last executing test programs: 7m30.041829669s ago: executing program 2 (id=64): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000002000010027bd700000000040020000000000000d00000000080018004e224e23"], 0x24}, 0x1, 0x0, 0x0, 0x24040804}, 0x4008000) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00!'], 0x5c}}, 0x40084) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./trace/trace\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000007000)={0x2020}, 0x2020) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@getlink={0x28, 0x12, 0x1, 0x0, 0x0, {}, [@IFLA_TXQLEN={0x8, 0x3}]}, 0x28}}, 0x0) brk(0x0) 7m20.432931606s ago: executing program 2 (id=89): sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv2(r0, &(0x7f0000001540)=[{0x0}, {0x0}], 0x2, 0x0, 0x0, 0x0) 7m17.648354998s ago: executing program 2 (id=95): socket$inet6(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) socket$inet(0x2, 0x2, 0x1) syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/timers\x00', 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f00000017c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r0, @ANYBLOB='\a'], 0x0) 7m12.460711212s ago: executing program 2 (id=105): sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv2(r0, &(0x7f0000001540)=[{0x0}, {0x0}], 0x2, 0x0, 0x0, 0x0) 7m9.533450849s ago: executing program 2 (id=111): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) syz_open_procfs(0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x4000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) 7m9.376343242s ago: executing program 2 (id=112): bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FIBMAP(r0, 0x2275, &(0x7f0000000100)=0x3) 6m51.372209171s ago: executing program 32 (id=112): bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FIBMAP(r0, 0x2275, &(0x7f0000000100)=0x3) 2m52.506119377s ago: executing program 4 (id=1147): r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000100)={0x2, 0x1, 0x1}) 2m52.231892014s ago: executing program 4 (id=1151): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0x1, 0x1, 0x107fff, 0x1, 0x4, 0x89, 0x0, 0xffb, 0x7, 0xb6b, 0x0, 0x4, 0x1, 0x3, 0x9, 0xff, 0x1003, 0xc, 0x3, 0x3, 0x80000001, 0xfffffffa, 0x0, 0x1, 0x9, 0x4, 0xa, 0x5, 0x100000, 0x9, 0x3, 0x63c, 0x10, 0x10001008, 0x2, 0x6, 0x1bf7, 0xc, 0x40, 0x0, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x8, 0x5, 0x79b, 0x3, 0x40001, 0x7f, 0x4, 0xa, 0x9, 0x8001, 0x101, 0xa, 0x1fa0860a, 0x3, 0x100aa, 0x3, 0x10000002, 0x0, 0x6, 0x8b, 0x5, 0x2af, 0x3, 0x5, 0x2, 0x1, 0x9, 0x5, 0x6, 0x1, 0x0, 0x4, 0x9, 0x4, 0x3, 0x3, 0x3, 0x0, 0x10000, 0x3f6, 0xffffffff, 0x6, 0x6, 0x9, 0xfffffffb, 0xfdffffff, 0x2, 0x1, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x4, 0x9, 0xc50, 0xfffffffe, 0xe, 0x2, 0xd9a, 0xc8, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x4, 0x100, 0x4, 0x2, 0x40, 0xe, 0x4, 0x5, 0x401, 0x66cd, 0x8, 0x8, 0x799e, 0x1fc, 0x1ff, 0xffffffff]}}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="60000000100005040100000000000000000000000003000000000000000000000a000300766574683000000034001280090001007665746800000000240002"], 0x60}}, 0x0) 2m51.756427957s ago: executing program 4 (id=1157): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000003300), 0x40002, 0x0) write$rfkill(r0, &(0x7f00000000c0)={0x0, 0x2, 0x3, 0xfe, 0x1}, 0x8) 2m51.573355134s ago: executing program 4 (id=1161): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) syz_usbip_server_init(0x3) syz_usbip_server_init(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1fe) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) umount2(&(0x7f0000000300)='./file0\x00', 0xc) 2m50.743460214s ago: executing program 4 (id=1173): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)={0x30, r0, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x14b4}]]}, 0x30}}, 0x0) 2m47.772936447s ago: executing program 4 (id=1195): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xc, &(0x7f0000000080), 0x4) sendto$inet6(r0, 0x0, 0x0, 0x20000845, 0x0, 0x0) 2m47.422167499s ago: executing program 33 (id=1195): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xc, &(0x7f0000000080), 0x4) sendto$inet6(r0, 0x0, 0x0, 0x20000845, 0x0, 0x0) 2m25.786493161s ago: executing program 5 (id=1380): r0 = socket$kcm(0x10, 0x2, 0x4) recvmmsg(r0, &(0x7f0000003d00)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x40000000, 0x0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 2m24.804797152s ago: executing program 5 (id=1394): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) io_setup(0x200, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f0000003440)=[&(0x7f00000000c0)={0x0, 0x0, 0xa1, 0x0, 0x4, r0, &(0x7f0000000040)="1d", 0x1, 0x801}]) 2m24.344144839s ago: executing program 5 (id=1397): mkdirat(0xffffffffffffff9c, 0x0, 0x134) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x101002, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, 0x0, &(0x7f0000000400)='//\xf2/\x06\b///\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L6\x18\x91\xd2_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\x04\x00\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\xc8\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = gettid() tkill(r5, 0xb) epoll_pwait(0xffffffffffffffff, &(0x7f0000000040)=[{}], 0x1, 0x2, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f00000001c0)={0x4800, 0x0, 0x4, 0x0, 0xb9a9, 0x9ce}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002580)=ANY=[@ANYBLOB="3400b800000000000000090800"/24, @ANYRES32=0x0, @ANYBLOB="31200000000000000c002b8008000100", @ANYRES32, @ANYBLOB="08001b0000000000"], 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) 1m49.731429019s ago: executing program 3 (id=1620): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000e00000001000000000000010400000020000001000000000000000d01000000050000000000000c020000000a0000000000000c0200000000696e74006d61696e0073"], 0x0, 0x5a}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000608), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x5, 0xb, &(0x7f0000000400)=ANY=[@ANYBLOB="18110000", @ANYRES32, @ANYBLOB="000000000000000018420000060000000000000000000000b703000000000000b70400000000000085000000a4000000b7000000000000009500000000000000b7000000000000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x1, 0x100000, &(0x7f0000000700)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r0, 0x8, &(0x7f0000000600)={0x0, 0x3}, 0x2, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) 1m49.522984471s ago: executing program 3 (id=1621): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1c, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x1e, &(0x7f0000000200)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, @void, {@can={0xc, {{0x2, 0x1}, 0x0, 0x2, 0x0, 0x0, "6d60ac2ca4972294"}}}}, 0x0) 1m49.428328452s ago: executing program 3 (id=1623): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x80) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, 0x27, 0x1, 0x7fffd, 0x1000, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008090) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x3}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x28}}, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x6, 0xb, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000300000000000000010000001801000020756c0000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000009002000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'syz_tun\x00'}) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0xc, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000700)={'wpan0\x00'}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x44, 0x41, 0x1, 0x70bd25, 0x25dfdbfe, {0x1}, [@nested={0x4, 0x48}, @nested={0x18, 0x1, 0x0, 0x1, [@nested={0x14, 0x10, 0x0, 0x1, [@nested={0x4, 0x10}, @typed={0x9, 0xb, 0x0, 0x0, @str='}&:}\x00'}]}]}, @typed={0x14, 0x2, 0x0, 0x0, @ipv6=@local}]}, 0x44}, 0x1, 0x0, 0x0, 0x400c801}, 0x200080c4) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2e, 0x76, 0x0, 0x0, 0x2b000000}, [@call={0x27, 0x0, 0x0, 0x20000000}]}, 0x0, 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r6, 0x89f2, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000400)={'sit0\x00', 0x0, 0xee3e0ec5e1c42de9, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x4, 0x0, @empty, @empty}}}}) socket$netlink(0x10, 0x3, 0x4) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r7, &(0x7f0000002fc0)=[{{&(0x7f0000000680)={0xa, 0x4e23, 0xfffffff9, @dev={0xfe, 0x80, '\x00', 0x33}, 0x9}, 0x1c, &(0x7f00000004c0)=[{&(0x7f00000005c0)="05", 0x1}], 0x1}}], 0x1, 0x24000045) shutdown(r7, 0x1) 1m34.288456538s ago: executing program 35 (id=1623): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x80) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, 0x27, 0x1, 0x7fffd, 0x1000, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008090) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000000)={0x28, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x3}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x28}}, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x6, 0xb, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000300000000000000010000001801000020756c0000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000009002000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'syz_tun\x00'}) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0xc, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000700)={'wpan0\x00'}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x44, 0x41, 0x1, 0x70bd25, 0x25dfdbfe, {0x1}, [@nested={0x4, 0x48}, @nested={0x18, 0x1, 0x0, 0x1, [@nested={0x14, 0x10, 0x0, 0x1, [@nested={0x4, 0x10}, @typed={0x9, 0xb, 0x0, 0x0, @str='}&:}\x00'}]}]}, @typed={0x14, 0x2, 0x0, 0x0, @ipv6=@local}]}, 0x44}, 0x1, 0x0, 0x0, 0x400c801}, 0x200080c4) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2e, 0x76, 0x0, 0x0, 0x2b000000}, [@call={0x27, 0x0, 0x0, 0x20000000}]}, 0x0, 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r6, 0x89f2, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000400)={'sit0\x00', 0x0, 0xee3e0ec5e1c42de9, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x4, 0x0, @empty, @empty}}}}) socket$netlink(0x10, 0x3, 0x4) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r7, &(0x7f0000002fc0)=[{{&(0x7f0000000680)={0xa, 0x4e23, 0xfffffff9, @dev={0xfe, 0x80, '\x00', 0x33}, 0x9}, 0x1c, &(0x7f00000004c0)=[{&(0x7f00000005c0)="05", 0x1}], 0x1}}], 0x1, 0x24000045) shutdown(r7, 0x1) 5.040540799s ago: executing program 1 (id=2312): socket$nl_route(0x10, 0x3, 0x0) r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cdab01ef0001010203010902270001010080fa0904000003ff00000007058103"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/usb/drivers/ushc/new_id\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write(r1, &(0x7f0000000300)='abcd ef01', 0x9) r2 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) r3 = userfaultfd(0x80801) ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) lsetxattr$security_ima(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000380)=@sha1={0x1, "39c6e7c386367ad2eda61e17cacc02c7fbce9f03"}, 0x15, 0x1) syz_usb_control_io(r0, &(0x7f0000000580)={0x2c, &(0x7f00000003c0)={0x20, 0x21, 0x4, {0x4, 0xd, "72a7"}}, &(0x7f0000000400)={0x0, 0x3, 0x66, @string={0x66, 0x3, "0da36be9adcf9b9e794a6252e90d101546afcd9ce4a11ad0d52065953735b7d8601479ccd4d7361802cce4f8d29b10365a70b970f040a830d91b1e46001864c1f0ffbe5ed5b0564719a19a44ea1ee9abc21853a850e550a705c6b1b8e36bd1b9eff2efe8"}}, &(0x7f0000000480)={0x0, 0xf, 0x2e, {0x5, 0xf, 0x2e, 0x6, [@ext_cap={0x7, 0x10, 0x2, 0x14, 0x4, 0x8, 0x3}, @wireless={0xb, 0x10, 0x1, 0x2, 0x2, 0xad, 0x9, 0x4, 0x1}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x1, 0x8}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0x4, 0x81, 0xff}, @ptm_cap={0x3}]}}, &(0x7f00000004c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3c, 0x0, 0xa9, 0x2, "ac563a03", "cb59b277"}}, &(0x7f0000000540)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x2, 0x4, 0x1, 0x8, 0x3, 0x9}}}, &(0x7f0000000b00)={0x84, &(0x7f00000005c0)={0x20, 0x30, 0xe, "19fdcc83228d8adea1c541b3d97d"}, 0x0, &(0x7f0000000680)={0x0, 0x8, 0x1, 0xa5}, &(0x7f0000000740)={0x20, 0x0, 0x4, {0x1, 0x3}}, &(0x7f0000000780)={0x20, 0x0, 0x8, {0x20, 0x20, [0xf00]}}, &(0x7f00000007c0)={0x40, 0x7, 0x2, 0x5}, &(0x7f0000000800)={0x40, 0x9, 0x1, 0xff}, &(0x7f0000000840)={0x40, 0xb, 0x2, "73c5"}, &(0x7f0000000880)={0x40, 0xf, 0x2, 0x6}, &(0x7f0000000940)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000980)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}}, &(0x7f00000009c0)={0x40, 0x19, 0x2, "7915"}, &(0x7f0000000a00)={0x40, 0x1a, 0x2, 0x1}, &(0x7f0000000a40)={0x40, 0x1c, 0x1, 0x3}, &(0x7f0000000a80)={0x40, 0x1e, 0x1, 0x9}, &(0x7f0000000ac0)={0x40, 0x21, 0x1, 0x1}}) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32, @ANYBLOB="0000000000000000280012000c00010076"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) 4.825496302s ago: executing program 7 (id=2314): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e21, @remote}}, 0x0, 0x0, 0x23, 0x0, "e83ae75240c2d6d8ec87bb53fab0910000000000000007a5922406b64cddaeb9d339ba3c35dc0a08df8e61740b7cf2d4e499d58654a4cf0fa0ce1f830c3079cffcfd00"}, 0xd8) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='bbr', 0x3) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000140)=0x4, 0x4) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000240)}], 0x1}, 0x0) 3.700820881s ago: executing program 7 (id=2320): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)=ANY=[], 0x28}], 0x1, 0x0, 0x0, 0x24008800}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@getlink={0x28, 0x12, 0x1, 0x0, 0x0, {}, [@IFLA_EXT_MASK={0x8, 0x1d, 0x3ff}]}, 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.806737528s ago: executing program 8 (id=2328): r0 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r0, &(0x7f0000000040)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @local}}, 0x24) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x1}, 0x1c) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @mcast1, 0x5}, 0x1c) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, 0x0, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe20, 0x0, @empty}, 0x1c) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket(0xa, 0x2, 0x0) bind$inet6(r9, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x5}}, 0x1c) bind$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast2, 0x2}, 0x1c) r10 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r10, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x1000000}, 0x1c) r11 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r11, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast2, 0x12}, 0x1c) 2.676992333s ago: executing program 8 (id=2330): socket(0x400000000010, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x44042) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) bind$x25(r0, &(0x7f0000000080), 0x12) connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) ioctl$SIOCX25SFACILITIES(r0, 0x89e3, &(0x7f0000000280)={0x3d, 0xffffffff, 0x6, 0x4, 0xfffffe00}) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000080)={0x100000011, @multicast2, 0x0, 0x0, 'nq\x00', 0x5, 0x5, 0x104a}, 0x2c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac1414aa00000000000000001400020002000000e000000200000000000004000d0001007564703a73"], 0x54}}, 0x0) 2.451294847s ago: executing program 7 (id=2332): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) writev(0xffffffffffffffff, &(0x7f0000000180), 0x0) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000180)={0x1, 0xaa4, 0x0, &(0x7f0000000980)}) ioctl$KVM_SET_CLOCK(r1, 0x4188aec6, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x20000000000003, 0x1004}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000029000/0x18000)=nil, &(0x7f0000000680)=[@text16={0x10, &(0x7f0000000080)="66b9800000c00f326635010000000f3064660f38828e4258660f08676ac744240012e93bf96766c744240201000000f20f78ecf5543e660f3829544e66b9800000c00f326635002000000f300f01df66b805000000f3a5baf80c66b80e5ca48f66efbafc0cec0f01310f019c09000f01c2", 0x71}], 0x1, 0x7d, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f0000000100)={0xbc, 0x0, 0x4}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.422103612s ago: executing program 6 (id=2333): syz_genetlink_get_family_id$nl802154(&(0x7f0000002600), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="210f28bd7000fcdbdf251c00000008000300", @ANYRES32=r1], 0x3c}}, 0x24008840) 2.405199258s ago: executing program 8 (id=2334): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x35, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0xb, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf99f, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0xffff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x191, 0x3, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x1000f, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0x9, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x3ff, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x41, 0x2000803, 0xffffffff, 0x10000, 0x4, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x0, 0x4, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8004) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, 0x0, 0x4000000) clock_settime(0xfffffff4, &(0x7f00000001c0)={0x0, 0x3938700}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.28259569s ago: executing program 6 (id=2335): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1c, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[], 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x1e, &(0x7f0000000200)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, @void, {@can={0xc, {{0x2, 0x1}, 0x0, 0x2, 0x0, 0x0, "6d60ac2ca4972294"}}}}, 0x0) 2.126131174s ago: executing program 6 (id=2336): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000500)="310a0000000000dbfb239d4626adee58fd754d323afc7b2736ee85757271dc7ae4b98aabaf55146547cfc59abe3efec26a7b3f2f2bc29baf7919e5c0646c889b14b3adb8dbd6e3d08ba3fa0f98168f27810f97edb89937bcb0943a0004cb0508e65cb5c49bbaeb3b7d7faa89c8538e3f469d3e86db9e3e785f8a7da23b55abd9d0d4993407125f74a74b320ec0e7cf127fbf9b0000000000", 0xd9) 2.017471133s ago: executing program 6 (id=2337): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=2.1,nodfs\x00') r1 = accept(r0, 0x0, 0x0) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f0000002000)="00000080fe534d4240000100000000000000010001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041000100100200000000000000000000000000000000000000000000000010000000100000001000000000000000000000000000000000000000800000000000", 0x84, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f0000002100)="00000078fe534d4240000100160000c00100010001000000000000000100000000000000000000000000000001000000000000000000000000000000000000000000000009000000480030004e544c4d53535000020000000000000000", 0x5d, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f0000002200)="00000048fe534d424000010000000000010001000100000000000000020000", 0x1f, 0x0, 0x0, 0x0) 1.950967226s ago: executing program 7 (id=2338): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000000c0)={0x9}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000003240)=@gettaction={0x28, 0x5a, 0x1, 0x70bd2c, 0x1, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x805}, 0x200004c0) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x10000006, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x5}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000140)=@gcm_256={{0x303, 0x3a}, "0f6b01fa00a30c00", "9e8ecc7bb535247672a2eff75b24866882519a85ef828f711330ff2bb17b5508", "0002d900", "a1014200000102a0"}, 0x38) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r3) write$tun(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="001c86dd0700100000002800000060ec97000fc83a00fe8000000000000000000000000000aaff0200"/51], 0xffe) 1.720128315s ago: executing program 1 (id=2340): r0 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r0, &(0x7f0000000040)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @local}}, 0x24) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x1}, 0x1c) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @mcast1, 0x5}, 0x1c) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x6}, 0x1c) r7 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r7, 0x0, 0x0) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket(0xa, 0x2, 0x0) bind$inet6(r9, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x5}}, 0x1c) bind$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast2, 0x2}, 0x1c) r10 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r10, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x1000000}, 0x1c) r11 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r11, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast2, 0x12}, 0x1c) 1.637147749s ago: executing program 1 (id=2341): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="580000000206050007000000000000000a0000000c0007800fe6fa8ea66db43a0500010006000000050005000a00000005000400000000000900020073"], 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x34000c24) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r2, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018"], 0x4c}}, 0x0) 1.547994121s ago: executing program 1 (id=2342): syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_open_procfs(0x0, &(0x7f0000000140)='attr/sockcreate\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000700)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) open(&(0x7f0000000040)='.