last executing test programs: 24m13.236481744s ago: executing program 2 (id=619): openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10) ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0) write(r0, 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_io_uring_setup(0xefd, 0x0, &(0x7f0000000100), &(0x7f0000000300)=0x0, &(0x7f0000000080)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x64, 0x3, 0x300, 0x6e, 0xffffffad, 0x190, 0x190, 0x190, 0x268, 0x268, 0x268, 0x268, 0x268, 0x3, 0x0, {[{{@ip={@remote, @local={0xac, 0x14, 0xd}, 0x0, 0x0, 'caif0\x00', 'ip6tnl0\x00'}, 0x0, 0x130, 0x190, 0xffffffc5, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "bdc74c01369df17d17ac76fa5f9b3bfa0c34430d864040bc25b2b73a59aa6ecab6b1d2cc05e3182f64694d7d05fb8b8c8f56627a54f905d564eeeb8334f650ca0f3c44f7fda4d20a55050342ea85ecc8838e7088de33582f36a0a375bb7008adc297a5ece1bb2df53d17bef26bb6f800", 0x7f, 0x2}}]}, @common=@SET={0x60}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, 0x0, 0x0, 'team0\x00', 'team0\x00'}, 0x0, 0x98, 0xd8, 0x0, {}, [@common=@inet=@set1={{0x28}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x360) socket$igmp(0x2, 0x3, 0x2) syz_emit_vhci(&(0x7f00000002c0)=ANY=[@ANYBLOB="043e130600c8000700ffff"], 0x16) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB, @ANYRES32=r2], 0x28}, 0x1, 0x0, 0x0, 0x4c000}, 0x20000000) r7 = fsopen(&(0x7f0000000200)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, 0x0, &(0x7f0000000280)='\x00', 0x0) 24m12.280616437s ago: executing program 2 (id=624): ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(0xffffffffffffffff, 0xc0305710, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f0000002200)={0x0, 0x0, 0x0}, 0x14) read$midi(0xffffffffffffffff, 0x0, 0x3b) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80383, 0x0) read$midi(0xffffffffffffffff, &(0x7f0000000040)=""/25, 0x19) ioctl$SNDCTL_SEQ_RESET(r0, 0x5100) 24m10.332582314s ago: executing program 2 (id=628): openat$vicodec0(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 24m4.316032948s ago: executing program 2 (id=641): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) 24m3.768690862s ago: executing program 2 (id=643): r0 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f0000000040)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019440)=""/102400, 0x19000) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x181041, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r4, 0x3b85, &(0x7f0000000200)={0x28, 0x5, r5, 0x0, &(0x7f0000000a40)="7f", 0x1, 0x4}) 24m1.574835114s ago: executing program 2 (id=649): openat$vicodec0(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 23m46.442547168s ago: executing program 32 (id=649): openat$vicodec0(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 2m51.906488179s ago: executing program 4 (id=3638): syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) fsopen(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x401) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r4, &(0x7f0000000040)="e4", 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000200)={0x4d, 0x82, 0xfa, 0x0, 0x77, 0x9, 0x8, 0x58, 0x0, 0x17, 0x9}, 0xe) 2m45.597214646s ago: executing program 4 (id=3645): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000002840)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) socket(0x2a, 0x80000, 0x4) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xb}}, './cgroup.cpu/cgroup.procs\x00'}) ppoll(&(0x7f00000003c0), 0x0, &(0x7f0000000400)={0x0, 0x3938700}, &(0x7f0000000440)={[0x3ff]}, 0x8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) 2m41.955776657s ago: executing program 4 (id=3652): r0 = syz_open_dev$hidraw(0x0, 0x0, 0x418000) ioctl$HIDIOCGFEATURE(r0, 0xc0404807, 0x0) ioctl$HIDIOCGRAWNAME(r0, 0x80404804, 0x0) syz_usb_connect(0x5, 0x52, &(0x7f0000000580)=ANY=[@ANYBLOB="1201100a144ea220e2040114ae34010203010902400002081020020904dc0300027112070a24010400130002010209240604010107000709040101026552cc0309", @ANYRESOCT=r0, @ANYRES8=r0], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x36, &(0x7f0000000180)=ANY=[], 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) r2 = syz_open_dev$evdev(0x0, 0x8003, 0x146800) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000440)=ANY=[], 0x0) ioctl$EVIOCRMFF(r2, 0x40044581, &(0x7f00000000c0)=0x3) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000300)={0x3, 0x0, 0x0}) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r4 = syz_usb_connect$rtl8150(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$rtl8150(r4, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0xc38, 0x0) syz_usb_ep_write(r4, 0x83, 0x0, 0x0) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, 0x0) 2m38.416659005s ago: executing program 4 (id=3657): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c2", 0x17) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f00000021c0)=[{0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, &(0x7f00000020c0)=[@iv={0x18}, @op={0x18, 0x117, 0x3, 0x1}], 0x30, 0x800}], 0x2, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 2m38.048568124s ago: executing program 4 (id=3658): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r4 = socket$inet6(0xa, 0x2, 0x3a) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r4, 0x29, 0x41, &(0x7f0000000280)={'nat\x00', 0x2, [{}, {}]}, 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10) getsockopt$sock_buf(r5, 0x1, 0x1a, 0x0, &(0x7f0000000140)) syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8931, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 2m36.964783131s ago: executing program 4 (id=3659): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/power/state\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='mem', 0x3) 2m21.885857166s ago: executing program 33 (id=3659): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/power/state\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='mem', 0x3) 15.234039191s ago: executing program 1 (id=4057): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000002840)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) socket(0x2a, 0x80000, 0x4) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xb}}, './cgroup.cpu/cgroup.procs\x00'}) ppoll(&(0x7f00000003c0), 0x0, &(0x7f0000000400)={0x0, 0x3938700}, &(0x7f0000000440)={[0x3ff]}, 0x8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20000080) 14.222267036s ago: executing program 1 (id=4060): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={r4, @in6={{0xa, 0x3, 0x3, @mcast1}}}, &(0x7f0000000040)=0x84) listen(r0, 0xa01) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/net/sctp/assocs\x00', 0x0, 0x0) lseek(r5, 0x800, 0x0) 12.343486543s ago: executing program 1 (id=4064): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) r0 = fsopen(&(0x7f0000002200)='ramfs\x00', 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = getpgrp(0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x401) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x50) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) recvmmsg(0xffffffffffffffff, &(0x7f0000006800), 0x0, 0x141, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) 11.278008969s ago: executing program 3 (id=4066): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_int(r4, 0x1, 0x2, &(0x7f0000000300)=0xfffffd7c, 0x4) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setparam(r1, &(0x7f00000006c0)=0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x20000805}, 0x24048040) r5 = io_uring_setup(0x66a4, &(0x7f0000000380)={0x0, 0x417c, 0x2, 0x1, 0x2b8}) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0xffffffff}, 0x10) r6 = socket(0x1e, 0x4, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r8, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}}, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r10, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c814) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x5c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbbd, {0x0, 0x0, 0x0, r10, {0xb, 0xfff3}, {0x0, 0xfff3}, {0xd, 0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x40}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x5, 0x1, 0xa}, {0x9b600000, 0x80000000, 0x3, 0x0, 0x9}}}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20041010}, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) close_range(r5, 0xffffffffffffffff, 0x0) 8.900464099s ago: executing program 5 (id=4070): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt(0xffffffffffffffff, 0x84, 0x81, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'dummy0\x00'}) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$sock_int(r5, 0x1, 0x22, &(0x7f0000000600)=0xfffffff8, 0x4) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0x0, 0x0, 0x0, 0xa}, 0x94) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) write$P9_RMKDIR(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x49, 0x2, {0xa, 0x0, 0x6}}, 0x14) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) shutdown(r0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='tracefs\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0xc4062, 0x0) 8.795992711s ago: executing program 0 (id=4071): syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x2, &(0x7f0000000000)=0x80000000000003) syz_open_procfs(0x0, &(0x7f0000000480)='fd/3\x00') fanotify_init(0x40, 0x101000) ioctl$TCSETS(0xffffffffffffffff, 0x5402, 0x0) wait4(r1, &(0x7f0000000100), 0x4, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r4, &(0x7f00000001c0)="5cba", 0x2) ioctl$SNDCTL_DSP_SYNC(r4, 0x5001, 0x0) 7.744558477s ago: executing program 5 (id=4072): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) fcntl$setstatus(r0, 0x4, 0x800) ioctl(r0, 0x8914, &(0x7f00000000c0)='lapb0\x00'/16) ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0') 6.545202957s ago: executing program 0 (id=4073): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r4, 0x29, 0xd4, &(0x7f0000000040)=0x5, 0x4) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000840)={0x1c, r7, 0x1, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000023c0)=ANY=[@ANYBLOB="140000000109010100000000000000000200000144db601cd21922675950b5ae1e3fcbfbca072059e8f557310ae52b91f0023b159f9cc8601e7fe6be3b57344d937b7619c778c3f04160ee0045bea682fbc750042f0f4e7c2585a76f9b47aa7cb1764f930249c8070f5bb52e1653571fbc84488082"], 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0xc854) ioctl$VIDIOC_G_PARM(r0, 0xc0cc5615, &(0x7f0000000180)={0xa, @capture={0x0, 0x0, {0x2, 0x2}, 0x4, 0x9}}) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, 0x0) syz_open_dev$radio(&(0x7f0000000440), 0x1, 0x2) openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) io_uring_register$IORING_REGISTER_QUERY(0xffffffffffffffff, 0x23, &(0x7f0000002280)=[{&(0x7f0000000500)={0x0, &(0x7f0000000400)="331ce46322", 0x89cc9476c6b5ad1b, 0x5}, &(0x7f0000000540)="ceaa622ea2e4c4ff6cdb1e0d0626fa804b9b51c0a2f6c942908732b52ac8749582c78b3f5e804ca353dad17d1acaee716f28702c32b0de57a06ec3bd418871be1bebf72a6db859a3ec9ff97df76f75cf1c443b272b1d6e96c9e6a03526a076eabdc8500e55524017d9dc2e7ab98131df94209de1b9426598e7b498c445a6c6e8982e6c58af4fedc0cb8e26ba5fe08901aee1ba881c8df5248d33", 0x0, 0x9a}, {&(0x7f0000000b80)={&(0x7f0000000ac0)={0x0, &(0x7f00000009c0), 0x2}, 0x0, 0x1}, 0x0, 0x1}, {&(0x7f0000000dc0)={&(0x7f0000000c80)={0x0, &(0x7f0000000c00)="a5d1068a26a3fc04eea57b8993c7a8aa00b4532ac2a4a07f1a6811e8fba679416a670bc1f3c922173c034c03bfb161aff8fbc4d65316f0882df38dc92b13331315b11824fa01a9f000e2c02be2e91edb9d92ad92b21fb4fe", 0x3, 0x58}, &(0x7f0000000cc0)="85f9b734d91bdaf449a13f39be786a2639884459dd5c08c8f42298c9887a48064d91b5930b2e7c2591c25485fde27b2e0d30dfd9bb95db41a55ef43a55547778e58a7e802a6be88581c4646f84feb778cd2361c710ac527ecdc7cc12303ef73d025bb3d912abb577f4b3c0105b5b622218551b762727daadd615", 0x0, 0x7a}, &(0x7f0000000e00)="be82c7677c7033d2b6bbea4f75834aeddcf607d1680d364d8d4b42986e7e3d5a0b24641219ce55faaadadae73409f719ec9b8eb0e25439f7360ad84c65fb31e5ec01e734a480214503ca19ee38bcc528150caf56ef45e1b59fc410ace8be35146561b6137126effdcbc3477f95442ceca6d0", 0x0, 0x72}, {&(0x7f0000000fc0)={&(0x7f0000000f40)={0x0, &(0x7f0000000e80)="e2f70944dfe10e622d99323b46ac43c7b721cf19db1480e05a420eb9a8d535bacad6b7359689e5b327e02ef886cf09ff8ec94928b77d490c0234ade882fe56096c66193c68a0b97b87613525391fd7d6730df38e3c38daa2095214a0dcb86f6736530ae33b0c4d511d60d381fc56804641b593d064a0bbfd737f4d1481de64034a811498109b06683cdadb7b726563fd51fb4419ded36a0e14121a24ca074407", 0x1, 0xa0}, &(0x7f0000000f80)="7067d2ca2f04f3a59fb13a4bf97f46", 0x6, 0xf}, &(0x7f0000001000)="2d62980258e1000b3d1254edaba0050ce791cd8770a8484037c91d48c79a1ae3e305e0d1ca3a1b015cb4002d51d64fc27ac091bf28e85cf3e22d3d69c2d1d4890ba7cdfb57428e103a1bc94e8416da18be110c890e02ca3da66158636e558ac3f239cd266ff6172f64fbab94d57d23d038784a7a5fdebbd63b3a47d1ef96cb89331e4eea9f5bf2f824c83bc7b765457cce1927eccb0d33b9aa0ee0a36931ec2e9cc88dbebb9636deba9e017ec966ac4dcc52844af5e561681abce9ce9f92dd096386ae545043ed240b9a660458294d133d2cafa55539a5d1dd40289574dfd1d891a878c00d904bcb81f98eb2176c371c7a88ebbdafc09b5b7bb5de62a5ad373e844b6055b7cde5ed2fec444cb92920831464af264d9b796f897a6d60120fb31eda3c8c78624b8f7d4a2ee209e3564bfc381cfc17dba38681fd8e9aed2e390af3439c06958941d794afa75552767227c4cfed5c6cbf67ef76cf702f2eb03a2a4c3eae0ed84c55815f81d24eff34b0f956e54c99e109e80e72523445b9ef755f1bd97d582c89c20b55087680f314b64ded594cfa636b7fb63406de7010fc71301c3404afb1d17e3514e7a294b0ac68bfb677c57f0a08c8996a8ca22100d5d2d2126708ba2403716dc29d3ff608a57505ebfcf1c3e72ff24c3f38ab761f73bf60a01e2068bbf2a65606a45f3c7e16bb20876b610c187c0b04ca18967b6c171bb7b831129886c318fc7537f62843c6a3ff32829d2a34c0c6e2f70753b74c91c119ec919cdb671ba59f04a72acf046f837785e809417f1e02fccac943ae29e90cae27f2c0680afffda0cce8a1b180bdf04d2181e298e92b01ed78ec206b78a19178552668efb44dc0732c89235edbcfb54611dd0c367f809596b8299e1b159a4e93dc5bc51d641b24ea6a275362968f3e38d9db6b3c8014e5b6ee8245df43c5e9405994264751a6f990f150d02df427d689ef2d418dbeb39cbcdb7540060305372cb2ef45ecef011ff8fd663737f67df9a30b8ab1831a02bf47a8fde511e59f71ff38094bdc624222ea710873732e85b83b2fba450d34c9265f00148502a5af03eabc4ff820c8afb2eabe69191545d2c368830bb55d8e6c2580173220c4c7d5a3ac62b831f27a77adeaed926e570f76ded55619414130a0c1777c45d0bf44e3405b082d61ca4f1069cd7ec457f6c696202928afdd7d18ca9a581c82c604562ef42fd16de23750b611ee1c65316c25a2c1158db9d68f3d4fc730fca7f68370eb82d4214d6a8498ca1012e0e70ba8fe6be54acbf957ddf907a1a5e7f9c14090d09a327b75e100c6c2eb796596d89856b5edad1046f09307b996705f6180ffdd2e5123c89d3b19da1334fc3daec4403ab3ff8d11fe8827f5d70f914a32abf1276cdc147d89e2dd0cdd0e154f1e7ed9269cec5e598504af47e2f856f14f78846f9fb6d570336af7dfb2fe3b47a3a935af0e6fb96182cf032890491d76618a1aea17a5d5d08bc6da60ffdae81e5728286a3ddb8ea9547c18216dc4ec2299098dcaced67ff37782fd34d7f7c81cdb814ed6ff03c7c76a3a7a465b1434e5153fc30de14dd95a3a48644030c7108f13aa0acafa2d26b26f9717f8179809f6701c7dfee7bbaea629953daae2efccd72777faf3f36207bd2a8feaa29ac7dbdc249635920b1a0c3c8b6162dcf7a86e8e89aa42fd811dbbb45e0ecb2bc8af646686015139e82e42d47936a4e0c72dc3f983bf5bce93756301d4d3bb9a70aaed25dcc9d9da8847dce8d71cec4219c27ab89e94428066a4b6f0e8c662f2f193fc9895fec29e0fdc46f27fcd56564173e9a7c17d6dac4629a502b1c128aa7b6fdab188a9ad3be63a22a8a76ebe0448884783ae998097e3bbb15f810fe1dd204682e503680dc7db3d1498f530df5b435835f4960c3713830a06393984b6c65b36f8dca1de27fed9e9c017bf8b022af845d29dfe2a8496d04ad1e51097d6d066b1de42b0d772e06ea68fdfe361118ea501859b64c72bf3dcbc11c8e86bc5dd6b596b11a8e6bbde344e6b351ef5defa0c68469f331a5ccbb33442bb1a087a2c7750c4f0548e0170f2b0ef2997965f813db7ccc997f327f3fbfdbcfcaa0873f4a8f7296af0072f46516896b16b596c85ab828ad43185c845bfd212d540b416f4e4bfa9737adf25121a99202cd2e98c24de6bf992702d54788cbded8ce212d410ecb1d34b27c05a9cfd69f1433ecb9b3bde77ad8875c8e4613b744c2131ce649514dad3792e9fc0ed74f8383a425f1bbeeb3596a164dc8eaab43996999da478c1539a49856d1b7bd7c9587b39a3306369c5967e9b86d78d356d934b42e6c3b4937315bc342719159c3ca61a5caceaf8d6aa4ecf356bd842b0bbfd50e45bfc837f5392241ea5f292faca5bb0884ae69f9dd433764793f6bdbbe1fc15d66f993b390f404d5cdff7273e198d8f7d047f49aaf387e0d79b5f59fb9e18625fc0ae8e761946ad3ce514f10faea9a4e591e8b256e374cf50e2ebfa23a85925c14055fc074d865fae6a6617d45fcb0f9e37a2910d9c534d331ebddda630d64d7f3b9d1555d442d17f94c1673da6cf9266c387f39c3dafaa570b828fee12616ac617f9650ce5cc9d8a524ea26ca8175d243e1e117d578e93720d702027922be82100a5510d51e7ce2ca0267b9e86fa2c1667f3fbb9353d410a02dbc7c2006f5b2cfbcbdbdfd89f47074534127470903cf3b1a4c7fc1cba986bcda8b0f858ed069c6b8dc8191c2d34d39e78a01dedd09546143a57c7d78987bb2bdd051605d095ea0d00acfad3cd101725baf497a5a113d56172c3337fe1de4c86648df888ea729f15da50b05bd1ca90af0d3fc7a22ef846c1d23d34789fe212041108cecbc0718c5057c61eb04e8677379ec92e72148e44b61f50086f942692c9c732ca09a1872aa7b1cf085d6044a2c21f2ecf572000e4159a1e520ca10b6872bbb5623a62cb3c6e377b9b94671a9b5e3bc9e056a812d620837f108f70a0ce0f1b93623fbbed9ed85413f63d01020d5132833bc0b257bb0a8dca2f794a7a3e59f59e075b73870f283c04e76b098969cb5d77c52bf2b29af79707ba578528bdcf29954de8bdb26dc1153adbd7f033c70a8e9525f1912748fb874bb34fb3cf98b02d235557846a32eb8dfcab61200ef4d6a6b4cf6e800a381a70697291526897eeb3f0622af1e4f998150637493c1605659c00c99ea3471e8a0eb0fbfe2b073569f1befbc5f2125343445190c69cbe8804960bd3297c48bc72f0f49b522696196ef559aa2a87eafeddf2585f49bdf00589f0054b57981f8ba9f05cc2903d38df011b1bcce7b97fc093a4113899baddf17d63ca630cde485d25218e5e1064b8fc86595e72397b6a522c1c8bcd97ee1f0b3526eff32d4e5924416a61af498a3520cb2ed9b3120d3293581fe29e724ac90e00c13245d6edda4a961cd84196156094eb5b4b892696b8c9935da3ec86f40f7a0c72963d6545e1f08cd393926a6a6241382bb52750d9b228ed4d949d9b1ddf6fbf2bcba94f849ad126e64632e9a32b11cf9d69b43ecaad0503f54f4211d859adcb012761f266e4959d601222f1e2a7e4ae159559b7a43fb3ac5227cd2833fea6ae090fabcc5a39278e9a0b291a4d57e9650aac11a3be6655bc1feac868633ebcd3628cff4c3d5d4b70a126d8412709776917e98d36ca383566f9a1b8945acee8ed41e3bdfbdf004093d0d889d77ccce102853196237e6a99b5eb403fac97dcf09b5087d086c8c021717d25fb61bd80e8d267f1f895b57900d61072bf108e2cf840f9fd30d312f2472d7772ef3f7eb33ccab5246ca8a22a498211b86da9b1b1becfb43ba232386dd94d136e325d26c21f95a0d4d5f952e3ba449fc9d0946c78b474bb6675daa895bdb6b77d0de8155c39655d33271dd793c20d2acdb13b720cf76e476395a6f164a59c0ab0a6c83a9629d7604f101ea4d4a6abd73ce91325a9b172443b86eadfec3b3af8067681f8ccafd3d15e672f368d24b48b466d4a28422e9019d91b92aef781c626917b1bd0fb2c6fc4c4b6f03037f56176d86f14572d6e136ae087307de9c34317f4a0e39c9037d9ab3da8b00d334385e5609e259504d0780e585b136c3add89a986936543b04ae5f5fab25870c69d13cadc6fb852c30ad9d8b34991b44122f132d203fd496e2e145bc6e5ea52d385ec3eaf0ba91d6f319f9519314bf000506a106fc8d162ad38182e26751e9d8a99f5d9e005207c32f7458593022452762424a64f135ac98d43e34d6e78830c3beddd9956ef58b1235cfb97a20a15f82229dfe66c64c79b07f852bad1892b5fbaf8023ff7369bd7b4a29b6d9eb455009560", 0x1, 0xc00}, {&(0x7f00000021c0)={&(0x7f00000020c0)={0x0, &(0x7f0000002000)="803f1108685db86fef2acf048dee12eb98dac08e95b926d0cb044abc655a9f43d7310f3cd444c4c0dd7372c8f55cdb24c3814a9b0f49580aa75f9a50b60fe2a693e980", 0x0, 0x43}, &(0x7f0000002100)="935ab67a62495a6d2c059ca244fcebc55e539c9cb5be400ff8b4c2a2bcd959a6aeabf57888285ebecca31927d528384cbf46558e82e640467ef0d1bfd1b013ca2f81384079d8cf1886b882b3bd8db5cba30443176628948850be60b0de2ad44a4019d07f67ba8b2fb4b0913a8635c5a766c0e1fd27088d05180febb91474dad58b13c096438ce96b39b7c7546610c67010d5a77fcd28639240ca13856470af7d", 0x2, 0xa0}, &(0x7f0000002200)="4df5952474a974b5c48b35a2c69f57b50a08783277cd2ddd144361096be5efeff7c7bae58f730cfbf407bed9d479d505532247a423d87688199198310fcf86666c09c658dfc2b1faa249728581285232518918655ddc4d02d4912fcec6b06673ec9190ef1b13aa1977597889c6444baacd7ff38d23074aad", 0x2, 0x78}], 0x0) mount$9p_unix(&(0x7f0000000300)='./cgroup\x00', &(0x7f0000000340)='./cgroup\x00', &(0x7f0000000380), 0x40020, &(0x7f00000003c0)=ANY=[@ANYBLOB="5b72cd00"]) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, &(0x7f0000000280)={0x9a, 0x5, 0x68, 0x1, 0x408}) ioctl$VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000100)=@mmap={0x7, 0xa, 0x4, 0x400, 0x5, {0x0, 0xea60}, {0x5, 0x9, 0x7, 0x60, 0x9, 0x7, "de056a52"}, 0x4, 0x1, {}, 0x3ff}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40400d1}, 0xc000) 6.505622908s ago: executing program 1 (id=4074): socket$nl_netfilter(0x10, 0x3, 0xc) socket$rxrpc(0x21, 0x2, 0x2) inotify_init1(0x80800) socket$unix(0x1, 0x5, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 6.369190322s ago: executing program 5 (id=4075): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000002840)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) socket(0x2a, 0x80000, 0x4) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r2, {0xb}}, './cgroup.cpu/cgroup.procs\x00'}) ppoll(&(0x7f00000003c0), 0x0, &(0x7f0000000400)={0x0, 0x3938700}, &(0x7f0000000440)={[0x3ff]}, 0x8) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) bpf$ITER_CREATE(0xb, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8002, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, 0x0) 6.265529274s ago: executing program 3 (id=4076): r0 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000440)={'#! ', './file1/../file0', [{0x20, '\x00#a\xe2\xa0&E\te\xec\xd4\xd4<\xdf\xb0\xa9k0\x8f~BsZ\x91\x7ft\xdb\xac\x9d\x87\fC\xcf\x9d\x94n\x1fP\x7f2\xb28\x00\x1a\xd2'}]}, 