last executing test programs: 5m8.737586045s ago: executing program 3 (id=323): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/keys\x00', 0x0, 0x0) r1 = add_key$user(&(0x7f0000000100), &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="ed", 0x1, 0xffffffffffffffff) r2 = request_key(&(0x7f0000000140)='ceph\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f0000000300)='{\\\x00', 0xffffffffffffffff) keyctl$set_timeout(0xf, r2, 0x1c0e) r3 = socket$nl_generic(0x11, 0x3, 0x10) r4 = syz_open_dev$midi(&(0x7f0000000000), 0x2, 0x800) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r4, 0x40045730, &(0x7f0000000600)) keyctl$update(0x2, r1, &(0x7f0000000040)="422ec8d2c029afebb3ce30ef79fad8c85dcd48861e216d397ae7ac56aa7b178db2f44e5af7900ebb30c0c262dc3478b9428a717ab2d867eacfb651f933c9f0ce0937fd7e7aa3e8b275e638847cfe25b6673b7e26dc8d167ba365acfc3f93763f87fc", 0x62) syz_emit_ethernet(0x3f, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x31, 0x0, 0x0, 0x9, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x9, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, '\x00'}}}}}, 0x0) sendmsg(r3, &(0x7f0000000640)={&(0x7f00000000c0)=@caif=@dgm={0x25, 0xd}, 0x2c, &(0x7f00000005c0)=[{&(0x7f0000000000)="4ba72c4cfd81685544f46c3f0800", 0x3e}], 0x2, 0x0, 0x0, 0x11000000}, 0x0) keyctl$read(0xb, r1, &(0x7f0000000240)=""/140, 0x8c) read$FUSE(r0, &(0x7f0000001580)={0x2020}, 0x2020) 5m8.379627718s ago: executing program 3 (id=326): r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x101401) syz_usb_disconnect(r1) syz_usb_connect$cdc_ecm(0x5, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000102505a1a44000000001010902"], 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) openat$smackfs_revoke_subject(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x2000300, 0xe, 0x0, &(0x7f0000000600)="63e4ed8e46080000003389f7f986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) ioctl$EVIOCRMFF(r1, 0x550c, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000001c0)={0x0, 0x23000, 0x1000, 0x1000, 0x3}, 0x20) 5m5.105951907s ago: executing program 3 (id=335): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000200)={0x50, 0x0, r1, {0x7, 0x1f, 0x200, 0x1082004, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x1a}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$nfs(&(0x7f0000000040)='fus\xe5\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x1000, &(0x7f0000000340)={[{',*!'}, {'\x00'}, {'\x00'}, {'}\'][&[#('}, {')5.+*$'}, {}, {'w+\\)\x00'}], [{@fowner_gt={'fowner>', r2}}, {@subj_type={'subj_type', 0x3d, '#\\'}}, {@fscontext={'fscontext', 0x3d, 'user_u'}}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@obj_type}]}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101) dup2(r3, r0) write$FUSE_NOTIFY_POLL(r0, &(0x7f0000000100)={0xfffffffffffffeab, 0x1, 0x0, {0x2}}, 0xffffffe8) 5m2.866620637s ago: executing program 3 (id=338): socket$nl_route(0x10, 0x3, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000680)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d8, 0x0, 0x268, 0x311, 0x130, 0x268, 0x268, 0x460, 0x460, 0x268, 0x460, 0x9, 0x0, {[{{@uncond, 0x160, 0xa8, 0xd0, 0x0, {0x9401}}, @common=@unspec=@NFQUEUE2={0x28}}, {{@ipv6={@mcast1, @mcast2, [0x0, 0xff, 0xffffff, 0xff], [0xff, 0xffffff00, 0xff000000], 'wg0\x00', 'veth1_to_batadv\x00', {}, {0xff}, 0x2e, 0x2, 0x7, 0x8}, 0x0, 0xd0, 0x138, 0xe4030000, {}, [@common=@ipv6header={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00', {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x338) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x10000005) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb, 0x2}, 0xe) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2042, 0x0) ioctl$AUTOFS_IOC_FAIL(r5, 0x4c80, 0x7000000) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x0) r7 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f00000001c0)={r7}, &(0x7f0000000200)={'enc=', 'oaep', ' hash=', {'sha512_mb\x00'}}, 0x0, 0x0) add_key$user(0x0, &(0x7f0000000200)={'syz', 0x2}, &(0x7f0000000240)="db3f3e06c6bf0c912c9a2267fada81803605cd602c83519af3630510baff41098f70b6eb26f2b2961374e05eeadd9c25d1c06a705e8972fcf722ef9f84b6479a1620350b0e581d64f5f6bd503d1e662a13ea7d93a28feeb006d1a585f545ac0ee2d5e5036328b42c8c2ad16d8728967f7f7016f6c7298abe08b3bacd984938d605f6c4c3f4f4ed438f34e87cd536", 0x8e, r7) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f000056c000/0x3000)=nil, &(0x7f000083d000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000dbd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r6}, 0x68) r8 = io_uring_setup(0x9, &(0x7f0000000040)={0x0, 0x65cf, 0x1c881, 0x8, 0xd1}) io_uring_enter(r8, 0x2219, 0x7721, 0x16, 0x0, 0x0) 5m0.959542186s ago: executing program 3 (id=347): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x10000005) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb, 0x2}, 0xe) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2042, 0x0) ioctl$AUTOFS_IOC_FAIL(r5, 0x4c80, 0x7000000) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x0) io_uring_setup(0x299, &(0x7f0000000300)={0x0, 0xf76b, 0x2, 0xfffffffd, 0x0, 0x0, r6}) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f00000001c0), &(0x7f0000000200)={'enc=', 'oaep', ' hash=', {'sha512_mb\x00'}}, 0x0, 0x0) add_key$user(0x0, &(0x7f0000000200)={'syz', 0x2}, &(0x7f0000000240)="db3f3e06c6bf0c912c9a2267fada81803605cd602c83519af3630510baff41098f70b6eb26f2b2961374e05eeadd9c25d1c06a705e8972fcf722ef9f84b6479a1620350b0e581d64f5f6bd503d1e662a13ea7d93a28feeb006d1a585f545ac0ee2d5e5036328b42c8c2ad16d8728967f7f7016f6c7298abe08b3bacd984938d605f6c4c3f4f4ed438f34e87cd536", 0x8e, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f000056c000/0x3000)=nil, &(0x7f000083d000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000dbd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r6}, 0x68) r7 = io_uring_setup(0x9, &(0x7f0000000040)={0x0, 0x65cf, 0x1c881, 0x8, 0xd1}) io_uring_enter(r7, 0x2219, 0x7721, 0x16, 0x0, 0x0) 4m59.313491392s ago: executing program 3 (id=350): syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) userfaultfd(0x1) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) socket$kcm(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$kcm(0x2a, 0x2, 0x0) r4 = socket$kcm(0x2a, 0x2, 0x0) ioctl$FS_IOC_READ_VERITY_METADATA(r3, 0xc0286687, &(0x7f0000000140)={0x3, 0x0, 0x0, 0x0}) sendmsg$kcm(r4, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x8917, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r5}}) 4m43.370857312s ago: executing program 32 (id=350): syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) userfaultfd(0x1) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) socket$kcm(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$kcm(0x2a, 0x2, 0x0) r4 = socket$kcm(0x2a, 0x2, 0x0) ioctl$FS_IOC_READ_VERITY_METADATA(r3, 0xc0286687, &(0x7f0000000140)={0x3, 0x0, 0x0, 0x0}) sendmsg$kcm(r4, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x8917, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r5}}) 3m26.996881037s ago: executing program 2 (id=576): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet_sctp(r0, &(0x7f0000000140)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000c3000)=ANY=[@ANYBLOB="1c0000008400000005"], 0x1c}], 0x1, 0x4000004) 3m25.744342665s ago: executing program 2 (id=579): openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1a5242, 0x0) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd86) 3m25.447577435s ago: executing program 2 (id=582): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000000000010711e092000000000000109022400010000000009040009010300010009210500000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hidraw(&(0x7f0000000100), 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x37, 0x7fffffff}]}) close_range(r1, 0xffffffffffffffff, 0x0) 3m22.860805146s ago: executing program 2 (id=594): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x181800, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x28081) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000800), 0x0) socket$inet(0x2, 0x1, 0x100) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x5, 0xfffffffffffffffd, 0x8001, 0x0, 0x5, 0x45}, 0x0, &(0x7f0000000080)={0x3ff, 0x4, 0x100000, 0x9, 0x0, 0x10, 0x80000002}, 0x0, 0x0) 3m20.70661549s ago: executing program 2 (id=599): ioctl$vim2m_VIDIOC_G_FMT(0xffffffffffffffff, 0xc0285628, &(0x7f0000000080)={0x1, @win={{0x2}, 0x5, 0x0, 0x0, 0x0, 0x0, 0x40}}) r0 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r0, 0xc008561c, &(0x7f00000001c0)={0x980915, 0x8081, @name="6736516728a5678c18a4ec047f3f1fa52fe9a9987d0406b3a0c705c611b66f06"}) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) socket$inet6_udplite(0xa, 0x2, 0x88) r3 = socket(0x40000000015, 0x5, 0x0) connect$inet(r3, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r3, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt(r3, 0x200000000114, 0x2715, &(0x7f0000000580)=""/102393, &(0x7f0000000400)=0x18ff9) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r6, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000001ac0)=@ethtool_regs={0x4, 0x5}}) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="c40000001900674c0000000000000000fc000000000000000000000000000000ac1e000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0700000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac0000000000"], 0xc4}}, 0x4c050) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000540)=@delpolicy={0x50, 0x14, 0x1, 0x0, 0x0, {{@in6=@empty, @in6=@local, 0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}, 0x8000000}}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r2, 0xc0bc5310, &(0x7f0000000200)) sendmmsg$unix(r4, &(0x7f000000bbc0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000001180)="dd9e4197", 0x4}], 0x1, &(0x7f00000003c0)=[@rights={{0x10, 0x1, 0x1, [r4]}}], 0x10, 0x20000041}}], 0x1, 0xc004) recvmmsg(r5, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}}], 0x700, 0x2, 0x0) 3m19.615216594s ago: executing program 2 (id=610): socket$inet_sctp(0x2, 0x1, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0) socket$kcm(0x2b, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) write$UHID_CREATE(0xffffffffffffffff, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_int(r5, &(0x7f0000000040)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) r7 = open(&(0x7f00000000c0)='./bus\x00', 0x1e5842, 0x0) r8 = open(&(0x7f0000000080)='./bus\x00', 0x145542, 0x40) ftruncate(r8, 0x2007ffd) sendfile(r6, r7, 0x0, 0x1000a3) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000380)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) mount(&(0x7f0000000040)=@sr0, &(0x7f0000000080)='./file1\x00', &(0x7f00000000c0)='vfat\x00', 0x81, 0x0) 3m4.29849331s ago: executing program 33 (id=610): socket$inet_sctp(0x2, 0x1, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0) socket$kcm(0x2b, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) write$UHID_CREATE(0xffffffffffffffff, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_int(r5, &(0x7f0000000040)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) r7 = open(&(0x7f00000000c0)='./bus\x00', 0x1e5842, 0x0) r8 = open(&(0x7f0000000080)='./bus\x00', 0x145542, 0x40) ftruncate(r8, 0x2007ffd) sendfile(r6, r7, 0x0, 0x1000a3) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000380)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) mount(&(0x7f0000000040)=@sr0, &(0x7f0000000080)='./file1\x00', &(0x7f00000000c0)='vfat\x00', 0x81, 0x0) 1m0.18066109s ago: executing program 4 (id=1174): r0 = syz_open_dev$dri(&(0x7f0000000040), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f00000004c0)={0x0, 0x0, r1, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000380)={r2, 0x0, 0x0, 0x0, 0x2, [], [0x0, 0x4, 0x0, 0x2], [0x0, 0xc6], [0x0, 0x1000000000]}) r3 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r4, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r3, 0xc06864ce, &(0x7f0000000440)={r5, 0x0, 0x0, 0x0, 0x0, [], [0x0, 0x0, 0x80000], [0x0, 0x1, 0xfffffffc, 0x74], [0x0, 0x8006]}) ioctl$DRM_IOCTL_MODE_GETFB2(r3, 0xc06864ce, &(0x7f0000000280)={r5, 0x0, 0x0, 0x0, 0x0, [], [], [0x0, 0x0, 0x8, 0x8000], [0x0, 0x3, 0x400000006]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 59.928750192s ago: executing program 4 (id=1176): openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x4040aea0, &(0x7f0000000040)=@arm64={0xa, 0x8, 0x4, '\x00', 0x7}) ioctl$KVM_SET_GUEST_DEBUG_x86(r0, 0x4048ae9b, &(0x7f00000010c0)={0x140002, 0x0, {[0x0, 0x6, 0x4, 0x5, 0x5, 0x3, 0x5, 0x9]}}) ioctl$KVM_SET_GUEST_DEBUG_x86(r0, 0x4048ae9b, &(0x7f0000000140)={0xb0003, 0x0, {[0x9, 0x7, 0x3, 0x3, 0x73, 0xb, 0x7fffffff]}}) 59.717505608s ago: executing program 4 (id=1177): bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000580)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/59, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000002c0)={0x1, r1}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffb2, 0x0, 0x0, 0x10, 0x5}, 0x94) connect(0xffffffffffffffff, &(0x7f00000001c0)=@pptp={0x18, 0x2, {0x2, @remote}}, 0x80) 56.004357005s ago: executing program 4 (id=1184): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$phonet_pipe(0x23, 0x5, 0x2) socket$vsock_stream(0x28, 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000040)={0x1}) pipe(0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000140)={0x0, 0x4}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000240)={r4, 0x3fba}, &(0x7f00000003c0)=0x8) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_io_uring_setup(0x88f, &(0x7f0000000300)={0x0, 0xd73, 0x80, 0xfffffffd, 0x287}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) unshare(0x20000400) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2}) io_uring_enter(r5, 0x75fa, 0xe475, 0x0, 0x0, 0x0) 49.987593281s ago: executing program 4 (id=1196): mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1}, 0x18) sendmmsg(r0, &(0x7f0000003e40)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="b875a1431a05b9319c", 0x9}], 0x1}}], 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000000)=0x5) r2 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r2, 0x0, 0x482, &(0x7f0000000000)=""/149, &(0x7f00000000c0)=0x210) 48.781104638s ago: executing program 4 (id=1199): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x8, 0x395, 0x5, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x2, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socket$igmp6(0xa, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r4 = io_uring_setup(0x332, &(0x7f0000000080)={0x0, 0x21e, 0x10}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000070000000200000007"], 0x50) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000000c0)=r7, 0x4) sendmsg$unix(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'aio_iiro_16\x00', [0x4f27, 0x8, 0x10000, 0x10000004, 0x5, 0xfffffbf9, 0x7fff, 0x40000000, 0x800000, 0x100, 0x5, 0x1, 0x1, 0x0, 0x40000004, 0xf, 0x0, 0x0, 0x3, 0x40000003, 0x89, 0xfffffffd, 0x0, 0x20001e56, 0xb, 0xfff, 0x3c, 0x7fffffff, 0x7, 0x8000000, 0xfffffff8]}) 31.380258273s ago: executing program 34 (id=1199): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x8, 0x395, 0x5, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x2, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socket$igmp6(0xa, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r4 = io_uring_setup(0x332, &(0x7f0000000080)={0x0, 0x21e, 0x10}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000070000000200000007"], 0x50) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000000c0)=r7, 0x4) sendmsg$unix(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'aio_iiro_16\x00', [0x4f27, 0x8, 0x10000, 0x10000004, 0x5, 0xfffffbf9, 0x7fff, 0x40000000, 0x800000, 0x100, 0x5, 0x1, 0x1, 0x0, 0x40000004, 0xf, 0x0, 0x0, 0x3, 0x40000003, 0x89, 0xfffffffd, 0x0, 0x20001e56, 0xb, 0xfff, 0x3c, 0x7fffffff, 0x7, 0x8000000, 0xfffffff8]}) 23.441123309s ago: executing program 0 (id=1235): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0xdfffffff, 0x5e490420, 0x4, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x3731, {0x0, 0x7f69ff17f1e1ab77}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xc5001, 