloc+0x105/0x170 [ 961.590559][T22581] ? fib_lookup+0x76/0x440 [ 961.590581][T22581] dst_alloc+0x105/0x170 [ 961.590609][T22581] ip_route_output_key_hash_rcu+0x14d0/0x25e0 [ 961.590640][T22581] ? ip_route_output_key_hash+0xd8/0x2a0 [ 961.590662][T22581] ip_route_output_key_hash+0x18d/0x2a0 [ 961.590687][T22581] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 961.590711][T22581] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 961.590735][T22581] ? lockdep_hardirqs_on+0x7a/0x110 [ 961.590759][T22581] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 961.590778][T22581] ? dst_release+0x7f/0x1b0 [ 961.590798][T22581] __ip4_datagram_connect+0x8f4/0x1270 [ 961.590839][T22581] udp_connect+0x33/0x1f0 [ 961.590867][T22581] __sys_connect+0x315/0x450 [ 961.590892][T22581] ? __pfx___sys_connect+0x10/0x10 [ 961.590926][T22581] ? __pfx_ksys_write+0x10/0x10 [ 961.590952][T22581] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.590971][T22581] __x64_sys_connect+0x7a/0x90 [ 961.590995][T22581] do_syscall_64+0x15f/0x560 [ 961.591018][T22581] ? trace_irq_disable+0x3b/0x140 [ 961.591042][T22581] ? clear_bhb_loop+0x40/0x90 [ 961.591065][T22581] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.591082][T22581] RIP: 0033:0x7f521186ce59 [ 961.591099][T22581] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 961.591116][T22581] RSP: 002b:00007f520fabe028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 961.591136][T22581] RAX: ffffffffffffffda RBX: 00007f5211ae5fa0 RCX: 00007f521186ce59 [ 961.591156][T22581] RDX: 0000000000000010 RSI: 0000200000000080 RDI: 0000000000000003 [ 961.591168][T22581] RBP: 00007f520fabe090 R08: 0000000000000000 R09: 0000000000000000 [ 961.591179][T22581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 961.591190][T22581] R13: 00007f5211ae6038 R14: 00007f5211ae5fa0 R15: 00007fff609117d8 [ 961.591221][T22581] [ 962.635128][T22610] netlink: 36 bytes leftover after parsing attributes in process `syz.9.5478'. [ 962.707839][T22605] usb usb8: usbfs: process 22605 (syz.4.5476) did not claim interface 0 before use [ 962.920451][T22619] netlink: 65051 bytes leftover after parsing attributes in process `syz.9.5479'. [ 963.692646][T22631] FAULT_INJECTION: forcing a failure. [ 963.692646][T22631] name failslab, interval 1, probability 0, space 0, times 0 [ 963.692683][T22631] CPU: 1 UID: 0 PID: 22631 Comm: syz.6.5480 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 963.692708][T22631] Tainted: [L]=SOFTLOCKUP [ 963.692715][T22631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 963.692726][T22631] Call Trace: [ 963.692733][T22631] [ 963.692741][T22631] dump_stack_lvl+0xe8/0x150 [ 963.692769][T22631] should_fail_ex+0x46b/0x600 [ 963.692798][T22631] should_failslab+0xa8/0x100 [ 963.692823][T22631] __kmalloc_node_noprof+0xe7/0x7f0 [ 963.692846][T22631] ? alloc_slab_obj_exts+0xbf/0x250 [ 963.692868][T22631] alloc_slab_obj_exts+0xbf/0x250 [ 963.692889][T22631] __memcg_slab_post_alloc_hook+0x5e5/0xf20 [ 963.692924][T22631] ? __alloc_skb+0x1d0/0x7d0 [ 963.692947][T22631] kmem_cache_alloc_node_noprof+0x4b7/0x6e0 [ 963.692967][T22631] ? __alloc_skb+0x1d0/0x7d0 [ 963.692993][T22631] __alloc_skb+0x1d0/0x7d0 [ 963.693019][T22631] alloc_skb_with_frags+0xc8/0x760 [ 963.693048][T22631] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 963.693080][T22631] sock_alloc_send_pskb+0x884/0x9a0 [ 963.693122][T22631] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 963.693160][T22631] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 963.693186][T22631] unix_dgram_sendmsg+0x460/0x18d0 [ 963.693214][T22631] ? __lock_acquire+0x6b5/0x2d10 [ 963.693238][T22631] ? __lock_acquire+0x6b5/0x2d10 [ 963.693267][T22631] ? unwind_next_frame+0xa6/0x2550 [ 963.693293][T22631] ? __lock_acquire+0x6b5/0x2d10 [ 963.693316][T22631] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 963.693346][T22631] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 963.693369][T22631] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 963.693389][T22631] sock_sendmsg_nosec+0x112/0x150 [ 963.693411][T22631] ____sys_sendmsg+0x55c/0x870 [ 963.693439][T22631] ? __pfx_____sys_sendmsg+0x10/0x10 [ 963.693471][T22631] ? import_iovec+0x73/0xa0 [ 963.693492][T22631] ___sys_sendmsg+0x2a5/0x360 [ 963.693514][T22631] ? __lock_acquire+0x6b5/0x2d10 [ 963.693538][T22631] ? __pfx____sys_sendmsg+0x10/0x10 [ 963.693566][T22631] ? kstrtouint+0x6e/0xe0 [ 963.693611][T22631] ? __fget_files+0x2a/0x420 [ 963.693628][T22631] ? __fget_files+0x3a6/0x420 [ 963.693654][T22631] __sys_sendmmsg+0x282/0x4e0 [ 963.693683][T22631] ? __pfx___sys_sendmmsg+0x10/0x10 [ 963.693715][T22631] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 963.693747][T22631] ? ksys_write+0x248/0x270 [ 963.693770][T22631] ? __pfx_ksys_write+0x10/0x10 [ 963.693797][T22631] __x64_sys_sendmmsg+0xa0/0xc0 [ 963.693821][T22631] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 963.693841][T22631] do_syscall_64+0x15f/0x560 [ 963.693863][T22631] ? trace_irq_disable+0x3b/0x140 [ 963.693884][T22631] ? clear_bhb_loop+0x40/0x90 [ 963.693905][T22631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 963.693924][T22631] RIP: 0033:0x7f229efcce59 [ 963.693942][T22631] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 963.693958][T22631] RSP: 002b:00007f229d21e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 963.693978][T22631] RAX: ffffffffffffffda RBX: 00007f229f245fa0 RCX: 00007f229efcce59 [ 963.693992][T22631] RDX: 0000000000000001 RSI: 0000200000002c40 RDI: 0000000000000003 [ 963.694004][T22631] RBP: 00007f229d21e090 R08: 0000000000000000 R09: 0000000000000000 [ 963.694015][T22631] R10: 0000000000040840 R11: 0000000000000246 R12: 0000000000000001 [ 963.694026][T22631] R13: 00007f229f246038 R14: 00007f229f245fa0 R15: 00007fff7a6a69f8 [ 963.694056][T22631] [ 964.151524][T22641] FAULT_INJECTION: forcing a failure. [ 964.151524][T22641] name failslab, interval 1, probability 0, space 0, times 0 [ 964.151553][T22641] CPU: 1 UID: 0 PID: 22641 Comm: syz.8.5485 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 964.151572][T22641] Tainted: [L]=SOFTLOCKUP [ 964.151577][T22641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 964.151586][T22641] Call Trace: [ 964.151595][T22641] [ 964.151602][T22641] dump_stack_lvl+0xe8/0x150 [ 964.151625][T22641] should_fail_ex+0x46b/0x600 [ 964.151648][T22641] should_failslab+0xa8/0x100 [ 964.151666][T22641] __kmalloc_noprof+0xdf/0x7b0 [ 964.151680][T22641] ? kfree+0x4d/0x6c0 [ 964.151692][T22641] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 964.151711][T22641] tomoyo_realpath_from_path+0xe3/0x5d0 [ 964.151726][T22641] ? tomoyo_domain+0xd7/0x130 [ 964.151744][T22641] ? tomoyo_path_number_perm+0x219/0x630 [ 964.151764][T22641] tomoyo_path_number_perm+0x246/0x630 [ 964.151783][T22641] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 964.151800][T22641] ? __lock_acquire+0x6b5/0x2d10 [ 964.151819][T22641] ? do_raw_spin_lock+0x12b/0x2f0 [ 964.151856][T22641] ? __fget_files+0x2a/0x420 [ 964.151872][T22641] ? __fget_files+0x2a/0x420 [ 964.151884][T22641] ? __fget_files+0x3a6/0x420 [ 964.151895][T22641] ? __fget_files+0x2a/0x420 [ 964.151911][T22641] security_file_ioctl+0xc3/0x2a0 [ 964.151931][T22641] __se_sys_ioctl+0x47/0x170 [ 964.151947][T22641] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 964.151962][T22641] do_syscall_64+0x15f/0x560 [ 964.151980][T22641] ? trace_irq_disable+0x3b/0x140 [ 964.151995][T22641] ? clear_bhb_loop+0x40/0x90 [ 964.152011][T22641] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 964.152025][T22641] RIP: 0033:0x7fd08245ce59 [ 964.152039][T22641] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 964.152051][T22641] RSP: 002b:00007fd0806b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 964.152066][T22641] RAX: ffffffffffffffda RBX: 00007fd0826d5fa0 RCX: 00007fd08245ce59 [ 964.152075][T22641] RDX: 0000000000000000 RSI: 000000004040ae79 RDI: 0000000000000004 [ 964.152084][T22641] RBP: 00007fd0806b6090 R08: 0000000000000000 R09: 0000000000000000 [ 964.152092][T22641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 964.152100][T22641] R13: 00007fd0826d6038 R14: 00007fd0826d5fa0 R15: 00007ffd17ef9f38 [ 964.152122][T22641] [ 964.152156][T22641] ERROR: Out of memory at tomoyo_realpath_from_path. [ 964.545456][T22649] netlink: 68 bytes leftover after parsing attributes in process `syz.9.5489'. [ 965.006763][T14913] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 965.059583][T14913] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 965.107455][T14913] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 965.113290][T14913] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 965.114813][T14913] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 965.224309][ T5621] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 965.231464][ T5621] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 965.234150][ T5621] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 965.246271][ T5621] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 965.248769][ T5621] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 965.587246][T22694] FAULT_INJECTION: forcing a failure. [ 965.587246][T22694] name failslab, interval 1, probability 0, space 0, times 0 [ 965.587285][T22694] CPU: 1 UID: 0 PID: 22694 Comm: syz.6.5493 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 965.587311][T22694] Tainted: [L]=SOFTLOCKUP [ 965.587318][T22694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 965.587330][T22694] Call Trace: [ 965.587337][T22694] [ 965.587345][T22694] dump_stack_lvl+0xe8/0x150 [ 965.587380][T22694] should_fail_ex+0x46b/0x600 [ 965.587410][T22694] should_failslab+0xa8/0x100 [ 965.587433][T22694] __kmalloc_noprof+0xdf/0x7b0 [ 965.587453][T22694] ? bit_cursor+0xe83/0x1990 [ 965.587481][T22694] bit_cursor+0xe83/0x1990 [ 965.587524][T22694] ? __pfx_bit_cursor+0x10/0x10 [ 965.587562][T22694] ? __pfx_bit_cursor+0x10/0x10 [ 965.587591][T22694] hide_cursor+0xd8/0x490 [ 965.587616][T22694] ? __pfx_hide_cursor+0x10/0x10 [ 965.587637][T22694] ? vcs_write+0x502/0x11c0 [ 965.587661][T22694] ? vcs_write+0x502/0x11c0 [ 965.587686][T22694] putconsxy+0x2f/0x540 [ 965.587701][T22694] ? vcs_write+0x94b/0x11c0 [ 965.587725][T22694] vcs_write+0x9e9/0x11c0 [ 965.587765][T22694] ? __pfx_vcs_write+0x10/0x10 [ 965.587791][T22694] ? rw_verify_area+0x25b/0x4e0 [ 965.587811][T22694] ? __pfx_vcs_write+0x10/0x10 [ 965.587836][T22694] vfs_write+0x2a3/0xba0 [ 965.587868][T22694] ? __pfx_vfs_write+0x10/0x10 [ 965.587888][T22694] ? __fget_files+0x2a/0x420 [ 965.587906][T22694] ? __fget_files+0x2a/0x420 [ 965.587920][T22694] ? __fget_files+0x3a6/0x420 [ 965.587936][T22694] ? __fget_files+0x2a/0x420 [ 965.587957][T22694] ksys_write+0x156/0x270 [ 965.587978][T22694] ? __pfx_ksys_write+0x10/0x10 [ 965.588006][T22694] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 965.588026][T22694] do_syscall_64+0x15f/0x560 [ 965.588049][T22694] ? trace_irq_disable+0x3b/0x140 [ 965.588069][T22694] ? clear_bhb_loop+0x40/0x90 [ 965.588091][T22694] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 965.588109][T22694] RIP: 0033:0x7f229efcce59 [ 965.588132][T22694] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 965.588148][T22694] RSP: 002b:00007f229d1fd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 965.588168][T22694] RAX: ffffffffffffffda RBX: 00007f229f246090 RCX: 00007f229efcce59 [ 965.588181][T22694] RDX: 0000000000000006 RSI: 0000200000000000 RDI: 0000000000000003 [ 965.588192][T22694] RBP: 00007f229d1fd090 R08: 0000000000000000 R09: 0000000000000000 [ 965.588204][T22694] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 965.588215][T22694] R13: 00007f229f246128 R14: 00007f229f246090 R15: 00007fff7a6a69f8 [ 965.588245][T22694] [ 966.121623][T10871] usb 9-1: USB disconnect, device number 77 [ 966.671346][T22714] FAULT_INJECTION: forcing a failure. [ 966.671346][T22714] name failslab, interval 1, probability 0, space 0, times 0 [ 966.671384][T22714] CPU: 0 UID: 0 PID: 22714 Comm: syz.6.5496 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 966.671410][T22714] Tainted: [L]=SOFTLOCKUP [ 966.671417][T22714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 966.671428][T22714] Call Trace: [ 966.671435][T22714] [ 966.671444][T22714] dump_stack_lvl+0xe8/0x150 [ 966.671473][T22714] should_fail_ex+0x46b/0x600 [ 966.671506][T22714] should_failslab+0xa8/0x100 [ 966.671530][T22714] __kmalloc_cache_noprof+0x84/0x690 [ 966.671553][T22714] ? drm_atomic_commit_alloc+0xa9/0x100 [ 966.671581][T22714] drm_atomic_commit_alloc+0xa9/0x100 [ 966.671604][T22714] drm_client_modeset_commit_atomic+0x122/0x7e0 [ 966.671637][T22714] ? rt_mutex_slowlock+0x420/0x780 [ 966.671662][T22714] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 966.671704][T22714] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 966.671726][T22714] ? lockdep_hardirqs_on+0x7a/0x110 [ 966.671750][T22714] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 966.671773][T22714] ? drm_client_modeset_commit_locked+0x4c/0x4d0 [ 966.671799][T22714] drm_client_modeset_commit_locked+0xce/0x4d0 [ 966.671829][T22714] drm_fb_helper_pan_display+0x3ea/0xbe0 [ 966.671863][T22714] fb_pan_display+0x39e/0x680 [ 966.671888][T22714] ? __pfx_drm_fb_helper_pan_display+0x10/0x10 [ 966.671912][T22714] bit_update_start+0x4c/0x1e0 [ 966.671943][T22714] fbcon_switch+0x127e/0x2040 [ 966.671981][T22714] ? __pfx_fbcon_switch+0x10/0x10 [ 966.672024][T22714] ? __pfx_hide_cursor+0x10/0x10 [ 966.672051][T22714] ? is_console_locked+0x9/0x20 [ 966.672074][T22714] ? set_origin+0x346/0x480 [ 966.672099][T22714] csi_J+0x6c4/0xe50 [ 966.672122][T22714] do_con_write+0x45d9/0x5930 [ 966.672195][T22714] ? __pfx_do_con_write+0x10/0x10 [ 966.672221][T22714] ? do_raw_spin_lock+0x12b/0x2f0 [ 966.672268][T22714] ? lockdep_hardirqs_on+0x7a/0x110 [ 966.672290][T22714] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 966.672315][T22714] con_write+0x31/0x2e0 [ 966.672335][T22714] n_tty_write+0xd55/0x1220 [ 966.672381][T22714] ? __pfx_n_tty_write+0x10/0x10 [ 966.672401][T22714] ? __pfx_woken_wake_function+0x10/0x10 [ 966.672429][T22714] ? rcu_is_watching+0x15/0xb0 [ 966.672470][T22714] ? __pfx_n_tty_write+0x10/0x10 [ 966.672495][T22714] file_tty_write+0x561/0xa10 [ 966.672524][T22714] vfs_write+0x629/0xba0 [ 966.672558][T22714] ? __pfx_vfs_write+0x10/0x10 [ 966.672590][T22714] ? __fget_files+0x2a/0x420 [ 966.672620][T22714] ksys_write+0x156/0x270 [ 966.672644][T22714] ? __pfx_ksys_write+0x10/0x10 [ 966.672678][T22714] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 966.672698][T22714] do_syscall_64+0x15f/0x560 [ 966.672721][T22714] ? trace_irq_disable+0x3b/0x140 [ 966.672741][T22714] ? clear_bhb_loop+0x40/0x90 [ 966.672765][T22714] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 