0x42) write$UHID_INPUT(r1, &(0x7f00000007c0)={0x8, {"dc5d3b0169633d3eba3eabbc09167be55101d4af4b22a373236464d2dbfaa84399b77bd438a54364a7ebc5bdaab4f9decb7c044318cd59a0af8279bcab35dd7daf7a0ceb381df2c32eff45b13e2c8f40e1895355bf6f165200cb1ca41a155730ee2e9f83183e9fafe029d0401b0770618254a8b2dc87b630072b1e2de160d1afed51b74c14b71ec1b226a324482d14ad586b1a4ce80e458fe45244c01eddeddf3564af838d6d5324f8a77023d6eb7aa14397a0e1413ea1c3dfdf063a35b709e627f36fe403ee3117365be5017682f53595f28543062c740a94a794312f5cebc315044b8ea000a5d0f27812ab0ce149d11e6f6f7620c5f3e250bf67d13a1ca39dbb7b8b5a31e3d7ba7ebe5849a7a09b61fc9f2cfc54b89e9cd0105bca49483ce55e0187ce2ad692a18219d881057c838587b915337169ee054655f26a04df913a658fccbf4def6aad750ca4796b74d322c67e9d4ee6a530a22dcc35db850b424d6ec9f62495b9f9fd2b000feadd57d26dbd505798c208d91eb0aab0fd97537631b8bf81ce0e2241c4272be4ff69b390e4485d574146b76d1fdbf7fc5334906805534cdae1e47240af7761a18fc8bd0a694be47529da98bc0f98eb7db3fc4a74cbb6e486f4de90fbf2452e72c2e1dca44543ad9ad094b8bc861eef1e814662d0b350339e3a510d459c6f83aabd5fd3dcb38224056d761e7df9b482b9905f1e2135c1929be328ecdb69c007a3efd548502c83106f6df1ab1178fac499eda92ad4373155227ec2df150c919d322ecb3ea37e659285f18a3e2f79b59900ca438df3a1381380a12d3ad7678e0a8d3bdfb40651389b4ac8c66138d442d70eafdc2df8b080028006b124e4ebe0d9883ef100f1934e425a4146056d800975675bb1913142adbc039a9c68c2f146a0e8903447313f5e5549905f397a9b1f21a93b80c4d04a8ea7a29a50fbc5407a9305bba420edf898ea678d6879489c39692c99bb6dacf61f5f97637b94c1031d635b5423d27f7b78fafa060000006eadc21466af5a10281e6a808748969d29efb444c99a4cb2111732a792dbca4376a125a68f7cdac065cc6173dc21caafba48c742d9a7df2f771ff2f5725b22c247d4e0c6106f9f5f6929b69929ab37e9a9b326ce618bb702b883b12026f1300f21f2c7440cac8c5f1210a78aa067211d2827f5dcc7578252c2ccc3f67bab9d1bb6939b21b550788ef550acfed4bf50c0b4fb3ca4d2872ee64f95d611a317d9daaf373a10d868680b2226396c95fa2b0ab4d6fce06c3b42cb97d17a7b5089061537fdeb1a53040869f7befca330358fdba86754fc2e46c2113e1484cb37534af8f0408a7ee313778dab49f08229964298f847ea66c4ec319f64b6a12da585bc59e82e0263c507b397d3efee3b4066f4d25566aa1549f6185f6375f84b65fa8945148b90430c86a5b6fdf58d5c812b98d9dc621fd9a3d9f1a577495356516d1cbcf5e8bb8923b54b247225b9c3892b18a9e137f3620c734052af9dc8f1ea36f0d4592d5ee32e35676a84dc891f97456f2ac3a4ab58a42bcdc221a4ac8bb28d428add2fcbe5b110a8afd5d23b31e827bd16167b2d88cae024afc04a722ac0b4d45c52512e6b6f102aac4be21bc89ce246539048370553665b0a4336a6db99d0d19399be6437bf21419304331b4342b2c1db580f0c9bf681fdb8e9fa3e025454197bbc82ef93ee2f385660818ec5127080675a8013766469afe3b1e36e81bf2f04c3a26eaf4517551e734d21ba3bc90e48aea0891792970c39f3f528397e9b7ae190f1760fe5960dc763ee0a17939c60bfcac0a8914be82c749e4fe85d1ac5fa733413468fb8941085e8c4d6e0b6d1e62e20da58440facd640ddbb6c1f694b3ca48757a34c5a11668368711a1d4f3a81d31ac30d71277d7ae77882b6841cfa6289e6cce84a3ad57eeb328f831888ac7d3cfcd3a472a48d903f20cec8c8ae8d0bea04ebf7413ef7693f8ed876e49bd5f89d7e1078208ff62712e330fc0341b9ccf26845578d44b1e0c66d1bebc14742baedfabb8e9a2c8f42730360c72997efe0ce786ff330c2eb6e0ff20896f813c2a515ce76f87d2a1a1c1588eb369231ddeb4a2f9f9591ecdecc74d20aeb50047beb3ab89a9e4e1b805a20b645c79d0bc5d0247fab8ba46a97a07630b1f1cb69b42b568af746733d2c581f057873d64fe6e659b00b4a26745f5fba1fe7406a86b007936c7cfdac53a4c5b0ea9f6604863c8e3f174eddbb09175f6e13cda9a860cf400ef9ed02b895502ac6e6de6a658249c3c6e8a653517eae2231e56e0f120547923c6549ebc1ed14c623637ce3d96af5c93a32e58e2d9659d8b5b145888b52d9a5b5cb3cdf594eb137bcef2ba068cfd2c6ccf7ab6e5b4ec55e9197bfb91c9b8729f7b50cf0b0326f7ea3e712c77674d48545ca2a86744c3c38f149d69cf811beacf7e5f49c7bfba20f1dcf3d7bc0b9c796016820a46495d244c9606a06fe2e14233eda78d69ae4523ad7b708b0c7ead44d7fd376fed60e3cc2ee25e9600adfbe87ac7c8fb8269aec9459602af0f420becda6120ce7d9626c65ae7f860639e8bf664eb4301ec18add0e436c0356c12ab6b4ca35da2b43c4a8c239fd0b59a2ce94843cdfa1667053165053633b062844dbb0d00070fde74fa3178eb5f1f5fd02e2088d8690379f39ab22c080cdcb29d700bac74fabd8a356fe99afe83a5d99aa5024e9158a299eda6c99b6701e64f1d68e7e2c0c6e88396bb535a02d0948f0a250a6e090041c96d9c9acd6134d44d516fd1010c39e572b86b05bb1326a2a4f23f11181186f9c2a01dc7b58c0129f4b851ca9b1e3dc35db7364e29ef646211796b1651511e041345abce427fa5d6e48b8fb078c8432061a4cc518a8f2a2caf709a5c1473a62112a6650afc64eec12f8f9c08cff1b6fbf7a1209fc8661f62303b7c5d49c1d0b32a9f37e81ed9ab6193816d40995ed49c10b9f5752e04d57535a3d16f06c65d32846c31ec9787ec4a965679eb804e86b45d007f38d8104550770dc6f313bc846e43a14a8c21d0628c744e3e83cb998d1b7acfe996541a8c03852dadf9326444c582b481cae844e4f3fe3d638903b38f24633b63adbad841ac6c4c1169d781a0e271e8a967b1c7e986fcb3a66168e86e3559a44fcfa92452260491da9397659af60453f4cd4be2d15439445ec2b4366a79d3283da912d9d499df1242bd174edc235848caa21d2c997aff0e95c7e5cc0803c90fab84e7be7b37909d0388acb6800baba183ecc8eea8c71c0d65d669e41f99ceae523b7a6b772f3b8ebba1d2127ccc3ddb7ddcb4ec73cbdc26fc87c3848e258a0b5484d3a13e40ec4e4a65dd92f09e9fe1e3e2f8b96c4e363aa3683860dee62dfcf8823ee4a3593a092e0bd9c4cedacf44a272faa164447b01f46a7795642a40c61b0034a37f0e9b792428a0ddcd144fe8263088eaac8016f8f1cd30b55ac90a8f10d785b7570dd9e639a4a068d3fe98a42010e24f69de817f676c2a224300d749571ad43f49d1fbe838f4566bc7b5f104c384ad87189213152b644d9fcbdf98bafeee569d640ce9045779f1d90024c023a7480a358dee276fba139c14b4fdb12885240903d0e61dc161659a68f62c92b899007e0f2b65bf0a069e9e57c9b6ae50a3b30dd1003fb0eead73ae2f6010b3b356b4060579a4f29935e1f00c01d12e5f44e8e3163d81dfef7ca8560604240c7e96e4454c6971614df306c768121abb3f628e3f1d2d026f58d1087334c5bdb74d7c949b0ee66a4531ba4e9b922aee3d0f802ed034734507a5913c52966f1f8bd4577840de0253aabc23299dced2a299859c07af9fb0f9c29b6533b9d84d471390d59ab315f5ddb226f6b8dd7889295f0fb1f7bd1adafe4cc520a1e84bf2a59d5b9795aeafc8d6fd66a8228aba8653b98622617ddfeb5d6795c9bd2f35d4a0c386e862675a50e3314c3fbb17aca151c13c7fc8b1d1b72ed0a958537b5ddc9e74bddc2b9571ec3f2b7775b125338d4852a75a63941564c65bb36dfb6bea4aab1ae7a4f285c2177aa98406eb2cc10934aa92d5a9612d4455c84ad200841d289b5c2d5deab0d8e2459598ef183d3dc46f6bad0b9513710600cfa4d69fcd5763cdcc4f2c2b7cd7d4491fd52f4aec82ce846c0988f6f0123e21e900d39c61085e68c9badc350b44004f6c042d64b0d0cbf91ad0592b198f1eeea1e52200bc8e6d62848d6884b10bdde72466039da488be6b340c23148f666f2fe6e032c07dac43586df182aca9116f4600313fa8375c76337ba86bdc391dae6450218f58f047ced64befc6bb5c2a60024669630a6279fedf2fe45e7e19ce582ad96ae0d023eb9b39f5f1e666e73bb038ae38157275be5eb3e7cbc8b05adf53e817646bdc2cfce98e5d162bf7faaca787db8717ab8b27b9e35609c5fb9fe9def07f010df8b43cf5c96851eadfdeff0b7bc5826e7e15490ae9c3d14166ee81bef007070e7981235a673804ad89943ee6b51ac63364f7870e121e6ff23a0c7d179527cd58dd7a4ca37247c2bd9efc79b720bb1ee2d39862e98cb81e93cf5b48d5d02ee8ac737ab504c867a1c49e678300803c94fbe978dea918a1e71b9791ee1e4d30056e86c26a4670b451a13ece52a89a7057fe2052e11c6666eb916d823ea66bf217c320acba3b714910734b2d27c2fa586bd7f7664b0d1422adabad2ce2afc10270057f11940fac1a51d023ce48bd04ea39b7f99381b239fd0ddeea0dce7863ec1f8f61775013b6414ecf86e686a340a3148f87a9d7d60a1f2da53436d16fc88d6a4e7c3d55e0dd004cbecc15a5558eb705d82aacb1862ddc251dd5d9cbf1d78f97900ce6e8dab0ea678cb823bd1e7bbd1e927878c19f4f322228f9b36287fc13e7c1293ea875ae73815e052d6c2ebc40df8f7b9d1f76e0b10e35aa160944983d8e6b790df0d9b13f3460657336d81f7d83c0350324b930ec9c7557ce12887f76372e126f504b0980fea27f31a780c05187b9b5353dafc6b101543b24332b96e15bc26b19062e52fa9f86d260ee3a3bc92a133e328407bb85357ee5c45cb87228f44888b14941b5911b050e9319fe88033f830a8490917a9c0572ebbc5492b4e1083a2e3d77215a34abef947b5b9a950e780662de18873e55899c92db3ad3d437e8407890afa6b0c04ef861b8bc85fbbe1bb67b3d9ef001409f84b8ec4f01d861cecc143a805b981ab5cf5b605057b63cb2c84ec358e510a69cd8c33a8a62fe4680d0c980145cc709157832bfaef261cb0466c237376ca2944ce9affffd4b1dc7cc9511da0b34bffb9ac216fb8cf7c6572d95627787720d1ba67c6512fcdb16f6329e9668681c404efebad559f81f05971b5efb6b4cca97ad0346753cc0a40a877242d8a808c602b03dc962cee38e646cb18abb079c70d357c30738a70f55cd3c5956a83a1bfcd6649dd765f16bfe968066345df7380bbc0c16b3b5af513d6458c791343952f33a051c5d711c1f35af1b47f3db9bbfb5c7c636b3a2b52805d606479879be0b404a28ade5649a3185e0f85a85fc15cd824671c2befdd0da509597c87d869f0bd7ad163ad93ca28fc0c4025eccaafe385ec3fc06c54ebcd7b07b6c7e0197c5b9ef886159a1585ae45248f865be760db6f5bc8f868fc6aefd04e34ecb51159e4cdcc2214b42b1ca9caec13ba3e1b2e7a3c736977b226213d265c2873195122a9b448088c8b50edd549be41c38ab176807b75e7267f86e400000000000000000000000000000001df00", 0x1000}}, 0x1006) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "9001001c551265406c7f306003d8a0f4bd0000000300", [0x10, 0x4]}}) 5.501518653s ago: executing program 3 (id=4077): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) socket$inet6(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) socket$inet6(0xa, 0x80003, 0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6(0xa, 0x2, 0x0) syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000080)) socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x2, 0x300) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x88002, 0x0) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 5.179094311s ago: executing program 5 (id=4078): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000002840)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) socket(0x2a, 0x80000, 0x4) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xb}}, './cgroup.cpu/cgroup.procs\x00'}) ppoll(&(0x7f00000003c0), 0x0, &(0x7f0000000400)={0x0, 0x3938700}, &(0x7f0000000440)={[0x3ff]}, 0x8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20000080) 5.115259833s ago: executing program 3 (id=4079): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000009c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 4.237335365s ago: executing program 0 (id=4080): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000050000000900010073797a30000000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a300000000050000000060a010400000000000000000500000008000b400000000028000480240001800b0001007303006b6574000014000280080002400000001608000140000000030900010073797a30"], 0xc4}}, 0x0) 4.160194907s ago: executing program 5 (id=4081): syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x2, &(0x7f0000000000)=0x80000000000003) syz_open_procfs(0x0, &(0x7f0000000480)='fd/3\x00') fanotify_init(0x40, 0x101000) ioctl$TCSETS(0xffffffffffffffff, 0x5402, 0x0) wait4(r1, &(0x7f0000000100), 0x4, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r4, &(0x7f00000001c0)="5cba", 0x2) ioctl$SNDCTL_DSP_SYNC(r4, 0x5001, 0x0) 4.088531688s ago: executing program 3 (id=4082): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) r0 = fsopen(&(0x7f0000002200)='ramfs\x00', 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = getpgrp(0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x401) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x50) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) recvmmsg(0xffffffffffffffff, &(0x7f0000006800), 0x0, 0x141, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) 2.855457359s ago: executing program 5 (id=4083): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rxrpc(0x21, 0x2, 0x2) inotify_init1(0x80800) socket$unix(0x1, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x24018807) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 2.757082181s ago: executing program 0 (id=4084): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) fcntl$setstatus(r0, 0x4, 0x800) ioctl(r0, 0x8914, &(0x7f00000000c0)='lapb0\x00'/16) connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) 2.484754678s ago: executing program 1 (id=4085): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xfc}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x8, 0xfffffffc, 0x80, 0x2, 0x3, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x800006, 0x102, 0x1, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0xd, 0x1, 0x4, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8f, 0x7, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x81, 0x0, 0x2, 0x3, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x0, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bb, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x100, 0x2, 0x2f, 0xe, 0x312, 0xffffffff, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x0, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0x8, 0x2, 0x5f, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x1, 0x3, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0xb8, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x800001ef, 0x5, 0x8, 0x86, 0x3, 0x3038, 0x3e7, 0xb, 0x5, 0x4, 0x2, 0x7, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x8, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x8, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0x7, 0xa, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x4, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x7, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x15) r4 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r5 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r5, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x11}, @multicast1}}}, @ip_retopts={{0x18, 0x0, 0x7, {[@timestamp_prespec={0x44, 0x4, 0x4c, 0x3, 0x3}, @ra={0x94, 0x4, 0x1}]}}}], 0x38}, 0x200040c4) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000500)={'wlan1\x00'}) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)) socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r7, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3806}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @vti={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VTI_REMOTE={0x8, 0x5, @multicast1}]}}}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x40}}, 0x440b0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r3, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x34, r4, 0x1, 0x70bd26, 0x25dfdbfd, {{}, {@void, @void, @void}}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xff, 0x17}}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x8, 0x5}}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) 2.484205048s ago: executing program 0 (id=4086): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000002840)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) socket(0x2a, 0x80000, 0x4) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r2, {0xb}}, './cgroup.cpu/cgroup.procs\x00'}) ppoll(&(0x7f00000003c0), 0x0, &(0x7f0000000400)={0x0, 0x3938700}, &(0x7f0000000440)={[0x3ff]}, 0x8) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) bpf$ITER_CREATE(0xb, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8002, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, 0x0) 311.755443ms ago: executing program 0 (id=4087): r0 = syz_usb_connect$cdc_ncm(0x0, 0x7a, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') preadv(r2, &(0x7f0000000440)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff) sendto$inet(r2, 0x0, 0x0, 0x20004014, &(0x7f00000001c0)={0x2, 0x4e23, @private=0xa010101}, 0x10) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x20000000000002, 0x2) mkdir(&(0x7f0000000000)='proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='proc_dir\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='proc_dir/scsi/scsi\x00', 0x0, 0x0) 210.841255ms ago: executing program 1 (id=4088): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r4, 0x29, 0xd4, &(0x7f0000000040)=0x5, 0x4) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000840)={0x1c, r7, 0x1, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000023c0)=ANY=[@ANYBLOB="140000000109010100000000000000000200000144db601cd21922675950b5ae1e3fcbfbca072059e8f557310ae52b91f0023b159f9cc8601e7fe6be3b57344d937b7619c778c3f04160ee0045bea682fbc750042f0f4e7c2585a76f9b47aa7cb1764f930249c8070f5bb52e1653571fbc84488082"], 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0xc854) ioctl$VIDIOC_G_PARM(r0, 0xc0cc5615, &(0x7f0000000180)={0xa, @capture={0x0, 0x0, {0x2, 0x2}, 0x4, 0x9}}) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, 0x0) syz_open_dev$radio(&(0x7f0000000440), 0x1, 0x2) openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) io_uring_register$IORING_REGISTER_QUERY(0xffffffffffffffff, 0x23, &(0x7f0000002280)=[{&(0x7f0000000500)={0x0, &(0x7f0000000400)="331ce46322", 0x89cc9476c6b5ad1b, 0x5}, &(0x7f0000000540)="ceaa622ea2e4c4ff6cdb1e0d0626fa804b9b51c0a2f6c942908732b52ac8749582c78b3f5e804ca353dad17d1acaee716f28702c32b0de57a06ec3bd418871be1bebf72a6db859a3ec9ff97df76f75cf1c443b272b1d6e96c9e6a03526a076eabdc8500e55524017d9dc2e7ab98131df94209de1b9426598e7b498c445a6c6e8982e6c58af4fedc0cb8e26ba5fe08901aee1ba881c8df5248d33", 0x0, 0x9a}, {&(0x7f0000000b80)={&(0x7f0000000ac0)={0x0, &(0x7f00000009c0), 0x2}, 0x0, 0x1}, 0x0, 0x1}, {&(0x7f0000000dc0)={&(0x7f0000000c80)={0x0, &(0x7f0000000c00)="a5d1068a26a3fc04eea57b8993c7a8aa00b4532ac2a4a07f1a6811e8fba679416a670bc1f3c922173c034c03bfb161aff8fbc4d65316f0882df38dc92b13331315b11824fa01a9f000e2c02be2e91edb9d92ad92b21fb4fe", 0x3, 0x58}, &(0x7f0000000cc0)="85f9b734d91bdaf449a13f39be786a2639884459dd5c08c8f42298c9887a48064d91b5930b2e7c2591c25485fde27b2e0d30dfd9bb95db41a55ef43a55547778e58a7e802a6be88581c4646f84feb778cd2361c710ac527ecdc7cc12303ef73d025bb3d912abb577f4b3c0105b5b622218551b762727daadd615", 0x0, 0x7a}, &(0x7f0000000e00)="be82c7677c7033d2b6bbea4f75834aeddcf607d1680d364d8d4b42986e7e3d5a0b24641219ce55faaadadae73409f719ec9b8eb0e25439f7360ad84c65fb31e5ec01e734a480214503ca19ee38bcc528150caf56ef45e1b59fc410ace8be35146561b6137126effdcbc3477f95442ceca6d0", 0x0, 0x72}, {&(0x7f0000000fc0)={&(0x7f0000000f40)={0x0, &(0x7f0000000e80)="e2f70944dfe10e622d99323b46ac43c7b721cf19db1480e05a420eb9a8d535bacad6b7359689e5b327e02ef886cf09ff8ec94928b77d490c0234ade882fe56096c66193c68a0b97b87613525391fd7d6730df38e3c38daa2095214a0dcb86f6736530ae33b0c4d511d60d381fc56804641b593d064a0bbfd737f4d1481de64034a811498109b06683cdadb7b726563fd51fb4419ded36a0e14121a24ca074407", 0x1, 0xa0}, &(0x7f0000000f80)="7067d2ca2f04f3a59fb13a4bf97f46", 0x6, 0xf}, &(0x7f0000001000)="2d62980258e1000b3d1254edaba0050ce791cd8770a8484037c91d48c79a1ae3e305e0d1ca3a1b015cb4002d51d64fc27ac091bf28e85cf3e22d3d69c2d1d4890ba7cdfb57428e103a1bc94e8416da18be110c890e02ca3da66158636e558ac3f239cd266ff6172f64fbab94d57d23d038784a7a5fdebbd63b3a47d1ef96cb89331e4eea9f5bf2f824c83bc7b765457cce1927eccb0d33b9aa0ee0a36931ec2e9cc88dbebb9636deba9e017ec966ac4dcc52844af5e561681abce9ce9f92dd096386ae545043ed240b9a660458294d133d2cafa55539a5d1dd40289574dfd1d891a878c00d904bcb81f98eb2176c371c7a88ebbdafc09b5b7bb5de62a5ad373e844b6055b7cde5ed2fec444cb92920831464af264d9b796f897a6d60120fb31eda3c8c78624b8f7d4a2ee209e3564bfc381cfc17dba38681fd8e9aed2e390af3439c06958941d794afa75552767227c4cfed5c6cbf67ef76cf702f2eb03a2a4c3eae0ed84c55815f81d24eff34b0f956e54c99e109e80e72523445b9ef755f1bd97d582c89c20b55087680f314b64ded594cfa636b7fb63406de7010fc71301c3404afb1d17e3514e7a294b0ac68bfb677c57f0a08c8996a8ca22100d5d2d2126708ba2403716dc29d3ff608a57505ebfcf1c3e72ff24c3f38ab761f73bf60a01e2068bbf2a65606a45f3c7e16bb20876b610c187c0b04ca18967b6c171bb7b831129886c318fc7537f62843c6a3ff32829d2a34c0c6e2f70753b74c91c119ec919cdb671ba59f04a72acf046f837785e809417f1e02fccac943ae29e90cae27f2c0680afffda0cce8a1b180bdf04d2181e298e92b01ed78ec206b78a19178552668efb44dc0732c89235edbcfb54611dd0c367f809596b8299e1b159a4e93dc5bc51d641b24ea6a275362968f3e38d9db6b3c8014e5b6ee8245df43c5e9405994264751a6f990f150d02df427d689ef2d418dbeb39cbcdb7540060305372cb2ef45ecef011ff8fd663737f67df9a30b8ab1831a02bf47a8fde511e59f71ff38094bdc624222ea710873732e85b83b2fba450d34c9265f00148502a5af03eabc4ff820c8afb2eabe69191545d2c368830bb55d8e6c2580173220c4c7d5a3ac62b831f27a77adeaed926e570f76ded55619414130a0c1777c45d0bf44e3405b082d61ca4f1069cd7ec457f6c696202928afdd7d18ca9a581c82c604562ef42fd16de23750b611ee1c65316c25a2c1158db9d68f3d4fc730fca7f68370eb82d4214d6a8498ca1012e0e70ba8fe6be54acbf957ddf907a1a5e7f9c14090d09a327b75e100c6c2eb796596d89856b5edad1046f09307b996705f6180ffdd2e5123c89d3b19da1334fc3daec4403ab3ff8d11fe8827f5d70f914a32abf1276cdc147d89e2dd0cdd0e154f1e7ed9269cec5e598504af47e2f856f14f78846f9fb6d570336af7dfb2fe3b47a3a935af0e6fb96182cf032890491d76618a1aea17a5d5d08bc6da60ffdae81e5728286a3ddb8ea9547c18216dc4ec2299098dcaced67ff37782fd34d7f7c81cdb814ed6ff03c7c76a3a7a465b1434e5153fc30de14dd95a3a48644030c7108f13aa0acafa2d26b26f9717f8179809f6701c7dfee7bbaea629953daae2efccd72777faf3f36207bd2a8feaa29ac7dbdc249635920b1a0c3c8b6162dcf7a86e8e89aa42fd811dbbb45e0ecb2bc8af646686015139e82e42d47936a4e0c72dc3f983bf5bce93756301d4d3bb9a70aaed25dcc9d9da8847dce8d71cec4219c27ab89e94428066a4b6f0e8c662f2f193fc9895fec29e0fdc46f27fcd56564173e9a7c17d6dac4629a502b1c128aa7b6fdab188a9ad3be63a22a8a76ebe0448884783ae998097e3bbb15f810fe1dd204682e503680dc7db3d1498f530df5b435835f4960c3713830a06393984b6c65b36f8dca1de27fed9e9c017bf8b022af845d29dfe2a8496d04ad1e51097d6d066b1de42b0d772e06ea68fdfe361118ea501859b64c72bf3dcbc11c8e86bc5dd6b596b11a8e6bbde344e6b351ef5defa0c68469f331a5ccbb33442bb1a087a2c7750c4f0548e0170f2b0ef2997965f813db7ccc997f327f3fbfdbcfcaa0873f4a8f7296af0072f46516896b16b596c85ab828ad43185c845bfd212d540b416f4e4bfa9737adf25121a99202cd2e98c24de6bf992702d54788cbded8ce212d410ecb1d34b27c05a9cfd69f1433ecb9b3bde77ad8875c8e4613b744c2131ce649514dad3792e9fc0ed74f8383a425f1bbeeb3596a164dc8eaab43996999da478c1539a49856d1b7bd7c9587b39a3306369c5967e9b86d78d356d934b42e6c3b4937315bc342719159c3ca61a5caceaf8d6aa4ecf356bd842b0bbfd50e45bfc837f5392241ea5f292faca5bb0884ae69f9dd433764793f6bdbbe1fc15d66f993b390f404d5cdff7273e198d8f7d047f49aaf387e0d79b5f59fb9e18625fc0ae8e761946ad3ce514f10faea9a4e591e8b256e374cf50e2ebfa23a85925c14055fc074d865fae6a6617d45fcb0f9e37a2910d9c534d331ebddda630d64d7f3b9d1555d442d17f94c1673da6cf9266c387f39c3dafaa570b828fee12616ac617f9650ce5cc9d8a524ea26ca8175d243e1e117d578e93720d702027922be82100a5510d51e7ce2ca0267b9e86fa2c1667f3fbb9353d410a02dbc7c2006f5b2cfbcbdbdfd89f47074534127470903cf3b1a4c7fc1cba986bcda8b0f858ed069c6b8dc8191c2d34d39e78a01dedd09546143a57c7d78987bb2bdd051605d095ea0d00acfad3cd101725baf497a5a113d56172c3337fe1de4c86648df888ea729f15da50b05bd1ca90af0d3fc7a22ef846c1d23d34789fe212041108cecbc0718c5057c61eb04e8677379ec92e72148e44b61f50086f942692c9c732ca09a1872aa7b1cf085d6044a2c21f2ecf572000e4159a1e520ca10b6872bbb5623a62cb3c6e377b9b94671a9b5e3bc9e056a812d620837f108f70a0ce0f1b93623fbbed9ed85413f63d01020d5132833bc0b257bb0a8dca2f794a7a3e59f59e075b73870f283c04e76b098969cb5d77c52bf2b29af79707ba578528bdcf29954de8bdb26dc1153adbd7f033c70a8e9525f1912748fb874bb34fb3cf98b02d235557846a32eb8dfcab61200ef4d6a6b4cf6e800a381a70697291526897eeb3f0622af1e4f998150637493c1605659c00c99ea3471e8a0eb0fbfe2b073569f1befbc5f2125343445190c69cbe8804960bd3297c48bc72f0f49b522696196ef559aa2a87eafeddf2585f49bdf00589f0054b57981f8ba9f05cc2903d38df011b1bcce7b97fc093a4113899baddf17d63ca630cde485d25218e5e1064b8fc86595e72397b6a522c1c8bcd97ee1f0b3526eff32d4e5924416a61af498a3520cb2ed9b3120d3293581fe29e724ac90e00c13245d6edda4a961cd84196156094eb5b4b892696b8c9935da3ec86f40f7a0c72963d6545e1f08cd393926a6a6241382bb52750d9b228ed4d949d9b1ddf6fbf2bcba94f849ad126e64632e9a32b11cf9d69b43ecaad0503f54f4211d859adcb012761f266e4959d601222f1e2a7e4ae159559b7a43fb3ac5227cd2833fea6ae090fabcc5a39278e9a0b291a4d57e9650aac11a3be6655bc1feac868633ebcd3628cff4c3d5d4b70a126d8412709776917e98d36ca383566f9a1b8945acee8ed41e3bdfbdf004093d0d889d77ccce102853196237e6a99b5eb403fac97dcf09b5087d086c8c021717d25fb61bd80e8d267f1f895b57900d61072bf108e2cf840f9fd30d312f2472d7772ef3f7eb33ccab5246ca8a22a498211b86da9b1b1becfb43ba232386dd94d136e325d26c21f95a0d4d5f952e3ba449fc9d0946c78b474bb6675daa895bdb6b77d0de8155c39655d33271dd793c20d2acdb13b720cf76e476395a6f164a59c0ab0a6c83a9629d7604f101ea4d4a6abd73ce91325a9b172443b86eadfec3b3af8067681f8ccafd3d15e672f368d24b48b466d4a28422e9019d91b92aef781c626917b1bd0fb2c6fc4c4b6f03037f56176d86f14572d6e136ae087307de9c34317f4a0e39c9037d9ab3da8b00d334385e5609e259504d0780e585b136c3add89a986936543b04ae5f5fab25870c69d13cadc6fb852c30ad9d8b34991b44122f132d203fd496e2e145bc6e5ea52d385ec3eaf0ba91d6f319f9519314bf000506a106fc8d162ad38182e26751e9d8a99f5d9e005207c32f7458593022452762424a64f135ac98d43e34d6e78830c3beddd9956ef58b1235cfb97a20a15f82229dfe66c64c79b07f852bad1892b5fbaf8023ff7369bd7b4a29b6d9eb455009560793e69a6547667e2dc286b8b609d07da88cf95a29460688bda9f7baeebc908b30afabe3011753a12cbf9ce18e63fb4fa771669a354747ec62e9725b71cd4c6d4567499c952bb3cdc84a9c3972b703195166be51dd3e2423f40e9570903e934c2de910e7aeb7d7f69da251ffc1a7ac2f7fc7472eff6a4ff84ac72f447f0b5bc363f39a21e96c2ca2d21c265e914c9e9a71b92ea675ecb315c70f819c1c5ea936655c4c7878775ff72b6d12b3dafb58ab53bab4f1c5fad524988a0fead3ddebefc161bd542c3a064055f377d28b89d524d3597655fa287c1ce3de17d418b765469644f88966d0ceeed121f044bac4041a43a97531615795ad6ad8e5d04c19938080c7071545d5ef64a427042970639bad900430efd13cc2bdb9d439e4633f55abd9205dd7db7f099cde90ec799857e8c15ded8acf9a31d6da9592f8e750a4ae5500527bc31ddea9d56277da7435cf17a71ac925eadeffb6cae20bf2fae7618ab6c8e1ce266159f9116109f508740900de84e25fe58a32eab0f83b440b1ab11fb891e8ef08dbff1d16f487128e47727ab1ead17a9b676c430de97014a9667fd8c2dbf1032ce03ee020b08ada0c9cef92d184bb663ed1c8c4677800f2d3fa9ea93145ec23eb55f10f8383e8252561d037cd1c6f38a8e9586aa3edd12810eddf9bf447f079a63a810b6d52a03c768945efb41a7145b32b3dd3d8e832b514f3bac90ac", 