0x104) write$FUSE_WRITE(r2, 0x0, 0xeffd) 23.265441625s ago: executing program 0 (id=1237): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f00000010c0)={0x140002, 0x0, {[0x0, 0x6, 0x4, 0x5, 0x5, 0x3, 0x5, 0x9]}}) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000140)={0xb0003, 0x0, {[0x9, 0x7, 0x3, 0x3, 0x73, 0xb, 0x7fffffff]}}) 22.918092334s ago: executing program 0 (id=1239): syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x88, 0x30, 0x1, 0x0, 0x0, {}, [{0x74, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000300)={{{@in=@multicast2, @in=@remote}}, {{@in=@local}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe4) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000440)='\x00'/16, 0x10) r4 = accept4(r3, 0x0, 0x0, 0x80000) r5 = accept4(r4, 0x0, 0x0, 0x80800) sendmmsg$inet6(r5, &(0x7f0000003b80)=[{{0x0, 0xd, &(0x7f00000003c0)=[{&(0x7f00000000c0)="e6", 0x1}], 0x1, 0x0, 0x0, 0x7000300}}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000440)='&', 0x23fff}], 0x1}, 0xff03}], 0x4000070, 0x8000) 20.463775415s ago: executing program 0 (id=1243): r0 = syz_open_dev$radio(&(0x7f0000000080), 0x1, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000040)=ANY=[@ANYRES32=r0], &(0x7f0000000300)='GPL\x00', 0x2, 0xa4, &(0x7f0000000140)=""/164, 0x41100, 0x7b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x38}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f00000002c0)="00154e0132", &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, &(0x7f0000000000)) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x8c, 0x0) r4 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000340)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a3000000000080041007369770014003300766c616e310000000000000000000000093c5388d9299741a812c666bd1a870eefaf60cac27f01eecc9dd14a4e7b7b4f4320"], 0x38}, 0x1, 0x1000000, 0x0, 0x80c9}, 0x20000000) r5 = mq_open(&(0x7f0000000040)='!se\xf7ih,\x17i\xacP\xe6lNnuxselinux\x00', 0x6e93ebbbcc0884f2, 0x8, &(0x7f0000000000)={0x0, 0x1, 0x7}) mq_timedreceive(r5, &(0x7f0000000640)=""/4096, 0x1000, 0x1, 0x0) mq_timedsend(r5, 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) ioctl$VIDIOC_DQEVENT(r0, 0x80785659, &(0x7f00000000c0)={0x0, @frame_sync}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="28000000350001002bbd7004fedbdb250400000008000400020000000c0005"], 0x28}, 0x1, 0x0, 0x0, 0x20040050}, 0x24000080) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0xe8, 0xffff, 0x3, 0x3}, 0x10) 18.271373349s ago: executing program 0 (id=1245): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) r2 = shmget$private(0x0, 0x13000, 0x1, &(0x7f0000feb000/0x13000)=nil) r3 = shmat(r2, &(0x7f0000ff1000/0x3000)=nil, 0x400c) r4 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0x0) shmdt(r3) 17.320922544s ago: executing program 6 (id=1252): syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x88, 0x30, 0x1, 0x0, 0x0, {}, [{0x74, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000300)={{{@in=@multicast2, @in=@remote}}, {{@in=@local}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe4) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000440)='\x00'/16, 0x10) r4 = accept4(r3, 0x0, 0x0, 0x80000) r5 = accept4(r4, 0x0, 0x0, 0x80800) sendmmsg$inet6(r5, &(0x7f0000003b80)=[{{0x0, 0xd, &(0x7f00000003c0)=[{&(0x7f00000000c0)="e6", 0x1}], 0x1, 0x0, 0x0, 0x7000300}}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000440)='&', 0x23fff}], 0x1}, 0xff03}], 0x4000070, 0x8000) 16.248333952s ago: executing program 6 (id=1253): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0xc831, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdir(0x0, 0x100) r4 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r5 = openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) close(r5) execveat$binfmt(0xffffffffffffff9c, r4, 0x0, 0x0, 0x0) openat$binfmt(0xffffffffffffff9c, r4, 0x2, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) preadv2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) write$binfmt_misc(r6, &(0x7f0000000300), 0x6) mount$9p_virtio(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x8c, 0x0) 14.231920185s ago: executing program 6 (id=1254): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x2, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x80020}, 0x1c, &(0x7f0000000500)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x34000811) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000640)=ANY=[@ANYBLOB="12e01b398adda16e"], 0x1000f) 14.014739857s ago: executing program 6 (id=1255): r0 = syz_open_dev$radio(&(0x7f0000000080), 0x1, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000040)=ANY=[@ANYRES32=r0], &(0x7f0000000300)='GPL\x00', 0x2, 0xa4, &(0x7f0000000140)=""/164, 0x41100, 0x7b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x38}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f00000002c0)="00154e0132", &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, &(0x7f0000000000)) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x8c, 0x0) r4 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000340)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a3000000000080041007369770014003300766c616e310000000000000000000000093c5388d9299741a812c666bd1a870eefaf60cac27f01eecc9dd14a4e7b7b4f4320"], 0x38}, 0x1, 0x1000000, 0x0, 0x80c9}, 0x20000000) r5 = mq_open(&(0x7f0000000040)='!se\xf7ih,\x17i\xacP\xe6lNnuxselinux\x00', 0x6e93ebbbcc0884f2, 0x8, &(0x7f0000000000)={0x0, 0x1, 0x7}) mq_timedreceive(r5, &(0x7f0000000640)=""/4096, 0x1000, 0x1, 0x0) mq_timedsend(r5, 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) ioctl$VIDIOC_DQEVENT(r0, 0x80785659, &(0x7f00000000c0)={0x0, @frame_sync}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="28000000350001002bbd7004fedbdb250400000008000400020000000c0005"], 0x28}, 0x1, 0x0, 0x0, 0x20040050}, 0x24000080) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0xe8, 0xffff, 0x3, 0x3}, 0x10) 12.677359379s ago: executing program 1 (id=1259): r0 = syz_open_dev$radio(&(0x7f0000000080), 0x1, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000040)=ANY=[@ANYRES32=r0], &(0x7f0000000300)='GPL\x00', 0x2, 0xa4, &(0x7f0000000140)=""/164, 0x41100, 0x7b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x38}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f00000002c0)="00154e0132", &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, &(0x7f0000000000)) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x8c, 0x0) r4 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000340)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a3000000000080041007369770014003300766c616e310000000000000000000000093c5388d9299741a812c666bd1a870eefaf60cac27f01eecc9dd14a4e7b7b4f4320"], 0x38}, 0x1, 0x1000000, 0x0, 0x80c9}, 0x20000000) r5 = mq_open(&(0x7f0000000040)='!se\xf7ih,\x17i\xacP\xe6lNnuxselinux\x00', 0x6e93ebbbcc0884f2, 0x8, &(0x7f0000000000)={0x0, 0x1, 0x7}) mq_timedreceive(r5, &(0x7f0000000640)=""/4096, 0x1000, 0x1, 0x0) mq_timedsend(r5, 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@enum64={0x6, 0x0, 0x0, 0x13, 0x0, 0x2}]}, {0x0, [0x6f, 0x2e, 0x2e, 0x2e, 0x5f]}}, 0x0, 0x2b, 0x0, 0x1, 0x8000}, 0x28) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000140)={0x3, 0x98f90f, 0x1}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="28000000350001002bbd7004fedbdb250400000008000400020000000c0005"], 0x28}, 0x1, 0x0, 0x0, 0x20040050}, 0x24000080) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0xe8, 0xffff, 0x3, 0x3}, 0x10) 10.727726984s ago: executing program 6 (id=1261): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000040)=@arm64={0xa, 0x8, 0x4, '\x00', 0x7}) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000140)={0xb0003, 0x0, {[0x9, 0x7, 0x3, 0x3, 0x73, 0xb, 0x7fffffff]}}) 10.137369576s ago: executing program 1 (id=1263): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0xc831, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdir(0x0, 0x100) r4 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r5 = openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) close(r5) execveat$binfmt(0xffffffffffffff9c, r4, 0x0, 0x0, 0x0) openat$binfmt(0xffffffffffffff9c, r4, 0x2, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r6, 0x1, 0x12, &(0x7f0000000300)=0x20, 0x4) preadv2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) write$binfmt_misc(r6, &(0x7f0000000300), 0x6) mount$9p_virtio(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x8c, 0x0) 7.135146695s ago: executing program 1 (id=1265): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0xe1, 0x0, 0x2377}]}) 7.133176336s ago: executing program 0 (id=1266): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x8, 0x395, 0x5, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x2, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socket$igmp6(0xa, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r4 = io_uring_setup(0x332, &(0x7f0000000080)={0x0, 0x21e, 0x10}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000000c0)=r6, 0x4) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'aio_iiro_16\x00', [0x4f27, 0x8, 0x10000, 0x10000004, 0x5, 0xfffffbf9, 0x7fff, 0x40000000, 0x800000, 0x100, 0x5, 0x1, 0x1, 0x0, 0x40000004, 0xf, 0x0, 0x0, 0x3, 0x40000003, 0x89, 0xfffffffd, 0x0, 0x20001e56, 0xb, 0xfff, 0x3c, 0x7fffffff, 0x7, 0x8000000, 0xfffffff8]}) 6.860667047s ago: executing program 6 (id=1268): socket$inet6_mptcp(0xa, 0x1, 0x106) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1b, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) syz_usb_connect(0x6, 0x0, 0x0, &(0x7f0000001b80)={0xa, &(0x7f0000001740)={0xa, 0x6, 0x150, 0x8, 0x5, 0x4, 0xff, 0xb}, 0x0, 0x0, 0x4, [{0x0, 0x0}, {0x0, 0x0}, {0x4, &(0x7f00000018c0)=@lang_id={0x4, 0x3, 0x43f}}, {0x0, 0x0}]}) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x3], 0x1, [0x1, 0x102, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, 0x0, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='numa_maps\x00') mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) read$FUSE(r7, 0x0, 0x0) 6.800725973s ago: executing program 5 (id=1269): mkdir(&(0x7f0000000380)='./file1\x00', 0xa) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x100, 0x0) r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x244) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000002280)={{0x1, 0x1, 0x18, r1}, './file2\x00'}) r2 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180), 0x28800, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r3, 0xc018937b, &(0x7f0000000140)={{0x1, 0x1, 0xb8, r2}, './file0\x00'}) 6.800139497s ago: executing program 1 (id=1270): r0 = syz_open_dev$radio(&(0x7f0000000080), 0x1, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000040)=ANY=[@ANYRES32=r0], &(0x7f0000000300)='GPL\x00', 0x2, 0xa4, &(0x7f0000000140)=""/164, 0x41100, 0x7b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x38}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f00000002c0)="00154e0132", &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, &(0x7f0000000000)) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x8c, 0x0) r4 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000340)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a3000000000080041007369770014003300766c616e310000000000000000000000093c5388d9299741a812c666bd1a870eefaf60cac27f01eecc9dd14a4e7b7b4f4320"], 0x38}, 0x1, 0x1000000, 0x0, 0x80c9}, 0x20000000) r5 = mq_open(&(0x7f0000000040)='!se\xf7ih,\x17i\xacP\xe6lNnuxselinux\x00', 0x6e93ebbbcc0884f2, 0x8, &(0x7f0000000000)={0x0, 0x1, 0x7}) mq_timedreceive(r5, &(0x7f0000000640)=""/4096, 0x1000, 0x1, 0x0) mq_timedsend(r5, 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) ioctl$VIDIOC_DQEVENT(r0, 0x80785659, &(0x7f00000000c0)={0x0, @frame_sync}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="28000000350001002bbd7004fedbdb250400000008000400020000000c0005"], 0x28}, 0x1, 0x0, 0x0, 0x20040050}, 0x24000080) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0xe8, 0xffff, 0x3, 0x3}, 0x10) 6.472932024s ago: executing program 5 (id=1271): socket(0x10, 0x3, 0x4) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002640)=@newtaction={0xe68, 0x30, 0x3f, 0x0, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x2}, [{0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {0xfffffffc, 0x0, 0x0, 0x0, 0x100}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, {0x5943}, {0x0, 0x800000, 0x0, 0xfffffffc}, {}, {}, {0x0, 0x0, 0x0, 0x10}, {}, {}, {0x0, 0xa2}, {0x0, 0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x1cbe}, {0x0, 0x0, 0x0, 0x5}, {}, {}, {}, {0x2}, {0x8}, {}, {0x0, 0xfffffffe, 0x400000}, {0x0, 0xfffffffc}, {}, {}, {}, {0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0x0, 0x4, 0xffffff6a}, {0x0, 0x0, 0x0, 0x0, 0x5}, {}, {}, {0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x0, 0x0, 0x0, 0x100}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x800000}, {0x0, 0x0, 0x0, 0xe54b}, {0x0, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x7fffffff}, {0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x27a}, {0x0, 0x0, 0xffffffff}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0xffffffff}, {0x0, 0xfffffffc, 0x0, 0x0, 0xfffffffc}, {}, {0x0, 0x2}, {}, {}, {}, {0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x0, 0x0, 0x0, 0x0, 0x1}, {0xc}, {}, {0x0, 0x0, 0x2b7f}, {0x3ff, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x6}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0xcfc, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x70}, {}, {0xfffffffd, 0x0, 0x0, 0x0, 0xa92}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x40000000, 0x1, 0x0, 0x10001}, {0x0, 0x0, 0x20}, {}, {0x80000}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, {0xfffffffc}, {}, {}, {}, {0x0, 0xa, 0xfffffffc}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x40, 0x0, 0x0, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1, 0x2}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x2}, {0x5}, {}, {}, {}, {}, {}, {0x7, 0x1}, {}, {}, {0x0, 0x1}, {}, {}, {0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x0) mbind(&(0x7f00001fa000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x0) 4.519521682s ago: executing program 1 (id=1272): r0 = syz_open_dev$radio(&(0x7f0000000080), 0x1, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000040)=ANY=[@ANYRES32=r0], &(0x7f0000000300)='GPL\x00', 0x2, 0xa4, &(0x7f0000000140)=""/164, 0x41100, 0x7b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x38}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f00000002c0)="00154e0132", &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, &(0x7f0000000000)) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x8c, 0x0) r4 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000340)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a3000000000080041007369770014003300766c616e310000000000000000000000093c5388d9299741a812c666bd1a870eefaf60cac27f01eecc9dd14a4e7b7b4f4320"], 0x38}, 0x1, 0x1000000, 0x0, 0x80c9}, 0x20000000) r5 = mq_open(&(0x7f0000000040)='!se\xf7ih,\x17i\xacP\xe6lNnuxselinux\x00', 0x6e93ebbbcc0884f2, 0x8, &(0x7f0000000000)={0x0, 0x1, 0x7}) mq_timedreceive(r5, &(0x7f0000000640)=""/4096, 0x1000, 0x1, 0x0) mq_timedsend(r5, 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@enum64={0x6, 0x0, 0x0, 0x13, 0x0, 0x2}]}, {0x0, [0x6f, 0x2e, 0x2e, 0x2e, 0x5f]}}, 0x0, 0x2b, 0x0, 0x1, 0x8000}, 0x28) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000140)={0x3, 0x98f90f, 0x1}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="28000000350001002bbd7004fedbdb250400000008000400020000000c0005"], 0x28}, 0x1, 0x0, 0x0, 0x20040050}, 0x24000080) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0xe8, 0xffff, 0x3, 0x3}, 0x10) 4.498861201s ago: executing program 5 (id=1273): sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0) get_mempolicy(&(0x7f0000000200), 0x0, 0x4, &(0x7f0000fe9000/0x14000)=nil, 0x2) 2.461527268s ago: executing program 1 (id=1274): syz_usb_connect(0x0, 0x24, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r1, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040)={0x1, 0x8, 0x2, 0x8, 0x7, 0x1, 0x3, 0x0, 0x2, 0x5, 0x6, 0x2, 0x5}, 0xe) close_range(r2, 0xffffffffffffffff, 0x0) 2.152765939s ago: executing program 5 (id=1275): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0xc831, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdir(0x0, 0x100) r4 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r5 = openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) close(r5) execveat$binfmt(0xffffffffffffff9c, r4, 0x0, 0x0, 0x0) openat$binfmt(0xffffffffffffff9c, r4, 0x2, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r6, 0x1, 0x12, &(0x7f0000000300)=0x20, 0x4) preadv2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) write$binfmt_misc(r6, &(0x7f0000000300), 0x6) mount$9p_virtio(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x8c, 0x0) 204.138602ms ago: executing program 5 (id=1276): r0 = syz_open_dev$vcsa(&(0x7f0000000380), 0x7b95b611, 0x802) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000000)='x', 0x1}, {&(0x7f00000001c0)='\x00\x00\x00\x00', 0x4}], 0x2) write$cgroup_int(r0, &(0x7f0000000340)=0xf, 0x12) 0s ago: executing program 5 (id=1277): socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x6, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() ptrace$PTRACE_SETSIGMASK(0x420b, 0x0, 0x8, &(0x7f00000005c0)={[0x8]}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) kernel console output (not intermixed with test programs): fr=0, Product=0, SerialNumber=0 [ 157.070086][ T31] usb 3-1: config 0 descriptor?? [ 157.200770][ T5125] usb 1-1: Using ep0 maxpacket: 32 [ 157.209125][ T5125] usb 1-1: config 4 has an invalid interface number: 228 but max is 0 [ 157.209154][ T5125] usb 1-1: config 4 has no interface number 0 [ 157.209199][ T5125] usb 1-1: config 4 interface 228 altsetting 68 endpoint 0x7 has invalid wMaxPacketSize 0 [ 157.209222][ T5125] usb 1-1: config 4 interface 228 altsetting 68 bulk endpoint 0x7 has invalid maxpacket 0 [ 157.209255][ T5125] usb 1-1: config 4 interface 228 has no altsetting 0 [ 157.218344][ T5125] usb 1-1: New USB device found, idVendor=0499, idProduct=a9a2, bcdDevice=c4.e8 [ 157.218375][ T5125] usb 1-1: New USB device strings: Mfr=1, Product=25, SerialNumber=3 [ 157.218394][ T5125] usb 1-1: Product: syz [ 157.218407][ T5125] usb 1-1: Manufacturer: syz [ 157.218420][ T5125] usb 1-1: SerialNumber: syz [ 158.022161][ T6668] netlink: 28 bytes leftover after parsing attributes in process `syz.4.231'. [ 160.300388][ T5878] usb 3-1: USB disconnect, device number 7 [ 160.474220][ T6681] FAULT_INJECTION: forcing a failure. [ 160.474220][ T6681] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 160.474257][ T6681] CPU: 0 UID: 0 PID: 6681 Comm: syz.1.235 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 160.474282][ T6681] Tainted: [L]=SOFTLOCKUP [ 160.474288][ T6681] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 160.474298][ T6681] Call Trace: [ 160.474304][ T6681] [ 160.474312][ T6681] dump_stack_lvl+0xe8/0x150 [ 160.474340][ T6681] should_fail_ex+0x46b/0x600 [ 160.474365][ T6681] prepare_alloc_pages+0x22a/0x6b0 [ 160.474394][ T6681] __alloc_frozen_pages_noprof+0x12f/0x380 [ 160.474417][ T6681] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 160.474442][ T6681] ? __pfx_policy_nodemask+0x10/0x10 [ 160.474460][ T6681] ? kstrtoull+0x12f/0x1d0 [ 160.474482][ T6681] ? kstrtouint+0x6e/0xe0 [ 160.474503][ T6681] alloc_pages_mpol+0xd1/0x380 [ 160.474526][ T6681] alloc_pages_noprof+0xce/0x1e0 [ 160.474548][ T6681] get_free_pages_noprof+0xf/0x80 [ 160.474569][ T6681] environ_read+0xbf/0x3d0 [ 160.474601][ T6681] vfs_readv+0x594/0x850 [ 160.474623][ T6681] ? __pfx_environ_read+0x10/0x10 [ 160.474650][ T6681] ? __pfx_vfs_readv+0x10/0x10 [ 160.474683][ T6681] ? __fget_files+0x2a/0x420 [ 160.474709][ T6681] ? __fget_files+0x3a6/0x420 [ 160.474729][ T6681] ? __fget_files+0x2a/0x420 [ 160.474766][ T6681] __x64_sys_preadv+0x1a2/0x2b0 [ 160.474789][ T6681] ? __pfx___x64_sys_preadv+0x10/0x10 [ 160.474819][ T6681] do_syscall_64+0x14d/0xf80 [ 160.474841][ T6681] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.474858][ T6681] ? trace_irq_disable+0x37/0x100 [ 160.474873][ T6681] ? clear_bhb_loop+0x40/0x90 [ 160.474894][ T6681] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.474911][ T6681] RIP: 0033:0x7f4d2cd2c629 [ 160.474927][ T6681] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 160.474941][ T6681] RSP: 002b:00007f4d2af7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 160.474961][ T6681] RAX: ffffffffffffffda RBX: 00007f4d2cfa5fa0 RCX: 00007f4d2cd2c629 [ 160.474974][ T6681] RDX: 0000000000000001 RSI: 0000200000001400 RDI: 0000000000000003 [ 160.474985][ T6681] RBP: 00007f4d2af7e090 R08: 0000000000000000 R09: 0000000000000000 [ 160.474996][ T6681] R10: 0000000000c002a0 R11: 0000000000000246 R12: 0000000000000001 [ 160.475007][ T6681] R13: 00007f4d2cfa6038 R14: 00007f4d2cfa5fa0 R15: 00007ffeb48428a8 [ 160.475037][ T6681] [ 163.091225][ T5125] usb 1-1: USB disconnect, device number 4 [ 163.371051][ T6722] Bluetooth: hci5: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 163.619973][ T5809] udevd[5809]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:4.228/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 164.284387][ T6736] FAULT_INJECTION: forcing a failure. [ 164.284387][ T6736] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 164.284423][ T6736] CPU: 1 UID: 0 PID: 6736 Comm: syz.0.250 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 164.284449][ T6736] Tainted: [L]=SOFTLOCKUP [ 164.284455][ T6736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 164.284541][ T6736] Call Trace: [ 164.284556][ T6736] [ 164.284565][ T6736] dump_stack_lvl+0xe8/0x150 [ 164.284594][ T6736] should_fail_ex+0x46b/0x600 [ 164.284618][ T6736] _copy_from_user+0x2d/0xb0 [ 164.284667][ T6736] ___sys_sendmsg+0x1c6/0x360 [ 164.284685][ T6736] ? __lock_acquire+0x6b5/0x2cf0 [ 164.284712][ T6736] ? __pfx____sys_sendmsg+0x10/0x10 [ 164.284763][ T6736] ? __fget_files+0x2a/0x420 [ 164.284785][ T6736] ? __fget_files+0x3a6/0x420 [ 164.284816][ T6736] __x64_sys_sendmsg+0x1c3/0x2a0 [ 164.284838][ T6736] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 164.284865][ T6736] ? __pfx_ksys_write+0x10/0x10 [ 164.284894][ T6736] do_syscall_64+0x14d/0xf80 [ 164.284916][ T6736] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.284933][ T6736] ? trace_irq_disable+0x37/0x100 [ 164.284949][ T6736] ? clear_bhb_loop+0x40/0x90 [ 164.284971][ T6736] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.284988][ T6736] RIP: 0033:0x7fafd5dbc629 [ 164.285006][ T6736] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 164.285022][ T6736] RSP: 002b:00007fafd400e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 164.285042][ T6736] RAX: ffffffffffffffda RBX: 00007fafd6035fa0 RCX: 00007fafd5dbc629 [ 164.285054][ T6736] RDX: 0000000000008000 RSI: 0000200000000280 RDI: 0000000000000003 [ 164.285066][ T6736] RBP: 00007fafd400e090 R08: 0000000000000000 R09: 0000000000000000 [ 164.285077][ T6736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 164.285088][ T6736] R13: 00007fafd6036038 R14: 00007fafd6035fa0 R15: 00007ffe960c7dd8 [ 164.285119][ T6736] [ 165.480318][ T5112] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 165.480652][ T5800] Bluetooth: hci5: command 0x1003 tx timeout [ 165.694238][ T6755] FAULT_INJECTION: forcing a failure. [ 165.694238][ T6755] name failslab, interval 1, probability 0, space 0, times 0 [ 165.694275][ T6755] CPU: 0 UID: 0 PID: 6755 Comm: syz.1.255 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 165.694300][ T6755] Tainted: [L]=SOFTLOCKUP [ 165.694306][ T6755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 165.694316][ T6755] Call Trace: [ 165.694323][ T6755] [ 165.694331][ T6755] dump_stack_lvl+0xe8/0x150 [ 165.694371][ T6755] should_fail_ex+0x46b/0x600 [ 165.694397][ T6755] should_failslab+0xa8/0x100 [ 165.694419][ T6755] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 165.694438][ T6755] ? __pfx_tcp_current_mss+0x10/0x10 [ 165.694456][ T6755] ? __alloc_skb+0x1d7/0x390 [ 165.694484][ T6755] __alloc_skb+0x1d7/0x390 [ 165.694511][ T6755] tcp_stream_alloc_skb+0x3d/0x350 [ 165.694538][ T6755] tcp_sendmsg_locked+0x1af7/0x55b0 [ 165.694609][ T6755] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 165.694642][ T6755] ? __local_bh_enable_ip+0x1ae/0x2b0 [ 165.694663][ T6755] ? lockdep_hardirqs_on+0x7a/0x110 [ 165.694689][ T6755] tcp_sendmsg+0x2f/0x50 [ 165.694711][ T6755] sock_write_iter+0x329/0x550 [ 165.694735][ T6755] ? __pfx_sock_write_iter+0x10/0x10 [ 165.694777][ T6755] do_iter_readv_writev+0x62b/0x8d0 [ 165.694800][ T6755] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 165.694815][ T6755] ? __lock_acquire+0x6b5/0x2cf0 [ 165.694846][ T6755] ? rw_verify_area+0x25b/0x4e0 [ 165.694874][ T6755] vfs_writev+0x345/0x9a0 [ 165.694904][ T6755] ? __pfx_vfs_writev+0x10/0x10 [ 165.694938][ T6755] ? __fget_files+0x2a/0x420 [ 165.694963][ T6755] ? __fget_files+0x3a6/0x420 [ 165.694982][ T6755] ? __fget_files+0x2a/0x420 [ 165.695011][ T6755] do_writev+0x15a/0x2e0 [ 165.695034][ T6755] ? __pfx_do_writev+0x10/0x10 [ 165.695066][ T6755] do_syscall_64+0x14d/0xf80 [ 165.695086][ T6755] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.695103][ T6755] ? trace_irq_disable+0x37/0x100 [ 165.695119][ T6755] ? clear_bhb_loop+0x40/0x90 [ 165.695140][ T6755] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.695157][ T6755] RIP: 0033:0x7f4d2cd2c629 [ 165.695173][ T6755] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 165.695189][ T6755] RSP: 002b:00007f4d2af7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 165.695209][ T6755] RAX: ffffffffffffffda RBX: 00007f4d2cfa5fa0 RCX: 00007f4d2cd2c629 [ 165.695222][ T6755] RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000004 [ 165.695233][ T6755] RBP: 00007f4d2af7e090 R08: 0000000000000000 R09: 0000000000000000 [ 165.695245][ T6755] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 165.695256][ T6755] R13: 00007f4d2cfa6038 R14: 00007f4d2cfa5fa0 R15: 00007ffeb48428a8 [ 165.695286][ T6755] [ 166.133450][ T6767] netlink: 128 bytes leftover after parsing attributes in process `syz.1.259'. [ 166.133467][ T6767] netlink: 20 bytes leftover after parsing attributes in process `syz.1.259'. [ 167.180610][ T6769] overlayfs: failed to resolve './file0': -2 [ 167.850688][ T6781] Bluetooth: hci5: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 167.920399][ T6777] netlink: 'syz.2.264': attribute type 1 has an invalid length. [ 167.920432][ T6777] netlink: 224 bytes leftover after parsing attributes in process `syz.2.264'. [ 167.920449][ T6777] NCSI netlink: No device for ifindex 4076863488 [ 171.354466][ T6803] netlink: 8 bytes leftover after parsing attributes in process `syz.3.272'. [ 171.463415][ T5112] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 171.811605][ T6812] netlink: 128 bytes leftover after parsing attributes in process `syz.2.273'. [ 171.811622][ T6812] netlink: 20 bytes leftover after parsing attributes in process `syz.2.273'. [ 172.873540][ T6815] overlayfs: failed to resolve './file0': -2 [ 173.461679][ T6825] FAULT_INJECTION: forcing a failure. [ 173.461679][ T6825] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 173.461713][ T6825] CPU: 1 UID: 0 PID: 6825 Comm: syz.3.281 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 173.461736][ T6825] Tainted: [L]=SOFTLOCKUP [ 173.461741][ T6825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 173.461750][ T6825] Call Trace: [ 173.461757][ T6825] [ 173.461765][ T6825] dump_stack_lvl+0xe8/0x150 [ 173.461792][ T6825] should_fail_ex+0x46b/0x600 [ 173.461815][ T6825] _copy_to_user+0x31/0xb0 [ 173.461840][ T6825] simple_read_from_buffer+0xe1/0x170 [ 173.461867][ T6825] proc_fail_nth_read+0x1be/0x230 [ 173.461890][ T6825] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 173.461911][ T6825] ? rw_verify_area+0x2ac/0x4e0 [ 173.461935][ T6825] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 173.461956][ T6825] vfs_read+0x212/0xa70 [ 173.461980][ T6825] ? __pfx_vfs_read+0x10/0x10 [ 173.462007][ T6825] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 173.462029][ T6825] ? lockdep_hardirqs_on+0x7a/0x110 [ 173.462050][ T6825] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 173.462070][ T6825] ? mutex_lock_nested+0x152/0x1d0 [ 173.462085][ T6825] ? fdget_pos+0x252/0x320 [ 173.462111][ T6825] ksys_read+0x156/0x270 [ 173.462128][ T6825] ? __pfx_ksys_read+0x10/0x10 [ 173.462152][ T6825] do_syscall_64+0x14d/0xf80 [ 173.462171][ T6825] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.462186][ T6825] ? trace_irq_disable+0x37/0x100 [ 173.462200][ T6825] ? clear_bhb_loop+0x40/0x90 [ 173.462220][ T6825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.462237][ T6825] RIP: 0033:0x7f852b80cece [ 173.462253][ T6825] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 173.462268][ T6825] RSP: 002b:00007f8529aa5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 173.462286][ T6825] RAX: ffffffffffffffda RBX: 00007f8529aa66c0 RCX: 00007f852b80cece [ 173.462299][ T6825] RDX: 000000000000000f RSI: 00007f8529aa60a0 RDI: 0000000000000005 [ 173.462310][ T6825] RBP: 00007f8529aa6090 R08: 0000000000000000 R09: 0000000000000000 [ 173.462320][ T6825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 173.462330][ T6825] R13: 00007f852bac6038 R14: 00007f852bac5fa0 R15: 00007ffef16969d8 [ 173.462361][ T6825] [ 174.856553][ T6833] fuse: Bad value for 'fd' [ 175.270181][ T6837] Bluetooth: hci5: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 175.355833][ T6843] netlink: 128 bytes leftover after parsing attributes in process `syz.0.287'. [ 175.355857][ T6843] netlink: 20 bytes leftover after parsing attributes in process `syz.0.287'. [ 176.310843][ T6848] netlink: 52 bytes leftover after parsing attributes in process `syz.2.277'. [ 176.730366][ T5878] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 177.198748][ T6863] 9p: Bad value for 'rfdno' [ 177.798546][ T5112] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 178.416520][ T6843] overlayfs: failed to resolve './file0': -2 [ 179.330557][ T5878] usb 5-1: Using ep0 maxpacket: 16 [ 179.336575][ T5878] usb 5-1: config 1 has an invalid interface number: 19 but max is 0 [ 179.336610][ T5878] usb 5-1: config 1 has no interface number 0 [ 179.336658][ T5878] usb 5-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 179.336683][ T5878] usb 5-1: config 1 interface 19 has no altsetting 0 [ 179.354579][ T5878] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 179.354616][ T5878] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.354634][ T5878] usb 5-1: Product: syz [ 179.354648][ T5878] usb 5-1: Manufacturer: syz [ 179.354661][ T5878] usb 5-1: SerialNumber: syz [ 179.518077][ T5878] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 179.617637][ T1119] usb 5-1: Failed to submit usb control message: -71 [ 179.617673][ T1119] usb 5-1: unable to send the bmi data to the device: -71 [ 179.617690][ T1119] usb 5-1: unable to get target info from device [ 179.617704][ T1119] usb 5-1: could not get target info (-71) [ 179.617823][ T1119] usb 5-1: could not probe fw (-71) [ 179.690972][ T5878] usb 5-1: USB disconnect, device number 4 [ 180.132797][ T5800] Bluetooth: Unexpected continuation frame (len 18) [ 180.551311][ T5878] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 180.745966][ T5878] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 180.746013][ T5878] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 180.746079][ T5878] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 180.751746][ T5878] usb 5-1: New USB device found, idVendor=8086, idProduct=0b5b, bcdDevice=e1.c5 [ 180.751776][ T5878] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.751795][ T5878] usb 5-1: Product: syz [ 180.751808][ T5878] usb 5-1: Manufacturer: syz [ 180.751821][ T5878] usb 5-1: SerialNumber: syz [ 180.776016][ T5878] usb 5-1: config 0 descriptor?? [ 180.819290][ T5878] uvcvideo 5-1:0.0: Found UVC 34.00 device syz (8086:0b5b) [ 180.819332][ T5878] uvcvideo 5-1:0.0: No valid video chain found. [ 181.704870][ T5905] usb 5-1: USB disconnect, device number 5 [ 182.402961][ T6911] FAULT_INJECTION: forcing a failure. [ 182.402961][ T6911] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 182.402997][ T6911] CPU: 0 UID: 0 PID: 6911 