966.672782][T22714] RIP: 0033:0x7f229efcce59 [ 966.672802][T22714] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 966.672816][T22714] RSP: 002b:00007f229d21e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 966.672835][T22714] RAX: ffffffffffffffda RBX: 00007f229f245fa0 RCX: 00007f229efcce59 [ 966.672849][T22714] RDX: 0000000000001006 RSI: 0000200000002080 RDI: 0000000000000005 [ 966.672860][T22714] RBP: 00007f229d21e090 R08: 0000000000000000 R09: 0000000000000000 [ 966.672871][T22714] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 966.672880][T22714] R13: 00007f229f246038 R14: 00007f229f245fa0 R15: 00007fff7a6a69f8 [ 966.672916][T22714] [ 967.430496][ T5713] Process accounting resumed [ 967.459444][T14913] Bluetooth: hci4: command tx timeout [ 967.468388][ T5787] Process accounting resumed [ 967.603431][T22723] Process accounting resumed [ 968.775797][ T3363] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 968.841934][T22734] netlink: 65051 bytes leftover after parsing attributes in process `syz.6.5498'. [ 969.260220][T22770] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 969.264629][T22770] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 969.415002][T14913] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 969.418511][T14913] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 969.425330][T14913] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 969.428782][T14913] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 969.471779][T14913] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 969.539426][T14913] Bluetooth: hci4: command tx timeout [ 969.926016][ T3363] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 970.331374][T22811] FAULT_INJECTION: forcing a failure. [ 970.331374][T22811] name failslab, interval 1, probability 0, space 0, times 0 [ 970.331408][T22811] CPU: 0 UID: 0 PID: 22811 Comm: syz.9.5508 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 970.331433][T22811] Tainted: [L]=SOFTLOCKUP [ 970.331440][T22811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 970.331450][T22811] Call Trace: [ 970.331458][T22811] [ 970.331465][T22811] dump_stack_lvl+0xe8/0x150 [ 970.331492][T22811] should_fail_ex+0x46b/0x600 [ 970.331521][T22811] should_failslab+0xa8/0x100 [ 970.331544][T22811] kmem_cache_alloc_noprof+0x87/0x680 [ 970.331564][T22811] ? do_getname+0x2e/0x250 [ 970.331591][T22811] do_getname+0x2e/0x250 [ 970.331612][T22811] ? user_path_at+0x1e/0x160 [ 970.331633][T22811] user_path_at+0x2a/0x160 [ 970.331654][T22811] __se_sys_mount+0x2dc/0x420 [ 970.331678][T22811] ? __pfx___se_sys_mount+0x10/0x10 [ 970.331701][T22811] ? __x64_sys_mount+0x20/0xc0 [ 970.331718][T22811] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 970.331738][T22811] do_syscall_64+0x15f/0x560 [ 970.331760][T22811] ? trace_irq_disable+0x3b/0x140 [ 970.331780][T22811] ? clear_bhb_loop+0x40/0x90 [ 970.331803][T22811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 970.331821][T22811] RIP: 0033:0x7f521186ce59 [ 970.331849][T22811] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 970.331863][T22811] RSP: 002b:00007f520fabe028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 970.331882][T22811] RAX: ffffffffffffffda RBX: 00007f5211ae5fa0 RCX: 00007f521186ce59 [ 970.331896][T22811] RDX: 0000200000000000 RSI: 00002000000000c0 RDI: 0000000000000000 [ 970.331909][T22811] RBP: 00007f520fabe090 R08: 0000000000000000 R09: 0000000000000000 [ 970.331921][T22811] R10: 0000000001000802 R11: 0000000000000246 R12: 0000000000000001 [ 970.331933][T22811] R13: 00007f5211ae6038 R14: 00007f5211ae5fa0 R15: 00007fff609117d8 [ 970.331962][T22811] [ 970.697676][ T3363] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 971.552890][ T5621] Bluetooth: hci0: command tx timeout [ 971.619144][ T5621] Bluetooth: hci4: command tx timeout [ 971.679367][ T3363] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 971.932665][T22658] bridge0: port 1(bridge_slave_0) entered blocking state [ 971.933044][T22658] bridge0: port 1(bridge_slave_0) entered disabled state [ 971.933316][T22658] bridge_slave_0: entered allmulticast mode [ 971.935279][T22658] bridge_slave_0: entered promiscuous mode [ 971.970380][T22658] bridge0: port 2(bridge_slave_1) entered blocking state [ 971.970605][T22658] bridge0: port 2(bridge_slave_1) entered disabled state [ 971.970951][T22658] bridge_slave_1: entered allmulticast mode [ 971.972935][T22658] bridge_slave_1: entered promiscuous mode [ 972.179903][T22658] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 972.243499][T22658] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 972.436057][T22658] team0: Port device team_slave_0 added [ 972.454117][T22658] team0: Port device team_slave_1 added [ 972.591154][T22658] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 972.591179][T22658] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 972.591202][T22658] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 972.609096][ T13] kworker/u8:1 (13) used greatest stack depth: 14976 bytes left [ 972.702105][T22658] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 972.702122][T22658] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 972.702148][T22658] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 972.989698][ T3363] bridge_slave_1: left allmulticast mode [ 972.989724][ T3363] bridge_slave_1: left promiscuous mode [ 972.989943][ T3363] bridge0: port 2(bridge_slave_1) entered disabled state [ 973.109752][ T3363] bridge_slave_0: left allmulticast mode [ 973.109777][ T3363] bridge_slave_0: left promiscuous mode [ 973.109975][ T3363] bridge0: port 1(bridge_slave_0) entered disabled state [ 973.222656][ T3363] dvmrp8: left allmulticast mode [ 973.621939][ T5621] Bluetooth: hci0: command tx timeout [ 973.745714][ T5621] Bluetooth: hci4: command tx timeout [ 973.829332][ T3363] bond0 (unregistering): (slave geneve1): Releasing backup interface [ 974.079943][ T3363] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 974.160301][ T3363] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 974.184681][ T3363] bond0 (unregistering): Released all slaves [ 974.233047][T22658] hsr_slave_0: entered promiscuous mode [ 974.235199][T22658] hsr_slave_1: entered promiscuous mode [ 974.236487][T22658] debugfs: 'hsr0' already exists in 'hsr' [ 974.236510][T22658] Cannot create hsr debugfs directory [ 974.853421][ T3363] IPVS: stopping backup sync thread 17766 ... [ 975.194520][T22773] bridge0: port 1(bridge_slave_0) entered blocking state [ 975.194812][T22773] bridge0: port 1(bridge_slave_0) entered disabled state [ 975.195113][T22773] bridge_slave_0: entered allmulticast mode [ 975.220455][T22773] bridge_slave_0: entered promiscuous mode [ 975.292106][T22773] bridge0: port 2(bridge_slave_1) entered blocking state [ 975.292486][T22773] bridge0: port 2(bridge_slave_1) entered disabled state [ 975.292846][T22773] bridge_slave_1: entered allmulticast mode [ 975.375489][T22773] bridge_slave_1: entered promiscuous mode [ 975.434578][ T5282] 8021q: adding VLAN 0 to HW filter on device eth13 [ 975.700448][ T5621] Bluetooth: hci0: command tx timeout [ 975.736583][T22773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 975.746014][T22773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 976.091758][T22773] team0: Port device team_slave_0 added [ 976.100784][T22773] team0: Port device team_slave_1 added [ 976.203433][T22773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 976.203450][T22773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 976.203476][T22773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 976.359663][ T3363] hsr_slave_0: left promiscuous mode [ 976.398940][ T3363] hsr_slave_1: left promiscuous mode [ 976.400292][ T3363] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 976.400316][ T3363] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 976.428059][ T3363] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 976.428090][ T3363] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 976.500260][ T3363] veth1_macvtap: left promiscuous mode [ 976.500387][ T3363] veth0_macvtap: left promiscuous mode [ 976.500509][ T3363] veth1_vlan: left promiscuous mode [ 976.500626][ T3363] veth0_vlan: left promiscuous mode [ 977.269801][ T3363] team0 (unregistering): Port device team_slave_1 removed [ 977.309808][ T3363] team0 (unregistering): Port device team_slave_0 removed [ 977.511675][T22773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 977.511686][T22773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 977.511701][T22773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 977.779026][ T5621] Bluetooth: hci0: command tx timeout [ 978.024636][T22773] hsr_slave_0: entered promiscuous mode [ 978.025983][T22773] hsr_slave_1: entered promiscuous mode [ 978.026982][T22773] debugfs: 'hsr0' already exists in 'hsr' [ 978.027002][T22773] Cannot create hsr debugfs directory [ 979.676123][T22773] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 980.046977][T22773] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 980.437170][T22773] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 980.786331][T22773] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 981.094231][ T3363] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 981.582769][ T3363] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 981.977069][ T3363] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 982.107490][T22658] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 982.159381][T22658] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 982.182844][T22658] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 982.212609][T22658] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 982.439198][ T3363] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 982.505964][T22658] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 982.522969][T22658] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 982.607372][T22658] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 982.651073][T22658] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 982.835740][T22773] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 982.877124][T22773] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 982.880130][T22773] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 982.913160][T22773] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 982.918360][T22773] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 982.993051][T22773] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 983.021105][T22773] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 983.055521][T22773] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 983.469919][ T3363] bridge_slave_1: left allmulticast mode [ 983.469951][ T3363] bridge_slave_1: left promiscuous mode [ 983.470173][ T3363] bridge0: port 2(bridge_slave_1) entered disabled state [ 983.610809][ T3363] bridge_slave_0: left allmulticast mode [ 983.610854][ T3363] bridge_slave_0: left promiscuous mode [ 983.611217][ T3363] bridge0: port 1(bridge_slave_0) entered disabled state [ 984.489748][ T3363] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 984.569463][ T3363] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 984.596277][ T3363] bond0 (unregistering): Released all slaves [ 984.982437][T22658] 8021q: adding VLAN 0 to HW filter on device bond0 [ 985.198404][T22658] 8021q: adding VLAN 0 to HW filter on device team0 [ 985.286624][ T4303] bridge0: port 1(bridge_slave_0) entered blocking state [ 985.286852][ T4303] bridge0: port 1(bridge_slave_0) entered forwarding state [ 985.307230][T15338] bridge0: port 2(bridge_slave_1) entered blocking state [ 985.307456][T15338] bridge0: port 2(bridge_slave_1) entered forwarding state [ 985.771177][ T5282] 8021q: adding VLAN 0 to HW filter on device eth13 [ 985.934158][T22773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 986.003364][T22773] 8021q: adding VLAN 0 to HW filter on device team0 [ 986.171013][T15338] bridge0: port 1(bridge_slave_0) entered blocking state [ 986.171201][T15338] bridge0: port 1(bridge_slave_0) entered forwarding state [ 986.370555][ T4303] bridge0: port 2(bridge_slave_1) entered blocking state [ 986.370717][ T4303] bridge0: port 2(bridge_slave_1) entered forwarding state [ 986.668761][ T3363] hsr_slave_0: left promiscuous mode [ 986.713995][ T3363] hsr_slave_1: left promiscuous mode [ 986.715188][ T3363] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 986.715213][ T3363] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 986.749733][ T3363] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 986.749754][ T3363] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 986.872258][ T3363] veth1_macvtap: left promiscuous mode [ 986.872332][ T3363] veth0_macvtap: left promiscuous mode [ 986.872508][ T3363] veth1_vlan: left promiscuous mode [ 986.872624][ T3363] veth0_vlan: left promiscuous mode [ 987.659743][ T3363] team0 (unregistering): Port device team_slave_1 removed [ 987.719725][ T3363] team0 (unregistering): Port device team_slave_0 removed [ 987.899601][ T5282] 8021q: adding VLAN 0 to HW filter on device eth14 [ 989.104897][T22658] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 989.206186][T22773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 989.666838][ T5282] 8021q: adding VLAN 0 to HW filter on device eth15 [ 989.763279][T22773] veth0_vlan: entered promiscuous mode [ 989.843103][T22773] veth1_vlan: entered promiscuous mode [ 990.065790][T22773] veth0_macvtap: entered promiscuous mode [ 990.111035][T22773] veth1_macvtap: entered promiscuous mode [ 990.187529][T22658] veth0_vlan: entered promiscuous mode [ 990.203152][T22773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 990.250318][T22773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 990.285691][T13304] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 990.304792][T13304] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 990.325063][T13304] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 990.346884][T22658] veth1_vlan: entered promiscuous mode [ 990.353508][T13304] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 990.681931][ T5282] 8021q: adding VLAN 0 to HW filter on device eth16 [ 991.347176][ T153] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 991.347196][ T153] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 991.411045][T22658] veth0_macvtap: entered promiscuous mode [ 991.489906][T22658] veth1_macvtap: entered promiscuous mode [ 991.651495][T22658] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 991.674666][ T153] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 991.674686][ T153] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 991.676618][T22658] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 