0x1, 0xe00}, {&(0x7f00000021c0)={&(0x7f00000020c0)={0x0, &(0x7f0000002000)="803f1108685db86fef2acf048dee12eb98dac08e95b926d0cb044abc655a9f43d7310f3cd444c4c0dd7372c8f55cdb24c3814a9b0f49580aa75f9a50b60fe2a693e980", 0x0, 0x43}, &(0x7f0000002100)="935ab67a62495a6d2c059ca244fcebc55e539c9cb5be400ff8b4c2a2bcd959a6aeabf57888285ebecca31927d528384cbf46558e82e640467ef0d1bfd1b013ca2f81384079d8cf1886b882b3bd8db5cba30443176628948850be60b0de2ad44a4019d07f67ba8b2fb4b0913a8635c5a766c0e1fd27088d05180febb91474dad58b13c096438ce96b39b7c7546610c67010d5a77fcd28639240ca13856470af7d", 0x2, 0xa0}, &(0x7f0000002200)="4df5952474a974b5c48b35a2c69f57b50a08783277cd2ddd144361096be5efeff7c7bae58f730cfbf407bed9d479d505532247a423d87688199198310fcf86666c09c658dfc2b1faa249728581285232518918655ddc4d02d4912fcec6b06673ec9190ef1b13aa1977597889c6444baacd7ff38d23074aad", 0x2, 0x78}], 0x0) mount$9p_unix(&(0x7f0000000300)='./cgroup\x00', &(0x7f0000000340)='./cgroup\x00', &(0x7f0000000380), 0x40020, &(0x7f00000003c0)=ANY=[@ANYBLOB="5b72cd00"]) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, &(0x7f0000000280)={0x9a, 0x5, 0x68, 0x1, 0x408}) ioctl$VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000100)=@mmap={0x7, 0xa, 0x4, 0x400, 0x5, {0x0, 0xea60}, {0x5, 0x9, 0x7, 0x60, 0x9, 0x7, "de056a52"}, 0x4, 0x1, {}, 0x3ff}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40400d1}, 0xc000) 0s ago: executing program 3 (id=4089): r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB(r1, 0xc01c64ae, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x20}) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r0, 0xc040564b, &(0x7f0000000080)={0x80000001, 0x0, 0x3009, 0x7fffffff, 0x7, {0x8, 0x401}, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x6}, 0x6e) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r5, 0x0, 0x0) setitimer(0x2, 0x0, 0x0) setitimer(0x2, 0x0, 0x0) r6 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, 0x0, 0x0) fcntl$setsig(r0, 0xa, 0x10) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000680), r7) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(r7, &(0x7f00000028c0)={0x0, 0xd00, &(0x7f0000002880)={&(0x7f0000002840)={0x14, r8, 0xf01, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20008804}, 0x0) kernel console output (not intermixed with test programs): _hwframe+0x68/0xd2 [ 1343.458578][T16551] RIP: 0033:0x7f123879e0d9 [ 1343.463085][T16551] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1343.482787][T16551] RSP: 002b:00007f12365f4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 1343.491312][T16551] RAX: ffffffffffffffda RBX: 00007f1238a26270 RCX: 00007f123879e0d9 [ 1343.499317][T16551] RDX: 0000000000000010 RSI: 0000200000000100 RDI: 0000000000000003 [ 1343.507317][T16551] RBP: 00007f1238835024 R08: 0000000000000000 R09: 0000000000000000 [ 1343.515321][T16551] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1343.523326][T16551] R13: 00007f1238a26308 R14: 00007f1238a26270 R15: 00007ffd272e6248 [ 1343.531350][T16551] [ 1343.618521][T16551] Mem-Info: [ 1343.631804][T16551] active_anon:19598 inactive_anon:0 isolated_anon:0 [ 1343.631804][T16551] active_file:18050 inactive_file:40474 isolated_file:0 [ 1343.631804][T16551] unevictable:768 dirty:129 writeback:0 [ 1343.631804][T16551] slab_reclaimable:11616 slab_unreclaimable:92680 [ 1343.631804][T16551] mapped:28279 shmem:14466 pagetables:585 [ 1343.631804][T16551] sec_pagetables:0 bounce:0 [ 1343.631804][T16551] kernel_misc_reclaimable:0 [ 1343.631804][T16551] free:1315536 free_pcp:13424 free_cma:0 [ 1343.756908][T16551] Node 0 active_anon:79192kB inactive_anon:0kB active_file:72164kB inactive_file:161696kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:113996kB dirty:516kB writeback:0kB shmem:56328kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10796kB pagetables:2340kB sec_pagetables:0kB all_unreclaimable? no [ 1343.885950][T16551] Node 1 active_anon:0kB inactive_anon:0kB active_file:36kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:20kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1344.250627][T16551] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1344.291903][T16551] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 1344.297890][T16551] Node 0 DMA32 free:1361492kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:74728kB inactive_anon:0kB active_file:72164kB inactive_file:160876kB unevictable:1536kB writepending:516kB present:3129332kB managed:2586840kB mlocked:0kB bounce:0kB free_pcp:17140kB local_pcp:16240kB free_cma:0kB [ 1344.328598][T16551] lowmem_reserve[]: 0 0 0 0 0 [ 1344.333382][T16551] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:820kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:0kB free_cma:0kB [ 1344.376056][T16551] lowmem_reserve[]: 0 0 0 0 0 [ 1344.380856][T16551] Node 1 Normal free:3908700kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:36kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:12260kB local_pcp:3232kB free_cma:0kB [ 1344.435818][T16551] lowmem_reserve[]: 0 0 0 0 0 [ 1344.440619][T16551] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1344.465870][T16551] Node 0 DMA32: 333*4kB (UME) 524*8kB (UME) 906*16kB (UME) 937*32kB (UME) 405*64kB (UME) 80*128kB (UME) 44*256kB (UM) 15*512kB (UME) 29*1024kB (UME) 19*2048kB (M) 290*4096kB (M) = 1361556kB [ 1344.505863][T16551] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1344.525930][T16551] Node 1 Normal: 211*4kB (UE) 44*8kB (UME) 33*16kB (UME) 221*32kB (UE) 60*64kB (UE) 8*128kB (UME) 3*256kB (U) 2*512kB (ME) 2*1024kB (UE) 2*2048kB (UE) 949*4096kB (M) = 3908700kB [ 1344.565830][T16551] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1344.575440][T16551] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 1344.595817][T16551] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1344.605423][T16551] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 1344.635790][T16551] 62767 total pagecache pages [ 1344.646135][T16551] 0 pages in swap cache [ 1344.650349][T16551] Free swap = 124416kB [ 1344.664771][T16551] Total swap = 124996kB [ 1344.669263][T16551] 2097051 pages RAM [ 1344.673090][T16551] 0 pages HighMem/MovableOnly [ 1344.685814][T16551] 416955 pages reserved [ 1344.696013][T16551] 0 pages cma reserved [ 1345.362970][T16558] tipc: Started in network mode [ 1345.368133][T16558] tipc: Node identity 4, cluster identity 4711 [ 1345.374367][T16558] tipc: Node number set to 4 [ 1348.147696][T16596] Bluetooth: hci0: invalid length 0, exp 2 for type 23 [ 1353.931813][T16662] kAFS: Can only specify source 'none' with -o dyn [ 1353.998761][T16664] input: syz1 as /devices/virtual/input/input11 [ 1356.451230][T15875] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1356.462246][T15875] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1357.342128][T15875] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1357.397837][T15875] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1357.405617][T15875] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1357.417300][T15875] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1358.809846][T16688] chnl_net:caif_netlink_parms(): no params data found [ 1359.695249][T15875] Bluetooth: hci1: command tx timeout [ 1359.822189][T16688] bridge0: port 1(bridge_slave_0) entered blocking state [ 1359.830200][T16688] bridge0: port 1(bridge_slave_0) entered disabled state [ 1359.838226][T16688] bridge_slave_0: entered allmulticast mode [ 1359.851015][T16688] bridge_slave_0: entered promiscuous mode [ 1359.867015][T16688] bridge0: port 2(bridge_slave_1) entered blocking state [ 1359.875128][T16688] bridge0: port 2(bridge_slave_1) entered disabled state [ 1359.882565][T16688] bridge_slave_1: entered allmulticast mode [ 1359.895830][T16688] bridge_slave_1: entered promiscuous mode [ 1360.722638][T16688] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1360.744921][T16732] comedi comedi3: aio_iiro_16: I/O port conflict (0x100,8) [ 1360.763115][T16688] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1360.837838][T16688] team0: Port device team_slave_0 added [ 1360.889710][T16688] team0: Port device team_slave_1 added [ 1360.969499][T16688] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1360.985900][T16688] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1361.032790][T16688] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1361.047349][T16688] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1361.054372][T16688] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1361.127742][T16688] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1361.187295][T16688] hsr_slave_0: entered promiscuous mode [ 1361.780526][T15875] Bluetooth: hci1: command tx timeout [ 1361.816005][T16688] hsr_slave_1: entered promiscuous mode [ 1361.832892][T16688] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1361.852784][T16688] Cannot create hsr debugfs directory [ 1361.877030][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.883399][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1363.644500][T16688] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1363.682820][T16688] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1363.920373][T15875] Bluetooth: hci1: command tx timeout [ 1364.395630][T16688] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1364.425126][T16688] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1364.538648][T16688] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1364.565795][T16688] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1364.861576][T16688] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1364.900229][T16688] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1365.765348][T16688] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1365.927098][T16688] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1365.961876][T15875] Bluetooth: hci1: command tx timeout [ 1365.965903][T16688] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1366.021260][T16688] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1366.838579][T16688] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1366.895836][T16785] tipc: Started in network mode [ 1366.900817][T16785] tipc: Node identity 4, cluster identity 4711 [ 1366.907259][T16785] tipc: Node number set to 4 [ 1367.774300][T16688] 8021q: adding VLAN 0 to HW filter on device team0 [ 1367.817686][T16097] bridge0: port 1(bridge_slave_0) entered blocking state [ 1367.824861][T16097] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1367.852381][ T9179] bridge0: port 2(bridge_slave_1) entered blocking state [ 1367.859612][ T9179] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1367.880588][T16790] kAFS: Can only specify source 'none' with -o dyn [ 1368.030898][T16791] input: syz1 as /devices/virtual/input/input12 [ 1368.486834][T16688] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1369.080704][T16817] comedi comedi3: aio_iiro_16: I/O port conflict (0x100,8) [ 1369.835298][T16822] kAFS: Can only specify source 'none' with -o dyn [ 1369.951004][T16827] input: syz1 as /devices/virtual/input/input13 [ 1370.074630][T16688] veth0_vlan: entered promiscuous mode [ 1370.162065][T16688] veth1_vlan: entered promiscuous mode [ 1370.303078][T16688] veth0_macvtap: entered promiscuous mode [ 1370.347778][T16688] veth1_macvtap: entered promiscuous mode [ 1370.366492][T16688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1370.377349][T16688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1370.387734][T16688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1370.420611][T16688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1370.445860][T16688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1370.465748][T16688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1370.475625][T16688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1370.525783][T16688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1370.558024][T16688] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1370.591467][T16688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1370.613953][T16688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1370.638192][T16688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1370.654581][T16688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1370.681100][T16688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1370.701064][T16688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1370.742379][T16688] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1370.758729][T16688] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1370.775787][T16688] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1370.784601][T16688] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1370.805766][T16688] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1370.998545][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1371.034533][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1371.085261][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1371.098893][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1380.970145][T16901] vlan2: entered allmulticast mode [ 1380.975311][T16901] veth0_vlan: entered allmulticast mode [ 1385.313220][T16943] __nla_validate_parse: 62 callbacks suppressed [ 1385.313266][T16943] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3110'. [ 1392.666838][T16995] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 1392.673860][T16995] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1392.691650][T16995] vhci_hcd vhci_hcd.0: Device attached [ 1392.741765][T17006] vhci_hcd vhci_hcd.0: pdev(0) rhport(2) sockfd(9) [ 1392.748339][T17006] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1392.760818][T17003] vhci_hcd vhci_hcd.0: pdev(0) rhport(1) sockfd(6) [ 1392.767353][T17003] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1392.775174][T17003] vhci_hcd vhci_hcd.0: Device attached [ 1392.912098][T17006] vhci_hcd vhci_hcd.0: Device attached [ 1392.974183][T17007] vhci_hcd: connection closed [ 1392.976552][ T27] usb 33-1: new high-speed USB device number 2 using vhci_hcd [ 1392.999165][T17005] vhci_hcd: connection closed [ 1392.999245][T16996] vhci_hcd: connection reset by peer [ 1393.000494][ T9253] vhci_hcd: stop threads [ 1393.028802][ T9253] vhci_hcd: release socket [ 1393.036257][ T9253] vhci_hcd: disconnect device [ 1393.059232][ T9253] vhci_hcd: stop threads [ 1393.085898][ T9253] vhci_hcd: release socket [ 1393.095291][ T9253] vhci_hcd: disconnect device [ 1393.107150][ T9253] vhci_hcd: stop threads [ 1393.111526][ T9253] vhci_hcd: release socket [ 1393.125814][ T9253] vhci_hcd: disconnect device [ 1397.095961][T17036] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1398.106572][ T27] vhci_hcd: vhci_device speed not set [ 1402.779105][T17106] sg_write: data in/out 896512/136 bytes for SCSI command 0x0-- guessing data in; [ 1402.779105][T17106] program syz.1.3161 not setting count and/or reply_len properly [ 1406.046255][T17142] sch_tbf: burst 0 is lower than device gretap0 mtu (1476) ! [ 1406.281391][T15978] usb 5-1: new full-speed USB device number 9 using dummy_hcd [ 1406.531728][T15978] usb 5-1: not running at top speed; connect to a high speed hub [ 1407.092622][T15978] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1407.140933][T15978] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 1407.191991][T15978] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1407.234733][T15978] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 1407.256647][T15978] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 81 [ 1407.276312][T15978] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 1 [ 1407.293764][T15978] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 84 [ 1407.322028][T15978] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 2 [ 1407.375908][T15978] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 1407.433649][T15978] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 88 [ 1407.463167][T15978] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 1407.505607][T15978] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 1408.841136][ T27] usb 5-1: USB disconnect, device number 9 [ 1408.886829][ T27] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 1408.946620][ T27] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 1409.004951][ T27] keyspan 5-1:1.0: device disconnected [ 1409.717852][T17178] sch_tbf: burst 0 is lower than device gretap0 mtu (1476) ! [ 1416.167351][T17222] sch_tbf: burst 0 is lower than device gretap0 mtu (1476) ! [ 1423.576680][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.583161][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1431.049416][T17328] Bluetooth: hci0: unsupported parameter 255 [ 1431.076207][T17328] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 1431.215835][T17330] sg_write: data in/out 241152/136 bytes for SCSI command 0x0-- guessing data in; [ 1431.215835][T17330] program syz.1.3234 not setting count and/or reply_len properly [ 1435.893263][T17378] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3248'. [ 1441.571984][T17414] Bluetooth: hci0: invalid length 0, exp 2 for type 7 [ 1442.226786][T17424] kAFS: Can only specify source 'none' with -o dyn [ 1442.367574][T17425] input: syz1 as /devices/virtual/input/input14 [ 1443.841168][T17444] Bluetooth: hci0: invalid length 0, exp 2 for type 7 [ 1448.520850][T17478] Bluetooth: hci0: invalid length 0, exp 2 for type 7 [ 1455.336856][T17524] Bluetooth: hci0: invalid length 0, exp 2 for type 7 [ 1457.829378][T17539] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1458.296133][T15875] Bluetooth: hci3: ACL packet for unknown connection handle 3439 [ 1460.784021][T17558] Bluetooth: hci0: invalid length 0, exp 2 for type 7 [ 1462.706550][T17570] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1463.725308][T15875] Bluetooth: hci2: ACL packet for unknown connection handle 3439 [ 1464.756673][T17593] Bluetooth: hci0: invalid length 0, exp 2 for type 7 [ 1464.898050][T17599] sg_write: data in/out 830976/136 bytes for SCSI command 0x0-- guessing data in; [ 1464.898050][T17599] program syz.1.3307 not setting count and/or reply_len properly [ 1465.599124][T17605] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1466.678188][ T5788] Bluetooth: hci2: ACL packet for unknown connection handle 3439 [ 1468.140787][T17627] Bluetooth: hci0: invalid length 0, exp 2 for type 7 [ 1469.063317][T17639] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1469.926022][ T5788] Bluetooth: hci2: ACL packet for unknown connection handle 3439 [ 