last executing test programs: 3.67119612s ago: executing program 2 (id=3): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updsa={0xf0, 0x1a, 0x1, 0x0, 0x0, {{@in6=@private1={0xfc, 0x2}, @in=@multicast2}, {@in=@empty, 0x0, 0x3c}, @in=@loopback, {}, {0x0, 0x0, 0xfffffffffffffffe}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x10}}, 0xf0}}, 0x0) r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xc3b3, 0x800, 0x1, 0x2082, 0x0, 0x0}, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_pktinfo(r4, 0x84, 0xb, 0xfffffffffffffffe, &(0x7f0000000040)=0x41) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000040)=@IORING_OP_READV=@pass_iovec={0x1, 0xb, 0x4004, @fd_index=0x9, 0xf8, 0x0, 0x0, 0x11, 0x1, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) 3.600395073s ago: executing program 0 (id=1): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xfffffe3e) sendmmsg$inet(r0, &(0x7f0000000a80)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000400)="1d", 0x1}], 0x1}}], 0x1, 0x40003) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0xfffc, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 3.329686555s ago: executing program 2 (id=14): r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) 3.107817734s ago: executing program 4 (id=16): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c00000010000104fcfffffffbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="431f07000b02000008000a00", @ANYRES32=r1, @ANYBLOB="08000500", @ANYRES32=r1, @ANYBLOB="1c"], 0x4c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x240408d4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="e8000000190001002dbd7000fbdbdf2502202000ff02ff020018000008000100ac1414aac100098026"], 0xe8}, 0x1, 0x0, 0x0, 0x44050}, 0x1000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20040040) 2.988369457s ago: executing program 1 (id=17): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x6d207ee5}, 0x8) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000080)={0x2, @pix_mp={0x8, 0x8, 0x20385655, 0x6, 0x6, [{0x0, 0xcf9}, {0x7, 0x8089}, {0x6, 0xc}, {0x2, 0x5}, {0x4, 0x101}, {0x0, 0x689b}, {0xfffffff7, 0x7}, {0x5, 0xd3eb}], 0x1, 0x4, 0x3, 0x1, 0x5}}) sendmmsg$inet6(r0, &(0x7f0000001140)=[{{&(0x7f0000000580)={0xa, 0x4e23, 0x1, @loopback}, 0x1c, &(0x7f00000006c0)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}], 0x1, 0x8020) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000080)=ANY=[@ANYRES32, @ANYBLOB="010004"], 0x10) 2.914917926s ago: executing program 4 (id=18): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0xb6, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "dce02de9d7bd466b", "72e64b3892cb7025848c9f40363cf916", "cfff3c66", "e2b768b4bb9e0d9b"}, 0x28) sendto$inet6(r0, &(0x7f0000000100)="5375f36738460bc6", 0x8, 0xc000, 0x0, 0x0) close(r0) 2.817903394s ago: executing program 3 (id=20): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) futex(&(0x7f000000cffc)=0x1, 0xd, 0x0, &(0x7f0000000000)={0x77359400}, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) 2.635529365s ago: executing program 1 (id=21): bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e21, 0xb, @empty}, 0x1c) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="12010000000000408c0d220000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(0xffffffffffffffff, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x13}) syz_usb_control_io(r0, &(0x7f0000000740)={0x18, &(0x7f0000000500)=ANY=[@ANYBLOB="00000001000000090090"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000600), 0x6828, 0x0) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f00000000c0)=""/148) 2.457560759s ago: executing program 4 (id=22): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000200), 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x64, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x5}]}, 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x401, 0x0, 0x0, {0x2, 0x0, 0x10}}, 0x14}}, 0x40040) 2.429414558s ago: executing program 3 (id=23): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) ftruncate(r1, 0x1000004) fcntl$addseals(r1, 0x409, 0x7) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000000)={r1, 0x0, 0x0, 0x1000000}) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x258a, 0x6a88, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x6, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x0, 0x0, 0x3}}}}}]}}]}}, 0x0) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x1000000}) 2.391456921s ago: executing program 0 (id=24): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x4bd1bfda, 0x0, 0x6}, 0x1c) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x22}}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) 1.981588255s ago: executing program 4 (id=25): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r0, 0x0}]) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0) 1.547323438s ago: executing program 4 (id=26): openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0x0, 0x0) syz_usb_connect(0x3, 0x3d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) fcntl$setstatus(r0, 0x4, 0x800) read$char_usb(r0, &(0x7f00000002c0)=""/151, 0x97) 1.416573076s ago: executing program 0 (id=27): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/vlan/vlan0\x00') socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newsa={0xec, 0x10, 0x1, 0x0, 0xfffffffe, {{@in=@multicast2, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}}, {@in=@broadcast, 0x0, 0x33}, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x84}}, 0xec}}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8923, &(0x7f0000000000)={'vlan0\x00', @local}) r4 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000080), 0x400000, 0x0) ppoll(&(0x7f0000000240)=[{r0, 0x10}, {r0, 0x8352}, {r0, 0x4206}, {r1, 0x418}, {r4, 0x9000}, {0xffffffffffffffff, 0x40}, {r2, 0x861b}, {r2, 0x34a}], 0x8, &(0x7f00000002c0)={0x77359400}, &(0x7f0000000300)={[0x9, 0x6]}, 0x8) 1.080409238s ago: executing program 0 (id=28): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8d00, 0x0) r1 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000001c0)={0xa0000001}) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000180)={0x0, 0x1, 0xfffffffd, 0x5b, 0xd, "ee06010000000000000000008000"}) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000140)=0x7) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xd) 1.017913604s ago: executing program 0 (id=29): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000000240)=0x8, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x40000}, 0x1c) sendmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000140)="13", 0x1}], 0x1}, 0x40) recvfrom(r0, 0x0, 0x0, 0x99bcb88de02507f2, 0x0, 0x0) 944.797316ms ago: executing program 0 (id=30): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000840)={0x2c, &(0x7f0000000680)={0x0, 0x5, 0x4, "0c8ac451"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1000, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000bc0)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x20, 0x0, 0x4, {0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) 855.801565ms ago: executing program 1 (id=31): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r1 = memfd_create(&(0x7f0000002a40)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad;\x92\n\x8d\xb6I\x1fQ\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\xa7Wd\xa4Eu\x8cs\xe0\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceYH\x8f\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xbf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xb6\x87\xa43\xdc50V-\x13F\xb6&\xcb\xa3\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xad\xcf`*8&\feeV\x17U=(\xff\xe5t\xe4\xe6\xd8\x8f\x81\xa02\xfed\xde\x03\xdbN98\xb1\x8b\xccg2_\xc4bA\xf1\xf8\xfb\xf8\xd0\xfb_\x1e\"\xedF\x17$\x9e\xd8\xae\xc1\xaf\xee%\x1c\xc6V\x17\x03\xa6&\xa86\xc3\xd5\x02\x10g\x02(EI\x8d\x19\xefJ\xc1x\x92\x8c\x05\xb9\xd2Y\xa0\x13|\x95\xce\x86in\xd4\xd0\xb4\x02?gl\x8f\x1e\xa0\xe5\xf9\xe5\xc9\x9eG\xa9\x14\xff\xe2p\xb4\xda\x1b\t\xc7t\xe3\xe8\xb2\xa5\\\xc6\f\r\xb4\xc1o\x9aS\xf2+\xf7\r04\xb3\xf8\xe38\v\xa4\xbdf', 0x1) mmap(&(0x7f00001d1000/0x3000)=nil, 0x3000, 0x1800006, 0x11, r1, 0xbc4cd000) madvise(&(0x7f0000203000/0x1000)=nil, 0x1000, 0xe) read$FUSE(r0, &(0x7f0000000640)={0x2020}, 0x2020) read$FUSE(r0, &(0x7f0000004880)={0x2020}, 0x2020) 770.211289ms ago: executing program 1 (id=32): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xf}, {0xffff, 0xffff}, {0xfff2, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x44}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newtfilter={0x7c, 0x2c, 0xd27, 0x70bd1e, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x7, 0xd}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x4c, 0x2, [@TCA_FLOWER_ACT={0x48, 0x3, [@m_bpf={0x44, 0x1, 0x0, 0x0, {{0x8}, {0x1c, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0xffff7fff, 0xc, 0x20000000, 0x1, 0x10}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x7c}, 0x1, 0x0, 0x0, 0x8848}, 0x4080) 623.429474ms ago: executing program 1 (id=33): socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x4, &(0x7f0000020440)=ANY=[@ANYBLOB="18000000004000000000000009000000850000000f00000095"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) setsockopt$packet_int(r0, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) r1 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}}, 0x24}}, 0x4c840) 567.954853ms ago: executing program 3 (id=34): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000080)='X', 0x1, 0x804, &(0x7f0000000140)={0xa, 0x0, 0x0, @private0}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x28, &(0x7f00000019c0)=0x6, 0x4) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000000)={0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x7}, 0xe) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x4b, &(0x7f0000000040)=0x5, 0x4) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f00000015c0)=[{{0x0, 0x0, 0x0}, 0xd}], 0x1, 0x0, 0x0) 441.148239ms ago: executing program 1 (id=35): openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) r0 = syz_ublk_setup_io_uring(0x19, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f00000002c0)={0x0, 0x1, 0x0, 0x3, 0x1a5}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x362a, 0x8, 0x2000, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x40, 