991.792311][ T3363] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 991.793725][ T3363] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 991.793769][ T3363] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 991.793802][ T3363] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 993.068167][ T1337] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.152186][ T1337] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.474787][ T3372] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 993.474808][ T3372] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 993.960204][T23526] netlink: 65051 bytes leftover after parsing attributes in process `syz.2.5510'. [ 994.150269][ T4303] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 994.150287][ T4303] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 995.072388][T23552] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1337 [ 995.313309][T23569] FAULT_INJECTION: forcing a failure. [ 995.313309][T23569] name failslab, interval 1, probability 0, space 0, times 0 [ 995.313343][T23569] CPU: 1 UID: 0 PID: 23569 Comm: syz.2.5522 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 995.313363][T23569] Tainted: [L]=SOFTLOCKUP [ 995.313367][T23569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 995.313376][T23569] Call Trace: [ 995.313382][T23569] [ 995.313390][T23569] dump_stack_lvl+0xe8/0x150 [ 995.313414][T23569] should_fail_ex+0x46b/0x600 [ 995.313438][T23569] should_failslab+0xa8/0x100 [ 995.313455][T23569] __kmalloc_cache_node_noprof+0x8a/0x6c0 [ 995.313471][T23569] ? do_raw_spin_lock+0x12b/0x2f0 [ 995.313484][T23569] ? __get_vm_area_node+0x13f/0x300 [ 995.313501][T23569] __get_vm_area_node+0x13f/0x300 [ 995.313518][T23569] __vmalloc_node_range_noprof+0x36a/0x1750 [ 995.313533][T23569] ? vc_uniscr_check+0x18f/0x7a0 [ 995.313551][T23569] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 995.313571][T23569] ? __pfx_up+0x10/0x10 [ 995.313598][T23569] ? __lock_acquire+0x6b5/0x2d10 [ 995.313620][T23569] ? atomic_notifier_call_chain+0x26/0x180 [ 995.313637][T23569] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 995.313661][T23569] ? vc_uniscr_check+0x18f/0x7a0 [ 995.313678][T23569] vzalloc_noprof+0xb2/0xe0 [ 995.313692][T23569] ? vc_uniscr_check+0x18f/0x7a0 [ 995.313716][T23569] vc_uniscr_check+0x18f/0x7a0 [ 995.313734][T23569] ? atomic_notifier_call_chain+0x26/0x180 [ 995.313749][T23569] ? atomic_notifier_call_chain+0x26/0x180 [ 995.313770][T23569] do_con_write+0xcbb/0x5930 [ 995.313832][T23569] ? __pfx_do_con_write+0x10/0x10 [ 995.313851][T23569] ? do_raw_spin_lock+0x12b/0x2f0 [ 995.313890][T23569] ? lockdep_hardirqs_on+0x7a/0x110 [ 995.313910][T23569] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 995.313933][T23569] con_write+0x31/0x2e0 [ 995.313953][T23569] n_tty_write+0xd55/0x1220 [ 995.313990][T23569] ? __pfx_n_tty_write+0x10/0x10 [ 995.314007][T23569] ? __pfx_woken_wake_function+0x10/0x10 [ 995.314028][T23569] ? rcu_is_watching+0x15/0xb0 [ 995.314052][T23569] ? __pfx_n_tty_write+0x10/0x10 [ 995.314070][T23569] file_tty_write+0x561/0xa10 [ 995.314092][T23569] vfs_write+0x629/0xba0 [ 995.314116][T23569] ? __pfx_vfs_write+0x10/0x10 [ 995.314141][T23569] ? __fget_files+0x2a/0x420 [ 995.314164][T23569] ksys_write+0x156/0x270 [ 995.314183][T23569] ? __pfx_ksys_write+0x10/0x10 [ 995.314209][T23569] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 995.314226][T23569] do_syscall_64+0x15f/0x560 [ 995.314253][T23569] ? trace_irq_disable+0x3b/0x140 [ 995.314277][T23569] ? clear_bhb_loop+0x40/0x90 [ 995.314298][T23569] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 995.314314][T23569] RIP: 0033:0x7f079ed3ce59 [ 995.314331][T23569] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 995.314344][T23569] RSP: 002b:00007f079cf8e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 995.314359][T23569] RAX: ffffffffffffffda RBX: 00007f079efb5fa0 RCX: 00007f079ed3ce59 [ 995.314369][T23569] RDX: 0000000000001006 RSI: 0000200000000000 RDI: 0000000000000004 [ 995.314377][T23569] RBP: 00007f079cf8e090 R08: 0000000000000000 R09: 0000000000000000 [ 995.314385][T23569] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 995.314393][T23569] R13: 00007f079efb6038 R14: 00007f079efb5fa0 R15: 00007ffd63f595e8 [ 995.314416][T23569] [ 995.325089][T23569] syz.2.5522: vmalloc error: size 3800, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 995.376762][T23569] CPU: 1 UID: 0 PID: 23569 Comm: syz.2.5522 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 995.376788][T23569] Tainted: [L]=SOFTLOCKUP [ 995.376794][T23569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 995.376802][T23569] Call Trace: [ 995.376808][T23569] [ 995.376816][T23569] dump_stack_lvl+0xe8/0x150 [ 995.376840][T23569] warn_alloc+0x24c/0x270 [ 995.376862][T23569] ? __pfx_warn_alloc+0x10/0x10 [ 995.376876][T23569] ? __kmalloc_cache_node_noprof+0x27d/0x6c0 [ 995.376894][T23569] ? __get_vm_area_node+0x13f/0x300 [ 995.376911][T23569] ? __get_vm_area_node+0x2b5/0x300 [ 995.376930][T23569] __vmalloc_node_range_noprof+0x38f/0x1750 [ 995.376944][T23569] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 995.376966][T23569] ? __pfx_up+0x10/0x10 [ 995.376995][T23569] ? __lock_acquire+0x6b5/0x2d10 [ 995.377017][T23569] ? atomic_notifier_call_chain+0x26/0x180 [ 995.377037][T23569] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 995.377064][T23569] ? vc_uniscr_check+0x18f/0x7a0 [ 995.377085][T23569] vzalloc_noprof+0xb2/0xe0 [ 995.377102][T23569] ? vc_uniscr_check+0x18f/0x7a0 [ 995.377122][T23569] vc_uniscr_check+0x18f/0x7a0 [ 995.377146][T23569] ? atomic_notifier_call_chain+0x26/0x180 [ 995.377161][T23569] ? atomic_notifier_call_chain+0x26/0x180 [ 995.377182][T23569] do_con_write+0xcbb/0x5930 [ 995.377241][T23569] ? __pfx_do_con_write+0x10/0x10 [ 995.377261][T23569] ? do_raw_spin_lock+0x12b/0x2f0 [ 995.377309][T23569] ? lockdep_hardirqs_on+0x7a/0x110 [ 995.377331][T23569] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 995.377354][T23569] con_write+0x31/0x2e0 [ 995.377373][T23569] n_tty_write+0xd55/0x1220 [ 995.377416][T23569] ? __pfx_n_tty_write+0x10/0x10 [ 995.377435][T23569] ? __pfx_woken_wake_function+0x10/0x10 [ 995.377453][T23569] ? rcu_is_watching+0x15/0xb0 [ 995.377478][T23569] ? __pfx_n_tty_write+0x10/0x10 [ 995.377495][T23569] file_tty_write+0x561/0xa10 [ 995.377515][T23569] vfs_write+0x629/0xba0 [ 995.377538][T23569] ? __pfx_vfs_write+0x10/0x10 [ 995.377562][T23569] ? __fget_files+0x2a/0x420 [ 995.377582][T23569] ksys_write+0x156/0x270 [ 995.377600][T23569] ? __pfx_ksys_write+0x10/0x10 [ 995.377638][T23569] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 995.377653][T23569] do_syscall_64+0x15f/0x560 [ 995.377670][T23569] ? trace_irq_disable+0x3b/0x140 [ 995.377686][T23569] ? clear_bhb_loop+0x40/0x90 [ 995.377703][T23569] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 995.377716][T23569] RIP: 0033:0x7f079ed3ce59 [ 995.377731][T23569] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 995.377743][T23569] RSP: 002b:00007f079cf8e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 995.377758][T23569] RAX: ffffffffffffffda RBX: 00007f079efb5fa0 RCX: 00007f079ed3ce59 [ 995.377767][T23569] RDX: 0000000000001006 RSI: 0000200000000000 RDI: 0000000000000004 [ 995.377776][T23569] RBP: 00007f079cf8e090 R08: 0000000000000000 R09: 0000000000000000 [ 995.377785][T23569] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 995.377794][T23569] R13: 00007f079efb6038 R14: 00007f079efb5fa0 R15: 00007ffd63f595e8 [ 995.377819][T23569] [ 995.377936][T23569] Mem-Info: [ 995.377947][T23569] active_anon:6463 inactive_anon:0 isolated_anon:0 [ 995.377947][T23569] active_file:0 inactive_file:57014 isolated_file:0 [ 995.377947][T23569] unevictable:768 dirty:102 writeback:0 [ 995.377947][T23569] slab_reclaimable:13084 slab_unreclaimable:116573 [ 995.377947][T23569] mapped:25123 shmem:1333 pagetables:1820 [ 995.377947][T23569] sec_pagetables:0 bounce:0 [ 995.377947][T23569] kernel_misc_reclaimable:0 [ 995.377947][T23569] free:1293634 free_pcp:5193 free_cma:0 [ 995.377996][T23569] Node 0 active_anon:25852kB inactive_anon:0kB active_file:0kB inactive_file:227836kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:100468kB dirty:404kB writeback:0kB shmem:3796kB kernel_stack:15456kB pagetables:7152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 995.378039][T23569] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:220kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:24kB dirty:4kB writeback:0kB shmem:1536kB kernel_stack:32kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 995.378072][T23569] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 995.378132][T23569] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 995.378180][T23569] Node 0 DMA32 free:1230164kB boost:0kB min:3912kB low:6436kB high:8960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:25852kB inactive_anon:0kB active_file:0kB inactive_file:227836kB unevictable:1536kB writepending:404kB zspages:0kB present:3129332kB managed:2552244kB mlocked:0kB bounce:0kB free_pcp:20764kB local_pcp:4488kB free_cma:0kB [ 995.378222][T23569] lowmem_reserve[]: 0 0 0 0 0 [ 995.378245][T23569] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:868kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 995.378295][T23569] lowmem_reserve[]: 0 0 0 0 0 [ 995.378320][T23569] Node 1 Normal free:3929012kB boost:0kB min:6372kB low:10480kB high:14588kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:220kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111096kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 995.378363][T23569] lowmem_reserve[]: 0 0 0 0 0 [ 995.378390][T23569] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 995.434955][T23569] Node 0 DMA32: 1131*4kB (UME) 1259*8kB (UME) 187*16kB (UME) 709*32kB (UME) 323*64kB (UME) 233*128kB (UME) 67*256kB (UME) 29*512kB (UME) 18*1024kB (UME) 14*2048kB (UME) 259*4096kB (UM) = 1230740kB [ 995.435097][T23569] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 995.435187][T23569] Node 1 Normal: 3*4kB (M) 5*8kB (UM) 12*16kB (UM) 12*32kB (UM) 5*64kB (UM) 2*128kB (UM) 1*256kB (M) 3*512kB (UM) 2*1024kB (UM) 0*2048kB 958*4096kB (M) = 3929012kB [ 995.435329][T23569] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 995.435343][T23569] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 995.435357][T23569] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 995.435372][T23569] Node 1 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 995.435387][T23569] 58343 total pagecache pages [ 995.435409][T23569] 0 pages in swap cache [ 995.435416][T23569] Free swap = 124996kB [ 995.435424][T23569] Total swap = 124996kB [ 995.435436][T23569] 2097051 pages RAM [ 995.435443][T23569] 0 pages HighMem/MovableOnly [ 995.435450][T23569] 427159 pages reserved [ 995.435457][T23569] 0 pages cma reserved [ 996.070663][T23582] block nbd4: NBD_DISCONNECT [ 996.070839][T23582] block nbd4: Send disconnect failed -32 [ 996.819797][T23602] FAULT_INJECTION: forcing a failure. [ 996.819797][T23602] name failslab, interval 1, probability 0, space 0, times 0 [ 996.819829][T23602] CPU: 1 UID: 0 PID: 23602 Comm: syz.9.5530 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 996.819849][T23602] Tainted: [L]=SOFTLOCKUP [ 996.819854][T23602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 996.819864][T23602] Call Trace: [ 996.819870][T23602] [ 996.819878][T23602] dump_stack_lvl+0xe8/0x150 [ 996.819904][T23602] should_fail_ex+0x46b/0x600 [ 996.819945][T23602] should_failslab+0xa8/0x100 [ 996.819966][T23602] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 996.819983][T23602] ? __alloc_skb+0x1d0/0x7d0 [ 996.820004][T23602] ? ipv4_default_advmss+0x20/0x340 [ 996.820027][T23602] __alloc_skb+0x1d0/0x7d0 [ 996.820051][T23602] tcp_stream_alloc_skb+0x3f/0x5c0 [ 996.820073][T23602] ? __asan_memset+0x22/0x50 [ 996.820099][T23602] tcp_connect+0x1570/0x5400 [ 996.820139][T23602] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 996.820161][T23602] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 996.820179][T23602] ? reacquire_held_locks+0x104/0x190 [ 996.820208][T23602] ? __pfx_tcp_connect+0x10/0x10 [ 996.820234][T23602] ? rt_spin_unlock+0x14f/0x200 [ 996.820264][T23602] ? __asan_memset+0x22/0x50 [ 996.820293][T23602] ? __pfx_tcp_fastopen_defer_connect+0x10/0x10 [ 996.820316][T23602] ? secure_tcp_seq_and_ts_off+0xf2/0x1d0 [ 996.820350][T23602] ? sk_setup_caps+0x9ef/0xc40 [ 996.820375][T23602] ? sk_setup_caps+0x29/0xc40 [ 996.820400][T23602] tcp_v4_connect+0x10f7/0x19b0 [ 996.820442][T23602] ? __pfx_tcp_v4_connect+0x10/0x10 [ 996.820474][T23602] __inet_stream_connect+0x25a/0xdd0 [ 996.820506][T23602] ? __pfx___inet_stream_connect+0x10/0x10 [ 996.820525][T23602] ? __local_bh_enable+0x1e1/0x2f0 [ 996.820555][T23602] ? __local_bh_enable_ip+0x1ae/0x2b0 [ 996.820579][T23602] ? lockdep_hardirqs_on+0x7a/0x110 [ 996.820607][T23602] inet_stream_connect+0x66/0xa0 [ 996.820630][T23602] __sys_connect+0x315/0x450 [ 996.820654][T23602] ? __pfx___sys_connect+0x10/0x10 [ 996.820687][T23602] ? __pfx_ksys_write+0x10/0x10 [ 996.820712][T23602] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 996.820731][T23602] __x64_sys_connect+0x7a/0x90 [ 996.820754][T23602] do_syscall_64+0x15f/0x560 [ 996.820775][T23602] ? trace_irq_disable+0x3b/0x140 [ 996.820795][T23602] ? clear_bhb_loop+0x40/0x90 [ 996.820816][T23602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 996.820834][T23602] RIP: 0033:0x7f521186ce59 [ 996.820851][T23602] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 996.820867][T23602] RSP: 002b:00007f520fabe028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 996.820886][T23602] RAX: ffffffffffffffda RBX: 00007f5211ae5fa0 RCX: 00007f521186ce59 [ 996.820900][T23602] RDX: 0000000000000010 RSI: 00002000000001c0 RDI: 0000000000000003 [ 996.820918][T23602] RBP: 00007f520fabe090 R08: 0000000000000000 R09: 0000000000000000 [ 996.820930][T23602] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 996.820942][T23602] R13: 00007f5211ae6038 R14: 00007f5211ae5fa0 R15: 00007fff609117d8 [ 996.820971][T23602] [ 997.522493][T23618] FAULT_INJECTION: forcing a failure. [ 997.522493][T23618] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 997.522530][T23618] CPU: 0 UID: 0 PID: 23618 Comm: syz.9.5536 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 997.522555][T23618] Tainted: [L]=SOFTLOCKUP [ 997.522562][T23618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 997.522572][T23618] Call Trace: [ 997.522580][T23618] [ 997.522589][T23618] dump_stack_lvl+0xe8/0x150 [ 997.522614][T23618] should_fail_ex+0x46b/0x600 [ 997.522644][T23618] _copy_from_user+0x2d/0xb0 [ 997.522664][T23618] get_timespec64+0x96/0x1b0 [ 