1471.111313][T17662] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1471.298977][T17662] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1471.493216][T17666] Bluetooth: hci0: invalid length 0, exp 2 for type 7 [ 1474.632855][T17691] netlink: 'syz.0.3345': attribute type 16 has an invalid length. [ 1474.672989][T17691] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1476.819294][T17705] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1477.004931][ T5788] Bluetooth: hci3: ACL packet for unknown connection handle 3439 [ 1479.896593][T17738] 9pnet_virtio: no channels available for device syz [ 1482.859469][ T5788] Bluetooth: hci1: command 0x0406 tx timeout [ 1484.545068][T15875] Bluetooth: hci2: ACL packet for unknown connection handle 3439 [ 1484.842948][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.850701][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1488.732244][T15978] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 1488.773615][T15978] hid-generic 0000:0000:0000.000A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1489.004434][T17781] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1490.571267][T15875] Bluetooth: hci2: ACL packet for unknown connection handle 3439 [ 1495.149320][T17814] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1497.341072][T17823] hpfs: Bad magic ... probably not HPFS [ 1497.364330][T17823] hpfs: Bad magic ... probably not HPFS [ 1498.209752][T15875] Bluetooth: hci2: ACL packet for unknown connection handle 3439 [ 1501.276044][T17858] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1501.940434][T17866] kAFS: Can only specify source 'none' with -o dyn [ 1501.948916][T17866] input: syz1 as /devices/virtual/input/input15 [ 1502.932356][T15875] Bluetooth: hci2: ACL packet for unknown connection handle 3439 [ 1503.058516][T17873] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1504.978779][T17882] sg_write: data in/out 830976/136 bytes for SCSI command 0x0-- guessing data in; [ 1504.978779][T17882] program syz.4.3394 not setting count and/or reply_len properly [ 1506.395826][ T172] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1507.298401][ T172] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 1507.335675][ T172] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1507.381178][ T172] usb 4-1: config 220 has no interface number 2 [ 1507.420715][ T172] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1507.482526][ T172] usb 4-1: config 220 interface 0 has no altsetting 0 [ 1507.510026][ T172] usb 4-1: config 220 interface 76 has no altsetting 0 [ 1507.531473][ T172] usb 4-1: config 220 interface 1 has no altsetting 0 [ 1507.590669][ T172] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1507.610773][ T172] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1507.645733][ T172] usb 4-1: Product: syz [ 1507.670904][ T172] usb 4-1: Manufacturer: syz [ 1507.698289][ T172] usb 4-1: SerialNumber: syz [ 1507.970519][ T172] usb 4-1: Found UVC 7.01 device syz (8086:0b07) [ 1508.005866][ T172] usb 4-1: No valid video chain found. [ 1508.036337][ T172] usb 4-1: selecting invalid altsetting 0 [ 1508.207304][ T172] usb 4-1: selecting invalid altsetting 0 [ 1508.918637][ T172] usbtest: probe of 4-1:220.1 failed with error -22 [ 1508.928872][T17904] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1508.993599][ T172] usb 4-1: USB disconnect, device number 11 [ 1509.077092][T15875] Bluetooth: hci2: ACL packet for unknown connection handle 3439 [ 1510.209562][T17915] sg_write: data in/out 830976/136 bytes for SCSI command 0x0-- guessing data in; [ 1510.209562][T17915] program syz.1.3404 not setting count and/or reply_len properly [ 1514.028609][T17933] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1516.119926][T17951] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1516.423396][T15875] Bluetooth: hci1: ACL packet for unknown connection handle 3439 [ 1517.493622][T17963] sg_write: data in/out 830976/136 bytes for SCSI command 0x0-- guessing data in; [ 1517.493622][T17963] program syz.3.3414 not setting count and/or reply_len properly [ 1520.342565][T15875] Bluetooth: hci3: ACL packet for unknown connection handle 3439 [ 1523.093057][T18010] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1525.034906][T15875] Bluetooth: hci2: ACL packet for unknown connection handle 3439 [ 1526.160855][T18039] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1526.755358][T18053] sg_write: data in/out 830976/136 bytes for SCSI command 0x0-- guessing data in; [ 1526.755358][T18053] program syz.1.3429 not setting count and/or reply_len properly [ 1527.624379][T18057] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 1529.569438][T15875] Bluetooth: hci0: ACL packet for unknown connection handle 3439 [ 1533.435770][T18093] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1534.801047][T18107] sg_write: data in/out 830976/136 bytes for SCSI command 0x0-- guessing data in; [ 1534.801047][T18107] program syz.4.3452 not setting count and/or reply_len properly [ 1536.363323][ T5788] Bluetooth: hci2: ACL packet for unknown connection handle 3439 [ 1538.245811][T18138] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3465'. [ 1538.274875][T18137] nbd0: detected capacity change from 0 to 63 [ 1538.435762][T18142] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3466'. [ 1538.473522][T18138] FAULT_INJECTION: forcing a failure. [ 1538.473522][T18138] name fail_futex, interval 1, probability 0, space 0, times 1 [ 1538.496569][T18141] nbd1: detected capacity change from 0 to 63 [ 1538.515872][T18138] CPU: 1 PID: 18138 Comm: syz.3.3465 Not tainted syzkaller #0 [ 1538.523406][T18138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1538.533506][T18138] Call Trace: [ 1538.536821][T18138] [ 1538.539795][T18138] dump_stack_lvl+0x18c/0x250 [ 1538.544529][T18138] ? show_regs_print_info+0x20/0x20 [ 1538.549764][T18138] ? load_image+0x420/0x420 [ 1538.554340][T18138] ? rcu_is_watching+0x15/0xb0 [ 1538.559144][T18138] ? min_deadline_cb_rotate+0x150/0x150 [ 1538.564773][T18138] should_fail_ex+0x394/0x4c0 [ 1538.569546][T18138] get_futex_key+0x136/0x1030 [ 1538.574260][T18138] ? futex_setup_timer+0xc0/0xc0 [ 1538.579208][T18138] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1538.585227][T18138] ? __lock_acquire+0x7d80/0x7d80 [ 1538.590300][T18138] ? lock_chain_count+0x20/0x20 [ 1538.595242][T18138] futex_wait_setup+0xbc/0x270 [ 1538.600051][T18138] ? futex_wait_multiple+0x920/0x920 [ 1538.605427][T18138] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1538.611422][T18138] ? _raw_spin_unlock+0x40/0x40 [ 1538.616326][T18138] futex_wait+0x1bc/0x5c0 [ 1538.620776][T18138] ? futex_wait_setup+0x270/0x270 [ 1538.625847][T18138] ? file_end_write+0x159/0x250 [ 1538.630747][T18138] ? vfs_write+0x5de/0x9a0 [ 1538.635200][T18138] do_futex+0x2ff/0x3e0 [ 1538.639392][T18138] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1538.645333][T18138] __se_sys_futex+0x3a9/0x440 [ 1538.650050][T18138] ? __x64_sys_futex+0xf0/0xf0 [ 1538.654854][T18138] ? __x64_sys_futex+0x21/0xf0 [ 1538.659664][T18138] do_syscall_64+0x55/0xb0 [ 1538.664175][T18138] ? clear_bhb_loop+0x40/0x90 [ 1538.669030][T18138] ? clear_bhb_loop+0x40/0x90 [ 1538.673750][T18138] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1538.677030][T18142] FAULT_INJECTION: forcing a failure. [ 1538.677030][T18142] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 1538.679658][T18138] RIP: 0033:0x7f535579e0d9 [ 1538.697120][T18138] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1538.716765][T18138] RSP: 002b:00007f53565a80e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1538.725217][T18138] RAX: ffffffffffffffda RBX: 00007f5355a26098 RCX: 00007f535579e0d9 [ 1538.733342][T18138] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f5355a26098 [ 1538.741415][T18138] RBP: 00007f5355a26090 R08: 0000000000000000 R09: 0000000000000000 [ 1538.749434][T18138] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1538.757441][T18138] R13: 00007f5355a26128 R14: 00007ffcc854c510 R15: 00007ffcc854c5f8 [ 1538.765483][T18138] [ 1538.769766][T18142] CPU: 1 PID: 18142 Comm: syz.0.3466 Not tainted syzkaller #0 [ 1538.777283][T18142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1538.787376][T18142] Call Trace: [ 1538.790685][T18142] [ 1538.793635][T18142] dump_stack_lvl+0x18c/0x250 [ 1538.798352][T18142] ? show_regs_print_info+0x20/0x20 [ 1538.803599][T18142] ? load_image+0x420/0x420 [ 1538.808146][T18142] ? __might_fault+0xaa/0x120 [ 1538.812855][T18142] ? __lock_acquire+0x7d80/0x7d80 [ 1538.817918][T18142] should_fail_ex+0x394/0x4c0 [ 1538.822674][T18142] _copy_from_user+0x2f/0xe0 [ 1538.827335][T18142] __sys_bpf+0x23e/0x890 [ 1538.831661][T18142] ? bpf_link_show_fdinfo+0x390/0x390 [ 1538.837084][T18142] ? lock_chain_count+0x20/0x20 [ 1538.841982][T18142] __x64_sys_bpf+0x7c/0x90 [ 1538.846440][T18142] do_syscall_64+0x55/0xb0 [ 1538.850898][T18142] ? clear_bhb_loop+0x40/0x90 [ 1538.855610][T18142] ? clear_bhb_loop+0x40/0x90 [ 1538.860332][T18142] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1538.866257][T18142] RIP: 0033:0x7f7fb219e0d9 [ 1538.870792][T18142] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1538.890426][T18142] RSP: 002b:00007f7fb3085028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1538.898846][T18142] RAX: ffffffffffffffda RBX: 00007f7fb2426090 RCX: 00007f7fb219e0d9 [ 1538.906819][T18142] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 1538.914790][T18142] RBP: 00007f7fb2235024 R08: 0000000000000000 R09: 0000000000000000 [ 1538.922764][T18142] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1538.930750][T18142] R13: 00007f7fb2426128 R14: 00007f7fb2426090 R15: 00007ffc89b375e8 [ 1538.938739][T18142] [ 1538.965293][ T5788] block nbd0: Receive control failed (result -104) [ 1539.938290][T15875] block nbd1: Receive control failed (result -104) [ 1540.416119][T18161] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1541.385821][T15875] Bluetooth: hci2: ACL packet for unknown connection handle 3439 [ 1546.190722][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.285851][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1546.485970][T18201] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1547.312178][T18210] Bluetooth: hci0: unsupported parameter 255 [ 1548.550128][T18210] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 1550.322326][T18228] sg_write: data in/out 830976/136 bytes for SCSI command 0x0-- guessing data in; [ 1550.322326][T18228] program syz.1.3489 not setting count and/or reply_len properly [ 1553.036498][T18241] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1553.332891][T18245] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1554.837055][T18251] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1556.481959][T18262] nbd2: detected capacity change from 0 to 63 [ 1556.510013][T18267] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3502'. [ 1556.606726][T18267] FAULT_INJECTION: forcing a failure. [ 1556.606726][T18267] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1557.934584][T18267] CPU: 0 PID: 18267 Comm: syz.0.3502 Not tainted syzkaller #0 [ 1557.942118][T18267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1557.952182][T18267] Call Trace: [ 1557.955461][T18267] [ 1557.958386][T18267] dump_stack_lvl+0x18c/0x250 [ 1557.963070][T18267] ? show_regs_print_info+0x20/0x20 [ 1557.968275][T18267] ? load_image+0x420/0x420 [ 1557.972797][T18267] ? min_deadline_cb_rotate+0x150/0x150 [ 1557.978352][T18267] should_fail_ex+0x394/0x4c0 [ 1557.983038][T18267] get_futex_key+0x136/0x1030 [ 1557.987727][T18267] ? futex_setup_timer+0xc0/0xc0 [ 1557.992664][T18267] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1557.998649][T18267] ? __lock_acquire+0x7d80/0x7d80 [ 1558.003679][T18267] ? lock_chain_count+0x20/0x20 [ 1558.008531][T18267] futex_wait_setup+0xbc/0x270 [ 1558.013300][T18267] ? futex_wait_multiple+0x920/0x920 [ 1558.018583][T18267] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1558.025435][T18267] ? _raw_spin_unlock+0x40/0x40 [ 1558.030290][T18267] futex_wait+0x1bc/0x5c0 [ 1558.034624][T18267] ? futex_wait_setup+0x270/0x270 [ 1558.039659][T18267] ? file_end_write+0x159/0x250 [ 1558.044512][T18267] ? vfs_write+0x5de/0x9a0 [ 1558.048934][T18267] do_futex+0x2ff/0x3e0 [ 1558.053089][T18267] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1558.058985][T18267] __se_sys_futex+0x3a9/0x440 [ 1558.063664][T18267] ? __x64_sys_futex+0xf0/0xf0 [ 1558.068441][T18267] ? __x64_sys_futex+0x21/0xf0 [ 1558.073203][T18267] do_syscall_64+0x55/0xb0 [ 1558.077624][T18267] ? clear_bhb_loop+0x40/0x90 [ 1558.082297][T18267] ? clear_bhb_loop+0x40/0x90 [ 1558.086973][T18267] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1558.092868][T18267] RIP: 0033:0x7f7fb219e0d9 [ 1558.097290][T18267] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1558.116902][T18267] RSP: 002b:00007f7fb30850e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1558.125319][T18267] RAX: ffffffffffffffda RBX: 00007f7fb2426098 RCX: 00007f7fb219e0d9 [ 1558.133291][T18267] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f7fb2426098 [ 1558.141270][T18267] RBP: 00007f7fb2426090 R08: 0000000000000000 R09: 0000000000000000 [ 1558.149264][T18267] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1558.157242][T18267] R13: 00007f7fb2426128 R14: 00007ffc89b37500 R15: 00007ffc89b375e8 [ 1558.165218][T18267] [ 1558.292976][ T5788] block nbd2: Receive control failed (result -104) [ 1558.498536][T18278] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1558.861674][T18284] Bluetooth: hci0: invalid length 0, exp 2 for type 9 [ 1561.365866][T18297] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1564.236872][T18311] nbd3: detected capacity change from 0 to 63 [ 1564.269991][T18311] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3517'. [ 1565.619844][T18313] FAULT_INJECTION: forcing a failure. [ 1565.619844][T18313] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1565.690280][T18313] CPU: 0 PID: 18313 Comm: syz.4.3517 Not tainted syzkaller #0 [ 1565.697810][T18313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1565.707896][T18313] Call Trace: [ 1565.711208][T18313] [ 1565.714164][T18313] dump_stack_lvl+0x18c/0x250 [ 1565.718873][T18313] ? show_regs_print_info+0x20/0x20 [ 1565.724097][T18313] ? load_image+0x420/0x420 [ 1565.728646][T18313] ? min_deadline_cb_rotate+0x150/0x150 [ 1565.734227][T18313] should_fail_ex+0x394/0x4c0 [ 1565.738937][T18313] get_futex_key+0x136/0x1030 [ 1565.743657][T18313] ? futex_setup_timer+0xc0/0xc0 [ 1565.748626][T18313] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1565.754639][T18313] ? __lock_acquire+0x7d80/0x7d80 [ 1565.759685][T18313] ? lock_chain_count+0x20/0x20 [ 1565.764537][T18313] futex_wait_setup+0xbc/0x270 [ 1565.769303][T18313] ? futex_wait_multiple+0x920/0x920 [ 1565.774599][T18313] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1565.780515][T18313] ? _raw_spin_unlock+0x40/0x40 [ 1565.785393][T18313] futex_wait+0x1bc/0x5c0 [ 1565.789731][T18313] ? futex_wait_setup+0x270/0x270 [ 1565.794771][T18313] ? file_end_write+0x159/0x250 [ 1565.799631][T18313] ? vfs_write+0x5de/0x9a0 [ 1565.804055][T18313] do_futex+0x2ff/0x3e0 [ 1565.808219][T18313] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1565.814118][T18313] __se_sys_futex+0x3a9/0x440 [ 1565.818802][T18313] ? __x64_sys_futex+0xf0/0xf0 [ 1565.823570][T18313] ? __x64_sys_futex+0x21/0xf0 [ 1565.828334][T18313] do_syscall_64+0x55/0xb0 [ 1565.832750][T18313] ? clear_bhb_loop+0x40/0x90 [ 1565.837436][T18313] ? clear_bhb_loop+0x40/0x90 [ 1565.842114][T18313] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1565.848006][T18313] RIP: 0033:0x7f4fadb9e0d9 [ 1565.852422][T18313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1565.872033][T18313] RSP: 002b:00007f4fae9940e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1565.880451][T18313] RAX: ffffffffffffffda RBX: 00007f4fade26098 RCX: 00007f4fadb9e0d9 [ 1565.888432][T18313] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f4fade26098 [ 1565.896403][T18313] RBP: 00007f4fade26090 R08: 0000000000000000 R09: 0000000000000000 [ 1565.904550][T18313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1565.912544][T18313] R13: 00007f4fade26128 R14: 00007ffe89742be0 R15: 00007ffe89742cc8 [ 1565.920527][T18313] [ 1565.954284][ T5788] block nbd3: Receive control failed (result -104) [ 1567.860676][T18335] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1568.591534][T16474] block nbd1: Possible stuck request ffff8880222e8000: control (read@0,1024B). Runtime 30 seconds [ 1568.604705][T16474] block nbd1: Possible stuck request ffff8880222e8200: control (read@1024,3072B). Runtime 30 seconds [ 1568.616218][ T8333] block nbd0: Possible stuck request ffff8880222b8000: control (read@0,1024B). Runtime 30 seconds [ 1568.627424][ T8333] block nbd0: Possible stuck request ffff8880222b8200: control (read@1024,3072B). Runtime 30 seconds [ 1568.746494][T18341] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1570.406832][T18348] nbd4: detected capacity change from 0 to 63 [ 1570.456299][T18348] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3529'. [ 1571.413455][ T5788] block nbd4: Receive control failed (result -104) [ 1573.505240][T18369] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1574.051654][T18391] input: syz1 as /devices/virtual/input/input16 [ 1577.368840][T18427] kAFS: Can only specify source 'none' with -o dyn [ 1577.378118][T18427] input: syz1 as /devices/virtual/input/input17 [ 1580.019629][T18465] kAFS: Can only specify source 'none' with -o dyn [ 1580.046742][T18465] input: syz1 as /devices/virtual/input/input18 [ 1585.344833][T18509] tipc: Started in network mode [ 1585.349984][T18509] tipc: Node identity 4, cluster identity 4711 [ 1585.356310][T18509] tipc: Node number set to 4 [ 1587.557130][T14950] block nbd2: Possible stuck request ffff888022318000: control (read@0,4096B). Runtime 30 seconds [ 1587.645201][T18528] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1590.112839][T18561] comedi comedi3: pcl711: I/O port conflict (0x100,16) [ 1590.344782][T18564] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1593.645799][T18593] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1594.987639][T16474] block nbd3: Possible stuck request ffff888022390000: control (read@0,4096B). Runtime 30 seconds [ 1597.885458][T18625] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3618'. [ 1598.666186][ T8333] block nbd0: Possible stuck request ffff8880222b8000: control (read@0,1024B). Runtime 60 seconds [ 1598.676962][T16474] block nbd1: Possible stuck request ffff8880222e8000: control (read@0,1024B). Runtime 60 seconds [ 1598.689207][ T8333] block nbd0: Possible stuck request ffff8880222b8200: control (read@1024,3072B). Runtime 60 seconds [ 1598.700310][T16474] block nbd1: Possible stuck request ffff8880222e8200: control (read@1024,3072B). Runtime 60 seconds [ 1600.605726][T14950] block nbd4: Possible stuck request ffff8880223b0000: control (read@0,1024B). Runtime 30 seconds [ 1600.616682][T14950] block nbd4: Possible stuck request ffff8880223b0200: control (read@1024,1024B). Runtime 30 seconds [ 1600.630708][T14950] block nbd4: Possible stuck request ffff8880223b0400: control (read@2048,1024B). Runtime 30 seconds [ 1600.641793][T14950] block nbd4: Possible stuck request ffff8880223b0600: control (read@3072,1024B). Runtime 30 seconds [ 1602.698412][ T5778] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 1603.685732][ T5778] usb 2-1: Using ep0 maxpacket: 32 [ 1603.697658][ T5778] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 1603.725729][ T5778] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1603.755789][ T5778] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 1603.796206][ T5778] usb 2-1: New USB device found, idVendor=06cb, idProduct=73f6, bcdDevice= 0.00 [ 1603.805298][ T5778] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1603.886454][ T5778] usb 2-1: config 0 descriptor?? [ 1605.070319][ T5778] usbhid 2-1:0.0: can't add hid device: -71 [ 1605.126401][ T5778] usbhid: probe of 2-1:0.0 failed with error -71 [ 1605.135483][ T5778] usb 2-1: USB disconnect, device number 12 [ 1607.736627][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.750770][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1609.475843][ T5142] udevd[5142]: worker [18144] /devices/virtual/block/nbd0 is taking a long time [ 1609.535713][ T5142] udevd[5142]: worker [18146] /devices/virtual/block/nbd1 is taking a long time [ 1610.306099][ T172] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 1610.525851][ T172] usb 2-1: Using ep0 maxpacket: 32 [ 1611.196108][ T172] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1611.296237][ T172] usb 2-1: New USB device found, idVendor=046d, idProduct=c086, bcdDevice= 0.00 [ 1611.342252][ T172] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1611.536847][ T172] usb 2-1: config 0 descriptor?? [ 1612.044745][T18716] sg_write: data in/out 830976/136 bytes for SCSI command 0x0-- guessing data in; [ 1612.044745][T18716] program syz.3.3634 not setting count and/or reply_len properly [ 