0x2, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x4000, 0x3, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x2, 0x367, 0x0, r6}}], 0x1, &(0x7f0000000340)={0x2e, 0x45, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x300, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) 438.819757ms ago: executing program 2 (id=36): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000001000)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x200000}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x1b, 0x0, 0xfee00d00}]}) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x8bf, 0x0, 0x3ff}]}) 315.141478ms ago: executing program 3 (id=37): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000002680)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000006c0), 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000680)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000400), 0x106}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000900), 0x111}}, 0x20) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000100), 0x111, 0x9}}, 0x20) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000080), 0x62}, {&(0x7f0000000100)="06010000246837f73199aee6fd1c291b3091ec1a06000000975ad8ec030f5919f397867997f9c0efa9c9092a31cdbb98ea272787afda0af59a320709c3a59ef05c6f40ceafec53f48d6186e7d8409e35306221caf67b370d875eff3191932728e5ab6c9a3acf6ccee3e352c898f5744abaedfb53f92c37acb126bd143f3e9cdfcf25a8d6129fcc3a141c3f5ab6db772f87c787817a9b699dd60732d952716b103bc1e91ac5b1ed92f35389580994bb0df9bce07e7a80921888f984139f488d256a67fec0cbb5c4e93d5c151d97f676ab93b1efbd46f600dc964231e3257bf358448fddf894c0cdfa9115adbe5b19bc912fcbc8aac7719b649b1ff1267491da", 0x682c}, {&(0x7f0000001480)="d1ffacd516de50ac9d15bc75316da4defa1e72f65a65cdd26dcc389aacf7856da9aecf3765d4c032e1960faf25bad906b7d3440b6e71a82f1d8f8b8db35b6091f3af94c6b46b9ab10fe3923f268771078d2668be7bd3eb941d4bb5baa8547e36283a065ce5766cbff3a8fc37fc4507643d3786bbf231d3ed88cb8b01eab14e4372cf4f89bd1b853caa5d9f07f523b9dfa8cc09053ff36fde08e96fb6b3acc196b1bd1e2d3a6c65f585df7e2b8b17439a7ab29a7dfe642c2f0ac7a81eca8073b559663f2daf7a0832b2b09557794a21bf114831f8e6db3922d0cd169e5a8b4adc95d7322ee75944de15f57780b88fef7f3d9b256705ccfa2125b43ce8e3aacaead963cdd7f792f14c9b24493f9f830f6de8da93bbd4357095631adec14224dd9bb049e826f3a49624393e6a031103faff0902ba88ae30af4a61caa77ff956214196fcf3c5536d823284306f367afcb46fb43231911cc53091671e7d853ebf015241b18e9fb6ac6d9a7a1b05dfd6d9e56a51567cd8837dd045abf6b85550f0dd8dded43147ab9bfadc18b9984699d5d875cb21a95a7f584d8c466d033df75193f9ae58b85cfacc54f6c6e12a0debe40ee361a839563bc2cb64271672a55370c2b035b482074ce2487ef8a3bc1c68856e6e09539276d961a0c647f1ee3237496fc99623e8fd33faf7797d86a88dcee152d15e10739bcbbd6077b76867e291f350d999024c12faf81f83792f48f7f6dd66aa6854e460ef7f8c755f3a6dd76509ea0d2db39057a5129185b2fb11546cd5d6cc59f640e9028ae6c7075fba5e5b5593d7f79ec387833f465d09bde464112821eaec5e6e8f2aee8d7358f9c14afe2018856f610848706c71cda62493aef2e39efb71b4a8e804847eda66b2b5b1d75b478f19208ee1ac43afb2dbbba5dd0f29f6946022e09fb853cb176ca3474ba2fa67cb245fe85ec61a095d6fd9ac2ac5685920201617342fe56072427b9bd3626a1a371e67041fcda781be0c234d6feb5ad500e8bc7074381fd0d04983a4a6cdb6c8e03d59dc50925e9e4b24e6f8e455f02818959f2927f0a2d9ff62ec3c5c399077048f7d3dad0830b2e6563693f2f9d48eca8c34804a7626282a4a214d13786993c011a88194dbf7b23e25f592e62186c9fb565fac7632de356153c89a6be0b6b26ba48c2427424769fcbd7ee072ed4bd4d0731d06c8537d616b1145a6c70edb13fb4dba3565221b3a2897a23861cd0e8e0060021cdd7de002d5e785e5d6d3d07f4e445ada9c8d9ba8b819d0b5c7b5d15a5192d3a83c125c8e117c823a9e33316b8c9154e7330d3a865048dbd9c14757691bfe56f10423f6ab717bec5eebeac6ba9ad1aeb6cde09d7fda8e475a71ac48d46b8d9a40879c9dec2db5c4799e5fc8e8b3d419031c1033fce88ae2c93d7ca62c9302e6b45ca8dfebe5b92724f035e8e9d7704efb23f445999fe08cfa28404874d8acc8d37870d394d9fcc8dbe763bc85c37f0f3bcc2cbea420cd073db598e7d89c14a31e5bf57cbefa301427c93091505f1f3e5cdf712958b2e8fc56684d3388107c1728f0e5a3be2164246071653e256ed3bf3000c17301da9a5a3d9ca475867c4f311a24e5ae909a62047a9e6bb71cbcb4f159c2ef0f66b4d0f9da51aba99cd9448443dd277362af18d32f111c48a952ef555b2c7c58b997ce61e74cc7551b57eaffe411219baddf490926d8e260dcd87c069e617195c352950f9b51ce88c12c4f7997ba515f77e68d44f831cdf4d7ee8b1b7cedcb4c4fc7e85ba288c8555d49d5b4b9bb70dc4b688bd12e6b38e37150f3ea457a76b23d5abe6551ea598e090aed87822b0954b8db1a7c605c925b7f9240b0e7a020f292a1fd4a37c74139bc6e7ff08373ebfc8feea371ae0b6c61c715f6f1f4b0b994c7e2e129f87db959aae6ff48664d824b29ba9f255890f9c537178db9c5302097891557f8175a46f308b1a2530aa726ea9d4cfce76db50637369724d0c5f51c97edb58ff5eb9b2434b3721b61688ba12471b97c6a65ba085e15406568ac852590701f2ef8451c5cf1191d70f51eaea9ddc4cbdd7428f627db5069111f65062d5cc34581826af3e670613dda99e31c42736aabd87be56e214ed606862a152455f91891b7430bae03284569c234588f495a5ecc4a23fad6ba34e2ee9ebde8c7f5f62c9344659375c2a1fe6fa6e4ef68712223b9471c513bb11429dbb8a45463c8882f462275ee0da567c60c2d8038843e0c20486676e9978f2aec9187820c94a6e7e519d06daf2ab198f5cafcab4d9c90a479800906192d66a3301a34fa6c5a931cea0a479a4d98d86d9de3e061323504b57186dd33df7a16ccb688c0de203666cb0a6b543a9d069dded44a3b432cbb71da921dcab6be1c2d7494d3b07841d9b4f9d659b5d3d3b2ed916f91588d589128e4b2d4448e6aab5a8160eddca0f6e022abb85e251a11cd6bae57a09b2c434ab5bdf6264afb20d5ab022d152e345bd32ba9283aa5b3cd9118bd271a8ac9083c98b8a83064e65428f7ad7b35bf1d60d4e703f22d2d316fc12bd68bcced82cf0962a3d5769c6a3d75d59f7a7b76454661fd3574b8c8e26d20c372407854505ea6c2406fbd8a1ba7bb017c565228aa6d03d18ed309a308ffb1ecec73c246413e7c70f25070eafed9e70d22e9e8b44125c44eceff37e65bf073bc6fad1ea2b72675af4bf70586a8f7e0f35700de94c802522897576ed115fa21b3d23a367844520b33f5b9aedc0245096765f4cb3b2ff4e54f39bd7346c2347875d75a931b17c6c424ddb4767e0e63cc7725a8fc4b1dbe7929b2f909cc5be8b09e63330341e6471dcac0f8b44693d01805a1467b71612260e2a273861b3697440a5f75497796bffcf79d62a4a50a6ed5ef2efe8c83374f2ecd08d8d628aa03b01a11caeb2bdecc0ab2abcecfa15627979d7c3f9dec5389fc6625e957f8075e23e636dd5514596189d568e14d33ae518e6e9978c6a36a74b49fdbd1260095c9abe447e618878039b75e305b1d2c9ddeb9e5cedb11802e0833739d8595d57d749c890c9290cca4aa96e6718747543796a187e54a66c2f71beefddf911a7a74b59c48ba642d5ecd4d415f48dfbde5baac8a4ba063c1b985d9f9f3180e8a1c8b2cf6a25c2ff17688cc858ac8b9c67960f09a1ca5f28f8e877159e00fe7fb10cca73b391508895e7e52c22f9b38d73dabd6ff7c55ebf4e1611daee8d52b4ceee49a6df7daeb81bf9d1c943a74c03d3dda52c5b99f3225c1b87074f5cef6187878bc5b665ec0561adcc9781280dd1c6592555d327afea78b21beeeb66a0af3eab3249245f41cdbca309d3fba5d4b345319dd0a26134c0c896f2c8d32fda28600013f6a4c95b4038faba70d6c480b360c55bdc0595f7ca636e85521ba505d894f9c5f0a90719bc9944f386ad7491422ff12f34a3c048708d51305a8cc5b2a502ac1575a14c75e9fb7219ede2f6d9c1b362230b6189e0d8cd8ccd11fd0325182c6e46c9977bf63aa02f7024aeb4389f989f5733a198b45e4329c4c1a538a009f216ad3ac09cac39547b4fd21a5d7146ea307ad9b9339f39d5161d17b59860a0aed38cd89d1b68c6438346d51a3a283074e34ee01d2eca527b1b3836ccdf7e807007152c79d14324e3d887c9551a9447527db4434810f5b0b73d855f32a0c89aa784e43f4c1657d408dd33f88aeae1e5186bbcc2a348b708e3cec9080e12ee3676beb5ee86a9b5cc4a3496c242b95a248906ed62f984b22373bdfd97515441f34e01006d8d1244aa88403f207cd8820ffe07634fc86d00f871c1e4c9e8fc1a00d295e36d98119599b62379cda10ada85efe7b50c5f38d8d010a2cd53db900939db1ffce14feffb7940d12842f4f2b507e1fa49e526752d1e3d80a0c2a75e870d85f77fd91fc46ac1b1288dd33338cdad154d6b80b5a925431868d62a3fb0036f28fe259a3f555f767526a9ea230c33843efc49ac3182a357845ea122d606ab22c9f937b2b905e02dd1cb07d380e3486be6167f00b6e6d90a3c1d6aee15da439a55542ce177e498998ba8ac69a848e63e4c7564e4dc04aad595fa1ab81275edafa0d352029c304200d2f2c5881cbf5a26b2141bdb117879cc11e7c13bd62f221ae1ac04dca3d8d58a13c130557ecf5f36184c7366d3852d0cbd6ca42f2a971d87c0bb204097af1a3abdab7b95d07fcdbf5f42607695dedcd26e30b8fc5cfd7b333a95f3ee69d5ba7911dadb1394285c437a0f26fc027737ba5ee7d63333f80acb59f1a7faf2ec3031c6533107502bffc92d8726a48ce00cdb5f1258d85ff8eb72bfb162e122022f1f3e8a72b41d2689d5228b1130fbc946384401f3bbe726314bb09d430333ad78de07b3cec5c18a4f4abb69507b6451ca4e610b8fc988c983426e0cc3b9d15393026eb75d3d08634b8a7495cef69aab83d27ea1b5b41f40b996dd10023d81f77d61192930ffc25cae1e149412322fcb0aa47bee3afc44ec3dda96c9294854e2cbaebfea6f9a90f0b3797d5f505824b4de964151569f881f87f9dd9d30a2a2f9ed01059a909cba157902903c77f2f3d056231e7c7483a3f35e04360e084f0d3f94a92c92c77b3f06479fbc417366d7fe87ddfcdfd86274f87a5f817b0f947924cbe2329f16f6b00c8a0ab96164f7b35fed38a388380af05c3600abc37a944c9e75a691728c26896ac3615297766f406aeb0f2fd147d68fad3fb3b032880280ebb4bf89252a36b0d9eb393daae72829b8da870b886676244897d5322b32703fcf138b66eedeb3024666a88fd99d8962f696ab7b34e19ced1bd27488aa2ffe5bfa11f8f9289bd8c052d4e88316cc33b0255ef1bfca4c17067d7f78175c56db481fe8dc6f73b1cbdf9d5823f115c9e03f2dfd07bc1ad88564d48b18cd9a30d83cbd5e6a3eedcb0ee86e5dd47f32820cb74dcf730b2052b31297b529e5e24f042335d13915e4048132fe1a101841e919c7870bb680eddead9a6111394bc12e274fbd88abaf2d254721c42e82abf4d1e319a631794ed6ce319ddd844ac5e9b1fc96dd9aaad42f2e087abe1b85430c4a00631970e3e74a6ed923f49e0df75685e044fae3fcea0af4dbfeebe0a9c2e73e8a89b89603a75f585e3ebba5453ae595da1469ea90ea3c9fb6a22411c56c58dfbf504caa629dbfc73ebbedc91669f2babf8b8215c525edf8feb366f104ffa9eb2bb79232660aece4730ef1ae8585c629ffe1390356a58e900da145b83ad177c7bb2d125e59d7ff4d3a8562efc620b4cf9b33c2305bbf1957e0f8b06f0fbe9c80db73b08fdd0be4a1ea4f91f52af47160040424aed8ac3c10251fb0b5d9be08247edf3dda5d1750d0597d60c8a0d9418a4e0c9325bb90f0886f9e5dda9e88ac1942ec1e53da0cf5ccad66b9cdfc2fdca784dd06a73713ef73785706d024873ddca5ccfcf0b91748a2c1fbd8c241934b5b473007b29d76aec5addf7b945a5f7abd6ddeccc8d0ccb26d69d4793b7224c27ba7bf45aac8a2be56086ab8c65ea69fdd593a01a29e2912378002d824bd98e6ed1c5dd5f33be529e640997f5f1bbde051fb2a669145966db4889bf32aa13777ac6c077c51bb8b2523954cea3adc307cfe53b8cbb00edf0c04c456392aea6613e8078a309dc538a6a24f80fc1b7f9fce3e3291ca6dab8090a634fcdb24e7a9de8aecd595b988f597cd623d148a8841b0a5203953166ea2e85316928f28dd2604d37c9ec80a49c0d91cbfe6d584b9b6a321b97bf99ae1d67985fd441976a828c97456003a7892c7c7f4a51bb49e3d3ea1e95ec29c89a2676", 0x1001}], 0x3) 171.688185ms ago: executing program 3 (id=38): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @loopback, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "ad8efa05fd9614ff"}, 0x28) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x2, 0x7) 92.205148ms ago: executing program 2 (id=39): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x7, 0x1, 0x8, 0x2, 0x7, 