997.522687][T23618] ? __pfx_get_timespec64+0x10/0x10 [ 997.522717][T23618] __x64_sys_recvmmsg+0x14b/0x250 [ 997.522746][T23618] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 997.522778][T23618] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 997.522798][T23618] do_syscall_64+0x15f/0x560 [ 997.522821][T23618] ? trace_irq_disable+0x3b/0x140 [ 997.522842][T23618] ? clear_bhb_loop+0x40/0x90 [ 997.522864][T23618] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 997.522882][T23618] RIP: 0033:0x7f521186ce59 [ 997.522898][T23618] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 997.522913][T23618] RSP: 002b:00007f520fabe028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 997.522933][T23618] RAX: ffffffffffffffda RBX: 00007f5211ae5fa0 RCX: 00007f521186ce59 [ 997.522947][T23618] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 997.522957][T23618] RBP: 00007f520fabe090 R08: 0000200000003700 R09: 0000000000000000 [ 997.523006][T23618] R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000001 [ 997.523017][T23618] R13: 00007f5211ae6038 R14: 00007f5211ae5fa0 R15: 00007fff609117d8 [ 997.523045][T23618] [ 997.753018][T23620] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 997.766090][T23620] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 997.857024][T23628] block nbd9: NBD_DISCONNECT [ 998.764937][T23660] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 998.765664][T23660] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 999.946974][T23709] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5566'. [ 999.946998][T23709] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5566'. [ 999.947013][T23709] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5566'. [ 1000.277731][T23717] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1000.292211][T23717] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1000.912747][T23726] block nbd2: NBD_DISCONNECT [ 1000.912790][T23726] block nbd2: Send disconnect failed -32 [ 1001.154937][T23729] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1001.155569][T23729] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1001.168112][T23729] netlink: 666 bytes leftover after parsing attributes in process `syz.9.5574'. [ 1001.401970][T23746] FAULT_INJECTION: forcing a failure. [ 1001.401970][T23746] name failslab, interval 1, probability 0, space 0, times 0 [ 1001.401995][T23746] CPU: 0 UID: 0 PID: 23746 Comm: syz.4.5580 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1001.402010][T23746] Tainted: [L]=SOFTLOCKUP [ 1001.402014][T23746] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1001.402021][T23746] Call Trace: [ 1001.402025][T23746] [ 1001.402030][T23746] dump_stack_lvl+0xe8/0x150 [ 1001.402045][T23746] should_fail_ex+0x46b/0x600 [ 1001.402063][T23746] should_failslab+0xa8/0x100 [ 1001.402076][T23746] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 1001.402093][T23746] ? __alloc_skb+0x1d0/0x7d0 [ 1001.402111][T23746] ? lockdep_hardirqs_on+0x7a/0x110 [ 1001.402138][T23746] __alloc_skb+0x1d0/0x7d0 [ 1001.402162][T23746] _sctp_make_chunk+0x59/0x290 [ 1001.402184][T23746] sctp_make_heartbeat+0xc5/0x4c0 [ 1001.402209][T23746] ? __pfx_sctp_make_heartbeat+0x10/0x10 [ 1001.402226][T23746] ? is_bpf_text_address+0x26/0x2b0 [ 1001.402241][T23746] ? is_bpf_text_address+0x292/0x2b0 [ 1001.402252][T23746] ? is_bpf_text_address+0x26/0x2b0 [ 1001.402266][T23746] sctp_sf_do_prm_requestheartbeat+0x32/0x280 [ 1001.402279][T23746] sctp_do_sm+0x238/0x5cf0 [ 1001.402289][T23746] ? __pfx_sctp_pname+0x10/0x10 [ 1001.402301][T23746] ? try_to_take_rt_mutex+0x840/0xb00 [ 1001.402318][T23746] ? __pfx_sctp_do_sm+0x10/0x10 [ 1001.402329][T23746] ? __lock_acquire+0x6b5/0x2d10 [ 1001.402360][T23746] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1001.402376][T23746] sctp_primitive_REQUESTHEARTBEAT+0x98/0xc0 [ 1001.402394][T23746] sctp_apply_peer_addr_params+0xdf/0x1880 [ 1001.402411][T23746] sctp_setsockopt_peer_addr_params+0x46f/0x6b0 [ 1001.402432][T23746] sctp_setsockopt+0x752/0x12c0 [ 1001.402445][T23746] ? sock_common_setsockopt+0x36/0xc0 [ 1001.402456][T23746] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1001.402469][T23746] do_sock_setsockopt+0x17c/0x1b0 [ 1001.402488][T23746] __x64_sys_setsockopt+0x143/0x1b0 [ 1001.402503][T23746] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1001.402514][T23746] do_syscall_64+0x15f/0x560 [ 1001.402527][T23746] ? trace_irq_disable+0x3b/0x140 [ 1001.402538][T23746] ? clear_bhb_loop+0x40/0x90 [ 1001.402550][T23746] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1001.402559][T23746] RIP: 0033:0x7f3a7963ce59 [ 1001.402570][T23746] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1001.402579][T23746] RSP: 002b:00007f3a77896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1001.402590][T23746] RAX: ffffffffffffffda RBX: 00007f3a798b5fa0 RCX: 00007f3a7963ce59 [ 1001.402598][T23746] RDX: 0000000000000009 RSI: 0000000000000084 RDI: 0000000000000005 [ 1001.402605][T23746] RBP: 00007f3a77896090 R08: 000000000000009c R09: 0000000000000000 [ 1001.402611][T23746] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000001 [ 1001.402618][T23746] R13: 00007f3a798b6038 R14: 00007f3a798b5fa0 R15: 00007ffd23f790a8 [ 1001.402633][T23746] [ 1001.627208][T23752] overlay: Unknown parameter '' [ 1001.639465][ T9] usb 3-1: new full-speed USB device number 29 using dummy_hcd [ 1001.815710][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1001.815764][ T9] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 1001.815788][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 1001.815811][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1001.815829][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1001.879416][ T9] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 1001.879443][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 1001.879463][ T9] usb 3-1: Product: syz [ 1001.879476][ T9] usb 3-1: Manufacturer: syz [ 1001.879489][ T9] usb 3-1: SerialNumber: syz [ 1001.911062][ T9] usb 3-1: config 0 descriptor?? [ 1002.186041][ T9] radio-si470x 3-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 1002.186066][ T9] radio-si470x 3-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 1002.417104][ T9] radio-si470x 3-1:0.0: software version 0, hardware version 0 [ 1002.417130][ T9] radio-si470x 3-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 1002.417148][ T9] radio-si470x 3-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 1002.634559][T23776] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1002.635041][T23776] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1002.650434][ T9] radio-si470x 3-1:0.0: submitting int urb failed (-90) [ 1002.680697][T23776] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1002.684600][T23776] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1003.044901][T23799] netlink: 3 bytes leftover after parsing attributes in process `syz.4.5592'. [ 1003.216089][T23805] netlink: 176 bytes leftover after parsing attributes in process `syz.6.5593'. [ 1003.437486][ T9] radio-si470x 3-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 1003.437823][ T9] radio-si470x 3-1:0.0: probe with driver radio-si470x failed with error -22 [ 1003.451997][ T9] usb 3-1: USB disconnect, device number 29 [ 1004.528818][ T5787] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 1004.678701][ T5787] usb 3-1: Using ep0 maxpacket: 16 [ 1004.680647][ T5787] usb 3-1: config 0 has an invalid interface number: 105 but max is 0 [ 1004.680672][ T5787] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1004.680690][ T5787] usb 3-1: config 0 has no interface number 0 [ 1004.682993][ T5787] usb 3-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 1004.683019][ T5787] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1004.683037][ T5787] usb 3-1: Product: syz [ 1004.683050][ T5787] usb 3-1: Manufacturer: syz [ 1004.683063][ T5787] usb 3-1: SerialNumber: syz [ 1004.701001][ T5787] usb 3-1: config 0 descriptor?? [ 1004.722204][ T5787] uvcvideo 3-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 1004.722236][ T5787] uvcvideo 3-1:0.105: No valid video chain found. [ 1005.063516][T23896] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1005.064106][T23896] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1005.087667][T11052] usb 3-1: USB disconnect, device number 30 [ 1005.774161][T23935] FAULT_INJECTION: forcing a failure. [ 1005.774161][T23935] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1005.774196][T23935] CPU: 0 UID: 0 PID: 23935 Comm: syz.2.5613 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1005.774221][T23935] Tainted: [L]=SOFTLOCKUP [ 1005.774228][T23935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1005.774239][T23935] Call Trace: [ 1005.774246][T23935] [ 1005.774255][T23935] dump_stack_lvl+0xe8/0x150 [ 1005.774283][T23935] should_fail_ex+0x46b/0x600 [ 1005.774313][T23935] _copy_from_user+0x2d/0xb0 [ 1005.774333][T23935] udmabuf_ioctl+0xfa/0x310 [ 1005.774358][T23935] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 1005.774387][T23935] ? __fget_files+0x2a/0x420 [ 1005.774403][T23935] ? __fget_files+0x3a6/0x420 [ 1005.774419][T23935] ? __fget_files+0x2a/0x420 [ 1005.774439][T23935] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1005.774462][T23935] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 1005.774483][T23935] __se_sys_ioctl+0xff/0x170 [ 1005.774504][T23935] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1005.774524][T23935] do_syscall_64+0x15f/0x560 [ 1005.774546][T23935] ? trace_irq_disable+0x3b/0x140 [ 1005.774565][T23935] ? clear_bhb_loop+0x40/0x90 [ 1005.774588][T23935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1005.774606][T23935] RIP: 0033:0x7f079ed3ce59 [ 1005.774624][T23935] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1005.774639][T23935] RSP: 002b:00007f079cf8e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1005.774664][T23935] RAX: ffffffffffffffda RBX: 00007f079efb5fa0 RCX: 00007f079ed3ce59 [ 1005.774678][T23935] RDX: 0000200000000000 RSI: 0000000040187542 RDI: 0000000000000003 [ 1005.774690][T23935] RBP: 00007f079cf8e090 R08: 0000000000000000 R09: 0000000000000000 [ 1005.774702][T23935] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1005.774713][T23935] R13: 00007f079efb6038 R14: 00007f079efb5fa0 R15: 00007ffd63f595e8 [ 1005.774742][T23935] [ 1006.062715][T23944] FAULT_INJECTION: forcing a failure. [ 1006.062715][T23944] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1006.062738][T23944] CPU: 1 UID: 0 PID: 23944 Comm: syz.2.5617 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1006.062753][T23944] Tainted: [L]=SOFTLOCKUP [ 1006.062757][T23944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1006.062765][T23944] Call Trace: [ 1006.062772][T23944] [ 1006.062779][T23944] dump_stack_lvl+0xe8/0x150 [ 1006.062805][T23944] should_fail_ex+0x46b/0x600 [ 1006.062830][T23944] _copy_to_user+0x31/0xb0 [ 1006.062843][T23944] simple_read_from_buffer+0xe1/0x170 [ 1006.062863][T23944] proc_fail_nth_read+0x1be/0x230 [ 1006.062877][T23944] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1006.062889][T23944] ? rw_verify_area+0x2ac/0x4e0 [ 1006.062901][T23944] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1006.062912][T23944] vfs_read+0x212/0xa80 [ 1006.062928][T23944] ? __pfx_vfs_read+0x10/0x10 [ 1006.062940][T23944] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1006.062955][T23944] ? lockdep_hardirqs_on+0x7a/0x110 [ 1006.062969][T23944] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1006.062982][T23944] ? mutex_lock_nested+0x152/0x1d0 [ 1006.062991][T23944] ? fdget_pos+0x252/0x320 [ 1006.063005][T23944] ksys_read+0x156/0x270 [ 1006.063018][T23944] ? __pfx_ksys_read+0x10/0x10 [ 1006.063029][T23944] ? __pfx_blkdev_ioctl+0x10/0x10 [ 1006.063047][T23944] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1006.063058][T23944] do_syscall_64+0x15f/0x560 [ 1006.063071][T23944] ? trace_irq_disable+0x3b/0x140 [ 1006.063083][T23944] ? clear_bhb_loop+0x40/0x90 [ 1006.063095][T23944] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1006.063105][T23944] RIP: 0033:0x7f079ecfd68e [ 1006.063116][T23944] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1006.063124][T23944] RSP: 002b:00007f079cf8dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1006.063135][T23944] RAX: ffffffffffffffda RBX: 00007f079cf8e6c0 RCX: 00007f079ecfd68e [ 1006.063143][T23944] RDX: 000000000000000f RSI: 00007f079cf8e0a0 RDI: 0000000000000004 [ 1006.063149][T23944] RBP: 00007f079cf8e090 R08: 0000000000000000 R09: 0000000000000000 [ 1006.063156][T23944] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1006.063162][T23944] R13: 00007f079efb6038 R14: 00007f079efb5fa0 R15: 00007ffd63f595e8 [ 1006.063178][T23944] [ 1006.373974][T23955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1006.374507][T23955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1006.713168][T23964] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1006.714907][T23964] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1006.717204][T23964] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1006.770366][T23964] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1007.053937][T23983] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5631'. [ 1007.124033][T23987] FAULT_INJECTION: forcing a failure. [ 1007.124033][T23987] name failslab, interval 1, probability 0, space 0, times 0 [ 1007.124056][T23987] CPU: 1 UID: 0 PID: 23987 Comm: syz.9.5632 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1007.124071][T23987] Tainted: [L]=SOFTLOCKUP [ 1007.124075][T23987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1007.124082][T23987] Call Trace: [ 1007.124086][T23987] [ 1007.124091][T23987] dump_stack_lvl+0xe8/0x150 [ 1007.124106][T23987] should_fail_ex+0x46b/0x600 [ 1007.124123][T23987] should_failslab+0xa8/0x100 [ 1007.124136][T23987] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 1007.124147][T23987] ? __alloc_skb+0x1d0/0x7d0 [ 1007.124159][T23987] ? lockdep_hardirqs_on+0x7a/0x110 [ 1007.124176][T23987] __alloc_skb+0x1d0/0x7d0 [ 1007.124189][T23987] ? __might_fault+0xaf/0x130 [ 1007.124208][T23987] alloc_skb_with_frags+0xc8/0x760 [ 1007.124228][T23987] sock_alloc_send_pskb+0x884/0x9a0 [ 1007.124246][T23987] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1007.124265][T23987] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1007.124282][T23987] ? dev_get_by_index+0x22/0x2f0 [ 1007.124292][T23987] ? dev_get_by_index+0x22/0x2f0 [ 1007.124304][T23987] packet_sendmsg+0x3167/0x4fd0 [ 1007.124315][T23987] ? aa_label_sk_perm+0x532/0x6e0 [ 1007.124335][T23987] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 1007.124350][T23987] ? __lock_acquire+0x6b5/0x2d10 [ 1007.124366][T23987] ? __lock_acquire+0x6b5/0x2d10 [ 1007.124385][T23987] ? __pfx_packet_sendmsg+0x10/0x10 [ 1007.124399][T23987] ? aa_sk_perm+0x703/0x950 [ 1007.124417][T23987] ? __pfx_aa_sk_perm+0x10/0x10 [ 1007.124430][T23987] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1007.124444][T23987] ? aa_sock_msg_perm+0x122/0x200 [ 1007.124454][T23987] ? __pfx_packet_sendmsg+0x10/0x10 [ 1007.124463][T23987] sock_sendmsg_nosec+0x112/0x150 [ 1007.124475][T23987] __sys_sendto+0x402/0x590 [ 1007.124491][T23987] ? __pfx___sys_sendto+0x10/0x10 [ 1007.124515][T23987] ? ksys_write+0x248/0x270 [ 1007.124528][T23987] ? __pfx_ksys_write+0x10/0x10 [ 1007.124541][T23987] __x64_sys_sendto+0xde/0x100 [ 1007.124555][T23987] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1007.124566][T23987] do_syscall_64+0x15f/0x560 [ 1007.124578][T23987] ? trace_irq_disable+0x3b/0x140 [ 1007.124590][T23987] ? clear_bhb_loop+0x40/0x90 [ 1007.124602][T23987] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1007.124611][T23987] RIP: 0033:0x7f521186ce59 [ 1007.124622][T23987] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1007.124631][T23987] RSP: 002b:00007f520fabe028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1007.124642][T23987] RAX: ffffffffffffffda RBX: 00007f5211ae5fa0 RCX: 00007f521186ce59 [ 1007.124650][T23987] RDX: 000000000000002a RSI: 0000200000000280 RDI: 0000000000000003 [ 1007.124656][T23987] RBP: 00007f520fabe090 R08: 00002000000000c0 R09: 0000000000000014 [ 1007.124663][T23987] R10: 00000000040008c1 R11: 0000000000000246 R12: 0000000000000001 [ 1007.124669][T23987] R13: 00007f5211ae6038 R14: 00007f5211ae5fa0 R15: 00007fff609117d8 [ 1007.124684][T23987] [ 1007.535739][T23999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1007.536799][T23999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1007.711372][T24007] FAULT_INJECTION: forcing a failure. [ 1007.711372][T24007] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1007.711408][T24007] CPU: 0 UID: 0 PID: 24007 Comm: syz.4.5640 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1007.711434][T24007] Tainted: [L]=SOFTLOCKUP [ 1007.711440][T24007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1007.711454][T24007] Call Trace: [ 1007.711461][T24007] [ 1007.711470][T24007] dump_stack_lvl+0xe8/0x150 [ 1007.711502][T24007] should_fail_ex+0x46b/0x600 [ 1007.711530][T24007] _copy_from_user+0x2d/0xb0 [ 1007.711550][T24007] do_handle_open+0x57b/0x970 [ 1007.711577][T24007] ? __pfx_do_handle_open+0x10/0x10 [ 1007.711601][T24007] ? ksys_write+0x248/0x270 [ 1007.711624][T24007] ? __pfx_ksys_write+0x10/0x10 [ 1007.711651][T24007] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1007.711670][T24007] do_syscall_64+0x15f/0x560 [ 1007.711692][T24007] ? trace_irq_disable+0x3b/0x140 [ 1007.711711][T24007] ? clear_bhb_loop+0x40/0x90 [ 1007.711733][T24007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1007.711750][T24007] RIP: 0033:0x7f3a7963ce59 [ 1007.711767][T24007] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1007.711783][T24007] RSP: 002b:00007f3a77896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 [ 1007.711803][T24007] RAX: ffffffffffffffda RBX: 00007f3a798b5fa0 RCX: 00007f3a7963ce59 [ 1007.711816][T24007] RDX: 0000000000000c80 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1007.711828][T24007] RBP: 00007f3a77896090 R08: 0000000000000000 R09: 0000000000000000 [ 1007.711840][T24007] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1007.711851][T24007] R13: 00007f3a798b6038 R14: 00007f3a798b5fa0 R15: 00007ffd23f790a8 [ 1007.711879][T24007] [ 1008.012174][T24017] FAULT_INJECTION: forcing a failure. [ 1008.012174][T24017] name failslab, interval 1, probability 0, space 0, times 0 [ 1008.012209][T24017] CPU: 0 UID: 0 PID: 24017 Comm: syz.2.5645 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1008.012235][T24017] Tainted: [L]=SOFTLOCKUP [ 1008.012242][T24017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1008.012253][T24017] Call Trace: [ 1008.012261][T24017] [ 1008.012269][T24017] dump_stack_lvl+0xe8/0x150 [ 1008.012296][T24017] should_fail_ex+0x46b/0x600 [ 1008.012325][T24017] should_failslab+0xa8/0x100 [ 1008.012346][T24017] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 1008.012367][T24017] ? __alloc_skb+0x1d0/0x7d0 [ 1008.012388][T24017] ? lockdep_hardirqs_on+0x7a/0x110 [ 1008.012418][T24017] __alloc_skb+0x1d0/0x7d0 [ 1008.012443][T24017] netlink_sendmsg+0x5d4/0xb40 [ 1008.012483][T24017] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1008.012508][T24017] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1008.012534][T24017] ? aa_sock_msg_perm+0x122/0x200 [ 1008.012552][T24017] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1008.012575][T24017] sock_sendmsg_nosec+0x112/0x150 [ 1008.012598][T24017] ____sys_sendmsg+0x55c/0x870 [ 1008.012627][T24017] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1008.012659][T24017] ? import_iovec+0x73/0xa0 [ 1008.012681][T24017] ___sys_sendmsg+0x2a5/0x360 [ 1008.012703][T24017] ? __lock_acquire+0x6b5/0x2d10 [ 1008.012728][T24017] ? __pfx____sys_sendmsg+0x10/0x10 [ 1008.012783][T24017] ? __fget_files+0x2a/0x420 [ 1008.012800][T24017] ? __fget_files+0x3a6/0x420 [ 1008.012826][T24017] __x64_sys_sendmsg+0x1c3/0x2a0 [ 1008.012853][T24017] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1008.012885][T24017] ? __pfx_ksys_write+0x10/0x10 [ 1008.012914][T24017] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1008.012934][T24017] do_syscall_64+0x15f/0x560 [ 1008.012956][T24017] ? trace_irq_disable+0x3b/0x140 [ 1008.012975][T24017] ? clear_bhb_loop+0x40/0x90 [ 1008.012997][T24017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1008.013015][T24017] RIP: 0033:0x7f079ed3ce59 [ 1008.013037][T24017] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1008.013052][T24017] RSP: 002b:00007f079cf8e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1008.013072][T24017] RAX: ffffffffffffffda RBX: 00007f079efb5fa0 RCX: 00007f079ed3ce59 [ 1008.013086][T24017] RDX: 0000000000000840 RSI: 0000200000000140 RDI: 0000000000000003 [ 1008.013097][T24017] RBP: 00007f079cf8e090 R08: 0000000000000000 R09: 0000000000000000 [ 1008.013109][T24017] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1008.013120][T24017] R13: 00007f079efb6038 R14: 00007f079efb5fa0 R15: 00007ffd63f595e8 [ 1008.013148][T24017] [ 1008.461454][T24029] netlink: 28 bytes leftover after parsing attributes in process `syz.6.5650'. [ 1008.722156][T24047] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1008.722799][T24047] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1008.888706][ T5787] usb 3-1: new full-speed USB device number 31 using dummy_hcd [ 1009.043118][ T5787] usb 3-1: config 8 has an invalid interface number: 223 but max is 0 [ 1009.043145][ T5787] usb 3-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 1009.043162][ T5787] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1009.043180][ T5787] usb 3-1: config 8 has no interface number 0 [ 1009.043226][ T5787] usb 3-1: config 8 interface 223 altsetting 0 endpoint 0x7 has invalid maxpacket 15872, setting to 64 [ 1009.043251][ T5787] usb 3-1: config 8 interface 223 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1009.045757][ T5787] usb 3-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d [ 1009.045784][ T5787] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1009.045803][ T5787] usb 3-1: Product: syz [ 1009.045816][ T5787] usb 3-1: Manufacturer: syz [ 1009.045829][ T5787] usb 3-1: SerialNumber: syz [ 1009.176096][T24057] comedi comedi1: comedi_config --init_data is deprecated [ 1009.295515][T24062] Bluetooth: MGMT ver 1.23 [ 1009.398346][T24066] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5662'. [ 1009.446968][ T5787] usb 3-1: USB disconnect, device number 31 [ 1009.630608][T24084] netlink: 60 bytes leftover after parsing attributes in process `syz.9.5667'. [ 1009.631927][T24084] netlink: 60 bytes leftover after parsing attributes in process `syz.9.5667'. [ 1009.798148][T24094] netlink: 10 bytes leftover after parsing attributes in process `syz.9.5670'. [ 1009.892082][T24096] netlink: 28 bytes leftover after parsing attributes in process `syz.6.5672'. [ 1010.301761][T24110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1010.303876][T24110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1010.771428][T24120] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5681'. [ 1010.771462][T24120] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5681'. [ 1011.035304][T24115] FAULT_INJECTION: forcing a failure. [ 1011.035304][T24115] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1011.035339][T24115] CPU: 1 UID: 0 PID: 24115 Comm: syz.4.5679 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1011.035365][T24115] Tainted: [L]=SOFTLOCKUP [ 1011.035372][T24115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1011.035388][T24115] Call Trace: [ 1011.035395][T24115] [ 1011.035403][T24115] dump_stack_lvl+0xe8/0x150 [ 1011.035429][T24115] should_fail_ex+0x46b/0x600 [ 1011.035458][T24115] _copy_from_user+0x2d/0xb0 [ 1011.035478][T24115] userfaultfd_ioctl+0x985/0x4dc0 [ 1011.035501][T24115] ? __kasan_slab_free+0x5c/0x80 [ 1011.035517][T24115] ? kfree+0x1c5/0x6c0 [ 1011.035531][T24115] ? tomoyo_path_number_perm+0x501/0x630 [ 1011.035553][T24115] ? __se_sys_ioctl+0x47/0x170 [ 1011.035574][T24115] ? do_syscall_64+0x15f/0x560 [ 1011.035594][T24115] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1011.035621][T24115] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 1011.035662][T24115] ? kasan_quarantine_put+0xbb/0x1f0 [ 1011.035687][T24115] ? tomoyo_path_number_perm+0x219/0x630 [ 1011.035717][T24115] ? do_vfs_ioctl+0x117b/0x1540 [ 1011.035740][T24115] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1011.035786][T24115] ? __fget_files+0x2a/0x420 [ 1011.035806][T24115] ? __fget_files+0x2a/0x420 [ 1011.035820][T24115] ? __fget_files+0x3a6/0x420 [ 1011.035835][T24115] ? __fget_files+0x2a/0x420 [ 1011.035852][T24115] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1011.035875][T24115] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 1011.035894][T24115] __se_sys_ioctl+0xff/0x170 [ 1011.035912][T24115] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1011.035930][T24115] do_syscall_64+0x15f/0x560 [ 1011.035959][T24115] ? trace_irq_disable+0x3b/0x140 [ 1011.035978][T24115] ? clear_bhb_loop+0x40/0x90 [ 1011.035999][T24115] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1011.036017][T24115] RIP: 0033:0x7f3a7963ce59 [ 1011.036034][T24115] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1011.036050][T24115] RSP: 002b:00007f3a77896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1011.036070][T24115] RAX: ffffffffffffffda RBX: 00007f3a798b5fa0 RCX: 00007f3a7963ce59 [ 1011.036084][T24115] RDX: 0000200000000080 RSI: 00000000c020aa04 RDI: 0000000000000003 [ 1011.036097][T24115] RBP: 00007f3a77896090 R08: 0000000000000000 R09: 0000000000000000 [ 1011.036109][T24115] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1011.036120][T24115] R13: 00007f3a798b6038 R14: 00007f3a798b5fa0 R15: 00007ffd23f790a8 [ 1011.036150][T24115] [ 1011.090217][T24130] FAULT_INJECTION: forcing a failure. [ 1011.090217][T24130] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1011.090261][T24130] CPU: 1 UID: 0 PID: 24130 Comm: syz.9.5685 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1011.090286][T24130] Tainted: [L]=SOFTLOCKUP [ 1011.090293][T24130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1011.090305][T24130] Call Trace: [ 1011.090312][T24130] [ 1011.090320][T24130] dump_stack_lvl+0xe8/0x150 [ 1011.090346][T24130] should_fail_ex+0x46b/0x600 [ 1011.090376][T24130] _copy_to_user+0x31/0xb0 [ 1011.090398][T24130] simple_read_from_buffer+0xe1/0x170 [ 1011.090429][T24130] proc_fail_nth_read+0x1be/0x230 [ 1011.090452][T24130] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1011.090474][T24130] ? rw_verify_area+0x2ac/0x4e0 [ 1011.090494][T24130] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1011.090514][T24130] vfs_read+0x212/0xa80 [ 1011.090541][T24130] ? __pfx_vfs_read+0x10/0x10 [ 1011.090563][T24130] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1011.090585][T24130] ? lockdep_hardirqs_on+0x7a/0x110 [ 1011.090607][T24130] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1011.090629][T24130] ? mutex_lock_nested+0x152/0x1d0 [ 1011.090646][T24130] ? fdget_pos+0x252/0x320 [ 1011.090671][T24130] ksys_read+0x156/0x270 [ 1011.090693][T24130] ? __pfx_ksys_read+0x10/0x10 [ 1011.090720][T24130] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1011.090739][T24130] do_syscall_64+0x15f/0x560 [ 1011.090761][T24130] ? trace_irq_disable+0x3b/0x140 [ 1011.090779][T24130] ? clear_bhb_loop+0x40/0x90 [ 1011.090799][T24130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1011.090816][T24130] RIP: 0033:0x7f521182d68e [ 1011.090833][T24130] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1011.090850][T24130] RSP: 002b:00007f520fabdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1011.090869][T24130] RAX: ffffffffffffffda RBX: 00007f520fabe6c0 RCX: 00007f521182d68e [ 1011.090883][T24130] RDX: 000000000000000f RSI: 00007f520fabe0a0 RDI: 0000000000000004 [ 1011.090894][T24130] RBP: 00007f520fabe090 R08: 0000000000000000 R09: 0000000000000000 [ 1011.090905][T24130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1011.090916][T24130] R13: 00007f5211ae6038 R14: 00007f5211ae5fa0 R15: 00007fff609117d8 [ 1011.090944][T24130] [ 1011.604163][T24142] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5690'. [ 1011.757030][T24149] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1011.757636][T24149] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1011.843632][T24157] binder: 24155:24157 ioctl 400c620e 200000008dc0 returned -22 [ 1011.959034][T24160] FAULT_INJECTION: forcing a failure. [ 1011.959034][T24160] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1011.959058][T24160] CPU: 0 UID: 0 PID: 24160 Comm: syz.6.5696 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1011.959074][T24160] Tainted: [L]=SOFTLOCKUP [ 1011.959078][T24160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1011.959085][T24160] Call Trace: [ 1011.959089][T24160] [ 1011.959094][T24160] dump_stack_lvl+0xe8/0x150 [ 1011.959110][T24160] should_fail_ex+0x46b/0x600 [ 1011.959128][T24160] _copy_from_user+0x2d/0xb0 [ 1011.959139][T24160] get_timespec64+0x96/0x1b0 [ 1011.959153][T24160] ? __pfx_get_timespec64+0x10/0x10 [ 1011.959170][T24160] __x64_sys_recvmmsg+0x14b/0x250 [ 1011.959187][T24160] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1011.959206][T24160] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1011.959217][T24160] do_syscall_64+0x15f/0x560 [ 1011.959231][T24160] ? trace_irq_disable+0x3b/0x140 [ 1011.959242][T24160] ? clear_bhb_loop+0x40/0x90 [ 1011.959254][T24160] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1011.959264][T24160] RIP: 0033:0x7f229efcce59 [ 1011.959274][T24160] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1011.959282][T24160] RSP: 002b:00007f229d21e028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1011.959294][T24160] RAX: ffffffffffffffda RBX: 00007f229f245fa0 RCX: 00007f229efcce59 [ 1011.959301][T24160] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 1011.959308][T24160] RBP: 00007f229d21e090 R08: 0000200000003700 R09: 0000000000000000 [ 1011.959315][T24160] R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000001 [ 1011.959321][T24160] R13: 00007f229f246038 R14: 00007f229f245fa0 R15: 00007fff7a6a69f8 [ 1011.959336][T24160] [ 1012.095585][T24164] FAULT_INJECTION: forcing a failure. [ 1012.095585][T24164] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1012.095627][T24164] CPU: 1 UID: 0 PID: 24164 Comm: syz.6.5699 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1012.095655][T24164] Tainted: [L]=SOFTLOCKUP [ 1012.095662][T24164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1012.095673][T24164] Call Trace: [ 1012.095680][T24164] [ 1012.095688][T24164] dump_stack_lvl+0xe8/0x150 [ 1012.095715][T24164] should_fail_ex+0x46b/0x600 [ 1012.095744][T24164] _copy_to_user+0x31/0xb0 [ 1012.095766][T24164] simple_read_from_buffer+0xe1/0x170 [ 1012.095798][T24164] proc_fail_nth_read+0x1be/0x230 [ 1012.095821][T24164] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1012.095842][T24164] ? rw_verify_area+0x2ac/0x4e0 [ 1012.095861][T24164] ? rt_spin_lock+0x1e0/0x400 [ 1012.095878][T24164] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1012.095898][T24164] vfs_read+0x212/0xa80 [ 1012.095926][T24164] ? __pfx_vfs_read+0x10/0x10 [ 1012.095947][T24164] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1012.095970][T24164] ? lockdep_hardirqs_on+0x7a/0x110 [ 1012.095992][T24164] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1012.096014][T24164] ? mutex_lock_nested+0x152/0x1d0 [ 1012.096031][T24164] ? fdget_pos+0x252/0x320 [ 1012.096056][T24164] ksys_read+0x156/0x270 [ 1012.096078][T24164] ? __pfx_ksys_read+0x10/0x10 [ 1012.096105][T24164] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1012.096125][T24164] do_syscall_64+0x15f/0x560 [ 1012.096152][T24164] ? trace_irq_disable+0x3b/0x140 [ 1012.096171][T24164] ? clear_bhb_loop+0x40/0x90 [ 1012.096192][T24164] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1012.096210][T24164] RIP: 0033:0x7f229ef8d68e [ 1012.096227][T24164] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1012.096242][T24164] RSP: 002b:00007f229d21dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1012.096261][T24164] RAX: ffffffffffffffda RBX: 00007f229d21e6c0 RCX: 00007f229ef8d68e [ 1012.096273][T24164] RDX: 000000000000000f RSI: 00007f229d21e0a0 RDI: 0000000000000004 [ 1012.096288][T24164] RBP: 00007f229d21e090 R08: 0000000000000000 R09: 0000000000000000 [ 1012.096299][T24164] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1012.096310][T24164] R13: 00007f229f246038 R14: 00007f229f245fa0 R15: 00007fff7a6a69f8 [ 1012.096338][T24164] [ 1012.413995][T24174] __nla_validate_parse: 3 callbacks suppressed [ 1012.414013][T24174] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5704'. [ 1012.414041][T24174] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5704'. [ 1012.655697][T24186] netlink: 64 bytes leftover after parsing attributes in process `syz.9.5707'. [ 1012.745340][T24189] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1012.864861][T24193] FAULT_INJECTION: forcing a failure. [ 1012.864861][T24193] name failslab, interval 1, probability 0, space 0, times 0 [ 1012.864905][T24193] CPU: 0 UID: 0 PID: 24193 Comm: syz.2.5710 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1012.864929][T24193] Tainted: [L]=SOFTLOCKUP [ 1012.864936][T24193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1012.864946][T24193] Call Trace: [ 1012.864953][T24193] [ 1012.864962][T24193] dump_stack_lvl+0xe8/0x150 [ 1012.864987][T24193] should_fail_ex+0x46b/0x600 [ 1012.865016][T24193] should_failslab+0xa8/0x100 [ 1012.865038][T24193] __kmalloc_cache_noprof+0x84/0x690 [ 1012.865058][T24193] ? cma_alloc_port+0xb9/0x680 [ 1012.865079][T24193] cma_alloc_port+0xb9/0x680 [ 1012.865099][T24193] rdma_bind_addr_dst+0x297c/0x3610 [ 1012.865122][T24193] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1012.865148][T24193] ? reacquire_held_locks+0x104/0x190 [ 1012.865166][T24193] ? rt_spin_lock+0x1e0/0x400 [ 1012.865183][T24193] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1012.865199][T24193] ? rt_spin_unlock+0x14f/0x200 [ 1012.865220][T24193] rdma_resolve_addr+0x66c/0x2160 [ 1012.865243][T24193] ? do_raw_spin_lock+0x12b/0x2f0 [ 1012.865257][T24193] ? __pfx_rdma_resolve_addr+0x10/0x10 [ 1012.865297][T24193] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1012.865314][T24193] ? mutex_lock_nested+0x152/0x1d0 [ 1012.865330][T24193] ? ucma_resolve_ip+0x302/0x490 [ 1012.865348][T24193] ucma_resolve_ip+0x338/0x490 [ 1012.865365][T24193] ? __pfx_ucma_resolve_ip+0x10/0x10 [ 1012.865393][T24193] ucma_write+0x257/0x2f0 [ 1012.865410][T24193] ? __pfx_ucma_write+0x10/0x10 [ 1012.865426][T24193] ? rw_verify_area+0x25b/0x4e0 [ 1012.865441][T24193] ? __pfx_ucma_write+0x10/0x10 [ 1012.865456][T24193] vfs_write+0x2a3/0xba0 [ 1012.865478][T24193] ? __pfx_vfs_write+0x10/0x10 [ 1012.865494][T24193] ? __fget_files+0x2a/0x420 [ 1012.865510][T24193] ? __fget_files+0x2a/0x420 [ 1012.865523][T24193] ? __fget_files+0x3a6/0x420 [ 1012.865535][T24193] ? __fget_files+0x2a/0x420 [ 1012.865554][T24193] ksys_write+0x156/0x270 [ 1012.865572][T24193] ? __pfx_ksys_write+0x10/0x10 [ 1012.865594][T24193] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1012.865609][T24193] do_syscall_64+0x15f/0x560 [ 1012.865628][T24193] ? trace_irq_disable+0x3b/0x140 [ 1012.865644][T24193] ? clear_bhb_loop+0x40/0x90 [ 1012.865661][T24193] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1012.865695][T24193] RIP: 0033:0x7f079ed3ce59 [ 1012.865709][T24193] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1012.865722][T24193] RSP: 002b:00007f079cf8e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1012.865737][T24193] RAX: ffffffffffffffda RBX: 00007f079efb5fa0 RCX: 00007f079ed3ce59 [ 1012.865748][T24193] RDX: 0000000000000048 RSI: 0000200000000180 RDI: 0000000000000003 [ 1012.865757][T24193] RBP: 00007f079cf8e090 R08: 0000000000000000 R09: 0000000000000000 [ 1012.865766][T24193] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1012.865775][T24193] R13: 00007f079efb6038 R14: 00007f079efb5fa0 R15: 00007ffd63f595e8 [ 1012.865798][T24193] [ 1013.259290][T24202] netlink: 'syz.2.5714': attribute type 10 has an invalid length. [ 1013.259485][T24202] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1013.298480][T24202] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1013.399991][T24202] bond0: (slave batadv_slave_1): Enslaving as an active interface with an up link [ 1013.439283][T24207] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5715'. [ 1013.439318][T24207] netlink: 16 bytes leftover after parsing attributes in process `syz.9.5715'. [ 1013.531553][T24210] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1013.532166][T24210] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1013.653217][T24214] netlink: 'syz.2.5717': attribute type 21 has an invalid length. [ 1013.654240][T24214] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5717'. [ 1013.868187][T24223] FAULT_INJECTION: forcing a failure. [ 1013.868187][T24223] name failslab, interval 1, probability 0, space 0, times 0 [ 1013.868210][T24223] CPU: 0 UID: 0 PID: 24223 Comm: syz.6.5719 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1013.868225][T24223] Tainted: [L]=SOFTLOCKUP [ 1013.868229][T24223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1013.868235][T24223] Call Trace: [ 1013.868240][T24223] [ 1013.868245][T24223] dump_stack_lvl+0xe8/0x150 [ 1013.868262][T24223] should_fail_ex+0x46b/0x600 [ 1013.868280][T24223] should_failslab+0xa8/0x100 [ 1013.868294][T24223] kmem_cache_alloc_noprof+0x87/0x680 [ 1013.868305][T24223] ? dst_alloc+0x105/0x170 [ 1013.868324][T24223] dst_alloc+0x105/0x170 [ 1013.868336][T24223] ip_route_output_key_hash_rcu+0x14d0/0x25e0 [ 1013.868354][T24223] ? ip_route_output_key_hash+0xd8/0x2a0 [ 1013.868367][T24223] ip_route_output_key_hash+0x18d/0x2a0 [ 1013.868380][T24223] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 1013.868394][T24223] ? stack_trace_save+0xa9/0x100 [ 1013.868404][T24223] ? __pfx_stack_trace_save+0x10/0x10 [ 1013.868418][T24223] tcp_v4_connect+0x74e/0x19b0 [ 1013.868436][T24223] ? do_getsockname+0x1de/0x1f0 [ 1013.868455][T24223] ? __pfx_tcp_v4_connect+0x10/0x10 [ 1013.868474][T24223] __inet_stream_connect+0x25a/0xdd0 [ 1013.868493][T24223] ? __pfx___inet_stream_connect+0x10/0x10 [ 1013.868513][T24223] ? __kasan_kmalloc+0x93/0xb0 [ 1013.868532][T24223] ? __kmalloc_cache_noprof+0x3a6/0x690 [ 1013.868549][T24223] ? tcp_sendmsg_fastopen+0x1de/0x5e0 [ 1013.868573][T24223] tcp_sendmsg_fastopen+0x3a7/0x5e0 [ 1013.868600][T24223] tcp_sendmsg_locked+0x4a8e/0x5370 [ 1013.868623][T24223] ? __lock_acquire+0x6b5/0x2d10 [ 1013.868642][T24223] ? tcp_sendmsg_locked+0x2a1/0x5370 [ 1013.868676][T24223] ? __lock_acquire+0x6b5/0x2d10 [ 1013.868705][T24223] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1013.868727][T24223] ? lockdep_hardirqs_on+0x7a/0x110 [ 1013.868749][T24223] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1013.868767][T24223] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 1013.868781][T24223] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 1013.868800][T24223] ? __local_bh_enable_ip+0x1ae/0x2b0 [ 1013.868815][T24223] ? lockdep_hardirqs_on+0x7a/0x110 [ 1013.868837][T24223] tcp_sendmsg+0x2f/0x50 [ 1013.868850][T24223] ? __pfx_inet_sendmsg+0x10/0x10 [ 1013.868861][T24223] sock_sendmsg_nosec+0xf9/0x150 [ 1013.868876][T24223] __sys_sendto+0x402/0x590 [ 1013.868893][T24223] ? __pfx___sys_sendto+0x10/0x10 [ 1013.868918][T24223] ? ksys_write+0x248/0x270 [ 1013.868932][T24223] ? __pfx_ksys_write+0x10/0x10 [ 1013.868946][T24223] __x64_sys_sendto+0xde/0x100 [ 1013.868960][T24223] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1013.868971][T24223] do_syscall_64+0x15f/0x560 [ 1013.868990][T24223] ? trace_irq_disable+0x3b/0x140 [ 1013.869010][T24223] ? clear_bhb_loop+0x40/0x90 [ 1013.869032][T24223] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1013.869049][T24223] RIP: 0033:0x7f229efcce59 [ 1013.869066][T24223] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1013.869081][T24223] RSP: 002b:00007f229d21e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1013.869096][T24223] RAX: ffffffffffffffda RBX: 00007f229f245fa0 RCX: 00007f229efcce59 [ 1013.869104][T24223] RDX: ffffffffffffff58 RSI: 0000200000000140 RDI: 0000000000000003 [ 1013.869110][T24223] RBP: 00007f229d21e090 R08: 0000200000000100 R09: 0000000000000010 [ 1013.869117][T24223] R10: 0000000020008005 R11: 0000000000000246 R12: 0000000000000001 [ 1013.869123][T24223] R13: 00007f229f246038 R14: 00007f229f245fa0 R15: 00007fff7a6a69f8 [ 1013.869139][T24223] [ 1014.284947][T24237] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5724'. [ 1014.284979][T24237] netlink: 16 bytes leftover after parsing attributes in process `syz.9.5724'. [ 1014.428916][ T9] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 1014.506455][T24241] picdev_read: 59 callbacks suppressed [ 1014.506478][T24241] kvm: pic: non byte read [ 1014.591286][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 1014.597876][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1014.597908][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1014.597930][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1014.597976][ T9] usb 3-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 1014.597998][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1014.614313][ T9] usb 3-1: config 0 descriptor?? [ 1014.945672][ T9] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.0020/input/input57 [ 1015.076126][T24268] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1015.076917][T24268] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1015.313976][T24273] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1015.315284][ T9] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.0020/input/input58 [ 1015.322824][T24273] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1015.567638][ T9] kye 0003:0458:5011.0020: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.2-1/input0 [ 1015.806084][ T9] usb 3-1: USB disconnect, device number 32 [ 1015.896570][T24307] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5735'. [ 1015.896601][T24307] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5735'. [ 1016.268055][T24315] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1016.289034][T24315] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1016.688077][T24357] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1016.689276][T24357] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1016.918701][ T9] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 1017.058678][T14913] Bluetooth: hci4: command 0x2016 tx timeout [ 1017.096556][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 1017.122659][ T9] usb 3-1: config 0 has an invalid interface number: 105 but max is 0 [ 1017.122681][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1017.122691][ T9] usb 3-1: config 0 has no interface number 0 [ 1017.157138][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 1017.157169][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1017.157186][ T9] usb 3-1: Product: syz [ 1017.157199][ T9] usb 3-1: Manufacturer: syz [ 1017.157212][ T9] usb 3-1: SerialNumber: syz [ 1017.170425][ T9] usb 3-1: config 0 descriptor?? [ 1017.208584][ T9] uvcvideo 3-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 1017.208665][ T9] uvcvideo 3-1:0.105: No valid video chain found. [ 1017.481543][T23482] usb 3-1: USB disconnect, device number 33 [ 1017.892805][T24391] binder: 24390:24391 ioctl 400c620e 200000008dc0 returned -22 [ 1017.974270][T24393] __nla_validate_parse: 3 callbacks suppressed [ 1017.974290][T24393] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5754'. [ 1017.974315][T24393] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5754'. [ 1018.355523][T24418] netlink: 14752 bytes leftover after parsing attributes in process `syz.9.5762'. [ 1018.424166][T24422] FAULT_INJECTION: forcing a failure. [ 1018.424166][T24422] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1018.424190][T24422] CPU: 1 UID: 0 PID: 24422 Comm: syz.9.5764 