\x00', 0x20000, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200060000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 1.435483435s ago: executing program 7 (id=2343): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)=ANY=[], 0x28}], 0x1, 0x0, 0x0, 0x24008800}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@getlink={0x28, 0x12, 0x1, 0x0, 0x0, {}, [@IFLA_EXT_MASK={0x8, 0x1d, 0x3ff}]}, 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.41172997s ago: executing program 0 (id=2344): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xef, 0x0, &(0x7f0000000100)="b9ff03076844268cb89e14f008004be0ffff00124000632f77fbac141416ac141416440c05114d2f87e5940c05ab440c13f2325f1a39010702038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6e", 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c02000019000100fcffffff10000000ffffffff00"/32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000001040000000000000600000000000000090000000000000008000000000000000000000000000000000000000000000000000000000020008100000000000000090000000000000083000000000000000000000000000000ff0300000000000001010003000000008401050064010102000000000000000000000000000004d432000000000000002001000000000000000000000000000006350000000002000000000000000000000000007f000001000000000000000000000000000000042b00000000000000fe8000000000000000000000000000bb0000000000000000000800000000000000000000ac141468000000000000000000000000000004d33200000000000000000000000000000000000000000000010000000000010000000000000000000000000000fe8000000000000000000000000000bb000004d533000000000000000a0101010000000000000000000000000435000000"], 0x23c}}, 0x4080) 1.268510798s ago: executing program 0 (id=2345): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000002600), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYRES16=r0, @ANYBLOB="210f28bd7000fcdbdf251c00000008000300", @ANYRES32=r2], 0x3c}}, 0x24008840) 1.196240178s ago: executing program 0 (id=2346): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1c, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[], 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x1e, &(0x7f0000000200)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, @void, {@can={0xc, {{0x2, 0x1}, 0x0, 0x2, 0x0, 0x0, "6d60ac2ca4972294"}}}}, 0x0) 1.119915503s ago: executing program 8 (id=2347): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @empty}}, 0x24) listen(r0, 0x1) sendmsg(r0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[{0x18, 0x110, 0x1, "02"}, {0x10, 0x110, 0xe}], 0x28}, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r1, &(0x7f0000000100)={&(0x7f0000000800)=@rxrpc=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @loopback}}, 0x24, &(0x7f0000000200)=[{&(0x7f0000000300), 0x1000}], 0x1, &(0x7f0000000400)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0) recvmsg(r0, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x0) 1.017353805s ago: executing program 6 (id=2348): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) writev(0xffffffffffffffff, &(0x7f0000000180), 0x0) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000180)={0x1, 0xaa4, 0x0, &(0x7f0000000980)}) ioctl$KVM_SET_CLOCK(r1, 0x4188aec6, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x20000000000003, 0x1004}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000029000/0x18000)=nil, &(0x7f0000000680)=[@text16={0x10, &(0x7f0000000080)="66b9800000c00f326635010000000f3064660f38828e4258660f08676ac744240012e93bf96766c744240201000000f20f78ecf5543e660f3829544e66b9800000c00f326635002000000f300f01df66b805000000f3a5baf80c66b80e5ca48f66efbafc0cec0f01310f019c09000f01c2", 0x71}], 0x1, 0x7d, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f0000000100)={0xbc, 0x0, 0x4}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 945.559316ms ago: executing program 1 (id=2349): socket$inet6(0xa, 0x80002, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x1, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000063000000bca30000000000002403000020fef6ff720af0fff8ffffff71a4f0ff000000001f030000000000002e100200000000002604f8ffffff000014010000630000001d130000000000007a0a00fe0000001f0f14000000000000b503f7fff80000009500000000000000093bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98dde20358d1148272abd23da767f8c549ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb46ffffffffffffff7f1569b33d21dae356e5c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d22891202d0f5ad94b081fcd507acc9b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb9439901fb39f1d78aa60ead1883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10880fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1b9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa2000000000000000906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0900000000fbff00ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554b15dca5f77a08a83431a87881fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f783e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bcb0addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43737a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab7493c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a44434600e64a6a274000000000088b3e63a000000000000000000000000000009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e727bf10d6335332f45b8e87383930f1a4724434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc946acfb3d1a56e9ec13ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdce1f7ffffffffffffcf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b338a59c0c0247bc9412e19204caaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af11210200000000000000484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea170ab651a039d7102923e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b187ab8e0d179e6ad0dc758975e9cf77f703e742b77521149d8fdeae4b92d5edc232ca356fb86784b865adda7c921dc475276837b2619922de4d96850172602fac7d165e32419a622bdef7c91385c87c30b8a144d9b01784a8060670455f76b207517f66cf32fa0772975e0963b7373dba424beadf60d5bd08ea73e2b5620a5754455006934679b10e596821e2bd380d472c9096ca4c55d6106d0b88e38f6c54abc952c81617a06f93465241070fea3d9fc786e2625572ff2068ff84361b3883cc2c8b9a0a2f70119db13b47c924c73216bb12d1e68a03a08aa682ede113691db07b50f5e6fde6252f1520c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x10, &(0x7f00000000c0), 0xfffffffffffffd00}, 0x48) 902.997465ms ago: executing program 0 (id=2350): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB], 0x4c}}, 0x4) 817.425031ms ago: executing program 0 (id=2351): r0 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r0, &(0x7f0000000040)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @local}}, 0x24) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x1}, 0x1c) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @mcast1, 0x5}, 0x1c) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x6}, 0x1c) r7 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r7, 0x0, 0x0) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket(0xa, 0x2, 0x0) bind$inet6(r9, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x5}}, 0x1c) bind$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast2, 0x2}, 0x1c) r10 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r10, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x1000000}, 0x1c) r11 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r11, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast2, 0x12}, 0x1c) 738.916499ms ago: executing program 0 (id=2352): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40800) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040341a02080000000000010902"], 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) syz_emit_vhci(0x0, 0xd) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[], 0x0) 563.276623ms ago: executing program 6 (id=2353): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000000c0)={0x9}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000003240)=@gettaction={0x28, 0x5a, 0x1, 0x70bd2c, 0x1, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x805}, 0x200004c0) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x10000006, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x5}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000140)=@gcm_256={{0x303, 0x3a}, "0f6b01fa00a30c00", "9e8ecc7bb535247672a2eff75b24866882519a85ef828f711330ff2bb17b5508", "0002d900", "a1014200000102a0"}, 0x38) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="001c86dd0700100000002800000060ec97000fc83a00fe8000000000000000000000000000aaff0200"/51], 0xffe) 117.912727ms ago: executing program 8 (id=2354): socket$nl_generic(0x10, 0x3, 0x10) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x500, 0x0) fsopen(&(0x7f0000000180)='befs\x00', 0x1) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r0], 0x3c}, 0x1, 0x0, 0x0, 0xc881}, 0x10) 85.371127ms ago: executing program 7 (id=2355): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xef, 0x0, &(0x7f0000000100)="b9ff03076844268cb89e14f008004be0ffff00124000632f77fbac141416ac141416440c05114d2f87e5940c05ab440c13f2325f1a39010702038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6e", 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c02000019000100fcffffff10000000ffffffff00"/32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000001040000000000000600000000000000090000000000000008000000000000000000000000000000000000000000000000000000000020008100000000000000090000000000000083000000000000000000000000000000ff0300000000000001010003000000008401050064010102000000000000000000000000000004d432000000000000002001000000000000000000000000000006350000000002000000000000000000000000007f000001000000000000000000000000000000042b00000000000000fe8000000000000000000000000000bb0000000000000000000800000000000000000000ac141468000000000000000000000000000004d33200000000000000000000000000000000000000000000010000000000010000000000000000000000000000fe8000000000000000000000000000bb000004d533000000000000000a0101010000000000000000000000000435000000"], 0x23c}}, 0x4080) 55.762719ms ago: executing program 8 (id=2356): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000002600), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYRES16=r0, @ANYBLOB="210f28bd7000fcdbdf251c00000008000300", @ANYRES32=r2], 0x3c}}, 0x24008840) 0s ago: executing program 1 (id=2357): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x35, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0xb, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf99f, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0xffff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x191, 0x3, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x1000f, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0x9, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x3ff, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x41, 0x2000803, 0xffffffff, 0x10000, 0x4, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x0, 0x4, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8004) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, 0x0, 0x4000000) clock_settime(0xfffffff4, &(0x7f00000001c0)={0x0, 0x3938700}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) kernel console output (not intermixed with test programs): uetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 410.691315][ T4903] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 410.699668][ T4903] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 410.708612][ T4903] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 410.726880][ T4903] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 410.812272][ T5603] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 410.819749][ T5603] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 410.827150][ T5603] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 410.844400][ T5603] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 410.852929][ T5603] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 410.945509][ T9615] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1204'. [ 411.309645][ T9630] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 411.565720][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 411.568754][ T5323] hid_parser_main: 14 callbacks suppressed [ 411.568855][ T5323] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 411.568912][ T5323] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 411.568961][ T5323] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 411.569010][ T5323] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 411.569086][ T5323] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 411.569160][ T5323] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 411.569219][ T5323] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 411.569316][ T5323] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 411.569384][ T5323] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 411.569451][ T5323] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 411.943224][ T5323] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz0] on syz0 [ 412.230627][ T9649] fido_id[9649]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 412.605790][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 412.944002][ T9681] 9pnet_virtio: no channels available for device syz [ 413.001910][ T9682] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 413.013612][ T4903] Bluetooth: hci1: command tx timeout [ 413.645707][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 414.125246][ T9724] sctp: [Deprecated]: syz.0.1242 (pid 9724) Use of int in max_burst socket option. [ 414.125246][ T9724] Use struct sctp_assoc_value instead [ 414.236063][ T9612] bridge0: port 1(bridge_slave_0) entered blocking state [ 414.236434][ T9612] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.236921][ T9612] bridge_slave_0: entered allmulticast mode [ 414.261620][ T9612] bridge_slave_0: entered promiscuous mode [ 414.422453][ T9612] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.425485][ T9612] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.427746][ T9612] bridge_slave_1: entered allmulticast mode [ 414.457198][ T9612] bridge_slave_1: entered promiscuous mode [ 414.591471][ T9736] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 414.724486][ T9612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 414.749907][ T9612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 414.830898][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 414.887643][ T9612] team0: Port device team_slave_0 added [ 414.909948][ T9612] team0: Port device team_slave_1 added [ 415.073589][ T9748] netlink: 388 bytes leftover after parsing attributes in process `syz.0.1253'. [ 415.086038][ T4903] Bluetooth: hci1: command tx timeout [ 415.179267][ T9612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 415.179337][ T9612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 415.179405][ T9612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 415.257128][ T9612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 415.257209][ T9612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 415.257242][ T9612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 415.625141][ T9764] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1259'. [ 415.633140][ T9612] hsr_slave_0: entered promiscuous mode [ 415.646273][ T9612] hsr_slave_1: entered promiscuous mode [ 415.648826][ T9612] debugfs: 'hsr0' already exists in 'hsr' [ 415.648932][ T9612] Cannot create hsr debugfs directory [ 415.881871][ T9772] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1261'. [ 415.885698][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 416.394361][ T9783] overlayfs: failed to create directory ./file0/work (errno: 13); mounting read-only [ 416.416738][ T9783] overlayfs: fs on '.' does not support file handles, falling back to index=off,nfs_export=off. [ 416.417033][ T9783] overlayfs: failed to get uuid (257/file2, err=-13); falling back to uuid=null. [ 416.813936][ T9792] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 416.935024][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 417.058417][ T9612] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 417.124818][ T9612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 417.132437][ T9612] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 417.160739][ T9612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 417.165775][ T4903] Bluetooth: hci1: command tx timeout [ 417.202479][ T9612] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 417.251956][ T9612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 417.281750][ T9612] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 417.353127][ T9612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 417.968174][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 418.292445][ T9612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 418.312167][ T9825] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 418.402206][ T9612] 8021q: adding VLAN 0 to HW filter on device team0 [ 418.514141][ T1021] bridge0: port 1(bridge_slave_0) entered blocking state [ 418.525390][ T1021] bridge0: port 1(bridge_slave_0) entered forwarding state [ 418.598817][ T3321] bridge0: port 2(bridge_slave_1) entered blocking state [ 418.601033][ T3321] bridge0: port 2(bridge_slave_1) entered forwarding state [ 418.642607][ T9832] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1283'. [ 418.813591][ T9833] tipc: Enabling of bearer rejected, already enabled [ 419.167370][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 419.336934][ T4903] Bluetooth: hci1: command tx timeout [ 420.205808][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 420.577265][ T9856] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 420.845487][ T9867] tipc: Started in network mode [ 420.845522][ T9867] tipc: Node identity ac1414aa, cluster identity 4711 [ 420.907135][ T9867] tipc: Enabled bearer , priority 10 [ 420.965772][ T5323] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 421.127250][ T5323] usb 1-1: Using ep0 maxpacket: 8 [ 421.136060][ T5323] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 421.146867][ T5323] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 421.155204][ T5323] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 421.165033][ T5323] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 421.165073][ T5323] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 421.165094][ T5323] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 421.165117][ T5323] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 421.165158][ T5323] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.239884][ T5323] usbtmc 1-1:16.0: probe with driver usbtmc failed with error -22 [ 421.412571][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 422.091322][ T5725] tipc: Node number set to 2886997162 [ 422.456158][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 422.534873][ T9612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 422.955000][ T9904] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 423.114219][ T9612] veth0_vlan: entered promiscuous mode [ 423.131534][ T9612] veth1_vlan: entered promiscuous mode [ 423.231984][ T9612] veth0_macvtap: entered promiscuous mode [ 423.247014][ T9612] veth1_macvtap: entered promiscuous mode [ 423.279051][ T9612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 423.335909][ T9612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 423.486821][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 423.489464][ T66] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.491439][ T66] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.504661][ T3392] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.504784][ T3392] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.100040][ T1021] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 424.111328][ T1021] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 424.174276][ T9908] netlink: 'syz.1.1307': attribute type 10 has an invalid length. [ 424.174379][ T9908] syz_tun: entered promiscuous mode [ 424.197069][ T5592] usb 1-1: USB disconnect, device number 9 [ 424.259622][ T9908] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 424.390533][ T1021] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 424.390557][ T1021] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 424.526693][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 425.579760][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 426.363145][ T9941] FAULT_INJECTION: forcing a failure. [ 426.363145][ T9941] name failslab, interval 1, probability 0, space 0, times 0 [ 426.386985][ T9941] CPU: 0 UID: 0 PID: 9941 Comm: syz.5.1320 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 426.387017][ T9941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 426.387036][ T9941] Call Trace: [ 426.387046][ T9941] [ 426.387056][ T9941] dump_stack_lvl+0xe8/0x150 [ 426.387100][ T9941] should_fail_ex+0x46b/0x600 [ 426.387133][ T9941] should_failslab+0xa8/0x100 [ 426.387172][ T9941] __kmalloc_noprof+0xfb/0x790 [ 426.387202][ T9941] ? __kasan_kmalloc+0x93/0xb0 [ 426.387233][ T9941] ? usb_alloc_urb+0x46/0x150 [ 426.387330][ T9941] ? usb_alloc_urb+0x46/0x150 [ 426.387360][ T9941] usb_alloc_urb+0x46/0x150 [ 426.387386][ T9941] usb_control_msg+0x118/0x3e0 [ 426.387418][ T9941] hub_ext_port_status+0x112/0x840 [ 426.387457][ T9941] hub_activate+0x740/0x1b10 [ 426.387505][ T9941] hub_resume+0xa4/0x3f0 [ 426.387535][ T9941] ? __pfx_hub_resume+0x10/0x10 [ 426.387574][ T9941] usb_resume_both+0x5f1/0xb20 [ 426.387644][ T9941] ? __pfx_usb_runtime_resume+0x10/0x10 [ 426.387666][ T9941] __rpm_callback+0x2d6/0x930 [ 426.387733][ T9941] ? __pfx_usb_runtime_resume+0x10/0x10 [ 426.387759][ T9941] ? __pfx_usb_runtime_resume+0x10/0x10 [ 426.387782][ T9941] rpm_resume+0x1074/0x1690 [ 426.387819][ T9941] ? lock_acquire+0x115/0x350 [ 426.387860][ T9941] ? __pfx_rpm_resume+0x10/0x10 [ 426.387884][ T9941] ? rt_spin_lock+0x2d0/0x400 [ 426.387974][ T9941] ? __pfx_rt_spin_lock+0x10/0x10 [ 426.388013][ T9941] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 426.388035][ T9941] ? __pm_runtime_resume+0x9d/0x170 [ 426.388066][ T9941] __pm_runtime_resume+0x119/0x170 [ 426.388098][ T9941] usb_autoresume_device+0x23/0xf0 [ 426.388133][ T9941] usbdev_open+0x190/0x790 [ 426.388199][ T9941] ? __pfx_usbdev_open+0x10/0x10 [ 426.388218][ T9941] ? rt_spin_unlock+0x159/0x200 [ 426.388253][ T9941] ? rt_spin_unlock+0x165/0x200 [ 426.388287][ T9941] chrdev_open+0x4dc/0x600 [ 426.388327][ T9941] ? __pfx_chrdev_open+0x10/0x10 [ 426.388357][ T9941] ? fsnotify_open_perm_and_set_mode+0x13b/0x6c0 [ 426.388403][ T9941] ? __pfx_chrdev_open+0x10/0x10 [ 426.388430][ T9941] do_dentry_open+0x849/0x1420 [ 426.388492][ T9941] vfs_open+0x3b/0x350 [ 426.388521][ T9941] ? path_openat+0x142d/0x1d60 [ 426.388550][ T9941] path_openat+0x1448/0x1d60 [ 426.388607][ T9941] do_file_open+0x23e/0x4a0 [ 426.388655][ T9941] ? __pfx_do_file_open+0x10/0x10 [ 426.388707][ T9941] ? alloc_fd+0x654/0x6d0 [ 426.388752][ T9941] do_sys_openat2+0x115/0x200 [ 426.388788][ T9941] ? __pfx_do_sys_openat2+0x10/0x10 [ 426.388830][ T9941] ? exc_page_fault+0x6a/0xc0 [ 426.388861][ T9941] ? do_user_addr_fault+0xc4c/0x1340 [ 426.388907][ T9941] __x64_sys_openat+0x138/0x170 [ 426.388948][ T9941] do_syscall_64+0x166/0x520 [ 426.388973][ T9941] ? trace_irq_disable+0x3b/0x140 [ 426.388999][ T9941] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.389023][ T9941] ? clear_bhb_loop+0x70/0xc0 [ 426.389051][ T9941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.389080][ T9941] RIP: 0033:0x7f556194e98e [ 426.389102][ T9941] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 426.389123][ T9941] RSP: 002b:00007f555fbe5b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 426.389149][ T9941] RAX: ffffffffffffffda RBX: 00007f555fbe66c0 RCX: 00007f556194e98e [ 426.389166][ T9941] RDX: 0000000000000000 RSI: 00007f555fbe5c00 RDI: ffffffffffffff9c [ 426.389182][ T9941] RBP: 00007f555fbe5c00 R08: 0000000000000000 R09: 0000000000000000 [ 426.389197][ T9941] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 426.389212][ T9941] R13: 00007f5561c16038 R14: 00007f5561c15fa0 R15: 00007ffe2ae05c48 [ 426.389250][ T9941] [ 426.615703][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 426.887675][ T9947] netlink: 388 bytes leftover after parsing attributes in process `syz.6.1319'. [ 427.375444][ T9954] vlan2: entered promiscuous mode [ 427.380734][ T9954] hsr0: entered promiscuous mode [ 427.418165][ T9954] vlan2: entered allmulticast mode [ 427.424307][ T9954] hsr0: entered allmulticast mode [ 427.424328][ T9954] hsr_slave_0: entered allmulticast mode [ 427.424356][ T9954] hsr_slave_1: entered allmulticast mode [ 427.648398][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 428.194459][ T9981] netlink: 388 bytes leftover after parsing attributes in process `syz.3.1335'. [ 428.310714][ T9978] netlink: 84 bytes leftover after parsing attributes in process `syz.6.1333'. [ 428.329923][ T9978] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1333'. [ 428.607614][ T9996] program syz.1.1342 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 428.641596][T10000] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1345'. [ 428.643397][T10000] netlink: 'syz.5.1345': attribute type 7 has an invalid length. [ 428.643416][T10000] netlink: 'syz.5.1345': attribute type 8 has an invalid length. [ 428.643430][T10000] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1345'. [ 428.685713][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 428.802120][T10000] syz_tun: entered promiscuous mode [ 428.907793][T10000] syz_tun: left promiscuous mode [ 428.982702][T10012] FAULT_INJECTION: forcing a failure. [ 428.982702][T10012] name failslab, interval 1, probability 0, space 0, times 0 [ 428.982854][T10012] CPU: 1 UID: 0 PID: 10012 Comm: syz.6.1349 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 428.982880][T10012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 428.982891][T10012] Call Trace: [ 428.982900][T10012] [ 428.982908][T10012] dump_stack_lvl+0xe8/0x150 [ 428.982945][T10012] should_fail_ex+0x46b/0x600 [ 428.982973][T10012] should_failslab+0xa8/0x100 [ 428.983001][T10012] __kvmalloc_node_noprof+0x176/0x890 [ 428.983027][T10012] ? __kasan_kmalloc+0x93/0xb0 [ 428.983052][T10012] ? bpf_stack_liveness_init+0x29/0x90 [ 428.983105][T10012] ? bpf_check+0x24ff/0x2e20 [ 428.983137][T10012] ? bpf_compute_const_regs+0x18f/0x3450 [ 428.983164][T10012] ? bpf_compute_const_regs+0x18f/0x3450 [ 428.983197][T10012] bpf_compute_const_regs+0x18f/0x3450 [ 428.983243][T10012] ? __pfx_bpf_compute_const_regs+0x10/0x10 [ 428.983269][T10012] ? check_attach_btf_id+0x325/0x1a30 [ 428.983303][T10012] ? rcu_is_watching+0x16/0xb0 [ 428.983360][T10012] ? bpf_stack_liveness_init+0x29/0x90 [ 428.983385][T10012] ? __pfx_check_attach_btf_id+0x10/0x10 [ 428.983412][T10012] ? bpf_stack_liveness_init+0x29/0x90 [ 428.983448][T10012] ? __asan_memset+0x22/0x50 [ 428.983474][T10012] bpf_check+0x2566/0x2e20 [ 428.983511][T10012] ? ktime_get_with_offset+0x93/0x2d0 [ 428.983550][T10012] ? __pfx_bpf_check+0x10/0x10 [ 428.983586][T10012] ? bpf_obj_name_cpy+0x194/0x1e0 [ 428.983611][T10012] bpf_prog_load+0x14d6/0x1c20 [ 428.983650][T10012] ? __pfx_bpf_prog_load+0x10/0x10 [ 428.983696][T10012] __sys_bpf+0xd0d/0xd90 [ 428.983729][T10012] ? __pfx___sys_bpf+0x10/0x10 [ 428.983758][T10012] ? do_futex+0x458/0x4e0 [ 428.983828][T10012] ? rcu_is_watching+0x16/0xb0 [ 428.983883][T10012] __x64_sys_bpf+0xba/0xd0 [ 428.983913][T10012] do_syscall_64+0x166/0x520 [ 428.983938][T10012] ? trace_irq_disable+0x3b/0x140 [ 428.983966][T10012] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.983988][T10012] ? clear_bhb_loop+0x70/0xc0 [ 428.984015][T10012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.984037][T10012] RIP: 0033:0x7f477f20e159 [ 428.984057][T10012] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 428.984076][T10012] RSP: 002b:00007f477d466028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 428.984100][T10012] RAX: ffffffffffffffda RBX: 00007f477f495fa0 RCX: 00007f477f20e159 [ 428.984117][T10012] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 428.984132][T10012] RBP: 00007f477f2a5024 R08: 0000000000000000 R09: 0000000000000000 [ 428.984147][T10012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 428.984161][T10012] R13: 00007f477f496038 R14: 00007f477f495fa0 R15: 00007fffd7d12138 [ 428.984194][T10012] [ 429.725745][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 429.741335][T10029] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(3) [ 429.741411][T10029] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 429.756645][T10029] vhci_hcd vhci_hcd.0: Device attached [ 429.771091][T10029] vhci_hcd vhci_hcd.0: pdev(6) rhport(1) sockfd(5) [ 429.771175][T10029] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 429.800815][T10029] vhci_hcd vhci_hcd.0: Device attached [ 429.819315][T10032] vhci_hcd: connection closed [ 429.820836][ T3392] vhci_hcd vhci_hcd.6: stop threads [ 429.820858][ T3392] vhci_hcd vhci_hcd.6: release socket [ 429.820895][ T3392] vhci_hcd vhci_hcd.6: disconnect device [ 429.823816][T10030] vhci_hcd: connection closed [ 429.824657][ T3392] vhci_hcd vhci_hcd.6: stop threads [ 429.824676][ T3392] vhci_hcd vhci_hcd.6: release socket [ 429.824716][ T3392] vhci_hcd vhci_hcd.6: disconnect device [ 429.871253][ T5725] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 430.035755][ T5725] usb 4-1: Using ep0 maxpacket: 32 [ 430.042656][ T5725] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 430.059648][ T5725] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 430.066933][ T5725] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 430.066964][ T5725] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 430.066992][ T5725] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 430.109730][ T5725] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.118794][ T5725] usb 4-1: Product: syz [ 430.118815][ T5725] usb 4-1: Manufacturer: syz [ 430.118831][ T5725] usb 4-1: SerialNumber: syz [ 430.141420][ T5725] usb 4-1: config 0 descriptor?? [ 430.157614][T10018] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 430.181386][ T5725] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input11 [ 430.357891][ C1] xpad 4-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 430.594479][T10049] nbd: couldn't find device at index 85 [ 430.676231][ C1] xpad 4-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 430.746429][ T5725] usb 4-1: USB disconnect, device number 15 [ 430.746520][ C1] xpad 4-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 430.765770][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 431.205524][T10065] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1369'. [ 431.439579][T10071] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 431.439665][T10071] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 431.483024][T10076] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(6) [ 431.483051][T10076] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 431.483144][T10076] vhci_hcd vhci_hcd.0: Device attached [ 431.520063][T10071] vhci_hcd vhci_hcd.0: Device attached [ 431.527973][T10077] vhci_hcd: connection closed [ 431.543546][ T1021] vhci_hcd vhci_hcd.3: stop threads [ 431.551857][ T1021] vhci_hcd vhci_hcd.3: release socket [ 431.551954][ T1021] vhci_hcd vhci_hcd.3: disconnect device [ 431.562580][T10074] vhci_hcd: connection closed [ 431.572164][ T3321] vhci_hcd vhci_hcd.3: stop threads [ 431.572185][ T3321] vhci_hcd vhci_hcd.3: release socket [ 431.572223][ T3321] vhci_hcd vhci_hcd.3: disconnect device [ 431.630371][T10082] jffs2: notice: (10082) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 431.676584][T10082] binder: 10079:10082 ioctl 40046205 0 returned -22 [ 431.806543][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 432.625830][ T5725] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 432.775707][ T5725] usb 4-1: Using ep0 maxpacket: 8 [ 432.789019][ T5725] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 432.799652][ T5725] usb 4-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 432.811219][ T5725] usb 4-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 432.811245][ T5725] usb 4-1: config 0 interface 0 has no altsetting 0 [ 432.811278][ T5725] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.845729][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 432.862720][ T5725] usb 4-1: config 0 descriptor?? [ 433.103083][T10136] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 433.103170][T10136] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 433.109438][T10136] vhci_hcd vhci_hcd.0: Device attached [ 433.136972][T10136] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(5) [ 433.137092][T10136] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 433.141414][T10136] vhci_hcd vhci_hcd.0: Device attached [ 433.146928][T10139] vhci_hcd: connection closed [ 433.147924][ T3321] vhci_hcd vhci_hcd.1: stop threads [ 433.147947][ T3321] vhci_hcd vhci_hcd.1: release socket [ 433.148048][ T3321] vhci_hcd vhci_hcd.1: disconnect device [ 433.148131][T10137] vhci_hcd: connection closed [ 433.149366][ T3321] vhci_hcd vhci_hcd.1: stop threads [ 433.149383][ T3321] vhci_hcd vhci_hcd.1: release socket [ 433.149418][ T3321] vhci_hcd vhci_hcd.1: disconnect device [ 433.313744][ T5725] hid_parser_main: 22 callbacks suppressed [ 433.315423][ T5725] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 433.315457][ T5725] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 433.315483][ T5725] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 433.315509][ T5725] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 433.315534][ T5725] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 433.390625][ T5725] mcp2221 0003:04D8:00DD.0005: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 433.668856][ T5725] usb 4-1: USB disconnect, device number 16 [ 433.885741][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 434.287255][T10172] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1408'. [ 434.876515][ T5725] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 434.925729][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 434.982231][T10188] random: crng reseeded on system resumption [ 435.096815][ T5725] usb 2-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 435.118760][ T5725] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 435.118849][ T5725] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 435.118875][ T5725] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 435.118895][ T5725] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 435.184878][ T5725] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.193030][ T5725] usb 2-1: Product: syz [ 435.193073][ T5725] usb 2-1: Manufacturer: syz [ 435.193089][ T5725] usb 2-1: SerialNumber: syz [ 435.746844][ T5725] ushc 2-1:1.0: probe with driver ushc failed with error -110 [ 435.966331][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 436.074660][T10202] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1409'. [ 436.215579][T10178] ushc 2-1:1.0: probe with driver ushc failed with error -110 [ 436.402565][ T5725] usb 2-1: USB disconnect, device number 9 [ 436.632052][T10225] FAULT_INJECTION: forcing a failure. [ 436.632052][T10225] name failslab, interval 1, probability 0, space 0, times 0 [ 436.632143][T10225] CPU: 1 UID: 0 PID: 10225 Comm: syz.0.1427 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 436.632219][T10225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 436.632265][T10225] Call Trace: [ 436.632294][T10225] [ 436.632318][T10225] dump_stack_lvl+0xe8/0x150 [ 436.632421][T10225] should_fail_ex+0x46b/0x600 [ 436.632496][T10225] should_failslab+0xa8/0x100 [ 436.632594][T10225] __kmalloc_cache_noprof+0xa1/0x680 [ 436.632673][T10225] ? fuse_get_tree+0xc2/0x3b0 [ 436.632806][T10225] ? fuse_get_tree+0xc2/0x3b0 [ 436.632845][T10225] fuse_get_tree+0xc2/0x3b0 [ 436.632889][T10225] vfs_get_tree+0x92/0x2a0 [ 436.632960][T10225] do_new_mount+0x319/0xdc0 [ 436.632995][T10225] ? cap_capable+0x123/0x460 [ 436.633023][T10225] ? __pfx_do_new_mount+0x10/0x10 [ 436.633110][T10225] ? ns_capable+0x89/0xe0 [ 436.633208][T10225] ? path_mount+0x647/0x1050 [ 436.633306][T10225] ? user_path_at+0xd4/0x160 [ 436.633382][T10225] __se_sys_mount+0x31d/0x420 [ 436.633459][T10225] ? __pfx___se_sys_mount+0x10/0x10 [ 436.633537][T10225] ? __x64_sys_mount+0x20/0xc0 [ 436.633601][T10225] do_syscall_64+0x166/0x520 [ 436.633664][T10225] ? trace_irq_disable+0x3b/0x140 [ 436.633717][T10225] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.633790][T10225] ? clear_bhb_loop+0x70/0xc0 [ 436.633892][T10225] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.633960][T10225] RIP: 0033:0x7f446de4e159 [ 436.634018][T10225] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 436.634038][T10225] RSP: 002b:00007f446c0a6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 436.634064][T10225] RAX: ffffffffffffffda RBX: 00007f446e0d5fa0 RCX: 00007f446de4e159 [ 436.634090][T10225] RDX: 0000200000002100 RSI: 00002000000020c0 RDI: 0000000000000000 [ 436.634127][T10225] RBP: 00007f446dee5024 R08: 0000200000000580 R09: 0000000000000000 [ 436.634171][T10225] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000000 [ 436.634207][T10225] R13: 00007f446e0d6038 R14: 00007f446e0d5fa0 R15: 00007ffe57dff908 [ 436.634305][T10225] [ 437.005764][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 437.197643][T10169] NFSD: Failed to start, no listeners configured. [ 437.245447][ T36] audit: type=1804 audit(1788567602.754:478): pid=10237 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.0.1431" name="/newroot/294/file0" dev="tmpfs" ino=1529 res=1 errno=0 [ 438.046837][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 438.923207][T10281] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 438.963537][T10281] Invalid logical block size (-2) [ 439.087767][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 439.125768][ T5725] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 439.156972][ T4903] Bluetooth: hci1: adv larger than maximum supported [ 439.164304][ T4903] Bluetooth: hci1: Malformed LE Event: 0x0d [ 439.276760][ T5725] usb 1-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 439.294346][ T5725] usb 1-1: config 0 has no interfaces? [ 439.294437][ T5725] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.311654][ T5725] usb 1-1: config 0 descriptor?? [ 440.167998][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 440.389247][ T1328] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.389396][ T1328] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.428793][T10279] FAULT_INJECTION: forcing a failure. [ 440.428793][T10279] name failslab, interval 1, probability 0, space 0, times 0 [ 440.428828][T10279] CPU: 1 UID: 0 PID: 10279 Comm: syz.0.1449 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 440.428855][T10279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 440.428868][T10279] Call Trace: [ 440.428878][T10279] [ 440.428887][T10279] dump_stack_lvl+0xe8/0x150 [ 440.428927][T10279] should_fail_ex+0x46b/0x600 [ 440.428958][T10279] should_failslab+0xa8/0x100 [ 440.429007][T10279] __kmalloc_node_track_caller_noprof+0xfb/0x7b0 [ 440.429035][T10279] ? __lock_acquire+0x6df/0x2e40 [ 440.429063][T10279] ? __kernfs_new_node+0xac/0xa70 [ 440.429126][T10279] ? __kernfs_new_node+0xac/0xa70 [ 440.429159][T10279] kstrdup+0x42/0x100 [ 440.429193][T10279] __kernfs_new_node+0xac/0xa70 [ 440.429232][T10279] ? __pfx___kernfs_new_node+0x10/0x10 [ 440.429259][T10279] ? kernfs_root+0x1c/0x230 [ 440.429296][T10279] ? kernfs_root+0x1c/0x230 [ 440.429319][T10279] ? kernfs_root+0x1c/0x230 [ 440.429341][T10279] ? kernfs_root+0x1c/0x230 [ 440.429369][T10279] kernfs_new_node+0xea/0x140 [ 440.429400][T10279] kernfs_create_link+0xa7/0x200 [ 440.429453][T10279] sysfs_do_create_link_sd+0x83/0x110 [ 440.429481][T10279] module_add_driver+0x26e/0x320 [ 440.429608][T10279] bus_add_driver+0x394/0x670 [ 