Comm: syz.4.304 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 182.403022][ T6911] Tainted: [L]=SOFTLOCKUP [ 182.403028][ T6911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 182.403082][ T6911] Call Trace: [ 182.403090][ T6911] [ 182.403098][ T6911] dump_stack_lvl+0xe8/0x150 [ 182.403127][ T6911] should_fail_ex+0x46b/0x600 [ 182.403154][ T6911] _copy_from_user+0x2d/0xb0 [ 182.403177][ T6911] ___sys_sendmsg+0x1c6/0x360 [ 182.403195][ T6911] ? __lock_acquire+0x6b5/0x2cf0 [ 182.403222][ T6911] ? __pfx____sys_sendmsg+0x10/0x10 [ 182.403274][ T6911] ? __fget_files+0x2a/0x420 [ 182.403294][ T6911] ? __fget_files+0x3a6/0x420 [ 182.403325][ T6911] __x64_sys_sendmsg+0x1c3/0x2a0 [ 182.403346][ T6911] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 182.403373][ T6911] ? __pfx_ksys_write+0x10/0x10 [ 182.403402][ T6911] do_syscall_64+0x14d/0xf80 [ 182.403424][ T6911] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 182.403441][ T6911] ? trace_irq_disable+0x37/0x100 [ 182.403457][ T6911] ? clear_bhb_loop+0x40/0x90 [ 182.403478][ T6911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 182.403494][ T6911] RIP: 0033:0x7f2bfa26c629 [ 182.403511][ T6911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 182.403526][ T6911] RSP: 002b:00007f2bf84be028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 182.403546][ T6911] RAX: ffffffffffffffda RBX: 00007f2bfa4e5fa0 RCX: 00007f2bfa26c629 [ 182.403559][ T6911] RDX: 0000000000000004 RSI: 0000200000000140 RDI: 0000000000000004 [ 182.403571][ T6911] RBP: 00007f2bf84be090 R08: 0000000000000000 R09: 0000000000000000 [ 182.403582][ T6911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 182.403593][ T6911] R13: 00007f2bfa4e6038 R14: 00007f2bfa4e5fa0 R15: 00007ffc45541488 [ 182.403622][ T6911] [ 183.832004][ T6919] fuse: Bad value for 'user_id' [ 183.832024][ T6919] fuse: Bad value for 'user_id' [ 183.930303][ T807] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 184.030405][ T5125] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 184.100612][ T807] usb 4-1: Using ep0 maxpacket: 16 [ 184.134909][ T807] usb 4-1: config 1 has an invalid interface number: 19 but max is 0 [ 184.134938][ T807] usb 4-1: config 1 has no interface number 0 [ 184.134983][ T807] usb 4-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 184.135010][ T807] usb 4-1: config 1 interface 19 has no altsetting 0 [ 184.146210][ T807] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 184.146242][ T807] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.146261][ T807] usb 4-1: Product: syz [ 184.146275][ T807] usb 4-1: Manufacturer: syz [ 184.146289][ T807] usb 4-1: SerialNumber: syz [ 184.190846][ T5125] usb 5-1: config 0 has an invalid interface number: 251 but max is 0 [ 184.190874][ T5125] usb 5-1: config 0 has no interface number 0 [ 184.203198][ T5125] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 184.203227][ T5125] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.203246][ T5125] usb 5-1: Product: syz [ 184.203259][ T5125] usb 5-1: Manufacturer: syz [ 184.203273][ T5125] usb 5-1: SerialNumber: syz [ 184.225224][ T5125] usb 5-1: config 0 descriptor?? [ 184.311527][ T807] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 184.589496][ T5905] usb 4-1: USB disconnect, device number 4 [ 184.638461][ T1315] usb 4-1: Failed to submit usb control message: -71 [ 184.638497][ T1315] usb 4-1: unable to send the bmi data to the device: -71 [ 184.638576][ T1315] usb 4-1: unable to get target info from device [ 184.638591][ T1315] usb 4-1: could not get target info (-71) [ 184.639594][ T1315] usb 4-1: could not probe fw (-71) [ 186.332477][ T6936] 9p: Bad value for 'rfdno' [ 187.115833][ T5125] asix 5-1:0.251: probe with driver asix failed with error -71 [ 187.147806][ T5125] usb 5-1: USB disconnect, device number 6 [ 187.290935][ T6939] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 187.565817][ T6950] fuse: Bad value for 'user_id' [ 187.565837][ T6950] fuse: Bad value for 'user_id' [ 187.831439][ T5125] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 187.980327][ T5125] usb 4-1: Using ep0 maxpacket: 32 [ 188.006516][ T5125] usb 4-1: config 0 interface 0 has no altsetting 0 [ 188.006564][ T5125] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1c0d, bcdDevice= 0.00 [ 188.006589][ T5125] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 188.051373][ T5125] usb 4-1: config 0 descriptor?? [ 188.313290][ T6960] fuse: Bad value for 'user_id' [ 188.313313][ T6960] fuse: Bad value for 'user_id' [ 188.443634][ T5125] usbhid 4-1:0.0: can't add hid device: -71 [ 188.443764][ T5125] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 188.485136][ T5125] usb 4-1: USB disconnect, device number 5 [ 189.343412][ T5125] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 189.499773][ T5125] usb 3-1: Using ep0 maxpacket: 16 [ 189.510807][ T5125] usb 3-1: config 1 has an invalid interface number: 19 but max is 0 [ 189.510824][ T5125] usb 3-1: config 1 has no interface number 0 [ 189.510850][ T5125] usb 3-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 189.510865][ T5125] usb 3-1: config 1 interface 19 has no altsetting 0 [ 190.195114][ T5125] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 190.195144][ T5125] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.195163][ T5125] usb 3-1: Product: syz [ 190.195177][ T5125] usb 3-1: Manufacturer: syz [ 190.195191][ T5125] usb 3-1: SerialNumber: syz [ 190.392712][ T5125] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 190.573798][ T1479] usb 3-1: Failed to submit usb control message: -71 [ 190.573830][ T1479] usb 3-1: unable to send the bmi data to the device: -71 [ 190.573842][ T1479] usb 3-1: unable to get target info from device [ 190.573852][ T1479] usb 3-1: could not get target info (-71) [ 190.577066][ T1479] usb 3-1: could not probe fw (-71) [ 190.581111][ T5878] usb 3-1: USB disconnect, device number 8 [ 191.165022][ T36] audit: type=1804 audit(1771395102.473:2): pid=6987 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.1.327" name="/newroot/60/file0" dev="fuse" ino=1 res=1 errno=0 [ 191.335348][ T5125] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 191.520475][ T5125] usb 4-1: Using ep0 maxpacket: 16 [ 191.539489][ T5125] usb 4-1: config 0 has no interfaces? [ 191.576150][ T5125] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 191.576182][ T5125] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 191.576202][ T5125] usb 4-1: SerialNumber: syz [ 191.614759][ T5125] usb 4-1: config 0 descriptor?? [ 191.738581][ T7003] netlink: 56 bytes leftover after parsing attributes in process `syz.1.330'. [ 191.967099][ T6985] Driver unsupported XDP return value 0 on prog (id 23) dev N/A, expect packet loss! [ 191.978070][ T5878] usb 4-1: USB disconnect, device number 6 [ 192.861873][ T7016] fuse: Bad value for 'fd' [ 194.851644][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.851713][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.306972][ T7030] FAULT_INJECTION: forcing a failure. [ 195.306972][ T7030] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 195.307008][ T7030] CPU: 0 UID: 0 PID: 7030 Comm: syz.0.340 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 195.307041][ T7030] Tainted: [L]=SOFTLOCKUP [ 195.307047][ T7030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 195.307058][ T7030] Call Trace: [ 195.307065][ T7030] [ 195.307073][ T7030] dump_stack_lvl+0xe8/0x150 [ 195.307100][ T7030] should_fail_ex+0x46b/0x600 [ 195.307128][ T7030] _copy_from_user+0x2d/0xb0 [ 195.307151][ T7030] __sys_bpf+0x229/0x950 [ 195.307179][ T7030] ? __pfx___sys_bpf+0x10/0x10 [ 195.307199][ T7030] ? rt_mutex_slowunlock+0x1cb/0x300 [ 195.307235][ T7030] ? ksys_write+0x248/0x270 [ 195.307255][ T7030] ? __pfx_ksys_write+0x10/0x10 [ 195.307280][ T7030] __x64_sys_bpf+0x7c/0x90 [ 195.307303][ T7030] do_syscall_64+0x14d/0xf80 [ 195.307324][ T7030] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.307341][ T7030] ? trace_irq_disable+0x37/0x100 [ 195.307356][ T7030] ? clear_bhb_loop+0x40/0x90 [ 195.307377][ T7030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.307394][ T7030] RIP: 0033:0x7fafd5dbc629 [ 195.307410][ T7030] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 195.307425][ T7030] RSP: 002b:00007fafd400e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 195.307445][ T7030] RAX: ffffffffffffffda RBX: 00007fafd6035fa0 RCX: 00007fafd5dbc629 [ 195.307458][ T7030] RDX: 0000000000000050 RSI: 0000200000000300 RDI: 000000000000000a [ 195.307470][ T7030] RBP: 00007fafd400e090 R08: 0000000000000000 R09: 0000000000000000 [ 195.307481][ T7030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 195.307492][ T7030] R13: 00007fafd6036038 R14: 00007fafd6035fa0 R15: 00007ffe960c7dd8 [ 195.307521][ T7030] [ 195.361807][ T807] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 195.555960][ T807] usb 2-1: Using ep0 maxpacket: 16 [ 195.567648][ T807] usb 2-1: config 1 has an invalid interface number: 19 but max is 0 [ 195.567676][ T807] usb 2-1: config 1 has no interface number 0 [ 195.567722][ T807] usb 2-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 195.567749][ T807] usb 2-1: config 1 interface 19 has no altsetting 0 [ 195.592903][ T807] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 195.592934][ T807] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.592953][ T807] usb 2-1: Product: syz [ 195.592966][ T807] usb 2-1: Manufacturer: syz [ 195.592980][ T807] usb 2-1: SerialNumber: syz [ 195.662621][ T807] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 195.838014][ T807] usb 2-1: USB disconnect, device number 2 [ 195.839281][ T7039] netlink: 56 bytes leftover after parsing attributes in process `syz.0.342'. [ 195.840699][ T71] usb 2-1: Failed to submit usb control message: -71 [ 195.840730][ T71] usb 2-1: unable to send the bmi data to the device: -71 [ 195.840767][ T71] usb 2-1: unable to get target info from device [ 195.840781][ T71] usb 2-1: could not get target info (-71) [ 195.841013][ T71] usb 2-1: could not probe fw (-71) [ 196.573151][ T7049] FAULT_INJECTION: forcing a failure. [ 196.573151][ T7049] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 196.573186][ T7049] CPU: 1 UID: 0 PID: 7049 Comm: syz.1.345 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 196.573211][ T7049] Tainted: [L]=SOFTLOCKUP [ 196.573217][ T7049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 196.573227][ T7049] Call Trace: [ 196.573234][ T7049] [ 196.573242][ T7049] dump_stack_lvl+0xe8/0x150 [ 196.573271][ T7049] should_fail_ex+0x46b/0x600 [ 196.573297][ T7049] _copy_from_user+0x2d/0xb0 [ 196.573320][ T7049] io_submit_one+0xd3/0x14c0 [ 196.573341][ T7049] ? irqentry_exit+0x59e/0x620 [ 196.573363][ T7049] ? lockdep_hardirqs_on+0x7a/0x110 [ 196.573383][ T7049] ? irqentry_exit+0x59e/0x620 [ 196.573408][ T7049] ? __pfx_io_submit_one+0x10/0x10 [ 196.573426][ T7049] ? __might_fault+0xaf/0x130 [ 196.573456][ T7049] ? __might_fault+0xaf/0x130 [ 196.573478][ T7049] __se_sys_io_submit+0x195/0x340 [ 196.573504][ T7049] ? __pfx___se_sys_io_submit+0x10/0x10 [ 196.573525][ T7049] ? ksys_write+0x248/0x270 [ 196.573558][ T7049] do_syscall_64+0x14d/0xf80 [ 196.573578][ T7049] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.573595][ T7049] ? trace_irq_disable+0x37/0x100 [ 196.573610][ T7049] ? clear_bhb_loop+0x40/0x90 [ 196.573631][ T7049] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.573648][ T7049] RIP: 0033:0x7f4d2cd2c629 [ 196.573664][ T7049] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 196.573679][ T7049] RSP: 002b:00007f4d2af7e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 196.573699][ T7049] RAX: ffffffffffffffda RBX: 00007f4d2cfa5fa0 RCX: 00007f4d2cd2c629 [ 196.573711][ T7049] RDX: 00002000000000c0 RSI: 0000000000000001 RDI: 00007f4d2dae1000 [ 196.573723][ T7049] RBP: 00007f4d2af7e090 R08: 0000000000000000 R09: 0000000000000000 [ 196.573734][ T7049] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 196.573745][ T7049] R13: 00007f4d2cfa6038 R14: 00007f4d2cfa5fa0 R15: 00007ffeb48428a8 [ 196.573774][ T7049] [ 203.600314][ T7087] netlink: 28 bytes leftover after parsing attributes in process `syz.2.357'. [ 204.210253][ T42] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 204.374248][ T42] usb 5-1: Using ep0 maxpacket: 8 [ 204.376341][ T42] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 204.376368][ T42] usb 5-1: config 0 has no interface number 0 [ 204.379214][ T42] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 204.379239][ T42] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.379257][ T42] usb 5-1: Product: syz [ 204.379270][ T42] usb 5-1: Manufacturer: syz [ 204.379284][ T42] usb 5-1: SerialNumber: syz [ 204.459830][ T42] usb 5-1: config 0 descriptor?? [ 204.895193][ T42] uvcvideo 5-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 204.895282][ T42] uvcvideo 5-1:0.31: Entity type for entity Output 32774 was not initialized! [ 205.074453][ T42] usb 5-1: USB disconnect, device number 7 [ 206.540559][ T7108] Bluetooth: hci2: command 0x0406 tx timeout [ 206.540600][ T7108] Bluetooth: hci0: command 0x0406 tx timeout [ 206.540623][ T7108] Bluetooth: hci1: command 0x0406 tx timeout [ 206.540645][ T7108] Bluetooth: hci3: command 0x0406 tx timeout [ 206.540668][ T7108] Bluetooth: hci4: command 0x0406 tx timeout [ 208.008404][ T7098] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 208.588816][ T7127] fuse: Bad value for 'fd' [ 210.081021][ T7143] netlink: 172 bytes leftover after parsing attributes in process `syz.1.371'. [ 212.760335][ T5905] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 212.910273][ T5905] usb 5-1: Using ep0 maxpacket: 8 [ 212.912647][ T5905] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 212.912674][ T5905] usb 5-1: config 0 has no interface number 0 [ 212.919093][ T5905] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 212.919122][ T5905] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.919142][ T5905] usb 5-1: Product: syz [ 212.919156][ T5905] usb 5-1: Manufacturer: syz [ 212.919171][ T5905] usb 5-1: SerialNumber: syz [ 212.988194][ T5905] usb 5-1: config 0 descriptor?? [ 213.261434][ T5905] uvcvideo 5-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 213.261507][ T5905] uvcvideo 5-1:0.31: Entity type for entity Output 32774 was not initialized! [ 214.358263][ T5905] usb 5-1: USB disconnect, device number 8 [ 214.889626][ T7166] trusted_key: syz.4.378 sent an empty control message without MSG_MORE. [ 214.920038][ T5797] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 214.940041][ T5797] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 214.955649][ T5797] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 214.959205][ T5797] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 214.960049][ T5797] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 215.298098][ T7179] netlink: 56 bytes leftover after parsing attributes in process `syz.2.380'. [ 215.542414][ T7182] fuse: Bad value for 'fd' [ 217.206236][ T5797] Bluetooth: hci5: command tx timeout [ 217.230308][ T7169] chnl_net:caif_netlink_parms(): no params data found [ 217.711002][ T7169] bridge0: port 1(bridge_slave_0) entered blocking state [ 217.711123][ T7169] bridge0: port 1(bridge_slave_0) entered disabled state [ 217.711349][ T7169] bridge_slave_0: entered allmulticast mode [ 217.713854][ T7169] bridge_slave_0: entered promiscuous mode [ 217.716771][ T7169] bridge0: port 2(bridge_slave_1) entered blocking state [ 217.716887][ T7169] bridge0: port 2(bridge_slave_1) entered disabled state [ 217.717053][ T7169] bridge_slave_1: entered allmulticast mode [ 217.721057][ T5125] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 217.748319][ T7169] bridge_slave_1: entered promiscuous mode [ 217.830231][ T5905] usb 3-1: new low-speed USB device number 9 using dummy_hcd [ 217.918814][ T5125] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 217.918845][ T5125] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.952872][ T5125] usb 5-1: config 0 descriptor?? [ 217.989188][ T5905] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 217.989224][ T5905] usb 3-1: config 0 has no