0xffff8003}]}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)) 60.178029ms ago: executing program 3 (id=40): r0 = landlock_create_ruleset(&(0x7f0000000080)={0x10}, 0x10, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x3231, 0x5, 0x1}, 0x30, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000280)={0x2, 0x4, @broadcast}, 0x10) 0s ago: executing program 4 (id=41): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = dup(r0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000080)=0x19f6, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x40000, &(0x7f0000000180)={0xa, 0x4e20, 0x8041, @ipv4={'\x00', '\xff\xff', @local}, 0x627bcafb}, 0x1c) r2 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x4110}, 0x1}) io_uring_enter(r2, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.33' (ED25519) to the list of known hosts. [ 63.504048][ T5597] cgroup: Unknown subsys name 'net' [ 63.596210][ T5597] cgroup: Unknown subsys name 'cpuset' [ 63.603636][ T5597] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 64.962778][ T5597] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 68.473639][ T5616] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 68.485206][ T5624] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 68.495912][ T5624] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 68.497447][ T5624] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 68.497844][ T5624] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 68.500910][ T5624] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 68.505445][ T5624] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 68.505738][ T5624] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 68.505955][ T5624] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 68.506146][ T5624] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 68.506548][ T5624] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 68.507748][ T5624] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 68.508870][ T5624] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 68.512100][ T5624] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 68.522825][ T5625] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 68.523155][ T5624] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 68.526010][ T5621] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 68.533523][ T5625] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 68.540929][ T5624] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 68.541285][ T5624] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 68.547188][ T5624] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 68.547565][ T5624] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 68.554447][ T5621] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 68.554704][ T5624] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 68.563379][ T5624] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 69.495068][ T5627] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.495180][ T5627] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.496253][ T5627] bridge_slave_0: entered allmulticast mode [ 69.498879][ T5627] bridge_slave_0: entered promiscuous mode [ 69.541279][ T5627] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.541493][ T5627] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.541620][ T5627] bridge_slave_1: entered allmulticast mode [ 69.543366][ T5627] bridge_slave_1: entered promiscuous mode [ 69.663688][ T5627] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.704938][ T5627] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.717230][ T5628] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.717382][ T5628] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.717948][ T5628] bridge_slave_0: entered allmulticast mode [ 69.720243][ T5628] bridge_slave_0: entered promiscuous mode [ 69.766530][ T5628] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.766645][ T5628] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.766766][ T5628] bridge_slave_1: entered allmulticast mode [ 69.768998][ T5628] bridge_slave_1: entered promiscuous mode [ 69.785273][ T5630] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.785418][ T5630] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.785533][ T5630] bridge_slave_0: entered allmulticast mode [ 69.787927][ T5630] bridge_slave_0: entered promiscuous mode [ 69.791793][ T5630] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.791887][ T5630] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.792250][ T5630] bridge_slave_1: entered allmulticast mode [ 69.793969][ T5630] bridge_slave_1: entered promiscuous mode [ 69.846073][ T5629] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.846239][ T5629] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.846394][ T5629] bridge_slave_0: entered allmulticast mode [ 69.848348][ T5629] bridge_slave_0: entered promiscuous mode [ 69.852120][ T5631] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.852216][ T5631] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.852648][ T5631] bridge_slave_0: entered allmulticast mode [ 69.854668][ T5631] bridge_slave_0: entered promiscuous mode [ 69.875634][ T5627] team0: Port device team_slave_0 added [ 69.891421][ T5629] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.892444][ T5629] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.892825][ T5629] bridge_slave_1: entered allmulticast mode [ 69.894533][ T5629] bridge_slave_1: entered promiscuous mode [ 69.897457][ T5631] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.897561][ T5631] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.898435][ T5631] bridge_slave_1: entered allmulticast mode [ 69.900865][ T5631] bridge_slave_1: entered promiscuous mode [ 69.905862][ T5628] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.909294][ T5627] team0: Port device team_slave_1 added [ 69.914125][ T5630] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.985845][ T5628] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.001724][ T5630] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.004410][ T5629] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.010621][ T5631] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.056319][ T5629] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.060658][ T5631] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.076676][ T5628] team0: Port device team_slave_0 added [ 70.080288][ T5628] team0: Port device team_slave_1 added [ 70.082223][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.082236][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.082259][ T5627] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.153029][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.153058][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.153081][ T5627] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.155872][ T5630] team0: Port device team_slave_0 added [ 70.159495][ T5630] team0: Port device team_slave_1 added [ 70.176130][ T5631] team0: Port device team_slave_0 added [ 70.217015][ T5629] team0: Port device team_slave_0 added [ 70.230083][ T5631] team0: Port device team_slave_1 added [ 70.231260][ T5628] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.231273][ T5628] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.231296][ T5628] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.235973][ T5630] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.235987][ T5630] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.236011][ T5630] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.248359][ T5630] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.248377][ T5630] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.248402][ T5630] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.251169][ T5629] team0: Port device team_slave_1 added [ 70.298356][ T5628] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.298374][ T5628] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.298398][ T5628] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.350148][ T5631] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.350167][ T5631] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.350190][ T5631] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.369412][ T5629] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.369429][ T5629] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.369460][ T5629] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.431306][ T5631] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.431323][ T5631] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.431347][ T5631] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.460802][ T5627] hsr_slave_0: entered promiscuous mode [ 70.461909][ T5627] hsr_slave_1: entered promiscuous mode [ 70.465391][ T5629] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.465405][ T5629] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.465429][ T5629] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.531724][ T5630] hsr_slave_0: entered promiscuous mode [ 70.532751][ T5630] hsr_slave_1: entered promiscuous mode [ 70.533455][ T5630] debugfs: 'hsr0' already exists in 'hsr' [ 70.533532][ T5630] Cannot create hsr debugfs directory [ 70.557535][ T4931] Bluetooth: hci4: command tx timeout [ 70.582124][ T5628] hsr_slave_0: entered promiscuous mode [ 70.583031][ T5628] hsr_slave_1: entered promiscuous mode [ 70.583662][ T5628] debugfs: 'hsr0' already exists in 'hsr' [ 70.583678][ T5628] Cannot create hsr debugfs directory [ 70.628892][ T52] Bluetooth: hci1: command tx timeout [ 70.629064][ T52] Bluetooth: hci3: command tx timeout [ 70.629142][ T52] Bluetooth: hci0: command tx timeout [ 70.629327][ T4931] Bluetooth: hci2: command tx timeout [ 70.651673][ T5631] hsr_slave_0: entered promiscuous mode [ 70.652811][ T5631] hsr_slave_1: entered promiscuous mode [ 70.653513][ T5631] debugfs: 'hsr0' already exists in 'hsr' [ 70.653531][ T5631] Cannot create hsr debugfs directory [ 70.717629][ T5629] hsr_slave_0: entered promiscuous mode [ 70.719412][ T5629] hsr_slave_1: entered promiscuous mode [ 70.720162][ T5629] debugfs: 'hsr0' already exists in 'hsr' [ 70.720179][ T5629] Cannot create hsr debugfs directory [ 71.158442][ T5627] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 71.170430][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 71.171360][ T5627] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 71.183688][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 71.187123][ T5627] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 71.199857][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 71.211863][ T5627] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 71.221327][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 71.272468][ T5628] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 71.277188][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.277255][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.294200][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 71.306322][ T5628] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 71.316118][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 71.316917][ T5628] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 71.326335][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 71.329390][ T5628] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 71.342071][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 71.418498][ T5631] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 71.432289][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 71.442672][ T5631] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 71.451617][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 71.452364][ T5631] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 71.462129][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 71.475734][ T5631] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 71.484618][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 71.560387][ T5629] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 71.571058][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 71.587813][ T5629] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 71.599438][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 71.600266][ T5629] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 71.611553][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 71.630306][ T5629] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 71.640958][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 71.693913][ T5627] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.726472][ T5630] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 71.736282][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 71.737570][ T5630] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 71.746203][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 71.767459][ T5630] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 71.776433][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 71.777193][ T5630] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 71.786937][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 71.814428][ T5627] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.853553][ T1487] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.853719][ T1487] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.860260][ T5628] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.890902][ T1487] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.891000][ T1487] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.940099][ T5628] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.960761][ T5631] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.007304][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.007407][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.036203][ T1487] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.036672][ T1487] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.045683][ T5631] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.085017][ T1487] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.085113][ T1487] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.115941][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.116153][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.125403][ T5630] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.140053][ T5630] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.156878][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.156970][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.159261][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.159355][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.177183][ T5629] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.193999][ T5627] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.239794][ T5629] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.278802][ T1487] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.278932][ T1487] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.319183][ T1487] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.319352][ T1487] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.332718][ T5628] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.422914][ T5630] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.446063][ T5627] veth0_vlan: entered promiscuous mode [ 72.455558][ T5627] veth1_vlan: entered promiscuous mode [ 72.475066][ T5628] veth0_vlan: entered promiscuous mode [ 72.512229][ T5631] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.524253][ T5628] veth1_vlan: entered promiscuous mode [ 72.577253][ T5627] veth0_macvtap: entered promiscuous mode [ 72.587291][ T5629] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.604988][ T5630] veth0_vlan: entered promiscuous mode [ 72.615048][ T5627] veth1_macvtap: entered promiscuous mode [ 72.638269][ T5624] Bluetooth: hci4: command tx timeout [ 72.649491][ T5628] veth0_macvtap: entered promiscuous mode [ 72.662746][ T5628] veth1_macvtap: entered promiscuous mode [ 72.667777][ T5630] veth1_vlan: entered promiscuous mode [ 72.707795][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.715603][ T5624] Bluetooth: hci2: command tx timeout [ 72.715633][ T5624] Bluetooth: hci3: command tx timeout [ 72.715643][ T52] Bluetooth: hci1: command tx timeout [ 72.715717][ T4931] Bluetooth: hci0: command tx timeout [ 72.722310][ T5631] veth0_vlan: entered promiscuous mode [ 72.734794][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.757364][ T5628] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.767253][ T5631] veth1_vlan: entered promiscuous mode [ 72.791290][ T5628] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.806761][ T5629] veth0_vlan: entered promiscuous mode [ 72.820503][ T114] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.821098][ T114] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.821270][ T114] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.821418][ T114] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.854295][ T5630] veth0_macvtap: entered promiscuous mode [ 72.884217][ T5629] veth1_vlan: entered promiscuous mode [ 72.891156][ T5630] veth1_macvtap: entered promiscuous mode [ 72.978396][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.978462][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.978492][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.978522][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.984176][ T5630] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.989902][ T5630] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.015312][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.015332][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.035101][ T5631] veth0_macvtap: entered promiscuous mode [ 73.088337][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.088412][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.088445][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.111542][ T5631] veth1_macvtap: entered promiscuous mode [ 73.124867][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.124909][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.163859][ T5629] veth0_macvtap: entered promiscuous mode [ 73.197451][ T5629] veth1_macvtap: entered promiscuous mode [ 73.204079][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.204099][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.218186][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.271028][ T5631] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.283520][ T5627] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 73.310317][ T5627] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 73.322562][ T5627] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 73.326548][ T5631] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.329360][ T5627] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 73.331724][ T5627] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 73.343842][ T5629] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.349641][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.349659][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.395666][ T5629] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.478119][ T1487] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.478154][ T1487] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.478665][ T1487] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.633132][ T114] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.633957][ T114] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.633971][ T114] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.689139][ T1487] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.689388][ T1487] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.689447][ T1487] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.689484][ T1487] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.689518][ T1487] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.694431][ T1487] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.874233][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.874277][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.927607][ T5714] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8'. [ 74.157384][ T114] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.169020][ T114] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.185222][ T5722] Zero length message leads to an empty skb [ 74.281965][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.282010][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.353932][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.366466][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.708262][ T4931] Bluetooth: hci4: command tx timeout [ 74.788657][ T4931] Bluetooth: hci0: command tx timeout [ 74.788670][ T5624] Bluetooth: hci3: command tx timeout [ 74.800610][ T5624] Bluetooth: hci1: command tx timeout [ 74.800628][ T4931] Bluetooth: hci2: command tx timeout [ 75.074595][ T5746] netlink: 32 bytes leftover after parsing attributes in process `syz.1.15'. [ 75.085848][ T5746] netlink: 16 bytes leftover after parsing attributes in process `syz.1.15'. [ 75.178384][ T5680] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 75.338398][ T5680] usb 3-1: Using ep0 maxpacket: 8 [ 75.350178][ T5680] usb 3-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 75.376012][ T5680] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.399318][ T5680] usb 3-1: config 0 descriptor?? [ 75.438880][ T5680] usb 3-1: probing VID:PID(0424:012C) [ 75.455088][ T5680] usb 3-1: vub300 testing BULK IN EndPoint(0) 81 [ 75.463157][ T5680] usb 3-1: vub300 testing BULK OUT EndPoint(1) 02 [ 75.470471][ T5680] usb 3-1: vub300 testing BULK IN EndPoint(2) 83 [ 75.476999][ T5680] usb 3-1: vub300 testing BULK OUT EndPoint(3) 04 [ 75.483621][ T5680] usb 3-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 75.761354][ T5687] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 75.831593][ T5680] usb 3-1: operating_mode = IRQs 4-bit 48 MHz with 512 byte USB packets [ 75.918885][ T5687] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 75.929816][ T5687] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 75.929886][ T5687] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 75.929939][ T5687] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.972521][ T5687] usb 2-1: config 0 descriptor?? [ 76.042069][ T5680] usb 3-1: USB vub300 remote SDIO host controller[0]connected with no SD/SDIO card inserted [ 76.108776][ T190] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 76.260415][ T190] usb 4-1: New USB device found, idVendor=258a, idProduct=6a88, bcdDevice= 0.00 [ 76.265168][ T190] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 76.265199][ T190] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 76.265237][ T190] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.285122][ T190] usb 4-1: config 0 descriptor?? [ 76.414041][ T5687] cm6533_jd 0003:0D8C:0022.0001: unknown main item tag 0x0 [ 76.421954][ T5687] cm6533_jd 0003:0D8C:0022.0001: unknown main item tag 0x0 [ 76.437677][ T5687] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0D8C:0022.0001/input/input5 [ 76.480708][ T5687] cm6533_jd 0003:0D8C:0022.0001: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.1-1/input0 [ 76.687206][ T190] usbhid 4-1:0.0: can't add hid device: -71 [ 76.687334][ T190] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 76.709423][ T5687] usb 2-1: USB disconnect, device number 2 [ 76.784175][ T190] usb 4-1: USB disconnect, device number 2 [ 76.788340][ T4931] Bluetooth: hci4: command tx timeout [ 76.869547][ T4931] Bluetooth: hci2: command tx timeout [ 76.869585][ T5624] Bluetooth: hci0: command tx timeout [ 76.869616][ T5624] Bluetooth: hci1: command tx timeout [ 76.869655][ T5624] Bluetooth: hci3: command tx timeout [ 76.899256][ T5779] ªªªªªª: renamed from vlan0 (while UP) [ 76.965564][ T5772] fido_id[5772]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 77.103219][ T5739] usb 3-1: USB disconnect, device number 2 [ 77.108553][ T5612] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 77.118641][ T25] usb 3-1: SET_CLOCK_SPEED 200kHz failed with retval=-71 [ 77.207664][ T5739] USB vub300 remote SDIO host controller[0] now disconnected [ 77.258946][ T5612] usb 5-1: Using ep0 maxpacket: 8 [ 77.260437][ T5612] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 77.261512][ T5612] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 77.261534][ T5612] usb 5-1: config 0 has no interface number 0 [ 77.261569][ T5612] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 77.261591][ T5612] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 77.261615][ T5612] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 77.261638][ T5612] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 77.261675][ T5612] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.266662][ T5612] usb 5-1: config 0 descriptor?? [ 77.282275][ T5612] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 77.429174][ T190] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 77.486847][ T48] usb 5-1: USB disconnect, device number 2 [ 77.507816][ T48] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 77.580366][ T190] usb 1-1: Using ep0 maxpacket: 32 [ 77.583256][ T190] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 77.584239][ T190] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 77.584342][ T190] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 77.584379][ T190] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.605779][ T190] usb 1-1: config 0 descriptor?? [ 77.613092][ T190] hub 1-1:0.0: USB hub found [ 77.720099][ T5802] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 77.836101][ T190] hub 1-1:0.0: 1 port detected [ 78.158266][ C1] [ 78.161102][ C1] ============================= [ 78.165991][ C1] WARNING: suspicious RCU usage [ 78.170923][ C1] syzkaller #0 Not tainted [ 78.175346][ C1] ----------------------------- [ 78.180253][ C1] kernel/sched/core.c:9218 Illegal context switch in RCU-sched read-side critical section! [ 78.190271][ C1] [ 78.190271][ C1] other info that might help us debug this: [ 78.190271][ C1] [ 78.200558][ C1] [ 78.200558][ C1] rcu_scheduler_active = 2, debug_locks = 1 [ 78.208661][ C1] locks held by syz.3.40/5813: 5, last CPU#1: [ 78.214768][ C1] #0: ffff8880795c9078 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 78.223929][ C1] #1: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 78.233486][ C1] #2: ffff888074e03eb8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 78.244046][ C1] #3: ffffffff8ed5c820 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 [ 78.253508][ C1] #4: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 78.264046][ C1] [ 78.264046][ C1] stack backtrace: [ 78.269997][ C1] CPU: 1 UID: 0 PID: 5813 Comm: syz.3.40 Not tainted syzkaller #0 PREEMPT(full) [ 78.279119][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 78.289209][ C1] Call Trace: [ 78.292516][ C1] [ 78.295367][ C1] dump_stack_lvl+0xe8/0x150 [ 78.299978][ C1] lockdep_rcu_suspicious+0x140/0x1d0 [ 78.305371][ C1] __might_resched+0xbb/0x4c0 [ 78.310067][ C1] ? __cancel_work_sync+0x5c/0x110 [ 78.315203][ C1] __cancel_work_sync+0x6d/0x110 [ 78.320167][ C1] mmc_free_host+0x19/0x30 [ 78.324594][ C1] call_timer_fn+0x18d/0x5f0 [ 78.329205][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 78.335900][ C1] ? call_timer_fn+0xd5/0x5f0 [ 78.340597][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 78.345742][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 78.350962][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 78.357668][ C1] __run_timer_base+0x652/0x8b0 [ 78.362551][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 78.367949][ C1] ? ktime_get+0x1f5/0x220 [ 78.372376][ C1] ? lapic_next_event+0x11/0x20 [ 78.377244][ C1] run_timer_softirq+0xb7/0x170 [ 78.382101][ C1] handle_softirqs+0x226/0x860 [ 78.386887][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 78.391682][ C1] __irq_exit_rcu+0xcb/0x220 [ 78.396287][ C1] irq_exit_rcu+0x9/0x30 [ 78.400521][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 78.406145][ C1] [ 78.409066][ C1] [ 78.411999][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 78.417988][ C1] RIP: 0010:pfn_valid+0x119/0x490 [ 78.423015][ C1] Code: 0d 9b 68 ff 84 c0 74 7d e8 84 07 84 ff 4d 85 ff 75 11 e8 7a 07 84 ff eb 3d e8 73 07 84 ff 4d 85 ff 74 ef 4d 89 fd 49 c1 ed 03 <43> 80 7c 25 00 00 74 08 4c 89 ff e8 67 07 f4 ff 49 8b 2f 48 89 ee [ 78.442603][ C1] RSP: 0018:ffffc90004f6f2d8 EFLAGS: 00000a06 [ 78.448687][ C1] RAX: ffffffff8243bdcc RBX: ffffffff8243bd8a RCX: ffff88802fed5dc0 [ 78.456674][ C1] RDX: 0000000000000000 RSI: ffffffff8c6d9460 RDI: ffffffff8c6d9420 [ 78.464633][ C1] RBP: 0000000000000001 R08: ffffffff8243bd8a R09: 0000000000000000 [ 78.472606][ C1] R10: dffffc0000000000 R11: fffff940003188b1 R12: dffffc0000000000 [ 78.480592][ C1] R13: 1ffff11027fc1230 R14: 0000000000063116 R15: ffff88813fe09180 [ 78.488554][ C1] ? pfn_valid+0xba/0x490 [ 78.492883][ C1] ? pfn_valid+0xba/0x490 [ 78.497219][ C1] ? pfn_valid+0xfc/0x490 [ 78.501561][ C1] ? pfn_valid+0xfc/0x490 [ 78.505903][ C1] page_table_check_clear+0x21/0x500 [ 78.511199][ C1] ? vm_normal_page+0x13c/0x2b0 [ 78.516042][ C1] __zap_vma_range+0x3a12/0x4f80 [ 78.520999][ C1] ? __pfx___zap_vma_range+0x10/0x10 [ 78.526301][ C1] ? mas_find+0x6d6/0xcb0 [ 78.530634][ C1] unmap_vmas+0x390/0x550 [ 78.534990][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 78.539850][ C1] ? mas_next_slot+0xc91/0xd70 [ 78.544654][ C1] exit_mmap+0x293/0x9f0 [ 78.548916][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 78.553724][ C1] ? __pfx_exit_aio+0x10/0x10 [ 78.558425][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 78.563653][ C1] __mmput+0x118/0x420 [ 78.567737][ C1] exit_mm+0x221/0x2d0 [ 78.571797][ C1] do_exit+0x6cd/0x2360 [ 78.575949][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 78.581150][ C1] ? __pfx_do_exit+0x10/0x10 [ 78.585762][ C1] do_group_exit+0x22d/0x2f0 [ 78.590365][ C1] ? _raw_spin_unlock_irq+0x29/0x50 [ 78.595562][ C1] get_signal+0x121b/0x12c0 [ 78.600112][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 78.605677][ C1] ? __sys_connect+0x3a1/0x450 [ 78.610455][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 78.616625][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 78.621994][ C1] ? rcu_is_watching+0x16/0xb0 [ 78.626765][ C1] ? do_fast_syscall_32+0x33/0x70 [ 78.631800][ C1] __do_fast_syscall_32+0x437/0x6a0 [ 78.637009][ C1] ? do_fast_syscall_32+0x33/0x70 [ 78.642028][ C1] ? irqentry_exit+0x10f/0x910 [ 78.646805][ C1] do_fast_syscall_32+0x33/0x70 [ 78.651702][ C1] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 78.658045][ C1] RIP: 0023:0xf7f030ec [ 78.662138][ C1] Code: Unable to access opcode bytes at 0xf7f030c2. [ 78.668794][ C1] RSP: 002b:00000000f53c65cc EFLAGS: 00000206 ORIG_RAX: 00000000000000f0 [ 78.677218][ C1] RAX: 0000000000000001 RBX: 00000000f73c4f8c