last executing test programs: 15m16.174369135s ago: executing program 1 (id=297): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r0, 0xc138fd06, &(0x7f0000002000)="04000000000000000000000038010000000000000000000000000000020e0000000000000000000000000000000000006d7061746830") 15m15.980386677s ago: executing program 1 (id=300): r0 = syz_io_uring_setup(0x82e, &(0x7f0000000240)={0x0, 0x2457, 0x400, 0x1000002, 0x20000}, &(0x7f0000000040), &(0x7f0000000140), &(0x7f0000000000)) r1 = dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r1, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x16, &(0x7f00000001c0)={&(0x7f0000002000)={[{0x0}, {0x0, 0x0, 0x3}, {0x0, 0x0, 0x1}, {0x0}]}, 0x4, 0x2}, 0x1) 15m15.928722662s ago: executing program 1 (id=301): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="820000000438a9650a82f7eb65e8a1960fe7000000010000000900000000000000129edc609ac77e4660eabfd8fadc4fca0bbba4738dab722240170971cd5f2d1745dea2aa4f6cc4a780752c13c9e0bce90af23a907dc6cf109fb8eedfd81785d8d7ac76b06c6dedb81f06d7a902246b2703857c424c57741a23393f8ce052e1dc102f058b1f16e7810395a5833f6544c31ec680293d98fd473c0d1ede83b17b74ddc45c62a1b51332c638950be944e884330d2b254aea46554b15edd7ca14e434", @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/27], 0x50) epoll_create1(0x0) socket$unix(0x1, 0x2, 0x0) r0 = socket$key(0xf, 0x3, 0x2) socket(0x10, 0x803, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) unshare(0x22020600) r2 = syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8) connect(r2, 0x0, 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write$bt_hci(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01"], 0x17) nanosleep(0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r4, 0x0, 0x0, 0x20040940, 0x0, 0x0) r5 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r5, 0x0, 0x0) listen(r3, 0x14) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, 0x0, 0x0) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) sendmsg$key(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x2, 0x7, 0x90, 0x0, 0x2, 0x0, 0x70bd2c, 0x25dfdbfe}, 0x10}}, 0x8040) 15m14.864490002s ago: executing program 1 (id=310): setresuid(0x0, 0xee00, 0x0) setfsuid(0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) 15m14.665435704s ago: executing program 1 (id=312): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x2, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 15m14.380100941s ago: executing program 1 (id=314): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x6}, 0xa) writev(r0, &(0x7f0000003380)=[{&(0x7f0000000080)="11a62d924b40594bb8e8f0d512bbedf7f47b110282ef34c805cd0d39bfbf4cef90384fcfce8af1c477c394dfa1891bb6e3d80ae8ee01366272ebff7090514249bbf75898497bf148b47b810ade62eb8ebe26e41c2919c38055", 0x59}, {&(0x7f0000000100)="6ff7c9e7f0f358ebaa73db9bb5508d5ed28f91a693c0a3d8a2823db45d5cb087da0a3d0e9dcac9c333a1d1869e133036a07d28c1b885759768f03225eb5e2aac8695f0a7c7a08b7f5b256e6085a9e0210f4763343aee289ebc60387ceeddf84f8b0e79d2537c960b11ae578c90c8146985f4cfa86f4d15d5ddb60755f2609c4dcf852046b8e1776557902b6e9f73834e63808fb197df6c075e3fd6662973fd4665a069468ab929aeeb515fc2eb809e75fee15924881a6e92f5ddf3bcfd3894d3b914856350df09527e3f8b2c9fb9d53963b647e54850330ec7a7800151775a64c1376906909fc7d8f408f5541aad63d68154800cbdbd5e32aea6483920bf52519482fe6ec6d3a4beef630577cd07f1048c1cef5ecbadf57d94c8a4f4b26d24530561850a8a4b803cab0caad488d9f351046b15de8dd97a1d56b46ad70ae1c8374ddad0dcd68ad4cffa9fec4fd40580fa3b47788cc0e70a8d43d516144b36b5c314cc3b24c1643743a114bb61b77ce03705ddbdb3b2a5fb9c3e84951f9fb5358a2f2f10042b0495c9f82900f2ca7103807161f498727774aa1e972959f7def116f8ff264d7aea9b876eae78473593d280e63a1578654c3d44b1e688e9e8f55e8f36930b220beb3569a07058efe1acceff00cd5ff297a3f7ebb620d680351d91328e5548d3a120cf5f9239b9272fe3c39bbe0df051f665b282c6ecfd71661c2f530a4a594d19f77d1e7f9d378089ef8ddc4359fac202a6752ddaa547dd82b5f5f23bee8edb5d3b3e46c0dd849c4d4bb6a0454e16018b9529e32839cbd0b9a4030c1584c1274b26776a89cd9e1660d2a4eded8c6eae4088b1665a02f5361af2f6f0f1042e697f18d2b4001e71cc65d9958852a572cfe5653cdac6dec818be6704bb4142eb5b7d7b692f3e0f0b3432cfebd60758f0c88aa09cfeba2a4eec51f41e8a156209bb39fef6cfd08cf7af03d7ff015d5b34603ca38857e7a72a66252de25d8e600d69f4fc584ff2097219b2fc5fe484053c7a7020c1131fa8c54a4f7efa9d84201417d30e084f7ce28f76f3b96bf5b31e06e0b30d282e9f69a0e29a2c2a283c28537a0b1f149dd425aee8f205912e34646ee268888a73fb725934b91ec247f0c9bc4ba10cf8f36c65d1e79757ee58a983d4d62b914a05ee41dfd613a7b078d7ae54a6a0536d1eeb1d8ee57e1d7b846095907fe5aa582511d107bed5b2243870ecfa3482e446a0c95f7ac23d0bf7820ce163f9167596677da5122439892d9aead8affc1a65a1e8e770b351f1b1b8082757217934f899bfe3a8e71515fb0739b1d735c7535e70979da77922f1d2ee5ad18eefcaa2438b39a5e7a143e5b99a14cd9880f5c573e7296ca208e2e30665e83b4b13c00fef9997d4872912cee8878f139409677f06eab93c209a8fbc52fe6cfe78b9878e47b927e6a53c8655e5cf63f5da6b81ca4e9596dc17b1d6766dad116352a0b9c74863c6845d0f96dd5195c7c23f8779ce9ef12be353613ae1871dc2154fbb54ee99f7ae1443e5070428897cadf25775f7fbf0dc3fa7680fb9d7436f85c8004b0b53d5330ae88ff502ad7085cfbae3aa7762c8d8c2485290ae638f68926aaefddaf7122146113dfc7833fe32719bbcc13554bb574502415f6fef2972e900d93b914449c922b3416cf6f5bdce8de97e6ca0ac62228d81be48e8b9e8f4c51f86764f04c4cb9a93dd9314e7c2e05f00f76ee275f88c5816b3061c7a41edb93f68665b014eae0834bac649e7c1a62a27a7903c781fd7a6dfbb5be1babe8ee7035d93081c04a4e38a0ceb83dadd14cf0834f385851789b4de553f5d55e62cbf293ba82553a67c3d077ed60459cb3c7171bc94b51f9856cff676c1933d3519ccfebaf79a8fb111d3a99eb0b8dc24a1e329678f63f7e87390a3bad9c06f1e3c9bb4d20a831f2a8f46e089033ce4ff8097d8420b6a1ff1aa59b9d081fa93dca4ea3d9c4b3201d6c44a1c7d0bae70aa7f314fb6500ad3ea7f8618f8d454668ba7b54672e8527f59a99825d85507206701203da67a8eff6334e7b099bf89717a1e631e686316f9d173f3954093fb0cf259e1c054085b96a58e2b14551b9f0b69cec1c2f90ee379dd75316b3aec9049152cc6693c83ccfdea351ebb85ac7802f0e9fe4ba0db89d538027f8ef4d157e8f36f651dcbb0f279b3a24b5dadfdbd7235aea2bed2d73610bfbd7055213af9f869b3c5401f001c0d7d121f46e962dc694106888531cb844eb66cdef90945a91acc48add66639fe8448ed316e395a03b748231a9db1f6d71c1ece19cc290fbe8fd3131706359d5919b506a7f7b60071e9f563d337910954cee67507684faed2905b9ee471b66aea242dba18ab565e92cc33c0cfeda3a4e90181fec36c1ffcfddde339990cbc69e4425c99500134922c4b8fecc92088b2ce64326d1d76a59b6df9f749d846c9e0c6dfd194bc4525eef68a7484c390be2f006db7eb9f6910ce4e9d3edb697e832f629fd1227772cbaadcbabcfe2ca0a5cdc715c60ce960287ca236d07ed27cb84087ebf7c6843dd6dd8b40ddb98fec931ab5b7444d3529f1c2e47f5294ae9a2cb54d2f9c17d3245b3eb53be622f32da67a026abb8546da0d334a9e0f6c2d2f166d44a3255d4b9a54ea0068a8b34c0b6a6f5503282c783d5abd35e0cc172c4f90367beea6d2ac6e0c8764a5bb933c52ae5bf0ff96f30e26ceba5a3c2567d48fcc4629ec25b56c7e2ae3eb07a9279d9e6951fa9b350064b65c0f3ab76d17e9377c069bd17512a27d46df6c1b1a7eed6c173f880ed2a279da0571762ccc27c50c2cf3d1bf0e8c26eef8a02e4a9ee2867592fce29ca31bb03951d45fa10aa6d379e0c802eaec3e04973d6435da44f321db67d5aebc49694850c8d3cb44bbdc3bd21b34cc2a49aebc8220b2ee1c54339d3be0ce3a595feb5bc4d1d2e97e99be79e3f4eeb15b456f628b4490cd4e4e1456a8a8102f2aa5cd820e10eb88ca67ac8b2fb07277eca0da40cc8786353b870eb8ce0a9f427da6a5ec406cacd3f4d70ed117bc5ce809a57489253a182f6b8f6fd5fe26c7463bac1728cea90680cd5880d35b52ca686d11b53af788aa249b42adec055b5195e05803ae75c3d3feb75057fe03d768d54289666f9d1160c783da88b49b2d5323baa08fdecc8d046f402e3185230970593e157a9a30db765a6b8f9f5e561680c2b83415f4769dcb3089e882533ddf7d200f57bbc70798e3a09361da93771ec9c984e9afaa23943b421813de00dd444b180a559a6b7de2f51f5a3085fdc484e998ff986725621d8eace5652c7a661ba6ad0bed1b3180b3c85d5e025c4f3712f45b6946e5d87259932d0c2ab793dad80bb0004d1d404eb9eda544c8934c30fc78873ef8893a694929bc05b95a8a700f918b39432ae3c21df7ecb1ad67fa643271142d56db9d7ae81f9882ff3e0902b473f6e353803b840c5e4166f04bae79d6543523f2588f482bd24934086fdc02729ff5bb3ea49e0360c43ba66b9c6268722d6bfe6f02a3c95a4740939b07d744d1a942ca8d4dfeeb53f2a92ad36b84347efa70ef3223a068eb35b380d2632f2b9d406ce76da0941e5988d3dab18520bd8eda185510bb722317d29b0eaa4b12107dba9b3f968b2df00300575d97004b171dcd5aebadcf7571ee5822eb82f69129b756a8a78bbf551d034cd84ac8eba10d63fe4351269e558255126a6705d6d62fff15df48a74a7c16d78e6e72ff4b92fab086c7f96a956d09218431612104666765c9a3d1ecb50b5b1b3745103957956a3e49eaea259eeeb49507768570274bef52e3cd599db867e20bb56ee69755e7b213e49e9bb1d68e4c709428a9127c7b5fec4d41d5fd332517ce600dd142c03ee7a1b41c9b612ae50ab033b913b53cb41ec55b361172f928dee18ab2d0027105fe0b18e5eee1b51ba8f1d3c002aba7c7d6ffe66782a46c1b29130fd1f52ebe698a7c3320c4eb1c1658f257402331af89f825631da2bb7f588483df5676975ee63f64a1743ccf7557bbf57241858f1d235488760b706548ff50e848c3b18be14ca8a97a0eddbd7f35f2e934d6c0cd1b28818a830d9b0deea6ed66f6a6cc42994df5f9c999c9f8516e10521aa781510028d746c8911d94d6124ffe40df62e71ec8eb51fdc83c38121828e9c71daa3cb4bdb111ec54d806561fa27df26679e2bf5f5de4ae4d133e752bc07638c1989d2a30bfbdc3e4ebb8f224483916d8f13d5fad77d8738c3a5f389c6f408a66c72bcc304d782dee5fc544ed03029ce4677bb0a1e690d9888dec0f7410fd790db10e0c73ba7202fb386e1d3a2806333ab04e5a209d2b34095adb34b546fb5d43d9650bc1db2971ee5f698a20761c2dfeacbf9418fb2591628ca45f49b3cbc472f17d6ea2b8e9a66b0289cd60abad9f9c14f11351a24ff8653e9306b0eb869bc99615ba0ceae816617c7d519e8f7bbc0e8846eed9b75ba3d91e567f11bec00105501854a9cbaf95092f5526427111a9783f829c1846a4a1b43fed094700a7202b615879487f42f9a554fb8e301b75c212e596dec221b0553e7b775cd874b4e75a6b4fb9ee5e72c4f7f45ebb8c034fe4abc1e33025e04685bd4f8126fc45cc6a77f9f5a4c712417c4579f06a94b8a6869aa01ec1376f96631713feb3f9820b7821558ec6a0f3ca5d33254653f17fc66b5fa407f5be879e109ead0efd6aaabc2fdc4d2cc9b90deb6c0a078e014b83a7092e859aa3f26390460d50894e95d0aad541b4e973b3de575ca2d485cc3d2a3d7d947562826daed0ce954db8a575527f6da148bbb9ea5188b67b09abaf2fc4fa5891f8557e44891d09da4d9994a990e6bbdf4038cfe6ff1b7846949daf03959d16779caeff940d6d24d1d8a4ade137e3522f085ca6f1a0bcb0111a87ed5a2f496bd2b642a521f2fa51d662d4308019504b82df01bf5f4da4bdf04b691e493e6b5bb39d059daee8280b8df046cdccdf1ef765fcc20c086ca9d7a351259475fb86accc5f18bd8f180f09b87d8b08937d7fc430d755dc73495cea3c1e6a1d55767571f20314ed2384a21771729b721467b78803fdcf37b47c4a83fc579f3246a3c095201aacd941928178a669402b708c0d0dd05a52cbf06b907fa6d2947652976c8f3cbc648a5a44b7dfe98fe3f9dd3aa44a2fa282d63ddfb1cc06046af2cd7c85b91eefa2dc5715859211563e60f62b213e32f603165a6efb0c6844d7b90ac5bee5689fd550cb0c907d05ebf3e662cf5a1008f40b51b77db4d8265ba505588ed68067211bae48409921eea52138d8e1cb1301e8714f8f09085bce54b372bffcd55fd3c9cddb76bbf17ddc46ca7bdc093f70abcbf1ae695e7d313be216883ede889736e799da52ad0d5d17905b6c941c1bb10e25d8613dd212b55db30bbb24093f91a9c7b517fd239e9a65b37a42920a5ecfdd41bd024c96499a0cd02e2875644b6349e72ef417fa0107d27d7d9c78130e388f16be73eb820ec6f196d4d4e31712a8aeee1b8a3a87cfa893a4868ef95d108ee4cb82047e25a1eb052fe3d579a3a603ef3798405ddcf04f7a1402d59c89ac62064ab95ce94381909a9f578ae39d3450c4cc9af679ebb4085cf1936c8ab49b00995113882e226932518bb731119f4def856a777800874c4926de001b58d8fc78c922da05ffd0f7142b995450fdd3395c0b5667b5d9ad12e3a967e95c03a6b7b59f0b99b4da9134371279f6ce107a20b70c5aca86bcd6824f09e08ff7c02230b79f938d8a7b0f5d1f779e7db59cde87ee6851cafa533723e91732e38cd57454c2", 0xffc}, {&(0x7f0000001100)="8ee5ced1c480fd65126ce2df6beb74a2d78a529efa07945bb15f0cf33661c0d2a459f712f297febfdb97a8d34d8cfb8cc6447c9e685262db437f03ca8fd397710bc7fdc2db056ece0292f8b9a689203d135da0a1f83c312ba901be6f4dbda75feca6194748785d1fcd7cb324faef6bbb27fadacac716f1ab04aa16978b610a6a5adaf168e504f744d8bdfedb6ecce60252c23584946bb5ea7d920741b457b154534e91d0ce98", 0xa6}, {0x0}], 0x4) shutdown(r0, 0x1) 14m59.179739145s ago: executing program 32 (id=314): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x6}, 0xa) writev(r0, &(0x7f0000003380)=[{&(0x7f0000000080)="11a62d924b40594bb8e8f0d512bbedf7f47b110282ef34c805cd0d39bfbf4cef90384fcfce8af1c477c394dfa1891bb6e3d80ae8ee01366272ebff7090514249bbf75898497bf148b47b810ade62eb8ebe26e41c2919c38055", 0x59}, {&(0x7f0000000100)="6ff7c9e7f0f358ebaa73db9bb5508d5ed28f91a693c0a3d8a2823db45d5cb087da0a3d0e9dcac9c333a1d1869e133036a07d28c1b885759768f03225eb5e2aac8695f0a7c7a08b7f5b256e6085a9e0210f4763343aee289ebc60387ceeddf84f8b0e79d2537c960b11ae578c90c8146985f4cfa86f4d15d5ddb60755f2609c4dcf852046b8e1776557902b6e9f73834e63808fb197df6c075e3fd6662973fd4665a069468ab929aeeb515fc2eb809e75fee15924881a6e92f5ddf3bcfd3894d3b914856350df09527e3f8b2c9fb9d53963b647e54850330ec7a7800151775a64c1376906909fc7d8f408f5541aad63d68154800cbdbd5e32aea6483920bf52519482fe6ec6d3a4beef630577cd07f1048c1cef5ecbadf57d94c8a4f4b26d24530561850a8a4b803cab0caad488d9f351046b15de8dd97a1d56b46ad70ae1c8374ddad0dcd68ad4cffa9fec4fd40580fa3b47788cc0e70a8d43d516144b36b5c314cc3b24c1643743a114bb61b77ce03705ddbdb3b2a5fb9c3e84951f9fb5358a2f2f10042b0495c9f82900f2ca7103807161f498727774aa1e972959f7def116f8ff264d7aea9b876eae78473593d280e63a1578654c3d44b1e688e9e8f55e8f36930b220beb3569a07058efe1acceff00cd5ff297a3f7ebb620d680351d91328e5548d3a120cf5f9239b9272fe3c39bbe0df051f665b282c6ecfd71661c2f530a4a594d19f77d1e7f9d378089ef8ddc4359fac202a6752ddaa547dd82b5f5f23bee8edb5d3b3e46c0dd849c4d4bb6a0454e16018b9529e32839cbd0b9a4030c1584c1274b26776a89cd9e1660d2a4eded8c6eae4088b1665a02f5361af2f6f0f1042e697f18d2b4001e71cc65d9958852a572cfe5653cdac6dec818be6704bb4142eb5b7d7b692f3e0f0b3432cfebd60758f0c88aa09cfeba2a4eec51f41e8a156209bb39fef6cfd08cf7af03d7ff015d5b34603ca38857e7a72a66252de25d8e600d69f4fc584ff2097219b2fc5fe484053c7a7020c1131fa8c54a4f7efa9d84201417d30e084f7ce28f76f3b96bf5b31e06e0b30d282e9f69a0e29a2c2a283c28537a0b1f149dd425aee8f205912e34646ee268888a73fb725934b91ec247f0c9bc4ba10cf8f36c65d1e79757ee58a983d4d62b914a05ee41dfd613a7b078d7ae54a6a0536d1eeb1d8ee57e1d7b846095907fe5aa582511d107bed5b2243870ecfa3482e446a0c95f7ac23d0bf7820ce163f9167596677da5122439892d9aead8affc1a65a1e8e770b351f1b1b8082757217934f899bfe3a8e71515fb0739b1d735c7535e70979da77922f1d2ee5ad18eefcaa2438b39a5e7a143e5b99a14cd9880f5c573e7296ca208e2e30665e83b4b13c00fef9997d4872912cee8878f139409677f06eab93c209a8fbc52fe6cfe78b9878e47b927e6a53c8655e5cf63f5da6b81ca4e9596dc17b1d6766dad116352a0b9c74863c6845d0f96dd5195c7c23f8779ce9ef12be353613ae1871dc2154fbb54ee99f7ae1443e5070428897cadf25775f7fbf0dc3fa7680fb9d7436f85c8004b0b53d5330ae88ff502ad7085cfbae3aa7762c8d8c2485290ae638f68926aaefddaf7122146113dfc7833fe32719bbcc13554bb574502415f6fef2972e900d93b914449c922b3416cf6f5bdce8de97e6ca0ac62228d81be48e8b9e8f4c51f86764f04c4cb9a93dd9314e7c2e05f00f76ee275f88c5816b3061c7a41edb93f68665b014eae0834bac649e7c1a62a27a7903c781fd7a6dfbb5be1babe8ee7035d93081c04a4e38a0ceb83dadd14cf0834f385851789b4de553f5d55e62cbf293ba82553a67c3d077ed60459cb3c7171bc94b51f9856cff676c1933d3519ccfebaf79a8fb111d3a99eb0b8dc24a1e329678f63f7e87390a3bad9c06f1e3c9bb4d20a831f2a8f46e089033ce4ff8097d8420b6a1ff1aa59b9d081fa93dca4ea3d9c4b3201d6c44a1c7d0bae70aa7f314fb6500ad3ea7f8618f8d454668ba7b54672e8527f59a99825d85507206701203da67a8eff6334e7b099bf89717a1e631e686316f9d173f3954093fb0cf259e1c054085b96a58e2b14551b9f0b69cec1c2f90ee379dd75316b3aec9049152cc6693c83ccfdea351ebb85ac7802f0e9fe4ba0db89d538027f8ef4d157e8f36f651dcbb0f279b3a24b5dadfdbd7235aea2bed2d73610bfbd7055213af9f869b3c5401f001c0d7d121f46e962dc694106888531cb844eb66cdef90945a91acc48add66639fe8448ed316e395a03b748231a9db1f6d71c1ece19cc290fbe8fd3131706359d5919b506a7f7b60071e9f563d337910954cee67507684faed2905b9ee471b66aea242dba18ab565e92cc33c0cfeda3a4e90181fec36c1ffcfddde339990cbc69e4425c99500134922c4b8fecc92088b2ce64326d1d76a59b6df9f749d846c9e0c6dfd194bc4525eef68a7484c390be2f006db7eb9f6910ce4e9d3edb697e832f629fd1227772cbaadcbabcfe2ca0a5cdc715c60ce960287ca236d07ed27cb84087ebf7c6843dd6dd8b40ddb98fec931ab5b7444d3529f1c2e47f5294ae9a2cb54d2f9c17d3245b3eb53be622f32da67a026abb8546da0d334a9e0f6c2d2f166d44a3255d4b9a54ea0068a8b34c0b6a6f5503282c783d5abd35e0cc172c4f90367beea6d2ac6e0c8764a5bb933c52ae5bf0ff96f30e26ceba5a3c2567d48fcc4629ec25b56c7e2ae3eb07a9279d9e6951fa9b350064b65c0f3ab76d17e9377c069bd17512a27d46df6c1b1a7eed6c173f880ed2a279da0571762ccc27c50c2cf3d1bf0e8c26eef8a02e4a9ee2867592fce29ca31bb03951d45fa10aa6d379e0c802eaec3e04973d6435da44f321db67d5aebc49694850c8d3cb44bbdc3bd21b34cc2a49aebc8220b2ee1c54339d3be0ce3a595feb5bc4d1d2e97e99be79e3f4eeb15b456f628b4490cd4e4e1456a8a8102f2aa5cd820e10eb88ca67ac8b2fb07277eca0da40cc8786353b870eb8ce0a9f427da6a5ec406cacd3f4d70ed117bc5ce809a57489253a182f6b8f6fd5fe26c7463bac1728cea90680cd5880d35b52ca686d11b53af788aa249b42adec055b5195e05803ae75c3d3feb75057fe03d768d54289666f9d1160c783da88b49b2d5323baa08fdecc8d046f402e3185230970593e157a9a30db765a6b8f9f5e561680c2b83415f4769dcb3089e882533ddf7d200f57bbc70798e3a09361da93771ec9c984e9afaa23943b421813de00dd444b180a559a6b7de2f51f5a3085fdc484e998ff986725621d8eace5652c7a661ba6ad0bed1b3180b3c85d5e025c4f3712f45b6946e5d87259932d0c2ab793dad80bb0004d1d404eb9eda544c8934c30fc78873ef8893a694929bc05b95a8a700f918b39432ae3c21df7ecb1ad67fa643271142d56db9d7ae81f9882ff3e0902b473f6e353803b840c5e4166f04bae79d6543523f2588f482bd24934086fdc02729ff5bb3ea49e0360c43ba66b9c6268722d6bfe6f02a3c95a4740939b07d744d1a942ca8d4dfeeb53f2a92ad36b84347efa70ef3223a068eb35b380d2632f2b9d406ce76da0941e5988d3dab18520bd8eda185510bb722317d29b0eaa4b12107dba9b3f968b2df00300575d97004b171dcd5aebadcf7571ee5822eb82f69129b756a8a78bbf551d034cd84ac8eba10d63fe4351269e558255126a6705d6d62fff15df48a74a7c16d78e6e72ff4b92fab086c7f96a956d09218431612104666765c9a3d1ecb50b5b1b3745103957956a3e49eaea259eeeb49507768570274bef52e3cd599db867e20bb56ee69755e7b213e49e9bb1d68e4c709428a9127c7b5fec4d41d5fd332517ce600dd142c03ee7a1b41c9b612ae50ab033b913b53cb41ec55b361172f928dee18ab2d0027105fe0b18e5eee1b51ba8f1d3c002aba7c7d6ffe66782a46c1b29130fd1f52ebe698a7c3320c4eb1c1658f257402331af89f825631da2bb7f588483df5676975ee63f64a1743ccf7557bbf57241858f1d235488760b706548ff50e848c3b18be14ca8a97a0eddbd7f35f2e934d6c0cd1b28818a830d9b0deea6ed66f6a6cc42994df5f9c999c9f8516e10521aa781510028d746c8911d94d6124ffe40df62e71ec8eb51fdc83c38121828e9c71daa3cb4bdb111ec54d806561fa27df26679e2bf5f5de4ae4d133e752bc07638c1989d2a30bfbdc3e4ebb8f224483916d8f13d5fad77d8738c3a5f389c6f408a66c72bcc304d782dee5fc544ed03029ce4677bb0a1e690d9888dec0f7410fd790db10e0c73ba7202fb386e1d3a2806333ab04e5a209d2b34095adb34b546fb5d43d9650bc1db2971ee5f698a20761c2dfeacbf9418fb2591628ca45f49b3cbc472f17d6ea2b8e9a66b0289cd60abad9f9c14f11351a24ff8653e9306b0eb869bc99615ba0ceae816617c7d519e8f7bbc0e8846eed9b75ba3d91e567f11bec00105501854a9cbaf95092f5526427111a9783f829c1846a4a1b43fed094700a7202b615879487f42f9a554fb8e301b75c212e596dec221b0553e7b775cd874b4e75a6b4fb9ee5e72c4f7f45ebb8c034fe4abc1e33025e04685bd4f8126fc45cc6a77f9f5a4c712417c4579f06a94b8a6869aa01ec1376f96631713feb3f9820b7821558ec6a0f3ca5d33254653f17fc66b5fa407f5be879e109ead0efd6aaabc2fdc4d2cc9b90deb6c0a078e014b83a7092e859aa3f26390460d50894e95d0aad541b4e973b3de575ca2d485cc3d2a3d7d947562826daed0ce954db8a575527f6da148bbb9ea5188b67b09abaf2fc4fa5891f8557e44891d09da4d9994a990e6bbdf4038cfe6ff1b7846949daf03959d16779caeff940d6d24d1d8a4ade137e3522f085ca6f1a0bcb0111a87ed5a2f496bd2b642a521f2fa51d662d4308019504b82df01bf5f4da4bdf04b691e493e6b5bb39d059daee8280b8df046cdccdf1ef765fcc20c086ca9d7a351259475fb86accc5f18bd8f180f09b87d8b08937d7fc430d755dc73495cea3c1e6a1d55767571f20314ed2384a21771729b721467b78803fdcf37b47c4a83fc579f3246a3c095201aacd941928178a669402b708c0d0dd05a52cbf06b907fa6d2947652976c8f3cbc648a5a44b7dfe98fe3f9dd3aa44a2fa282d63ddfb1cc06046af2cd7c85b91eefa2dc5715859211563e60f62b213e32f603165a6efb0c6844d7b90ac5bee5689fd550cb0c907d05ebf3e662cf5a1008f40b51b77db4d8265ba505588ed68067211bae48409921eea52138d8e1cb1301e8714f8f09085bce54b372bffcd55fd3c9cddb76bbf17ddc46ca7bdc093f70abcbf1ae695e7d313be216883ede889736e799da52ad0d5d17905b6c941c1bb10e25d8613dd212b55db30bbb24093f91a9c7b517fd239e9a65b37a42920a5ecfdd41bd024c96499a0cd02e2875644b6349e72ef417fa0107d27d7d9c78130e388f16be73eb820ec6f196d4d4e31712a8aeee1b8a3a87cfa893a4868ef95d108ee4cb82047e25a1eb052fe3d579a3a603ef3798405ddcf04f7a1402d59c89ac62064ab95ce94381909a9f578ae39d3450c4cc9af679ebb4085cf1936c8ab49b00995113882e226932518bb731119f4def856a777800874c4926de001b58d8fc78c922da05ffd0f7142b995450fdd3395c0b5667b5d9ad12e3a967e95c03a6b7b59f0b99b4da9134371279f6ce107a20b70c5aca86bcd6824f09e08ff7c02230b79f938d8a7b0f5d1f779e7db59cde87ee6851cafa533723e91732e38cd57454c2", 0xffc}, {&(0x7f0000001100)="8ee5ced1c480fd65126ce2df6beb74a2d78a529efa07945bb15f0cf33661c0d2a459f712f297febfdb97a8d34d8cfb8cc6447c9e685262db437f03ca8fd397710bc7fdc2db056ece0292f8b9a689203d135da0a1f83c312ba901be6f4dbda75feca6194748785d1fcd7cb324faef6bbb27fadacac716f1ab04aa16978b610a6a5adaf168e504f744d8bdfedb6ecce60252c23584946bb5ea7d920741b457b154534e91d0ce98", 0xa6}, {0x0}], 0x4) shutdown(r0, 0x1) 11m35.324846196s ago: executing program 4 (id=1457): sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="180100003600010000000000fcdbdf250701f2800c00980008000000000000001400010000000000000000000000ffff0000000050bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5efc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe81"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x1, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x24}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a50000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0c0009800800014000000002080008400000000114"], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c000180060001000000000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a01010000000000f9ff000a0000090900020073797a31000000200900010073797a310000000014000380100000800c000180060001"], 0x68}, 0x1, 0x0, 0x0, 0x4004850}, 0x40) 11m32.776105259s ago: executing program 4 (id=1461): r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000200)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d7061746830") ioctl(r0, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000006d70617468300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000580000006d756c74697061746800000000000000322071756575655f6d6f64652062696f203020312031") ioctl(r0, 0xc138fd04, &(0x7f0000000700)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d7061746830") 11m32.718113707s ago: executing program 4 (id=1463): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0xc) mount(0x0, 0x0, &(0x7f0000000100)='proc\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x80002, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902"], 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) syz_usb_connect(0x5, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x8d, 0x8f, 0x33, 0x10, 0x5ac, 0x247, 0xc91e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x8, 