440.429667][T10279] driver_register+0x23a/0x320 [ 440.429704][T10279] usb_gadget_register_driver_owner+0xf9/0x270 [ 440.429813][T10279] raw_ioctl+0x1503/0x40d0 [ 440.429895][T10279] ? tomoyo_path_number_perm+0x219/0x5f0 [ 440.429923][T10279] ? do_vfs_ioctl+0x1184/0x1550 [ 440.429956][T10279] ? __pfx_raw_ioctl+0x10/0x10 [ 440.429999][T10279] ? hook_file_ioctl+0x1f5/0x610 [ 440.430043][T10279] ? __asan_memset+0x22/0x50 [ 440.430069][T10279] ? smack_file_ioctl+0x265/0x370 [ 440.430108][T10279] ? __pfx_smack_file_ioctl+0x10/0x10 [ 440.430154][T10279] ? __fget_files+0x2a/0x420 [ 440.430175][T10279] ? __fget_files+0x3a8/0x420 [ 440.430196][T10279] ? __fget_files+0x2a/0x420 [ 440.430222][T10279] ? bpf_lsm_file_ioctl+0x9/0x20 [ 440.430246][T10279] ? __pfx_raw_ioctl+0x10/0x10 [ 440.430282][T10279] __se_sys_ioctl+0xff/0x170 [ 440.430313][T10279] do_syscall_64+0x166/0x520 [ 440.430339][T10279] ? trace_irq_disable+0x3b/0x140 [ 440.430386][T10279] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.430410][T10279] ? clear_bhb_loop+0x70/0xc0 [ 440.430439][T10279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.430462][T10279] RIP: 0033:0x7f446de4ddeb [ 440.430485][T10279] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 440.430505][T10279] RSP: 002b:00007f446c0a3f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 440.430531][T10279] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f446de4ddeb [ 440.430548][T10279] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000005 [ 440.430563][T10279] RBP: 00007f446c0a4fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 440.430579][T10279] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 440.430594][T10279] R13: 00002000000006c0 R14: 0000000000000000 R15: 0000000000000868 [ 440.430639][T10279] [ 440.647057][T10279] bus_add_driver: failed to create module links for raw-gadget.1 [ 440.647287][T10279] UDC core: USB Raw Gadget: driver registration failed: -12 [ 440.647370][T10279] misc raw-gadget: fail, usb_gadget_register_driver returned -12 [ 440.820324][ T5728] usb 1-1: USB disconnect, device number 10 [ 441.288801][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 442.119613][T10335] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1470'. [ 442.130807][T10335] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1470'. [ 442.365841][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 442.506294][T10341] No buffer was provided with the request [ 442.911900][T10347] Config c/1 of g1 needs at least one function. [ 442.932820][T10347] udc dummy_udc.0: failed to start g1: -22 [ 442.947843][T10347] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 443.004727][T10347] UDC core: g1: couldn't find an available UDC or it's busy [ 443.405802][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 443.991455][T10379] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1486'. [ 443.999114][T10379] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1486'. [ 444.445943][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 444.967447][ T5728] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 445.127778][ T5728] usb 1-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 445.137521][ T5728] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 445.137573][ T5728] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 445.137599][ T5728] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 445.137622][ T5728] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 445.193383][ T5728] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.202788][ T5728] usb 1-1: Product: syz [ 445.202808][ T5728] usb 1-1: Manufacturer: syz [ 445.202824][ T5728] usb 1-1: SerialNumber: syz [ 445.386111][ T5728] ushc 1-1:1.0: probe with driver ushc failed with error -110 [ 445.485744][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 445.714489][T10423] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1505'. [ 445.989244][T10424] ushc 1-1:1.0: probe with driver ushc failed with error -110 [ 446.080521][T10405] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1497'. [ 446.110251][T10435] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 446.197750][ T1736] usb 1-1: USB disconnect, device number 11 [ 446.526221][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 446.537650][T10444] ieee802154 phy0 wpan0: encryption failed: -22 [ 448.037864][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 448.695712][ T5605] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 448.766009][ T5711] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 448.845896][ T5605] usb 7-1: Using ep0 maxpacket: 8 [ 448.848519][ T5605] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 448.851375][ T5605] usb 7-1: config 0 has no interfaces? [ 448.864795][ T5605] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.864870][ T5605] usb 7-1: Product: syz [ 448.864919][ T5605] usb 7-1: Manufacturer: syz [ 448.864956][ T5605] usb 7-1: SerialNumber: syz [ 448.884874][ T5605] usb 7-1: config 0 descriptor?? [ 448.976482][ T5711] usb 4-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 448.986330][ T5711] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 448.986807][ T5711] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 448.986885][ T5711] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 448.986944][ T5711] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 449.035756][ T5711] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 449.035826][ T5711] usb 4-1: Product: syz [ 449.035865][ T5711] usb 4-1: Manufacturer: syz [ 449.035913][ T5711] usb 4-1: SerialNumber: syz [ 449.087524][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 449.105428][ T5605] usb 7-1: USB disconnect, device number 2 [ 449.198229][ T5711] ushc 4-1:1.0: probe with driver ushc failed with error -110 [ 449.651555][ T5603] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 449.878676][ T5603] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 450.327137][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 450.476049][T10488] ushc 4-1:1.0: probe with driver ushc failed with error -110 [ 450.489960][T10493] ieee802154 phy0 wpan0: encryption failed: -22 [ 450.502457][ T5603] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 450.503464][ T5603] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 450.504228][ T5603] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 450.924583][T10504] XFS (nbd6): Invalid device [./loop0], error=-2 [ 451.405822][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 452.456517][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 452.685926][ T4903] Bluetooth: hci3: command tx timeout [ 452.787245][ T1736] usb 4-1: USB disconnect, device number 17 [ 453.700623][T10485] bridge0: port 1(bridge_slave_0) entered blocking state [ 453.701421][T10485] bridge0: port 1(bridge_slave_0) entered disabled state [ 453.701966][T10485] bridge_slave_0: entered allmulticast mode [ 453.704907][T10485] bridge_slave_0: entered promiscuous mode [ 453.714066][T10485] bridge0: port 2(bridge_slave_1) entered blocking state [ 453.715923][T10485] bridge0: port 2(bridge_slave_1) entered disabled state [ 453.716121][T10485] bridge_slave_1: entered allmulticast mode [ 453.721820][T10485] bridge_slave_1: entered promiscuous mode [ 453.816407][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 454.745781][T10485] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 454.759418][T10547] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1542'. [ 454.770801][T10485] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 454.775663][ T4903] Bluetooth: hci3: command tx timeout [ 454.855971][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 455.157408][T10485] team0: Port device team_slave_0 added [ 455.427629][T10485] team0: Port device team_slave_1 added [ 455.895898][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 455.960097][T10485] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 455.960180][T10485] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 455.960211][T10485] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 455.990632][T10485] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 455.992250][T10485] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 455.992336][T10485] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 456.407194][T10485] hsr_slave_0: entered promiscuous mode [ 456.419270][T10485] hsr_slave_1: entered promiscuous mode [ 456.438842][T10485] debugfs: 'hsr0' already exists in 'hsr' [ 456.440176][T10485] Cannot create hsr debugfs directory [ 456.692886][T10574] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1551'. [ 456.725509][T10572] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1551'. [ 456.845816][ T4903] Bluetooth: hci3: command tx timeout [ 456.883505][T10578] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1553'. [ 456.925838][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 457.430033][T10584] XFS (nbd0): Invalid device [./loop0], error=-2 [ 457.965920][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 458.057322][T10561] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 458.057413][ T4903] Bluetooth: hci1: command 0x0c1a tx timeout [ 458.058359][T10561] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 458.500191][T10561] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 458.506640][T10561] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 459.005982][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 459.061227][T10485] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 459.121736][T10485] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 459.290217][T10608] netlink: 68 bytes leftover after parsing attributes in process `syz.6.1564'. [ 459.322626][T10485] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 459.401147][T10485] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 459.511825][T10604] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1563'. [ 459.650011][T10485] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 459.742372][T10485] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 459.958098][T10485] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 460.006597][T10485] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 460.045978][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 460.319888][T10626] tipc: Enabling of bearer rejected, already enabled [ 460.724470][T10638] netlink: 68 bytes leftover after parsing attributes in process `syz.6.1574'. [ 460.874377][T10485] 8021q: adding VLAN 0 to HW filter on device bond0 [ 460.896213][ T1736] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 461.058579][ T1736] usb 1-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 461.065762][ T1736] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 461.065814][ T1736] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 461.065839][ T1736] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 461.065860][ T1736] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 461.073256][ T1736] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.073285][ T1736] usb 1-1: Product: syz [ 461.073301][ T1736] usb 1-1: Manufacturer: syz [ 461.073317][ T1736] usb 1-1: SerialNumber: syz [ 461.088188][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 461.090170][T10646] netlink: 32 bytes leftover after parsing attributes in process `syz.6.1578'. [ 461.170066][T10485] 8021q: adding VLAN 0 to HW filter on device team0 [ 461.326838][ T1736] ushc 1-1:1.0: probe with driver ushc failed with error -110 [ 461.360764][ T1404] bridge0: port 1(bridge_slave_0) entered blocking state [ 461.368364][ T1404] bridge0: port 1(bridge_slave_0) entered forwarding state [ 461.420863][ T66] bridge0: port 2(bridge_slave_1) entered blocking state [ 461.428350][ T66] bridge0: port 2(bridge_slave_1) entered forwarding state [ 461.984012][T10660] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 462.037421][T10656] ushc 1-1:1.0: probe with driver ushc failed with error -110 [ 462.129113][ T50] usb 1-1: USB disconnect, device number 12 [ 462.137092][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 462.404039][T10667] tipc: Enabling of bearer rejected, already enabled [ 463.114700][T10681] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1587'. [ 463.165736][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 463.398122][T10688] vlan2: entered allmulticast mode [ 463.403502][T10688] bridge0: entered allmulticast mode [ 463.404499][T10690] bridge0: port 1(erspan0) entered blocking state [ 463.404643][T10690] bridge0: port 1(erspan0) entered disabled state [ 463.404841][T10690] erspan0: entered allmulticast mode [ 463.444572][T10690] erspan0: entered promiscuous mode [ 464.119132][T10485] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 464.219168][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 465.250461][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 465.302857][T10485] veth0_vlan: entered promiscuous mode [ 465.355891][T10485] veth1_vlan: entered promiscuous mode [ 465.533294][T10485] veth0_macvtap: entered promiscuous mode [ 465.567818][T10485] veth1_macvtap: entered promiscuous mode [ 465.642490][T10485] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 465.747683][T10485] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 465.888378][ T3166] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.888499][ T3166] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.888535][ T3166] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.888568][ T3166] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.287445][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 467.332093][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 468.317994][ T3392] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 468.365838][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 468.445505][T10796] openvswitch: netlink: VXLAN extension message has 5 unknown bytes. [ 469.226473][T10805] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1626'. [ 469.442201][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 469.496331][ T3392] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 469.791244][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 469.791319][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 470.467403][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 471.242870][ T3392] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.487589][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 471.771667][ T3392] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.827873][ T1404] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 471.828018][ T1404] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 471.975464][T10836] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1636'. [ 472.527437][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 473.657297][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 474.367548][ T3392] bridge_slave_1: left allmulticast mode [ 474.367638][ T3392] bridge_slave_1: left promiscuous mode [ 474.367940][ T3392] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.431994][T10871] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1646'. [ 474.547754][ T3392] bridge_slave_0: left allmulticast mode [ 474.547856][ T3392] bridge_slave_0: left promiscuous mode [ 474.548567][ T3392] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.696211][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 475.735709][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 476.208108][ T3392] bond0 (unregistering): (slave 17ÿ): Releasing backup interface [ 476.288238][ T3392] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 476.308829][T10910] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1654'. [ 476.351071][ T3392] bond0 (unregistering): Released all slaves [ 476.420767][ T5250] 8021q: adding VLAN 0 to HW filter on device eth5 [ 476.470106][T10912] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 476.776057][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 477.083765][ T5728] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 477.246099][ T5728] usb 7-1: device descriptor read/64, error -71 [ 477.505893][ T5728] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 477.656496][ T5728] usb 7-1: device descriptor read/64, error -71 [ 477.769226][ T5728] usb usb7-port1: attempt power cycle [ 477.808399][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 477.969231][T10940] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1666'. [ 478.110990][T10946] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 478.245788][ T5728] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 478.269022][ T5728] usb 7-1: device descriptor read/8, error -71 [ 478.507813][ T5728] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 478.527586][ T5728] usb 7-1: device descriptor read/8, error -71 [ 478.637981][ T5728] usb usb7-port1: unable to enumerate USB device [ 478.845863][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 478.895324][T10975] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1670'. [ 479.066513][T10983] FAULT_INJECTION: forcing a failure. [ 479.066513][T10983] name fail_futex, interval 1, probability 0, space 0, times 1 [ 479.080745][T10983] CPU: 1 UID: 0 PID: 10983 Comm: syz.0.1675 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 479.080776][T10983] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 479.080789][T10983] Call Trace: [ 479.080799][T10983] [ 479.080809][T10983] dump_stack_lvl+0xe8/0x150 [ 479.080850][T10983] should_fail_ex+0x46b/0x600 [ 479.080881][T10983] get_futex_key+0x1b4/0x1580 [ 479.080913][T10983] ? __lock_acquire+0x6df/0x2e40 [ 479.080945][T10983] ? kasan_save_track+0x3e/0x80 [ 479.080973][T10983] ? __kasan_slab_free+0x5c/0x80 [ 479.081002][T10983] ? kmem_cache_free+0x187/0x6d0 [ 479.081035][T10983] ? __pfx_get_futex_key+0x10/0x10 [ 479.081078][T10983] futex_wake+0x119/0x600 [ 479.081110][T10983] ? __pfx_futex_wake+0x10/0x10 [ 479.081153][T10983] do_futex+0x458/0x4e0 [ 479.081192][T10983] ? __pfx_do_futex+0x10/0x10 [ 479.081224][T10983] ? kmem_cache_free+0x187/0x6d0 [ 479.081253][T10983] ? do_sys_openat2+0x14e/0x200 [ 479.081292][T10983] __se_sys_futex+0x3a8/0x450 [ 479.081333][T10983] ? __pfx___se_sys_futex+0x10/0x10 [ 479.081367][T10983] ? rcu_is_watching+0x16/0xb0 [ 479.081406][T10983] ? __x64_sys_futex+0x21/0xf0 [ 479.081455][T10983] do_syscall_64+0x166/0x520 [ 479.081480][T10983] ? trace_irq_disable+0x3b/0x140 [ 479.081508][T10983] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.081531][T10983] ? clear_bhb_loop+0x70/0xc0 [ 479.081585][T10983] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.081607][T10983] RIP: 0033:0x7f446de4e159 [ 479.081645][T10983] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 479.081665][T10983] RSP: 002b:00007f446c0a60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 479.081690][T10983] RAX: ffffffffffffffda RBX: 00007f446e0d5fa8 RCX: 00007f446de4e159 [ 479.081707][T10983] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f446e0d5fac [ 479.081725][T10983] RBP: 00007f446e0d5fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 479.081740][T10983] R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000 [ 479.081754][T10983] R13: 00007f446e0d6038 R14: 00007ffe57dff820 R15: 00007ffe57dff908 [ 479.081789][T10983] [ 479.368899][ T5250] 8021q: adding VLAN 0 to HW filter on device eth7 [ 479.885682][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 479.917132][ T3392] hsr_slave_0: left promiscuous mode [ 479.969902][ T3392] hsr_slave_1: left promiscuous mode [ 479.976533][ T3392] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 479.976610][ T3392] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 480.008243][ T3392] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 480.010007][ T3392] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 480.122135][T10995] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 480.201660][ T3392] veth1_macvtap: left promiscuous mode [ 480.201812][ T3392] veth0_macvtap: left promiscuous mode [ 480.201988][ T3392] veth1_vlan: left promiscuous mode [ 480.202133][ T3392] veth0_vlan: left promiscuous mode [ 480.585761][ T5728] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 480.757373][ T5728] usb 7-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 480.768173][ T5728] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 480.768236][ T5728] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 480.768261][ T5728] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 480.768278][ T5728] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 480.770720][ T5728] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 480.770753][ T5728] usb 7-1: Product: syz [ 480.770769][ T5728] usb 7-1: Manufacturer: syz [ 480.770790][ T5728] usb 7-1: SerialNumber: syz [ 480.925825][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 480.996019][ T5728] ushc 7-1:1.0: probe with driver ushc failed with error -110 [ 481.518555][T11001] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1683'. [ 481.595966][T11016] ushc 7-1:1.0: probe with driver ushc failed with error -110 [ 481.657580][ T3392] team0 (unregistering): Port device team_slave_1 removed [ 481.724215][ T3392] team0 (unregistering): Port device team_slave_0 removed [ 481.985735][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 482.089590][ T5728] usb 7-1: USB disconnect, device number 7 [ 482.406200][ T50] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 482.555986][ T50] usb 1-1: device descriptor read/64, error -71 [ 482.805705][ T50] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 482.975748][ T50] usb 1-1: device descriptor read/64, error -71 [ 483.006988][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 483.076533][T11042] netlink: 192 bytes leftover after parsing attributes in process `syz.7.1695'. [ 483.102801][ T50] usb usb1-port1: attempt power cycle [ 483.301287][ T5250] 8021q: adding VLAN 0 to HW filter on device eth6 [ 483.486238][ T50] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 483.512821][ T50] usb 1-1: device descriptor read/8, error -71 [ 483.530745][ T3392] IPVS: stop unused estimator thread 0... [ 483.758987][ T50] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 483.777090][ T50] usb 1-1: device descriptor read/8, error -71 [ 483.886040][ T50] usb usb1-port1: unable to enumerate USB device [ 484.045716][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 484.099713][ T5603] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 484.164262][ T5603] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 484.177948][ T5603] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 484.197770][ T5603] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 484.211172][ T5603] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 484.403267][T11069] 9pnet_virtio: no channels available for device syz [ 485.095826][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 485.455294][ T5250] 8021q: adding VLAN 0 to HW filter on device eth8 [ 485.611870][T11105] Bluetooth: ISO socket layer initialized [ 486.125715][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 486.371919][ T4903] Bluetooth: hci6: command tx timeout [ 486.796009][ T5725] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 486.956608][ T5725] usb 2-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 486.958764][ T5725] usb 2-1: config 0 has no interfaces? [ 486.958840][ T5725] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.023410][ T5725] usb 2-1: config 0 descriptor?? [ 487.165819][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 487.263514][T11128] FAULT_INJECTION: forcing a failure. [ 487.263514][T11128] name failslab, interval 1, probability 0, space 0, times 0 [ 487.278714][T11128] CPU: 1 UID: 0 PID: 11128 Comm: syz.1.1718 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 487.278745][T11128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 487.278759][T11128] Call Trace: [ 487.278769][T11128] [ 487.278778][T11128] dump_stack_lvl+0xe8/0x150 [ 487.278819][T11128] should_fail_ex+0x46b/0x600 [ 487.278850][T11128] should_failslab+0xa8/0x100 [ 487.278892][T11128] __kmalloc_cache_noprof+0xa1/0x680 [ 487.278924][T11128] ? kobject_uevent_env+0x28c/0x9e0 [ 487.278954][T11128] ? kobject_uevent_env+0x28c/0x9e0 [ 487.278989][T11128] ? module_add_driver+0x31b/0x320 [ 487.279027][T11128] kobject_uevent_env+0x28c/0x9e0 [ 487.279068][T11128] driver_register+0x2d4/0x320 [ 487.279105][T11128] usb_gadget_register_driver_owner+0xf9/0x270 [ 487.279142][T11128] raw_ioctl+0x1503/0x40d0 [ 487.279181][T11128] ? tomoyo_path_number_perm+0x219/0x5f0 [ 487.279210][T11128] ? do_vfs_ioctl+0x1184/0x1550 [ 487.279244][T11128] ? __pfx_raw_ioctl+0x10/0x10 [ 487.279289][T11128] ? hook_file_ioctl+0x1f5/0x610 [ 487.279324][T11128] ? __asan_memset+0x22/0x50 [ 487.279350][T11128] ? smack_file_ioctl+0x265/0x370 [ 487.279389][T11128] ? __pfx_smack_file_ioctl+0x10/0x10 [ 487.279435][T11128] ? __fget_files+0x2a/0x420 [ 487.279456][T11128] ? __fget_files+0x3a8/0x420 [ 487.279478][T11128] ? __fget_files+0x2a/0x420 [ 487.279503][T11128] ? bpf_lsm_file_ioctl+0x9/0x20 [ 487.279527][T11128] ? __pfx_raw_ioctl+0x10/0x10 [ 487.279556][T11128] __se_sys_ioctl+0xff/0x170 [ 487.279588][T11128] do_syscall_64+0x166/0x520 [ 487.279613][T11128] ? trace_irq_disable+0x3b/0x140 [ 487.279641][T11128] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.279664][T11128] ? clear_bhb_loop+0x70/0xc0 [ 487.279692][T11128] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.279716][T11128] RIP: 0033:0x7f37868bddeb [ 487.279737][T11128] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 487.279757][T11128] RSP: 002b:00007f3784b13f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 487.279783][T11128] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f37868bddeb [ 487.279799][T11128] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000005 [ 487.279813][T11128] RBP: 00007f3784b14fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 487.279827][T11128] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 487.279840][T11128] R13: 00002000000006c0 R14: 0000000000000000 R15: 0000000000000868 [ 487.279873][T11128] [ 487.386154][T11128] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 487.387290][T11128] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.439188][ T5728] usb 2-1: USB disconnect, device number 10 [ 487.731265][T11141] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 487.946989][T11153] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1724'. [ 487.958675][T11153] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1724'. [ 487.958722][T11153] FAULT_INJECTION: forcing a failure. [ 487.958722][T11153] name failslab, interval 1, probability 0, space 0, times 0 [ 487.958750][T11153] CPU: 1 UID: 0 PID: 11153 Comm: syz.0.1724 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 487.958775][T11153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 487.958788][T11153] Call Trace: [ 487.958796][T11153] [ 487.958805][T11153] dump_stack_lvl+0xe8/0x150 [ 487.958842][T11153] should_fail_ex+0x46b/0x600 [ 487.958873][T11153] should_failslab+0xa8/0x100 [ 487.958907][T11153] __kmalloc_noprof+0xfb/0x790 [ 487.958933][T11153] ? __asan_memcpy+0x40/0x70 [ 487.958955][T11153] ? nft_trans_alloc+0x22/0x2a0 [ 487.959095][T11153] ? nft_trans_alloc+0x22/0x2a0 [ 487.959131][T11153] nft_trans_alloc+0x22/0x2a0 [ 487.959163][T11153] nf_tables_newsetelem+0x298a/0x4200 [ 487.959193][T11153] ? do_trace_netlink_extack+0x80/0x1d0 [ 487.959319][T11153] ? __pfx_nf_tables_newsetelem+0x10/0x10 [ 487.959348][T11153] ? lock_acquire+0x115/0x350 [ 487.959384][T11153] ? nla_validate_array+0xfc/0x260 [ 487.959442][T11153] ? __pfx___nla_validate_parse+0x10/0x10 [ 487.959478][T11153] ? __pfx_nf_tables_newset+0x10/0x10 [ 487.959511][T11153] ? lock_acquire+0x115/0x350 [ 487.959537][T11153] ? nfnl_pernet+0x23/0x240 [ 487.959603][T11153] ? __nla_parse+0x40/0x60 [ 487.959648][T11153] nfnetlink_rcv+0x1291/0x28d0 [ 487.959705][T11153] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 487.959732][T11153] ? __lock_acquire+0x6df/0x2e40 [ 487.959801][T11153] ? lock_acquire+0x115/0x350 [ 487.959835][T11153] ? netlink_deliver_tap+0x2e/0x1b0 [ 487.959865][T11153] ? netlink_deliver_tap+0x2e/0x1b0 [ 487.959900][T11153] netlink_unicast+0x7f5/0x990 [ 487.959937][T11153] netlink_sendmsg+0x813/0xb40 [ 487.959966][T11153] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 487.960003][T11153] ? __pfx_netlink_sendmsg+0x10/0x10 [ 487.960035][T11153] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 487.960070][T11153] ? __pfx_netlink_sendmsg+0x10/0x10 [ 487.960099][T11153] sock_sendmsg_nosec+0x13a/0x180 [ 487.960170][T11153] ____sys_sendmsg+0x565/0x870 [ 487.960228][T11153] ? __pfx_____sys_sendmsg+0x10/0x10 [ 487.960266][T11153] ? import_iovec+0x73/0xa0 [ 487.960304][T11153] ___sys_sendmsg+0x2a5/0x360 [ 487.960331][T11153] ? __lock_acquire+0x6df/0x2e40 [ 487.960359][T11153] ? __pfx____sys_sendmsg+0x10/0x10 [ 487.960390][T11153] ? futex_wait+0x2a2/0x390 [ 487.960441][T11153] ? __fget_files+0x2a/0x420 [ 487.960461][T11153] ? __fget_files+0x3a8/0x420 [ 487.960490][T11153] __x64_sys_sendmsg+0x1b7/0x290 [ 487.960520][T11153] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 487.960582][T11153] do_syscall_64+0x166/0x520 [ 487.960604][T11153] ? trace_irq_disable+0x3b/0x140 [ 487.960629][T11153] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.960650][T11153] ? clear_bhb_loop+0x70/0xc0 [ 487.960676][T11153] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.960695][T11153] RIP: 0033:0x7f446de4e159 [ 487.960714][T11153] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 487.960732][T11153] RSP: 002b:00007f446c0a6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 487.960753][T11153] RAX: ffffffffffffffda RBX: 00007f446e0d5fa0 RCX: 00007f446de4e159 [ 487.960768][T11153] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 487.960811][T11153] RBP: 00007f446dee5024 R08: 0000000000000000 R09: 0000000000000000 [ 487.960825][T11153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 487.960838][T11153] R13: 00007f446e0d6038 R14: 00007f446e0d5fa0 R15: 00007ffe57dff908 [ 487.960892][T11153] [ 488.205695][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 488.402418][T11061] bridge0: port 1(bridge_slave_0) entered blocking state [ 488.404596][T11061] bridge0: port 1(bridge_slave_0) entered disabled state [ 488.447413][ T4903] Bluetooth: hci6: command tx timeout [ 488.465704][T11061] bridge_slave_0: entered allmulticast mode [ 488.484627][T11061] bridge_slave_0: entered promiscuous mode [ 488.527841][T11061] bridge0: port 2(bridge_slave_1) entered blocking state [ 488.529857][T11061] bridge0: port 2(bridge_slave_1) entered disabled state [ 488.530237][T11061] bridge_slave_1: entered allmulticast mode [ 488.574921][T11061] bridge_slave_1: entered promiscuous mode [ 488.675364][T11061] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 488.686855][T11163] 9p: Bad value for 'wfdno' [ 488.763570][T11061] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 489.255938][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 489.447893][T11061] team0: Port device team_slave_0 added [ 489.477326][T11061] team0: Port device team_slave_1 added [ 489.517631][ T10] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 489.657324][T11061] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 489.657406][T11061] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 489.657461][T11061] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 489.663408][T11061] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 489.663449][T11061] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 489.663523][T11061] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 489.693056][ T10] usb 1-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 489.723877][ T10] usb 1-1: config 0 has no interfaces? [ 489.724023][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 489.854858][ T10] usb 1-1: config 0 descriptor?? [ 489.930278][T11061] hsr_slave_0: entered promiscuous mode [ 489.935193][T11061] hsr_slave_1: entered promiscuous mode [ 489.943044][T11061] debugfs: 'hsr0' already exists in 'hsr' [ 489.943126][T11061] Cannot create hsr debugfs directory [ 490.066706][T11185] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.076633][T11185] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.089812][ T50] usb 1-1: USB disconnect, device number 17 [ 490.184473][T11196] 9p: Bad value for 'wfdno' [ 490.295684][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 490.525735][ T4903] Bluetooth: hci6: command tx timeout [ 491.326348][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 491.490363][T11236] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 491.841466][T11061] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 491.879768][T11061] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 491.890478][T11061] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 491.929769][T11061] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 491.938231][T11061] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 491.986042][T11061] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 491.991218][T11061] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 492.054698][T11061] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 492.072974][T11248] Invalid logical block size (8192) [ 492.105801][ T50] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 492.214699][T11248] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1761'. [ 492.264970][ T50] usb 2-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 492.278963][ T50] usb 2-1: config 0 has no interfaces? [ 492.284584][ T50] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 492.305371][ T50] usb 2-1: config 0 descriptor?? [ 492.342468][T11256] netlink: 56 bytes leftover after parsing attributes in process `syz.6.1762'. [ 492.365707][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 492.522683][T11243] FAULT_INJECTION: forcing a failure. [ 492.522683][T11243] name failslab, interval 1, probability 0, space 0, times 0 [ 492.522725][T11243] CPU: 0 UID: 0 PID: 11243 Comm: syz.1.1759 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 492.522752][T11243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 492.522767][T11243] Call Trace: [ 492.522777][T11243] [ 492.522787][T11243] dump_stack_lvl+0xe8/0x150 [ 492.522834][T11243] should_fail_ex+0x46b/0x600 [ 492.522868][T11243] should_failslab+0xa8/0x100 [ 492.522905][T11243] __kmalloc_cache_noprof+0xa1/0x680 [ 492.522938][T11243] ? kobject_uevent_env+0x28c/0x9e0 [ 492.522971][T11243] ? kobject_uevent_env+0x28c/0x9e0 [ 492.523006][T11243] ? module_add_driver+0x31b/0x320 [ 492.523047][T11243] kobject_uevent_env+0x28c/0x9e0 [ 492.523091][T11243] driver_register+0x2d4/0x320 [ 492.523129][T11243] usb_gadget_register_driver_owner+0xf9/0x270 [ 492.523167][T11243] raw_ioctl+0x1503/0x40d0 [ 492.523208][T11243] ? tomoyo_path_number_perm+0x219/0x5f0 [ 492.523238][T11243] ? do_vfs_ioctl+0x1184/0x1550 [ 492.523271][T11243] ? __pfx_raw_ioctl+0x10/0x10 [ 492.523318][T11243] ? hook_file_ioctl+0x1f5/0x610 [ 492.523356][T11243] ? __asan_memset+0x22/0x50 [ 492.523382][T11243] ? smack_file_ioctl+0x265/0x370 [ 492.523422][T11243] ? __pfx_smack_file_ioctl+0x10/0x10 [ 492.523470][T11243] ? __fget_files+0x2a/0x420 [ 492.523492][T11243] ? __fget_files+0x3a8/0x420 [ 492.523515][T11243] ? __fget_files+0x2a/0x420 [ 492.523541][T11243] ? bpf_lsm_file_ioctl+0x9/0x20 [ 492.523566][T11243] ? __pfx_raw_ioctl+0x10/0x10 [ 492.523597][T11243] __se_sys_ioctl+0xff/0x170 [ 492.523629][T11243] do_syscall_64+0x166/0x520 [ 492.523654][T11243] ? trace_irq_disable+0x3b/0x140 [ 492.523682][T11243] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.523705][T11243] ? clear_bhb_loop+0x70/0xc0 [ 492.523733][T11243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.523757][T11243] RIP: 0033:0x7f37868bddeb [ 492.523779][T11243] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 492.523799][T11243] RSP: 002b:00007f3784b13f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 492.523824][T11243] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f37868bddeb [ 492.523841][T11243] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000005 [ 492.523855][T11243] RBP: 00007f3784b14fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 492.523871][T11243] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 492.523886][T11243] R13: 00002000000006c0 R14: 0000000000000000 R15: 0000000000000868 [ 492.523922][T11243] [ 492.530325][T11243] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 492.534795][T11243] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 492.586270][ T5728] usb 2-1: USB disconnect, device number 11 [ 492.628167][ T4903] Bluetooth: hci6: command tx timeout [ 493.198002][T11061] 8021q: adding VLAN 0 to HW filter on device bond0 [ 493.268820][T11061] 8021q: adding VLAN 0 to HW filter on device team0 [ 493.291421][ T69] bridge0: port 1(bridge_slave_0) entered blocking state [ 493.293629][ T69] bridge0: port 1(bridge_slave_0) entered forwarding state [ 493.385219][ T69] bridge0: port 2(bridge_slave_1) entered blocking state [ 493.385303][ T69] bridge0: port 2(bridge_slave_1) entered forwarding state [ 493.409645][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 493.475715][ T5592] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 493.637290][ T5592] usb 7-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 493.648917][ T5592] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 493.649130][ T5592] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 493.649157][ T5592] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 493.649178][ T5592] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 493.696135][ T5592] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.696214][ T5592] usb 7-1: Product: syz [ 493.696257][ T5592] usb 7-1: Manufacturer: syz [ 493.696310][ T5592] usb 7-1: SerialNumber: syz [ 493.887483][ T5592] ushc 7-1:1.0: probe with driver ushc failed with error -110 [ 494.124609][T11288] netlink: 'syz.0.1773': attribute type 11 has an invalid length. [ 494.129508][T11288] netlink: 252 bytes leftover after parsing attributes in process `syz.0.1773'. [ 494.251991][T11286] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 494.455671][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 494.576026][T11294] ushc 7-1:1.0: probe with driver ushc failed with error -110 [ 494.681712][T11272] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1768'. [ 494.896565][ T5605] usb 7-1: USB disconnect, device number 8 [ 495.300248][ T50] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 495.480282][ T50] usb 2-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 495.489511][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 495.502955][ T50] usb 2-1: config 0 has no interfaces? [ 495.503033][ T50] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.559757][ T50] usb 2-1: config 0 descriptor?? [ 495.698809][T11061] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 495.733078][T11329] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 495.777999][T11310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.778686][T11310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.842429][ T50] usb 2-1: USB disconnect, device number 12 [ 495.987827][T11332] F2FS-fs (nbd7): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 495.988985][T11332] F2FS-fs (nbd7): Can't find valid F2FS filesystem in 1th superblock [ 496.011672][T11332] F2FS-fs (nbd7): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 496.011736][T11332] F2FS-fs (nbd7): Can't find valid F2FS filesystem in 2th superblock [ 496.118494][T11337] fuse: Bad value for 'fd' [ 496.525669][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 496.614796][T11061] veth0_vlan: entered promiscuous mode [ 496.650619][T11061] veth1_vlan: entered promiscuous mode [ 496.725754][ T5592] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 496.901556][ T5592] usb 8-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 496.913997][ T5592] usb 8-1: config 0 has no interfaces? [ 496.914043][ T5592] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.966214][ T5592] usb 8-1: config 0 descriptor?? [ 497.052377][T11061] veth0_macvtap: entered promiscuous mode [ 497.101323][T11061] veth1_macvtap: entered promiscuous mode [ 497.185966][ T5592] usb 8-1: USB disconnect, device number 2 [ 497.373286][T11061] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 497.499347][T11061] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 497.575915][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 497.665981][ T66] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.927972][ T3343] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.934422][ T3343] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.934470][ T3343] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.502750][ T1021] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 498.502803][ T1021] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 