RCX: 0000000000000081 [ 78.685186][ C1] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 78.693173][ C1] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 78.701143][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 78.709120][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 78.717120][ C1] [ 78.720224][ C1] BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 [ 78.720245][ C1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5813, name: syz.3.40 [ 78.720267][ C1] preempt_count: 102, expected: 0 [ 78.720281][ C1] RCU nest depth: 1, expected: 0 [ 78.720295][ C1] locks held by syz.3.40/5813: 5, last CPU#1: [ 78.720314][ C1] #0: ffff8880795c9078 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 78.720395][ C1] #1: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 78.720458][ C1] #2: ffff888074e03eb8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 78.720546][ C1] #3: ffffffff8ed5c820 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 [ 78.720616][ C1] #4: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 78.720692][ C1] Preemption disabled at: [ 78.720699][ C1] [<0000000000000000>] 0x0 [ 78.720724][ C1] CPU: 1 UID: 0 PID: 5813 Comm: syz.3.40 Not tainted syzkaller #0 PREEMPT(full) [ 78.720746][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 78.720757][ C1] Call Trace: [ 78.720764][ C1] [ 78.720771][ C1] dump_stack_lvl+0xe8/0x150 [ 78.720801][ C1] __might_resched+0x36a/0x4c0 [ 78.720840][ C1] __cancel_work_sync+0x6d/0x110 [ 78.720871][ C1] mmc_free_host+0x19/0x30 [ 78.720891][ C1] call_timer_fn+0x18d/0x5f0 [ 78.720913][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 78.720939][ C1] ? call_timer_fn+0xd5/0x5f0 [ 78.720959][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 78.720993][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 78.721018][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 78.721047][ C1] __run_timer_base+0x652/0x8b0 [ 78.721082][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 78.721108][ C1] ? ktime_get+0x1f5/0x220 [ 78.721128][ C1] ? lapic_next_event+0x11/0x20 [ 78.721155][ C1] run_timer_softirq+0xb7/0x170 [ 78.721179][ C1] handle_softirqs+0x226/0x860 [ 78.721207][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 78.721239][ C1] __irq_exit_rcu+0xcb/0x220 [ 78.721265][ C1] irq_exit_rcu+0x9/0x30 [ 78.721286][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 78.721315][ C1] [ 78.721321][ C1] [ 78.721329][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 78.721350][ C1] RIP: 0010:pfn_valid+0x119/0x490 [ 78.721371][ C1] Code: 0d 9b 68 ff 84 c0 74 7d e8 84 07 84 ff 4d 85 ff 75 11 e8 7a 07 84 ff eb 3d e8 73 07 84 ff 4d 85 ff 74 ef 4d 89 fd 49 c1 ed 03 <43> 80 7c 25 00 00 74 08 4c 89 ff e8 67 07 f4 ff 49 8b 2f 48 89 ee [ 78.721385][ C1] RSP: 0018:ffffc90004f6f2d8 EFLAGS: 00000a06 [ 78.721402][ C1] RAX: ffffffff8243bdcc RBX: ffffffff8243bd8a RCX: ffff88802fed5dc0 [ 78.721417][ C1] RDX: 0000000000000000 RSI: ffffffff8c6d9460 RDI: ffffffff8c6d9420 [ 78.721431][ C1] RBP: 0000000000000001 R08: ffffffff8243bd8a R09: 0000000000000000 [ 78.721444][ C1] R10: dffffc0000000000 R11: fffff940003188b1 R12: dffffc0000000000 [ 78.721457][ C1] R13: 1ffff11027fc1230 R14: 0000000000063116 R15: ffff88813fe09180 [ 78.721475][ C1] ? pfn_valid+0xba/0x490 [ 78.721495][ C1] ? pfn_valid+0xba/0x490 [ 78.721515][ C1] ? pfn_valid+0xfc/0x490 [ 78.721542][ C1] ? pfn_valid+0xfc/0x490 [ 78.721566][ C1] page_table_check_clear+0x21/0x500 [ 78.721588][ C1] ? vm_normal_page+0x13c/0x2b0 [ 78.721612][ C1] __zap_vma_range+0x3a12/0x4f80 [ 78.721678][ C1] ? __pfx___zap_vma_range+0x10/0x10 [ 78.721716][ C1] ? mas_find+0x6d6/0xcb0 [ 78.721740][ C1] unmap_vmas+0x390/0x550 [ 78.721768][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 78.721786][ C1] ? mas_next_slot+0xc91/0xd70 [ 78.721827][ C1] exit_mmap+0x293/0x9f0 [ 78.721856][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 78.721904][ C1] ? __pfx_exit_aio+0x10/0x10 [ 78.721943][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 78.721973][ C1] __mmput+0x118/0x420 [ 78.721999][ C1] exit_mm+0x221/0x2d0 [ 78.722022][ C1] do_exit+0x6cd/0x2360 [ 78.722047][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 78.722064][ C1] ? __pfx_do_exit+0x10/0x10 [ 78.722099][ C1] do_group_exit+0x22d/0x2f0 [ 78.722118][ C1] ? _raw_spin_unlock_irq+0x29/0x50 [ 78.722148][ C1] get_signal+0x121b/0x12c0 [ 78.722193][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 78.722219][ C1] ? __sys_connect+0x3a1/0x450 [ 78.722240][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 78.722287][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 78.722309][ C1] ? rcu_is_watching+0x16/0xb0 [ 78.722331][ C1] ? do_fast_syscall_32+0x33/0x70 [ 78.722354][ C1] __do_fast_syscall_32+0x437/0x6a0 [ 78.722376][ C1] ? do_fast_syscall_32+0x33/0x70 [ 78.722396][ C1] ? irqentry_exit+0x10f/0x910 [ 78.722418][ C1] do_fast_syscall_32+0x33/0x70 [ 78.722440][ C1] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 78.722463][ C1] RIP: 0023:0xf7f030ec [ 78.722477][ C1] Code: Unable to access opcode bytes at 0xf7f030c2. [ 78.722487][ C1] RSP: 002b:00000000f53c65cc EFLAGS: 00000206 ORIG_RAX: 00000000000000f0 [ 78.722506][ C1] RAX: 0000000000000001 RBX: 00000000f73c4f8c RCX: 0000000000000081 [ 78.722519][ C1] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 78.722531][ C1] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 78.722541][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 78.722551][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 78.722578][ C1] [ 78.723097][ C1] [ 79.255613][ C1] ============================= [ 79.260494][ C1] WARNING: suspicious RCU usage [ 79.265350][ C1] syzkaller #0 Tainted: G W [ 79.271375][ C1] ----------------------------- [ 79.276220][ C1] kernel/rcu/srcutree.c:1468 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! [ 79.288220][ C1] [ 79.288220][ C1] other info that might help us debug this: [ 79.288220][ C1] [ 79.298480][ C1] [ 79.298480][ C1] rcu_scheduler_active = 2, debug_locks = 1 [ 79.306525][ C1] locks held by syz.3.40/5813: 5, last CPU#1: [ 79.312608][ C1] #0: ffff8880795c9078 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 79.321726][ C1] #1: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 79.331296][ C1] #2: ffff888074e03eb8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 79.341812][ C1] #3: ffffffff8ed5c820 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 [ 79.351256][ C1] #4: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 79.361757][ C1] [ 79.361757][ C1] stack backtrace: [ 79.367643][ C1] CPU: 1 UID: 0 PID: 5813 Comm: syz.3.40 Tainted: G W syzkaller #0 PREEMPT(full) [ 79.378339][ C1] Tainted: [W]=WARN [ 79.382147][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 79.392195][ C1] Call Trace: [ 79.395484][ C1] [ 79.398330][ C1] dump_stack_lvl+0xe8/0x150 [ 79.402935][ C1] lockdep_rcu_suspicious+0x140/0x1d0 [ 79.408323][ C1] __synchronize_srcu+0x157/0x2f0 [ 79.413345][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 79.418896][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 79.423944][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 79.429747][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 79.435319][ C1] ? synchronize_srcu+0x20a/0x260 [ 79.440363][ C1] wakeup_source_unregister+0x129/0x3f0 [ 79.445938][ C1] mmc_host_classdev_release+0x47/0x100 [ 79.451501][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 79.457652][ C1] device_release+0xc4/0x1f0 [ 79.462250][ C1] kobject_put+0x222/0x550 [ 79.466661][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 79.471412][ C1] call_timer_fn+0x18d/0x5f0 [ 79.475989][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 79.482650][ C1] ? call_timer_fn+0xd5/0x5f0 [ 79.487316][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 79.492421][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 79.497612][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 79.504282][ C1] __run_timer_base+0x652/0x8b0 [ 79.509142][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 79.514523][ C1] ? ktime_get+0x1f5/0x220 [ 79.518947][ C1] ? lapic_next_event+0x11/0x20 [ 79.523788][ C1] run_timer_softirq+0xb7/0x170 [ 79.528623][ C1] handle_softirqs+0x226/0x860 [ 79.533380][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 79.538138][ C1] __irq_exit_rcu+0xcb/0x220 [ 79.542740][ C1] irq_exit_rcu+0x9/0x30 [ 79.546974][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 79.552609][ C1] [ 79.555544][ C1] [ 79.558458][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 79.564422][ C1] RIP: 0010:pfn_valid+0x119/0x490 [ 79.569429][ C1] Code: 0d 9b 68 ff 84 c0 74 7d e8 84 07 84 ff 4d 85 ff 75 11 e8 7a 07 84 ff eb 3d e8 73 07 84 ff 4d 85 ff 74 ef 4d 89 fd 49 c1 ed 03 <43> 80 7c 25 00 00 74 08 4c 89 ff e8 67 07 f4 ff 49 8b 2f 48 89 ee [ 79.589022][ C1] RSP: 0018:ffffc90004f6f2d8 EFLAGS: 00000a06 [ 79.595092][ C1] RAX: ffffffff8243bdcc RBX: ffffffff8243bd8a RCX: ffff88802fed5dc0 [ 79.603068][ C1] RDX: 0000000000000000 RSI: ffffffff8c6d9460 RDI: ffffffff8c6d9420 [ 79.611041][ C1] RBP: 0000000000000001 R08: ffffffff8243bd8a R09: 0000000000000000 [ 79.618998][ C1] R10: dffffc0000000000 R11: fffff940003188b1 R12: dffffc0000000000 [ 79.626951][ C1] R13: 1ffff11027fc1230 R14: 0000000000063116 R15: ffff88813fe09180 [ 79.634909][ C1] ? pfn_valid+0xba/0x490 [ 79.639234][ C1] ? pfn_valid+0xba/0x490 [ 79.643557][ C1] ? pfn_valid+0xfc/0x490 [ 79.647878][ C1] ? pfn_valid+0xfc/0x490 [ 79.652188][ C1] page_table_check_clear+0x21/0x500 [ 79.657457][ C1] ? vm_normal_page+0x13c/0x2b0 [ 79.662293][ C1] __zap_vma_range+0x3a12/0x4f80 [ 79.667240][ C1] ? __pfx___zap_vma_range+0x10/0x10 [ 79.672518][ C1] ? mas_find+0x6d6/0xcb0 [ 79.676859][ C1] unmap_vmas+0x390/0x550 [ 79.681180][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 79.686013][ C1] ? mas_next_slot+0xc91/0xd70 [ 79.690772][ C1] exit_mmap+0x293/0x9f0 [ 79.695029][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 79.699789][ C1] ? __pfx_exit_aio+0x10/0x10 [ 79.704460][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 79.709649][ C1] __mmput+0x118/0x420 [ 79.713724][ C1] exit_mm+0x221/0x2d0 [ 79.717791][ C1] do_exit+0x6cd/0x2360 [ 79.721944][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 79.727125][ C1] ? __pfx_do_exit+0x10/0x10 [ 79.731722][ C1] do_group_exit+0x22d/0x2f0 [ 79.736297][ C1] ? _raw_spin_unlock_irq+0x29/0x50 [ 79.741487][ C1] get_signal+0x121b/0x12c0 [ 79.746007][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 79.751567][ C1] ? __sys_connect+0x3a1/0x450 [ 79.756341][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 79.762494][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 79.767875][ C1] ? rcu_is_watching+0x16/0xb0 [ 79.772630][ C1] ? do_fast_syscall_32+0x33/0x70 [ 79.777644][ C1] __do_fast_syscall_32+0x437/0x6a0 [ 79.782845][ C1] ? do_fast_syscall_32+0x33/0x70 [ 79.787858][ C1] ? irqentry_exit+0x10f/0x910 [ 79.792608][ C1] do_fast_syscall_32+0x33/0x70 [ 79.797456][ C1] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 79.803771][ C1] RIP: 0023:0xf7f030ec [ 79.807826][ C1] Code: Unable to access opcode bytes at 0xf7f030c2. [ 79.814516][ C1] RSP: 002b:00000000f53c65cc EFLAGS: 00000206 ORIG_RAX: 00000000000000f0 [ 79.822912][ C1] RAX: 0000000000000001 RBX: 00000000f73c4f8c RCX: 0000000000000081 [ 79.830880][ C1] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 79.838854][ C1] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 79.846811][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 79.854767][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 79.862751][ C1] [ 79.865828][ C1] BUG: slee ** replaying previous printk message ** [ 79.865828][ C1] BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1472 [ 79.865849][ C1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5813, name: syz.3.40 [ 79.865871][ C1] preempt_count: 102, expected: 0 [ 79.865885][ C1] RCU nest depth: 1, expected: 0 [ 79.865899][ C1] locks held by syz.3.40/5813: 5, last CPU#1: [ 79.865919][ C1] #0: ffff8880795c9078 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 79.865993][ C1] #1: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 79.866060][ C1] #2: ffff888074e03eb8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 79.866135][ C1] #3: ffffffff8ed5c820 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 [ 79.866200][ C1] #4: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 79.866268][ C1] Preemption disabled at: [ 79.866277][ C1] [<0000000000000000>] 0x0 [ 79.866304][ C1] CPU: 1 UID: 0 PID: 5813 Comm: syz.3.40 Tainted: G W syzkaller #0 PREEMPT(full) [ 79.866329][ C1] Tainted: [W]=WARN [ 79.866335][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 79.866346][ C1] Call Trace: [ 79.866353][ C1] [ 79.866361][ C1] dump_stack_lvl+0xe8/0x150 [ 79.866390][ C1] __might_resched+0x36a/0x4c0 [ 79.866424][ C1] __synchronize_srcu+0x1a1/0x2f0 [ 79.866446][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 79.866465][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 79.866503][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 79.866531][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 79.866563][ C1] ? synchronize_srcu+0x20a/0x260 [ 79.866585][ C1] wakeup_source_unregister+0x129/0x3f0 [ 79.866628][ C1] mmc_host_classdev_release+0x47/0x100 [ 79.866649][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 79.866667][ C1] device_release+0xc4/0x1f0 [ 79.866692][ C1] kobject_put+0x222/0x550 [ 79.866715][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 79.866740][ C1] call_timer_fn+0x18d/0x5f0 [ 79.866764][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 79.866789][ C1] ? call_timer_fn+0xd5/0x5f0 [ 79.866810][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 79.866840][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 79.866865][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 79.866895][ C1] __run_timer_base+0x652/0x8b0 [ 79.866929][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 79.866954][ C1] ? ktime_get+0x1f5/0x220 [ 79.866974][ C1] ? lapic_next_event+0x11/0x20 [ 79.866999][ C1] run_timer_softirq+0xb7/0x170 [ 79.867022][ C1] handle_softirqs+0x226/0x860 [ 79.867051][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 79.867082][ C1] __irq_exit_rcu+0xcb/0x220 [ 79.867108][ C1] irq_exit_rcu+0x9/0x30 [ 79.867131][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 79.867159][ C1] [ 79.867165][ C1] [ 79.867173][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 79.867194][ C1] RIP: 0010:pfn_valid+0x119/0x490 [ 79.867216][ C1] Code: 0d 9b 68 ff 84 c0 74 7d e8 84 07 84 ff 4d 85 ff 75 11 e8 7a 07 84 ff eb 3d e8 73 07 84 ff 4d 85 ff 74 ef 4d 89 fd 49 c1 ed 03 <43> 80 7c 25 00 00 74 08 4c 89 ff e8 67 07 f4 ff 49 8b 2f 48 89 ee [ 79.867233][ C1] RSP: 0018:ffffc90004f6f2d8 EFLAGS: 00000a06 [ 79.867250][ C1] RAX: ffffffff8243bdcc RBX: ffffffff8243bd8a RCX: ffff88802fed5dc0 [ 79.867263][ C1] RDX: 0000000000000000 RSI: ffffffff8c6d9460 RDI: ffffffff8c6d9420 [ 79.867277][ C1] RBP: 0000000000000001 R08: ffffffff8243bd8a R09: 0000000000000000 [ 79.867289][ C1] R10: dffffc0000000000 R11: fffff940003188b1 R12: dffffc0000000000 [ 79.867303][ C1] R13: 1ffff11027fc1230 R14: 0000000000063116 R15: ffff88813fe09180 [ 79.867320][ C1] ? pfn_valid+0xba/0x490 [ 79.867338][ C1] ? pfn_valid+0xba/0x490 [ 79.867355][ C1] ? pfn_valid+0xfc/0x490 [ 79.867383][ C1] ? pfn_valid+0xfc/0x490 [ 79.867406][ C1] page_table_check_clear+0x21/0x500 [ 79.867427][ C1] ? vm_normal_page+0x13c/0x2b0 [ 79.867451][ C1] __zap_vma_range+0x3a12/0x4f80 [ 79.867516][ C1] ? __pfx___zap_vma_range+0x10/0x10 [ 79.867548][ C1] ? mas_find+0x6d6/0xcb0 [ 79.867571][ C1] unmap_vmas+0x390/0x550 [ 79.867599][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 79.867623][ C1] ? mas_next_slot+0xc91/0xd70 [ 79.867665][ C1] exit_mmap+0x293/0x9f0 [ 79.867694][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 79.867743][ C1] ? __pfx_exit_aio+0x10/0x10 [ 79.867783][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 79.867813][ C1] __mmput+0x118/0x420 [ 79.867839][ C1] exit_mm+0x221/0x2d0 [ 79.867861][ C1] do_exit+0x6cd/0x2360 [ 79.867886][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 79.867904][ C1] ? __pfx_do_exit+0x10/0x10 [ 79.867942][ C1] do_group_exit+0x22d/0x2f0 [ 79.867961][ C1] ? _raw_spin_unlock_irq+0x29/0x50 [ 79.867991][ C1] get_signal+0x121b/0x12c0 [ 79.868034][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 79.868062][ C1] ? __sys_connect+0x3a1/0x450 [ 79.868083][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 79.868127][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 79.868148][ C1] ? rcu_is_watching+0x16/0xb0 [ 79.868172][ C1] ? do_fast_syscall_32+0x33/0x70 [ 79.868194][ C1] __do_fast_syscall_32+0x437/0x6a0 [ 79.868215][ C1] ? do_fast_syscall_32+0x33/0x70 [ 79.868235][ C1] ? irqentry_exit+0x10f/0x910 [ 79.868257][ C1] do_fast_syscall_32+0x33/0x70 [ 79.868278][ C1] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 79.868302][ C1] RIP: 0023:0xf7f030ec [ 79.868317][ C1] Code: Unable to access opcode bytes at 0xf7f030c2. [ 79.868326][ C1] RSP: 002b:00000000f53c65cc EFLAGS: 00000206 ORIG_RAX: 00000000000000f0 [ 79.868345][ C1] RAX: 0000000000000001 RBX: 00000000f73c4f8c RCX: 0000000000000081 [ 79.868357][ C1] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 79.868370][ C1] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 79.868382][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 79.868393][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 79.868420][ C1] [ 79.868462][ C1] ODEBUG: object ffffc90000a18a80 is NOT on stack ffffc90004f68000, but annotated. [ 79.869114][ C1] ------------[ cut here ]------------ [ 79.869122][ C1] 1 [ 79.869131][ C1] WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0, CPU#1: syz.3.40/5813 [ 80.487906][ C1] Modules linked in: [ 80.491796][ C1] CPU: 1 UID: 0 PID: 5813 Comm: syz.3.40 Tainted: G W syzkaller #0 PREEMPT(full) [ 80.502465][ C1] Tainted: [W]=WARN [ 80.506260][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 80.516301][ C1] RIP: 0010:__debug_object_init+0x2c4/0x3c0 [ 80.522188][ C1] Code: fd 06 cc 41 ff c7 44 89 3d 29 50 e8 15 48 c7 c1 80 9d 6d 8c 48 c7 c7 e0 9d 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 ad a4 3d fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 81 7e 6e 0a 3b 05 7f [ 80.541784][ C1] RSP: 0018:ffffc90000a189b8 EFLAGS: 00010046 [ 80.547844][ C1] RAX: 0000000000000050 RBX: ffffc90000a18a80 RCX: 5fc7271e6215bf00 [ 80.555817][ C1] RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 [ 80.563782][ C1] RBP: ffff88802fed5de0 R08: 0000000000000100 R09: 0000000000000001 [ 80.571746][ C1] R10: dffffc0000000000 R11: fffff520001430b9 R12: 1ffff9200014314c [ 80.579725][ C1] R13: ffff888074e08bd0 R14: dffffc0000000000 R15: 0000000000000001 [ 80.587685][ C1] FS: 0000000000000000(0000) GS:ffff888124dd6000(0000) knlGS:0000000000000000 [ 80.596598][ C1] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 80.603185][ C1] CR2: 0000000033a20ff8 CR3: 0000000074c4c000 CR4: 00000000003526f0 [ 80.611147][ C1] Call Trace: [ 80.614416][ C1] [ 80.617249][ C1] ? __init_swait_queue_head+0xa8/0x150 [ 80.622784][ C1] __synchronize_srcu+0x1d5/0x2f0 [ 80.627807][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 80.633357][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 80.638382][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 80.644181][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 80.649722][ C1] ? synchronize_srcu+0x20a/0x260 [ 80.654734][ C1] wakeup_source_unregister+0x129/0x3f0 [ 80.660276][ C1] mmc_host_classdev_release+0x47/0x100 [ 80.665812][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 80.671953][ C1] device_release+0xc4/0x1f0 [ 80.676541][ C1] kobject_put+0x222/0x550 [ 80.680950][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 80.685712][ C1] call_timer_fn+0x18d/0x5f0 [ 80.690292][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 80.696963][ C1] ? call_timer_fn+0xd5/0x5f0 [ 80.701655][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 80.706761][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 80.711974][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 80.718661][ C1] __run_timer_base+0x652/0x8b0 [ 80.723507][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 80.728871][ C1] ? ktime_get+0x1f5/0x220 [ 80.733303][ C1] ? lapic_next_event+0x11/0x20 [ 80.738166][ C1] run_timer_softirq+0xb7/0x170 [ 80.743017][ C1] handle_softirqs+0x226/0x860 [ 80.747778][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 80.752537][ C1] __irq_exit_rcu+0xcb/0x220 [ 80.757120][ C1] irq_exit_rcu+0x9/0x30 [ 