0x6, 0x20, 0x7, "", [{{0x9, 0x4, 0x19, 0xfe, 0x0, 0x3, 0x4b, 0x2, 0xe}}]}}]}}, 0x0) 11m32.613931209s ago: executing program 5 (id=1464): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r0, 0x0, 0x0) lseek(r0, 0xffffffffffffffff, 0x1) 11m32.42560119s ago: executing program 5 (id=1465): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r1 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r0}, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYRES32=r2, @ANYRESHEX=r3, @ANYRESDEC=r3], 0x40) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$NBD_CMD_RECONFIGURE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="63812bbd7000fcdbdf2503000000080001", @ANYRES32=r6, @ANYBLOB="0c00018008000100", @ANYRES32=r7], 0x44}, 0x1, 0x0, 0x0, 0x440c0}, 0x40040) getsockname$packet(r1, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000680)=0x14) 11m32.370087968s ago: executing program 5 (id=1466): syz_emit_ethernet(0x4c8, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaa000000000000080045bc04ba00544a7d784951002000e39ea6714259e202000000119078000000000000000000004e2004a6907802010001800000002b47019676fb912bfb3979bb82d94c42da0498ad601e4b92fe2c62ba4d6bdd44d280dada5a5650e1edaecb4fd923a6ded85d084df9d5e7bffddda34d04e5cdb51ef2fe8703b3988bb47989823d53b49308c5d2977c173d08535eaf56e740391766d74589e9806165ef3d4085755bbaa162e74e4dc541aa6004761f6a43e20556918bb04da9070b3cc89472820459902b3342031e1571d32a8b78f2da2a8e73e26af9389dced48cdcaf0a714363789e4acd9373813e2729986552c1cdbeabd3a03d7684ead62926c387b1552066f9751c9f0fa935afda36cf2fb30bba0cb8007f3bd1fea86ef3b7f8434e250f2a09e6a3b569c8c0519adc93f8b909470f39920551618ecfe04ff0cc4b1ed29eee56dcd976a79181e4d3218b51150ce595c25371293ec4d05e4aa411ef3b190554c6a2e06ee6374d80a3c511603a8a20b75f8075d0d83d31b86be7d2d785e6d60c07b515fe04bd55e20bcfe799a3e66c93744c52d0d34880ab42354859d5d1a9d0d65b52a0819b19c2d7f7a285d401825bf40ccc355b1aecb100c3f86c71607b00c59c7a8c0d8ae35a0a0e20f189568cb1a386c9d799f2c5ba6cce4e6ae0dce69f7391a4f4b011b27ad89ecaca95b90be9e517d39fa47ab5d08fd75233c1b0b604c169ebdc29efe713e9ecd551fc383be78cc5afccee1d8bb067e64054734b61c99f1055748b335ea261b9a6ccd1b3362a0c9d26c74bcda8e4d1efca7f614a61b8dfa2508a39f78901cf7ab2f15409f1da06432db0b50f00e16a77ceece0e315fc63c46cd418a1d259ba713bc5a26a49bdc202cf04e02149cf29c1f617f0898321ecf9d395f349e276480b42147d4dc1af6491e05cff9a33517437cb21125f6945e0b727576880a89ef6d53375bb901e14ae1a2dd27a5bf67012b8e4515023dba602d2e5293da914c199c0c0d610bf6461cd7bba6c8b948e96f395c39a7a0b93df65368f8eaa306fdcf87522ac1a36c427d98af77c3a3afa33dc3e8e070a1a2f66a4877abbeef23ff67befdcc9532cf3990918fb778d7799ee1f26b469c37f3c9578b8f8f2d00d32fc839171b9474e76f03d827a4eac2802322f3d68b03d1516aec9566bba3acc0bcf0d6a551c412f080d8c7fe0c60e23cdb328920263477470ea4f23e23d5aebbfda173aa781f89bf0cdfce2003ed3c010c511b3b489eab29453a365b839cca172e3abbcbab0203899bdb4f14a3423c2293166145760e61c3c188c3e0888ee817f0772ff89e02df8f42b9951e1661b39def34308c46e8ec1e4e5b68e88140ac7dc993523191fdb71db3a2677a3bd666e6180a96c9846bce6cb6c16e379bf29e1769a66da2f6781e79f082cb80662d72adbb21240cef87dc3079a822b2a791753fcd12a7ec362088d76237370bcd5d5daa440ba735b4e29cf2cb93583a5080270d1a3fd40183dc04f30e01c428f92e595c89fcbd1fc52962eedea82e2772b5f5fa3dad0f908fe6a48fffcc69df60f34ef9d9ba7609d16cdf733ca77785c0ab6f536b79ffde4ff9b835bfcaffef0d15ae69c26c0588f1acd5a648fde52568c713163717eb77f863d20dda0f1ca2c0306748544d3763c1cfa82f1785f047c842cadc4f8ac1906ab6ad8f6425bb9efbe97ee62ea7e"], 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280), 0x0) sendmmsg$inet6(r0, &(0x7f0000000480)=[{{&(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback, 0x80020}, 0x1c, &(0x7f0000000300)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f00000009c0)=ANY=[], 0x1000f) 11m32.267599822s ago: executing program 5 (id=1468): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2, 0x4) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x2000010, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000009200)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x9, 0x9104, 0x40, 0x0, 0x6, 0x3fffff, 0x0, 0x0, 0x40}}, 0x50) write$FUSE_NOTIFY_STORE(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="2d0000000400000000000000000000000100000000000000000000800000230005"], 0x2d) 11m32.105682911s ago: executing program 5 (id=1469): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000000c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$vim2m(0x0, 0x7fff, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r2}, &(0x7f0000000380), 0x0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) read$FUSE(0xffffffffffffffff, &(0x7f0000002380)={0x2020}, 0x2020) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000005c0)={0xffffffffffffffff, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1c, 0x1c, "fee8a2ab78fc179fd1f8a0e9a1af1ea09dc2b7fb0a010000000000000000030000000000000000000000000000000000000000000000001b00", "28095397bab22d0000b42076c1ce8ef05f819e01177d3d458dac0000000000000000000800000000003788cf8f00", "90be8b1c5512406c7f00", [0x4, 0xa]}}) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x5, 0x84) 11m29.320172022s ago: executing program 4 (id=1474): r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000200)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d7061746830") ioctl(r0, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000006d70617468300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000580000006d756c74697061746800000000000000322071756575655f6d6f64652062696f20302031203120726f756e642d726f62696e") ioctl(r0, 0xc138fd04, &(0x7f0000000700)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d7061746830") 11m29.113631738s ago: executing program 4 (id=1476): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r1 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r0}, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYRES32=r2, @ANYRESHEX=r3, @ANYRESDEC=r3], 0x40) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$NBD_CMD_RECONFIGURE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="63812bbd7000fcdbdf2503000000080001", @ANYRES32=r6, @ANYBLOB="0c00018008000100", @ANYRES32=r7], 0x44}, 0x1, 0x0, 0x0, 0x440c0}, 0x40040) getsockname$packet(r1, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000680)=0x14) 11m28.980203526s ago: executing program 4 (id=1477): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, 0x0, 0x0) 11m26.687736287s ago: executing program 5 (id=1481): socket$netlink(0x10, 0x3, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x7a) socket$tipc(0x1e, 0x2, 0x0) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x180, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) socket$inet_udp(0x2, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_usb_connect$uac1(0x3, 0xdc, 0x0, 0x0) 11m13.499143182s ago: executing program 33 (id=1477): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, 0x0, 0x0) 11m11.176833793s ago: executing program 34 (id=1481): socket$netlink(0x10, 0x3, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x7a) socket$tipc(0x1e, 0x2, 0x0) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x180, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) socket$inet_udp(0x2, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_usb_connect$uac1(0x3, 0xdc, 0x0, 0x0) 6m0.916183818s ago: executing program 6 (id=2096): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mq_open(0x0, 0x42, 0x54, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_DETACH(0x1c, 0x0, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x5, 0xbc6c, 0x4936, 0xc2, 0x1, 0xffffffffffffffff, 0x6}, 0x50) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) 5m57.074079106s ago: executing program 6 (id=2102): syz_kvm_add_vcpu$x86(0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x36900, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000100)={0x0, 0xaaa, 0x0, 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0xea5bc50b6199d76e) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5m54.860787818s ago: executing program 6 (id=2109): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mq_open(0x0, 0x42, 0x54, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_DETACH(0x1c, 0x0, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x5, 0xbc6c, 0x4936, 0xc2, 0x1, r1, 0x6}, 0x50) connect$netlink(r1, &(0x7f00000000c0)=@kern={0x10, 0x0, 0x0, 0x1}, 0xc) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) 5m51.631668242s ago: executing program 6 (id=2111): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x240007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000c80)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000", 0x4b}], 0x1}}], 0x1, 0x2090) writev(r0, &(0x7f00000007c0)=[{&(0x7f0000000380)="b704ee9d685bdef1565e991eeb07c007a81af7ced96e9fbcf855d88a21dbb4a1f2653dd18367c8f404914d85a8cfc547b87bf23abacdc8e41db9607a94f6617f682d264413688b", 0x47}, {&(0x7f0000000400)="3fe3a3a70465018d6f66510bf4b02f53608791072afecedf59abfc74291a75baed28d67be03c956b10e2eeb57be2ca07d7fef7f46585c12d7c71939ff3919741216b05e112ab", 0x46}, {&(0x7f0000000500)="72bef51f42bcd387eaafff845220df654188287b3df95e6bccb67b8c8fffe4016650ebb37fac50e9457ba3c8040d", 0x2e}], 0x3) write(r0, &(0x7f0000001e00)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a060bc6c836862451c4e76fc9cb221db8d4b449c27aa44564cb33ef144ed0c51bdd66675302692d979297f30e2d9523f85afbbf54c5b5e2261f8b792f83b33cca78c44a5c4e6ff96273979acbb447d49c0502cc9f8991e9bc784a2e978912d8102d867b631d54269936f54bb20ee57e2b4ba4b6c44e767aef24f6c3a8bb5a3b2084d793082e4c5e517694b220e35ac140913e0e55257af03c4dcf376f24773642c14279e2b55906b0b8a4a34fa4d73f37a5feeca1cf93395b998ddcc557d0e2ae112cf1566f7097e7acb6c0bdf9350781341bb83936b355779417839a70c3cbe13e9561b0820df44dbd2a24bd3d6d8b0d9e83983cb7ad8f147f980b06be823e93a93395f5e60b7f31f5aeadc81f02e177446888c15d2845fd675b98360ac2f584a8ab618789499babac77e3311c563fa519a8dbbe49b91a46cc355f8e956c04dfc3b8e218dbe0302ff463fc94eceec7050b7477d9542f6d05d36ee13e664dfc0bb165601e6bd70615f3c299a9c7c7004cc9987a76afc54b3c83e5d23c0790f39593437b2592cf0548f21823f61076340a87dae9d3427acc844357d6bdbba726e7a41eb30a916df698ab241b5e4991f41d34afd2c2b99f259ca582f09c8027c3381e64070aad6ec7f7c7c973d55a33eca3cc4245bf488a497ac966aa13111ec3033172a3512e97700b3b58b621ccb71309d6ccafb05352718a362d14c38501ec45a522fb86563533d1f46e3fc182181ca5583096ec3849fb5db88ba0bcf565ec4665280402275fe98483a6c6b9da4665196aeff9b18c1e4fe3f19f1ff296702a10a27684a6cf0f9c003f", 0x3de) 5m51.628916589s ago: executing program 0 (id=2112): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mq_open(0x0, 0x42, 0x54, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='100000', 0x6) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_DETACH(0x1c, 0x0, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x5, 0xbc6c, 0x4936, 0xc2, 0x1, 0xffffffffffffffff, 0x6}, 0x50) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) 5m49.894303616s ago: executing program 6 (id=2115): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newsa={0x138, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in=@multicast1, @in=@multicast2, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in=@multicast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x192, 0xffffffffffffff3a, 0x0, 0x8251c, 0x2, 0xfffffffffffffff8, 0xe2e237c}, {0x9, 0x0, 0x20000001f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0xfff}, 0x70bd2a, 0x3504, 0x2, 0x1}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_connect(0x3, 0x9f, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b081000010000000109028d0001010080fa090400"], 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x2c, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r6) 5m47.740070346s ago: executing program 0 (id=2117): r0 = open(&(0x7f0000000040)='.\x00', 0x20000, 0x0) getdents64(r0, &(0x7f0000000fc0)=""/224, 0xe0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = getpid() r6 = syz_pidfd_open(r5, 0x0) setns(r6, 0x8020000) 5m46.502026913s ago: executing program 6 (id=2119): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000040)={0x11, 0x1, 0x0, "ad2896b02ca8b044d00dc81345c4b935bab32cecd875596364ab192cb8b873aa"}) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x920, 0x12) syz_clone3(0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x3801}, {0x2c}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x10000000}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 5m42.552259328s ago: executing program 0 (id=2122): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000040)={0x11, 0x1, 0x0, "ad2896b02ca8b044d00dc81345c4b935bab32cecd875596364ab192cb8b873aa"}) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x920, 0x12) ioctl$KVM_TDX_INIT_MEM_REGION(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000040)={0x3, 0x1, 0x0}) syz_clone3(0x0, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(0x0, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x3801}, {0x2c}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x10000000}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 5m39.988743162s ago: executing program 0 (id=2123): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000040)={0x11, 0x1, 0x0, "ad2896b02ca8b044d00dc81345c4b935bab32cecd875596364ab192cb8b873aa"}) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x920, 0x12) syz_clone3(0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(0x0, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x3801}, {0x2c}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x10000000}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 5m38.205732915s ago: executing program 0 (id=2124): r0 = open(&(0x7f0000000040)='.\x00', 0x20000, 0x0) getdents64(r0, &(0x7f0000000fc0)=""/224, 0xe0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = getpid() r6 = syz_pidfd_open(r5, 0x0) setns(r6, 0x8020000) 5m36.599820298s ago: executing program 0 (id=2127): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_DETACH(0x1c, 0x0, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x5, 0xbc6c, 0x4936, 0xc2, 0x1, r1, 0x6}, 0x50) connect$netlink(r1, &(0x7f00000000c0)=@kern={0x10, 0x0, 0x0, 0x1}, 0xc) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) 5m29.916588993s ago: executing program 35 (id=2119): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000040)={0x11, 0x1, 0x0, "ad2896b02ca8b044d00dc81345c4b935bab32cecd875596364ab192cb8b873aa"}) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x920, 0x12) syz_clone3(0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x3801}, {0x2c}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x10000000}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 5m21.011580129s ago: executing program 36 (id=2127): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_DETACH(0x1c, 0x0, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x5, 0xbc6c, 0x4936, 0xc2, 0x1, r1, 0x6}, 0x50) connect$netlink(r1, &(0x7f00000000c0)=@kern={0x10, 0x0, 0x0, 0x1}, 0xc) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) 2m45.117591406s ago: executing program 3 (id=2335): keyctl$setperm(0x5, 0x0, 0x120c0603) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) r1 = getpgrp(r0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x97) r5 = socket$alg(0x26, 0x5, 0x0) close(0x3) bind$alg(r5, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes-generic)\x00'}, 0x58) accept$alg(r5, 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r6) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r7, 0x405c5503, &(0x7f0000000440)={{0x0, 0x5, 0x0, 0x25}, 'syz0\x00', 0x53}) ioctl$UI_SET_EVBIT(r7, 0x40045564, 0x12) ioctl$UI_DEV_CREATE(r7, 0x5501) 2m38.128407492s ago: executing program 3 (id=2343): r0 = open(&(0x7f0000000040)='.\x00', 0x20000, 0x0) getdents64(r0, &(0x7f0000000fc0)=""/224, 0xe0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = getpid() r6 = syz_pidfd_open(r5, 0x0) setns(r6, 0x8020000) 2m31.343271117s ago: executing program 3 (id=2349): keyctl$setperm(0x5, 0x0, 0x120c0603) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) r1 = getpgrp(r0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x97) r6 = socket$alg(0x26, 0x5, 0x0) close(0x3) bind$alg(r6, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes-generic)\x00'}, 0x58) accept$alg(r6, 0x0, 0x0) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000440)={{0x0, 0x5, 0x0, 0x25}, 'syz0\x00', 0x53}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x12) ioctl$UI_DEV_CREATE(r8, 0x5501) close_range(r5, 0xffffffffffffffff, 0x0) 2m27.20227786s ago: executing program 3 (id=2355): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x7, 0x81}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000040)=0xff) mknodat(0xffffffffffffff9c, &(0x7f0000000800)='./loop0\x00', 0x6180, 0x700) mount(&(0x7f0000000040)=@filename='./loop0\x00', &(0x7f0000000300)='./file0\x00', &(0x7f0000000200)='xfs\x00', 0x85, 0x0) 2m23.08262164s ago: executing program 3 (id=2360): mkdirat(0xffffffffffffff9c, 0x0, 0xbd) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) unshare(0x8000000) r4 = syz_pidfd_open(0x0, 0x0) setns(r4, 0x8020000) 2m21.416359382s ago: executing program 3 (id=2363): socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x289c2, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000000c0), 0x6, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) unshare(0x6a040000) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x4, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, r5, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x1, 0x36, 0x0, 0x0, 0x1000, 0xffffffff, r1, 0x0, 0x28}}}, &(0x7f00000002c0)) r6 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0xffffffff}, 0x10) socket(0x1e, 0x4, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r8, 0x201, 0x400000, 0xffffffff, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x4008004}, 0x0) 2m6.104052678s ago: executing program 37 (id=2363): socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x289c2, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000000c0), 0x6, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) unshare(0x6a040000) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x4, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, r5, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x1, 0x36, 0x0, 0x0, 0x1000, 0xffffffff, r1, 0x0, 0x28}}}, &(0x7f00000002c0)) r6 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0xffffffff}, 0x10) socket(0x1e, 0x4, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r8, 0x201, 0x400000, 0xffffffff, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x4008004}, 0x0) 18.676428142s ago: executing program 2 (id=2488): openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x40101, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x4, [@var={0x2, 0x0, 0x0, 0x11, 0x3, 0xffffffff}, @const={0x0, 0x0, 0x0, 0x4}, @func_proto={0x2, 0x0, 0x0, 0x8, 0x2}]}, {0x0, [0x0, 0x61]}}, 0x0, 0x44}, 0x20) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r5, 0x0, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="020000000000000002000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e100"/108], 0x110) r6 = syz_open_dev$video4linux(&(0x7f0000001a80), 0x6e, 0x141602) writev(r6, &(0x7f0000002b80)=[{&(0x7f0000001ac0)="0e", 0x1}], 0x1) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00', 0x800, 0x0, 0x103, 0x1}, 0x20) ioctl$sock_FIOGETOWN(r5, 0x8903, 0x0) r7 = gettid() process_vm_writev(r7, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000000040)=[{&(0x7f0000217f28)=""/218, 0xe7}], 0x2f, 0x0) ptrace$getenv(0x4201, 0x0, 0x2, &(0x7f00000003c0)) syz_clone3(&(0x7f0000000500)={0x0, &(0x7f0000000000), &(0x7f0000000400), &(0x7f0000000140), {0x25}, &(0x7f0000000580)=""/109, 0x6d, &(0x7f00000002c0)=""/186, &(0x7f0000000480)}, 0x58) 15.497110089s ago: executing program 7 (id=2490): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) readv(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) fsopen(0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) open_by_handle_at(0xffffffffffffffff, &(0x7f00000002c0)=@ceph_nfs_confh={0x10, 0x2, {0x8, 0x6d1}}, 0x4f0a80) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000180)) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r4 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r4, 0xc0184800, &(0x7f0000000100)={0x20004, r3, 0x2}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r5}) connect$inet(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x4c840) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=@newtfilter={0x4c, 0x2c, 0xf3f, 0x30bd29, 0x25ffdbfd, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xf}, {0x0, 0xfff3}, {0x2, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_VLAN_ID={0x6, 0x17, 0xb8a}, @TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x88a8}, @TCA_FLOWER_KEY_VLAN_PRIO={0x5, 0x18, 0x4}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x4000000000003, 0x0, 0x9, 0x800, 0x6e6a, 0x2000000000000}, 0x0, &(0x7f0000000080)={0x5, 0x3, 0x5}, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xffff, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 12.774792728s ago: executing program 2 (id=2491): bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x6, 0xd, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x5c, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x48, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xffffffff}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) r4 = socket(0x2, 0x2, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xff}, 0x94) listen(r0, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r5, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000000), 0xffffff6a) sendfile(r5, r6, 0x0, 0x10ffffffff003) read(r5, &(0x7f0000000300)=""/192, 0xc0) connect$pppl2tp(r4, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x0, 0x4, 0x2, 0x3, {0xa, 0x4e22, 0x5, @loopback, 0xb712}}}, 0x32) 12.265648852s ago: executing program 7 (id=2492): socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x289c2, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000000c0), 0x6, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) unshare(0x6a040000) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x4, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, r5, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x1, 