498.606812][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 499.023665][T11387] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 499.651982][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 499.814208][T11396] fuse: Bad value for 'fd' [ 499.941625][ T3175] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 499.952519][ T3175] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 500.695679][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 500.894924][T11426] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 501.055779][ T5725] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 501.081732][T11435] fuse: Bad value for 'fd' [ 501.206699][ T5725] usb 1-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 501.220219][ T5725] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 501.220277][ T5725] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 501.220306][ T5725] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 501.220331][ T5725] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 501.225423][ T5725] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.225449][ T5725] usb 1-1: Product: syz [ 501.225464][ T5725] usb 1-1: Manufacturer: syz [ 501.225479][ T5725] usb 1-1: SerialNumber: syz [ 501.516045][ T5725] ushc 1-1:1.0: probe with driver ushc failed with error -110 [ 501.579389][ T1328] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.586711][ T1328] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.735763][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 502.403182][T11468] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1808'. [ 502.765674][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 502.799922][ T5323] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 502.844491][T11476] i2c i2c-0: Failed to register i2c client tps6598x at 0x03 (-16) [ 503.050116][ T5323] usb 2-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 503.067685][ T5323] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.085744][ T5725] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 503.130787][ T5323] i2c-tiny-usb 2-1:1.0: version 1.00 found at bus 002 address 013 [ 503.256521][ T5725] usb 8-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 503.267974][ T5725] usb 8-1: config 0 has no interfaces? [ 503.273578][ T5725] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.303330][ T5725] usb 8-1: config 0 descriptor?? [ 503.532633][T11478] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.544577][T11478] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.554687][ T5735] usb 8-1: USB disconnect, device number 3 [ 503.692138][ T5323] (null): failure reading functionality [ 503.797906][ T5323] i2c i2c-1: failure reading functionality [ 503.815864][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 504.054373][ T5728] usb 1-1: USB disconnect, device number 18 [ 504.179224][ T5323] i2c i2c-1: connected i2c-tiny-usb device [ 504.584636][T11518] random: crng reseeded on system resumption [ 504.845698][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 505.226929][T11529] i2c i2c-0: Failed to register i2c client tps6598x at 0x03 (-16) [ 505.441424][ T5323] usb 2-1: USB disconnect, device number 13 [ 505.917372][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 506.686277][ T5725] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 506.855824][ T5725] usb 8-1: Using ep0 maxpacket: 8 [ 506.861824][ T5725] usb 8-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 506.864534][ T5725] usb 8-1: config 179 has an invalid interface number: 65 but max is 0 [ 506.864562][ T5725] usb 8-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 506.864585][ T5725] usb 8-1: config 179 has no interface number 0 [ 506.864634][ T5725] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 506.864664][ T5725] usb 8-1: config 179 interface 65 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 23 [ 506.864708][ T5725] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.935708][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 507.223001][ T5323] usb 8-1: USB disconnect, device number 4 [ 507.966483][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 508.093027][T11571] fuse: Bad value for 'fd' [ 508.905129][T11592] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 509.005681][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 509.439050][T11600] file system registered [ 509.846980][T11606] fuse: Bad value for 'fd' [ 510.045820][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 510.319157][T11615] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1864'. [ 510.401884][T11615] bond0: (slave bond_slave_0): Releasing backup interface [ 510.648013][T11615] bond_slave_0: entered promiscuous mode [ 510.648110][T11615] bond_slave_0: entered allmulticast mode [ 511.095870][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 511.119980][T11626] jffs2: notice: (11626) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 511.991376][T11654] XFS (nbd6): SB validate failed with error -5. [ 512.135955][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 513.175714][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 514.205992][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 514.734139][T11725] FAULT_INJECTION: forcing a failure. [ 514.734139][T11725] name failslab, interval 1, probability 0, space 0, times 0 [ 514.748845][T11725] CPU: 1 UID: 0 PID: 11725 Comm: syz.6.1900 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 514.748878][T11725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 514.748893][T11725] Call Trace: [ 514.748903][T11725] [ 514.748913][T11725] dump_stack_lvl+0xe8/0x150 [ 514.748955][T11725] should_fail_ex+0x46b/0x600 [ 514.748989][T11725] should_failslab+0xa8/0x100 [ 514.749024][T11725] ? __kernfs_new_node+0xe7/0xa70 [ 514.749053][T11725] kmem_cache_alloc_noprof+0x9e/0x690 [ 514.749083][T11725] ? __kernfs_new_node+0xe7/0xa70 [ 514.749117][T11725] __kernfs_new_node+0xe7/0xa70 [ 514.749154][T11725] ? __pfx___kernfs_new_node+0x10/0x10 [ 514.749181][T11725] ? kernfs_root+0x1c/0x230 [ 514.749213][T11725] ? kernfs_root+0x1c/0x230 [ 514.749239][T11725] ? kernfs_root+0x1c/0x230 [ 514.749271][T11725] kernfs_new_node+0xea/0x140 [ 514.749302][T11725] kernfs_create_link+0xa7/0x200 [ 514.749357][T11725] sysfs_do_create_link_sd+0x83/0x110 [ 514.749384][T11725] driver_sysfs_add+0x89/0x210 [ 514.749416][T11725] really_probe+0x142/0xae0 [ 514.749451][T11725] __driver_probe_device+0x1e8/0x360 [ 514.749483][T11725] driver_probe_device+0x4f/0x240 [ 514.749515][T11725] __driver_attach+0x339/0x600 [ 514.749546][T11725] bus_for_each_dev+0x23e/0x2c0 [ 514.749568][T11725] ? __pfx___driver_attach+0x10/0x10 [ 514.749597][T11725] ? __pfx_bus_for_each_dev+0x10/0x10 [ 514.749616][T11725] ? rt_spin_unlock+0x159/0x200 [ 514.749652][T11725] ? rt_spin_unlock+0x165/0x200 [ 514.749684][T11725] bus_add_driver+0x348/0x670 [ 514.749714][T11725] driver_register+0x23a/0x320 [ 514.749748][T11725] usb_gadget_register_driver_owner+0xf9/0x270 [ 514.749777][T11725] raw_ioctl+0x1503/0x40d0 [ 514.749852][T11725] ? tomoyo_path_number_perm+0x219/0x5f0 [ 514.749879][T11725] ? do_vfs_ioctl+0x1184/0x1550 [ 514.749911][T11725] ? __pfx_raw_ioctl+0x10/0x10 [ 514.749952][T11725] ? hook_file_ioctl+0x1f5/0x610 [ 514.749985][T11725] ? __asan_memset+0x22/0x50 [ 514.750028][T11725] ? smack_file_ioctl+0x265/0x370 [ 514.750065][T11725] ? __pfx_smack_file_ioctl+0x10/0x10 [ 514.750113][T11725] ? __fget_files+0x2a/0x420 [ 514.750134][T11725] ? __fget_files+0x3a8/0x420 [ 514.750154][T11725] ? __fget_files+0x2a/0x420 [ 514.750180][T11725] ? bpf_lsm_file_ioctl+0x9/0x20 [ 514.750203][T11725] ? __pfx_raw_ioctl+0x10/0x10 [ 514.750233][T11725] __se_sys_ioctl+0xff/0x170 [ 514.750265][T11725] do_syscall_64+0x166/0x520 [ 514.750290][T11725] ? trace_irq_disable+0x3b/0x140 [ 514.750319][T11725] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 514.750342][T11725] ? clear_bhb_loop+0x70/0xc0 [ 514.750370][T11725] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 514.750393][T11725] RIP: 0033:0x7f477f20ddeb [ 514.750415][T11725] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 514.750435][T11725] RSP: 002b:00007f477d463f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 514.750460][T11725] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f477f20ddeb [ 514.750477][T11725] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004 [ 514.750491][T11725] RBP: 00007f477d464fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 514.750506][T11725] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 514.750520][T11725] R13: 00002000000006c0 R14: 0000000000000000 R15: 0000000000000000 [ 514.750553][T11725] [ 515.041681][T11725] raw-gadget.0 gadget.6: really_probe: driver_sysfs_add failed [ 515.051306][T11725] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.113761][T11725] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.245700][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 516.295861][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 516.678435][T11771] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1917'. [ 517.204777][T11777] jffs2: notice: (11777) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 517.326403][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 518.365823][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 518.601467][T11805] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1929'. [ 519.405831][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 519.436091][T11822] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1935'. [ 519.449691][T11822] FAULT_INJECTION: forcing a failure. [ 519.449691][T11822] name failslab, interval 1, probability 0, space 0, times 0 [ 519.449728][T11822] CPU: 1 UID: 0 PID: 11822 Comm: syz.0.1935 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 519.449761][T11822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 519.449777][T11822] Call Trace: [ 519.449787][T11822] [ 519.449798][T11822] dump_stack_lvl+0xe8/0x150 [ 519.449843][T11822] should_fail_ex+0x46b/0x600 [ 519.449880][T11822] should_failslab+0xa8/0x100 [ 519.449927][T11822] ? __kernfs_new_node+0xe7/0xa70 [ 519.449959][T11822] kmem_cache_alloc_noprof+0x9e/0x690 [ 519.449993][T11822] ? __kernfs_new_node+0xe7/0xa70 [ 519.450031][T11822] __kernfs_new_node+0xe7/0xa70 [ 519.450073][T11822] ? __pfx___kernfs_new_node+0x10/0x10 [ 519.450104][T11822] ? kernfs_root+0x1c/0x230 [ 519.450141][T11822] ? kernfs_root+0x1c/0x230 [ 519.450169][T11822] ? kernfs_root+0x1c/0x230 [ 519.450195][T11822] ? kernfs_root+0x1c/0x230 [ 519.450250][T11822] kernfs_create_dir_ns+0xfe/0x230 [ 519.450289][T11822] sysfs_create_dir_ns+0x12f/0x2a0 [ 519.450323][T11822] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 519.450360][T11822] ? rt_spin_unlock+0x165/0x200 [ 519.450402][T11822] kobject_add_internal+0x62c/0xce0 [ 519.450448][T11822] kobject_add+0x163/0x240 [ 519.450482][T11822] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 519.450526][T11822] ? __pfx_kobject_add+0x10/0x10 [ 519.450580][T11822] ? get_device_parent+0x370/0x3a0 [ 519.450685][T11822] ? __pfx_klist_children_get+0x10/0x10 [ 519.450730][T11822] device_add+0x3fa/0xb80 [ 519.450766][T11822] device_create+0x269/0x300 [ 519.450806][T11822] ? timer_init_key+0x161/0x2c0 [ 519.450839][T11822] ? __pfx_device_create+0x10/0x10 [ 519.450876][T11822] ? ieee80211_roc_setup+0x119/0x1d0 [ 519.451004][T11822] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 519.451102][T11822] mac80211_hwsim_new_radio+0x419/0x5810 [ 519.451231][T11822] ? mac80211_hwsim_new_radio+0xf6/0x5810 [ 519.451288][T11822] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 519.451322][T11822] ? rcu_is_watching+0x16/0xb0 [ 519.451360][T11822] ? trace_kmalloc+0x2a/0xf0 [ 519.451402][T11822] hwsim_new_radio_nl+0xd8b/0xf90 [ 519.451455][T11822] genl_family_rcv_msg_doit+0x233/0x340 [ 519.451498][T11822] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 519.451547][T11822] ? bpf_lsm_capable+0x9/0x20 [ 519.451584][T11822] ? security_capable+0x7e/0x2c0 [ 519.451627][T11822] genl_rcv_msg+0x614/0x7a0 [ 519.451666][T11822] ? __pfx_genl_rcv_msg+0x10/0x10 [ 519.451696][T11822] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 519.451748][T11822] netlink_rcv_skb+0x226/0x4a0 [ 519.451789][T11822] ? __pfx_genl_rcv_msg+0x10/0x10 [ 519.451822][T11822] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 519.451878][T11822] ? netlink_deliver_tap+0x2e/0x1b0 [ 519.451928][T11822] ? netlink_deliver_tap+0x2e/0x1b0 [ 519.451975][T11822] genl_rcv+0x28/0x40 [ 519.452003][T11822] netlink_unicast+0x7f5/0x990 [ 519.452050][T11822] netlink_sendmsg+0x813/0xb40 [ 519.452091][T11822] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 519.452141][T11822] ? __pfx_netlink_sendmsg+0x10/0x10 [ 519.452185][T11822] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 519.452233][T11822] ? __pfx_netlink_sendmsg+0x10/0x10 [ 519.452275][T11822] sock_sendmsg_nosec+0x13a/0x180 [ 519.452308][T11822] ____sys_sendmsg+0x565/0x870 [ 519.452356][T11822] ? __pfx_____sys_sendmsg+0x10/0x10 [ 519.452407][T11822] ? import_iovec+0x73/0xa0 [ 519.452444][T11822] ___sys_sendmsg+0x2a5/0x360 [ 519.452479][T11822] ? __lock_acquire+0x6df/0x2e40 [ 519.452518][T11822] ? __pfx____sys_sendmsg+0x10/0x10 [ 519.452559][T11822] ? futex_wait+0x2a2/0x390 [ 519.452637][T11822] ? __fget_files+0x2a/0x420 [ 519.452663][T11822] ? __fget_files+0x3a8/0x420 [ 519.452703][T11822] __x64_sys_sendmsg+0x1b7/0x290 [ 519.452742][T11822] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 519.452807][T11822] do_syscall_64+0x166/0x520 [ 519.452836][T11822] ? trace_irq_disable+0x3b/0x140 [ 519.452869][T11822] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 519.452896][T11822] ? clear_bhb_loop+0x70/0xc0 [ 519.452938][T11822] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 519.452965][T11822] RIP: 0033:0x7f446de4e159 [ 519.453003][T11822] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 519.453025][T11822] RSP: 002b:00007f446c0a6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 519.453054][T11822] RAX: ffffffffffffffda RBX: 00007f446e0d5fa0 RCX: 00007f446de4e159 [ 519.453073][T11822] RDX: 0000000000000004 RSI: 0000200000000100 RDI: 0000000000000004 [ 519.453089][T11822] RBP: 00007f446dee5024 R08: 0000000000000000 R09: 0000000000000000 [ 519.453106][T11822] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 519.453122][T11822] R13: 00007f446e0d6038 R14: 00007f446e0d5fa0 R15: 00007ffe57dff908 [ 519.453164][T11822] [ 519.453237][T11822] kobject: kobject_add_internal failed for hwsim45 (error: -12 parent: mac80211_hwsim) [ 519.490624][ T4903] Bluetooth: hci7: Opcode 0x0c03 failed: -110 [ 520.445951][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 521.485656][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 523.705401][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 523.814031][T11909] netlink: 15 bytes leftover after parsing attributes in process `syz.1.1965'. [ 524.770335][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 525.215679][ T5728] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 525.366669][ T5728] usb 2-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 525.375885][ T5728] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 525.375939][ T5728] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 525.375967][ T5728] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 525.375991][ T5728] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 525.430695][ T5728] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.430764][ T5728] usb 2-1: Product: syz [ 525.430781][ T5728] usb 2-1: Manufacturer: syz [ 525.430795][ T5728] usb 2-1: SerialNumber: syz [ 525.659291][ T5728] ushc 2-1:1.0: probe with driver ushc failed with error -110 [ 526.308396][T11948] ushc 2-1:1.0: probe with driver ushc failed with error -110 [ 526.353508][T11952] FAULT_INJECTION: forcing a failure. [ 526.353508][T11952] name failslab, interval 1, probability 0, space 0, times 0 [ 526.368157][T11952] CPU: 0 UID: 0 PID: 11952 Comm: syz.0.1982 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 526.368203][T11952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 526.368218][T11952] Call Trace: [ 526.368234][T11952] [ 526.368244][T11952] dump_stack_lvl+0xe8/0x150 [ 526.368310][T11952] should_fail_ex+0x46b/0x600 [ 526.368350][T11952] should_failslab+0xa8/0x100 [ 526.368384][T11952] ? security_inode_alloc+0x39/0x310 [ 526.368425][T11952] kmem_cache_alloc_noprof+0x9e/0x690 [ 526.368460][T11952] ? security_inode_alloc+0x39/0x310 [ 526.368507][T11952] security_inode_alloc+0x39/0x310 [ 526.368548][T11952] inode_init_always_gfp+0x983/0xd40 [ 526.368596][T11952] ? __pfx_sock_alloc_inode+0x10/0x10 [ 526.368620][T11952] alloc_inode+0x82/0x1b0 [ 526.368656][T11952] __sock_create+0x12d/0x9d0 [ 526.368692][T11952] __sys_socket+0xd6/0x1b0 [ 526.368722][T11952] __x64_sys_socket+0x7a/0x90 [ 526.368750][T11952] do_syscall_64+0x166/0x520 [ 526.368776][T11952] ? trace_irq_disable+0x3b/0x140 [ 526.368804][T11952] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.368828][T11952] ? clear_bhb_loop+0x70/0xc0 [ 526.368857][T11952] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.368893][T11952] RIP: 0033:0x7f446de4e159 [ 526.368916][T11952] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 526.368942][T11952] RSP: 002b:00007f446c0a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 526.368975][T11952] RAX: ffffffffffffffda RBX: 00007f446e0d5fa0 RCX: 00007f446de4e159 [ 526.368993][T11952] RDX: 0000000000000084 RSI: 0000000000000001 RDI: 000000000000000a [ 526.369012][T11952] RBP: 00007f446dee5024 R08: 0000000000000000 R09: 0000000000000000 [ 526.369028][T11952] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 526.369043][T11952] R13: 00007f446e0d6038 R14: 00007f446e0d5fa0 R15: 00007ffe57dff908 [ 526.369079][T11952] [ 526.373538][T11952] socket: no more sockets [ 526.599816][T11927] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1971'. [ 526.736721][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 526.831770][ T5728] usb 2-1: USB disconnect, device number 14 [ 527.919998][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 528.925914][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 529.059037][T12018] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2001'. [ 529.612144][T12024] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 529.617352][T12024] Bluetooth: hci6: Error when powering off device on rfkill (-4) [ 530.919234][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 531.965805][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 532.168200][T12067] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2018'. [ 532.360490][ T5848] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 532.518919][ T5848] usb 2-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 532.530010][ T5848] usb 2-1: config 0 has no interfaces? [ 532.536177][ T5848] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 532.556211][ T5848] usb 2-1: config 0 descriptor?? [ 533.009086][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 533.060496][T12065] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 533.213025][T12065] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 533.645072][ T5735] usb 2-1: USB disconnect, device number 15 [ 535.260804][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 535.845357][T12106] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2033'. [ 535.917184][T12112] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2035'. [ 535.929937][T12112] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2035'. [ 536.285865][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 537.999216][T12128] tipc: Enabling of bearer rejected, already enabled [ 538.482290][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 539.495722][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 539.508682][T12166] tipc: Enabling of bearer rejected, already enabled [ 541.116119][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 541.791956][T12194] tipc: Enabling of bearer rejected, already enabled [ 542.709725][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 543.094846][T12221] jffs2: notice: (12221) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 5 of xref (0 dead, 0 orphan) found. [ 543.717517][T12227] tipc: Started in network mode [ 543.717622][T12227] tipc: Node identity ac1414aa, cluster identity 4711 [ 543.718632][T12227] tipc: Enabled bearer , priority 10 [ 543.726203][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 