80.761351][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 80.766977][ C1] [ 80.769896][ C1] [ 80.772817][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 80.778786][ C1] RIP: 0010:pfn_valid+0x119/0x490 [ 80.783842][ C1] Code: 0d 9b 68 ff 84 c0 74 7d e8 84 07 84 ff 4d 85 ff 75 11 e8 7a 07 84 ff eb 3d e8 73 07 84 ff 4d 85 ff 74 ef 4d 89 fd 49 c1 ed 03 <43> 80 7c 25 00 00 74 08 4c 89 ff e8 67 07 f4 ff 49 8b 2f 48 89 ee [ 80.803438][ C1] RSP: 0018:ffffc90004f6f2d8 EFLAGS: 00000a06 [ 80.809529][ C1] RAX: ffffffff8243bdcc RBX: ffffffff8243bd8a RCX: ffff88802fed5dc0 [ 80.817610][ C1] RDX: 0000000000000000 RSI: ffffffff8c6d9460 RDI: ffffffff8c6d9420 [ 80.825592][ C1] RBP: 0000000000000001 R08: ffffffff8243bd8a R09: 0000000000000000 [ 80.833559][ C1] R10: dffffc0000000000 R11: fffff940003188b1 R12: dffffc0000000000 [ 80.841547][ C1] R13: 1ffff11027fc1230 R14: 0000000000063116 R15: ffff88813fe09180 [ 80.849534][ C1] ? pfn_valid+0xba/0x490 [ 80.853885][ C1] ? pfn_valid+0xba/0x490 [ 80.858203][ C1] ? pfn_valid+0xfc/0x490 [ 80.862536][ C1] ? pfn_valid+0xfc/0x490 [ 80.866879][ C1] page_table_check_clear+0x21/0x500 [ 80.872177][ C1] ? vm_normal_page+0x13c/0x2b0 [ 80.877041][ C1] __zap_vma_range+0x3a12/0x4f80 [ 80.881995][ C1] ? __pfx___zap_vma_range+0x10/0x10 [ 80.887275][ C1] ? mas_find+0x6d6/0xcb0 [ 80.891596][ C1] unmap_vmas+0x390/0x550 [ 80.895927][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 80.900763][ C1] ? mas_next_slot+0xc91/0xd70 [ 80.905552][ C1] exit_mmap+0x293/0x9f0 [ 80.909789][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 80.914558][ C1] ? __pfx_exit_aio+0x10/0x10 [ 80.919241][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 80.924433][ C1] __mmput+0x118/0x420 [ 80.928498][ C1] exit_mm+0x221/0x2d0 [ 80.932553][ C1] do_exit+0x6cd/0x2360 [ 80.936697][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 80.941891][ C1] ? __pfx_do_exit+0x10/0x10 [ 80.946495][ C1] do_group_exit+0x22d/0x2f0 [ 80.951080][ C1] ? _raw_spin_unlock_irq+0x29/0x50 [ 80.956298][ C1] get_signal+0x121b/0x12c0 [ 80.960817][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 80.966357][ C1] ? __sys_connect+0x3a1/0x450 [ 80.971103][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 80.977254][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 80.982614][ C1] ? rcu_is_watching+0x16/0xb0 [ 80.987372][ C1] ? do_fast_syscall_32+0x33/0x70 [ 80.992384][ C1] __do_fast_syscall_32+0x437/0x6a0 [ 80.997570][ C1] ? do_fast_syscall_32+0x33/0x70 [ 81.002582][ C1] ? irqentry_exit+0x10f/0x910 [ 81.007334][ C1] do_fast_syscall_32+0x33/0x70 [ 81.012171][ C1] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 81.018485][ C1] RIP: 0023:0xf7f030ec [ 81.022537][ C1] Code: Unable to access opcode bytes at 0xf7f030c2. [ 81.029212][ C1] RSP: 002b:00000000f53c65cc EFLAGS: 00000206 ORIG_RAX: 00000000000000f0 [ 81.037614][ C1] RAX: 0000000000000001 RBX: 00000000f73c4f8c RCX: 0000000000000081 [ 81.045590][ C1] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 81.053548][ C1] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 81.061507][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 81.069496][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 81.077498][ C1] [ 81.080504][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 81.087767][ C1] CPU: 1 UID: 0 PID: 5813 Comm: syz.3.40 Tainted: G W syzkaller #0 PREEMPT(full) [ 81.098424][ C1] Tainted: [W]=WARN [ 81.102237][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 81.112275][ C1] Call Trace: [ 81.115551][ C1] [ 81.118383][ C1] vpanic+0x56d/0xa60 [ 81.122380][ C1] ? __pfx__printk+0x10/0x10 [ 81.126966][ C1] ? __pfx_vpanic+0x10/0x10 [ 81.131471][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 81.136783][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 81.141975][ C1] panic+0xc5/0xd0 [ 81.145717][ C1] ? __pfx_panic+0x10/0x10 [ 81.150135][ C1] __warn+0x315/0x4c0 [ 81.154204][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 81.159505][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 81.164782][ C1] __report_bug+0x276/0x570 [ 81.169275][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 81.174554][ C1] ? __pfx___report_bug+0x10/0x10 [ 81.179583][ C1] ? __wake_up_klogd+0xf0/0x130 [ 81.184450][ C1] ? vprintk_emit+0x4ee/0x560 [ 81.189118][ C1] ? __pfx_vprintk_emit+0x10/0x10 [ 81.194140][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 81.199411][ C1] report_bug+0x16b/0x220 [ 81.203737][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 81.209007][ C1] ? __debug_object_init+0x2c6/0x3c0 [ 81.214276][ C1] handle_bug+0x9c/0x200 [ 81.218513][ C1] exc_invalid_op+0x1a/0x50 [ 81.223028][ C1] asm_exc_invalid_op+0x1a/0x20 [ 81.227864][ C1] RIP: 0010:__debug_object_init+0x2c4/0x3c0 [ 81.233746][ C1] Code: fd 06 cc 41 ff c7 44 89 3d 29 50 e8 15 48 c7 c1 80 9d 6d 8c 48 c7 c7 e0 9d 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 ad a4 3d fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 81 7e 6e 0a 3b 05 7f [ 81.253341][ C1] RSP: 0018:ffffc90000a189b8 EFLAGS: 00010046 [ 81.259396][ C1] RAX: 0000000000000050 RBX: ffffc90000a18a80 RCX: 5fc7271e6215bf00 [ 81.267375][ C1] RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 [ 81.275332][ C1] RBP: ffff88802fed5de0 R08: 0000000000000100 R09: 0000000000000001 [ 81.283308][ C1] R10: dffffc0000000000 R11: fffff520001430b9 R12: 1ffff9200014314c [ 81.291267][ C1] R13: ffff888074e08bd0 R14: dffffc0000000000 R15: 0000000000000001 [ 81.299234][ C1] ? __debug_object_init+0x2c3/0x3c0 [ 81.304511][ C1] ? __init_swait_queue_head+0xa8/0x150 [ 81.310049][ C1] __synchronize_srcu+0x1d5/0x2f0 [ 81.315060][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 81.320587][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 81.325606][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 81.331403][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 81.336951][ C1] ? synchronize_srcu+0x20a/0x260 [ 81.341973][ C1] wakeup_source_unregister+0x129/0x3f0 [ 81.347531][ C1] mmc_host_classdev_release+0x47/0x100 [ 81.353070][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 81.359212][ C1] device_release+0xc4/0x1f0 [ 81.363819][ C1] kobject_put+0x222/0x550 [ 81.368225][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 81.372975][ C1] call_timer_fn+0x18d/0x5f0 [ 81.377551][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 81.384215][ C1] ? call_timer_fn+0xd5/0x5f0 [ 81.388895][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 81.394019][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 81.399217][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 81.405915][ C1] __run_timer_base+0x652/0x8b0 [ 81.410780][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 81.416149][ C1] ? ktime_get+0x1f5/0x220 [ 81.420553][ C1] ? lapic_next_event+0x11/0x20 [ 81.425398][ C1] run_timer_softirq+0xb7/0x170 [ 81.430239][ C1] handle_softirqs+0x226/0x860 [ 81.435000][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 81.439762][ C1] __irq_exit_rcu+0xcb/0x220 [ 81.444346][ C1] irq_exit_rcu+0x9/0x30 [ 81.448584][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 81.454226][ C1] [ 81.457145][ C1] [ 81.460064][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 81.466037][ C1] RIP: 0010:pfn_valid+0x119/0x490 [ 81.471051][ C1] Code: 0d 9b 68 ff 84 c0 74 7d e8 84 07 84 ff 4d 85 ff 75 11 e8 7a 07 84 ff eb 3d e8 73 07 84 ff 4d 85 ff 74 ef 4d 89 fd 49 c1 ed 03 <43> 80 7c 25 00 00 74 08 4c 89 ff e8 67 07 f4 ff 49 8b 2f 48 89 ee [ 81.490644][ C1] RSP: 0018:ffffc90004f6f2d8 EFLAGS: 00000a06 [ 81.496699][ C1] RAX: ffffffff8243bdcc RBX: ffffffff8243bd8a RCX: ffff88802fed5dc0 [ 81.504656][ C1] RDX: 0000000000000000 RSI: ffffffff8c6d9460 RDI: ffffffff8c6d9420 [ 81.512615][ C1] RBP: 0000000000000001 R08: ffffffff8243bd8a R09: 0000000000000000 [ 81.520577][ C1] R10: dffffc0000000000 R11: fffff940003188b1 R12: dffffc0000000000 [ 81.528539][ C1] R13: 1ffff11027fc1230 R14: 0000000000063116 R15: ffff88813fe09180 [ 81.536507][ C1] ? pfn_valid+0xba/0x490 [ 81.540832][ C1] ? pfn_valid+0xba/0x490 [ 81.545152][ C1] ? pfn_valid+0xfc/0x490 [ 81.549486][ C1] ? pfn_valid+0xfc/0x490 [ 81.553809][ C1] page_table_check_clear+0x21/0x500 [ 81.559085][ C1] ? vm_normal_page+0x13c/0x2b0 [ 81.563931][ C1] __zap_vma_range+0x3a12/0x4f80 [ 81.568903][ C1] ? __pfx___zap_vma_range+0x10/0x10 [ 81.574187][ C1] ? mas_find+0x6d6/0xcb0 [ 81.578511][ C1] unmap_vmas+0x390/0x550 [ 81.582837][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 81.587673][ C1] ? mas_next_slot+0xc91/0xd70 [ 81.592446][ C1] exit_mmap+0x293/0x9f0 [ 81.596687][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 81.601467][ C1] ? __pfx_exit_aio+0x10/0x10 [ 81.606151][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 81.611348][ C1] __mmput+0x118/0x420 [ 81.615415][ C1] exit_mm+0x221/0x2d0 [ 81.619475][ C1] do_exit+0x6cd/0x2360 [ 81.623625][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 81.628811][ C1] ? __pfx_do_exit+0x10/0x10 [ 81.633403][ C1] do_group_exit+0x22d/0x2f0 [ 81.637982][ C1] ? _raw_spin_unlock_irq+0x29/0x50 [ 81.643179][ C1] get_signal+0x121b/0x12c0 [ 81.647693][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 81.653235][ C1] ? __sys_connect+0x3a1/0x450 [ 81.657991][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 81.664175][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 81.669545][ C1] ? rcu_is_watching+0x16/0xb0 [ 81.674303][ C1] ? do_fast_syscall_32+0x33/0x70 [ 81.679321][ C1] __do_fast_syscall_32+0x437/0x6a0 [ 81.684510][ C1] ? do_fast_syscall_32+0x33/0x70 [ 81.689523][ C1] ? irqentry_exit+0x10f/0x910 [ 81.694278][ C1] do_fast_syscall_32+0x33/0x70 [ 81.699120][ C1] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 81.705440][ C1] RIP: 0023:0xf7f030ec [ 81.709495][ C1] Code: Unable to access opcode bytes at 0xf7f030c2. [ 81.716145][ C1] RSP: 002b:00000000f53c65cc EFLAGS: 00000206 ORIG_RAX: 00000000000000f0 [ 81.724544][ C1] RAX: 0000000000000001 RBX: 00000000f73c4f8c RCX: 0000000000000081 [ 81.732505][ C1] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 81.740459][ C1] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 81.748413][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 81.756370][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 81.764342][ C1] [ 81.767654][ C1] Kernel Offset: disabled [ 81.771962][ C1] Rebooting in 86400 seconds..