0x36, 0x0, 0x0, 0x1000, 0xffffffff, r1, 0x0, 0x28}}}, &(0x7f00000002c0)) r6 = socket(0x1e, 0x4, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmmsg(r6, &(0x7f0000003240), 0x4000000000000e4, 0x0) 9.291294126s ago: executing program 7 (id=2493): socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x289c2, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000000c0), 0x6, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) unshare(0x6a040000) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x4, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x1, 0x36, 0x0, 0x0, 0x1000, 0xffffffff, r1, 0x0, 0x28}}}, &(0x7f00000002c0)) r5 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0xffffffff}, 0x10) r6 = socket(0x1e, 0x4, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r8, 0x201, 0x400000, 0xffffffff, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x4008004}, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) 8.785704087s ago: executing program 2 (id=2494): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}, {0x0}], 0x2}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) socket(0x10, 0x803, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xffff0000, 0x0, 0xf000, 0xfd, 0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1}, {0x1, 0xddccb000, 0xa, 0x0, 0x0, 0x7, 0x2, 0x10, 0x0, 0x1}, {0x0, 0xb000, 0x18, 0x8, 0xc9, 0x4, 0x3, 0x5, 0x80, 0xe, 0x4, 0x6}, {0x10b002, 0x2000, 0xc, 0xfd, 0x80, 0x0, 0x3}, {0x1000, 0x0, 0xd, 0xfa, 0x70, 0x80, 0x0, 0x0, 0xfd, 0x1c, 0x7, 0xa8}, {0x100026fff, 0xcccd4000, 0xd, 0x4, 0x0, 0x8f, 0x0, 0xb, 0x6, 0xfc, 0x86, 0xfe}, {0xeeee8000, 0xe000, 0xb, 0x0, 0x5, 0x0, 0x0, 0x80, 0x3, 0x4, 0x7}, {0x100000, 0x41000, 0x3, 0x82, 0x0, 0x10, 0xe8, 0xe, 0x0, 0x0, 0x7}, {0x100000, 0x1}, {0x1, 0xfffe}, 0x10000, 0x0, 0x0, 0x10, 0x1, 0x800, 0x900, [0x17a, 0x0, 0x10000, 0x5]}) ioctl$KVM_SET_MSRS(r2, 0x4140aecd, &(0x7f0000000100)) r3 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r4, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) kexec_load(0x3, 0x0, 0x0, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x2) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000000)={0x600, 0x1000000}) 5.354595601s ago: executing program 7 (id=2495): socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x10) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0x4, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa35, 0x2, 0x1000002, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8197, 0x200, 0x3, 0xbaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8684, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 4.88354242s ago: executing program 2 (id=2496): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x88a00, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) sendfile(r4, r4, 0x0, 0x200000) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r3, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r3, 0x0, 0x10001, 0x0, 0xfdfffffe, 0xd6fe2, 0x1b3468}) sendmsg$nl_route(r0, 0x0, 0x4) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) r7 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f", 0x554, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000000)={r7}, &(0x7f0000000040)={'enc=', 'pkcs1', ' hash=', {'sha512\x00'}}, 0x0, &(0x7f0000000440)) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000080)={0x48, 0x2, r8}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000400)={0x28, 0x2, r8, 0x0, &(0x7f0000003000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r8, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r9, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x26}) close_range(r5, 0xffffffffffffffff, 0x0) r10 = socket$pptp(0x18, 0x1, 0x2) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000040)={r10, 0x7, 0x6f, 0x4}) 4.125389554s ago: executing program 2 (id=2497): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x40101, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x4, [@var={0x2, 0x0, 0x0, 0x11, 0x3, 0xffffffff}, @const={0x0, 0x0, 0x0, 0x4}, @func_proto={0x2, 0x0, 0x0, 0x8, 0x2}]}, {0x0, [0x0, 0x61]}}, 0x0, 0x44}, 0x20) r5 = socket$inet6(0xa, 0x2, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r6, 0x0, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="020000000000000002000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e100"/108], 0x110) r7 = syz_open_dev$video4linux(&(0x7f0000001a80), 0x6e, 0x141602) writev(r7, &(0x7f0000002b80)=[{&(0x7f0000001ac0)="0e", 0x1}], 0x1) ioctl$sock_FIOGETOWN(r6, 0x8903, 0x0) r8 = gettid() process_vm_writev(r8, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000000040)=[{&(0x7f0000217f28)=""/218, 0xe7}], 0x2f, 0x0) ptrace$getenv(0x4201, 0x0, 0x2, &(0x7f00000003c0)) sendmsg$inet6(r5, &(0x7f0000000100)={&(0x7f0000000040)={0xa, 0x4e24, 0x1, @loopback, 0x400}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=[@hopopts_2292={{0x60, 0x29, 0xb, {0x0, 0x8, '\x00', [@calipso={0x7, 0x40, {0xb1bbf2d6b755cdf8, 0xe, 0x0, 0x3, [0x7f, 0x0, 0x0, 0x1, 0x6, 0x200, 0x5]}}]}}}], 0x60}, 0xff00) dup(r0) 2.93039963s ago: executing program 2 (id=2498): socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000020c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x121302, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000d40)=@raw={'raw\x00', 0x9, 0x3, 0x1c8, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x228) syz_emit_ethernet(0x2a, &(0x7f0000000700)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000002080)='net/igmp\x00') read$FUSE(r2, &(0x7f0000000040)={0x2020}, 0x2020) preadv(r2, 0x0, 0x0, 0xffffffff, 0x34) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = dup(r3) write$UHID_INPUT(r4, &(0x7f0000004000)={0xf, {"a2e3ad21ed1909f91b50090987f70906d038e7ff7fc6e5539b0d3d0e8b089b33396d63060890e0878f0e1ac6e7049b334a959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a97376f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e8294265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b608a470c91555c70a803cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20877f7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f762413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95ff54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db082afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bd7c7dca9ffffffffa4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cd5f4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf62af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) 1.303900265s ago: executing program 7 (id=2499): sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x0) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) r4 = socket$inet6(0xa, 0x1, 0x0) r5 = dup2(r4, r4) ioctl$sock_inet6_SIOCDELRT(r5, 0x890c, &(0x7f00000000c0)={@remote, @private0, @empty, 0x40003, 0x40, 0x5, 0x0, 0x0, 0x590043}) 0s ago: executing program 7 (id=2500): socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x289c2, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000000c0), 0x6, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) unshare(0x6a040000) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x4, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, r5, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x1, 0x36, 0x0, 0x0, 0x1000, 0xffffffff, r1, 0x0, 0x28}}}, &(0x7f00000002c0)) r6 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0xffffffff}, 0x10) r7 = socket(0x1e, 0x4, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r9, 0x201, 0x400000, 0xffffffff, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x4008004}, 0x0) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) kernel console output (not intermixed with test programs): Number=3 [ 575.764598][ T5704] usb 8-1: Product: syz [ 575.764605][ T5704] usb 8-1: Manufacturer: syz [ 575.764612][ T5704] usb 8-1: SerialNumber: syz [ 575.891590][ T109] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 576.460237][ T5704] legousbtower 8-1:14.57: interrupt endpoints not found [ 576.715713][ T5704] legousbtower 8-1:14.228: get version request failed: -71 [ 576.715904][ T5704] legousbtower 8-1:14.228: probe with driver legousbtower failed with error -71 [ 576.760756][ T5704] usb 8-1: USB disconnect, device number 2 [ 577.184883][ T10] usb 3-1: USB disconnect, device number 27 [ 577.735450][ T5704] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 577.773528][ T10] usb 3-1: new full-speed USB device number 28 using dummy_hcd [ 577.946393][ T5704] usb 8-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 577.947946][ T5704] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 577.951853][ T10] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 577.952547][ T5704] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.952571][ T5704] usb 8-1: Product: syz [ 577.952585][ T5704] usb 8-1: Manufacturer: syz [ 577.952599][ T5704] usb 8-1: SerialNumber: syz [ 577.953492][ T10] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 577.960838][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.960864][ T10] usb 3-1: Product: syz [ 577.960877][ T10] usb 3-1: Manufacturer: syz [ 577.960890][ T10] usb 3-1: SerialNumber: syz [ 578.105985][ T5704] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 578.123905][ T10] usb 3-1: config 0 descriptor?? [ 579.842941][ T5704] gspca_mr97310a: reg write [21] error -71 [ 579.843016][ T5704] mr97310a 8-1:1.0: probe with driver mr97310a failed with error -71 [ 579.875275][ T5704] usb 8-1: USB disconnect, device number 3 [ 581.866170][ T5597] usb 3-1: USB disconnect, device number 28 [ 582.345384][ T5597] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 582.507250][ T5597] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 582.512872][ T5597] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 582.512889][ T5597] usb 3-1: Product: syz [ 582.512897][ T5597] usb 3-1: Manufacturer: syz [ 582.512904][ T5597] usb 3-1: SerialNumber: syz [ 582.732640][T12462] syzkaller0: entered promiscuous mode [ 582.732667][T12462] syzkaller0: entered allmulticast mode [ 584.076480][ T5597] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 584.076548][ T5597] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 584.078003][ T5597] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 584.078037][ T5597] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 584.096668][ T5597] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 584.170289][ T5597] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -32 [ 585.592578][ T5597] usb 3-1: USB disconnect, device number 29 [ 586.196269][T12487] ceph: No mds server is up or the cluster is laggy [ 586.374816][ T5734] libceph: connect (1)[c::]:6789 error -22 [ 586.375043][ T5734] libceph: mon0 (1)[c::]:6789 connect error [ 586.673616][ T5597] libceph: connect (1)[c::]:6789 error -22 [ 586.673821][ T5597] libceph: mon0 (1)[c::]:6789 connect error [ 587.188385][ T5704] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 587.336248][ T5704] usb 3-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 587.337852][ T5704] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 587.341936][ T5704] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 587.341964][ T5704] usb 3-1: Product: syz [ 587.341979][ T5704] usb 3-1: Manufacturer: syz [ 587.341994][ T5704] usb 3-1: SerialNumber: syz [ 587.436550][ T5704] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 587.706148][ T49] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 587.888666][ T49] usb 4-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 587.890093][ T49] usb 4-1: config 0 has no interfaces? [ 587.890129][ T49] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 587.952478][ T49] usb 4-1: config 0 descriptor?? [ 587.998222][ T5704] gspca_mr97310a: reg read [21] error -71 [ 587.998314][ T5704] mr97310a 3-1:1.0: probe with driver mr97310a failed with error -71 [ 588.026864][ T5704] usb 3-1: USB disconnect, device number 30 [ 588.141203][T12515] syzkaller0: entered promiscuous mode [ 588.141232][T12515] syzkaller0: entered allmulticast mode [ 588.245326][ T5704] usb 4-1: USB disconnect, device number 29 [ 593.975416][ T10] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 594.130757][ T10] usb 1-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 594.133266][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 594.133316][ T10] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 594.145127][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 594.145156][ T10] usb 1-1: Product: syz [ 594.145169][ T10] usb 1-1: Manufacturer: syz [ 594.145183][ T10] usb 1-1: SerialNumber: syz [ 594.264096][ T10] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 594.264153][ T10] gspca_mr97310a: reg write [21] error -22 [ 594.264199][ T10] mr97310a 1-1:1.0: probe with driver mr97310a failed with error -22 [ 594.605437][T11213] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 594.836254][T11213] usb 4-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 594.842908][T11213] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 594.877358][T11213] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 594.877386][T11213] usb 4-1: Product: syz [ 594.877394][T11213] usb 4-1: Manufacturer: syz [ 594.877401][T11213] usb 4-1: SerialNumber: syz [ 594.976872][T11213] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 595.569691][T11213] gspca_mr97310a: reg read [21] error -71 [ 595.569780][T11213] mr97310a 4-1:1.0: probe with driver mr97310a failed with error -71 [ 595.601711][T11213] usb 4-1: USB disconnect, device number 30 [ 597.406748][T11213] usb 1-1: USB disconnect, device number 42 [ 600.940693][ T5601] libceph: connect (1)[c::]:6789 error -101 [ 600.957922][ T5601] libceph: mon0 (1)[c::]:6789 connect error [ 601.006919][T12585] ceph: No mds server is up or the cluster is laggy [ 601.441416][T12596] netlink: 292 bytes leftover after parsing attributes in process `syz.2.1924'. [ 604.180910][T12625] tipc: Enabling of bearer rejected, already enabled [ 604.435662][ T5704] libceph: connect (1)[c::]:6789 error -101 [ 604.435849][ T5704] libceph: mon0 (1)[c::]:6789 connect error [ 604.475982][T12628] ceph: No mds server is up or the cluster is laggy [ 606.963048][T12125] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 607.851123][T12655] syzkaller0: entered promiscuous mode [ 607.851150][T12655] syzkaller0: entered allmulticast mode [ 608.196980][T12666] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1945'. [ 608.863639][T12656] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 608.980733][T12683] tipc: Enabling of bearer rejected, already enabled [ 610.125361][ T49] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 610.275363][ T5704] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 610.293047][ T49] usb 3-1: Using ep0 maxpacket: 32 [ 610.303064][ T49] usb 3-1: unable to get BOS descriptor or descriptor too short [ 610.303124][ T49] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 610.304611][ T49] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 610.304637][ T49] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 610.304657][ T49] usb 3-1: config 14 has no interface number 0 [ 610.304672][ T49] usb 3-1: config 14 has no interface number 1 [ 610.304742][ T49] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 610.304766][ T49] usb 3-1: config 14 interface 228 altsetting 5 has an invalid endpoint descriptor of length 5, skipping [ 610.304788][ T49] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 610.304815][ T49] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 610.304842][ T49] usb 3-1: config 14 interface 57 has no altsetting 0 [ 610.304871][ T49] usb 3-1: config 14 interface 228 has no altsetting 0 [ 611.780539][ T49] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 611.780568][ T49] usb 3-1: Product: syz [ 611.780583][ T49] usb 3-1: Manufacturer: syz [ 611.780598][ T49] usb 3-1: SerialNumber: syz [ 611.901317][ T5704] usb 7-1: device descriptor read/all, error -71 [ 611.956874][ T49] usb 3-1: can't set config #14, error -71 [ 611.977705][ T49] usb 3-1: USB disconnect, device number 31 [ 612.116013][T12699] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1956'. [ 612.465528][T12703] syzkaller0: entered promiscuous mode [ 612.465551][T12703] syzkaller0: entered allmulticast mode [ 617.235296][ T5608] Bluetooth: hci5: command 0x0406 tx timeout [ 617.434090][T12750] ceph: No mds server is up or the cluster is laggy [ 617.441264][ T10] libceph: connect (1)[c::]:6789 error -22 [ 617.441467][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 617.696876][ T10] libceph: connect (1)[c::]:6789 error -22 [ 618.769524][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 618.857397][T12757] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1967'. [ 619.505025][T10900] libceph: connect (1)[c::]:6789 error -22 [ 619.516553][T10900] libceph: mon0 (1)[c::]:6789 connect error [ 621.237117][T12771] device-mapper: table: 248:0: multipath: invalid number of feature args (-EINVAL) [ 621.237143][T12771] device-mapper: ioctl: error adding target to table [ 622.095360][ T31] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 622.258600][ T31] usb 3-1: Using ep0 maxpacket: 8 [ 622.259408][ T31] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 622.260606][ T31] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 622.260646][ T31] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 622.260657][ T31] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 622.260671][ T31] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 622.260683][ T31] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 622.260705][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 622.547863][ T31] usb 3-1: GET_CAPABILITIES returned 0 [ 622.547893][ T31] usbtmc 3-1:16.0: can't read capabilities [ 623.449633][ T10] usb 3-1: USB disconnect, device number 32 [ 624.363359][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.371140][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.638102][T12797] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 625.037183][T12806] zram: Cannot change disksize for initialized device [ 625.696648][T12820] netlink: 292 bytes leftover after parsing attributes in process `syz.2.1987'. [ 625.825436][ T10] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 625.927908][T12820] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 625.974808][T12827] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1988'. [ 625.985875][T12827] syzkaller1: entered promiscuous mode [ 625.988992][ T10] usb 7-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 625.989997][T12827] syzkaller1: entered allmulticast mode [ 625.990594][ T10] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 625.993366][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.993392][ T10] usb 7-1: Product: syz [ 625.993406][ T10] usb 7-1: Manufacturer: syz [ 625.993419][ T10] usb 7-1: SerialNumber: syz [ 626.073289][ T10] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 628.523445][ T10] gspca_mr97310a: reg read [21] error -110 [ 628.523547][ T10] mr97310a 7-1:1.0: probe with driver mr97310a failed with error -110 [ 628.596396][ T10] usb 7-1: USB disconnect, device number 4 [ 634.393399][T12864] netlink: 292 bytes leftover after parsing attributes in process `syz.6.1999'. [ 635.745650][ T5734] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 635.817065][T12884] netlink: 88 bytes leftover after parsing attributes in process `syz.0.2003'. [ 635.853500][T12883] syzkaller1: entered promiscuous mode [ 635.853527][T12883] syzkaller1: entered allmulticast mode [ 635.896167][ T5734] usb 7-1: Using ep0 maxpacket: 32 [ 635.898265][ T5734] usb 7-1: unable to get BOS descriptor or descriptor too short [ 635.898302][ T5734] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 635.899454][ T5734] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 635.899469][ T5734] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 635.899479][ T5734] usb 7-1: config 14 has no interface number 0 [ 635.899488][ T5734] usb 7-1: config 14 has no interface number 1 [ 635.899628][ T5734] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 635.899642][ T5734] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 635.899656][ T5734] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 635.899669][ T5734] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 635.899683][ T5734] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 635.899697][ T5734] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 635.899710][ T5734] usb 7-1: config 14 interface 57 has no altsetting 0 [ 635.899720][ T5734] usb 7-1: config 14 interface 228 has no altsetting 0 [ 635.902075][ T5734] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 635.902098][ T5734] usb 7-1: Product: syz [ 635.902112][ T5734] usb 7-1: Manufacturer: syz [ 635.902125][ T5734] usb 7-1: SerialNumber: syz [ 636.533342][ T5734] legousbtower 7-1:14.57: interrupt endpoints not found [ 636.836077][ T5734] legousbtower 7-1:14.228: get version request failed: -71 [ 636.836192][ T5734] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 636.904400][ T5734] usb 7-1: USB disconnect, device number 5 [ 637.757621][T12892] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2005'. [ 637.949247][T12898] zram: Cannot change disksize for initialized device [ 638.238270][ T67] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 639.617512][T12926] netlink: 88 bytes leftover after parsing attributes in process `syz.3.2014'. [ 639.618781][T12926] syzkaller1: entered promiscuous mode [ 639.618804][T12926] syzkaller1: entered allmulticast mode [ 643.114606][T12952] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 644.208860][ T5704] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 644.385314][ T5704] usb 8-1: Using ep0 maxpacket: 8 [ 644.386137][ T5704] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 644.468976][ T5704] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 644.469007][ T5704] usb 8-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 644.469048][ T5704] usb 8-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 644.469086][ T5704] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 644.570773][ T5704] usbtmc 8-1:16.0: bulk endpoints not found [ 646.958378][ T5734] usb 8-1: USB disconnect, device number 4 [ 652.033609][ T5595] Bluetooth: hci1: command 0x0406 tx timeout [ 657.235392][ T5734] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 657.410399][ T5734] usb 3-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 657.411890][ T5734] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 657.411944][ T5734] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 657.473527][ T5734] ttusb_dec_send_command: command bulk message failed: error -22 [ 657.473761][ T5734] ttusb-dec 3-1:1.0: probe with driver ttusb-dec failed with error -22 [ 657.696356][ T10] usb 3-1: USB disconnect, device number 33 [ 658.725512][ T5734] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 658.876247][ T5734] usb 8-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 658.877728][ T5734] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 658.877783][ T5734] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 658.877805][ T5734] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 658.881281][ T5734] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 658.881305][ T5734] usb 8-1: Product: syz [ 658.881326][ T5734] usb 8-1: Manufacturer: syz [ 658.881340][ T5734] usb 8-1: SerialNumber: syz [ 658.972259][ T5734] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 658.972413][ T5734] gspca_mr97310a: reg write [21] error -90 [ 658.972499][ T5734] mr97310a 8-1:1.0: probe with driver mr97310a failed with error -90 [ 659.450528][T13088] debugfs: out of free dentries, can not create directory '13088-6' [ 661.255336][ T5734] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 661.420164][ T5734] usb 3-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 661.421682][ T5734] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 661.421739][ T5734] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 661.480741][ T5734] ttusb_dec_send_command: command bulk message failed: error -22 [ 661.481620][ T5734] ttusb-dec 3-1:1.0: probe with driver ttusb-dec failed with error -22 [ 661.585459][ T49] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 662.754109][ T5734] usb 3-1: USB disconnect, device number 34 [ 662.823292][ T49] usb 7-1: Using ep0 maxpacket: 32 [ 662.841612][ T49] usb 7-1: unable to get BOS descriptor or descriptor too short [ 662.841671][ T49] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 662.843487][ T49] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 662.843512][ T49] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 662.843532][ T49] usb 7-1: config 14 has no interface number 0 [ 662.843547][ T49] usb 7-1: config 14 has no interface number 1 [ 662.843612][ T49] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 662.843637][ T49] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 662.843661][ T49] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 662.843687][ T49] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 662.843711][ T49] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 662.843736][ T49] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 662.843762][ T49] usb 7-1: config 14 interface 57 has no altsetting 0 [ 662.843778][ T49] usb 7-1: config 14 interface 228 has no altsetting 0 [ 662.886232][ T49] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.886261][ T49] usb 7-1: Product: syz [ 662.886275][ T49] usb 7-1: Manufacturer: syz [ 662.886289][ T49] usb 7-1: SerialNumber: syz [ 664.657371][ T5734] usb 8-1: USB disconnect, device number 5 [ 664.814082][ T49] legousbtower 7-1:14.57: interrupt endpoints not found [ 664.826182][ T49] legousbtower 7-1:14.228: get version request failed: -71 [ 664.826368][ T49] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 664.853005][ T49] usb 7-1: USB disconnect, device number 6 [ 669.771533][ T2923] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 671.475362][ T5734] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 671.629253][ T5734] usb 8-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 671.630317][ T5734] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 671.630348][ T5734] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 671.702953][ T5734] ttusb_dec_send_command: command bulk message failed: error -22 [ 671.703183][ T5734] ttusb-dec 8-1:1.0: probe with driver ttusb-dec failed with error -22 [ 671.913647][ T5734] usb 8-1: USB disconnect, device number 6 [ 679.205343][ T5918] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 679.356148][ T5918] usb 3-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 679.358620][ T5918] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 679.358675][ T5918] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 679.597294][ T5918] ttusb_dec_send_command: command bulk message failed: error -22 [ 679.597511][ T5918] ttusb-dec 3-1:1.0: probe with driver ttusb-dec failed with error -22 [ 679.696494][ T5918] usb 3-1: USB disconnect, device number 35 [ 679.906830][T13196] syz.3.2090 invoked oom-killer: gfp_mask=0x402cc0(GFP_KERNEL_ACCOUNT|__GFP_NOWARN), order=0, oom_score_adj=1000 [ 679.906881][T13196] CPU: 0 UID: 0 PID: 13196 Comm: syz.3.2090 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 679.906910][T13196] Tainted: [L]=SOFTLOCKUP [ 679.906917][T13196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 679.906930][T13196] Call Trace: [ 679.906938][T13196] [ 679.906948][T13196] dump_stack_lvl+0xe8/0x150 [ 679.906984][T13196] dump_header+0xd3/0x4b0 [ 679.907014][T13196] oom_kill_process+0x3ab/0x9e0 [ 679.907040][T13196] out_of_memory+0x1064/0x1480 [ 679.907075][T13196] ? __pfx_out_of_memory+0x10/0x10 [ 679.907096][T13196] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 679.907119][T13196] ? _mutex_lock_killable+0x152/0x1d0 [ 679.907148][T13196] ? try_charge_memcg+0xcc3/0x16f0 [ 679.907170][T13196] try_charge_memcg+0xd82/0x16f0 [ 679.907207][T13196] ? __pfx_try_charge_memcg+0x10/0x10 [ 679.907235][T13196] ? percpu_ref_tryget+0x15/0x180 [ 679.907269][T13196] ? __obj_cgroup_charge+0x36/0x2c0 [ 679.907304][T13196] __obj_cgroup_charge+0x1fd/0x2c0 [ 679.907334][T13196] ? __obj_cgroup_charge+0x36/0x2c0 [ 679.907368][T13196] __memcg_slab_post_alloc_hook+0x7a2/0xde0 [ 679.907422][T13196] __kmalloc_node_noprof+0x5e7/0x7b0 [ 679.907452][T13196] ? __alloc+0x54/0x170 [ 679.907470][T13196] ? __alloc+0x54/0x170 [ 679.907496][T13196] __alloc+0x54/0x170 [ 679.907517][T13196] alloc_bulk+0x4ea/0x7f0 [ 679.907548][T13196] bpf_mem_alloc_init+0x4bb/0xd80 [ 679.907591][T13196] htab_map_alloc+0x8a5/0xc90 [ 679.907621][T13196] map_create+0x1111/0x1e20 [ 679.907663][T13196] ? __pfx_map_create+0x10/0x10 [ 679.907705][T13196] ? bpf_lsm_bpf+0x9/0x20 [ 679.907728][T13196] ? security_bpf+0x7e/0x2d0 [ 679.907821][T13196] __sys_bpf+0xaea/0xd90 [ 679.907860][T13196] ? __pfx___sys_bpf+0x10/0x10 [ 679.907896][T13196] ? do_futex+0x3e7/0x4e0 [ 679.907953][T13196] ? rcu_is_watching+0x16/0xb0 [ 679.907993][T13196] __x64_sys_bpf+0xba/0xd0 [ 679.908024][T13196] do_syscall_64+0x166/0x520 [ 679.908048][T13196] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 679.908069][T13196] ? clear_bhb_loop+0x70/0xc0 [ 679.908095][T13196] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 679.908116][T13196] RIP: 0033:0x7fa672eae199 [ 679.908137][T13196] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 679.908155][T13196] RSP: 002b:00007fa6710e5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 679.908178][T13196] RAX: ffffffffffffffda RBX: 00007fa673136090 RCX: 00007fa672eae199 [ 679.908195][T13196] RDX: 0000000000000050 RSI: 0000200000000400 RDI: 0000000000000000 [ 679.908209][T13196] RBP: 00007fa672f450b8 R08: 0000000000000000 R09: 0000000000000000 [ 679.908222][T13196] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 679.908235][T13196] R13: 00007fa673136128 R14: 00007fa673136090 R15: 00007fff72f28358 [ 679.908269][T13196] [ 679.910147][T13196] memory: usage 96kB, limit 96kB, failcnt 144 [ 679.910167][T13196] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 679.910183][T13196] kmem: usage 80kB, limit 9007199254740988kB, failcnt 0 [ 679.910197][T13196] Memory cgroup stats for /syz3/test: [ 679.910822][T13196] cache 0 [ 679.910833][T13196] rss 0 [ 679.910840][T13196] shmem 0 [ 679.910847][T13196] mapped_file 0 [ 679.910855][T13196] dirty 0 [ 679.910862][T13196] writeback 0 [ 679.910869][T13196] workingset_refault_anon 0 [ 679.910877][T13196] workingset_refault_file 0 [ 679.910885][T13196] swap 0 [ 679.910892][T13196] swapcached 0 [ 679.910899][T13196] pgpgin 0 [ 679.910906][T13196] pgpgout 0 [ 679.910913][T13196] pgfault 8 [ 679.910920][T13196] pgmajfault 0 [ 679.910926][T13196] inactive_anon 0 [ 679.910934][T13196] active_anon 0 [ 679.910942][T13196] inactive_file 0 [ 679.910949][T13196] active_file 0 [ 679.910956][T13196] unevictable 0 [ 679.910963][T13196] hierarchical_memory_limit 98304 [ 679.910972][T13196] hierarchical_memsw_limit 9223372036854771712 [ 679.910981][T13196] total_cache 0 [ 679.910988][T13196] total_rss 0 [ 679.910995][T13196] total_shmem 0 [ 679.911002][T13196] total_mapped_file 0 [ 679.911009][T13196] total_dirty 0 [ 679.911017][T13196] total_writeback 0 [ 679.911024][T13196] total_workingset_refault_anon 0 [ 679.911033][T13196] total_workingset_refault_file 0 [ 679.911041][T13196] total_swap 0 [ 679.911048][T13196] total_swapcached 0 [ 679.911055][T13196] total_pgpgin 0 [ 679.911063][T13196] total_pgpgout 0 [ 679.911070][T13196] total_pgfault 8 [ 679.911078][T13196] total_pgmajfault 0 [ 679.911086][T13196] total_inactive_anon 0 [ 679.911093][T13196] total_active_anon 0 [ 679.911101][T13196] total_inactive_file 0 [ 679.911109][T13196] total_active_file 0 [ 679.911116][T13196] total_unevictable 0 [ 679.911123][T13196] anon_cost 0 [ 679.911130][T13196] file_cost 0 [ 679.911138][T13196] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.2090,pid=13192,uid=0 [ 680.550463][T13196] Memory cgroup out of memory: Killed process 13192 (syz.3.2090) total-vm:202876kB, anon-rss:1432kB, file-rss:21676kB, shmem-rss:1756kB, UID:0 pgtables:132kB oom_score_adj:1000 [ 682.395329][ T5601] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 682.546715][ T5601] usb 8-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 682.547779][ T5601] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 682.547811][ T5601] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 682.646881][ T5601] ttusb_dec_send_command: command bulk message failed: error -22 [ 682.647115][ T5601] ttusb-dec 8-1:1.0: probe with driver ttusb-dec failed with error -22 [ 683.103869][ T5601] usb 8-1: USB disconnect, device number 7 [ 684.020813][ T49] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 684.172083][ T49] usb 1-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 684.173641][ T49] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 684.173697][ T49] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 684.278498][ T49] ttusb_dec_send_command: command bulk message failed: error -22 [ 684.278736][ T49] ttusb-dec 1-1:1.0: probe with driver ttusb-dec failed with error -22 [ 684.458576][ T5918] usb 1-1: USB disconnect, device number 43 [ 685.523580][T13223] debugfs: out of free dentries, can not create directory '13223-6' [ 685.790054][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.790125][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 687.301811][T13236] debugfs: out of free dentries, can not create directory '13236-6' [ 688.219315][T13240] debugfs: out of free dentries, can not create file 'insn_emulation_fail' [ 690.369098][ T38] oom_reaper: reaped process 13240 (syz.7.2099), now anon-rss:0kB, file-rss:20684kB, shmem-rss:5344kB [ 693.198889][ T5918] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 693.204470][T13261] syz.0.2112 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 693.204507][T13261] CPU: 0 UID: 0 PID: 13261 Comm: syz.0.2112 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 693.204533][T13261] Tainted: [L]=SOFTLOCKUP [ 693.204539][T13261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 693.204550][T13261] Call Trace: [ 693.204558][T13261] [ 693.204567][T13261] dump_stack_lvl+0xe8/0x150 [ 693.204598][T13261] dump_header+0xd3/0x4b0 [ 693.204629][T13261] oom_kill_process+0x3ab/0x9e0 [ 693.204654][T13261] out_of_memory+0x1064/0x1480 [ 693.204687][T13261] ? __pfx_out_of_memory+0x10/0x10 [ 693.204707][T13261] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 693.204729][T13261] ? _mutex_lock_killable+0x152/0x1d0 [ 693.204755][T13261] ? try_charge_memcg+0xcc3/0x16f0 [ 693.204778][T13261] try_charge_memcg+0xd82/0x16f0 [ 693.204817][T13261] ? __pfx_try_charge_memcg+0x10/0x10 [ 693.204843][T13261] ? percpu_ref_tryget+0x15/0x180 [ 693.204875][T13261] ? __memcg_kmem_charge_page+0x182/0x560 [ 693.204906][T13261] __memcg_kmem_charge_page+0x358/0x560 [ 693.204931][T13261] ? __memcg_kmem_charge_page+0x182/0x560 [ 693.204960][T13261] memcg_charge_kernel_stack+0xf6/0x4c0 [ 693.204978][T13261] ? dup_task_struct+0x1cd/0xa00 [ 693.205005][T13261] dup_task_struct+0x1e8/0xa00 [ 693.205030][T13261] ? rt_spin_unlock+0x165/0x200 [ 693.205058][T13261] copy_process+0x7e0/0x4410 [ 693.205086][T13261] ? try_to_take_rt_mutex+0x842/0xb00 [ 693.205123][T13261] ? lock_acquire+0x115/0x350 [ 693.205162][T13261] ? __pfx_copy_process+0x10/0x10 [ 693.205188][T13261] ? __asan_memset+0x22/0x50 [ 693.205215][T13261] kernel_clone+0x2d2/0x8d0 [ 693.205243][T13261] ? __pfx_kernel_clone+0x10/0x10 [ 693.205278][T13261] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 693.205307][T13261] __se_sys_clone3+0x33c/0x360 [ 693.205336][T13261] ? __pfx___se_sys_clone3+0x10/0x10 [ 693.205385][T13261] ? _copy_to_user+0x8a/0xb0 [ 693.205418][T13261] ? do_user_addr_fault+0xc4c/0x1340 [ 693.205450][T13261] do_syscall_64+0x166/0x520 [ 693.205469][T13261] ? trace_irq_disable+0x3b/0x140 [ 693.205493][T13261] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.205513][T13261] ? clear_bhb_loop+0x70/0xc0 [ 693.205536][T13261] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.205554][T13261] RIP: 0033:0x7f3a9fbfef89 [ 693.205573][T13261] Code: 90 b8 01 00 00 00 b9 01 00 00 00 eb ec 0f 1f 40 00 b8 ea ff ff ff 48 85 ff 74 28 48 85 d2 74 23 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 14 74 01 c3 31 ed 4c 89 c7 ff d2 48 89 c7 b8 3c 00 00 [ 693.205588][T13261] RSP: 002b:00007ffc0842adf8 EFLAGS: 00000202 ORIG_RAX: 00000000000001b3 [ 693.205608][T13261] RAX: ffffffffffffffda RBX: 00007f3a9fbba520 RCX: 00007f3a9fbfef89 [ 693.205622][T13261] RDX: 00007f3a9fbba520 RSI: 0000000000000058 RDI: 00007ffc0842ae50 [ 693.205634][T13261] RBP: 00007f3a9de356c0 R08: 00007f3a9de356c0 R09: 00007ffc0842af37 [ 693.205647][T13261] R10: 0000000000000008 R11: 0000000000000202 R12: ffffffffffffffe8 [ 693.205659][T13261] R13: 000000000000006e R14: 00007ffc0842ae50 R15: 00007ffc0842af38 [ 693.205690][T13261] [ 694.884858][ T5918] usb 4-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 694.887041][ T5918] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 694.887094][ T5918] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 695.005461][ T5918] usb 4-1: can't set config #1, error -71 [ 695.008128][T13261] memory: usage 96kB, limit 96kB, failcnt 67 [ 695.008148][T13261] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 695.008160][T13261] kmem: usage 92kB, limit 9007199254740988kB, failcnt 0 [ 695.008172][T13261] Memory cgroup stats for /syz0/test: [ 695.008285][T13261] cache 0 [ 695.008293][T13261] rss 4096 [ 695.008299][T13261] shmem 0 [ 695.008304][T13261] mapped_file 0 [ 695.008310][T13261] dirty 0 [ 695.008316][T13261] writeback 0 [ 695.008322][T13261] workingset_refault_anon 0 [ 695.008328][T13261] workingset_refault_file 0 [ 695.008335][T13261] swap 0 [ 695.008341][T13261] swapcached 0 [ 695.008347][T13261] pgpgin 1 [ 695.008353][T13261] pgpgout 0 [ 695.008359][T13261] pgfault 14 [ 695.008364][T13261] pgmajfault 0 [ 695.008370][T13261] inactive_anon 0 [ 695.008375][T13261] active_anon 0 [ 695.008381][T13261] inactive_file 0 [ 695.008387][T13261] active_file 0 [ 695.008393][T13261] unevictable 0 [ 695.008399][T13261] hierarchical_memory_limit 98304 [ 695.008406][T13261] hierarchical_memsw_limit 9223372036854771712 [ 695.008414][T13261] total_cache 0 [ 695.008420][T13261] total_rss 4096 [ 695.008425][T13261] total_shmem 0 [ 695.008431][T13261] total_mapped_file 0 [ 695.008437][T13261] total_dirty 0 [ 695.008443][T13261] total_writeback 0 [ 695.008449][T13261] total_workingset_refault_anon 0 [ 695.008456][T13261] total_workingset_refault_file 0 [ 695.008462][T13261] total_swap 0 [ 695.008467][T13261] total_swapcached 0 [ 695.008472][T13261] total_pgpgin 1 [ 695.008478][T13261] total_pgpgout 0 [ 695.008485][T13261] total_pgfault 14 [ 695.008491][T13261] total_pgmajfault 0 [ 695.008497][T13261] total_inactive_anon 0 [ 695.008503][T13261] total_active_anon 0 [ 695.008509][T13261] total_inactive_file 0 [ 695.008516][T13261] total_active_file 0 [ 695.008522][T13261] total_unevictable 0 [ 695.008527][T13261] anon_cost 0 [ 695.008533][T13261] file_cost 0 [ 695.008539][T13261] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.2112,pid=13261,uid=0 [ 695.008647][T13261] Memory cgroup out of memory: Killed process 13261 (syz.0.2112) total-vm:202744kB, anon-rss:1432kB, file-rss:21648kB, shmem-rss:4kB, UID:0 pgtables:132kB oom_score_adj:1000 [ 695.011301][ T5918] usb 4-1: USB disconnect, device number 31 [ 695.445349][ T5734] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 695.615458][ T5734] usb 7-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 695.622201][ T5734] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 695.622354][ T5734] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 697.483123][ T5734] usb 7-1: can't set config #1, error -71 [ 698.582102][ T5734] usb 7-1: USB disconnect, device number 7 [ 699.207281][T13293] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2120'. [ 702.172073][ T67] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 709.506517][ T5918] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 709.865360][ T5734] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 710.016212][ T5734] usb 4-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 710.017629][ T5734] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 710.017683][ T5734] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 710.037458][ T5734] ttusb_dec_send_command: command bulk message failed: error -22 [ 710.037673][ T5734] ttusb-dec 4-1:1.0: probe with driver ttusb-dec failed with error -22 [ 710.264179][ T5734] usb 4-1: USB disconnect, device number 32 [ 715.310786][ T5595] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 715.324293][ T5595] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 715.389374][ T5595] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 715.419042][ T5595] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 715.434970][ T5595] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 717.625464][ T5595] Bluetooth: hci0: command tx timeout [ 719.715274][ T5595] Bluetooth: hci0: command tx timeout [ 721.787895][ T5595] Bluetooth: hci0: command tx timeout [ 723.833391][ T5608] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 723.873599][T10900] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 723.875512][ T5608] Bluetooth: hci0: command tx timeout [ 723.875901][ T5608] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 723.901830][ T5608] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 723.908615][ T5608] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 723.912541][ T5608] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 724.080912][T10900] usb 4-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 724.082368][T10900] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 724.082430][T10900] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 724.122543][T10900] ttusb_dec_send_command: command bulk message failed: error -22 [ 724.122770][T10900] ttusb-dec 4-1:1.0: probe with driver ttusb-dec failed with error -22 [ 725.333665][T10900] usb 4-1: USB disconnect, device number 33 [ 725.782632][ T5597] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 725.969148][T12125] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 726.002470][ T5597] usb 3-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 726.011417][ T5597] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 726.011473][ T5597] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 726.078660][ T5597] ttusb_dec_send_command: command bulk message failed: error -22 [ 726.078889][ T5597] ttusb-dec 3-1:1.0: probe with driver ttusb-dec failed with error -22 [ 726.105581][ T5595] Bluetooth: hci5: command tx timeout [ 726.232081][ T5597] usb 3-1: USB disconnect, device number 36 [ 728.185336][ T5595] Bluetooth: hci5: command tx timeout [ 728.746559][T12125] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 729.365098][T12125] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 730.052118][T12125] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 730.114241][T13410] debugfs: out of free dentries, can not create directory '13410-7' [ 730.267187][ T5595] Bluetooth: hci5: command tx timeout [ 732.025429][ T5918] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 732.145281][T13344] bridge0: port 1(bridge_slave_0) entered blocking state [ 732.145399][T13344] bridge0: port 1(bridge_slave_0) entered disabled state [ 732.145598][T13344] bridge_slave_0: entered allmulticast mode [ 732.176012][ T5918] usb 4-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 732.186619][ T5918] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 732.186675][ T5918] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.225490][ T5918] ttusb_dec_send_command: command bulk message failed: error -22 [ 732.225631][ T5918] ttusb-dec 4-1:1.0: probe with driver ttusb-dec failed with error -22 [ 732.235092][T13344] bridge_slave_0: entered promiscuous mode [ 732.274524][T13344] bridge0: port 2(bridge_slave_1) entered blocking state [ 732.274595][T13344] bridge0: port 2(bridge_slave_1) entered disabled state [ 732.274723][T13344] bridge_slave_1: entered allmulticast mode [ 732.308505][T13344] bridge_slave_1: entered promiscuous mode [ 732.349251][ T5595] Bluetooth: hci5: command tx timeout [ 732.415578][ T5918] usb 4-1: USB disconnect, device number 34 [ 733.105769][T13344] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 733.118944][ T12] IPVS: starting estimator thread 0... [ 733.255539][T13441] IPVS: using max 8 ests per chain, 19200 per kthread [ 733.553199][T13344] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 733.995524][ T12] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 734.100570][T13344] team0: Port device team_slave_0 added [ 734.129525][T13344] team0: Port device team_slave_1 added [ 734.343178][ T49] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 734.410913][T12125] bridge_slave_1: left allmulticast mode [ 734.410948][T12125] bridge_slave_1: left promiscuous mode [ 734.411179][T12125] bridge0: port 2(bridge_slave_1) entered disabled state [ 734.510657][ T49] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 734.648518][T12125] bridge_slave_0: left allmulticast mode [ 734.648556][T12125] bridge_slave_0: left promiscuous mode [ 734.648820][T12125] bridge0: port 1(bridge_slave_0) entered disabled state [ 735.445314][ T5601] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 735.618512][ T5601] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 735.623639][ T5601] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 52, changing to 7 [ 735.623675][ T5601] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 9272, setting to 1024 [ 735.623718][ T5601] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 735.723750][ T5601] usb 4-1: config 0 descriptor?? [ 736.008521][ T5601] ath6kl: Failed to submit usb control message: -71 [ 736.008577][ T5601] ath6kl: unable to send the bmi data to the device: -71 [ 736.008592][ T5601] ath6kl: Unable to send get target info: -71 [ 736.111391][ T5601] ath6kl: Failed to init ath6kl core: -71 [ 736.113690][ T5601] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 736.127990][ T5601] usb 4-1: USB disconnect, device number 35 [ 736.416017][T12125] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 736.526623][T12125] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 736.567756][T12125] bond0 (unregistering): Released all slaves [ 736.765282][T13344] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 736.765300][T13344] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 736.765326][T13344] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 736.820515][T13344] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 736.820526][T13344] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 736.820544][T13344] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 737.251884][T13344] hsr_slave_0: entered promiscuous mode [ 737.252720][T13344] hsr_slave_1: entered promiscuous mode [ 737.253236][T13344] debugfs: 'hsr0' already exists in 'hsr' [ 737.253261][T13344] Cannot create hsr debugfs directory [ 737.655582][T13378] bridge0: port 1(bridge_slave_0) entered blocking state [ 737.656024][T13378] bridge0: port 1(bridge_slave_0) entered disabled state [ 737.656237][T13378] bridge_slave_0: entered allmulticast mode [ 737.702513][T13378] bridge_slave_0: entered promiscuous mode [ 737.753809][T13491] netlink: 292 bytes leftover after parsing attributes in process `syz.7.2156'. [ 738.029548][T13378] bridge0: port 2(bridge_slave_1) entered blocking state [ 738.029619][T13378] bridge0: port 2(bridge_slave_1) entered disabled state [ 738.029753][T13378] bridge_slave_1: entered allmulticast mode [ 738.033303][T13378] bridge_slave_1: entered promiscuous mode [ 738.045463][T10900] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 738.379605][T10900] usb 4-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 738.537714][T10900] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 738.537770][T10900] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 738.859191][T10900] ttusb_dec_send_command: command bulk message failed: error -22 [ 738.859371][T10900] ttusb-dec 4-1:1.0: probe with driver ttusb-dec failed with error -22 [ 739.171997][T13499] debugfs: out of free dentries, can not create directory '13499-7' [ 739.178910][T13378] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 739.195313][ T49] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 739.231290][T13378] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 739.420291][ T49] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 739.425490][ T49] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 52, changing to 7 [ 739.425512][ T49] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 9272, setting to 1024 [ 739.425536][ T49] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 739.430384][ T49] usb 8-1: config 0 descriptor?? [ 739.641313][ T49] ath6kl: Failed to submit usb control message: -71 [ 739.641363][ T49] ath6kl: unable to send the bmi data to the device: -71 [ 739.641378][ T49] ath6kl: Unable to send get target info: -71 [ 739.716182][ T49] ath6kl: Failed to init ath6kl core: -71 [ 739.720916][ T49] ath6kl_usb 8-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 739.721492][T10900] usb 4-1: USB disconnect, device number 36 [ 739.723558][T13378] team0: Port device team_slave_0 added [ 739.949877][ T49] usb 8-1: USB disconnect, device number 9 [ 740.163649][T13513] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2158'. [ 742.162949][T13378] team0: Port device team_slave_1 added [ 742.264613][ T5249] 8021q: adding VLAN 0 to HW filter on device eth13 [ 742.671815][T13378] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 742.671834][T13378] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 742.671860][T13378] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 742.760590][T13378] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 742.760610][T13378] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 742.760637][T13378] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 743.035562][T12125] hsr_slave_0: left promiscuous mode [ 743.102229][T12125] hsr_slave_1: left promiscuous mode [ 743.110099][T12125] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 743.110126][T12125] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 743.156538][T12125] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 743.156568][T12125] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 743.342489][T12125] veth1_macvtap: left promiscuous mode [ 743.342596][T12125] veth0_macvtap: left promiscuous mode [ 743.342865][T12125] veth1_vlan: left promiscuous mode [ 743.343051][T12125] veth0_vlan: left promiscuous mode [ 743.385907][ T5601] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 743.557067][ T5601] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 743.559564][ T5601] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 52, changing to 7 [ 743.559583][ T5601] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 9272, setting to 1024 [ 743.559607][ T5601] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 743.562460][ T5601] usb 3-1: config 0 descriptor?? [ 744.262416][ T5601] ath6kl: Failed to submit usb control message: -71 [ 744.262446][ T5601] ath6kl: unable to send the bmi data to the device: -71 [ 744.262454][ T5601] ath6kl: Unable to send get target info: -71 [ 744.264532][ T5601] ath6kl: Failed to init ath6kl core: -71 [ 744.267317][ T5601] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 744.389092][ T5601] usb 3-1: USB disconnect, device number 37 [ 744.973186][T13551] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2167'. [ 745.617727][T12125] team0 (unregistering): Port device team_slave_1 removed [ 745.696273][T12125] team0 (unregistering): Port device team_slave_0 removed [ 745.987647][T13550] ªªªªª): renamed from hsr0 (while UP) [ 746.037916][T13551] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2167'. [ 746.379262][T13378] hsr_slave_0: entered promiscuous mode [ 746.383436][T13378] hsr_slave_1: entered promiscuous mode [ 747.231552][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.231622][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.544498][T13568] debugfs: out of free dentries, can not create file 'io_exits' [ 748.667342][T13568] debugfs: out of free dentries, can not create file 'mmio_exits' [ 748.726010][T13568] debugfs: out of free dentries, can not create file 'signal_exits' [ 748.868769][ T5249] 8021q: adding VLAN 0 to HW filter on device eth14 [ 748.974926][T13344] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 749.022154][T13596] kvm [13595]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x100000080 [ 749.113628][T13344] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 749.117948][T13344] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 749.312511][T13344] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 749.327337][T13603] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2176'. [ 749.327391][T13603] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2176'. [ 749.347739][T13603] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2176'. [ 749.347773][T13603] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2176'. [ 749.373975][T13344] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 749.737745][T13344] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 749.934890][T13606] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2177'. [ 749.975982][T13344] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 750.011077][T13344] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 751.992237][T13629] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2181'. [ 752.065427][T10900] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 752.226676][T10900] usb 8-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 752.227865][T10900] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 752.232447][T10900] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 752.232475][T10900] usb 8-1: Product: syz [ 752.232489][T10900] usb 8-1: Manufacturer: syz [ 752.232504][T10900] usb 8-1: SerialNumber: syz [ 752.483323][T10900] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 753.161167][T10900] gspca_mr97310a: reg read [21] error -110 [ 753.161269][T10900] mr97310a 8-1:1.0: probe with driver mr97310a failed with error -110 [ 753.363903][T12125] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 753.363941][T12125] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 753.440237][T13638] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2183'. [ 753.789681][ T49] usb 8-1: USB disconnect, device number 10 [ 753.891183][ T5249] 8021q: adding VLAN 0 to HW filter on device eth15 [ 753.896391][T13648] netlink: 292 bytes leftover after parsing attributes in process `syz.7.2185'. [ 755.577691][T12125] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 755.577726][T12125] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.914110][T13378] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 757.052002][T13660] kvm [13656]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x100000080 [ 757.140418][T13378] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 758.068356][T12125] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 758.068401][T12125] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 758.557620][T13378] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 758.669662][T13687] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2190'. [ 759.240394][T13378] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 759.297384][T13671] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2188'. [ 759.319525][T13378] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 759.417890][T13378] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 759.438887][ T5249] 8021q: adding VLAN 0 to HW filter on device eth16 [ 759.439533][T13378] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 759.553692][T13378] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 759.885730][T12125] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 759.885766][T12125] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 759.980793][T13693] netlink: 292 bytes leftover after parsing attributes in process `syz.3.2192'. [ 761.772626][T13692] syz.7.2191 invoked oom-killer: gfp_mask=0x402dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), order=0, oom_score_adj=1000 [ 761.772670][T13692] CPU: 1 UID: 0 PID: 13692 Comm: syz.7.2191 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 761.772699][T13692] Tainted: [L]=SOFTLOCKUP [ 761.772707][T13692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 761.772719][T13692] Call Trace: [ 761.772728][T13692] [ 761.772737][T13692] dump_stack_lvl+0xe8/0x150 [ 761.772772][T13692] dump_header+0xd3/0x4b0 [ 761.772803][T13692] oom_kill_process+0x3ab/0x9e0 [ 761.772829][T13692] out_of_memory+0x1064/0x1480 [ 761.772864][T13692] ? __pfx_out_of_memory+0x10/0x10 [ 761.772886][T13692] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 761.772911][T13692] ? _mutex_lock_killable+0x152/0x1d0 [ 761.772941][T13692] ? try_charge_memcg+0xcc3/0x16f0 [ 761.772964][T13692] try_charge_memcg+0xd82/0x16f0 [ 761.773002][T13692] ? __pfx_try_charge_memcg+0x10/0x10 [ 761.773044][T13692] ? percpu_ref_tryget+0x15/0x180 [ 761.773079][T13692] ? __memcg_kmem_charge_page+0x182/0x560 [ 761.773113][T13692] __memcg_kmem_charge_page+0x358/0x560 [ 761.773142][T13692] ? __memcg_kmem_charge_page+0x182/0x560 [ 761.773172][T13692] __alloc_frozen_pages_noprof+0x263/0x5c0 [ 761.773208][T13692] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 761.773247][T13692] ? __pfx_policy_nodemask+0x10/0x10 [ 761.773267][T13692] ? lruvec_stat_mod_folio+0x6e/0x3e0 [ 761.773300][T13692] alloc_pages_mpol+0xd4/0x280 [ 761.773326][T13692] alloc_pages_noprof+0xd2/0x2f0 [ 761.773351][T13692] __vmalloc_node_range_noprof+0xc62/0x1540 [ 761.773404][T13692] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 761.773431][T13692] ? kvm_dev_ioctl+0x12b/0x17e0 [ 761.773449][T13692] ? rcu_is_watching+0x16/0xb0 [ 761.773478][T13692] ? kvm_dev_ioctl+0x12b/0x17e0 [ 761.773498][T13692] ? rcu_is_watching+0x16/0xb0 [ 761.773530][T13692] ? kvm_dev_ioctl+0x12b/0x17e0 [ 761.773549][T13692] __kvmalloc_node_noprof+0x646/0x890 [ 761.773581][T13692] ? kvm_dev_ioctl+0x12b/0x17e0 [ 761.773605][T13692] ? kvm_dev_ioctl+0x12b/0x17e0 [ 761.773630][T13692] kvm_dev_ioctl+0x12b/0x17e0 [ 761.773655][T13692] ? __fget_files+0x2a/0x420 [ 761.773677][T13692] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 761.773696][T13692] ? __fget_files+0x2a/0x420 [ 761.773724][T13692] ? bpf_lsm_file_ioctl+0x9/0x20 [ 761.773750][T13692] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 761.773771][T13692] __se_sys_ioctl+0xff/0x170 [ 761.773804][T13692] do_syscall_64+0x166/0x520 [ 761.773827][T13692] ? trace_irq_disable+0x3b/0x140 [ 761.773856][T13692] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.773878][T13692] ? clear_bhb_loop+0x70/0xc0 [ 761.773904][T13692] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.773926][T13692] RIP: 0033:0x7fc87010e199 [ 761.773947][T13692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 761.773966][T13692] RSP: 002b:00007fc86e366028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 761.773989][T13692] RAX: ffffffffffffffda RBX: 00007fc870395fa0 RCX: 00007fc87010e199 [ 761.774006][T13692] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000006 [ 761.774020][T13692] RBP: 00007fc8701a50b8 R08: 0000000000000000 R09: 0000000000000000 [ 761.774034][T13692] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 761.774054][T13692] R13: 00007fc870396038 R14: 00007fc870395fa0 R15: 00007ffc133e7be8 [ 761.774090][T13692] [ 761.987005][T13692] memory: usage 8kB, limit 8kB, failcnt 161 [ 761.987026][T13692] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 761.987040][T13692] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 761.987053][T13692] Memory cgroup stats for /syz7/test: [ 761.987171][T13692] cache 0 [ 761.987180][T13692] rss 0 [ 761.987186][T13692] shmem 0 [ 761.987193][T13692] mapped_file 0 [ 761.987200][T13692] dirty 0 [ 761.987206][T13692] writeback 0 [ 761.987213][T13692] workingset_refault_anon 0 [ 761.987220][T13692] workingset_refault_file 0 [ 761.987228][T13692] swap 0 [ 761.987234][T13692] swapcached 0 [ 761.987240][T13692] pgpgin 0 [ 761.987247][T13692] pgpgout 0 [ 761.987253][T13692] pgfault 15 [ 761.987259][T13692] pgmajfault 0 [ 761.987266][T13692] inactive_anon 0 [ 761.987273][T13692] active_anon 0 [ 761.987280][T13692] inactive_file 0 [ 761.987286][T13692] active_file 0 [ 761.987293][T13692] unevictable 0 [ 761.987300][T13692] hierarchical_memory_limit 8192 [ 761.987307][T13692] hierarchical_memsw_limit 9223372036854771712 [ 761.987315][T13692] total_cache 0 [ 761.987321][T13692] total_rss 0 [ 761.987328][T13692] total_shmem 0 [ 761.987335][T13692] total_mapped_file 0 [ 761.987341][T13692] total_dirty 0 [ 761.987348][T13692] total_writeback 0 [ 761.987354][T13692] total_workingset_refault_anon 0 [ 761.987362][T13692] total_workingset_refault_file 0 [ 761.987370][T13692] total_swap 0 [ 761.987376][T13692] total_swapcached 0 [ 761.987383][T13692] total_pgpgin 0 [ 761.987390][T13692] total_pgpgout 0 [ 761.987397][T13692] total_pgfault 15 [ 761.987404][T13692] total_pgmajfault 0 [ 761.987411][T13692] total_inactive_anon 0 [ 761.987418][T13692] total_active_anon 0 [ 761.987425][T13692] total_inactive_file 0 [ 761.987432][T13692] total_active_file 0 [ 761.987440][T13692] total_unevictable 0 [ 761.987447][T13692] anon_cost 0 [ 761.987453][T13692] file_cost 0 [ 761.987461][T13692] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz7/test,task_memcg=/syz7/test,task=syz.7.2191,pid=13689,uid=0 [ 761.987604][T13692] Memory cgroup out of memory: Killed process 13689 (syz.7.2191) total-vm:202744kB, anon-rss:1432kB, file-rss:21780kB, shmem-rss:5344kB, UID:0 pgtables:148kB oom_score_adj:1000 [ 762.142628][T13344] 8021q: adding VLAN 0 to HW filter on device bond0 [ 762.968388][T13724] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2197'. [ 763.571457][T13344] 8021q: adding VLAN 0 to HW filter on device team0 [ 763.680515][T13721] debugfs: out of free dentries, can not create file 'exits' [ 763.703149][T13721] debugfs: out of free dentries, can not create file 'mmio_exits' [ 763.820452][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 763.820532][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 765.132390][ T12] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 765.170381][T12127] bridge0: port 2(bridge_slave_1) entered blocking state [ 765.170888][T12127] bridge0: port 2(bridge_slave_1) entered forwarding state [ 766.905810][T12125] bridge_slave_1: left allmulticast mode [ 766.905846][T12125] bridge_slave_1: left promiscuous mode [ 766.906102][T12125] bridge0: port 2(bridge_slave_1) entered disabled state [ 767.011646][ T5717] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 767.230785][ T5717] usb 8-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 767.233394][ T5717] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 767.233545][ T5717] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 767.677327][ T5717] usb 8-1: can't set config #1, error -71 [ 767.929438][ T5717] usb 8-1: USB disconnect, device number 11 [ 769.020499][T12125] bridge_slave_0: left allmulticast mode [ 769.020537][T12125] bridge_slave_0: left promiscuous mode [ 769.020793][T12125] bridge0: port 1(bridge_slave_0) entered disabled state [ 769.433544][T13752] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2204'. [ 770.809313][T13754] syz.7.2203 invoked oom-killer: gfp_mask=0x402dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), order=0, oom_score_adj=1000 [ 770.809343][T13754] CPU: 0 UID: 0 PID: 13754 Comm: syz.7.2203 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 770.809366][T13754] Tainted: [L]=SOFTLOCKUP [ 770.809370][T13754] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 770.809377][T13754] Call Trace: [ 770.809383][T13754] [ 770.809388][T13754] dump_stack_lvl+0xe8/0x150 [ 770.809409][T13754] dump_header+0xd3/0x4b0 [ 770.809426][T13754] oom_kill_process+0x3ab/0x9e0 [ 770.809440][T13754] out_of_memory+0x1064/0x1480 [ 770.809458][T13754] ? __pfx_out_of_memory+0x10/0x10 [ 770.809469][T13754] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 770.809482][T13754] ? _mutex_lock_killable+0x152/0x1d0 [ 770.809498][T13754] ? try_charge_memcg+0xcc3/0x16f0 [ 770.809510][T13754] try_charge_memcg+0xd82/0x16f0 [ 770.809530][T13754] ? __pfx_try_charge_memcg+0x10/0x10 [ 770.809551][T13754] ? percpu_ref_tryget+0x15/0x180 [ 770.809569][T13754] ? __memcg_kmem_charge_page+0x182/0x560 [ 770.809587][T13754] __memcg_kmem_charge_page+0x358/0x560 [ 770.809601][T13754] ? __memcg_kmem_charge_page+0x182/0x560 [ 770.809618][T13754] __alloc_frozen_pages_noprof+0x263/0x5c0 [ 770.809637][T13754] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 770.809656][T13754] ? __pfx_policy_nodemask+0x10/0x10 [ 770.809668][T13754] ? lruvec_stat_mod_folio+0x6e/0x3e0 [ 770.809685][T13754] alloc_pages_mpol+0xd4/0x280 [ 770.809698][T13754] alloc_pages_noprof+0xd2/0x2f0 [ 770.809711][T13754] __vmalloc_node_range_noprof+0xc62/0x1540 [ 770.809740][T13754] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 770.809754][T13754] ? kvm_dev_ioctl+0x12b/0x17e0 [ 770.809764][T13754] ? rcu_is_watching+0x16/0xb0 [ 770.809780][T13754] ? kvm_dev_ioctl+0x12b/0x17e0 [ 770.809790][T13754] ? rcu_is_watching+0x16/0xb0 [ 770.809807][T13754] ? kvm_dev_ioctl+0x12b/0x17e0 [ 770.809817][T13754] __kvmalloc_node_noprof+0x646/0x890 [ 770.809833][T13754] ? kvm_dev_ioctl+0x12b/0x17e0 [ 770.809844][T13754] ? kvm_dev_ioctl+0x12b/0x17e0 [ 770.809860][T13754] kvm_dev_ioctl+0x12b/0x17e0 [ 770.809875][T13754] ? __fget_files+0x2a/0x420 [ 770.809886][T13754] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 770.809896][T13754] ? __fget_files+0x2a/0x420 [ 770.809909][T13754] ? bpf_lsm_file_ioctl+0x9/0x20 [ 770.809922][T13754] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 770.809932][T13754] __se_sys_ioctl+0xff/0x170 [ 770.809948][T13754] do_syscall_64+0x166/0x520 [ 770.809959][T13754] ? trace_irq_disable+0x3b/0x140 [ 770.809973][T13754] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.809984][T13754] ? clear_bhb_loop+0x70/0xc0 [ 770.809996][T13754] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.810007][T13754] RIP: 0033:0x7fc87010e199 [ 770.810019][T13754] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 770.810028][T13754] RSP: 002b:00007fc86e366028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 770.810042][T13754] RAX: ffffffffffffffda RBX: 00007fc870395fa0 RCX: 00007fc87010e199 [ 770.810051][T13754] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000006 [ 770.810058][T13754] RBP: 00007fc8701a50b8 R08: 0000000000000000 R09: 0000000000000000 [ 770.810064][T13754] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 770.810071][T13754] R13: 00007fc870396038 R14: 00007fc870395fa0 R15: 00007ffc133e7be8 [ 770.810088][T13754] [ 770.810101][T13754] memory: usage 8kB, limit 8kB, failcnt 244 [ 770.810109][T13754] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 770.810117][T13754] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 770.810123][T13754] Memory cgroup stats for /syz7/test: [ 770.810186][T13754] cache 0 [ 770.810191][T13754] rss 0 [ 770.810194][T13754] shmem 0 [ 770.810198][T13754] mapped_file 0 [ 770.810202][T13754] dirty 0 [ 770.810205][T13754] writeback 0 [ 770.810209][T13754] workingset_refault_anon 0 [ 770.810213][T13754] workingset_refault_file 0 [ 770.810217][T13754] swap 0 [ 770.810221][T13754] swapcached 0 [ 770.810224][T13754] pgpgin 0 [ 770.810228][T13754] pgpgout 0 [ 770.810231][T13754] pgfault 24 [ 770.810235][T13754] pgmajfault 0 [ 770.810238][T13754] inactive_anon 0 [ 770.810241][T13754] active_anon 0 [ 770.810245][T13754] inactive_file 0 [ 770.810248][T13754] active_file 0 [ 770.810252][T13754] unevictable 0 [ 770.810255][T13754] hierarchical_memory_limit 8192 [ 770.810259][T13754] hierarchical_memsw_limit 9223372036854771712 [ 770.810277][T13754] total_cache 0 [ 770.810281][T13754] total_rss 0 [ 770.810284][T13754] total_shmem 0 [ 770.810288][T13754] total_mapped_file 0 [ 770.810291][T13754] total_dirty 0 [ 770.810295][T13754] total_writeback 0 [ 770.810299][T13754] total_workingset_refault_anon 0 [ 770.810303][T13754] total_workingset_refault_file 0 [ 770.810307][T13754] total_swap 0 [ 770.810310][T13754] total_swapcached 0 [ 770.810314][T13754] total_pgpgin 0 [ 770.810318][T13754] total_pgpgout 0 [ 770.810322][T13754] total_pgfault 24 [ 770.810325][T13754] total_pgmajfault 0 [ 770.810329][T13754] total_inactive_anon 0 [ 770.810333][T13754] total_active_anon 0 [ 770.810337][T13754] total_inactive_file 0 [ 770.810341][T13754] total_active_file 0 [ 770.810345][T13754] total_unevictable 0 [ 770.810349][T13754] anon_cost 0 [ 770.810352][T13754] file_cost 0 [ 770.810356][T13754] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz7/test,task_memcg=/syz7/test,task=syz.7.2203,pid=13753,uid=0 [ 770.810460][T13754] Memory cgroup out of memory: Killed process 13753 (syz.7.2203) total-vm:202744kB, anon-rss:1432kB, file-rss:21704kB, shmem-rss:5344kB, UID:0 pgtables:148kB oom_score_adj:1000 [ 771.687601][T12125] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 771.725907][T12125] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 771.747652][T12125] bond0 (unregistering): Released all slaves [ 771.806797][T13741] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2201'. [ 771.896911][T13378] 8021q: adding VLAN 0 to HW filter on device bond0 [ 772.064194][T13378] 8021q: adding VLAN 0 to HW filter on device team0 [ 772.090377][T12125] tipc: Disabling bearer [ 772.090532][T12125] tipc: Left network mode [ 772.102094][T13768] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 772.122207][T11440] bridge0: port 1(bridge_slave_0) entered blocking state [ 772.193124][T13770] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2207'. [ 772.193157][T13770] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2207'. [ 772.193314][T11440] bridge0: port 1(bridge_slave_0) entered forwarding state [ 772.290878][T13770] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2207'. [ 772.291001][T13770] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2207'. [ 773.260522][ T2924] bridge0: port 2(bridge_slave_1) entered blocking state [ 773.260659][ T2924] bridge0: port 2(bridge_slave_1) entered forwarding state [ 773.581067][T13784] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2211'. [ 773.581101][T13784] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2211'. [ 773.593568][T13784] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2211'. [ 773.593609][T13784] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2211'. [ 775.703841][T13799] 9pnet_fd: p9_fd_create_tcp (13799): problem connecting socket to 127.0.0.1 [ 776.320722][ T5608] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 776.324997][ T5608] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 776.355531][ T5608] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 776.356694][ T5608] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 776.394896][ T5608] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 777.826374][ T5249] 8021q: adding VLAN 0 to HW filter on device eth17 [ 780.454255][T13378] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 780.521811][ T5595] Bluetooth: hci4: command tx timeout [ 781.568237][T13856] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2216'. [ 782.828770][T13882] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2218'. [ 783.740070][ T5595] Bluetooth: hci4: command tx timeout [ 784.323855][T13346] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 784.397447][T13897] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2220'. [ 785.157422][ T5249] 8021q: adding VLAN 0 to HW filter on device eth18 [ 785.164340][T13346] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 785.169019][T13346] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 785.172476][T13346] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 785.212812][T13346] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 785.789962][T13346] Bluetooth: hci4: command tx timeout [ 786.086771][T13911] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2221'. [ 787.399488][T13346] Bluetooth: hci0: command tx timeout [ 787.865379][T13346] Bluetooth: hci4: command tx timeout [ 789.838355][T13346] Bluetooth: hci0: command tx timeout [ 790.064809][T13935] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2227'. [ 790.130730][T10900] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 790.276354][T10900] usb 4-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 790.277871][T10900] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 790.277926][T10900] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 790.346981][T10900] ttusb_dec_send_command: command bulk message failed: error -22 [ 790.347114][T10900] ttusb-dec 4-1:1.0: probe with driver ttusb-dec failed with error -22 [ 790.491745][T13959] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2231'. [ 791.403052][ T9] usb 4-1: USB disconnect, device number 37 [ 791.476754][T12125] hsr_slave_0: left promiscuous mode [ 791.495416][T12125] hsr_slave_1: left promiscuous mode [ 791.496147][T12125] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 791.496164][T12125] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 791.539058][T12125] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 791.539078][T12125] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 791.591162][T12125] veth1_macvtap: left promiscuous mode [ 791.591232][T12125] veth0_macvtap: left promiscuous mode [ 791.591383][T12125] veth1_vlan: left promiscuous mode [ 791.591487][T12125] veth0_vlan: left promiscuous mode [ 791.866209][T13346] Bluetooth: hci0: command tx timeout [ 793.898157][T12125] team0 (unregistering): Port device team_slave_1 removed [ 793.990033][T13346] Bluetooth: hci0: command tx timeout [ 794.078272][T12125] team0 (unregistering): Port device team_slave_0 removed [ 794.324513][T13959] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2231'. [ 795.313912][T13987] tipc: Enabled bearer , priority 0 [ 795.338696][T13975] syzkaller0: entered promiscuous mode [ 795.338726][T13975] syzkaller0: entered allmulticast mode [ 796.043221][T14001] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2237'. [ 798.091322][T13984] tipc: Resetting bearer [ 798.131223][T13974] tipc: Resetting bearer [ 798.295270][T10900] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 798.402584][T13974] tipc: Disabling bearer [ 798.455903][T10900] usb 8-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 798.456958][T10900] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 798.456998][T10900] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 798.467354][T10900] ttusb_dec_send_command: command bulk message failed: error -22 [ 798.467576][T10900] ttusb-dec 8-1:1.0: probe with driver ttusb-dec failed with error -22 [ 798.616714][ T5249] 8021q: adding VLAN 0 to HW filter on device eth19 [ 798.713581][ T10] usb 8-1: USB disconnect, device number 12 [ 798.768032][T14009] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2239'. [ 798.772480][T13806] bridge0: port 1(bridge_slave_0) entered blocking state [ 798.772678][T13806] bridge0: port 1(bridge_slave_0) entered disabled state [ 798.772872][T13806] bridge_slave_0: entered allmulticast mode [ 798.812207][T13806] bridge_slave_0: entered promiscuous mode [ 798.871423][T13806] bridge0: port 2(bridge_slave_1) entered blocking state [ 798.871564][T13806] bridge0: port 2(bridge_slave_1) entered disabled state [ 798.890904][T13806] bridge_slave_1: entered allmulticast mode [ 798.894180][T13806] bridge_slave_1: entered promiscuous mode [ 800.506494][T13806] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 800.636924][T13806] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 801.135616][T13806] team0: Port device team_slave_0 added [ 801.155004][T13806] team0: Port device team_slave_1 added [ 801.312453][T13806] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 801.312472][T13806] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 801.312499][T13806] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 801.339308][T13806] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 801.339327][T13806] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 801.339355][T13806] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 804.165272][T14033] kvm [14031]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x100000000 [ 804.167539][T14033] kvm [14031]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x80 [ 804.167613][T14033] kvm [14031]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 804.536421][T13806] hsr_slave_0: entered promiscuous mode [ 804.537806][T13806] hsr_slave_1: entered promiscuous mode [ 804.572623][T13806] debugfs: 'hsr0' already exists in 'hsr' [ 804.572790][T13806] Cannot create hsr debugfs directory [ 808.521370][T14073] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2250'. [ 808.521414][T14073] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2250'. [ 809.259480][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 809.259565][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.319490][T14073] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2250'. [ 809.319524][T14073] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2250'. [ 809.454503][ T5249] 8021q: adding VLAN 0 to HW filter on device eth20 [ 809.470263][T14077] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2251'. [ 809.971431][T14088] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2253'. [ 816.049222][T13893] bridge0: port 1(bridge_slave_0) entered blocking state [ 816.049293][T13893] bridge0: port 1(bridge_slave_0) entered disabled state [ 816.049424][T13893] bridge_slave_0: entered allmulticast mode [ 816.123068][T13893] bridge_slave_0: entered promiscuous mode [ 816.153056][T13893] bridge0: port 2(bridge_slave_1) entered blocking state [ 816.153144][T13893] bridge0: port 2(bridge_slave_1) entered disabled state [ 816.153283][T13893] bridge_slave_1: entered allmulticast mode [ 816.165790][T13893] bridge_slave_1: entered promiscuous mode [ 818.243156][T13893] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 818.260950][T13893] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 823.506613][T14164] syz.7.2266 (14164) used greatest stack depth: 17312 bytes left [ 823.762970][T13893] team0: Port device team_slave_0 added [ 823.810870][T13893] team0: Port device team_slave_1 added [ 825.626011][T13893] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 825.626026][T13893] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 825.626042][T13893] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 825.629195][T13893] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 825.629207][T13893] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 825.629222][T13893] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 827.659763][T13893] hsr_slave_0: entered promiscuous mode [ 827.661157][T13893] hsr_slave_1: entered promiscuous mode [ 827.662096][T13893] debugfs: 'hsr0' already exists in 'hsr' [ 827.662119][T13893] Cannot create hsr debugfs directory [ 830.054838][T14241] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2278'. [ 831.011399][T14248] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2279'. [ 834.700969][T13725] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 834.846197][T13725] usb 8-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 834.852244][T13725] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 834.852311][T13725] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 834.892223][T13725] ttusb_dec_send_command: command bulk message failed: error -22 [ 834.899032][T13725] ttusb-dec 8-1:1.0: probe with driver ttusb-dec failed with error -22 [ 834.970980][T12125] bridge_slave_1: left allmulticast mode [ 834.971016][T12125] bridge_slave_1: left promiscuous mode [ 834.971275][T12125] bridge0: port 2(bridge_slave_1) entered disabled state [ 835.070964][T10900] usb 8-1: USB disconnect, device number 13 [ 835.245048][T12125] bridge_slave_0: left allmulticast mode [ 835.245088][T12125] bridge_slave_0: left promiscuous mode [ 835.247599][T12125] bridge0: port 1(bridge_slave_0) entered disabled state [ 835.427981][ T5595] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 835.464797][ T5595] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 835.491432][ T5595] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 835.493217][ T5595] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 835.494037][ T5595] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 835.928313][T12125] bridge_slave_1: left allmulticast mode [ 835.928352][T12125] bridge_slave_1: left promiscuous mode [ 835.928611][T12125] bridge0: port 2(bridge_slave_1) entered disabled state [ 836.102545][T12125] bridge_slave_0: left allmulticast mode [ 836.102582][T12125] bridge_slave_0: left promiscuous mode [ 836.102835][T12125] bridge0: port 1(bridge_slave_0) entered disabled state [ 836.208837][T14283] debugfs: out of free dentries, can not create directory '14283-7' [ 837.785337][ T5595] Bluetooth: hci5: command tx timeout [ 839.676153][T12125] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 839.705365][T10900] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 839.737168][T12125] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 839.758396][T12125] bond0 (unregistering): Released all slaves [ 839.862355][T10900] usb 3-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 839.863971][T10900] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 839.863998][T10900] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 839.864035][T10900] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 839.865285][ T5595] Bluetooth: hci5: command tx timeout [ 839.870597][T10900] usb 3-1: config 0 descriptor?? [ 840.107448][T10900] usb 3-1: USB disconnect, device number 38 [ 840.615867][T12125] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 840.746001][T12125] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 840.795685][T12125] bond0 (unregistering): Released all slaves [ 840.854265][ T5249] 8021q: adding VLAN 0 to HW filter on device eth21 [ 840.857781][T14322] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2290'. [ 842.621773][ T5595] Bluetooth: hci5: command tx timeout [ 842.865320][ T10] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 843.015991][ T10] usb 8-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 843.017317][ T10] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 843.017333][ T10] usb 8-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 843.017356][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 843.521400][ T10] usb 8-1: USB disconnect, device number 14 [ 843.704584][T13346] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 843.770675][T13346] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 843.788547][T13346] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 843.793399][T13346] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 843.837105][T13346] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 846.593030][ T5595] Bluetooth: hci5: command tx timeout [ 846.593165][T13346] Bluetooth: hci6: command tx timeout [ 847.155361][T12125] hsr_slave_0: left promiscuous mode [ 847.258879][T12125] hsr_slave_1: left promiscuous mode [ 847.262305][T12125] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 847.327413][T12125] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 847.711437][T14377] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.2298'. [ 848.655342][T12125] hsr_slave_0: left promiscuous mode [ 848.665360][T13346] Bluetooth: hci6: command tx timeout [ 850.025765][T12125] hsr_slave_1: left promiscuous mode [ 850.027000][T12125] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 850.068954][T12125] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 850.745251][T13346] Bluetooth: hci6: command tx timeout [ 851.152762][T12125] team0 (unregistering): Port device team_slave_1 removed [ 851.377000][T12125] team0 (unregistering): Port device team_slave_0 removed [ 851.945987][T12125] team0 (unregistering): Port device team_slave_1 removed [ 852.034719][T12125] team0 (unregistering): Port device team_slave_0 removed [ 852.497915][ T5249] 8021q: adding VLAN 0 to HW filter on device eth22 [ 852.501623][T14387] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2301'. [ 852.825329][T13346] Bluetooth: hci6: command tx timeout [ 863.767131][T14466] ªªªªª): renamed from hsr0 (while UP) [ 864.018402][T14467] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2313'. [ 869.552368][T14493] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 869.552394][T14493] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 869.717278][T14284] bridge0: port 1(bridge_slave_0) entered blocking state [ 869.717482][T14284] bridge0: port 1(bridge_slave_0) entered disabled state [ 869.717678][T14284] bridge_slave_0: entered allmulticast mode [ 869.720323][T14284] bridge_slave_0: entered promiscuous mode [ 869.898051][T14284] bridge0: port 2(bridge_slave_1) entered blocking state [ 869.898144][T14284] bridge0: port 2(bridge_slave_1) entered disabled state [ 869.898270][T14284] bridge_slave_1: entered allmulticast mode [ 869.901814][T14284] bridge_slave_1: entered promiscuous mode [ 870.120454][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.120521][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.353958][T13346] Bluetooth: hci2: command 0x0406 tx timeout [ 870.411417][T14284] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 870.643880][T14284] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 870.755268][T14493] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 870.755297][T14493] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 870.790746][T14341] bridge0: port 1(bridge_slave_0) entered blocking state [ 870.790817][T14341] bridge0: port 1(bridge_slave_0) entered disabled state [ 870.790949][T14341] bridge_slave_0: entered allmulticast mode [ 870.795833][T14341] bridge_slave_0: entered promiscuous mode [ 870.894666][T14341] bridge0: port 2(bridge_slave_1) entered blocking state [ 870.894736][T14341] bridge0: port 2(bridge_slave_1) entered disabled state [ 870.894849][T14341] bridge_slave_1: entered allmulticast mode [ 870.900583][T14341] bridge_slave_1: entered promiscuous mode [ 870.916166][T14284] team0: Port device team_slave_0 added [ 871.002231][T14284] team0: Port device team_slave_1 added [ 871.152532][T14493] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 871.152558][T14493] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 871.322249][T14532] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 871.419270][T14341] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 871.606611][T14493] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 871.606639][T14493] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 871.700642][T14341] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 871.706918][T14284] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 871.706935][T14284] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 871.706968][T14284] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 871.921711][T14284] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 871.921728][T14284] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 871.921743][T14284] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 872.060261][T14341] team0: Port device team_slave_0 added [ 872.098006][T14341] team0: Port device team_slave_1 added [ 872.146237][T14493] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 872.146260][T14493] Bluetooth: hci6: Error when powering off device on rfkill (-4) [ 872.364324][T14341] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 872.364345][T14341] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 872.364369][T14341] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 872.364443][T14538] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 872.379744][T14284] hsr_slave_0: entered promiscuous mode [ 872.381238][T14284] hsr_slave_1: entered promiscuous mode [ 872.384236][T14341] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 