interface number 0 [ 217.989267][ T5905] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 217.989294][ T5905] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 217.989335][ T5905] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 217.989358][ T5905] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.036596][ T7169] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 218.064784][ T5905] usb 3-1: config 0 descriptor?? [ 218.064817][ T7169] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 218.067299][ T7196] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 218.167895][ T5905] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 218.236764][ T7169] team0: Port device team_slave_0 added [ 218.239829][ T7169] team0: Port device team_slave_1 added [ 218.410685][ T7169] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 218.410700][ T7169] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 218.410718][ T7169] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 218.420701][ T7169] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 218.420716][ T7169] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 218.420734][ T7169] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 218.542568][ T807] usb 3-1: USB disconnect, device number 9 [ 218.542691][ C1] iowarrior 3-1:0.1: iowarrior_callback - usb_submit_urb failed with result -19 [ 218.570306][ T5945] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 218.749132][ T5945] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 218.749151][ T5945] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 218.779457][ T5945] usb 1-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 218.779488][ T5945] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.779507][ T5945] usb 1-1: Product: syz [ 218.779521][ T5945] usb 1-1: Manufacturer: syz [ 218.779534][ T5945] usb 1-1: SerialNumber: syz [ 218.805803][ T5945] usb 1-1: config 0 descriptor?? [ 218.806879][ T7199] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 218.807051][ T7199] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 219.017547][ T7199] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 219.017640][ T7199] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 219.166763][ T7169] hsr_slave_0: entered promiscuous mode [ 219.184698][ T7169] hsr_slave_1: entered promiscuous mode [ 219.189105][ T7169] debugfs: 'hsr0' already exists in 'hsr' [ 219.189342][ T7169] Cannot create hsr debugfs directory [ 219.250479][ T5797] Bluetooth: hci5: command tx timeout [ 219.511391][ T7209] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.546435][ T7209] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.647955][ T5945] Error reading MAC address [ 219.698045][ T5945] usb 1-1: USB disconnect, device number 5 [ 221.886164][ T5797] Bluetooth: hci5: command tx timeout [ 222.175837][ T7220] netlink: 'syz.0.392': attribute type 1 has an invalid length. [ 222.315399][ T5945] usb 5-1: USB disconnect, device number 9 [ 223.890366][ T5805] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 223.970378][ T5797] Bluetooth: hci5: command tx timeout [ 224.050570][ T5805] usb 1-1: device descriptor read/64, error -71 [ 224.302309][ T7169] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 224.350538][ T5805] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 224.539163][ T7169] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 224.638694][ T5805] usb 1-1: device descriptor read/64, error -71 [ 224.760788][ T5805] usb usb1-port1: attempt power cycle [ 224.847940][ T7169] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 224.860364][ T5125] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 224.940500][ T7169] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 225.170482][ T5125] usb 2-1: Using ep0 maxpacket: 16 [ 225.172483][ T5125] usb 2-1: config 1 has an invalid interface number: 19 but max is 0 [ 225.172509][ T5125] usb 2-1: config 1 has no interface number 0 [ 225.172551][ T5125] usb 2-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 225.172578][ T5125] usb 2-1: config 1 interface 19 has no altsetting 0 [ 225.174742][ T5125] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 225.174769][ T5125] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.174789][ T5125] usb 2-1: Product: syz [ 225.174803][ T5125] usb 2-1: Manufacturer: syz [ 225.174817][ T5125] usb 2-1: SerialNumber: syz [ 225.308137][ T7253] 9p: Bad value for 'rfdno' [ 226.144091][ T5805] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 226.161502][ T5805] usb 1-1: device descriptor read/8, error -71 [ 226.281834][ T5125] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 226.404658][ T5805] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 226.429458][ T5805] usb 1-1: device descriptor read/8, error -71 [ 226.459491][ T1177] usb 2-1: Failed to submit usb control message: -71 [ 226.459528][ T1177] usb 2-1: unable to send the bmi data to the device: -71 [ 226.459599][ T1177] usb 2-1: unable to get target info from device [ 226.459613][ T1177] usb 2-1: could not get target info (-71) [ 226.459698][ T1177] usb 2-1: could not probe fw (-71) [ 226.493066][ T42] usb 2-1: USB disconnect, device number 3 [ 226.530662][ T5805] usb usb1-port1: unable to enumerate USB device [ 228.506775][ T71] bridge_slave_1: left allmulticast mode [ 228.506915][ T71] bridge_slave_1: left promiscuous mode [ 228.509479][ T71] bridge0: port 2(bridge_slave_1) entered disabled state [ 228.563396][ T42] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 228.648867][ T71] bridge_slave_0: left allmulticast mode [ 228.648886][ T71] bridge_slave_0: left promiscuous mode [ 228.698047][ T71] bridge0: port 1(bridge_slave_0) entered disabled state [ 228.795452][ T42] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 228.795484][ T42] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.820349][ T42] usb 1-1: config 0 descriptor?? [ 230.167538][ T5878] usb 1-1: USB disconnect, device number 10 [ 230.214417][ T5945] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 230.375621][ T5945] usb 2-1: Using ep0 maxpacket: 8 [ 230.379875][ T5945] usb 2-1: config 0 has an invalid interface number: 31 but max is 0 [ 230.379903][ T5945] usb 2-1: config 0 has no interface number 0 [ 230.385126][ T5945] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 230.385156][ T5945] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.385176][ T5945] usb 2-1: Product: syz [ 230.385189][ T5945] usb 2-1: Manufacturer: syz [ 230.385203][ T5945] usb 2-1: SerialNumber: syz [ 230.392542][ T5945] usb 2-1: config 0 descriptor?? [ 230.690667][ T7293] 9p: Bad value for 'rfdno' [ 231.418420][ T5945] uvcvideo 2-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 231.418493][ T5945] uvcvideo 2-1:0.31: Entity type for entity Output 32774 was not initialized! [ 231.437073][ T5945] usb 2-1: USB disconnect, device number 4 [ 233.415092][ T7305] netlink: 'syz.1.415': attribute type 1 has an invalid length. [ 233.415109][ T7305] netlink: 96 bytes leftover after parsing attributes in process `syz.1.415'. [ 233.415124][ T7305] netlink: 1 bytes leftover after parsing attributes in process `syz.1.415'. [ 233.415132][ T7305] netlink: 658 bytes leftover after parsing attributes in process `syz.1.415'. [ 233.860457][ T42] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 233.940459][ T7311] netlink: 424 bytes leftover after parsing attributes in process `syz.2.413'. [ 234.010280][ T42] usb 2-1: Using ep0 maxpacket: 16 [ 234.012286][ T42] usb 2-1: config 1 has an invalid interface number: 19 but max is 0 [ 234.012308][ T42] usb 2-1: config 1 has no interface number 0 [ 234.012345][ T42] usb 2-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 234.012370][ T42] usb 2-1: config 1 interface 19 has no altsetting 0 [ 234.014646][ T42] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 234.014669][ T42] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.014686][ T42] usb 2-1: Product: syz [ 234.014699][ T42] usb 2-1: Manufacturer: syz [ 234.014711][ T42] usb 2-1: SerialNumber: syz [ 234.164202][ T42] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 234.381175][ T71] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 234.462051][ T71] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 234.508084][ T71] bond0 (unregistering): Released all slaves [ 234.730497][ T13] usb 2-1: Failed to submit usb control message: -71 [ 234.730532][ T13] usb 2-1: unable to send the bmi data to the device: -71 [ 234.730549][ T13] usb 2-1: unable to get target info from device [ 234.730563][ T13] usb 2-1: could not get target info (-71) [ 234.730649][ T13] usb 2-1: could not probe fw (-71) [ 234.731992][ T42] usb 2-1: USB disconnect, device number 5 [ 238.178753][ T7169] 8021q: adding VLAN 0 to HW filter on device bond0 [ 238.210267][ T31] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 238.334666][ T7169] 8021q: adding VLAN 0 to HW filter on device team0 [ 238.353758][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 238.354035][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 238.387330][ T31] usb 5-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 238.387360][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.391607][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 238.391735][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 238.410226][ T5125] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 238.440586][ T31] usb 5-1: config 0 descriptor?? [ 238.461177][ T31] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 238.567770][ T5125] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 238.567870][ T5125] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.676195][ T5125] usb 3-1: config 0 descriptor?? [ 238.845808][ T31] cpia1 5-1:0.0: unexpected state after lo power cmd: 00 [ 238.939154][ T7346] netlink: 48 bytes leftover after parsing attributes in process `syz.0.425'. [ 239.160718][ T71] hsr_slave_0: left promiscuous mode [ 239.204197][ T71] hsr_slave_1: left promiscuous mode [ 239.205732][ T71] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 239.247026][ T31] gspca_cpia1: usb_control_msg 02, error -32 [ 239.247404][ T31] gspca_cpia1: usb_control_msg 02, error -71 [ 239.247771][ T31] gspca_cpia1: usb_control_msg 05, error -71 [ 239.247790][ T31] cpia1 5-1:0.0: unexpected systemstate: 00 [ 239.288158][ T71] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 239.289600][ T31] usb 5-1: USB disconnect, device number 10 [ 239.360224][ T5125] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 239.520178][ T5125] usb 1-1: Using ep0 maxpacket: 32 [ 239.557089][ T5125] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 239.557118][ T5125] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.557137][ T5125] usb 1-1: Product: syz [ 239.557150][ T5125] usb 1-1: Manufacturer: syz [ 239.557164][ T5125] usb 1-1: SerialNumber: syz [ 239.582277][ T5125] usb 1-1: config 0 descriptor?? [ 239.790012][ T7351] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 239.889263][ T5125] RobotFuzz Open Source InterFace, OSIF 1-1:0.0: version d4.15 found at bus 001 address 011 [ 240.494234][ T7372] netlink: 44 bytes leftover after parsing attributes in process `syz.0.426'. [ 241.142063][ T5945] usb 3-1: USB disconnect, device number 10 [ 241.229678][ T7376] 9pnet_fd: Insufficient options for proto=fd [ 242.284945][ T7351] i2c i2c-1: failure reading status [ 242.431972][ T71] team0 (unregistering): Port device team_slave_1 removed [ 243.582548][ T71] team0 (unregistering): Port device team_slave_0 removed [ 244.680776][ T7392] netlink: 112 bytes leftover after parsing attributes in process `syz.2.434'. [ 244.680795][ T7392] netlink: 8 bytes leftover after parsing attributes in process `syz.2.434'. [ 246.097179][ T7367] syzkaller0: entered promiscuous mode [ 246.097206][ T7367] syzkaller0: entered allmulticast mode [ 246.179564][ T7402] netlink: 'syz.1.435': attribute type 1 has an invalid length. [ 246.208794][ T6119] usb 1-1: USB disconnect, device number 11 [ 246.328106][ T7406] netlink: 'syz.0.437': attribute type 27 has an invalid length. [ 246.343060][ T7404] netlink: 'syz.1.436': attribute type 5 has an invalid length. [ 246.380310][ T7407] FAULT_INJECTION: forcing a failure. [ 246.380310][ T7407] name failslab, interval 1, probability 0, space 0, times 0 [ 246.380345][ T7407] CPU: 1 UID: 0 PID: 7407 Comm: syz.0.437 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 246.380367][ T7407] Tainted: [L]=SOFTLOCKUP [ 246.380372][ T7407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 246.380389][ T7407] Call Trace: [ 246.380395][ T7407] [ 246.380402][ T7407] dump_stack_lvl+0xe8/0x150 [ 246.380428][ T7407] should_fail_ex+0x46b/0x600 [ 246.380449][ T7407] should_failslab+0xa8/0x100 [ 246.380467][ T7407] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 246.380483][ T7407] ? __pfx_tcp_current_mss+0x10/0x10 [ 246.380498][ T7407] ? __alloc_skb+0x1d7/0x390 [ 246.380522][ T7407] __alloc_skb+0x1d7/0x390 [ 246.380544][ T7407] tcp_stream_alloc_skb+0x3d/0x350 [ 246.380566][ T7407] tcp_sendmsg_locked+0x1af7/0x55b0 [ 246.380624][ T7407] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 246.380650][ T7407] ? __local_bh_enable_ip+0x1ae/0x2b0 [ 246.380667][ T7407] ? lockdep_hardirqs_on+0x7a/0x110 [ 246.380688][ T7407] tcp_sendmsg+0x2f/0x50 [ 246.380707][ T7407] __sys_sendto+0x643/0x7d0 [ 246.380731][ T7407] ? __pfx___sys_sendto+0x10/0x10 [ 246.380770][ T7407] ? ksys_write+0x248/0x270 [ 246.380786][ T7407] ? __pfx_ksys_write+0x10/0x10 [ 246.380804][ T7407] __x64_sys_sendto+0xde/0x100 [ 246.380825][ T7407] do_syscall_64+0x14d/0xf80 [ 246.380843][ T7407] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 246.380856][ T7407] ? trace_irq_disable+0x37/0x100 [ 246.380868][ T7407] ? clear_bhb_loop+0x40/0x90 [ 246.380886][ T7407] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 246.380899][ T7407] RIP: 0033:0x7fafd5dbc629 [ 246.380917][ T7407] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 246.380931][ T7407] RSP: 002b:00007fafd3fed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 246.380947][ T7407] RAX: ffffffffffffffda RBX: 00007fafd6036090 RCX: 00007fafd5dbc629 [ 246.380958][ T7407] RDX: 000000000000006d RSI: 0000200000000f00 RDI: 0000000000000003 [ 246.380967][ T7407] RBP: 00007fafd3fed090 R08: 0000000000000000 R09: 0000000000000000 [ 246.380977][ T7407] R10: 000000000004c840 R11: 0000000000000246 R12: 0000000000000001 [ 246.380986][ T7407] R13: 00007fafd6036128 R14: 00007fafd6036090 R15: 00007ffe960c7dd8 [ 246.381011][ T7407] [ 246.659173][ T807] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 246.836717][ T807] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 246.836765][ T807] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 246.837998][ T807] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 246.838025][ T807] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 246.838045][ T807] usb 2-1: SerialNumber: syz [ 246.913169][ T7417] netlink: 8 bytes leftover after parsing attributes in process `syz.2.438'. [ 246.943945][ T7416] FAULT_INJECTION: forcing a failure. [ 246.943945][ T7416] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 246.943980][ T7416] CPU: 1 UID: 0 PID: 7416 Comm: syz.4.439 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 246.944005][ T7416] Tainted: [L]=SOFTLOCKUP [ 246.944012][ T7416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 246.944023][ T7416] Call Trace: [ 246.944030][ T7416] [ 246.944038][ T7416] dump_stack_lvl+0xe8/0x150 [ 246.944068][ T7416] should_fail_ex+0x46b/0x600 [ 246.944095][ T7416] _copy_to_user+0x31/0xb0 [ 246.944130][ T7416] simple_read_from_buffer+0xe1/0x170 [ 246.944158][ T7416] proc_fail_nth_read+0x1be/0x230 [ 246.944181][ T7416] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 246.944202][ T7416] ? rw_verify_area+0x2ac/0x4e0 [ 246.944226][ T7416] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 246.944246][ T7416] vfs_read+0x212/0xa70 [ 246.944272][ T7416] ? __pfx_vfs_read+0x10/0x10 [ 246.944292][ T7416] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 246.944315][ T7416] ? lockdep_hardirqs_on+0x7a/0x110 [ 246.944336][ T7416] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 246.944357][ T7416] ? mutex_lock_nested+0x152/0x1d0 [ 246.944373][ T7416] ? fdget_pos+0x252/0x320 [ 246.944403][ T7416] ksys_read+0x156/0x270 [ 246.944423][ T7416] ? __pfx_ksys_read+0x10/0x10 [ 246.944451][ T7416] do_syscall_64+0x14d/0xf80 [ 246.944471][ T7416] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 246.944486][ T7416] ? trace_irq_disable+0x37/0x100 [ 246.944500][ T7416] ? clear_bhb_loop+0x40/0x90 [ 246.944519][ T7416] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 246.944536][ T7416] RIP: 0033:0x7f2bfa22cece [ 246.944552][ T7416] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 246.944568][ T7416] RSP: 002b:00007f2bf849cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 246.944587][ T7416] RAX: ffffffffffffffda RBX: 00007f2bf849d6c0 RCX: 00007f2bfa22cece [ 246.944601][ T7416] RDX: 000000000000000f RSI: 00007f2bf849d0a0 RDI: 0000000000000004 [ 246.944612][ T7416] RBP: 00007f2bf849d090 R08: 0000000000000000 R09: 0000000000000000 [ 246.944623][ T7416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 246.944633][ T7416] R13: 00007f2bfa4e6128 R14: 00007f2bfa4e6090 R15: 00007ffc45541488 [ 246.944660][ T7416] [ 247.311522][ T7406] bridge0: port 2(bridge_slave_1) entered disabled state [ 247.316595][ T7406] bridge0: port 1(bridge_slave_0) entered disabled state [ 247.564450][ T7426] netlink: 64 bytes leftover after parsing attributes in process `syz.4.442'. [ 247.677923][ T7428] fuse: Invalid rootmode [ 247.982724][ T7406] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 248.012463][ T7406] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 248.426206][ T7430] netlink: 9 bytes leftover after parsing attributes in process `syz.4.444'. [ 248.460682][ T7430] netlink: 9 bytes leftover after parsing attributes in process `syz.4.444'. [ 251.860463][ T7415] batadv_slave_0: entered promiscuous mode [ 251.877213][ T1461] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 251.903689][ T7440] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 251.984908][ T807] usb 2-1: 0:2 : does not exist [ 251.985014][ T807] usb 2-1: unit 5 not found! [ 252.049332][ T7444] netlink: 'syz.4.447': attribute type 1 has an invalid length. [ 252.077438][ T7415] batadv_slave_0: left promiscuous mode [ 252.106018][ T1461] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 252.114017][ T7442] program syz.0.446 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 252.139220][ T1461] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 252.149325][ T1461] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 252.179005][ T7446] FAULT_INJECTION: forcing a failure. [ 252.179005][ T7446] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 252.179040][ T7446] CPU: 0 UID: 0 PID: 7446 Comm: syz.4.448 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 252.179065][ T7446] Tainted: [L]=SOFTLOCKUP [ 252.179071][ T7446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 252.179080][ T7446] Call Trace: [ 252.179088][ T7446] [ 252.179095][ T7446] dump_stack_lvl+0xe8/0x150 [ 252.179129][ T7446] should_fail_ex+0x46b/0x600 [ 252.179155][ T7446] _copy_from_user+0x2d/0xb0 [ 252.179178][ T7446] __sys_bpf+0x229/0x950 [ 252.179207][ T7446] ? __pfx___sys_bpf+0x10/0x10 [ 252.179228][ T7446] ? rt_mutex_slowunlock+0x1cb/0x300 [ 252.179262][ T7446] ? ksys_write+0x248/0x270 [ 252.179283][ T7446] ? __pfx_ksys_write+0x10/0x10 [ 252.179307][ T7446] __x64_sys_bpf+0x7c/0x90 [ 252.179330][ T7446] do_syscall_64+0x14d/0xf80 [ 252.179351][ T7446] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.179369][ T7446] ? trace_irq_disable+0x37/0x100 [ 252.179384][ T7446] ? clear_bhb_loop+0x40/0x90 [ 252.179405][ T7446] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.179421][ T7446] RIP: 0033:0x7f2bfa26c629 [ 252.179437][ T7446] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 252.179452][ T7446] RSP: 002b:00007f2bf84be028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 252.179472][ T7446] RAX: ffffffffffffffda RBX: 00007f2bfa4e5fa0 RCX: 00007f2bfa26c629 [ 252.179485][ T7446] RDX: 0000000000000094 RSI: 0000200000000540 RDI: 0000000000000005 [ 252.179497][ T7446] RBP: 00007f2bf84be090 R08: 0000000000000000 R09: 0000000000000000 [ 252.179508][ T7446] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 252.179526][ T7446] R13: 00007f2bfa4e6038 R14: 00007f2bfa4e5fa0 R15: 00007ffc45541488 [ 252.179556][ T7446] [ 252.300545][ T807] usb 2-1: USB disconnect, device number 6 [ 252.513097][ T7169] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 252.515107][ T7453] FAULT_INJECTION: forcing a failure. [ 252.515107][ T7453] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 252.515140][ T7453] CPU: 1 UID: 0 PID: 7453 Comm: syz.4.451 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 252.515166][ T7453] Tainted: [L]=SOFTLOCKUP [ 252.515172][ T7453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 252.515182][ T7453] Call Trace: [ 252.515190][ T7453] [ 252.515198][ T7453] dump_stack_lvl+0xe8/0x150 [ 252.515226][ T7453] should_fail_ex+0x46b/0x600 [ 252.515252][ T7453] _copy_from_user+0x2d/0xb0 [ 252.515276][ T7453] ___sys_sendmsg+0x1c6/0x360 [ 252.515294][ T7453] ? __lock_acquire+0x6b5/0x2cf0 [ 252.515320][ T7453] ? __pfx____sys_sendmsg+0x10/0x10 [ 252.515371][ T7453] ? __fget_files+0x2a/0x420 [ 252.515393][ T7453] ? __fget_files+0x3a6/0x420 [ 252.515424][ T7453] __x64_sys_sendmsg+0x1c3/0x2a0 [ 252.515445][ T7453] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 252.515472][ T7453] ? __pfx_ksys_write+0x10/0x10 [ 252.515509][ T7453] do_syscall_64+0x14d/0xf80 [ 252.515531][ T7453] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.515548][ T7453] ? trace_irq_disable+0x37/0x100 [ 252.515563][ T7453] ? clear_bhb_loop+0x40/0x90 [ 252.515584][ T7453] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.515602][ T7453] RIP: 0033:0x7f2bfa26c629 [ 252.515618][ T7453] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 252.515635][ T7453] RSP: 002b:00007f2bf849d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 252.515655][ T7453] RAX: ffffffffffffffda RBX: 00007f2bfa4e6090 RCX: 00007f2bfa26c629 [ 252.515669][ T7453] RDX: 0000000000000000 RSI: 0000200000007940 RDI: 0000000000000003 [ 252.515681][ T7453] RBP: 00007f2bf849d090 R08: 0000000000000000 R09: 0000000000000000 [ 252.515692][ T7453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 252.515704][ T7453] R13: 00007f2bfa4e6128 R14: 00007f2bfa4e6090 R15: 00007ffc45541488 [ 252.515733][ T7453] [ 252.616002][ T5809] udevd[5809]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 252.897512][ T7460] loop2: detected capacity change from 0 to 7 [ 253.094802][ T5809] loop2: [ 253.094839][ T5809] loop2: partition table partially beyond EOD, truncated [ 253.270409][ T7460] loop2: [ 253.270440][ T7460] loop2: partition table partially beyond EOD, truncated [ 253.600476][ T807] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 253.606468][ T7485] IPVS: Error connecting to the multicast addr [ 253.944349][ T7492] netlink: 'syz.0.457': attribute type 1 has an invalid length. [ 254.141325][ T7169] veth0_vlan: entered promiscuous mode [ 255.013947][ T7169] veth1_vlan: entered promiscuous mode [ 255.210541][ T7169] veth0_macvtap: entered promiscuous mode [ 255.261665][ T7169] veth1_macvtap: entered promiscuous mode [ 255.378223][ T7502] FAULT_INJECTION: forcing a failure. [ 255.378223][ T7502] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 255.378272][ T7502] CPU: 1 UID: 0 PID: 7502 Comm: syz.1.459 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 255.378298][ T7502] Tainted: [L]=SOFTLOCKUP [ 255.378304][ T7502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 255.378313][ T7502] Call Trace: [ 255.378320][ T7502] [ 255.378328][ T7502] dump_stack_lvl+0xe8/0x150 [ 255.378357][ T7502] should_fail_ex+0x46b/0x600 [ 255.378382][ T7502] _copy_from_user+0x2d/0xb0 [ 255.378406][ T7502] do_sock_getsockopt+0x165/0x3f0 [ 255.378427][ T7502] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 255.378446][ T7502] ? __fget_files+0x3a6/0x420 [ 255.378467][ T7502] ? __fget_files+0x2a/0x420 [ 255.378494][ T7502] __x64_sys_getsockopt+0x1aa/0x250 [ 255.378519][ T7502] do_syscall_64+0x14d/0xf80 [ 255.378544][ T7502] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.378560][ T7502] ? trace_irq_disable+0x37/0x100 [ 255.378575][ T7502] ? clear_bhb_loop+0x40/0x90 [ 255.378595][ T7502] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.378611][ T7502] RIP: 0033:0x7f4d2cd2c629 [ 255.378627][ T7502] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 255.378640][ T7502] RSP: 002b:00007f4d2af7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 255.378659][ T7502] RAX: ffffffffffffffda RBX: 00007f4d2cfa5fa0 RCX: 00007f4d2cd2c629 [ 255.378672][ T7502] RDX: 0000000000000007 RSI: 000000000000010c RDI: 0000000000000004 [ 255.378684][ T7502] RBP: 00007f4d2af7e090 R08: 0000200000000000 R09: 0000000000000000 [ 255.378695][ T7502] R10: 0000200000001b00 R11: 0000000000000246 R12: 0000000000000001 [ 255.378707][ T7502] R13: 00007f4d2cfa6038 R14: 00007f4d2cfa5fa0 R15: 00007ffeb48428a8 [ 255.378735][ T7502] [ 255.397734][ T7169] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 255.610530][ T7169] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 255.649494][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.649594][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.706385][ T71] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.725405][ T71] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.727720][ T57] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.728386][ T57] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.816992][ T7509] FAULT_INJECTION: forcing a failure. [ 255.816992][ T7509] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 255.817024][ T7509] CPU: 1 UID: 0 PID: 7509 Comm: syz.0.462 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 255.817050][ T7509] Tainted: [L]=SOFTLOCKUP [ 255.817056][ T7509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 255.817066][ T7509] Call Trace: [ 255.817074][ T7509] [ 255.817082][ T7509] dump_stack_lvl+0xe8/0x150 [ 255.817111][ T7509] should_fail_ex+0x46b/0x600 [ 255.817132][ T7509] _copy_to_user+0x31/0xb0 [ 255.817148][ T7509] simple_read_from_buffer+0xe1/0x170 [ 255.817165][ T7509] proc_fail_nth_read+0x1be/0x230 [ 255.817185][ T7509] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 255.817214][ T7509] ? rw_verify_area+0x2ac/0x4e0 [ 255.817239][ T7509] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 255.817259][ T7509] vfs_read+0x212/0xa70 [ 255.817284][ T7509] ? __pfx_vfs_read+0x10/0x10 [ 255.817296][ T7509] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 255.817310][ T7509] ? lockdep_hardirqs_on+0x7a/0x110 [ 255.817323][ T7509] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 255.817343][ T7509] ? mutex_lock_nested+0x152/0x1d0 [ 255.817359][ T7509] ? fdget_pos+0x252/0x320 [ 255.817390][ T7509] ksys_read+0x156/0x270 [ 255.817410][ T7509] ? __pfx_ksys_read+0x10/0x10 [ 255.817440][ T7509] do_syscall_64+0x14d/0xf80 [ 255.817458][ T7509] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.817468][ T7509] ? trace_irq_disable+0x37/0x100 [ 255.817476][ T7509] ? clear_bhb_loop+0x40/0x90 [ 255.817489][ T7509] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.817498][ T7509] RIP: 0033:0x7fafd5d7cece [ 255.817514][ T7509] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 255.817530][ T7509] RSP: 002b:00007fafd400dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 255.817550][ T7509] RAX: ffffffffffffffda RBX: 00007fafd400e6c0 RCX: 00007fafd5d7cece [ 255.817563][ T7509] RDX: 000000000000000f RSI: 00007fafd400e0a0 RDI: 0000000000000003 [ 255.817576][ T7509] RBP: 00007fafd400e090 R08: 0000000000000000 R09: 0000000000000000 [ 255.817587][ T7509] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 255.817598][ T7509] R13: 00007fafd6036038 R14: 00007fafd6035fa0 R15: 00007ffe960c7dd8 [ 255.817622][ T7509] [ 255.861190][ T7507] program syz.1.461 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 257.892291][ T807] usb 5-1: unable to get BOS descriptor or descriptor too short [ 257.893332][ T807] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 257.893367][ T807] usb 5-1: can't read configurations, error -71 [ 258.196100][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 258.196121][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 258.230938][ T7520] FAULT_INJECTION: forcing a failure. [ 258.230938][ T7520] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 258.230976][ T7520] CPU: 1 UID: 0 PID: 7520 Comm: syz.1.466 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 258.231001][ T7520] Tainted: [L]=SOFTLOCKUP [ 258.231007][ T7520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 258.231015][ T7520] Call Trace: [ 258.231021][ T7520] [ 258.231028][ T7520] dump_stack_lvl+0xe8/0x150 [ 258.231052][ T7520] should_fail_ex+0x46b/0x600 [ 258.231082][ T7520] _copy_from_user+0x2d/0xb0 [ 258.231101][ T7520] nfc_llcp_setsockopt+0x36d/0x670 [ 258.231124][ T7520] ? __pfx_nfc_llcp_setsockopt+0x10/0x10 [ 258.231145][ T7520] ? __fget_files+0x2a/0x420 [ 258.231163][ T7520] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 258.231178][ T7520] ? __pfx_nfc_llcp_setsockopt+0x10/0x10 [ 258.231198][ T7520] do_sock_setsockopt+0x17c/0x1b0 [ 258.231222][ T7520] __x64_sys_setsockopt+0x143/0x1b0 [ 258.231246][ T7520] do_syscall_64+0x14d/0xf80 [ 258.231263][ T7520] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.231277][ T7520] ? trace_irq_disable+0x37/0x100 [ 258.231290][ T7520] ? clear_bhb_loop+0x40/0x90 [ 258.231307][ T7520] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.231322][ T7520] RIP: 0033:0x7f4d2cd2c629 [ 258.231336][ T7520] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 258.231349][ T7520] RSP: 002b:00007f4d2af7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 258.231365][ T7520] RAX: ffffffffffffffda RBX: 00007f4d2cfa5fa0 RCX: 00007f4d2cd2c629 [ 258.231376][ T7520] RDX: 0000000000000000 RSI: 0000000000000118 RDI: 0000000000000004 [ 258.231385][ T7520] RBP: 00007f4d2af7e090 R08: 0000000000000004 R09: 0000000000000000 [ 258.231394][ T7520] R10: 0000200000000a40 R11: 0000000000000246 R12: 0000000000000001 [ 258.231403][ T7520] R13: 00007f4d2cfa6038 R14: 00007f4d2cfa5fa0 R15: 00007ffeb48428a8 [ 258.231427][ T7520] [ 258.560840][ T7525] netlink: 'syz.4.467': attribute type 1 has an invalid length. [ 258.660483][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 258.660503][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 258.682326][ T7522] netlink: 128 bytes leftover after parsing attributes in process `syz.1.468'. [ 259.100315][ T807] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 259.252749][ T807] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 259.252780][ T807] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 259.282937][ T807] usb 5-1: config 0 descriptor?? [ 259.340243][ T5878] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 259.475207][ T7545] FAULT_INJECTION: forcing a failure. [ 259.475207][ T7545] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 259.475242][ T7545] CPU: 1 UID: 0 PID: 7545 Comm: syz.2.472 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 259.475279][ T7545] Tainted: [L]=SOFTLOCKUP [ 259.475289][ T7545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 259.475298][ T7545] Call Trace: [ 259.475304][ T7545] [ 259.475311][ T7545] dump_stack_lvl+0xe8/0x150 [ 259.475336][ T7545] should_fail_ex+0x46b/0x600 [ 259.475358][ T7545] _copy_from_user+0x2d/0xb0 [ 259.475378][ T7545] ___sys_sendmsg+0x1c6/0x360 [ 259.475392][ T7545] ? __lock_acquire+0x6b5/0x2cf0 [ 259.475413][ T7545] ? __pfx____sys_sendmsg+0x10/0x10 [ 259.475450][ T7545] ? __fget_files+0x2a/0x420 [ 259.475468][ T7545] ? __fget_files+0x3a6/0x420 [ 259.475492][ T7545] __x64_sys_sendmsg+0x1c3/0x2a0 [ 259.475507][ T7545] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 259.475527][ T7545] ? __pfx_ksys_write+0x10/0x10 [ 259.475550][ T7545] do_syscall_64+0x14d/0xf80 [ 259.475567][ T7545] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 259.475581][ T7545] ? trace_irq_disable+0x37/0x100 [ 259.475594][ T7545] ? clear_bhb_loop+0x40/0x90 [ 259.475611][ T7545] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 259.475626][ T7545] RIP: 0033:0x7fe04286c629 [ 259.475641][ T7545] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 259.475653][ T7545] RSP: 002b:00007fe040ac6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 259.475671][ T7545] RAX: ffffffffffffffda RBX: 00007fe042ae5fa0 RCX: 00007fe04286c629 [ 259.475683][ T7545] RDX: 0000000000000040 RSI: 0000200000000680 RDI: 0000000000000004 [ 259.475693][ T7545] RBP: 00007fe040ac6090 R08: 0000000000000000 R09: 0000000000000000 [ 259.475703][ T7545] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 259.475713][ T7545] R13: 00007fe042ae6038 R14: 00007fe042ae5fa0 R15: 00007fffc2b2cb28 [ 259.475756][ T7545] [ 259.548080][ T5878] usb 6-1: unable to get BOS descriptor or descriptor too short [ 259.548659][ T5878] usb 6-1: not running at top speed; connect to a high speed hub [ 259.549836][ T5878] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 147, changing to 4 [ 259.640289][ T5878] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 259.640323][ T5878] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 259.640343][ T5878] usb 6-1: Product: syz [ 259.640357][ T5878] usb 6-1: Manufacturer: syz [ 259.640371][ T5878] usb 6-1: SerialNumber: syz [ 259.643820][ T807] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 259.656849][ T807] [drm:udl_init] *ERROR* Selecting channel failed [ 261.162569][ T807] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 2 [ 261.162587][ T807] [drm] Initialized udl on minor 2 [ 261.269226][ T807] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 261.325238][ T807] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 261.399174][ T5878] usb 6-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 261.420052][ T5945] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 261.431205][ T5945] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 261.516035][ T807] usb 5-1: USB disconnect, device number 13 [ 261.784982][ T5878] usb 6-1: USB disconnect, device number 2 [ 261.871659][ T7567] netlink: 'syz.4.478': attribute type 1 has an invalid length. [ 261.897943][ T5809] udevd[5809]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 262.263535][ T7581] FAULT_INJECTION: forcing a failure. [ 262.263535][ T7581] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 262.263571][ T7581] CPU: 0 UID: 0 PID: 7581 Comm: syz.2.482 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 262.263597][ T7581] Tainted: [L]=SOFTLOCKUP [ 262.263603][ T7581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 262.263615][ T7581] Call Trace: [ 262.263622][ T7581] [ 262.263630][ T7581] dump_stack_lvl+0xe8/0x150 [ 262.263658][ T7581] should_fail_ex+0x46b/0x600 [ 262.263685][ T7581] _copy_from_user+0x2d/0xb0 [ 262.263709][ T7581] ___sys_recvmsg+0x175/0x590 [ 262.263737][ T7581] ? __pfx____sys_recvmsg+0x10/0x10 [ 262.263761][ T7581] ? __fget_files+0x2a/0x420 [ 262.263800][ T7581] ? __fget_files+0x3a6/0x420 [ 262.263831][ T7581] do_recvmmsg+0x33a/0x800 [ 262.263858][ T7581] ? __pfx_do_recvmmsg+0x10/0x10 [ 262.263889][ T7581] ? rt_mutex_slowunlock+0x1cb/0x300 [ 262.263938][ T7581] __x64_sys_recvmmsg+0x198/0x250 [ 262.263960][ T7581] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 262.263991][ T7581] do_syscall_64+0x14d/0xf80 [ 262.264013][ T7581] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.264030][ T7581] ? trace_irq_disable+0x37/0x100 [ 262.264046][ T7581] ? clear_bhb_loop+0x40/0x90 [ 262.264066][ T7581] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.264083][ T7581] RIP: 0033:0x7fe04286c629 [ 262.264100][ T7581] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 262.264116][ T7581] RSP: 002b:00007fe040ac6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 262.264137][ T7581] RAX: ffffffffffffffda RBX: 00007fe042ae5fa0 RCX: 00007fe04286c629 [ 262.264150][ T7581] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 262.264162][ T7581] RBP: 00007fe040ac6090 R08: 0000000000000000 R09: 0000000000000000 [ 262.264175][ T7581] R10: 0000000040000020 R11: 0000000000000246 R12: 0000000000000001 [ 262.264187][ T7581] R13: 00007fe042ae6038 R14: 00007fe042ae5fa0 R15: 00007fffc2b2cb28 [ 262.264217][ T7581] [ 263.278286][ T7591] netlink: 24 bytes leftover after parsing attributes in process `syz.2.485'. [ 263.278368][ T7591] nbd: must specify a size in bytes for the device [ 264.625955][ T7606] netlink: 'syz.1.490': attribute type 1 has an invalid length. [ 264.910539][ T5125] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 264.976137][ T7618] netlink: 'syz.4.491': attribute type 3 has an invalid length. [ 264.976159][ T7618] netlink: 244 bytes leftover after parsing attributes in process `syz.4.491'. [ 267.518705][ T7632] FAULT_INJECTION: forcing a failure. [ 267.518705][ T7632] name failslab, interval 1, probability 0, space 0, times 0 [ 267.518745][ T7632] CPU: 1 UID: 0 PID: 7632 Comm: syz.1.497 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 267.518775][ T7632] Tainted: [L]=SOFTLOCKUP [ 267.518790][ T7632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 267.518801][ T7632] Call Trace: [ 267.518809][ T7632] [ 267.518817][ T7632] dump_stack_lvl+0xe8/0x150 [ 267.518846][ T7632] should_fail_ex+0x46b/0x600 [ 267.518873][ T7632] should_failslab+0xa8/0x100 [ 267.518896][ T7632] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 267.518915][ T7632] ? __alloc_skb+0x1d7/0x390 [ 267.518937][ T7632] ? lockdep_hardirqs_on+0x7a/0x110 [ 267.518960][ T7632] ? __alloc_skb+0x193/0x390 [ 267.518983][ T7632] __alloc_skb+0x1d7/0x390 [ 267.519009][ T7632] alloc_skb_with_frags+0xca/0x890 [ 267.519033][ T7632] ? is_bpf_text_address+0x26/0x2b0 [ 267.519065][ T7632] sock_alloc_send_pskb+0x884/0x9a0 [ 267.519103][ T7632] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 267.519123][ T7632] ? __pfx_smack_socket_sendmsg+0x10/0x10 [ 267.519141][ T7632] ? __lock_acquire+0x6b5/0x2cf0 [ 267.519168][ T7632] ? _parse_integer_limit+0x1ae/0x1f0 [ 267.519193][ T7632] hci_sock_sendmsg+0x208/0xf40 [ 267.519221][ T7632] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 267.519247][ T7632] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 267.519270][ T7632] sock_write_iter+0x509/0x550 [ 267.519293][ T7632] ? __pfx_sock_write_iter+0x10/0x10 [ 267.519334][ T7632] vfs_write+0x629/0xba0 [ 267.519361][ T7632] ? __pfx_vfs_write+0x10/0x10 [ 267.519388][ T7632] ? __fget_files+0x2a/0x420 [ 267.519419][ T7632] ksys_write+0x156/0x270 [ 267.519439][ T7632] ? __pfx_ksys_write+0x10/0x10 [ 267.519467][ T7632] do_syscall_64+0x14d/0xf80 [ 267.519488][ T7632] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.519506][ T7632] ? clear_bhb_loop+0x40/0x90 [ 267.519534][ T7632] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.519552][ T7632] RIP: 0033:0x7f4d2cd2c629 [ 267.519568][ T7632] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 267.519584][ T7632] RSP: 002b:00007f4d2af7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 267.519605][ T7632] RAX: ffffffffffffffda RBX: 00007f4d2cfa5fa0 RCX: 00007f4d2cd2c629 [ 267.519619][ T7632] RDX: 0000000000000007 RSI: 0000200000000000 RDI: 0000000000000004 [ 267.519631][ T7632] RBP: 00007f4d2af7e090 R08: 0000000000000000 R09: 0000000000000000 [ 267.519643][ T7632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 267.519654][ T7632] R13: 00007f4d2cfa6038 R14: 00007f4d2cfa5fa0 R15: 00007ffeb48428a8 [ 267.519684][ T7632] [ 267.612390][ T6119] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 267.766049][ T6119] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 267.766081][ T6119] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.826582][ T6119] usb 5-1: config 0 descriptor?? [ 268.093520][ T6119] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 268.097553][ T6119] [drm:udl_init] *ERROR* Selecting channel failed [ 268.118041][ T5125] usb 1-1: unable to get BOS descriptor or descriptor too short [ 268.119643][ T5125] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 268.119680][ T5125] usb 1-1: can't read configurations, error -71 [ 268.204825][ T6119] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 2 [ 268.204841][ T6119] [drm] Initialized udl on minor 2 [ 268.230328][ T6119] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 268.230861][ T6119] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 268.272962][ T6119] usb 5-1: USB disconnect, device number 14 [ 268.275974][ T31] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 268.342916][ T31] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 270.030249][ T5125] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 270.192303][ T5125] usb 1-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 270.192335][ T5125] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.197297][ T5125] usb 1-1: config 0 descriptor?? [ 270.214245][ T5125] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 271.311975][ T5125] gspca_cpia1: usb_control_msg 05, error -110 [ 271.520351][ T5125] cpia1 1-1:0.0: only firmware version 1 is supported (got: 0) [ 273.223100][ T31] usb 1-1: USB disconnect, device number 13 [ 273.301818][ T7673] FAULT_INJECTION: forcing a failure. [ 273.301818][ T7673] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 273.301855][ T7673] CPU: 1 UID: 0 PID: 7673 Comm: syz.4.510 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 273.301880][ T7673] Tainted: [L]=SOFTLOCKUP [ 273.301887][ T7673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 273.301898][ T7673] Call Trace: [ 273.301905][ T7673] [ 273.301914][ T7673] dump_stack_lvl+0xe8/0x150 [ 273.301942][ T7673] should_fail_ex+0x46b/0x600 [ 273.301968][ T7673] _copy_from_user+0x2d/0xb0 [ 273.301992][ T7673] ___sys_recvmsg+0x175/0x590 [ 273.302010][ T7673] ? get_pid_task+0x20/0x1f0 [ 273.302031][ T7673] ? get_pid_task+0x20/0x1f0 [ 273.302057][ T7673] ? __pfx____sys_recvmsg+0x10/0x10 [ 273.302079][ T7673] ? __fget_files+0x2a/0x420 [ 273.302119][ T7673] ? __fget_files+0x3a6/0x420 [ 273.302151][ T7673] __x64_sys_recvmsg+0x1c0/0x2a0 [ 273.302172][ T7673] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 273.302200][ T7673] ? __pfx_ksys_write+0x10/0x10 [ 273.302230][ T7673] do_syscall_64+0x14d/0xf80 [ 273.302252][ T7673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.302269][ T7673] ? trace_irq_disable+0x37/0x100 [ 273.302284][ T7673] ? clear_bhb_loop+0x40/0x90 [ 273.302306][ T7673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.302323][ T7673] RIP: 0033:0x7f2bfa26c629 [ 273.302339][ T7673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 273.302356][ T7673] RSP: 002b:00007f2bf849d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 273.302376][ T7673] RAX: ffffffffffffffda RBX: 00007f2bfa4e6090 RCX: 00007f2bfa26c629 [ 273.302389][ T7673] RDX: 0000000000000020 RSI: 00002000000017c0 RDI: 0000000000000003 [ 273.302402][ T7673] RBP: 00007f2bf849d090 R08: 0000000000000000 R09: 0000000000000000 [ 273.302413][ T7673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 273.302425][ T7673] R13: 00007f2bfa4e6128 R14: 00007f2bfa4e6090 R15: 00007ffc45541488 [ 273.302455][ T7673] [ 273.979956][ T7684] FAULT_INJECTION: forcing a failure. [ 273.979956][ T7684] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 273.979991][ T7684] CPU: 1 UID: 0 PID: 7684 Comm: syz.0.512 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 273.980016][ T7684] Tainted: [L]=SOFTLOCKUP [ 273.980023][ T7684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 273.980033][ T7684] Call Trace: [ 273.980041][ T7684] [ 273.980049][ T7684] dump_stack_lvl+0xe8/0x150 [ 273.980082][ T7684] should_fail_ex+0x46b/0x600 [ 273.980106][ T7684] _copy_to_user+0x31/0xb0 [ 273.980131][ T7684] simple_read_from_buffer+0xe1/0x170 [ 273.980156][ T7684] proc_fail_nth_read+0x1be/0x230 [ 273.980177][ T7684] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 273.980199][ T7684] ? rw_verify_area+0x2ac/0x4e0 [ 273.980223][ T7684] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 273.980244][ T7684] vfs_read+0x212/0xa70 [ 273.980269][ T7684] ? __pfx_vfs_read+0x10/0x10 [ 273.980289][ T7684] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 273.980312][ T7684] ? lockdep_hardirqs_on+0x7a/0x110 [ 273.980333][ T7684] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 273.980355][ T7684] ? mutex_lock_nested+0x152/0x1d0 [ 273.980371][ T7684] ? fdget_pos+0x252/0x320 [ 273.980401][ T7684] ksys_read+0x156/0x270 [ 273.980421][ T7684] ? __pfx_ksys_read+0x10/0x10 [ 273.980450][ T7684] do_syscall_64+0x14d/0xf80 [ 273.980471][ T7684] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.980488][ T7684] ? trace_irq_disable+0x37/0x100 [ 273.980509][ T7684] ? clear_bhb_loop+0x40/0x90 [ 273.980530][ T7684] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.980548][ T7684] RIP: 0033:0x7fafd5d7cece [ 273.980565][ T7684] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 273.980581][ T7684] RSP: 002b:00007fafd400dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 273.980601][ T7684] RAX: ffffffffffffffda RBX: 00007fafd400e6c0 RCX: 00007fafd5d7cece [ 273.980614][ T7684] RDX: 000000000000000f RSI: 00007fafd400e0a0 RDI: 0000000000000004 [ 273.980626][ T7684] RBP: 00007fafd400e090 R08: 0000000000000000 R09: 0000000000000000 [ 273.980638][ T7684] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 273.980649][ T7684] R13: 00007fafd6036038 R14: 00007fafd6035fa0 R15: 00007ffe960c7dd8 [ 273.980679][ T7684] [ 275.213573][ T7691] netlink: 'syz.2.514': attribute type 3 has an invalid length. [ 275.279422][ T7691] Bluetooth: MGMT ver 1.23 [ 276.362048][ T7693] netlink: 12 bytes leftover after parsing attributes in process `syz.4.515'. [ 276.362067][ T7693] nbd: must specify a size in bytes for the device [ 276.420942][ T6119] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 276.577610][ T6119] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 276.577641][ T6119] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.585367][ T6119] usb 1-1: config 0 descriptor?? [ 277.915368][ T6119] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 277.915843][ T6119] [drm:udl_init] *ERROR* Selecting channel failed [ 278.000388][ T6119] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 2 [ 278.000422][ T6119] [drm] Initialized udl on minor 2 [ 278.012672][ T6119] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 278.013751][ T6119] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 278.084162][ T6119] usb 1-1: USB disconnect, device number 14 [ 278.090309][ T31] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 278.090888][ T31] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 280.433330][ T5797] Bluetooth: hci5: unexpected event 0x14 length: 83 > 6 [ 280.811398][ T7753] veth0_to_team: entered promiscuous mode [ 282.208056][ T7779] netlink: 'syz.1.546': attribute type 5 has an invalid length. [ 282.330560][ T5805] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 282.414770][ T7798] netlink: 16 bytes leftover after parsing attributes in process `syz.5.552'. [ 282.531855][ T5805] usb 3-1: Using ep0 maxpacket: 8 [ 282.534918][ T5805] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 282.534948][ T5805] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 282.534971][ T5805] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 282.534994][ T5805] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 282.535035][ T5805] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 282.535066][ T5805] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.012801][ T5805] usb 3-1: GET_CAPABILITIES returned 0 [ 283.012846][ T5805] usbtmc 3-1:16.0: can't read capabilities [ 283.263522][ T5805] usb 3-1: USB disconnect, device number 11 [ 283.460511][ T31] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 283.570737][ T7837] netlink: 120 bytes leftover after parsing attributes in process `syz.4.562'. [ 283.570777][ T7837] netlink: 'syz.4.562': attribute type 1 has an invalid length. [ 283.570790][ T7837] netlink: 64 bytes leftover after parsing attributes in process `syz.4.562'. [ 283.612629][ T31] usb 6-1: Using ep0 maxpacket: 8 [ 283.615285][ T31] usb 6-1: config 0 interface 0 altsetting 254 