544.748360][ T5735] tipc: Node number set to 2886997162 [ 544.777222][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 545.741364][T12275] jffs2: notice: (12275) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 6 of xref (0 dead, 1 orphan) found. [ 545.805822][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 546.349763][T12289] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2099'. [ 546.845631][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 547.634669][T12319] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2111'. [ 547.816206][T12324] jffs2: notice: (12324) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 7 of xref (0 dead, 2 orphan) found. [ 547.885810][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 548.382423][T12337] FAULT_INJECTION: forcing a failure. [ 548.382423][T12337] name fail_futex, interval 1, probability 0, space 0, times 0 [ 548.385391][T12337] CPU: 0 UID: 0 PID: 12337 Comm: syz.0.2119 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 548.385423][T12337] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 548.385438][T12337] Call Trace: [ 548.385447][T12337] [ 548.385458][T12337] dump_stack_lvl+0xe8/0x150 [ 548.385500][T12337] should_fail_ex+0x46b/0x600 [ 548.385548][T12337] get_futex_key+0x1b4/0x1580 [ 548.385594][T12337] ? __pfx_get_futex_key+0x10/0x10 [ 548.385629][T12337] ? update_se+0x90/0xf30 [ 548.385675][T12337] futex_wait_setup+0x4a/0x590 [ 548.385703][T12337] ? __resched_curr+0x334/0x540 [ 548.385738][T12337] ? __futex_wait+0xe1/0x410 [ 548.385776][T12337] __futex_wait+0x161/0x410 [ 548.385810][T12337] ? __pfx___futex_wait+0x10/0x10 [ 548.385842][T12337] ? __pfx_futex_wake_mark+0x10/0x10 [ 548.385874][T12337] ? try_to_wake_up+0x84b/0x1430 [ 548.385913][T12337] futex_wait+0x121/0x390 [ 548.385942][T12337] ? __pfx_futex_wait+0x10/0x10 [ 548.385980][T12337] ? vfs_write+0x9e7/0xbb0 [ 548.386012][T12337] do_futex+0x3e7/0x4e0 [ 548.386052][T12337] ? __pfx_do_futex+0x10/0x10 [ 548.386096][T12337] __se_sys_futex+0x3a8/0x450 [ 548.386135][T12337] ? ksys_write+0x248/0x270 [ 548.386160][T12337] ? __pfx___se_sys_futex+0x10/0x10 [ 548.386196][T12337] ? __pfx_ksys_write+0x10/0x10 [ 548.386227][T12337] ? __x64_sys_futex+0x21/0xf0 [ 548.386265][T12337] do_syscall_64+0x166/0x520 [ 548.386291][T12337] ? trace_irq_disable+0x3b/0x140 [ 548.386319][T12337] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.386342][T12337] ? clear_bhb_loop+0x70/0xc0 [ 548.386370][T12337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.386393][T12337] RIP: 0033:0x7f446de4e159 [ 548.386415][T12337] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 548.386434][T12337] RSP: 002b:00007f446c0a60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 548.386459][T12337] RAX: ffffffffffffffda RBX: 00007f446e0d5fa8 RCX: 00007f446de4e159 [ 548.386476][T12337] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f446e0d5fa8 [ 548.386491][T12337] RBP: 00007f446e0d5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 548.386505][T12337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 548.386518][T12337] R13: 00007f446e0d6038 R14: 00007ffe57dff820 R15: 00007ffe57dff908 [ 548.386555][T12337] [ 548.925760][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 549.374563][T12361] netlink: 'syz.7.2130': attribute type 1 has an invalid length. [ 549.425059][T12363] FAULT_INJECTION: forcing a failure. [ 549.425059][T12363] name failslab, interval 1, probability 0, space 0, times 0 [ 549.439193][T12363] CPU: 0 UID: 0 PID: 12363 Comm: syz.6.2131 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 549.439221][T12363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 549.439233][T12363] Call Trace: [ 549.439240][T12363] [ 549.439249][T12363] dump_stack_lvl+0xe8/0x150 [ 549.439283][T12363] should_fail_ex+0x46b/0x600 [ 549.439309][T12363] should_failslab+0xa8/0x100 [ 549.439351][T12363] ? security_inode_alloc+0x39/0x310 [ 549.439380][T12363] kmem_cache_alloc_noprof+0x9e/0x690 [ 549.439408][T12363] ? security_inode_alloc+0x39/0x310 [ 549.439442][T12363] security_inode_alloc+0x39/0x310 [ 549.439470][T12363] inode_init_always_gfp+0x983/0xd40 [ 549.439506][T12363] ? __pfx_sock_alloc_inode+0x10/0x10 [ 549.439528][T12363] alloc_inode+0x82/0x1b0 [ 549.439559][T12363] __sock_create+0x12d/0x9d0 [ 549.439591][T12363] __sys_socket+0xd6/0x1b0 [ 549.439618][T12363] __x64_sys_socket+0x7a/0x90 [ 549.439641][T12363] do_syscall_64+0x166/0x520 [ 549.439665][T12363] ? trace_irq_disable+0x3b/0x140 [ 549.439690][T12363] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.439719][T12363] ? clear_bhb_loop+0x70/0xc0 [ 549.439744][T12363] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.439764][T12363] RIP: 0033:0x7f477f20e159 [ 549.439784][T12363] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 549.439803][T12363] RSP: 002b:00007f477d466028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 549.439825][T12363] RAX: ffffffffffffffda RBX: 00007f477f495fa0 RCX: 00007f477f20e159 [ 549.439839][T12363] RDX: 0000000000000084 RSI: 0000000000000001 RDI: 000000000000000a [ 549.439851][T12363] RBP: 00007f477f2a5024 R08: 0000000000000000 R09: 0000000000000000 [ 549.439863][T12363] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 549.439875][T12363] R13: 00007f477f496038 R14: 00007f477f495fa0 R15: 00007fffd7d12138 [ 549.439904][T12363] [ 549.439939][T12363] socket: no more sockets [ 549.965741][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 550.308250][T12386] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2139'. [ 550.308343][T12386] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2139'. [ 551.015696][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 551.737468][T12418] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2151'. [ 551.737544][T12418] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2151'. [ 552.045824][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 552.373882][T12432] tipc: Enabling of bearer rejected, failed to enable media [ 552.466722][T12436] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2159'. [ 552.482850][T12435] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2158'. [ 552.960845][T12449] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2163'. [ 553.085769][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 553.162791][T12455] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2165'. [ 553.162873][T12455] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2165'. [ 553.644646][T12469] netlink: 'syz.6.2171': attribute type 11 has an invalid length. [ 554.127206][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 554.382453][T12484] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2176'. [ 554.482963][T12488] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2178'. [ 554.494280][T12488] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2178'. [ 555.165713][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 555.175749][ T5605] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 555.347386][ T5605] usb 7-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 555.359641][ T5605] usb 7-1: config 0 has no interfaces? [ 555.359679][ T5605] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 555.393470][ T5605] usb 7-1: config 0 descriptor?? [ 555.611974][T12500] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 555.621638][T12500] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 555.625264][ T5605] usb 7-1: USB disconnect, device number 9 [ 556.180767][T12533] FAULT_INJECTION: forcing a failure. [ 556.180767][T12533] name fail_futex, interval 1, probability 0, space 0, times 0 [ 556.195520][T12533] CPU: 1 UID: 0 PID: 12533 Comm: syz.0.2196 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 556.195554][T12533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 556.195569][T12533] Call Trace: [ 556.195578][T12533] [ 556.195589][T12533] dump_stack_lvl+0xe8/0x150 [ 556.195633][T12533] should_fail_ex+0x46b/0x600 [ 556.195668][T12533] get_futex_key+0x1b4/0x1580 [ 556.195703][T12533] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 556.195744][T12533] ? __pfx_get_futex_key+0x10/0x10 [ 556.195780][T12533] ? __lock_acquire+0x6df/0x2e40 [ 556.195817][T12533] futex_wait_setup+0x4a/0x590 [ 556.195849][T12533] ? __lock_acquire+0x6df/0x2e40 [ 556.195877][T12533] ? __futex_wait+0xe1/0x410 [ 556.195908][T12533] __futex_wait+0x161/0x410 [ 556.195941][T12533] ? __pfx___futex_wait+0x10/0x10 [ 556.195972][T12533] ? __pfx_futex_wake_mark+0x10/0x10 [ 556.196005][T12533] ? futex_hash+0x4e/0x2b0 [ 556.196037][T12533] ? futex_hash+0x4e/0x2b0 [ 556.196066][T12533] ? futex_hash+0x275/0x2b0 [ 556.196103][T12533] futex_wait+0x121/0x390 [ 556.196133][T12533] ? __pfx_futex_wait+0x10/0x10 [ 556.196170][T12533] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 556.196199][T12533] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 556.196228][T12533] do_futex+0x3e7/0x4e0 [ 556.196279][T12533] ? __pfx_do_futex+0x10/0x10 [ 556.196325][T12533] __se_sys_futex+0x3a8/0x450 [ 556.196365][T12533] ? lockdep_hardirqs_on+0x7b/0x110 [ 556.196393][T12533] ? __pfx___se_sys_futex+0x10/0x10 [ 556.196439][T12533] ? __x64_sys_futex+0x21/0xf0 [ 556.196479][T12533] do_syscall_64+0x166/0x520 [ 556.196505][T12533] ? trace_irq_disable+0x3b/0x140 [ 556.196532][T12533] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 556.196556][T12533] ? clear_bhb_loop+0x70/0xc0 [ 556.196585][T12533] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 556.196609][T12533] RIP: 0033:0x7f446de4e159 [ 556.196630][T12533] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 556.196651][T12533] RSP: 002b:00007f446c0a60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 556.196676][T12533] RAX: ffffffffffffffda RBX: 00007f446e0d5fa8 RCX: 00007f446de4e159 [ 556.196693][T12533] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f446e0d5fa8 [ 556.196709][T12533] RBP: 00007f446e0d5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 556.196723][T12533] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 556.196737][T12533] R13: 00007f446e0d6038 R14: 00007ffe57dff820 R15: 00007ffe57dff908 [ 556.196774][T12533] [ 556.215752][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 557.095338][T12554] FAULT_INJECTION: forcing a failure. [ 557.095338][T12554] name failslab, interval 1, probability 0, space 0, times 0 [ 557.112097][T12554] CPU: 0 UID: 0 PID: 12554 Comm: syz.7.2203 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 557.112121][T12554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 557.112131][T12554] Call Trace: [ 557.112138][T12554] [ 557.112145][T12554] dump_stack_lvl+0xe8/0x150 [ 557.112175][T12554] should_fail_ex+0x46b/0x600 [ 557.112203][T12554] ? sock_alloc_inode+0x2c/0x1a0 [ 557.112224][T12554] should_failslab+0xa8/0x100 [ 557.112253][T12554] kmem_cache_alloc_lru_noprof+0xa2/0x680 [ 557.112277][T12554] ? sock_alloc_inode+0x2c/0x1a0 [ 557.112297][T12554] ? __pfx_sock_alloc_inode+0x10/0x10 [ 557.112313][T12554] sock_alloc_inode+0x2c/0x1a0 [ 557.112330][T12554] ? __pfx_sock_alloc_inode+0x10/0x10 [ 557.112345][T12554] alloc_inode+0x6a/0x1b0 [ 557.112372][T12554] __sock_create+0x12d/0x9d0 [ 557.112397][T12554] __sys_socket+0xd6/0x1b0 [ 557.112421][T12554] __x64_sys_socket+0x7a/0x90 [ 557.112440][T12554] do_syscall_64+0x166/0x520 [ 557.112460][T12554] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.112476][T12554] ? clear_bhb_loop+0x70/0xc0 [ 557.112496][T12554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.112512][T12554] RIP: 0033:0x7fc092bce159 [ 557.112528][T12554] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 557.112542][T12554] RSP: 002b:00007fc090e26028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 557.112560][T12554] RAX: ffffffffffffffda RBX: 00007fc092e55fa0 RCX: 00007fc092bce159 [ 557.112572][T12554] RDX: 0000000000000084 RSI: 0000000000000001 RDI: 000000000000000a [ 557.112582][T12554] RBP: 00007fc092c65024 R08: 0000000000000000 R09: 0000000000000000 [ 557.112592][T12554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 557.112602][T12554] R13: 00007fc092e56038 R14: 00007fc092e55fa0 R15: 00007fff2800f638 [ 557.112627][T12554] [ 557.112708][T12554] socket: no more sockets [ 557.265775][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 557.871768][T12564] __nla_validate_parse: 4 callbacks suppressed [ 557.872562][T12564] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2208'. [ 557.872625][T12564] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2208'. [ 558.434411][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 558.518324][T12578] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2214'. [ 559.493075][T12596] ptrace attach of "ci-upstream-kasan-gce-smack-root/syz-executor exec"[11061] was attempted by "ci-upstream-kasan-gce-smack-root/syz-executor exec"[12596] [ 560.281351][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 560.509910][T12606] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2223'. [ 560.519736][T12606] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2223'. [ 560.811461][T12614] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2225'. [ 561.325847][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 561.923212][T12638] ptrace attach of "ci-upstream-kasan-gce-smack-root/syz-executor exec"[11061] was attempted by "ci-upstream-kasan-gce-smack-root/syz-executor exec"[12638] [ 562.677160][ T5848] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 562.722221][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 562.840166][ T5848] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 562.858759][ T5848] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 562.861519][ T5848] usb 7-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 562.861545][ T5848] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 562.861598][ T5848] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 562.861628][ T5848] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 562.905928][ T5848] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 562.905957][ T5848] usb 7-1: Product: syz [ 562.905975][ T5848] usb 7-1: Manufacturer: syz [ 562.961887][ T5848] cdc_wdm 7-1:1.0: skipping garbage [ 562.968142][ T5848] cdc_wdm 7-1:1.0: skipping garbage [ 562.982149][ T5848] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 562.988297][ T5848] cdc_wdm 7-1:1.0: Unknown control protocol [ 563.023151][ T1328] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.024925][ T1328] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.294987][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 563.295164][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 563.295584][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 563.295607][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 563.295856][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 563.295888][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 563.296214][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 563.296265][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 563.296667][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 563.296718][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 563.297100][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 563.297156][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 563.297481][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 563.297530][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 563.297922][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 563.297974][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 563.298434][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 563.298520][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 563.298936][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 563.298992][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 563.440774][ T5848] usb 7-1: USB disconnect, device number 10 [ 563.441047][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 563.698479][T12661] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2243'. [ 563.725897][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 564.543371][T12678] ptrace attach of "ci-upstream-kasan-gce-smack-root/syz-executor exec"[11061] was attempted by "ci-upstream-kasan-gce-smack-root/syz-executor exec"[12678] [ 565.351813][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 565.812375][T12703] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2259'. [ 565.977656][T12710] jffs2: notice: (12710) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 8 of xref (0 dead, 3 orphan) found. [ 566.365943][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 567.201942][T12755] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2279'. [ 567.315677][ T5605] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 567.405805][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 567.449026][ T5605] usb 2-1: device descriptor read/64, error -71 [ 567.747458][ T5605] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 567.885665][ T5605] usb 2-1: device descriptor read/64, error -71 [ 567.995998][ T5605] usb usb2-port1: attempt power cycle [ 568.122732][T12788] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2291'. [ 568.139585][ T5848] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 568.288041][ T5848] usb 1-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 568.303106][ T5848] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 568.316442][ T5848] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 568.338725][ T5848] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 568.338790][ T5848] usb 1-1: Product: syz [ 568.338818][ T5848] usb 1-1: Manufacturer: syz [ 568.338867][ T5848] usb 1-1: SerialNumber: syz [ 568.395679][ T5605] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 568.406560][ T5605] usb 2-1: device descriptor read/8, error -71 [ 568.413274][ T5848] ti_usb_3410_5052 1-1:2.0: TI USB 5052 2 port adapter converter detected [ 568.445949][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 568.458976][ T5848] usb 1-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 568.521809][ T5848] usb 1-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 568.675870][ T5605] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 568.708266][ T5605] usb 2-1: device descriptor read/8, error -71 [ 568.825958][ T5605] usb usb2-port1: unable to enumerate USB device [ 568.975504][T12808] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2297'. [ 569.090240][T12812] netlink: 32 bytes leftover after parsing attributes in process `syz.7.2299'. [ 569.622946][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 570.705910][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 571.267744][T12837] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2303'. [ 571.421622][T12842] netlink: 'syz.7.2304': attribute type 1 has an invalid length. [ 571.725669][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 572.765958][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 573.075738][ T5848] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 573.165946][T12778] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set config on port 0, -110 [ 573.183031][T12778] ti_usb_3410_5052_2 ttyUSB0: ti_write_byte - failed, -32 [ 573.183069][T12778] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set modem control on port 0, -32 [ 573.236880][T12778] ti_usb_3410_5052_2 ttyUSB0: ti_get_lsr - get port status command failed, -32 [ 573.236960][ T5848] usb 2-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 573.296239][ T5848] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 573.296471][ T5848] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 573.296684][ T5848] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 573.296710][ T5848] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 573.380881][ T5848] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 573.381010][ T5848] usb 2-1: Product: syz [ 573.381027][ T5848] usb 2-1: Manufacturer: syz [ 573.381232][ T5848] usb 2-1: SerialNumber: syz [ 573.592837][T12778] ti_usb_3410_5052_2 ttyUSB0: ti_close - cannot send close port command, -32 [ 573.650637][ T5605] usb 1-1: USB disconnect, device number 19 [ 573.745992][ T5848] ushc 2-1:1.0: probe with driver ushc failed with error -110 [ 573.763689][ T5605] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 573.784845][ T5605] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 573.796588][ T5605] ti_usb_3410_5052 1-1:2.0: device disconnected [ 573.815647][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 