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1018.424205][T24422] Tainted: [L]=SOFTLOCKUP [ 1018.424209][T24422] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1018.424215][T24422] Call Trace: [ 1018.424220][T24422] [ 1018.424225][T24422] dump_stack_lvl+0xe8/0x150 [ 1018.424242][T24422] should_fail_ex+0x46b/0x600 [ 1018.424260][T24422] _copy_to_user+0x31/0xb0 [ 1018.424272][T24422] simple_read_from_buffer+0xe1/0x170 [ 1018.424292][T24422] proc_fail_nth_read+0x1be/0x230 [ 1018.424305][T24422] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1018.424318][T24422] ? rw_verify_area+0x2ac/0x4e0 [ 1018.424336][T24422] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1018.424348][T24422] vfs_read+0x212/0xa80 [ 1018.424363][T24422] ? __pfx_vfs_read+0x10/0x10 [ 1018.424376][T24422] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1018.424390][T24422] ? lockdep_hardirqs_on+0x7a/0x110 [ 1018.424404][T24422] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1018.424417][T24422] ? mutex_lock_nested+0x152/0x1d0 [ 1018.424427][T24422] ? fdget_pos+0x252/0x320 [ 1018.424441][T24422] ksys_read+0x156/0x270 [ 1018.424454][T24422] ? __pfx_ksys_read+0x10/0x10 [ 1018.424465][T24422] ? __pfx_tty_ioctl+0x10/0x10 [ 1018.424480][T24422] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1018.424497][T24422] do_syscall_64+0x15f/0x560 [ 1018.424518][T24422] ? trace_irq_disable+0x3b/0x140 [ 1018.424536][T24422] ? clear_bhb_loop+0x40/0x90 [ 1018.424558][T24422] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1018.424574][T24422] RIP: 0033:0x7f521182d68e [ 1018.424591][T24422] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1018.424603][T24422] RSP: 002b:00007f520fabdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1018.424614][T24422] RAX: ffffffffffffffda RBX: 00007f520fabe6c0 RCX: 00007f521182d68e [ 1018.424622][T24422] RDX: 000000000000000f RSI: 00007f520fabe0a0 RDI: 0000000000000004 [ 1018.424628][T24422] RBP: 00007f520fabe090 R08: 0000000000000000 R09: 0000000000000000 [ 1018.424634][T24422] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1018.424640][T24422] R13: 00007f5211ae6038 R14: 00007f5211ae5fa0 R15: 00007fff609117d8 [ 1018.424656][T24422] [ 1018.526883][T24424] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1018.533387][T24424] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1019.138750][ T5621] Bluetooth: hci4: command 0x2016 tx timeout [ 1019.452447][T24433] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1019.456587][T24433] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1019.511397][T24433] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1019.511971][T24433] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1019.606680][T24449] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1019.607289][T24449] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1020.938734][T23482] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1021.091892][T23482] usb 3-1: Using ep0 maxpacket: 16 [ 1021.122549][T23482] usb 3-1: config 0 has an invalid interface number: 105 but max is 0 [ 1021.122566][T23482] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1021.122576][T23482] usb 3-1: config 0 has no interface number 0 [ 1021.145840][T23482] usb 3-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 1021.145869][T23482] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1021.145887][T23482] usb 3-1: Product: syz [ 1021.145900][T23482] usb 3-1: Manufacturer: syz [ 1021.145913][T23482] usb 3-1: SerialNumber: syz [ 1021.161590][T23482] usb 3-1: config 0 descriptor?? [ 1021.195711][T23482] uvcvideo 3-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 1021.195757][T23482] uvcvideo 3-1:0.105: No valid video chain found. [ 1021.430625][ T5703] usb 3-1: USB disconnect, device number 34 [ 1021.518339][T24510] FAULT_INJECTION: forcing a failure. [ 1021.518339][T24510] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1021.518363][T24510] CPU: 0 UID: 0 PID: 24510 Comm: syz.9.5782 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1021.518378][T24510] Tainted: [L]=SOFTLOCKUP [ 1021.518382][T24510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1021.518388][T24510] Call Trace: [ 1021.518393][T24510] [ 1021.518398][T24510] dump_stack_lvl+0xe8/0x150 [ 1021.518414][T24510] should_fail_ex+0x46b/0x600 [ 1021.518432][T24510] _copy_to_user+0x31/0xb0 [ 1021.518445][T24510] simple_read_from_buffer+0xe1/0x170 [ 1021.518464][T24510] proc_fail_nth_read+0x1be/0x230 [ 1021.518477][T24510] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1021.518489][T24510] ? rw_verify_area+0x2ac/0x4e0 [ 1021.518507][T24510] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1021.518527][T24510] vfs_read+0x212/0xa80 [ 1021.518551][T24510] ? __pfx_vfs_read+0x10/0x10 [ 1021.518571][T24510] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1021.518593][T24510] ? lockdep_hardirqs_on+0x7a/0x110 [ 1021.518614][T24510] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1021.518635][T24510] ? mutex_lock_nested+0x152/0x1d0 [ 1021.518652][T24510] ? fdget_pos+0x252/0x320 [ 1021.518675][T24510] ksys_read+0x156/0x270 [ 1021.518698][T24510] ? __pfx_ksys_read+0x10/0x10 [ 1021.518723][T24510] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1021.518742][T24510] do_syscall_64+0x15f/0x560 [ 1021.518761][T24510] ? trace_irq_disable+0x3b/0x140 [ 1021.518773][T24510] ? clear_bhb_loop+0x40/0x90 [ 1021.518786][T24510] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1021.518796][T24510] RIP: 0033:0x7f521182d68e [ 1021.518806][T24510] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1021.518815][T24510] RSP: 002b:00007f520fabdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1021.518827][T24510] RAX: ffffffffffffffda RBX: 00007f520fabe6c0 RCX: 00007f521182d68e [ 1021.518835][T24510] RDX: 000000000000000f RSI: 00007f520fabe0a0 RDI: 0000000000000005 [ 1021.518841][T24510] RBP: 00007f520fabe090 R08: 0000000000000000 R09: 0000000000000000 [ 1021.518847][T24510] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1021.518853][T24510] R13: 00007f5211ae6038 R14: 00007f5211ae5fa0 R15: 00007fff609117d8 [ 1021.518869][T24510] [ 1022.095855][T24533] netlink: 'syz.2.5790': attribute type 4 has an invalid length. [ 1022.095870][T24533] netlink: 152 bytes leftover after parsing attributes in process `syz.2.5790'. [ 1022.568783][ T5703] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 1022.718670][ T5703] usb 3-1: Using ep0 maxpacket: 8 [ 1022.720641][ T5703] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 1022.720695][ T5703] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1022.720716][ T5703] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1022.720738][ T5703] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1022.720759][ T5703] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1022.720797][ T5703] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1022.720819][ T5703] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1023.206891][T24540] usbtmc 3-1:16.0: usbtmc488_ioctl_trigger returned -90 [ 1023.210680][T23482] usb 3-1: USB disconnect, device number 35 [ 1023.253786][T24585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1023.254486][T24585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1023.292600][T24585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1023.293210][T24585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1023.461239][T24602] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1023.463217][T24602] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1023.467454][T24602] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5811'. [ 1024.028746][ T5703] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 1024.178775][ T5703] usb 3-1: Using ep0 maxpacket: 16 [ 1024.206629][ T5703] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1024.206658][ T5703] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1024.206677][ T5703] usb 3-1: Product: syz [ 1024.206690][ T5703] usb 3-1: Manufacturer: syz [ 1024.206702][ T5703] usb 3-1: SerialNumber: syz [ 1024.284132][ T5703] usb 3-1: config 0 descriptor?? [ 1024.406327][T24628] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1024.425543][T24628] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1024.622274][T24636] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5820'. [ 1024.786242][ T5703] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1024.877488][ T5703] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1024.887369][ T5703] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1024.896824][ T5703] usb 3-1: media controller created [ 1024.921008][ T5703] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1025.571599][ T5703] zl10353_read_register: readreg error (reg=127, ret==0) [ 1025.571659][ T5703] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1025.571673][ T5703] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1025.571736][T24606] dtv5100: wlen = 0, aborting. [ 1025.611073][ T5703] usb 3-1: USB disconnect, device number 36 [ 1025.690288][ T5703] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1026.830078][T24708] syz.2.5839 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 1029.355993][T24730] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1029.357868][T24730] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1029.604492][T24730] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1029.605180][T24730] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1030.354524][T24764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1030.360645][T24764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1030.366100][T24764] Invalid logical block size (8192) [ 1031.455757][T24789] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1031.456380][T24789] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1033.530756][T24824] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1033.531387][T24824] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1033.577989][T24824] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1033.587499][T24824] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1035.286427][T24850] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1035.303787][T24850] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1037.113879][T24878] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1037.114515][T24878] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1037.121217][T24878] Invalid logical block size (8192) [ 1038.294253][T24915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1038.294855][T24915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1038.382567][T24921] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1038.383101][T24921] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1039.011559][T24946] binder: 24945:24946 unknown command 0 [ 1039.011582][T24946] binder: 24945:24946 ioctl c0306201 200000000080 returned -22 [ 1039.018272][T24946] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1039.034343][T24946] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1043.714396][T25115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1043.716188][T25115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1047.876174][T25306] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1047.876809][T25306] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1049.689355][ T1253] usb 10-1: USB disconnect, device number 49 [ 1049.709687][ T5786] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 1049.868624][ T5786] usb 3-1: Using ep0 maxpacket: 16 [ 1049.881986][ T5786] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1049.882014][ T5786] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1049.882033][ T5786] usb 3-1: Product: syz [ 1049.882047][ T5786] usb 3-1: Manufacturer: syz [ 1049.882060][ T5786] usb 3-1: SerialNumber: syz [ 1049.938892][ T5786] usb 3-1: config 0 descriptor?? [ 1050.001212][ T5621] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1050.104401][ T5621] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1050.130399][ T5621] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1050.131786][ T5621] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1050.171049][ T5621] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1050.425123][ T5786] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1050.456507][ T5786] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1050.479710][ T5786] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1050.479773][ T5786] usb 3-1: media controller created [ 1050.531481][ T5786] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1050.627399][ T5786] zl10353_read_register: readreg error (reg=127, ret==0) [ 1050.627448][ T5786] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1050.627460][ T5786] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1050.677375][ T5786] usb 3-1: USB disconnect, device number 37 [ 1050.794563][ T5786] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1052.149538][ T5786] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 1052.298683][ T5786] usb 3-1: Using ep0 maxpacket: 16 [ 1052.307973][ T5786] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1052.308004][ T5786] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1052.308022][ T5786] usb 3-1: Product: syz [ 1052.308034][ T5786] usb 3-1: Manufacturer: syz [ 1052.308057][ T5786] usb 3-1: SerialNumber: syz [ 1052.360012][ T5786] usb 3-1: config 0 descriptor?? [ 1052.423535][T14913] Bluetooth: hci1: command tx timeout [ 1052.702027][T25407] bridge0: port 1(bridge_slave_0) entered blocking state [ 1052.702401][T25407] bridge0: port 1(bridge_slave_0) entered disabled state [ 1052.702706][T25407] bridge_slave_0: entered allmulticast mode [ 1052.706350][T25407] bridge_slave_0: entered promiscuous mode [ 1052.711312][T25407] bridge0: port 2(bridge_slave_1) entered blocking state [ 1052.711671][T25407] bridge0: port 2(bridge_slave_1) entered disabled state [ 1052.711937][T25407] bridge_slave_1: entered allmulticast mode [ 1052.715010][T25407] bridge_slave_1: entered promiscuous mode [ 1052.778005][ T5786] dvb_usb_dtv5100 3-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 1052.810656][ T5786] usb 3-1: USB disconnect, device number 38 [ 1052.853072][T25407] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1052.863595][T25407] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1053.014435][T25407] team0: Port device team_slave_0 added [ 1053.018128][T25407] team0: Port device team_slave_1 added [ 1053.067422][T25407] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1053.067438][T25407] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1053.067463][T25407] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1053.136576][T25407] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1053.136588][T25407] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1053.136603][T25407] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1053.317029][T25407] hsr_slave_0: entered promiscuous mode [ 1053.330830][T25407] hsr_slave_1: entered promiscuous mode [ 1053.334873][T25407] debugfs: 'hsr0' already exists in 'hsr' [ 1053.334899][T25407] Cannot create hsr debugfs directory [ 1054.348238][T25407] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1054.358726][ T5703] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 1054.505579][T14913] Bluetooth: hci1: command tx timeout [ 1054.506644][ T1337] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.506737][ T1337] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.528717][ T5703] usb 3-1: Using ep0 maxpacket: 16 [ 1054.556937][ T5703] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1054.556966][ T5703] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1054.556984][ T5703] usb 3-1: Product: syz [ 1054.556997][ T5703] usb 3-1: Manufacturer: syz [ 1054.557010][ T5703] usb 3-1: SerialNumber: syz [ 1054.569602][ T5703] usb 3-1: config 0 descriptor?? [ 1054.927118][T25407] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1055.051185][ T5703] dvb_usb_dtv5100 3-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 1055.064570][ T5703] usb 3-1: USB disconnect, device number 39 [ 1055.463694][T25407] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1056.084266][T25407] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1056.288638][ T5703] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 1056.459492][ T5703] usb 3-1: Using ep0 maxpacket: 16 [ 1056.464915][ T5703] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1056.464944][ T5703] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1056.464962][ T5703] usb 3-1: Product: syz [ 1056.464975][ T5703] usb 3-1: Manufacturer: syz [ 1056.464988][ T5703] usb 3-1: SerialNumber: syz [ 1056.584890][T14913] Bluetooth: hci1: command tx timeout [ 1056.620162][ T5703] usb 3-1: config 0 descriptor?? [ 1057.071076][ T5703] dvb_usb_dtv5100 3-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 1057.096502][ T5703] usb 3-1: USB disconnect, device number 40 [ 1057.452373][T25407] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1057.528405][T25407] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1057.530476][T25407] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1057.618407][T25407] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1057.622742][T25407] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1057.807606][T25407] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1057.817160][T25407] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1057.847160][T25407] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1058.197907][T25407] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1058.238027][T25407] 8021q: adding VLAN 0 to HW filter on device team0 [ 1058.298340][ T153] bridge0: port 1(bridge_slave_0) entered blocking state [ 1058.301277][ T153] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1058.333445][ T153] bridge0: port 2(bridge_slave_1) entered blocking state [ 1058.335083][ T153] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1058.658918][T14913] Bluetooth: hci1: command tx timeout [ 1059.313397][T25407] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1059.601687][T25407] veth0_vlan: entered promiscuous mode [ 1059.616048][T25407] veth1_vlan: entered promiscuous mode [ 1059.678683][T25407] veth0_macvtap: entered promiscuous mode [ 1059.694298][T25407] veth1_macvtap: entered promiscuous mode [ 1059.736398][T25407] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1059.768878][T25407] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1059.824129][ T153] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1059.827041][ T153] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1059.828269][ T153] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1059.833777][ T3390] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1060.975838][ T3390] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1060.975860][ T3390] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1061.544470][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1061.545626][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1064.477654][T26132] vivid-003: ================= START STATUS ================= [ 1064.477677][T26132] vivid-003: Radio HW Seek Mode: Bounded [ 1064.477698][T26132] vivid-003: Radio Programmable HW Seek: false [ 1064.477716][T26132] vivid-003: RDS Rx I/O Mode: Block I/O [ 1064.477733][T26132] vivid-003: Generate RBDS Instead of RDS: false [ 1064.477751][T26132] vivid-003: RDS Reception: true [ 1064.477767][T26132] vivid-003: RDS Program Type: 0 inactive [ 1064.477788][T26132] vivid-003: RDS PS Name: inactive [ 1064.477807][T26132] vivid-003: RDS Radio Text: inactive [ 1064.477826][T26132] vivid-003: RDS Traffic Announcement: false inactive [ 1064.477846][T26132] vivid-003: RDS Traffic Program: false inactive [ 1064.477864][T26132] vivid-003: RDS Music: false inactive [ 1064.477885][T26132] vivid-003: ================== END STATUS ================== [ 1064.729815][T26139] [ 1064.729827][T26139] ====================================================== [ 1064.729835][T26139] WARNING: possible circular locking dependency detected [ 1064.729851][T26139] syzkaller #0 Tainted: G L [ 1064.729862][T26139] ------------------------------------------------------ [ 1064.729868][T26139] syz.9.6242/26139 is trying to acquire lock: [ 1064.729878][T26139] ffff888060bc77b0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}, at: __flush_work+0x104/0xda0 [ 1064.729922][T26139] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1064.729922][T26139] but task is already holding lock: [ 1064.729927][T26139] ffff88805be80358 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x24d/0x5a0 [ 1064.729967][T26139] [ 1064.729967][T26139] which lock already depends on the new lock. [ 1064.729967][T26139] [ 1064.729974][T26139] [ 1064.729974][T26139] the existing dependency chain (in reverse order) is: [ 1064.729980][T26139] [ 1064.729980][T26139] -> #1 (sk_lock-AF_SMC/1){+.+.}-{0:0}: [ 1064.730005][T26139] lock_sock_nested+0x41/0x130 [ 1064.730023][T26139] smc_listen_out+0x109/0x3e0 [ 1064.730044][T26139] smc_listen_work+0x813/0x13f0 [ 1064.730068][T26139] process_one_work+0x98b/0x1630 [ 1064.730088][T26139] worker_thread+0xb49/0x1140 [ 1064.730109][T26139] kthread+0x388/0x470 [ 1064.730125][T26139] ret_from_fork+0x514/0xb70 [ 1064.730144][T26139] ret_from_fork_asm+0x1a/0x30 [ 1064.730164][T26139] [ 1064.730164][T26139] -> #0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}: [ 1064.730186][T26139] __lock_acquire+0x15a5/0x2d10 [ 1064.730205][T26139] lock_acquire+0x106/0x350 [ 1064.730222][T26139] __flush_work+0x6df/0xda0 [ 1064.730236][T26139] __cancel_work_sync+0xbe/0x110 [ 1064.730252][T26139] smc_clcsock_release+0x60/0xf0 [ 1064.730277][T26139] __smc_release+0x6a0/0x810 [ 1064.730295][T26139] smc_close_non_accepted+0xd5/0x1f0 [ 1064.730321][T26139] smc_close_active+0xb9b/0xf40 [ 1064.730343][T26139] __smc_release+0xa0/0x810 [ 1064.730359][T26139] smc_release+0x2eb/0x5a0 [ 1064.730375][T26139] __sock_release+0xb9/0x250 [ 1064.730391][T26139] sock_close+0x1c/0x30 [ 1064.730406][T26139] __fput+0x461/0xa70 [ 1064.730420][T26139] task_work_run+0x1d9/0x270 [ 1064.730438][T26139] exit_to_user_mode_loop+0xf3/0x4d0 [ 1064.730455][T26139] do_syscall_64+0x33e/0x560 [ 1064.730477][T26139] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1064.730494][T26139] [ 1064.730494][T26139] other info that might help us debug this: [ 1064.730494][T26139] [ 1064.730500][T26139] Possible unsafe locking scenario: [ 1064.730500][T26139] [ 1064.730506][T26139] CPU0 CPU1 [ 1064.730512][T26139] ---- ---- [ 1064.730518][T26139] lock(sk_lock-AF_SMC/1); [ 1064.730532][T26139] lock((work_completion)(&new_smc->smc_listen_work)); [ 1064.730545][T26139] lock(sk_lock-AF_SMC/1); [ 1064.730558][T26139] lock((work_completion)(&new_smc->smc_listen_work)); [ 1064.730573][T26139] [ 1064.730573][T26139] *** DEADLOCK *** [ 1064.730573][T26139] [ 1064.730577][T26139] 3 locks held by syz.9.6242/26139: [ 1064.730586][T26139] #0: ffff8880408e8978 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x89/0x250 [ 1064.730633][T26139] #1: ffff88805be80358 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x24d/0x5a0 [ 1064.730674][T26139] #2: ffffffff8e1cabc0 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x104/0xda0 [ 1064.730709][T26139] [ 1064.730709][T26139] stack backtrace: [ 1064.730720][T26139] CPU: 1 UID: 0 PID: 26139 Comm: syz.9.6242 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1064.730742][T26139] Tainted: [L]=SOFTLOCKUP [ 1064.730747][T26139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1064.730757][T26139] Call Trace: [ 1064.730764][T26139] [ 1064.730773][T26139] dump_stack_lvl+0xe8/0x150 [ 1064.730791][T26139] print_circular_bug+0x2e1/0x300 [ 1064.730814][T26139] check_noncircular+0x12e/0x150 [ 1064.730835][T26139] __lock_acquire+0x15a5/0x2d10 [ 1064.730855][T26139] ? irqentry_exit+0x218/0x760 [ 1064.730875][T26139] ? lockdep_hardirqs_on+0x7a/0x110 [ 1064.730894][T26139] ? irqentry_exit+0x218/0x760 [ 1064.730911][T26139] ? trace_irq_disable+0x3b/0x140 [ 1064.730928][T26139] ? __flush_work+0x104/0xda0 [ 1064.730941][T26139] lock_acquire+0x106/0x350 [ 1064.730958][T26139] ? __flush_work+0x104/0xda0 [ 1064.730976][T26139] ? __flush_work+0x104/0xda0 [ 1064.730992][T26139] __flush_work+0x6df/0xda0 [ 1064.731006][T26139] ? __flush_work+0x104/0xda0 [ 1064.731020][T26139] ? __flush_work+0x104/0xda0 [ 1064.731037][T26139] ? __pfx___flush_work+0x10/0x10 [ 1064.731054][T26139] ? __pfx_wq_barrier_func+0x10/0x10 [ 1064.731084][T26139] ? __cancel_work_sync+0x5c/0x110 [ 1064.731101][T26139] __cancel_work_sync+0xbe/0x110 [ 1064.731119][T26139] smc_clcsock_release+0x60/0xf0 [ 1064.731143][T26139] __smc_release+0x6a0/0x810 [ 1064.731161][T26139] ? lockdep_hardirqs_on+0x7a/0x110 [ 1064.731184][T26139] smc_close_non_accepted+0xd5/0x1f0 [ 1064.731205][T26139] smc_close_active+0xb9b/0xf40 [ 1064.731228][T26139] ? smc_close_active+0x420/0xf40 [ 1064.731249][T26139] ? __pfx_sock_def_readable+0x10/0x10 [ 1064.731268][T26139] __smc_release+0xa0/0x810 [ 1064.731286][T26139] ? lockdep_hardirqs_on+0x7a/0x110 [ 1064.731317][T26139] smc_release+0x2eb/0x5a0 [ 1064.731338][T26139] __sock_release+0xb9/0x250 [ 1064.731359][T26139] ? __pfx_sock_close+0x10/0x10 [ 1064.731376][T26139] sock_close+0x1c/0x30 [ 1064.731391][T26139] __fput+0x461/0xa70 [ 1064.731408][T26139] task_work_run+0x1d9/0x270 [ 1064.731428][T26139] ? __pfx_task_work_run+0x10/0x10 [ 1064.731450][T26139] exit_to_user_mode_loop+0xf3/0x4d0 [ 1064.731468][T26139] ? rcu_is_watching+0x15/0xb0 [ 1064.731488][T26139] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1064.731503][T26139] do_syscall_64+0x33e/0x560 [ 1064.731520][T26139] ? clear_bhb_loop+0x40/0x90 [ 1064.731535][T26139] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1064.731548][T26139] RIP: 0033:0x7fa464ffce59 [ 1064.731563][T26139] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1064.731576][T26139] RSP: 002b:00007ffd5d42c768 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 1064.731591][T26139] RAX: 0000000000000000 RBX: 00007ffd5d42c850 RCX: 00007fa464ffce59 [ 1064.731601][T26139] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 1064.731610][T26139] RBP: 0000000000103e3c R08: 0000000000000001 R09: 0000000000000000 [ 1064.731619][T26139] R10: 0000001b2f720000 R11: 0000000000000246 R12: 00007ffd5d42c890 [ 1064.731628][T26139] R13: 00007fa465275fac R14: 0000000000103e9f R15: 00007fa465275fa0 [ 1064.731642][T26139] [ 1065.075169][ T9] usb 7-1: USB disconnect, device number 6 [ 1065.941413][T26126] syz_tun (unregistering): left allmulticast mode [ 1067.090565][ T3358] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1067.289767][ T3358] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1067.500218][ T3358] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1067.712342][ T3358] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1068.069522][ T3358] bridge_slave_1: left allmulticast mode [ 1068.069540][ T3358] bridge_slave_1: left promiscuous mode [ 1068.069662][ T3358] bridge0: port 2(bridge_slave_1) entered disabled state [ 1068.229140][ T3358] bridge_slave_0: left allmulticast mode [ 1068.229160][ T3358] bridge_slave_0: left promiscuous mode [ 1068.229284][ T3358] bridge0: port 1(bridge_slave_0) entered disabled state [ 1068.889651][ T3358] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1068.969331][ T3358] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1068.990351][ T3358] bond0 (unregistering): Released all slaves [ 1069.032340][ T5282] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1069.348950][ T5282] 8021q: adding VLAN 0 to HW filter on device eth18 [ 1069.701103][ T5282] 8021q: adding VLAN 0 to HW filter on device eth19 [ 1070.172451][ T5282] 8021q: adding VLAN 0 to HW filter on device eth20 [ 1070.408706][ T3358] hsr_slave_0: left promiscuous mode [ 1070.448749][ T3358] hsr_slave_1: left promiscuous mode [ 1070.449519][ T3358] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1070.449534][ T3358] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1070.489755][ T3358] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1070.489772][ T3358] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1070.548898][ T3358] veth1_macvtap: left promiscuous mode [ 1070.548935][ T3358] veth0_macvtap: left promiscuous mode [ 1070.549011][ T3358] veth1_vlan: left promiscuous mode [ 1070.549066][ T3358] veth0_vlan: left promiscuous mode [ 1071.040197][ T3358] team0 (unregistering): Port device team_slave_1 removed [ 1071.079277][ T3358] team0 (unregistering): Port device team_slave_0 removed [ 1072.639822][ T3358] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1072.860043][ T3358] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1073.119947][ T3358] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1073.331101][ T3358] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1073.720282][ T3358] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1073.765140][ T5282] 8021q: adding VLAN 0 to HW filter on device eth21 [ 1073.999712][ T3358] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1074.040132][ T5282] 8021q: adding VLAN 0 to HW filter on device eth22 [ 1074.279758][ T3358] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1074.320163][ T5282] 8021q: adding VLAN 0 to HW filter on device eth23 [ 1074.560829][ T3358] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1074.600068][ T5282] 8021q: adding VLAN 0 to HW filter on device eth24