1613.625290][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1613.665955][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1613.674300][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1613.706313][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1613.717521][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1613.737311][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1613.755694][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1613.775021][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.552507][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.562538][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.571419][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.584393][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.593587][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.602334][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.610988][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.739608][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.748410][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.756947][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.765407][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.775022][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.783967][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.792682][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.801458][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1614.810301][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.509379][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.523967][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.532293][T18727] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1615.563077][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.585806][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.594214][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.625884][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.634246][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.663139][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.685861][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.694195][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.715714][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.724060][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.763388][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.805676][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.814022][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.845800][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.863548][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.883749][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.895920][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.904243][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.935712][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.944046][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.975830][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1615.984176][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.005851][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.014196][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.045848][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.063963][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.085667][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.094011][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.125669][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.153837][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.206621][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.214968][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.255531][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.295769][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.304116][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.333978][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.367781][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.395156][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.469454][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.584561][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.707446][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.793646][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.905771][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1616.989860][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1617.073017][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1617.176723][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1617.265751][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1617.274093][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1617.358984][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1617.368580][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1617.396083][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1617.404445][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1617.428816][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1617.442551][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1618.655224][T14950] block nbd2: Possible stuck request ffff888022318000: control (read@0,4096B). Runtime 60 seconds [ 1618.716307][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1618.724659][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1618.781129][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1618.785738][ T27] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 1619.364489][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.632361][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.661784][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.675831][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.725723][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.746801][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.765684][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.774020][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.802755][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.815653][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.825972][ T27] usb 5-1: Using ep0 maxpacket: 32 [ 1619.850038][ T27] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1619.865903][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.874915][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.874958][ T27] usb 5-1: config 8 has an invalid interface number: 220 but max is 1 [ 1619.883292][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.883354][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.883380][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.883406][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.883433][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.883459][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.883502][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.883529][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.883555][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.883581][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1619.883604][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.681462][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.689917][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.698253][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.698693][ T5142] udevd[5142]: worker [18178] /devices/virtual/block/nbd2 is taking a long time [ 1620.706783][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.706819][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.706847][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.706872][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.745695][ T27] usb 5-1: config 8 has an invalid descriptor of length 55, skipping remainder of the config [ 1620.776698][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.785333][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.802267][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.810821][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.815648][ T27] usb 5-1: config 8 has no interface number 0 [ 1620.824537][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.845451][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.861036][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.877958][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.883559][ T27] usb 5-1: config 8 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1620.892805][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.909363][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.917898][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.930675][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.939463][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.948162][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.956787][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.965349][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.975966][ T27] usb 5-1: config 8 interface 220 has no altsetting 0 [ 1620.982872][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1620.992004][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.000783][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.009405][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.018125][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.018661][ T27] usb 5-1: config 8 interface 1 has no altsetting 0 [ 1621.031333][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.042364][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.054319][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.069840][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.085871][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.095142][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.103745][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.112283][ T27] usb 5-1: string descriptor 0 read error: -71 [ 1621.112694][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.127443][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.135932][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.144503][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.154701][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.165911][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.175204][ T27] usb 5-1: New USB device found, idVendor=04e2, idProduct=1401, bcdDevice=34.ae [ 1621.175321][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.195092][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.203762][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.213519][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.227329][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.237261][ T27] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1621.259506][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.286716][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.319012][ T27] usb 5-1: can't set config #8, error -71 [ 1621.319427][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1621.491163][ T27] usb 5-1: USB disconnect, device number 10 [ 1621.493994][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.158513][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.177365][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.239792][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.248909][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.284750][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.311911][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.329928][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.344637][T18763] PM: suspend entry (deep) [ 1622.351567][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.373486][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.384681][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.394087][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.404838][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.413980][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.422451][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.435308][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.464751][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.495431][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.533021][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.565447][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.597439][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.627829][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.781068][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.800175][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.827193][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.866251][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.888854][T18767] sg_write: data in/out 765440/136 bytes for SCSI command 0x0-- guessing data in; [ 1622.888854][T18767] program syz.3.3654 not setting count and/or reply_len properly [ 1622.950729][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1622.990199][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.533910][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.561793][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.585763][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.594121][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.623660][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.634730][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.643790][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.652536][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.663986][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.712398][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.773801][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.836081][ T27] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 1623.846620][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.889297][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1623.946693][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.002061][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.045861][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.086951][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.137691][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.190283][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.234803][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.280253][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.324914][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.371635][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.417296][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.470477][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.517299][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.567753][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.638943][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.692383][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.745045][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.804306][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.856818][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.935801][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1624.989958][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1625.038351][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1625.100693][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1625.105724][ T27] usb 4-1: Using ep0 maxpacket: 8 [ 1625.154140][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1625.203871][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1625.255897][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1625.274165][ T27] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1625.281691][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1625.291474][ T27] usb 4-1: config 4 interface 0 has no altsetting 0 [ 1625.305838][ T27] usb 4-1: string descriptor 0 read error: -22 [ 1625.306227][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1625.312314][ T27] usb 4-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 1625.331999][ T27] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 1625.348152][ T27] usb 4-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 1625.352326][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1625.370119][ T27] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1625.382345][ T27] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 1625.390409][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1625.393119][ T27] usb 4-1: media controller created [ 1626.621392][T16474] block nbd3: Possible stuck request ffff888022390000: control (read@0,4096B). Runtime 60 seconds [ 1626.628600][ T27] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1626.658425][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1626.695877][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1626.715883][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1626.724224][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1626.730018][ T27] zl10353_read_register: readreg error (reg=127, ret==0) [ 1626.775935][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1626.797476][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1627.958091][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1627.967097][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1627.975409][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1627.983757][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1627.992155][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.003063][ T27] usb 4-1: USB disconnect, device number 12 [ 1628.045789][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.054120][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.085656][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.094976][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.144012][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.165751][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.174085][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.195890][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.204249][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.235746][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.251761][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x5 [ 1628.275774][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.284115][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.315991][ T172] logitech-hidpp-device 0003:046D:C086.000B: unknown main item tag 0x0 [ 1628.324329][ T172] logitech-hidpp-device 0003:046D:C086.000B: unexpected long global item [ 1628.344536][T18784] kAFS: Can only specify source 'none' with -o dyn [ 1628.353378][T18784] input: syz1 as /devices/virtual/input/input19 [ 1628.386669][ T172] logitech-hidpp-device 0003:046D:C086.000B: hidpp_probe:parse failed [ 1628.395081][ T172] logitech-hidpp-device: probe of 0003:046D:C086.000B failed with error -22 [ 1628.472256][ T172] usb 2-1: USB disconnect, device number 13 [ 1628.931309][T16474] block nbd0: Possible stuck request ffff8880222b8000: control (read@0,1024B). Runtime 90 seconds [ 1628.942070][T16474] block nbd0: Possible stuck request ffff8880222b8200: control (read@1024,3072B). Runtime 90 seconds [ 1628.953517][ T8333] block nbd1: Possible stuck request ffff8880222e8000: control (read@0,1024B). Runtime 90 seconds [ 1628.965760][ T8333] block nbd1: Possible stuck request ffff8880222e8200: control (read@1024,3072B). Runtime 90 seconds [ 1630.668333][T14950] block nbd4: Possible stuck request ffff8880223b0000: control (read@0,1024B). Runtime 60 seconds [ 1630.679712][T14950] block nbd4: Possible stuck request ffff8880223b0200: control (read@1024,1024B). Runtime 60 seconds [ 1630.690810][T14950] block nbd4: Possible stuck request ffff8880223b0400: control (read@2048,1024B). Runtime 60 seconds [ 1630.705720][T14950] block nbd4: Possible stuck request ffff8880223b0600: control (read@3072,1024B). Runtime 60 seconds [ 1631.014429][T18804] sg_write: data in/out 765440/136 bytes for SCSI command 0x0-- guessing data in; [ 1631.014429][T18804] program syz.1.3668 not setting count and/or reply_len properly [ 1631.567273][ T5142] udevd[5142]: worker [18323] /devices/virtual/block/nbd4 is taking a long time [ 1631.592846][ T5142] udevd[5142]: worker [18274] /devices/virtual/block/nbd3 is taking a long time [ 1632.655722][ T28] kauditd_printk_skb: 33 callbacks suppressed [ 1632.655740][ T28] audit: type=1800 audit(1786077499.935:289): pid=18809 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3670" name="/" dev="fuse" ino=4 res=0 errno=0 [ 1635.429959][T18831] kAFS: Can only specify source 'none' with -o dyn [ 1636.157126][T18831] input: syz1 as /devices/virtual/input/input20 [ 1636.600112][T18840] sg_write: data in/out 765440/136 bytes for SCSI command 0x0-- guessing data in; [ 1636.600112][T18840] program syz.1.3678 not setting count and/or reply_len properly [ 1638.073470][T15875] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1638.085409][T15875] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1638.094515][T15875] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1638.104059][T15875] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1638.112088][T15875] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1638.119733][T15875] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1639.022934][T18860] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 1639.114429][T18861] kAFS: Can only specify source 'none' with -o dyn [ 1639.123192][T18861] input: syz1 as /devices/virtual/input/input21 [ 1639.451230][T18854] chnl_net:caif_netlink_parms(): no params data found [ 1640.473652][T18854] bridge0: port 1(bridge_slave_0) entered blocking state [ 1640.520980][T18854] bridge0: port 1(bridge_slave_0) entered disabled state [ 1640.554621][T18854] bridge_slave_0: entered allmulticast mode [ 1640.785769][T18854] bridge_slave_0: entered promiscuous mode [ 1640.809879][T18854] bridge0: port 2(bridge_slave_1) entered blocking state [ 1640.832304][T18854] bridge0: port 2(bridge_slave_1) entered disabled state [ 1640.855909][T18854] bridge_slave_1: entered allmulticast mode [ 1640.900950][T18854] bridge_slave_1: entered promiscuous mode [ 1641.087002][T15875] Bluetooth: hci4: command tx timeout [ 1641.507887][T18854] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1641.520736][T18854] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1641.640554][T18892] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 1641.783284][T18854] team0: Port device team_slave_0 added [ 1641.842065][T18854] team0: Port device team_slave_1 added [ 1641.976182][T18854] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1641.983187][T18854] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1642.049997][T18854] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1642.220811][T18854] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1642.317279][T18854] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1642.526288][T18854] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1642.939266][T18854] hsr_slave_0: entered promiscuous mode [ 1642.967326][T18854] hsr_slave_1: entered promiscuous mode [ 1642.980499][T18854] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1643.004871][T18854] Cannot create hsr debugfs directory [ 1643.145775][T15875] Bluetooth: hci4: command tx timeout [ 1644.307642][T18919] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 1644.498094][T18854] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1644.544197][T18854] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1644.586962][T18854] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1644.912021][T18854] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1645.226076][T15875] Bluetooth: hci4: command tx timeout [ 1646.762112][T18933] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 1646.774038][T18933] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 1646.782880][T18933] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 1647.305642][T15875] Bluetooth: hci4: command tx timeout [ 1647.923116][T18854] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1647.943193][T18854] 8021q: adding VLAN 0 to HW filter on device team0 [ 1647.980643][ T9253] bridge0: port 1(bridge_slave_0) entered blocking state [ 1647.987807][ T9253] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1648.032671][ T9253] bridge0: port 2(bridge_slave_1) entered blocking state [ 1648.039971][ T9253] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1648.232302][T15875] Bluetooth: hci2: ACL packet for unknown connection handle 3439 [ 1649.845974][T14950] block nbd2: Possible stuck request ffff888022318000: control (read@0,4096B). Runtime 90 seconds [ 1650.555761][T18707] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1650.770348][T18707] usb 4-1: New USB device found, idVendor=9710, idProduct=7720, bcdDevice= 0.00 [ 1650.780477][T18854] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1650.790041][T18707] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1650.820511][T18707] mos7720 4-1:1.0: Moschip 2 port adapter converter detected [ 1651.034323][T18707] usb 4-1: mos7720: usb_control_msg() failed: 0 [ 1651.071662][T18707] usb 4-1: Moschip 2 port adapter converter now attached to ttyUSB0 [ 1651.125428][T18707] usb 4-1: Moschip 2 port adapter converter now attached to ttyUSB1 [ 1651.249713][T18707] usb 4-1: USB disconnect, device number 13 [ 1651.255731][ C0] usb 4-1: mos7720_interrupt_callback - Error -19 submitting control urb [ 1651.287329][T18707] moschip7720 ttyUSB0: Moschip 2 port adapter converter now disconnected from ttyUSB0 [ 1651.328002][T18707] moschip7720 ttyUSB1: Moschip 2 port adapter converter now disconnected from ttyUSB1 [ 1651.359614][T18707] mos7720 4-1:1.0: device disconnected [ 1651.539163][T18854] veth0_vlan: entered promiscuous mode [ 1651.560445][T18854] veth1_vlan: entered promiscuous mode [ 1651.592081][T18854] veth0_macvtap: entered promiscuous mode [ 1651.624006][T18854] veth1_macvtap: entered promiscuous mode [ 1651.656807][T18854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1651.677797][T18854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1651.700043][T18854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1651.720523][T18854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1651.730817][T18854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1651.741636][T18854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1651.752188][T18854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1651.763980][T18854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1651.785986][T18854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1651.815802][T18854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1651.838342][T18854] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1651.889613][T18854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1651.906792][T18854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1651.918216][T18854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1651.929019][T18854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1651.939211][T18854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1651.950599][T18854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1651.962164][T18854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1652.135855][T15875] Bluetooth: hci3: ACL packet for unknown connection handle 3439 [ 1652.928688][T18854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1653.032694][T18854] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1653.161709][T18854] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1653.222212][T18854] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1653.268024][T18854] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1653.280550][T18854] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1654.208824][ T9248] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1654.248930][ T9248] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1654.318994][ T9255] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1654.341589][ T9255] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1656.273110][T19032] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3733'. [ 1657.018284][T18876] block nbd3: Possible stuck request ffff888022390000: control (read@0,4096B). Runtime 90 seconds [ 1658.492331][T19050] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3740'. [ 1658.533217][T19050] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3740'. [ 1658.568581][T19050] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3740'. [ 1658.606146][T19050] netlink: 108 bytes leftover after parsing attributes in process `syz.1.3740'. [ 1658.610021][T19052] can: request_module (can-proto-0) failed. [ 1658.639106][T19050] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3740'. [ 1659.200916][T19058] kvm: requested 72076 ns i8254 timer period limited to 200000 ns [ 1659.806327][T18876] block nbd0: Possible stuck request ffff8880222b8000: control (read@0,1024B). Runtime 120 seconds [ 1659.815851][T19058] kvm: requested 55314 ns i8254 timer period limited to 200000 ns [ 1659.817156][T18876] block nbd0: Possible stuck request ffff8880222b8200: control (read@1024,3072B). Runtime 120 seconds [ 1659.838359][ T8333] block nbd1: Possible stuck request ffff8880222e8000: control (read@0,1024B). Runtime 120 seconds [ 1659.850125][ T8333] block nbd1: Possible stuck request ffff8880222e8200: control (read@1024,3072B). Runtime 120 seconds [ 1660.390653][T19058] kvm: requested 25142 ns i8254 timer period limited to 200000 ns [ 1660.428459][T19058] kvm: requested 78781 ns i8254 timer period limited to 200000 ns [ 1661.405670][T17736] block nbd4: Possible stuck request ffff8880223b0000: control (read@0,1024B). Runtime 90 seconds [ 1661.418561][T17736] block nbd4: Possible stuck request ffff8880223b0200: control (read@1024,1024B). Runtime 90 seconds [ 1661.429839][T17736] block nbd4: Possible stuck request ffff8880223b0400: control (read@2048,1024B). Runtime 90 seconds [ 1661.440827][T17736] block nbd4: Possible stuck request ffff8880223b0600: control (read@3072,1024B). Runtime 90 seconds [ 1663.732263][T19111] sg_write: data in/out 699904/136 bytes for SCSI command 0x0-- guessing data in; [ 1663.732263][T19111] program syz.3.3760 not setting count and/or reply_len properly [ 1666.740078][T19131] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 1666.761624][T19133] ALSA: mixer_oss: invalid OSS volume 'SPEA9¦KŸsË â¢+ñI2KER' [ 1667.812090][T19149] sg_write: data in/out 699904/136 bytes for SCSI command 0x0-- guessing data in; [ 1667.812090][T19149] program syz.5.3771 not setting count and/or reply_len properly [ 1669.138808][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1669.145128][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1669.421813][T19161] Bluetooth: hci0: invalid length 0, exp 2 for type 23 [ 1669.606054][T19164] Bluetooth: hci0: unsupported parameter 255 [ 1669.623743][T19164] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 1670.480598][T18707] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 1671.060290][T19178] sg_write: data in/out 568832/136 bytes for SCSI command 0x0-- guessing data in; [ 1671.060290][T19178] program syz.5.3783 not setting count and/or reply_len properly [ 1671.251190][T18707] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 1671.261571][T18707] usb 2-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 1671.261600][T18707] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1671.261620][T18707] usb 2-1: Product: syz [ 1671.261633][T18707] usb 2-1: Manufacturer: syz [ 1671.261648][T18707] usb 2-1: SerialNumber: syz [ 1671.273551][T18707] usb 2-1: config 0 descriptor?? [ 1671.277001][T18707] hub 2-1:0.0: bad descriptor, ignoring hub [ 1671.277029][T18707] hub: probe of 2-1:0.0 failed with error -5 [ 1671.630242][T18707] usb 2-1: USB disconnect, device number 14 [ 1671.846210][T19185] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1672.320091][T19193] Bluetooth: hci0: unsupported parameter 255 [ 1672.320114][T19193] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 1672.716833][T19198] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1674.220603][T19214] sg_write: data in/out 699904/136 bytes for SCSI command 0x0-- guessing data in; [ 1674.220603][T19214] program syz.5.3794 not setting count and/or reply_len properly [ 1675.220059][T19218] Bluetooth: hci0: invalid length 0, exp 2 for type 21 [ 1675.615710][ T5761] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1675.643410][T19226] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1675.797451][ T5761] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1675.846966][ T5761] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1675.865636][ T5761] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1675.892097][ T5761] usb 4-1: config 0 descriptor?? [ 1675.908479][ T5761] pwc: Askey VC010 type 2 USB webcam detected. [ 1676.903439][ T5761] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1677.772854][ T5761] pwc: recv_control_msg error -71 req 02 val 2c00 [ 1677.835259][ T5761] pwc: recv_control_msg error -71 req 04 val 1000 [ 1677.903549][ T5761] pwc: recv_control_msg error -71 req 04 val 1300 [ 1677.918300][ T5761] pwc: recv_control_msg error -71 req 04 val 1400 [ 1677.945238][ T5761] pwc: recv_control_msg error -71 req 02 val 2000 [ 1677.967187][ T5761] pwc: recv_control_msg error -71 req 02 val 2100 [ 1677.982538][ T5761] pwc: recv_control_msg error -71 req 04 val 1500 [ 1677.990947][ T5761] pwc: recv_control_msg error -71 req 02 val 2500 [ 1678.001763][ T5761] pwc: recv_control_msg error -71 req 02 val 2400 [ 1678.019674][ T5761] pwc: recv_control_msg error -71 req 02 val 2600 [ 1678.144289][ T5761] pwc: recv_control_msg error -71 req 02 val 2900 [ 1678.151701][ T5761] pwc: recv_control_msg error -71 req 02 val 2800 [ 1678.170488][ T5761] pwc: recv_control_msg error -71 req 04 val 1100 [ 1678.204166][T19240] sg_write: data in/out 699904/136 bytes for SCSI command 0x0-- guessing data in; [ 1678.204166][T19240] program syz.5.3803 not setting count and/or reply_len properly [ 1678.227422][ T5761] pwc: recv_control_msg error -71 req 04 val 1200 [ 1678.246053][ T5761] pwc: Registered as video103. [ 1678.292599][ T5761] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input22 [ 1678.471267][ T5761] usb 4-1: USB disconnect, device number 14 [ 1679.065417][T19248] Bluetooth: hci0: invalid length 0, exp 2 for type 21 [ 1679.320843][T19251] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1681.706196][T17736] block nbd2: Possible stuck request ffff888022318000: control (read@0,4096B). Runtime 120 seconds [ 1682.918847][T19272] Bluetooth: hci0: invalid length 0, exp 2 for type 21 [ 1683.203562][T19276] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1683.541799][T19284] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1683.564259][T19284] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1684.068357][T19290] kAFS: Can only specify source 'none' with -o dyn [ 1684.109035][T19291] sg_write: data in/out 699904/136 bytes for SCSI command 0x0-- guessing data in; [ 1684.109035][T19291] program syz.3.3815 not setting count and/or reply_len properly [ 1686.306557][T19303] Can't find ip_set type has [ 1686.371305][T19310] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1686.574705][T19313] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1686.835494][T19320] loop8: detected capacity change from 0 to 7 [ 1686.862240][T19320] Dev loop8: unable to read RDB block 7 [ 1686.883608][T19320] loop8: unable to read partition table [ 1686.902644][T19320] loop8: partition table beyond EOD, truncated [ 1686.930698][T19320] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 1687.199529][T19324] sg_write: data in/out 699904/136 bytes for SCSI command 0x0-- guessing data in; [ 1687.199529][T19324] program syz.1.3832 not setting count and/or reply_len properly [ 1687.665919][ T8333] block nbd3: Possible stuck request ffff888022390000: control (read@0,4096B). Runtime 120 seconds [ 1687.944974][T19330] kAFS: Can only specify source 'none' with -o dyn [ 1689.411003][T19337] nbd5: detected capacity change from 0 to 63 [ 1689.491804][T19340] FAULT_INJECTION: forcing a failure. [ 1689.491804][T19340] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1689.628330][T19340] CPU: 1 PID: 19340 Comm: syz.3.3836 Not tainted syzkaller #0 [ 1689.635902][T19340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1689.646245][T19340] Call Trace: [ 1689.649555][T19340] [ 1689.652524][T19340] dump_stack_lvl+0x18c/0x250 [ 1689.657265][T19340] ? show_regs_print_info+0x20/0x20 [ 1689.662584][T19340] ? load_image+0x420/0x420 [ 1689.667130][T19340] should_fail_ex+0x394/0x4c0 [ 1689.671878][T19340] get_futex_key+0x136/0x1030 [ 1689.676620][T19340] ? futex_setup_timer+0xc0/0xc0 [ 1689.681589][T19340] ? finish_task_switch+0x25d/0x8f0 [ 1689.686822][T19340] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1689.692835][T19340] futex_wait_setup+0xbc/0x270 [ 1689.697634][T19340] ? futex_wait_multiple+0x920/0x920 [ 1689.702941][T19340] ? finish_task_switch+0x262/0x8f0 [ 1689.708193][T19340] futex_wait+0x1bc/0x5c0 [ 1689.712560][T19340] ? futex_setup_timer+0xc0/0xc0 [ 1689.717524][T19340] ? futex_wait_setup+0x270/0x270 [ 1689.722623][T19340] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1689.728631][T19340] do_futex+0x2ff/0x3e0 [ 1689.732817][T19340] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1689.738739][T19340] ? lock_chain_count+0x20/0x20 [ 1689.743639][T19340] __se_sys_futex+0x3a9/0x440 [ 1689.748359][T19340] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1689.754038][T19340] ? __x64_sys_futex+0xf0/0xf0 [ 1689.758858][T19340] ? __x64_sys_futex+0x21/0xf0 [ 1689.763706][T19340] do_syscall_64+0x55/0xb0 [ 1689.768162][T19340] ? clear_bhb_loop+0x40/0x90 [ 1689.772871][T19340] ? clear_bhb_loop+0x40/0x90 [ 1689.777576][T19340] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1689.783499][T19340] RIP: 0033:0x7f535579e0d9 [ 1689.788034][T19340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1689.807672][T19340] RSP: 002b:00007f53565a80e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1689.816124][T19340] RAX: ffffffffffffffda RBX: 00007f5355a26098 RCX: 00007f535579e0d9 [ 1689.824120][T19340] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f5355a26098 [ 1689.832117][T19340] RBP: 00007f5355a26090 R08: 0000000000000000 R09: 0000000000000000 [ 1689.840311][T19340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1689.848399][T19340] R13: 00007f5355a26128 R14: 00007ffcc854c510 R15: 00007ffcc854c5f8 [ 1689.856416][T19340] [ 1690.013085][T19346] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1690.255807][T18876] block nbd0: Possible stuck request ffff8880222b8000: control (read@0,1024B). Runtime 150 seconds [ 1690.277952][T18876] block nbd0: Possible stuck request ffff8880222b8200: control (read@1024,3072B). Runtime 150 seconds [ 1690.294817][T15875] block nbd5: Receive control failed (result -104) [ 1690.319220][ T40] block nbd1: Possible stuck request ffff8880222e8000: control (read@0,1024B). Runtime 150 seconds [ 1690.330049][ T40] block nbd1: Possible stuck request ffff8880222e8200: control (read@1024,3072B). Runtime 150 seconds [ 1690.493445][T19349] nbd6: detected capacity change from 0 to 63 [ 1690.541442][T15875] block nbd6: Receive control failed (result -104) [ 1690.796187][T19361] kAFS: Can only specify source 'none' with -o dyn [ 1690.888296][T19363] sg_write: data in/out 699904/136 bytes for SCSI command 0x0-- guessing data in; [ 1690.888296][T19363] program syz.1.3842 not setting count and/or reply_len properly [ 1691.466140][T14950] block nbd4: Possible stuck request ffff8880223b0000: control (read@0,1024B). Runtime 120 seconds [ 1691.477160][T14950] block nbd4: Possible stuck request ffff8880223b0200: control (read@1024,1024B). Runtime 120 seconds [ 1691.516514][T14950] block nbd4: Possible stuck request ffff8880223b0400: control (read@2048,1024B). Runtime 120 seconds [ 1691.562887][T14950] block nbd4: Possible stuck request ffff8880223b0600: control (read@3072,1024B). Runtime 120 seconds [ 1692.770570][T19379] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1693.956637][T19390] nbd7: detected capacity change from 0 to 63 [ 1693.978334][T19390] FAULT_INJECTION: forcing a failure. [ 1693.978334][T19390] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1694.046291][T19390] CPU: 1 PID: 19390 Comm: syz.5.3852 Not tainted syzkaller #0 [ 1694.053856][T19390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1694.064029][T19390] Call Trace: [ 1694.067333][T19390] [ 1694.070288][T19390] dump_stack_lvl+0x18c/0x250 [ 1694.075006][T19390] ? show_regs_print_info+0x20/0x20 [ 1694.080237][T19390] ? load_image+0x420/0x420 [ 1694.084780][T19390] ? __might_fault+0xaa/0x120 [ 1694.089496][T19390] ? __lock_acquire+0x7d80/0x7d80 [ 1694.094564][T19390] should_fail_ex+0x394/0x4c0 [ 1694.099296][T19390] _copy_from_user+0x2f/0xe0 [ 1694.103934][T19390] __sys_bpf+0x23e/0x890 [ 1694.108232][T19390] ? bpf_link_show_fdinfo+0x390/0x390 [ 1694.113663][T19390] ? lock_chain_count+0x20/0x20 [ 1694.118560][T19390] __x64_sys_bpf+0x7c/0x90 [ 1694.123008][T19390] do_syscall_64+0x55/0xb0 [ 1694.127453][T19390] ? clear_bhb_loop+0x40/0x90 [ 1694.132169][T19390] ? clear_bhb_loop+0x40/0x90 [ 1694.136865][T19390] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1694.142787][T19390] RIP: 0033:0x7f1afc39e0d9 [ 1694.147269][T19390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1694.166910][T19390] RSP: 002b:00007f1afa5f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1694.175369][T19390] RAX: ffffffffffffffda RBX: 00007f1afc625fa0 RCX: 00007f1afc39e0d9 [ 1694.183390][T19390] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 1694.191397][T19390] RBP: 00007f1afc435024 R08: 0000000000000000 R09: 0000000000000000 [ 1694.199395][T19390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1694.207405][T19390] R13: 00007f1afc626038 R14: 00007f1afc625fa0 R15: 00007ffc1e4155d8 [ 1694.215432][T19390] [ 1694.262048][T15875] block nbd7: Receive control failed (result -104) [ 1694.487224][T19395] nbd8: detected capacity change from 0 to 63 [ 1694.509111][T15875] block nbd8: Receive control failed (result -104) [ 1694.628436][T19403] sg_write: data in/out 699904/136 bytes for SCSI command 0x0-- guessing data in; [ 1694.628436][T19403] program syz.3.3854 not setting count and/or reply_len properly [ 1696.411327][T19414] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1697.058230][T19431] nbd9: detected capacity change from 0 to 63 [ 1697.079609][T19431] FAULT_INJECTION: forcing a failure. [ 1697.079609][T19431] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1697.103457][T19431] CPU: 1 PID: 19431 Comm: syz.0.3863 Not tainted syzkaller #0 [ 1697.111006][T19431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1697.121097][T19431] Call Trace: [ 1697.124442][T19431] [ 1697.127370][T19431] dump_stack_lvl+0x18c/0x250 [ 1697.132142][T19431] ? show_regs_print_info+0x20/0x20 [ 1697.137341][T19431] ? load_image+0x420/0x420 [ 1697.141859][T19431] ? __might_fault+0xaa/0x120 [ 1697.146559][T19431] ? __lock_acquire+0x7d80/0x7d80 [ 1697.151611][T19431] should_fail_ex+0x394/0x4c0 [ 1697.156304][T19431] _copy_from_user+0x2f/0xe0 [ 1697.160899][T19431] __sys_bpf+0x23e/0x890 [ 1697.165159][T19431] ? bpf_link_show_fdinfo+0x390/0x390 [ 1697.170563][T19431] ? lock_chain_count+0x20/0x20 [ 1697.175451][T19431] __x64_sys_bpf+0x7c/0x90 [ 1697.179879][T19431] do_syscall_64+0x55/0xb0 [ 1697.184297][T19431] ? clear_bhb_loop+0x40/0x90 [ 1697.188974][T19431] ? clear_bhb_loop+0x40/0x90 [ 1697.193650][T19431] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1697.199545][T19431] RIP: 0033:0x7f7fb219e0d9 [ 1697.203972][T19431] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1697.223589][T19431] RSP: 002b:00007f7fb30a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1697.232011][T19431] RAX: ffffffffffffffda RBX: 00007f7fb2425fa0 RCX: 00007f7fb219e0d9 [ 1697.240004][T19431] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 1697.247986][T19431] RBP: 00007f7fb2235024 R08: 0000000000000000 R09: 0000000000000000 [ 1697.255980][T19431] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1697.263980][T19431] R13: 00007f7fb2426038 R14: 00007f7fb2425fa0 R15: 00007ffc89b375e8 [ 1697.271975][T19431] [ 1697.293198][T15875] block nbd9: Receive control failed (result -104) [ 1697.481982][T19436] nbd10: detected capacity change from 0 to 63 [ 1697.502612][T15875] block nbd10: Receive control failed (result -32) [ 1697.521468][T14950] block nbd10: Dead connection, failed to find a fallback [ 1697.531501][T14950] block nbd10: shutting down sockets [ 1697.538805][T14950] I/O error, dev nbd10, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1697.548927][T14950] Buffer I/O error on dev nbd10, logical block 0, async page read [ 1697.595677][T16474] I/O error, dev nbd10, sector 2 op 0x0:(READ) flags 0x0 phys_seg 3 prio class 2 [ 1697.604913][T16474] Buffer I/O error on dev nbd10, logical block 1, async page read [ 1697.612987][T16474] Buffer I/O error on dev nbd10, logical block 2, async page read [ 1697.620895][T16474] Buffer I/O error on dev nbd10, logical block 3, async page read [ 1697.631046][T16474] I/O error, dev nbd10, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 1697.644734][T16474] Buffer I/O error on dev nbd10, logical block 0, async page read [ 1697.653047][T16474] Buffer I/O error on dev nbd10, logical block 1, async page read [ 1697.661465][T16474] Buffer I/O error on dev nbd10, logical block 2, async page read [ 1697.671673][T16474] Buffer I/O error on dev nbd10, logical block 3, async page read [ 1697.679911][T16474] I/O error, dev nbd10, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 1697.690970][T16474] Buffer I/O error on dev nbd10, logical block 0, async page read [ 1697.698988][T16474] Buffer I/O error on dev nbd10, logical block 1, async page read [ 1697.707254][T16474] I/O error, dev nbd10, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 1697.716916][T16474] I/O error, dev nbd10, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 1697.726686][T16474] I/O error, dev nbd10, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 1697.736222][T16474] I/O error, dev nbd10, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 1697.745691][T16474] I/O error, dev nbd10, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1697.755065][T16474] I/O error, dev nbd10, sector 2 op 0x0:(READ) flags 0x0 phys_seg 3 prio class 2 [ 1697.764413][T19413] ldm_validate_partition_table(): Disk read failed. [ 1697.775035][T19413] Dev nbd10: unable to read RDB block 0 [ 1697.782618][T19413] nbd10: unable to read partition table [ 1697.794944][T19413] ldm_validate_partition_table(): Disk read failed. [ 1697.803597][T19413] Dev nbd10: unable to read RDB block 0 [ 1697.811132][T19413] nbd10: unable to read partition table [ 1697.846636][T19442] sg_write: data in/out 568832/136 bytes for SCSI command 0x0-- guessing data in; [ 1697.846636][T19442] program syz.0.3867 not setting count and/or reply_len properly [ 1699.106019][T19455] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1700.230701][T19467] nbd11: detected capacity change from 0 to 63 [ 1700.262135][T19467] FAULT_INJECTION: forcing a failure. [ 1700.262135][T19467] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1700.310985][T19467] CPU: 1 PID: 19467 Comm: syz.5.3874 Not tainted syzkaller #0 [ 1700.318511][T19467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1700.328620][T19467] Call Trace: [ 1700.331925][T19467] [ 1700.334883][T19467] dump_stack_lvl+0x18c/0x250 [ 1700.339600][T19467] ? show_regs_print_info+0x20/0x20 [ 1700.344836][T19467] ? load_image+0x420/0x420 [ 1700.349408][T19467] should_fail_ex+0x394/0x4c0 [ 1700.354133][T19467] get_futex_key+0x136/0x1030 [ 1700.358840][T19467] ? verify_lock_unused+0x140/0x140 [ 1700.364089][T19467] ? futex_setup_timer+0xc0/0xc0 [ 1700.369067][T19467] futex_wait_setup+0xbc/0x270 [ 1700.373874][T19467] ? futex_wait_multiple+0x920/0x920 [ 1700.379205][T19467] futex_wait+0x1bc/0x5c0 [ 1700.383616][T19467] ? futex_setup_timer+0xc0/0xc0 [ 1700.388591][T19467] ? futex_wait_setup+0x270/0x270 [ 1700.393678][T19467] ? file_end_write+0x159/0x250 [ 1700.398565][T19467] ? vfs_write+0x5de/0x9a0 [ 1700.403012][T19467] do_futex+0x2ff/0x3e0 [ 1700.407192][T19467] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1700.413101][T19467] __se_sys_futex+0x3a9/0x440 [ 1700.417785][T19467] ? __x64_sys_futex+0xf0/0xf0 [ 1700.422581][T19467] ? __x64_sys_futex+0x21/0xf0 [ 1700.427346][T19467] do_syscall_64+0x55/0xb0 [ 1700.431764][T19467] ? clear_bhb_loop+0x40/0x90 [ 1700.436443][T19467] ? clear_bhb_loop+0x40/0x90 [ 1700.441120][T19467] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1700.447010][T19467] RIP: 0033:0x7f1afc39e0d9 [ 1700.451420][T19467] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1700.471028][T19467] RSP: 002b:00007f1afa5f60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1700.479443][T19467] RAX: ffffffffffffffda RBX: 00007f1afc625fa8 RCX: 00007f1afc39e0d9 [ 1700.487435][T19467] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1afc625fa8 [ 1700.495400][T19467] RBP: 00007f1afc625fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1700.503391][T19467] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1700.511367][T19467] R13: 00007f1afc626038 R14: 00007ffc1e4154f0 R15: 00007ffc1e4155d8 [ 1700.519359][T19467] [ 1700.567872][T15875] block nbd11: Receive control failed (result -104) [ 1700.686934][T19471] nbd12: detected capacity change from 0 to 63 [ 1700.722888][T15875] block nbd12: Receive control failed (result -32) [ 1700.814907][T16474] block nbd12: Dead connection, failed to find a fallback [ 1700.822985][T16474] block nbd12: shutting down sockets [ 1700.837428][T19474] ldm_validate_partition_table(): Disk read failed. [ 1700.856851][T19474] Dev nbd12: unable to read RDB block 0 [ 1700.877304][T19474] nbd12: unable to read partition table [ 1700.936609][T19473] sg_write: data in/out 568832/136 bytes for SCSI command 0x0-- guessing data in; [ 1700.936609][T19473] program syz.0.3877 not setting count and/or reply_len properly [ 1701.071949][T19474] ldm_validate_partition_table(): Disk read failed. [ 1701.097660][T19474] Dev nbd12: unable to read RDB block 0 [ 1701.126736][T19474] nbd12: unable to read partition table [ 1703.585726][T19499] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1704.748935][T19505] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 1705.511205][T19507] nbd13: detected capacity change from 0 to 63 [ 1705.533855][T19507] FAULT_INJECTION: forcing a failure. [ 1705.533855][T19507] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1705.551815][T19507] CPU: 1 PID: 19507 Comm: syz.5.3887 Not tainted syzkaller #0 [ 1705.559345][T19507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1705.569428][T19507] Call Trace: [ 1705.572725][T19507] [ 1705.575666][T19507] dump_stack_lvl+0x18c/0x250 [ 1705.580370][T19507] ? show_regs_print_info+0x20/0x20 [ 1705.585593][T19507] ? load_image+0x420/0x420 [ 1705.590138][T19507] should_fail_ex+0x394/0x4c0 [ 1705.594849][T19507] get_futex_key+0x136/0x1030 [ 1705.599553][T19507] ? verify_lock_unused+0x140/0x140 [ 1705.604782][T19507] ? futex_setup_timer+0xc0/0xc0 [ 1705.609754][T19507] futex_wait_setup+0xbc/0x270 [ 1705.614553][T19507] ? futex_wait_multiple+0x920/0x920 [ 1705.619888][T19507] futex_wait+0x1bc/0x5c0 [ 1705.624247][T19507] ? futex_setup_timer+0xc0/0xc0 [ 1705.629217][T19507] ? futex_wait_setup+0x270/0x270 [ 1705.634295][T19507] ? file_end_write+0x159/0x250 [ 1705.639185][T19507] ? vfs_write+0x5de/0x9a0 [ 1705.643632][T19507] do_futex+0x2ff/0x3e0 [ 1705.647820][T19507] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1705.653752][T19507] __se_sys_futex+0x3a9/0x440 [ 1705.658462][T19507] ? __x64_sys_futex+0xf0/0xf0 [ 1705.663237][T19507] ? __x64_sys_futex+0x21/0xf0 [ 1705.668000][T19507] do_syscall_64+0x55/0xb0 [ 1705.672414][T19507] ? clear_bhb_loop+0x40/0x90 [ 1705.677087][T19507] ? clear_bhb_loop+0x40/0x90 [ 1705.681765][T19507] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1705.687667][T19507] RIP: 0033:0x7f1afc39e0d9 [ 1705.692080][T19507] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1705.711701][T19507] RSP: 002b:00007f1afa5f60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1705.720119][T19507] RAX: ffffffffffffffda RBX: 00007f1afc625fa8 RCX: 00007f1afc39e0d9 [ 1705.728116][T19507] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1afc625fa8 [ 1705.736081][T19507] RBP: 00007f1afc625fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1705.744046][T19507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1705.752011][T19507] R13: 00007f1afc626038 R14: 00007ffc1e4154f0 R15: 00007ffc1e4155d8 [ 1705.760000][T19507] [ 1705.817096][T19509] sg_write: data in/out 568832/136 bytes for SCSI command 0x0-- guessing data in; [ 1705.817096][T19509] program syz.3.3888 not setting count and/or reply_len properly [ 1705.856323][T15875] block nbd13: Receive control failed (result -104) [ 1707.190253][T19514] nbd14: detected capacity change from 0 to 63 [ 1707.220165][T15875] block nbd14: Receive control failed (result -32) [ 1710.160155][T19537] nbd15: detected capacity change from 0 to 63 [ 1710.226702][T19537] FAULT_INJECTION: forcing a failure. [ 1710.226702][T19537] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1710.262825][T19537] CPU: 0 PID: 19537 Comm: syz.3.3897 Not tainted syzkaller #0 [ 1710.270360][T19537] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1710.280450][T19537] Call Trace: [ 1710.283745][T19537] [ 1710.286690][T19537] dump_stack_lvl+0x18c/0x250 [ 1710.291395][T19537] ? show_regs_print_info+0x20/0x20 [ 1710.296617][T19537] ? load_image+0x420/0x420 [ 1710.301155][T19537] ? __might_fault+0xaa/0x120 [ 1710.305861][T19537] ? __lock_acquire+0x7d80/0x7d80 [ 1710.310918][T19537] should_fail_ex+0x394/0x4c0 [ 1710.315626][T19537] _copy_from_user+0x2f/0xe0 [ 1710.320275][T19537] __sys_bpf+0x23e/0x890 [ 1710.324549][T19537] ? bpf_link_show_fdinfo+0x390/0x390 [ 1710.329956][T19537] ? lock_chain_count+0x20/0x20 [ 1710.334841][T19537] __x64_sys_bpf+0x7c/0x90 [ 1710.339291][T19537] do_syscall_64+0x55/0xb0 [ 1710.343740][T19537] ? clear_bhb_loop+0x40/0x90 [ 1710.348535][T19537] ? clear_bhb_loop+0x40/0x90 [ 1710.353244][T19537] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1710.359194][T19537] RIP: 0033:0x7f535579e0d9 [ 1710.363638][T19537] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1710.383275][T19537] RSP: 002b:00007f53565c9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1710.391749][T19537] RAX: ffffffffffffffda RBX: 00007f5355a25fa0 RCX: 00007f535579e0d9 [ 1710.399758][T19537] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 1710.407752][T19537] RBP: 00007f5355835024 R08: 0000000000000000 R09: 0000000000000000 [ 1710.415749][T19537] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1710.423749][T19537] R13: 00007f5355a26038 R14: 00007f5355a25fa0 R15: 00007ffcc854c5f8 [ 1710.431765][T19537] [ 1710.483088][T15875] block nbd15: Receive control failed (result -32) [ 1711.125382][T19549] sg_write: data in/out 699904/136 bytes for SCSI command 0x0-- guessing data in; [ 1711.125382][T19549] program syz.3.3899 not setting count and/or reply_len properly [ 1711.396065][T19551] Bluetooth: hci0: invalid length 0, exp 2 for type 8 [ 1712.921256][T14950] block nbd2: Possible stuck request ffff888022318000: control (read@0,4096B). Runtime 150 seconds [ 1715.067597][T19594] loop8: detected capacity change from 0 to 7 [ 1715.117697][T19594] Dev loop8: unable to read RDB block 7 [ 1715.125715][T19594] loop8: unable to read partition table [ 1715.142262][T19594] loop8: partition table beyond EOD, truncated [ 1715.186023][T19594] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 1715.472191][T19598] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1716.138571][T19604] nbd16: detected capacity change from 0 to 63 [ 1716.144337][T19606] FAULT_INJECTION: forcing a failure. [ 1716.144337][T19606] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1716.170030][T19606] CPU: 0 PID: 19606 Comm: syz.1.3917 Not tainted syzkaller #0 [ 1716.177594][T19606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1716.187682][T19606] Call Trace: [ 1716.191027][T19606] [ 1716.193975][T19606] dump_stack_lvl+0x18c/0x250 [ 1716.198688][T19606] ? show_regs_print_info+0x20/0x20 [ 1716.204016][T19606] ? load_image+0x420/0x420 [ 1716.208575][T19606] should_fail_ex+0x394/0x4c0 [ 1716.213298][T19606] get_futex_key+0x136/0x1030 [ 1716.218008][T19606] ? verify_lock_unused+0x140/0x140 [ 1716.223244][T19606] ? futex_setup_timer+0xc0/0xc0 [ 1716.228217][T19606] futex_wait_setup+0xbc/0x270 [ 1716.233021][T19606] ? futex_wait_multiple+0x920/0x920 [ 1716.238350][T19606] futex_wait+0x1bc/0x5c0 [ 1716.242705][T19606] ? futex_setup_timer+0xc0/0xc0 [ 1716.247669][T19606] ? futex_wait_setup+0x270/0x270 [ 1716.252729][T19606] ? file_end_write+0x159/0x250 [ 1716.257592][T19606] ? vfs_write+0x5de/0x9a0 [ 1716.262014][T19606] do_futex+0x2ff/0x3e0 [ 1716.266175][T19606] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1716.272072][T19606] __se_sys_futex+0x3a9/0x440 [ 1716.276778][T19606] ? __x64_sys_futex+0xf0/0xf0 [ 1716.281542][T19606] ? __x64_sys_futex+0x21/0xf0 [ 1716.286301][T19606] do_syscall_64+0x55/0xb0 [ 1716.290717][T19606] ? clear_bhb_loop+0x40/0x90 [ 1716.295391][T19606] ? clear_bhb_loop+0x40/0x90 [ 1716.300070][T19606] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1716.305964][T19606] RIP: 0033:0x7f651ff9e0d9 [ 1716.310384][T19606] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1716.329998][T19606] RSP: 002b:00007f6520e5d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1716.338418][T19606] RAX: ffffffffffffffda RBX: 00007f6520226098 RCX: 00007f651ff9e0d9 [ 1716.346385][T19606] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f6520226098 [ 1716.354357][T19606] RBP: 00007f6520226090 R08: 0000000000000000 R09: 0000000000000000 [ 1716.362336][T19606] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1716.370304][T19606] R13: 00007f6520226128 R14: 00007ffc5ae2e630 R15: 00007ffc5ae2e718 [ 1716.378287][T19606] [ 1716.388575][T15875] block nbd16: Receive control failed (result -32) [ 1716.496486][T19609] sg_write: data in/out 699904/136 bytes for SCSI command 0x0-- guessing data in; [ 1716.496486][T19609] program syz.5.3910 not setting count and/or reply_len properly [ 1718.688191][T16474] block nbd3: Possible stuck request ffff888022390000: control (read@0,4096B). Runtime 150 seconds [ 1718.914032][T19629] Bluetooth: hci0: invalid length 0, exp 2 for type 23 [ 1719.383814][T19641] FAULT_INJECTION: forcing a failure. [ 1719.383814][T19641] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1719.402456][T19641] CPU: 1 PID: 19641 Comm: syz.0.3926 Not tainted syzkaller #0 [ 1719.409991][T19641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1719.420074][T19641] Call Trace: [ 1719.423369][T19641] [ 1719.426312][T19641] dump_stack_lvl+0x18c/0x250 [ 1719.431026][T19641] ? verify_lock_unused+0x140/0x140 [ 1719.436262][T19641] ? show_regs_print_info+0x20/0x20 [ 1719.441487][T19641] ? load_image+0x420/0x420 [ 1719.446034][T19641] should_fail_ex+0x394/0x4c0 [ 1719.450743][T19641] get_futex_key+0x136/0x1030 [ 1719.455451][T19641] ? futex_setup_timer+0xc0/0xc0 [ 1719.460424][T19641] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1719.466435][T19641] ? __lock_acquire+0x7d80/0x7d80 [ 1719.471486][T19641] ? lock_chain_count+0x20/0x20 [ 1719.476359][T19641] ? llist_add_batch+0x10f/0x1f0 [ 1719.481336][T19641] futex_wait_setup+0xbc/0x270 [ 1719.486141][T19641] ? futex_wait_multiple+0x920/0x920 [ 1719.491463][T19641] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1719.497380][T19641] ? _raw_spin_unlock+0x40/0x40 [ 1719.497422][T19641] futex_wait+0x1bc/0x5c0 [ 1719.497452][T19641] ? futex_wait_setup+0x270/0x270 [ 1719.497489][T19641] ? file_end_write+0x159/0x250 [ 1719.497515][T19641] ? vfs_write+0x5de/0x9a0 [ 1719.506705][T19641] do_futex+0x2ff/0x3e0 [ 1719.506739][T19641] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1719.506765][T19641] __se_sys_futex+0x3a9/0x440 [ 1719.506787][T19641] ? __x64_sys_futex+0xf0/0xf0 [ 1719.506807][T19641] ? __x64_sys_futex+0x21/0xf0 [ 1719.506827][T19641] do_syscall_64+0x55/0xb0 [ 1719.506847][T19641] ? clear_bhb_loop+0x40/0x90 [ 1719.506868][T19641] ? clear_bhb_loop+0x40/0x90 [ 1719.506889][T19641] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1719.565274][T19641] RIP: 0033:0x7f7fb219e0d9 [ 1719.569734][T19641] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1719.589387][T19641] RSP: 002b:00007f7fb30850e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1719.597864][T19641] RAX: ffffffffffffffda RBX: 00007f7fb2426098 RCX: 00007f7fb219e0d9 [ 1719.605844][T19641] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f7fb2426098 [ 1719.613813][T19641] RBP: 00007f7fb2426090 R08: 0000000000000000 R09: 0000000000000000 [ 1719.621781][T19641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1719.629750][T19641] R13: 00007f7fb2426128 R14: 00007ffc89b37500 R15: 00007ffc89b375e8 [ 1719.637730][T19641] [ 1719.645147][T19644] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1719.715335][T19639] nbd17: detected capacity change from 0 to 63 [ 1719.759366][T15875] block nbd17: Receive control failed (result -32) [ 1720.276603][T14950] block nbd5: Possible stuck request ffff888022860000: control (read@0,4096B). Runtime 30 seconds [ 1720.504834][T19652] sg_write: data in/out 699904/136 bytes for SCSI command 0x0-- guessing data in; [ 1720.504834][T19652] program syz.5.3928 not setting count and/or reply_len properly [ 1721.673900][T19347] block nbd0: Possible stuck request ffff8880222b8000: control (read@0,1024B). Runtime 180 seconds [ 1721.684894][T19347] block nbd0: Possible stuck request ffff8880222b8200: control (read@1024,3072B). Runtime 180 seconds [ 1721.685657][T17736] block nbd4: Possible stuck request ffff8880223b0000: control (read@0,1024B). Runtime 150 seconds [ 1721.696270][T16474] block nbd1: Possible stuck request ffff8880222e8000: control (read@0,1024B). Runtime 180 seconds [ 1721.696308][T16474] block nbd1: Possible stuck request ffff8880222e8200: control (read@1024,3072B). Runtime 180 seconds [ 1721.730396][T14950] block nbd6: Possible stuck request ffff8880228b8000: control (read@0,1024B). Runtime 30 seconds [ 1721.741638][T14950] block nbd6: Possible stuck request ffff8880228b8200: control (read@1024,1024B). Runtime 30 seconds [ 1721.752663][T14950] block nbd6: Possible stuck request ffff8880228b8400: control (read@2048,1024B). Runtime 30 seconds [ 1721.763653][T14950] block nbd6: Possible stuck request ffff8880228b8600: control (read@3072,1024B). Runtime 30 seconds [ 1721.774820][T17736] block nbd4: Possible stuck request ffff8880223b0200: control (read@1024,1024B). Runtime 150 seconds [ 1721.787921][T17736] block nbd4: Possible stuck request ffff8880223b0400: control (read@2048,1024B). Runtime 150 seconds [ 1721.799656][T17736] block nbd4: Possible stuck request ffff8880223b0600: control (read@3072,1024B). Runtime 150 seconds [ 1723.086262][T19679] FAULT_INJECTION: forcing a failure. [ 1723.086262][T19679] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1723.145844][T19679] CPU: 0 PID: 19679 Comm: syz.5.3937 Not tainted syzkaller #0 [ 1723.153385][T19679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1723.163467][T19679] Call Trace: [ 1723.166760][T19679] [ 1723.169704][T19679] dump_stack_lvl+0x18c/0x250 [ 1723.174404][T19679] ? show_regs_print_info+0x20/0x20 [ 1723.179701][T19679] ? load_image+0x420/0x420 [ 1723.184224][T19679] ? __might_fault+0xaa/0x120 [ 1723.188914][T19679] ? __lock_acquire+0x7d80/0x7d80 [ 1723.193962][T19679] should_fail_ex+0x394/0x4c0 [ 1723.198665][T19679] _copy_from_user+0x2f/0xe0 [ 1723.203270][T19679] __sys_bpf+0x23e/0x890 [ 1723.207529][T19679] ? bpf_link_show_fdinfo+0x390/0x390 [ 1723.212932][T19679] ? lock_chain_count+0x20/0x20 [ 1723.217826][T19679] __x64_sys_bpf+0x7c/0x90 [ 1723.222281][T19679] do_syscall_64+0x55/0xb0 [ 1723.226723][T19679] ? clear_bhb_loop+0x40/0x90 [ 1723.231429][T19679] ? clear_bhb_loop+0x40/0x90 [ 1723.236124][T19679] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1723.242032][T19679] RIP: 0033:0x7f1afc39e0d9 [ 1723.246469][T19679] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1723.266102][T19679] RSP: 002b:00007f1afa5d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1723.274543][T19679] RAX: ffffffffffffffda RBX: 00007f1afc626090 RCX: 00007f1afc39e0d9 [ 1723.282531][T19679] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 1723.290516][T19679] RBP: 00007f1afc435024 R08: 0000000000000000 R09: 0000000000000000 [ 1723.298499][T19679] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1723.306507][T19679] R13: 