574.392940][T12903] netlink: 'syz.0.2324': attribute type 1 has an invalid length. [ 574.631951][T12907] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2312'. [ 574.846013][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 575.087463][T12922] tipc: Started in network mode [ 575.087547][T12922] tipc: Node identity ac1414aa, cluster identity 4711 [ 575.116681][T12922] tipc: Enabled bearer , priority 10 [ 575.640415][T12940] CIFS: Attempting to mount //127.0.0.1/share [ 575.736715][T12943] netlink: 'syz.7.2338': attribute type 1 has an invalid length. [ 575.828442][ T5848] usb 2-1: USB disconnect, device number 20 [ 575.895669][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 576.292569][T12956] netlink: 100 bytes leftover after parsing attributes in process `syz.0.2344'. [ 576.328442][T12953] vlan2: entered promiscuous mode [ 576.328525][T12953] bridge0: entered promiscuous mode [ 576.484404][ T5848] tipc: Node number set to 2886997162 [ 576.520335][T12940] CIFS: VFS: Error connecting to socket. Aborting operation. [ 576.520528][T12940] CIFS: VFS: cifs_mount failed w/return code = -4 [ 576.772365][T12976] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2350'. [ 576.925968][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 577.136525][T12990] netlink: 'syz.6.2353': attribute type 1 has an invalid length. [ 577.185820][ T5848] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 577.356990][ T5848] usb 1-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 577.369339][ T5848] usb 1-1: config 0 has no interfaces? [ 577.369376][ T5848] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 577.406139][ T5848] usb 1-1: config 0 descriptor?? [ 577.651135][T12984] FAULT_INJECTION: forcing a failure. [ 577.651135][T12984] name failslab, interval 1, probability 0, space 0, times 0 [ 577.651227][T12984] CPU: 1 UID: 0 PID: 12984 Comm: syz.0.2352 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 577.651354][T12984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 577.651405][T12984] Call Trace: [ 577.651421][T12984] [ 577.651450][T12984] dump_stack_lvl+0xe8/0x150 [ 577.651603][T12984] should_fail_ex+0x46b/0x600 [ 577.651688][T12984] should_failslab+0xa8/0x100 [ 577.651781][T12984] kmem_cache_alloc_node_noprof+0xac/0x660 [ 577.651855][T12984] ? __alloc_skb+0x1db/0x7a0 [ 577.652017][T12984] ? __alloc_skb+0x1db/0x7a0 [ 577.652111][T12984] __alloc_skb+0x1db/0x7a0 [ 577.652189][T12984] vhci_write+0xc2/0x480 [ 577.652370][T12984] vfs_write+0x61e/0xbb0 [ 577.652464][T12984] ? __pfx_vfs_write+0x10/0x10 [ 577.652571][T12984] ? __fget_files+0x2a/0x420 [ 577.652653][T12984] ksys_write+0x156/0x270 [ 577.652712][T12984] ? __pfx_ksys_write+0x10/0x10 [ 577.652747][T12984] do_syscall_64+0x166/0x520 [ 577.652834][T12984] ? trace_irq_disable+0x3b/0x140 [ 577.652929][T12984] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.652990][T12984] ? clear_bhb_loop+0x70/0xc0 [ 577.653063][T12984] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.653123][T12984] RIP: 0033:0x7f446de0e98e [ 577.653210][T12984] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 577.653255][T12984] RSP: 002b:00007f446c0a5fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 577.653321][T12984] RAX: ffffffffffffffda RBX: 00007f446c0a66c0 RCX: 00007f446de0e98e [ 577.653364][T12984] RDX: 000000000000000d RSI: 0000000000000000 RDI: 00000000000000ca [ 577.653406][T12984] RBP: 00007f446dee5024 R08: 0000000000000000 R09: 0000000000000000 [ 577.653454][T12984] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 577.653488][T12984] R13: 00007f446e0d6038 R14: 00007f446e0d5fa0 R15: 00007ffe57dff908 [ 577.653584][T12984] [ 577.726393][ T37] INFO: task syz.5.1405:10162 blocked for more than 143 seconds. [ 577.726440][ T37] Not tainted syzkaller #0 [ 577.726469][ T37] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 577.726496][ T37] task:syz.5.1405 state:D stack:27464 pid:10162 tgid:10159 ppid:7391 task_flags:0x400140 flags:0x00080002 [ 577.726662][ T37] Call Trace: [ 577.726680][ T37] [ 577.726711][ T37] __schedule+0x16d9/0x5700 [ 577.726823][ T37] ? __pfx___schedule+0x10/0x10 [ 577.726891][ T37] ? trace_irq_disable+0x3b/0x140 [ 577.726972][ T37] ? __pfx___schedule+0x10/0x10 [ 577.727064][ T37] rt_mutex_schedule+0x76/0xf0 [ 577.727124][ T37] rt_mutex_slowlock_block+0x55e/0x690 [ 577.727213][ T37] ? rt_mutex_slowlock_block+0x33c/0x690 [ 577.727278][ T37] rt_mutex_slowlock+0x2d4/0x780 [ 577.727395][ T37] ? rt_mutex_slowlock+0x1f2/0x780 [ 577.728894][T12984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 577.749773][ T37] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 577.749833][ T37] ? write_ports+0xb5/0xd20 [ 577.749990][ T37] ? write_ports+0xb5/0xd20 [ 577.750047][ T37] mutex_lock_nested+0x168/0x1d0 [ 577.750134][ T37] ? preempt_schedule_common+0x7f/0xd0 [ 577.750206][ T37] write_ports+0xb5/0xd20 [ 577.750296][ T37] ? __pfx_write_ports+0x10/0x10 [ 577.750428][ T37] ? _copy_from_user+0x94/0 ** replaying previous printk message ** [ 577.750428][ T37] ? _copy_from_user+0x94/0xb0 [ 577.750509][ T37] ? simple_transaction_get+0x130/0x170 [ 577.750580][ T37] nfsctl_transaction_write+0x112/0x160 [ 577.750680][ T37] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 577.750756][ T37] vfs_write+0x29f/0xbb0 [ 577.750839][ T37] ? __pfx_vfs_write+0x10/0x10 [ 577.750905][ T37] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 577.750975][ T37] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 577.751032][ T37] ? mutex_lock_nested+0x152/0x1d0 [ 577.751105][ T37] ? fdget_pos+0x252/0x320 [ 577.751186][ T37] ksys_write+0x156/0x270 [ 577.766604][ T37] ? __pfx_ksys_write+0x10/0x10 [ 577.766739][ T37] do_syscall_64+0x166/0x520 [ 577.766826][ T37] ? trace_irq_disable+0x3b/0x140 [ 577.766900][ T37] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.766957][ T37] ? clear_bhb_loop+0x70/0xc0 [ 577.767030][ T37] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.767085][ T37] RIP: 0033:0x7f556198e159 [ 577.767106][ T37] RSP: 002b:00007f555fbe6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 577.767131][ T37] RAX: ffffffffffffffda RBX: 00007f5561c15fa0 RCX: 00007f556198e159 [ 577.767251][ T37] RDX: 0000000000000005 RSI: 00002000000000c0 RDI: 0000000000000003 [ 577.767267][ T37] RBP: 00007f5561a25024 R08: 0000000000000000 R09: 0000000000000000 [ 577.767283][ T37] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 577.767297][ T37] R13: 00007f5561c16038 R14: 00007f5561c15fa0 R15: 00007ffe2ae05c48 [ 577.767334][ T37] [ 577.767389][ T37] [ 577.767389][ T37] Showing all locks held in the system: [ 577.767404][ T37] locks held by kworker/u8:0/12: 3, last CPU#1: [ 577.767444][ T37] #0: ffff888035741938 ((wq_completion)wg-kex-wg1#9){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 577.767577][ T37] #1: ffffc90000117c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 577.767639][ T37] #2: ffff888064ba5b10 (&cookie->lock){++++}-{4:4}, at: wg_cookie_add_mac_to_packet+0x3e/0x1a0 [ 577.767771][ T37] locks held by pr/ttyS0/17: 5, last CPU#0: [ 577.767816][ T37] #0: ffffffff8e09d578 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 [ 577.768019][ T37] #1: ffffffff99e991f8 [ 577.771354][T12984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 577.779527][ T37] (&port_lock_key){+.+.}-{3:3}, at: nbcon_kthread_func+0x64c/0x880 [ 577.779671][ T37] #2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 577.779813][ T37] #3: ffff8880b863c320 (&rq->__lock){-...}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 577.779978][ T37] #4: ffff8880b8628558 (hrtimer_bases.lock){-...}-{2:2}, at: __hrtimer_rearm_deferred+0x99/0x4d0 [ 577.780128][ T37] locks held by rcuc/0/20: 4, last CPU#0: [ 577.780169][ T37] #0: ffffffff8e0594c0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 577.780330][ T37] #1: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 577.780501][ T37] #2: ffffffff8e1c3be0 (rcu_callback){....}-{0:0}, at: rcu_cpu_kthread+0x217/0x1740 [ 577.780653][ T37] #3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 577.780813][ T37] locks held by khungtaskd/37: 1, last CPU#1: [ 577.780853][ T37] #0: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 577.802733][ T37] locks held by kworker/u8:16/3321: 5, last CPU#1: [ 577.802780][ T37] #0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 577.802937][ T37] #1: ffffc9000fff7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 577.803077][ T37] #2: ffff888025226310 (&devlink->lock_key#5){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 [ 577.803295][ T37] #3: ffff888061e31d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 [ 577.803458][ T37] #4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 577.803597][ T37] locks held by kworker/u8:18/3392: 5, last CPU#1: [ 577.803633][ T37] #0: ffff8880332a8138 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 577.803761][ T37] #1: ffffc90010237c40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 577.803938][ T37] #2: ffffffff8e0594c0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 577.804100][ T37] #3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 577.840185][ T37] #4: ffff8880b873c320 (&rq->__lock){-...}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 577.840389][ T37] locks held by udevd/4955: 2, last CPU#1: [ 577.840447][ T37] #0: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __d_lookup+0x66/0x790 [ 577.840865][ T37] #1: ffff88803e2e3ad8 (&lockref->lock){+.+.}-{3:3}, at: __d_lookup+0x23e/0x790 [ 577.841013][ T37] locks held by getty/5345: 2, on CPU#0: [ 577.841054][ T37] #0: ffff8880368e80a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 577.841337][ T37] #1: ffffc900044c32e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 [ 577.841550][ T37] locks held by syz-executor/5586: 10, last CPU#1: [ 577.841591][ T37] #0: ffffffff8e29eaf0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x10f/0x480 [ 577.846531][ T5605] usb 1-1: USB disconnect, device number 20 [ 577.875251][ T37] #1: ffff888037ac47b0 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x18e/0x1d80 [ 577.875385][ T37] #2: ffff8880381c91b0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x27d/0x1d80 [ 577.875617][ T37] #3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 577.875722][ T37] #4: ffff8880401a1b98 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 577.875868][ T37] #5: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 577.876008][ T37] #6: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 577.876160][ T37] #7: ffff888041cb1718 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x569/0x58f0 [ 577.876317][ T37] #8: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock_nested+0x1e0/0x400 [ 577.876505][ T37] #9: ffff8880b873c320 (&rq->__lock){-...}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 577.876673][ T37] locks held by kworker/1:4/5605: 7, last CPU#1: [ 577.896313][ T37] #0: ffff8880222f7138 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 577.896442][ T37] #1: ffffc9000596fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 577.896585][ T37] #2: ffff88802a0a4210 (&dev->mutex){....}-{4:4}, at: hub_event+0x187/0x4cf0 [ 577.896701][ T37] #3: ffff888037ad2210 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xe3/0x990 [ 577.896840][ T37] #4: ffff88813ff6f348 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3f/0x140 [ 577.896983][ T37] #5: ffff88813ff6f238 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x4e/0x140 [ 577.897128][ T37] #6: ffff88813ff6f2c0 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: __kernfs_remove+0x174/0x8e0 [ 577.897338][ T37] locks held by syz.5.1405/10162: 3, on CPU#0: [ 577.897380][ T37] #0: ffff888020fd5128 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x252/0x320 [ 577.897521][ T37] #1: ffff888062bb6510 (sb_writers#16){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 577.897680][ T37] #2: ffffffff8e4f7358 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xb5/0xd20 [ 577.927286][ T37] locks held by syz.5.1405/10169: 3, on CPU#0: [ 577.927341][ T37] #0: ffff88802ff74928 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x252/0x320 [ 577.927662][ T37] #1: ffff888062bb6510 (sb_writers#16){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 577.927821][ T37] #2: ffffffff8e4f7358 (nfsd_mutex){+.+.}-{4:4}, at: write_threads+0x3b4/0x610 [ 577.927963][ T37] locks held by syz.3.1623/10793: 2, on CPU#1: [ 577.927978][ T37] #0: ffffffff8f643260 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 577.928170][ T37] #1: ffffffff8e4f7358 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_svc_export_set_reqs_doit+0x132/0x1450 [ 577.928319][ T37] locks held by syz.0.2352/12983: 2, on CPU#1: [ 577.928356][ T37] #0: ffff88813ff6f348 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3f/0x140 [ 577.928506][ T37] #1: ffff88813ff6f238 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x4e/0x140 [ 577.928666][ T37] locks held by dhcpcd-run-hook/12985: 3, last CPU#1: [ 577.928716][ T37] #0: ffffffff8e29eaf0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x10f/0x480 [ 577.947882][ T37] #1: ffff888037a50430 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x18e/0x1d80 [ 577.948248][ T37] #2: ffff8880381cd530 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x27d/0x1d80 [ 577.948410][ T37] locks held by syz.6.2353/12990: 4, last CPU#1: [ 577.948450][ T37] #0: ffff88801a7647b0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 577.948594][ T37] #1: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 577.948720][ T37] #2: ffff888028c5fd18 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 577.949037][ T37] #3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 577.949186][ T37] locks held by syz.7.2355/12998: 9, last CPU#1: [ 577.949221][ T37] #0: ffff8880809ea948 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 [ 577.949349][ T37] #1: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 577.949501][ T37] #2: ffff888021fdead8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 577.965336][ T37] #3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 577.965402][ T37] #4: ffff8880b8733f68 ((lock)#2){+.+.}-{3:3}, at: __folio_batch_add_and_move+0x289/0xaa0 [ 577.965532][ T37] #5: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 577.965591][ T37] #6: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: folio_lruvec_lock_irqsave+0x24/0x540 [ 577.965656][ T37] #7: ffff88801aed8b70 (&lruvec->lru_lock){+.+.}-{3:3}, at: folio_lruvec_lock_irqsave+0x293/0x540 [ 577.965705][ T37] #8: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 577.965866][ T37] locks held by syz-executor/13000: 3, last CPU#1: [ 577.965914][ T37] #0: ffff8880336ee510 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 577.966077][ T37] #1: ffff88803c4abf90 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 577.966372][ T37] #2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 577.966524][ T37] [ 577.966543][ T37] ============================================= [ 577.966543][ T37] [ 577.966572][ T37] NMI backtrace for cpu 1 [ 577.966613][ T37] CPU: 1 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 577.966674][ T37] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 577.966712][ T37] Call Trace: [ 577.966734][ T37] [ 577.966755][ T37] dump_stack_lvl+0xe8/0x150 [ 577.966851][ T37] nmi_cpu_backtrace+0x274/0x2d0 [ 577.966996][ T37] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 577.967096][ T37] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 577.967164][ T37] sys_info+0x135/0x170 [ 577.967193][ T37] watchdog+0xfd7/0x1030 [ 577.967251][ T37] ? watchdog+0x1c7/0x1030 [ 577.967283][ T37] kthread+0x38b/0x470 [ 577.967305][ T37] ? __pfx_watchdog+0x10/0x10 [ 577.967328][ T37] ? __pfx_kthread+0x10/0x10 [ 577.967350][ T37] ret_from_fork+0x514/0xb70 [ 577.967394][ T37] ? __pfx_ret_from_fork+0x10/0x10 [ 577.967415][ T37] ? __switch_to+0xc89/0x1420 [ 577.967446][ T37] ? __pfx_kthread+0x10/0x10 [ 577.967468][ T37] ret_from_fork_asm+0x1a/0x30 [ 577.967504][ T37] [ 577.967539][ T37] Sending NMI from CPU 1 to CPUs 0: [ 577.967566][ C0] NMI backtrace for cpu 0 [ 577.967578][ C0] CPU: 0 UID: 0 PID: 20 Comm: rcuc/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 577.967596][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 577.967605][ C0] RIP: 0010:check_preemption_disabled+0x1f/0xd0 [ 577.967629][ C0] Code: 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 53 65 8b 05 2b ce 4e 07 65 48 8b 0d fb cd 4e 07 85 c9 74 0c 5b 41 5e 41 5f 5d bc b6 03 00 cc 9c 59 f7 c1 00 02 00 00 74 ea 65 4c 8b 3d d1 cd [ 577.967642][ C0] RSP: 0018:ffffc90000197678 EFLAGS: 00000202 [ 577.967656][ C0] RAX: 0000000000000000 RBX: ffffc90000197758 RCX: 8000000000000001 [ 577.967667][ C0] RDX: ffffffff90505601 RSI: ffffffff8bcc2260 RDI: ffffffff8bcc2220 [ 577.967679][ C0] RBP: 1ffffffff20a0a01 R08: ffffc90000197ad0 R09: 0000000000000000 [ 577.967689][ C0] R10: ffffc90000197798 R11: fffff52000032ef5 R12: ffffc90000190000 [ 577.967701][ C0] R13: ffffffff8177e20f R14: ffffc90000197748 R15: ffffc90000197ad0 [ 577.967713][ C0] FS: 0000000000000000(0000) GS:ffff888125bd4000(0000) knlGS:0000000000000000 [ 577.967726][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 577.967736][ C0] CR2: 00007ffdf9039628 CR3: 000000005b88a000 CR4: 00000000003526f0 [ 577.967751][ C0] Call Trace: [ 577.967756][ C0] [ 577.967761][ C0] rcu_is_watching+0x16/0xb0 [ 577.967785][ C0] unwind_next_frame+0x1b66/0x2550 [ 577.967806][ C0] ? kasan_save_free_info+0x40/0x50 [ 577.967822][ C0] ? unwind_next_frame+0x8f/0x2550 [ 577.967841][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 577.967860][ C0] arch_stack_walk+0x11b/0x150 [ 577.967881][ C0] ? __kasan_slab_free+0x5c/0x80 [ 577.967909][ C0] stack_trace_save+0xa9/0x100 [ 577.967926][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 577.967945][ C0] ? __lock_acquire+0x6df/0x2e40 [ 577.967965][ C0] kasan_save_track+0x3e/0x80 [ 577.967991][ C0] ? kasan_save_track+0x3e/0x80 [ 577.968016][ C0] ? kasan_save_free_info+0x40/0x50 [ 577.968055][ C0] kasan_save_free_info+0x40/0x50 [ 577.968071][ C0] __kasan_slab_free+0x5c/0x80 [ 577.968091][ C0] __rcu_free_sheaf_prepare+0x12d/0x2a0 [ 577.968117][ C0] ? rcu_cpu_kthread+0x217/0x1740 [ 577.968137][ C0] rcu_free_sheaf+0x31/0x210 [ 577.968157][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 577.968174][ C0] ? __pfx_rcu_free_sheaf+0x10/0x10 [ 577.968194][ C0] ? rcu_cpu_kthread+0x217/0x1740 [ 577.968213][ C0] rcu_cpu_kthread+0xb2c/0x1740 [ 577.968242][ C0] ? __pfx_rcu_cpu_kthread+0x10/0x10 [ 577.968270][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 577.968292][ C0] smpboot_thread_fn+0x565/0xa70 [ 577.968315][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 577.968340][ C0] kthread+0x38b/0x470 [ 577.968354][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 577.968375][ C0] ? __pfx_kthread+0x10/0x10 [ 577.968391][ C0] ret_from_fork+0x514/0xb70 [ 577.968406][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 577.968421][ C0] ? __switch_to+0xc89/0x1420 [ 577.968442][ C0] ? __pfx_kthread+0x10/0x10 [ 577.968457][ C0] ret_from_fork_asm+0x1a/0x30 [ 577.968478][ C0] [ 577.983147][ C1] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 577.998139][ T37] Kernel panic - not syncing: hung_task: blocked tasks [ 579.441549][ T37] CPU: 1 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 579.451194][ T37] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 579.461451][ T37] Call Trace: [ 579.464751][ T37] [ 579.467708][ T37] vpanic+0x56d/0xa60 [ 579.471714][ T37] ? __pfx___schedule+0x10/0x10 [ 579.476591][ T37] ? __pfx_vpanic+0x10/0x10 [ 579.481124][ T37] panic+0xc5/0xd0 [ 579.484875][ T37] ? __pfx_panic+0x10/0x10 [ 579.489327][ T37] ? preempt_schedule_common+0x7f/0xd0 [ 579.494826][ T37] ? preempt_schedule_thunk+0x16/0x40 [ 579.500226][ T37] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 579.506419][ T37] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 579.512603][ T37] watchdog+0x1030/0x1030 [ 579.516968][ T37] ? watchdog+0x1c7/0x1030 [ 579.521409][ T37] kthread+0x38b/0x470 [ 579.525500][ T37] ? __pfx_watchdog+0x10/0x10 [ 579.530215][ T37] ? __pfx_kthread+0x10/0x10 [ 579.534843][ T37] ret_from_fork+0x514/0xb70 [ 579.539465][ T37] ? __pfx_ret_from_fork+0x10/0x10 [ 579.544608][ T37] ? __switch_to+0xc89/0x1420 [ 579.549334][ T37] ? __pfx_kthread+0x10/0x10 [ 579.553967][ T37] ret_from_fork_asm+0x1a/0x30 [ 579.558783][ T37] [ 579.562438][ T37] Kernel Offset: disabled [ 579.566781][ T37] Rebooting in 86400 seconds..