872.384252][T14341] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 872.384276][T14341] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 873.714280][T14546] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2325'. [ 873.722497][T14556] tipc: Started in network mode [ 873.722526][T14556] tipc: Node identity ac1414aa, cluster identity 4711 [ 873.723689][T14556] tipc: Enabled bearer , priority 10 [ 873.804424][T14341] hsr_slave_0: entered promiscuous mode [ 873.807305][T14341] hsr_slave_1: entered promiscuous mode [ 873.808197][T14341] debugfs: 'hsr0' already exists in 'hsr' [ 873.808220][T14341] Cannot create hsr debugfs directory [ 876.307978][ T5601] tipc: Node number set to 2886997162 [ 878.669278][T14591] input: syz0 as /devices/virtual/input/input7 [ 880.678324][T14606] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2338'. [ 883.049589][T14619] input: syz0 as /devices/virtual/input/input8 [ 889.372626][T12126] bridge_slave_1: left allmulticast mode [ 889.372668][T12126] bridge_slave_1: left promiscuous mode [ 889.372938][T12126] bridge0: port 2(bridge_slave_1) entered disabled state [ 889.791113][T12126] bridge_slave_0: left allmulticast mode [ 889.791158][T12126] bridge_slave_0: left promiscuous mode [ 889.791436][T12126] bridge0: port 1(bridge_slave_0) entered disabled state [ 891.836100][T12126] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 891.956087][T12126] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 892.039410][T12126] bond0 (unregistering): Released all slaves [ 892.138341][ T5249] 8021q: adding VLAN 0 to HW filter on device eth21 [ 892.140536][T14671] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2348'. [ 895.514407][T14686] input: syz0 as /devices/virtual/input/input9 [ 896.536325][ T5595] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 896.614855][ T5595] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 896.640651][ T5595] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 896.652703][ T5595] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 896.653378][ T5595] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 897.067007][T13346] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 897.074361][T13346] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 897.074746][T13346] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 897.078603][T13346] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 897.107417][T13346] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 897.386346][T12126] hsr_slave_0: left promiscuous mode [ 897.428016][T12126] hsr_slave_1: left promiscuous mode [ 897.429241][T12126] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 897.476131][T12126] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 898.989702][T14727] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2359'. [ 899.169932][T13346] Bluetooth: hci0: command tx timeout [ 901.620216][T13346] Bluetooth: hci0: command tx timeout [ 902.338958][T12126] team0 (unregistering): Port device team_slave_1 removed [ 902.500496][T12126] team0 (unregistering): Port device team_slave_0 removed [ 902.588325][T14749] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2364'. [ 902.588471][T14749] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2364'. [ 903.489879][T14749] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2364'. [ 903.489914][T14749] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2364'. [ 903.509834][T14727] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2359'. [ 903.626091][T13346] Bluetooth: hci0: command tx timeout [ 905.758507][T13346] Bluetooth: hci0: command tx timeout [ 905.982478][ T5595] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 906.116621][ T5595] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 906.163600][ T5595] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 906.228196][ T5595] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 906.244210][ T5595] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 908.487377][ T5595] Bluetooth: hci4: command tx timeout [ 909.760474][T12126] bridge_slave_1: left allmulticast mode [ 909.760502][T12126] bridge_slave_1: left promiscuous mode [ 909.760687][T12126] bridge0: port 2(bridge_slave_1) entered disabled state [ 909.960033][T12126] bridge_slave_0: left allmulticast mode [ 909.960069][T12126] bridge_slave_0: left promiscuous mode [ 909.960321][T12126] bridge0: port 1(bridge_slave_0) entered disabled state [ 910.454910][T14805] ./loop0: Can't open blockdev [ 911.003741][ T5595] Bluetooth: hci4: command tx timeout [ 912.796742][T12126] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 913.065260][ T5595] Bluetooth: hci4: command tx timeout [ 913.070595][T12126] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 913.986550][T12126] bond0 (unregistering): Released all slaves [ 915.314985][ T5595] Bluetooth: hci4: command tx timeout [ 917.172724][T12126] hsr_slave_0: left promiscuous mode [ 917.313917][T12126] hsr_slave_1: left promiscuous mode [ 917.320881][T12126] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 917.388260][T12126] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 917.826367][T12126] team0 (unregistering): Port device team_slave_1 removed [ 917.924137][T12126] team0 (unregistering): Port device team_slave_0 removed [ 918.051953][ T5595] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 918.092293][ T5595] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 918.135378][ T5595] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 918.173266][T14844] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 918.185220][T14844] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 920.159915][T14704] bridge0: port 1(bridge_slave_0) entered blocking state [ 920.160129][T14704] bridge0: port 1(bridge_slave_0) entered disabled state [ 920.160302][T14704] bridge_slave_0: entered allmulticast mode [ 920.171950][T14704] bridge_slave_0: entered promiscuous mode [ 920.176447][T14704] bridge0: port 2(bridge_slave_1) entered blocking state [ 920.176669][T14704] bridge0: port 2(bridge_slave_1) entered disabled state [ 920.176853][T14704] bridge_slave_1: entered allmulticast mode [ 920.179424][T14704] bridge_slave_1: entered promiscuous mode [ 920.268311][T13346] Bluetooth: hci5: command tx timeout [ 920.672453][T14704] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 922.367997][T13346] Bluetooth: hci5: command tx timeout [ 922.388341][T14888] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2374'. [ 922.937606][T14704] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 922.942647][T14888] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2374'. [ 923.162389][T14898] tipc: Enabling of bearer rejected, already enabled [ 923.326920][T14704] team0: Port device team_slave_0 added [ 924.225611][T14704] team0: Port device team_slave_1 added [ 924.439485][T13346] Bluetooth: hci5: command tx timeout [ 926.507965][T13346] Bluetooth: hci5: command tx timeout [ 926.558800][T12126] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 926.942841][T14704] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 926.942859][T14704] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 926.942878][T14704] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 926.994657][T14704] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 926.994673][T14704] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 926.994693][T14704] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 927.015649][T14768] bridge0: port 1(bridge_slave_0) entered blocking state [ 927.015768][T14768] bridge0: port 1(bridge_slave_0) entered disabled state [ 927.015958][T14768] bridge_slave_0: entered allmulticast mode [ 927.022842][T14768] bridge_slave_0: entered promiscuous mode [ 927.081210][T14768] bridge0: port 2(bridge_slave_1) entered blocking state [ 927.081395][T14768] bridge0: port 2(bridge_slave_1) entered disabled state [ 927.081574][T14768] bridge_slave_1: entered allmulticast mode [ 927.091932][T14768] bridge_slave_1: entered promiscuous mode [ 931.213901][T12126] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 931.322924][T14768] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 931.551016][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.551088][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.594080][T14957] program syz.7.2388 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 931.629457][T14768] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 931.659130][T14704] hsr_slave_0: entered promiscuous mode [ 931.661008][T14704] hsr_slave_1: entered promiscuous mode [ 931.662122][T14704] debugfs: 'hsr0' already exists in 'hsr' [ 931.662143][T14704] Cannot create hsr debugfs directory [ 932.118271][T12126] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 932.375972][T14768] team0: Port device team_slave_0 added [ 932.502469][T14768] team0: Port device team_slave_1 added [ 935.497725][T12126] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 935.667308][T14768] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 935.667321][T14768] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 935.667336][T14768] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 935.725970][T14768] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 935.725990][T14768] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 935.726017][T14768] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 936.202024][T14768] hsr_slave_0: entered promiscuous mode [ 936.204874][T14768] hsr_slave_1: entered promiscuous mode [ 936.208517][T14768] debugfs: 'hsr0' already exists in 'hsr' [ 936.208544][T14768] Cannot create hsr debugfs directory [ 939.391198][T14989] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 939.473102][T14842] bridge0: port 1(bridge_slave_0) entered blocking state [ 939.473595][T14842] bridge0: port 1(bridge_slave_0) entered disabled state [ 939.473791][T14842] bridge_slave_0: entered allmulticast mode [ 939.497486][T14842] bridge_slave_0: entered promiscuous mode [ 939.772685][T14842] bridge0: port 2(bridge_slave_1) entered blocking state [ 939.772808][T14842] bridge0: port 2(bridge_slave_1) entered disabled state [ 939.773003][T14842] bridge_slave_1: entered allmulticast mode [ 939.792164][T14842] bridge_slave_1: entered promiscuous mode [ 940.119821][T12126] bridge_slave_1: left allmulticast mode [ 940.119856][T12126] bridge_slave_1: left promiscuous mode [ 940.120111][T12126] bridge0: port 2(bridge_slave_1) entered disabled state [ 940.291621][T12126] bridge_slave_0: left allmulticast mode [ 940.291658][T12126] bridge_slave_0: left promiscuous mode [ 940.291915][T12126] bridge0: port 1(bridge_slave_0) entered disabled state [ 940.856995][T12126] bridge_slave_1: left allmulticast mode [ 940.857034][T12126] bridge_slave_1: left promiscuous mode [ 940.857281][T12126] bridge0: port 2(bridge_slave_1) entered disabled state [ 941.059808][T12126] bridge_slave_0: left allmulticast mode [ 941.059847][T12126] bridge_slave_0: left promiscuous mode [ 941.060086][T12126] bridge0: port 1(bridge_slave_0) entered disabled state [ 944.141262][T12126] bridge_slave_1: left allmulticast mode [ 944.141299][T12126] bridge_slave_1: left promiscuous mode [ 944.141609][T12126] bridge0: port 2(bridge_slave_1) entered disabled state [ 944.216341][T12126] bridge_slave_0: left allmulticast mode [ 944.216366][T12126] bridge_slave_0: left promiscuous mode [ 944.216520][T12126] bridge0: port 1(bridge_slave_0) entered disabled state [ 945.295902][T12126] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 945.335831][T12126] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 945.357779][T12126] bond0 (unregistering): Released all slaves [ 945.587261][T12126] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 945.666613][T12126] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 945.726894][T12126] bond0 (unregistering): Released all slaves [ 945.948230][T12126] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 946.025943][T12126] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 946.087619][T12126] bond0 (unregistering): Released all slaves [ 946.784094][T14842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 946.962594][T12126] tipc: Disabling bearer [ 946.962778][T12126] tipc: Left network mode [ 946.999610][T14842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 947.055681][T14704] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 947.185655][T14704] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 947.266820][T14704] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 947.729997][T14704] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 948.413136][T14842] team0: Port device team_slave_0 added [ 948.939691][T14704] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 949.190089][T14704] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 949.193636][T14842] team0: Port device team_slave_1 added [ 949.302408][T14704] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 949.365297][T14704] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 949.720782][T14842] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 949.720801][T14842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 949.720825][T14842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 949.744602][T14842] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 949.744620][T14842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 949.744647][T14842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 955.023706][T14842] hsr_slave_0: entered promiscuous mode [ 955.024952][T14842] hsr_slave_1: entered promiscuous mode [ 955.026876][T14842] debugfs: 'hsr0' already exists in 'hsr' [ 955.026904][T14842] Cannot create hsr debugfs directory [ 955.189189][T14768] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 955.220551][T15106] program syz.7.2406 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 955.291970][T14768] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 955.323315][T14768] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 955.372202][T14768] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 955.386143][ T5249] 8021q: adding VLAN 0 to HW filter on device eth21 [ 955.681773][T14768] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 956.758274][T14768] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 957.098785][T14768] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 957.179756][T14768] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 957.251636][T15116] program syz.7.2408 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 957.974445][T14844] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 958.003028][T14844] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 958.013729][T14844] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 958.024585][T14844] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 958.028131][T14844] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 960.265286][T14844] Bluetooth: hci3: command tx timeout [ 963.506641][T14844] Bluetooth: hci3: command tx timeout [ 964.780730][ T5249] 8021q: adding VLAN 0 to HW filter on device eth22 [ 966.285271][T14844] Bluetooth: hci3: command tx timeout [ 966.753400][T13346] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 966.804723][T13346] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 966.912333][T13346] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 966.939841][T13346] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 966.941922][T13346] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 968.666896][T14844] Bluetooth: hci3: command tx timeout [ 969.145252][T13346] Bluetooth: hci0: command tx timeout [ 971.235214][T13346] Bluetooth: hci0: command tx timeout [ 971.466871][T15228] ./loop0: Can't open blockdev [ 972.822661][ T5249] 8021q: adding VLAN 0 to HW filter on device eth23 [ 974.292724][T13346] Bluetooth: hci0: command tx timeout [ 974.447187][T12126] hsr_slave_0: left promiscuous mode [ 974.485349][T12126] hsr_slave_1: left promiscuous mode [ 974.486669][T12126] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 974.486696][T12126] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 974.552795][T12126] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 974.552823][T12126] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 975.670847][T12126] hsr_slave_0: left promiscuous mode [ 975.688172][T12126] hsr_slave_1: left promiscuous mode [ 975.690176][T12126] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 975.717583][T12126] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 976.025258][T12126] hsr_slave_0: left promiscuous mode [ 976.045278][T12126] hsr_slave_1: left promiscuous mode [ 976.046106][T12126] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 976.347394][T13346] Bluetooth: hci0: command tx timeout [ 977.119422][T12126] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 977.199752][T12126] veth1_macvtap: left promiscuous mode [ 977.199829][T12126] veth0_macvtap: left promiscuous mode [ 977.200009][T12126] veth1_vlan: left promiscuous mode [ 977.200128][T12126] veth0_vlan: left promiscuous mode [ 977.532620][T14844] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 977.620843][T14844] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 977.631338][T14844] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 977.648423][T14844] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 977.729854][T14844] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 978.097805][T12126] team0 (unregistering): Port device team_slave_1 removed [ 978.125736][T12126] team0 (unregistering): Port device team_slave_0 removed [ 978.495844][T12126] team0 (unregistering): Port device team_slave_1 removed [ 978.526634][T12126] team0 (unregistering): Port device team_slave_0 removed [ 978.916365][T12126] team0 (unregistering): Port device team_slave_1 removed [ 978.956335][T12126] team0 (unregistering): Port device team_slave_0 removed [ 979.873004][T14844] Bluetooth: hci4: command tx timeout [ 980.023463][T11946] batman_adv: batadv0: adding TT local entry 33:33:00:00:00:01 to non-existent VLAN -1 [ 981.053908][T15123] bridge0: port 1(bridge_slave_0) entered blocking state [ 981.054043][T15123] bridge0: port 1(bridge_slave_0) entered disabled state [ 981.054342][T15123] bridge_slave_0: entered allmulticast mode [ 981.058232][T15123] bridge_slave_0: entered promiscuous mode [ 981.127895][T15123] bridge0: port 2(bridge_slave_1) entered blocking state [ 981.128106][T15123] bridge0: port 2(bridge_slave_1) entered disabled state [ 981.128309][T15123] bridge_slave_1: entered allmulticast mode [ 981.132082][T15123] bridge_slave_1: entered promiscuous mode [ 981.872997][T15123] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 981.945287][T14844] Bluetooth: hci4: command tx timeout [ 982.011843][T15123] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 982.423082][T15123] team0: Port device team_slave_0 added [ 982.570670][T15123] team0: Port device team_slave_1 added [ 983.269916][T15314] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2433'. [ 984.786128][T14844] Bluetooth: hci4: command tx timeout [ 984.973092][ T5249] 8021q: adding VLAN 0 to HW filter on device eth24 [ 984.974325][T15123] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 984.974341][T15123] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 984.974368][T15123] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 985.048564][T15123] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 985.048585][T15123] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 985.048611][T15123] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 985.322546][T15203] bridge0: port 1(bridge_slave_0) entered blocking state [ 985.322675][T15203] bridge0: port 1(bridge_slave_0) entered disabled state [ 985.322880][T15203] bridge_slave_0: entered allmulticast mode [ 985.329439][T15203] bridge_slave_0: entered promiscuous mode [ 985.381461][T15203] bridge0: port 2(bridge_slave_1) entered blocking state [ 985.381596][T15203] bridge0: port 2(bridge_slave_1) entered disabled state [ 985.381767][T15203] bridge_slave_1: entered allmulticast mode [ 985.395856][T15203] bridge_slave_1: entered promiscuous mode [ 985.896578][T15123] hsr_slave_0: entered promiscuous mode [ 985.897849][T15123] hsr_slave_1: entered promiscuous mode [ 985.918100][T15203] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 986.038695][T15203] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 986.836113][T14844] Bluetooth: hci4: command tx timeout [ 989.363346][T15203] team0: Port device team_slave_0 added [ 989.518657][T15203] team0: Port device team_slave_1 added [ 989.820312][T15203] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 989.820330][T15203] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 989.820356][T15203] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 991.060762][T15203] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 991.060781][T15203] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 991.060804][T15203] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 993.024359][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.024437][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.122002][T15203] hsr_slave_0: entered promiscuous mode [ 993.123323][T15203] hsr_slave_1: entered promiscuous mode [ 993.124223][T15203] debugfs: 'hsr0' already exists in 'hsr' [ 993.124247][T15203] Cannot create hsr debugfs directory [ 993.222399][T15264] bridge0: port 1(bridge_slave_0) entered blocking state [ 993.222469][T15264] bridge0: port 1(bridge_slave_0) entered disabled state [ 993.222608][T15264] bridge_slave_0: entered allmulticast mode [ 993.224151][T15264] bridge_slave_0: entered promiscuous mode [ 993.453862][T15264] bridge0: port 2(bridge_slave_1) entered blocking state [ 993.469021][T15264] bridge0: port 2(bridge_slave_1) entered disabled state [ 993.469255][T15264] bridge_slave_1: entered allmulticast mode [ 993.479724][T15264] bridge_slave_1: entered promiscuous mode [ 994.966283][T15264] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 995.082571][T15264] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 995.348166][T15264] team0: Port device team_slave_0 added [ 