00007f1afc626128 R14: 00007f1afc626090 R15: 00007ffc1e4155d8 [ 1723.314509][T19679] [ 1723.555649][T19675] nbd18: detected capacity change from 0 to 63 [ 1723.592369][T15875] block nbd18: Receive control failed (result -32) [ 1724.637113][T17736] block nbd7: Possible stuck request ffff8880228f0000: control (read@0,4096B). Runtime 30 seconds [ 1724.865635][T17736] block nbd8: Possible stuck request ffff888022990000: control (read@0,4096B). Runtime 30 seconds [ 1725.062820][T19693] sg_write: data in/out 699904/136 bytes for SCSI command 0x0-- guessing data in; [ 1725.062820][T19693] program syz.0.3940 not setting count and/or reply_len properly [ 1725.095214][T19692] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1725.365848][ T5852] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 1725.569566][ T5852] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1726.485384][ T5852] usb 2-1: config 0 has no interfaces? [ 1726.513199][ T5852] usb 2-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 1726.535716][ T5852] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1726.564716][ T5852] usb 2-1: Product: syz [ 1726.585271][ T5852] usb 2-1: Manufacturer: syz [ 1726.590356][ T5852] usb 2-1: SerialNumber: syz [ 1726.597856][ T5852] usb 2-1: config 0 descriptor?? [ 1726.842062][ T5852] usb 2-1: USB disconnect, device number 15 [ 1727.151801][T19751] FAULT_INJECTION: forcing a failure. [ 1727.151801][T19751] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1727.185895][T19751] CPU: 0 PID: 19751 Comm: syz.3.3947 Not tainted syzkaller #0 [ 1727.193429][T19751] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1727.199573][T19749] nbd19: detected capacity change from 0 to 63 [ 1727.203493][T19751] Call Trace: [ 1727.203513][T19751] [ 1727.203522][T19751] dump_stack_lvl+0x18c/0x250 [ 1727.203553][T19751] ? show_regs_print_info+0x20/0x20 [ 1727.225758][T19751] ? load_image+0x420/0x420 [ 1727.230272][T19751] ? __might_fault+0xaa/0x120 [ 1727.234957][T19751] ? __lock_acquire+0x7d80/0x7d80 [ 1727.239996][T19751] should_fail_ex+0x394/0x4c0 [ 1727.244688][T19751] _copy_from_user+0x2f/0xe0 [ 1727.249287][T19751] __sys_bpf+0x23e/0x890 [ 1727.253533][T19751] ? bpf_link_show_fdinfo+0x390/0x390 [ 1727.258912][T19751] ? lock_chain_count+0x20/0x20 [ 1727.263787][T19751] __x64_sys_bpf+0x7c/0x90 [ 1727.268245][T19751] do_syscall_64+0x55/0xb0 [ 1727.272665][T19751] ? clear_bhb_loop+0x40/0x90 [ 1727.277523][T19751] ? clear_bhb_loop+0x40/0x90 [ 1727.282215][T19751] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1727.288138][T19751] RIP: 0033:0x7f535579e0d9 [ 1727.292563][T19751] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1727.312180][T19751] RSP: 002b:00007f53565a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1727.320599][T19751] RAX: ffffffffffffffda RBX: 00007f5355a26090 RCX: 00007f535579e0d9 [ 1727.328615][T19751] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 1727.336601][T19751] RBP: 00007f5355835024 R08: 0000000000000000 R09: 0000000000000000 [ 1727.344575][T19751] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1727.352543][T19751] R13: 00007f5355a26128 R14: 00007f5355a26090 R15: 00007ffcc854c5f8 [ 1727.360547][T19751] [ 1727.387419][T19347] block nbd9: Possible stuck request ffff8880229d0000: control (read@0,4096B). Runtime 30 seconds [ 1727.433639][T15875] block nbd19: Receive control failed (result -32) [ 1728.713202][T19763] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1730.525432][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1730.531941][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1731.914486][T19347] block nbd11: Possible stuck request ffff888022a98000: control (read@0,4096B). Runtime 30 seconds [ 1734.025884][T19794] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1734.066953][T19794] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1735.136013][T19802] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1735.974358][T19347] block nbd13: Possible stuck request ffff888022ba8000: control (read@0,4096B). Runtime 30 seconds [ 1737.387688][T19818] Bluetooth: hci0: invalid length 0, exp 2 for type 8 [ 1740.876219][ T5142] udevd[5142]: worker [18146] /devices/virtual/block/nbd1 timeout; kill it [ 1741.570047][ T5142] udevd[5142]: seq 14996 '/devices/virtual/block/nbd1' killed [ 1741.577967][ T5142] udevd[5142]: worker [18144] /devices/virtual/block/nbd0 timeout; kill it [ 1741.588376][ T5142] udevd[5142]: seq 14995 '/devices/virtual/block/nbd0' killed [ 1741.613658][ T5142] udevd[5142]: worker [18178] /devices/virtual/block/nbd2 timeout; kill it [ 1741.656718][ T5142] udevd[5142]: seq 15006 '/devices/virtual/block/nbd2' killed [ 1743.339036][T19880] Bluetooth: hci0: invalid length 0, exp 2 for type 8 [ 1743.346346][T17736] block nbd2: Possible stuck request ffff888022318000: control (read@0,4096B). Runtime 180 seconds [ 1744.965926][T19901] Bluetooth: hci0: invalid length 0, exp 2 for type 8 [ 1745.190129][T19906] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1746.591189][T19931] Bluetooth: hci0: invalid length 0, exp 2 for type 8 [ 1748.268311][T19941] Bluetooth: hci0: invalid length 0, exp 2 for type 23 [ 1749.360711][T19347] block nbd3: Possible stuck request ffff888022390000: control (read@0,4096B). Runtime 180 seconds [ 1750.875636][T17736] block nbd5: Possible stuck request ffff888022860000: control (read@0,4096B). Runtime 60 seconds [ 1751.666410][T19973] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1752.472249][T14950] block nbd4: Possible stuck request ffff8880223b0000: control (read@0,1024B). Runtime 180 seconds [ 1752.473725][T16474] block nbd1: Possible stuck request ffff8880222e8000: control (read@0,1024B). Runtime 210 seconds [ 1752.483196][T17736] block nbd6: Possible stuck request ffff8880228b8000: control (read@0,1024B). Runtime 60 seconds [ 1752.493824][T19347] block nbd0: Possible stuck request ffff8880222b8000: control (read@0,1024B). Runtime 210 seconds [ 1752.504515][T14950] block nbd4: Possible stuck request ffff8880223b0200: control (read@1024,1024B). Runtime 180 seconds [ 1752.515209][T16474] block nbd1: Possible stuck request ffff8880222e8200: control (read@1024,3072B). Runtime 210 seconds [ 1752.526399][T17736] block nbd6: Possible stuck request ffff8880228b8200: control (read@1024,1024B). Runtime 60 seconds [ 1752.537324][T19347] block nbd0: Possible stuck request ffff8880222b8200: control (read@1024,3072B). Runtime 210 seconds [ 1752.560438][T14950] block nbd4: Possible stuck request ffff8880223b0400: control (read@2048,1024B). Runtime 180 seconds [ 1752.571555][T14950] block nbd4: Possible stuck request ffff8880223b0600: control (read@3072,1024B). Runtime 180 seconds [ 1752.582919][T17736] block nbd6: Possible stuck request ffff8880228b8400: control (read@2048,1024B). Runtime 60 seconds [ 1752.594328][T17736] block nbd6: Possible stuck request ffff8880228b8600: control (read@3072,1024B). Runtime 60 seconds [ 1752.953722][T19979] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1754.896135][T17736] block nbd7: Possible stuck request ffff8880228f0000: control (read@0,4096B). Runtime 60 seconds [ 1755.488766][T17736] block nbd8: Possible stuck request ffff888022990000: control (read@0,4096B). Runtime 60 seconds [ 1756.573909][T20011] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1756.789920][T20013] Bluetooth: hci0: invalid length 0, exp 2 for type 21 [ 1759.549894][T16474] block nbd9: Possible stuck request ffff8880229d0000: control (read@0,4096B). Runtime 60 seconds [ 1759.595973][T20025] Bluetooth: hci0: invalid length 0, exp 2 for type 24 [ 1760.006362][T20041] Bluetooth: hci0: invalid length 0, exp 2 for type 21 [ 1763.002118][T16474] block nbd11: Possible stuck request ffff888022a98000: control (read@0,4096B). Runtime 60 seconds [ 1763.077680][T20060] Bluetooth: hci0: invalid length 0, exp 2 for type 9 [ 1763.548063][T15875] Bluetooth: hci4: command 0x0406 tx timeout [ 1763.805749][T20073] Bluetooth: hci0: invalid length 0, exp 2 for type 21 [ 1766.847701][T16474] block nbd13: Possible stuck request ffff888022ba8000: control (read@0,4096B). Runtime 60 seconds [ 1768.649639][T20108] Bluetooth: hci0: invalid length 0, exp 2 for type 21 [ 1773.418468][T17736] block nbd2: Possible stuck request ffff888022318000: control (read@0,4096B). Runtime 210 seconds [ 1773.824597][T20146] Can't find ip_set type hash:n [ 1773.945013][T20153] Bluetooth: hci0: invalid length 0, exp 2 for type 23 [ 1778.205704][ T5142] udevd[5142]: worker [19427] /devices/virtual/block/nbd9 is taking a long time [ 1778.243661][ T5142] udevd[5142]: worker [18675] /devices/virtual/block/nbd5 is taking a long time [ 1778.356267][ T5142] udevd[5142]: worker [18323] /devices/virtual/block/nbd4 timeout; kill it [ 1778.366544][ T5142] udevd[5142]: seq 15020 '/devices/virtual/block/nbd4' killed [ 1778.374200][ T5142] udevd[5142]: worker [18361] /devices/virtual/block/nbd6 is taking a long time [ 1778.383562][ T5142] udevd[5142]: worker [18394] /devices/virtual/block/nbd7 is taking a long time [ 1778.618283][ T5142] udevd[5142]: worker [18656] /devices/virtual/block/nbd8 is taking a long time [ 1778.648494][ T5142] udevd[5142]: worker [19474] /devices/virtual/block/nbd13 is taking a long time [ 1778.718182][T20185] Can't find ip_set type hash:n [ 1778.724163][ T5142] udevd[5142]: worker [19413] /devices/virtual/block/nbd11 is taking a long time [ 1778.733566][ T5142] udevd[5142]: worker [18274] /devices/virtual/block/nbd3 timeout; kill it [ 1778.920152][T20194] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1778.929639][T20194] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1779.785762][ T29] INFO: task syz.4.3659:18763 blocked for more than 144 seconds. [ 1779.802086][T16474] block nbd3: Possible stuck request ffff888022390000: control (read@0,4096B). Runtime 210 seconds [ 1779.881058][ T29] Not tainted syzkaller #0 [ 1779.886251][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1779.901499][ T29] task:syz.4.3659 state:D stack:26904 pid:18763 ppid:16688 flags:0x00004004 [ 1779.910841][ T29] Call Trace: [ 1779.914327][ T29] [ 1779.917363][ T29] __schedule+0x15ae/0x4660 [ 1779.922054][ T29] ? asan.module_dtor+0x20/0x20 [ 1779.927086][ T29] ? __mutex_lock+0x66e/0xc80 [ 1779.931924][ T29] ? __mutex_trylock_common+0x8a/0x270 [ 1779.937576][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1779.943855][ T29] schedule+0xbd/0x170 [ 1779.948087][ T29] schedule_preempt_disabled+0x13/0x20 [ 1779.953738][ T29] __mutex_lock+0x673/0xc80 [ 1779.958499][ T29] ? __mutex_lock+0x4d2/0xc80 [ 1779.963222][ T29] ? sync_bdevs+0x1a4/0x320 [ 1779.967940][ T29] ? mutex_lock_nested+0x20/0x20 [ 1779.973073][ T29] ? do_raw_spin_lock+0x11f/0x2b0 [ 1779.978302][ T29] ? _atomic_dec_and_lock+0x93/0x120 [ 1779.983719][ T29] ? iput+0x33f/0x900 [ 1779.987921][ T29] ? do_raw_spin_unlock+0x121/0x230 [ 1779.993156][ T29] sync_bdevs+0x1a4/0x320 [ 1779.998443][ T29] ksys_sync+0xc6/0x170 [ 1780.002640][ T29] ? sync_filesystem+0x220/0x220 [ 1780.007684][ T29] ? ktime_get+0x24b/0x280 [ 1780.012287][ T29] ksys_sync_helper+0x17/0xa0 [ 1780.017157][ T29] pm_suspend+0x1b8/0x950 [ 1780.021642][ T29] state_store+0x206/0x290 [ 1780.026402][ T29] ? sysfs_kf_read+0x360/0x360 [ 1780.031239][ T29] kernfs_fop_write_iter+0x3a4/0x520 [ 1780.038866][ T29] vfs_write+0x474/0x9a0 [ 1780.043189][ T29] ? file_end_write+0x250/0x250 [ 1780.048551][ T29] ? __fget_files+0x3fc/0x460 [ 1780.053279][ T29] ? __fdget_pos+0x2a3/0x330 [ 1780.060986][ T29] ? ksys_write+0x74/0x260 [ 1780.065455][ T29] ksys_write+0x151/0x260 [ 1780.073575][ T29] ? __ia32_sys_read+0x90/0x90 [ 1780.081947][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 1780.090892][ T29] do_syscall_64+0x55/0xb0 [ 1780.095359][ T29] ? clear_bhb_loop+0x40/0x90 [ 1780.101213][ T29] ? clear_bhb_loop+0x40/0x90 [ 1780.115484][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1780.121668][ T29] RIP: 0033:0x7f4fadb9e0d9 [ 1780.132725][ T29] RSP: 002b:00007f4fae9b5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1780.142407][ T29] RAX: ffffffffffffffda RBX: 00007f4fade25fa0 RCX: 00007f4fadb9e0d9 [ 1780.159814][ T29] RDX: 0000000000000003 RSI: 0000200000000200 RDI: 0000000000000003 [ 1780.170305][ T29] RBP: 00007f4fadc35024 R08: 0000000000000000 R09: 0000000000000000 [ 1780.184534][ T29] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1780.195215][ T29] R13: 00007f4fade26038 R14: 00007f4fade25fa0 R15: 00007ffe89742cc8 [ 1780.212874][ T29] [ 1780.218178][ T29] [ 1780.218178][ T29] Showing all locks held in the system: [ 1780.324401][ T29] 1 lock held by khungtaskd/29: [ 1780.329497][ T29] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 [ 1780.341277][ T29] 1 lock held by udevd/5142: [ 1780.345982][ T29] 2 locks held by getty/5528: [ 1780.351023][ T29] #0: ffff88802d36d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1780.360951][ T29] #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 [ 1780.364997][T20202] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 1780.376156][ T29] 2 locks held by kworker/1:2/9926: [ 1780.383433][ T29] #0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1780.394645][ T29] #1: ffffc9000e4afd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1780.408078][ T29] 2 locks held by syz-executor/14792: [ 1780.408099][ T29] 1 lock held by udevd/18144: [ 1780.408109][ T29] #0: ffff8881407d74c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 1780.408168][ T29] 1 lock held by udevd/18146: [ 1780.408178][ T29] #0: ffff888021fcd4c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 1780.408227][ T29] 1 lock held by udevd/18178: [ 1780.408238][ T29] #0: ffff8880222524c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 1780.408288][ T29] 1 lock held by udevd/18274: [ 1780.408298][ T29] #0: ffff8880222574c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 1780.408348][ T29] 1 lock held by udevd/18323: [ 1780.408358][ T29] #0: ffff8880223444c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 1780.408409][ T29] 1 lock held by udevd/18361: [ 1780.408420][ T29] #0: ffff8880223664c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 1780.408469][ T29] 1 lock held by udevd/18394: [ 1780.408479][ T29] #0: ffff88802281b4c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 1780.408528][ T29] 1 lock held by udevd/18656: [ 1780.408539][ T29] #0: ffff8880229504c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 1780.408590][ T29] 1 lock held by udevd/18675: [ 1780.408600][ T29] #0: ffff8880223614c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 1780.408652][ T29] 6 locks held by syz.4.3659/18763: [ 1780.408663][ T29] #0: ffff8880650b2d48 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 [ 1780.408719][ T29] #1: ffff88805ab7a418 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 [ 1780.408862][ T29] #2: ffff88807db0e088 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x520 [ 1780.408923][ T29] #3: ffff88801ca749b8 (kn->active#74){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x236/0x520 [ 1780.408986][ T29] #4: ffffffff8cfe58a8 (system_transition_mutex){+.+.}-{3:3}, at: pm_suspend+0x3a8/0x950 [ 1780.409045][ T29] #5: ffff8880223444c8 (&disk->open_mutex){+.+.}-{3:3}, at: sync_bdevs+0x1a4/0x320 [ 1780.409097][ T29] 1 lock held by udevd/19413: [ 1780.409108][ T29] #0: ffff88802296f4c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 1780.409159][ T29] 1 lock held by udevd/19427: [ 1780.409169][ T29] #0: ffff8880229554c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 1780.409219][ T29] 1 lock held by udevd/19474: [ 1780.409230][ T29] #0: ffff888022a004c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 1780.409281][ T29] 2 locks held by dhcpcd/20200: [ 1780.409292][ T29] #0: ffff88805ca44a20 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x82/0x210 [ 1780.409354][ T29] #1: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x306/0x880 [ 1780.409411][ T29] 1 lock held by syz.5.4083/20201: [ 1780.415456][ T29] [ 1780.726239][ T29] ============================================= [ 1780.726239][ T29] [ 1780.734710][ T29] NMI backtrace for cpu 1 [ 1780.739055][ T29] CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 1780.746276][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1780.756341][ T29] Call Trace: [ 1780.759618][ T29] [ 1780.762544][ T29] dump_stack_lvl+0x18c/0x250 [ 1780.767250][ T29] ? __wake_up_klogd+0xd9/0x100 [ 1780.772101][ T29] ? show_regs_print_info+0x20/0x20 [ 1780.777291][ T29] ? load_image+0x420/0x420 [ 1780.781809][ T29] nmi_cpu_backtrace+0x3a6/0x3e0 [ 1780.786746][ T29] ? nmi_trigger_cpumask_backtrace+0x2f0/0x2f0 [ 1780.792917][ T29] ? load_image+0x420/0x420 [ 1780.797415][ T29] ? wq_watchdog_touch+0xef/0x170 [ 1780.802460][ T29] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 1780.808565][ T29] nmi_trigger_cpumask_backtrace+0x17a/0x2f0 [ 1780.814552][ T29] watchdog+0xf59/0xfa0 [ 1780.818748][ T29] ? watchdog+0x1e1/0xfa0 [ 1780.823099][ T29] kthread+0x2fa/0x390 [ 1780.827172][ T29] ? hungtask_pm_notify+0x50/0x50 [ 1780.832196][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1780.836780][ T29] ret_from_fork+0x48/0x80 [ 1780.841192][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1780.845811][ T29] ret_from_fork_asm+0x11/0x20 [ 1780.850582][ T29] [ 1780.854608][ T29] Sending NMI from CPU 1 to CPUs 0: [ 1780.860423][ C0] NMI backtrace for cpu 0 [ 1780.860435][ C0] CPU: 0 PID: 19734 Comm: kworker/u4:9 Not tainted syzkaller #0 [ 1780.860450][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1780.860459][ C0] Workqueue: events_unbound cfg80211_wiphy_work [ 1780.860579][ C0] RIP: 0010:preempt_count_sub+0x51/0x160 [ 1780.860603][ C0] Code: 83 3d 72 3a d2 15 00 75 25 65 8b 05 31 ce a6 7e 89 c1 81 e1 ff ff ff 7f 39 cf 7f 25 81 ff ff 00 00 00 0f 93 c1 84 c0 0f 95 c0 <08> c8 74 53 65 8b 05 0c ce a6 7e f7 df 65 01 3d 03 ce a6 7e 5b 5d [ 1780.860616][ C0] RSP: 0018:ffffc9000b85f560 EFLAGS: 00000202 [ 1780.860628][ C0] RAX: 0000000080000001 RBX: dffffc0000000000 RCX: 0000000000000000 [ 1780.860639][ C0] RDX: 0000000000000000 RSI: ffffc9000b85f648 RDI: 0000000000000001 [ 1780.860648][ C0] RBP: 0000000000000001 R08: ffff8880317a0000 R09: 0000000000000003 [ 1780.860658][ C0] R10: 0000000000000004 R11: 0000000000000000 R12: ffffc9000b85f648 [ 1780.860667][ C0] R13: ffffc9000b85f6a8 R14: ffffc9000b85f6a8 R15: ffffc9000b85f6b8 [ 1780.860679][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 1780.860692][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1780.860702][ C0] CR2: 0000001b2eb22ff8 CR3: 00000000300bd000 CR4: 00000000003506f0 [ 1780.860716][ C0] Call Trace: [ 1780.860721][ C0] [ 1780.860728][ C0] unwind_next_frame+0x1d1b/0x2990 [ 1780.860749][ C0] ? __unwind_start+0x275/0x730 [ 1780.860765][ C0] __unwind_start+0x5bb/0x730 [ 1780.860781][ C0] ? stack_trace_save+0x100/0x100 [ 1780.860800][ C0] arch_stack_walk+0xf8/0x190 [ 1780.860817][ C0] ? arch_stack_walk+0xf8/0x190 [ 1780.860834][ C0] stack_trace_save+0xaa/0x100 [ 1780.860851][ C0] ? stack_trace_snprint+0xf0/0xf0 [ 1780.860868][ C0] ? ieee80211_iface_work+0x7a0/0xc90 [ 1780.860916][ C0] ? kthread+0x2fa/0x390 [ 1780.860930][ C0] ? ret_from_fork+0x48/0x80 [ 1780.860948][ C0] ? ret_from_fork_asm+0x11/0x20 [ 1780.860969][ C0] kasan_set_track+0x4e/0x70 [ 1780.861009][ C0] ? __kmem_cache_free+0xba/0x1f0 [ 1780.861031][ C0] ? kmem_cache_free+0xf8/0x290 [ 1780.861051][ C0] kasan_save_free_info+0x28/0x40 [ 1780.861070][ C0] ____kasan_slab_free+0x126/0x1f0 [ 1780.861089][ C0] slab_free_freelist_hook+0x130/0x1a0 [ 1780.861107][ C0] ? ieee80211_iface_work+0x7a0/0xc90 [ 1780.861123][ C0] kmem_cache_free+0xf8/0x290 [ 1780.861146][ C0] ieee80211_iface_work+0x7a0/0xc90 [ 1780.861167][ C0] cfg80211_wiphy_work+0x228/0x260 [ 1780.861185][ C0] ? process_scheduled_works+0x975/0x1600 [ 1780.861204][ C0] process_scheduled_works+0xa60/0x1600 [ 1780.861235][ C0] ? worker_attach_to_pool+0x370/0x370 [ 1780.861256][ C0] ? assign_work+0x3cc/0x5d0 [ 1780.861276][ C0] worker_thread+0xa5e/0xfe0 [ 1780.861306][ C0] kthread+0x2fa/0x390 [ 1780.861319][ C0] ? pr_cont_work+0x550/0x550 [ 1780.861337][ C0] ? kthread_blkcg+0xd0/0xd0 [ 1780.861351][ C0] ret_from_fork+0x48/0x80 [ 1780.861367][ C0] ? kthread_blkcg+0xd0/0xd0 [ 1780.861382][ C0] ret_from_fork_asm+0x11/0x20 [ 1780.861406][ C0] [ 1781.170090][ T29] Kernel panic - not syncing: hung_task: blocked tasks [ 1781.176975][ T29] CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 1781.184188][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1781.194365][ T29] Call Trace: [ 1781.197654][ T29] [ 1781.200596][ T29] dump_stack_lvl+0x18c/0x250 [ 1781.205294][ T29] ? show_regs_print_info+0x20/0x20 [ 1781.210506][ T29] ? load_image+0x420/0x420 [ 1781.215042][ T29] panic+0x2ca/0x720 [ 1781.218962][ T29] ? bpf_jit_dump+0xd0/0xd0 [ 1781.223479][ T29] ? __irq_work_queue_local+0x13a/0x3b0 [ 1781.229056][ T29] ? preempt_schedule_thunk+0x1a/0x30 [ 1781.234462][ T29] ? nmi_trigger_cpumask_backtrace+0x2a4/0x2f0 [ 1781.240648][ T29] watchdog+0xf98/0xfa0 [ 1781.244827][ T29] ? watchdog+0x1e1/0xfa0 [ 1781.249179][ T29] kthread+0x2fa/0x390 [ 1781.253257][ T29] ? hungtask_pm_notify+0x50/0x50 [ 1781.258302][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1781.262911][ T29] ret_from_fork+0x48/0x80 [ 1781.267345][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1781.271953][ T29] ret_from_fork_asm+0x11/0x20 [ 1781.276757][ T29] [ 1781.280038][ T29] Kernel Offset: disabled [ 1781.284363][ T29] Rebooting in 86400 seconds..