995.393923][T15264] team0: Port device team_slave_1 added [ 997.395987][T15264] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 997.396006][T15264] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 997.396035][T15264] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 997.446732][T15264] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 997.446751][T15264] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 997.446777][T15264] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1000.207171][T15264] hsr_slave_0: entered promiscuous mode [ 1000.210013][T15264] hsr_slave_1: entered promiscuous mode [ 1000.210913][T15264] debugfs: 'hsr0' already exists in 'hsr' [ 1000.210939][T15264] Cannot create hsr debugfs directory [ 1006.042054][T15551] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.2468'. [ 1010.279493][T15613] ./loop0: Can't open blockdev [ 1010.703665][T12126] bridge_slave_1: left allmulticast mode [ 1010.703717][T12126] bridge_slave_1: left promiscuous mode [ 1010.703979][T12126] bridge0: port 2(bridge_slave_1) entered disabled state [ 1010.894800][T12126] bridge_slave_0: left allmulticast mode [ 1010.894839][T12126] bridge_slave_0: left promiscuous mode [ 1010.926831][T12126] bridge0: port 1(bridge_slave_0) entered disabled state [ 1011.195445][T12126] bridge_slave_1: left allmulticast mode [ 1011.195483][T12126] bridge_slave_1: left promiscuous mode [ 1011.195721][T12126] bridge0: port 2(bridge_slave_1) entered disabled state [ 1012.267627][T12126] bridge_slave_0: left allmulticast mode [ 1012.267665][T12126] bridge_slave_0: left promiscuous mode [ 1012.267913][T12126] bridge0: port 1(bridge_slave_0) entered disabled state [ 1012.415356][T12126] bridge_slave_1: left allmulticast mode [ 1012.415394][T12126] bridge_slave_1: left promiscuous mode [ 1012.415674][T12126] bridge0: port 2(bridge_slave_1) entered disabled state [ 1012.507245][T12126] bridge_slave_0: left allmulticast mode [ 1012.507283][T12126] bridge_slave_0: left promiscuous mode [ 1012.507535][T12126] bridge0: port 1(bridge_slave_0) entered disabled state [ 1014.602577][T15639] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1014.674650][T12126] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1014.726709][T12126] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1014.767272][T12126] bond0 (unregistering): Released all slaves [ 1015.978968][T12126] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1016.096175][T12126] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1016.178389][T12126] bond0 (unregistering): Released all slaves [ 1016.495910][T12126] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1016.595809][T12126] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1016.677603][T12126] bond0 (unregistering): Released all slaves [ 1020.043351][T13346] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1020.115364][T13346] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1020.123622][T13346] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1020.144027][T13346] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1020.152894][T13346] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1020.771562][ T5249] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1022.279416][ T10] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 1022.395186][T14844] Bluetooth: hci5: command tx timeout [ 1022.575327][ T10] usb 8-1: device descriptor read/64, error -71 [ 1022.815262][ T10] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 1022.945161][ T10] usb 8-1: device descriptor read/64, error -71 [ 1023.065272][ T10] usb usb8-port1: attempt power cycle [ 1023.485221][ T10] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 1023.615260][ T10] usb 8-1: device descriptor read/8, error -71 [ 1023.686574][ T5249] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1023.915238][ T10] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 1023.935934][ T10] usb 8-1: device descriptor read/8, error -71 [ 1024.047236][ T10] usb usb8-port1: unable to enumerate USB device [ 1024.273141][T12126] hsr_slave_0: left promiscuous mode [ 1024.285241][T12126] hsr_slave_1: left promiscuous mode [ 1024.286066][T12126] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1024.408025][T12126] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1024.425357][T14844] Bluetooth: hci5: command tx timeout [ 1025.585412][T12126] hsr_slave_0: left promiscuous mode [ 1025.606528][T12126] hsr_slave_1: left promiscuous mode [ 1025.607850][T12126] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1025.646380][T12126] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1025.785388][T12126] hsr_slave_0: left promiscuous mode [ 1025.805422][T12126] hsr_slave_1: left promiscuous mode [ 1025.806217][T12126] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1025.847208][T12126] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1027.142100][T14844] Bluetooth: hci5: command tx timeout [ 1027.752314][T13346] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1027.794185][T12126] team0 (unregistering): Port device team_slave_1 removed [ 1027.811870][T13346] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1027.831682][T13346] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1027.833037][T13346] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1027.834555][T13346] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1027.870071][T12126] team0 (unregistering): Port device team_slave_0 removed [ 1028.497762][T12126] team0 (unregistering): Port device team_slave_1 removed [ 1028.556250][T12126] team0 (unregistering): Port device team_slave_0 removed [ 1029.205145][T14844] Bluetooth: hci5: command tx timeout [ 1029.337420][T12126] team0 (unregistering): Port device team_slave_1 removed [ 1029.570250][T12126] team0 (unregistering): Port device team_slave_0 removed [ 1030.266861][T14844] Bluetooth: hci3: command tx timeout [ 1032.394790][T14844] Bluetooth: hci3: command tx timeout [ 1033.589603][T15671] bridge0: port 1(bridge_slave_0) entered blocking state [ 1033.589806][T15671] bridge0: port 1(bridge_slave_0) entered disabled state [ 1033.590004][T15671] bridge_slave_0: entered allmulticast mode [ 1033.592489][T15671] bridge_slave_0: entered promiscuous mode [ 1033.632971][T15671] bridge0: port 2(bridge_slave_1) entered blocking state [ 1033.633207][T15671] bridge0: port 2(bridge_slave_1) entered disabled state [ 1033.633404][T15671] bridge_slave_1: entered allmulticast mode [ 1033.658654][T15671] bridge_slave_1: entered promiscuous mode [ 1033.948100][T15671] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1033.980577][T15671] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1034.352693][T15671] team0: Port device team_slave_0 added [ 1034.435367][T13346] Bluetooth: hci3: command tx timeout [ 1034.451553][T15671] team0: Port device team_slave_1 added [ 1034.688050][T15671] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1034.688069][T15671] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1034.688104][T15671] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1034.808238][T15671] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1034.808258][T15671] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1034.808279][T15671] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1035.582123][T15671] hsr_slave_0: entered promiscuous mode [ 1035.583574][T15671] hsr_slave_1: entered promiscuous mode [ 1035.587960][T15671] debugfs: 'hsr0' already exists in 'hsr' [ 1035.587989][T15671] Cannot create hsr debugfs directory [ 1037.247944][T13346] Bluetooth: hci3: command tx timeout [ 1038.309071][T14844] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1038.360995][T14844] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1038.363830][T14844] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1038.364882][T14844] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1038.410647][T14844] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1040.505235][T14844] Bluetooth: hci6: command tx timeout [ 1043.070676][T14844] Bluetooth: hci6: command tx timeout [ 1043.310740][T15731] bridge0: port 1(bridge_slave_0) entered blocking state [ 1043.310923][T15731] bridge0: port 1(bridge_slave_0) entered disabled state [ 1043.311130][T15731] bridge_slave_0: entered allmulticast mode [ 1043.324932][T15731] bridge_slave_0: entered promiscuous mode [ 1043.402329][T15731] bridge0: port 2(bridge_slave_1) entered blocking state [ 1043.402451][T15731] bridge0: port 2(bridge_slave_1) entered disabled state [ 1043.402652][T15731] bridge_slave_1: entered allmulticast mode [ 1043.429216][T15731] bridge_slave_1: entered promiscuous mode [ 1045.308735][T14844] Bluetooth: hci6: command tx timeout [ 1048.402073][T15731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1049.923820][T15731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1150.694993][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1150.701989][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P1642/2:b..l P15836/1:b..l [ 1150.711130][ C0] rcu: (detected by 0, t=10502 jiffies, g=77941, q=401 ncpus=2) [ 1150.718943][ C0] task:syz.7.2500 state:D stack:24688 pid:15836 tgid:15836 ppid:11515 task_flags:0x400040 flags:0x00080002 [ 1150.730880][ C0] Call Trace: [ 1150.734160][ C0] [ 1150.737096][ C0] __schedule+0x16d9/0x5700 [ 1150.741638][ C0] ? __pfx___schedule+0x10/0x10 [ 1150.746508][ C0] schedule_rtlock+0x30/0x70 [ 1150.751105][ C0] rtlock_slowlock_locked+0x35c9/0x3c20 [ 1150.756666][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 1150.761891][ C0] ? rtlock_slowlock_locked+0x2ab/0x3c20 [ 1150.767544][ C0] ? __pfx_rtlock_slowlock_locked+0x10/0x10 [ 1150.773468][ C0] ? rcu_is_watching+0x16/0xb0 [ 1150.778254][ C0] rt_spin_lock+0x165/0x400 [ 1150.782769][ C0] ? __pfx_rt_spin_lock+0x10/0x10 [ 1150.787820][ C0] ? rcu_is_watching+0x16/0xb0 [ 1150.792596][ C0] ? __local_bh_disable_ip+0x3d/0x420 [ 1150.797980][ C0] ? lock_sock_nested+0x69/0x130 [ 1150.802926][ C0] ? lock_sock_nested+0x69/0x130 [ 1150.807872][ C0] lock_sock_nested+0x7e/0x130 [ 1150.812651][ C0] tipc_release+0xc4/0x2500 [ 1150.817160][ C0] ? lock_acquire+0x115/0x350 [ 1150.821855][ C0] ? __pfx_tipc_release+0x10/0x10 [ 1150.826891][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1150.832707][ C0] ? rwbase_write_lock+0x550/0x720 [ 1150.837837][ C0] __sock_release+0xa0/0x1f0 [ 1150.842440][ C0] ? __pfx_sock_close+0x10/0x10 [ 1150.847301][ C0] sock_close+0x1c/0x30 [ 1150.851472][ C0] __fput+0x42a/0xa80 [ 1150.855467][ C0] task_work_run+0x1d9/0x270 [ 1150.860064][ C0] ? __pfx_task_work_run+0x10/0x10 [ 1150.865186][ C0] exit_to_user_mode_loop+0x204/0x770 [ 1150.870566][ C0] ? rcu_is_watching+0x16/0xb0 [ 1150.875348][ C0] do_syscall_64+0x328/0x520 [ 1150.879944][ C0] ? trace_irq_disable+0x3b/0x140 [ 1150.884976][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1150.891043][ C0] ? clear_bhb_loop+0x70/0xc0 [ 1150.895727][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1150.901620][ C0] RIP: 0033:0x7fc87010e199 [ 1150.906034][ C0] RSP: 002b:00007ffc133e7d48 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 1150.914451][ C0] RAX: 0000000000000000 RBX: 00007fc870397da0 RCX: 00007fc87010e199 [ 1150.922423][ C0] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 1150.930401][ C0] RBP: 00007fc870397da0 R08: 0000000000000006 R09: 0000000000000000 [ 1150.938387][ C0] R10: 00007fc870397cb0 R11: 0000000000000246 R12: 00000000000ff489 [ 1150.946792][ C0] R13: 00007fc870395fac R14: 00000000000ff424 R15: 00007ffc133e7e50 [ 1150.954781][ C0] [ 1150.957797][ C0] task:kworker/u8:13 state:R running task stack:21112 pid:1642 tgid:1642 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1150.971378][ C0] Workqueue: tipc_send tipc_conn_send_work [ 1150.977225][ C0] Call Trace: [ 1150.980497][ C0] [ 1150.983427][ C0] __schedule+0x16d9/0x5700 [ 1150.987971][ C0] ? __pfx___schedule+0x10/0x10 [ 1150.992826][ C0] ? lockdep_unlock+0x5c/0xd0 [ 1150.997501][ C0] ? __lock_acquire+0x1511/0x2de0 [ 1151.002541][ C0] preempt_schedule_irq+0x4b/0x90 [ 1151.007571][ C0] irqentry_exit+0x14f/0x920 [ 1151.012161][ C0] ? trace_irq_disable+0x3b/0x140 [ 1151.017214][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1151.023198][ C0] RIP: 0010:lock_acquire+0x232/0x350 [ 1151.028486][ C0] Code: ff ff ff e8 e0 09 b7 09 f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 22 d4 03 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 3f de ba 09 cc 48 8d 3d 17 29 13 [ 1151.048095][ C0] RSP: 0018:ffffc900072d6ca0 EFLAGS: 00000296 [ 1151.054166][ C0] RAX: 7209be926ddaf600 RBX: 0000000000000001 RCX: 0000000000000046 [ 1151.062136][ C0] RDX: ffff88802a05cbb0 RSI: ffffffff8dae0efd RDI: ffffffff8bcc4c80 [ 1151.070108][ C0] RBP: ffff88802a05be80 R08: ffffc900072d6ac0 R09: 0000000000000020 [ 1151.078081][ C0] R10: dffffc0000000000 R11: ffffffff81a27bf0 R12: ffffc900072d7470 [ 1151.086054][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000246 [ 1151.094120][ C0] ? __pfx_hlock_conflict+0x10/0x10 [ 1151.099350][ C0] rt_spin_lock+0x83/0x400 [ 1151.103777][ C0] ? tipc_sk_rcv+0x653/0x2b30 [ 1151.108462][ C0] ? __pfx_rt_spin_lock+0x10/0x10 [ 1151.113497][ C0] ? __local_bh_disable_ip+0x3d/0x420 [ 1151.118875][ C0] ? rt_spin_trylock_bh+0x159/0x2f0 [ 1151.124083][ C0] ? tipc_sk_rcv+0x299/0x2b30 [ 1151.128769][ C0] tipc_sk_rcv+0x653/0x2b30 [ 1151.133327][ C0] ? tipc_sk_rcv+0x299/0x2b30 [ 1151.138125][ C0] ? __pfx_tipc_sk_rcv+0x10/0x10 [ 1151.143109][ C0] ? tipc_loopback_trace+0x48/0x1b0 [ 1151.148457][ C0] tipc_node_xmit+0x218/0xf10 [ 1151.153239][ C0] ? __pfx_tipc_node_xmit+0x10/0x10 [ 1151.158516][ C0] ? do_raw_spin_unlock+0xf5/0x200 [ 1151.163641][ C0] ? __set_cpus_allowed_ptr_locked+0x9ca/0x19c0 [ 1151.169889][ C0] ? __pfx___set_cpus_allowed_ptr_locked+0x10/0x10 [ 1151.176424][ C0] tipc_node_distr_xmit+0x2da/0x420 [ 1151.181648][ C0] ? __pfx_tipc_node_distr_xmit+0x10/0x10 [ 1151.187388][ C0] ? __local_bh_enable_ip+0x1ad/0x2b0 [ 1151.192769][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 1151.197984][ C0] tipc_sk_rcv+0x273c/0x2b30 [ 1151.202604][ C0] ? tipc_sk_rcv+0x299/0x2b30 [ 1151.207303][ C0] ? __pfx_tipc_sk_rcv+0x10/0x10 [ 1151.212263][ C0] ? lock_acquire+0x115/0x350 [ 1151.217053][ C0] ? tipc_conn_send_work+0x19c/0xa50 [ 1151.222376][ C0] tipc_conn_send_work+0x6cd/0xa50 [ 1151.227502][ C0] ? tipc_conn_send_work+0x19c/0xa50 [ 1151.232903][ C0] ? __pfx_tipc_conn_send_work+0x10/0x10 [ 1151.238604][ C0] ? rcu_is_watching+0x16/0xb0 [ 1151.243387][ C0] ? process_scheduled_works+0x97a/0x1630 [ 1151.249121][ C0] process_scheduled_works+0xc3d/0x1630 [ 1151.254715][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 1151.260717][ C0] ? assign_work+0x3cf/0x5d0 [ 1151.265323][ C0] worker_thread+0xa47/0xfb0 [ 1151.269943][ C0] ? __kthread_parkme+0x71/0x1f0 [ 1151.274902][ C0] kthread+0x38b/0x470 [ 1151.279066][ C0] ? __pfx_worker_thread+0x10/0x10 [ 1151.284276][ C0] ? __pfx_kthread+0x10/0x10 [ 1151.288872][ C0] ret_from_fork+0x514/0xb70 [ 1151.293471][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1151.298579][ C0] ? __switch_to+0xc89/0x1420 [ 1151.303355][ C0] ? __pfx_kthread+0x10/0x10 [ 1151.307948][ C0] ret_from_fork_asm+0x1a/0x30 [ 1151.312744][ C0] [ 1151.315762][ C0] rcu: rcu_preempt kthread timer wakeup didn't happen for 10562 jiffies! g77941 f0x0 RCU_GP_WAIT_FQS(5) ->state=I [ 1151.327751][ C0] rcu: Possible timer handling issue on cpu=1 timer-softirq=38844 [ 1151.335649][ C0] rcu: rcu_preempt kthread starved for 10563 jiffies! g77941 f0x0 RCU_GP_WAIT_FQS(5) ->state=I ->cpu=1 [ 1151.346706][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1151.356678][ C0] rcu: RCU grace-period kthread stack dump: [ 1151.362564][ C0] task:rcu_preempt state:I stack:26848 pid:18 tgid:18 ppid:2 task_flags:0x208040 flags:0x00080000 [ 1151.374500][ C0] Call Trace: [ 1151.377786][ C0] [ 1151.380733][ C0] __schedule+0x16d9/0x5700 [ 1151.385273][ C0] ? __pfx___schedule+0x10/0x10 [ 1151.390122][ C0] ? lock_acquire+0x115/0x350 [ 1151.394813][ C0] ? schedule+0x90/0x2b0 [ 1151.399064][ C0] schedule+0x164/0x2b0 [ 1151.403311][ C0] schedule_timeout+0x152/0x2c0 [ 1151.408165][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 1151.413542][ C0] ? __pfx_process_timeout+0x10/0x10 [ 1151.418840][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1151.424656][ C0] ? prepare_to_swait_event+0x322/0x350 [ 1151.430217][ C0] rcu_gp_fqs_loop+0x30c/0x11f0 [ 1151.435095][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1151.440387][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1151.445591][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1151.451423][ C0] rcu_gp_kthread+0x9e/0x2b0 [ 1151.456034][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1151.461249][ C0] ? __kthread_parkme+0x71/0x1f0 [ 1151.466197][ C0] ? __kthread_parkme+0x199/0x1f0 [ 1151.471241][ C0] kthread+0x38b/0x470 [ 1151.475313][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1151.480518][ C0] ? __pfx_kthread+0x10/0x10 [ 1151.485116][ C0] ret_from_fork+0x514/0xb70 [ 1151.489711][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1151.494823][ C0] ? __switch_to+0xc89/0x1420 [ 1151.499514][ C0] ? __pfx_kthread+0x10/0x10 [ 1151.504113][ C0] ret_from_fork_asm+0x1a/0x30 [ 1151.508890][ C0] [ 1151.511909][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 1151.518226][ C0] Sending NMI from CPU 0 to CPUs 1: [ 1151.523444][ C1] NMI backtrace for cpu 1 [ 1151.523468][ C1] CPU: 1 UID: 0 PID: 15837 Comm: syz.7.2500 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1151.523514][ C1] Tainted: [L]=SOFTLOCKUP [ 1151.523525][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1151.523535][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x61/0x80 [ 1151.523561][ C1] Code: ff 0f 77 3d 81 e2 00 00 00 0f 75 35 83 b9 2c 17 00 00 00 74 2c 8b 91 00 17 00 00 83 fa 02 75 21 48 8b 91 08 17 00 00 48 8b 32 <48> 8d 7e 01 8b 89 04 17 00 00 48 39 cf 73 08 48 89 3a 48 89 44 f2 [ 1151.523576][ C1] RSP: 0018:ffffc90004a3f218 EFLAGS: 00000246 [ 1151.523593][ C1] RAX: ffffffff8af72b5d RBX: 0000000000000001 RCX: ffff888037e99f40 [ 1151.523606][ C1] RDX: ffffc9000f0d9000 RSI: 000000000007ffff RDI: 0000000000000000 [ 1151.523618][ C1] RBP: ffffc90004a3f310 R08: 0000000000000000 R09: 0000000000000000 [ 1151.523629][ C1] R10: 0000000000000100 R11: 0000000000000003 R12: ffff88805b92c110 [ 1151.523641][ C1] R13: dffffc0000000000 R14: 1ffff11008087239 R15: ffff888062c00000 [ 1151.523655][ C1] FS: 00007fc86e3666c0(0000) GS:ffff888125cc2000(0000) knlGS:0000000000000000 [ 1151.523670][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1151.523682][ C1] CR2: 00005555e1690078 CR3: 000000006e72a000 CR4: 00000000003526f0 [ 1151.523698][ C1] Call Trace: [ 1151.523707][ C1] [ 1151.523713][ C1] tipc_sk_lookup+0x30d/0x920 [ 1151.523739][ C1] ? tipc_sk_lookup+0xb5/0x920 [ 1151.523759][ C1] ? __pfx_tipc_sk_lookup+0x10/0x10 [ 1151.523779][ C1] ? __local_bh_enable_ip+0x1ad/0x2b0 [ 1151.523802][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 1151.523823][ C1] tipc_sk_rcv+0x45d/0x2b30 [ 1151.523847][ C1] ? stack_trace_save+0xa9/0x100 [ 1151.523869][ C1] ? lock_acquire+0x115/0x350 [ 1151.523892][ C1] ? tipc_sk_rcv+0x299/0x2b30 [ 1151.523921][ C1] ? __pfx_tipc_sk_rcv+0x10/0x10 [ 1151.523950][ C1] ? tipc_loopback_trace+0x48/0x1b0 [ 1151.523975][ C1] tipc_node_xmit+0x218/0xf10 [ 1151.523992][ C1] ? stack_depot_save_flags+0x33/0x7f0 [ 1151.524016][ C1] ? tipc_bcast_xmit+0x331/0x4f0 [ 1151.524040][ C1] ? __pfx_tipc_node_xmit+0x10/0x10 [ 1151.524056][ C1] ? __kasan_slab_alloc+0x6c/0x80 [ 1151.524081][ C1] ? kmem_cache_alloc_node_noprof+0x3fc/0x660 [ 1151.524105][ C1] ? __alloc_skb+0x27a/0x7a0 [ 1151.524122][ C1] ? tipc_msg_create+0x4c/0x4c0 [ 1151.524146][ C1] ? tipc_group_proto_xmit+0xce/0x790 [ 1151.524164][ C1] ? tipc_group_join+0x156/0x710 [ 1151.524181][ C1] ? tipc_sk_join+0x480/0x6a0 [ 1151.524205][ C1] ? tipc_setsockopt+0x73e/0x9a0 [ 1151.524228][ C1] ? do_sock_setsockopt+0x17c/0x1b0 [ 1151.524246][ C1] ? __x64_sys_setsockopt+0x143/0x1b0 [ 1151.524264][ C1] ? do_syscall_64+0x166/0x520 [ 1151.524282][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1151.524322][ C1] tipc_node_distr_xmit+0x2da/0x420 [ 1151.524344][ C1] ? __pfx_tipc_node_distr_xmit+0x10/0x10 [ 1151.524373][ C1] ? tipc_group_proto_xmit+0x3d6/0x790 [ 1151.524394][ C1] tipc_group_join+0x571/0x710 [ 1151.524417][ C1] ? __pfx_tipc_group_join+0x10/0x10 [ 1151.524444][ C1] ? __pfx_tipc_sk_publish+0x10/0x10 [ 1151.524465][ C1] ? tipc_nametbl_build_group+0x2e/0x530 [ 1151.524485][ C1] ? tipc_nametbl_build_group+0x4f9/0x530 [ 1151.524505][ C1] ? tipc_nametbl_build_group+0x2e/0x530 [ 1151.524535][ C1] tipc_sk_join+0x480/0x6a0 [ 1151.524563][ C1] ? __pfx_tipc_sk_join+0x10/0x10 [ 1151.524589][ C1] ? __local_bh_enable_ip+0x1ad/0x2b0 [ 1151.524611][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 1151.524632][ C1] tipc_setsockopt+0x73e/0x9a0 [ 1151.524659][ C1] ? __pfx_tipc_setsockopt+0x10/0x10 [ 1151.524683][ C1] ? __fget_files+0x2a/0x420 [ 1151.524704][ C1] ? __fget_files+0x2a/0x420 [ 1151.524721][ C1] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 1151.524740][ C1] ? __pfx_tipc_setsockopt+0x10/0x10 [ 1151.524765][ C1] do_sock_setsockopt+0x17c/0x1b0 [ 1151.524786][ C1] __x64_sys_setsockopt+0x143/0x1b0 [ 1151.524808][ C1] do_syscall_64+0x166/0x520 [ 1151.524826][ C1] ? trace_irq_disable+0x3b/0x140 [ 1151.524849][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1151.524866][ C1] ? clear_bhb_loop+0x70/0xc0 [ 1151.524886][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1151.524903][ C1] RIP: 0033:0x7fc87010e199 [ 1151.524919][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1151.524933][ C1] RSP: 002b:00007fc86e366028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1151.524952][ C1] RAX: ffffffffffffffda RBX: 00007fc870395fa0 RCX: 00007fc87010e199 [ 1151.524965][ C1] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000007 [ 1151.524975][ C1] RBP: 00007fc8701a50b8 R08: 0000000000000010 R09: 0000000000000000 [ 1151.524987][ C1] R10: 0000200000000440 R11: 0000000000000246 R12: 0000000000000000 [ 1151.524997][ C1] R13: 00007fc870396038 R14: 00007fc870395fa0 R15: 00007ffc133e7be8 [ 1151.525019][ C1]