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 283.615401][ T31] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 283.615429][ T31] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 283.615457][ T31] usb 6-1: config 0 interface 0 has no altsetting 0 [ 283.615489][ T31] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 283.615511][ T31] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.622862][ T31] usb 6-1: config 0 descriptor?? [ 283.624387][ T7824] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 284.021857][ C1] [drm:vkms_crtc_handle_vblank_timeout] *ERROR* vkms failure on handling vblank [ 284.738228][ T31] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 284.738271][ T31] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 284.738296][ T31] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 284.738321][ T31] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 284.738346][ T31] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 284.762684][ T31] mcp2221 0003:04D8:00DD.0001: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 284.982326][ T7850] 9pnet_virtio: no channels available for device syz [ 285.880751][ T31] usb 6-1: USB disconnect, device number 3 [ 289.884671][ T7868] binder: 7864:7868 ioctl c0306201 200000000140 returned -14 [ 290.715061][ T7879] netlink: 16 bytes leftover after parsing attributes in process `syz.2.572'. [ 290.786718][ T7883] netlink: 16 bytes leftover after parsing attributes in process `syz.5.573'. [ 292.232935][ T7893] 9pnet_virtio: no channels available for device syz [ 293.170891][ T5805] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 293.259584][ T7923] veth0_to_team: entered promiscuous mode [ 293.330177][ T5805] usb 3-1: Using ep0 maxpacket: 16 [ 293.339617][ T5805] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 293.339651][ T5805] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 293.339674][ T5805] usb 3-1: config 0 interface 0 has no altsetting 0 [ 293.339706][ T5805] usb 3-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 293.339727][ T5805] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 293.404278][ T5805] usb 3-1: config 0 descriptor?? [ 293.682301][ T7935] Bluetooth: hci0: unsupported parameter 255 [ 293.682325][ T7935] Bluetooth: hci0: unsupported parameter 255 [ 293.879696][ T5805] nzxt-smart2 0003:1E71:2009.0002: unknown main item tag 0x0 [ 293.879733][ T5805] nzxt-smart2 0003:1E71:2009.0002: unknown main item tag 0x0 [ 293.879759][ T5805] nzxt-smart2 0003:1E71:2009.0002: unknown main item tag 0x0 [ 293.879786][ T5805] nzxt-smart2 0003:1E71:2009.0002: unknown main item tag 0x0 [ 293.879813][ T5805] nzxt-smart2 0003:1E71:2009.0002: unknown main item tag 0x0 [ 293.979769][ T5805] nzxt-smart2 0003:1E71:2009.0002: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.2-1/input0 [ 294.155156][ T5805] usb 3-1: USB disconnect, device number 12 [ 294.298878][ T7942] fido_id[7942]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 297.353679][ T7979] netlink: 12 bytes leftover after parsing attributes in process `syz.2.599'. [ 298.339056][ T7996] syzkaller0: entered promiscuous mode [ 298.339081][ T7996] syzkaller0: entered allmulticast mode [ 305.422164][ T8059] random: crng reseeded on system resumption [ 305.666954][ T8056] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 305.666982][ T8056] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 305.708958][ T8056] vhci_hcd vhci_hcd.0: Device attached [ 306.276057][ T8057] vhci_hcd: connection closed [ 306.300334][ T13] vhci_hcd vhci_hcd.4: stop threads [ 306.326369][ T13] vhci_hcd vhci_hcd.4: release socket [ 306.344732][ T13] vhci_hcd vhci_hcd.4: disconnect device [ 307.383659][ T6119] usb usb42-port1: attempt power cycle [ 308.390200][ T6119] usb usb42-port1: unable to enumerate USB device [ 308.792758][ T8078] netdevsim netdevsim5: Direct firmware load for / [ 308.792758][ T8078] failed with error -2 [ 308.792786][ T8078] netdevsim netdevsim5: Falling back to sysfs fallback for: / [ 308.792786][ T8078] [ 309.715882][ T8089] binder: 8086:8089 ioctl 4018620d 0 returned -22 [ 310.050223][ T31] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 310.216328][ T31] usb 5-1: Using ep0 maxpacket: 16 [ 310.220509][ T31] usb 5-1: config 0 has no interfaces? [ 310.220542][ T31] usb 5-1: New USB device found, idVendor=04d8, idProduct=00df, bcdDevice= 0.00 [ 310.220565][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 310.225304][ T31] usb 5-1: config 0 descriptor?? [ 310.470424][ T6119] usb 5-1: USB disconnect, device number 15 [ 311.690679][ T807] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 311.712309][ T8136] binder: 8132:8136 ioctl 0 0 returned -22 [ 311.840387][ T807] usb 5-1: Using ep0 maxpacket: 8 [ 311.951208][ T807] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 311.951239][ T807] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 311.951259][ T807] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 311.951281][ T807] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 311.951319][ T807] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 311.951340][ T807] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 312.660215][ T807] usb 5-1: GET_CAPABILITIES returned 0 [ 312.660245][ T807] usbtmc 5-1:16.0: can't read capabilities [ 312.815293][ T5125] usb 5-1: USB disconnect, device number 16 [ 313.922067][ T36] audit: type=1326 audit(1771395225.253:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8157 comm="syz.1.663" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4d2cd2c629 code=0x0 [ 315.192008][ T60] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 315.204802][ T60] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 315.222136][ T60] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 315.671631][ T60] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 315.672436][ T60] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 316.104408][ T8165] chnl_net:caif_netlink_parms(): no params data found [ 316.274931][ T8165] bridge0: port 1(bridge_slave_0) entered blocking state [ 316.275127][ T8165] bridge0: port 1(bridge_slave_0) entered disabled state [ 316.275901][ T8165] bridge_slave_0: entered allmulticast mode [ 316.278963][ T8165] bridge_slave_0: entered promiscuous mode [ 316.702106][ T8165] bridge0: port 2(bridge_slave_1) entered blocking state [ 316.702199][ T8165] bridge0: port 2(bridge_slave_1) entered disabled state [ 316.702355][ T8165] bridge_slave_1: entered allmulticast mode [ 316.704401][ T8165] bridge_slave_1: entered promiscuous mode [ 316.873925][ T8185] evm: overlay not supported [ 317.089215][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.089279][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.242711][ T8165] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 317.246754][ T8165] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 317.420255][ T5945] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 317.460704][ T8165] team0: Port device team_slave_0 added [ 317.467292][ T8165] team0: Port device team_slave_1 added [ 317.580229][ T5945] usb 5-1: Using ep0 maxpacket: 8 [ 317.585056][ T5945] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 317.585086][ T5945] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 317.585104][ T5945] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 317.585118][ T5945] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 317.585141][ T5945] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 317.585153][ T5945] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.723956][ T60] Bluetooth: hci1: command tx timeout [ 317.940418][ T5945] usb 5-1: GET_CAPABILITIES returned 0 [ 317.940447][ T5945] usbtmc 5-1:16.0: can't read capabilities [ 318.023417][ T5125] usb 5-1: USB disconnect, device number 17 [ 318.649687][ T8165] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 318.649698][ T8165] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 318.649712][ T8165] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 318.716322][ T8165] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 318.716339][ T8165] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 318.716365][ T8165] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 319.289615][ T8165] hsr_slave_0: entered promiscuous mode [ 319.300807][ T8165] hsr_slave_1: entered promiscuous mode [ 319.301363][ T8165] debugfs: 'hsr0' already exists in 'hsr' [ 319.301379][ T8165] Cannot create hsr debugfs directory [ 319.326650][ T8225] netlink: 16 bytes leftover after parsing attributes in process `syz.5.686'. [ 319.801569][ T60] Bluetooth: hci1: command tx timeout [ 320.311589][ T5125] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 320.460313][ T5125] usb 6-1: Using ep0 maxpacket: 8 [ 320.462779][ T5125] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 320.462806][ T5125] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 320.462830][ T5125] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 320.462854][ T5125] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 320.462892][ T5125] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 320.462915][ T5125] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 320.855580][ T5125] usb 6-1: GET_CAPABILITIES returned 0 [ 320.855630][ T5125] usbtmc 6-1:16.0: can't read capabilities [ 321.185598][ T5125] usb 6-1: USB disconnect, device number 4 [ 321.883766][ T60] Bluetooth: hci1: command tx timeout [ 322.567819][ T8255] netlink: 260 bytes leftover after parsing attributes in process `syz.4.699'. [ 323.159225][ T8165] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 323.735098][ T1461] bridge_slave_1: left allmulticast mode [ 323.735141][ T1461] bridge_slave_1: left promiscuous mode [ 323.735354][ T1461] bridge0: port 2(bridge_slave_1) entered disabled state [ 323.854754][ T1461] bridge_slave_0: left allmulticast mode [ 323.854784][ T1461] bridge_slave_0: left promiscuous mode [ 323.855040][ T1461] bridge0: port 1(bridge_slave_0) entered disabled state [ 323.960716][ T60] Bluetooth: hci1: command tx timeout [ 324.900217][ T5905] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 325.050897][ T5905] usb 5-1: Using ep0 maxpacket: 8 [ 325.058572][ T5905] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 325.058603][ T5905] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 325.058628][ T5905] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 325.058647][ T5905] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 325.058672][ T5905] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 325.058684][ T5905] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 325.348572][ T5905] usb 5-1: GET_CAPABILITIES returned 0 [ 325.348602][ T5905] usbtmc 5-1:16.0: can't read capabilities [ 325.538874][ T5878] usb 5-1: USB disconnect, device number 18 [ 326.930253][ T5125] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 326.951214][ T1461] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 327.011743][ T1461] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 327.061675][ T1461] bond0 (unregistering): Released all slaves [ 327.080615][ T5125] usb 5-1: Using ep0 maxpacket: 8 [ 327.108149][ T5125] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 327.108177][ T5125] usb 5-1: config 0 has no interface number 0 [ 327.121047][ T5125] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 327.121074][ T5125] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.121094][ T5125] usb 5-1: Product: syz [ 327.121107][ T5125] usb 5-1: Manufacturer: syz [ 327.121121][ T5125] usb 5-1: SerialNumber: syz [ 327.124933][ T8165] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 327.133435][ T5125] usb 5-1: config 0 descriptor?? [ 327.262982][ T8312] syz_tun: entered allmulticast mode [ 327.325543][ T8165] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 327.433011][ T8165] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 327.502552][ T5125] uvcvideo 5-1:0.31: probe with driver uvcvideo failed with error -22 [ 327.548764][ T5125] usb 5-1: USB disconnect, device number 19 [ 327.664084][ T8306] syz_tun: left allmulticast mode [ 327.670492][ T5945] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 327.832154][ T5945] usb 1-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 327.832187][ T5945] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 327.832208][ T5945] usb 1-1: Product: syz [ 327.832223][ T5945] usb 1-1: Manufacturer: syz [ 327.832236][ T5945] usb 1-1: SerialNumber: syz [ 327.898243][ T5945] usb 1-1: config 0 descriptor?? [ 327.922905][ T5945] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 327.923350][ T5945] dvb-usb: bulk message failed: -22 (2/0) [ 327.959560][ T5945] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 327.969891][ T5945] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 327.969954][ T5945] usb 1-1: media controller created [ 328.009107][ T5945] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 328.179069][ T5945] cxusb: set interface failed [ 328.179089][ T5945] dvb-usb: bulk message failed: -22 (1/0) [ 328.232725][ T5945] DVB: Unable to find symbol mt352_attach() [ 328.233663][ T5945] dvb-usb: bulk message failed: -22 (5/0) [ 328.233687][ T5945] zl10353_read_register: readreg error (reg=127, ret==-121) [ 328.233744][ T5945] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 328.392399][ T5945] rc_core: IR keymap rc-dvico-mce not found [ 328.392419][ T5945] Registered IR keymap rc-empty [ 328.415140][ T5945] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 328.418887][ T5945] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input6 [ 328.646267][ T5945] dvb-usb: schedule remote query interval to 100 msecs. [ 328.646293][ T5945] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 328.670430][ T5945] usb 1-1: USB disconnect, device number 15 [ 329.119708][ T5945] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 329.503215][ T5945] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 329.659178][ T5945] usb 1-1: Using ep0 maxpacket: 8 [ 329.666311][ T5945] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 329.666341][ T5945] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 329.666364][ T5945] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 329.666378][ T5945] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 329.666402][ T5945] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 329.666415][ T5945] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.777383][ T1461] hsr_slave_0: left promiscuous mode [ 329.860222][ T1461] hsr_slave_1: left promiscuous mode [ 329.879447][ T1461] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 329.892036][ T5945] usb 1-1: GET_CAPABILITIES returned 0 [ 329.892085][ T5945] usbtmc 1-1:16.0: can't read capabilities [ 329.967218][ T1461] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 330.091188][ T5905] usb 1-1: USB disconnect, device number 16 [ 330.380414][ T8361] netlink: 260 bytes leftover after parsing attributes in process `syz.4.723'. [ 332.480294][ T807] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 332.505773][ T8413] netlink: 120 bytes leftover after parsing attributes in process `syz.5.743'. [ 332.505797][ T8413] netlink: 'syz.5.743': attribute type 1 has an invalid length. [ 332.505810][ T8413] netlink: 64 bytes leftover after parsing attributes in process `syz.5.743'. [ 332.649594][ T807] usb 1-1: Using ep0 maxpacket: 8 [ 332.656464][ T807] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 332.656490][ T807] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 332.656503][ T807] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 332.656515][ T807] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 332.656540][ T807] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 332.656552][ T807] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 332.869225][ T807] usb 1-1: GET_CAPABILITIES returned 0 [ 332.869255][ T807] usbtmc 1-1:16.0: can't read capabilities [ 333.074092][ T807] usb 1-1: USB disconnect, device number 17 [ 334.382223][ T8439] netlink: 120 bytes leftover after parsing attributes in process `syz.0.753'. [ 334.382239][ T8439] netlink: 'syz.0.753': attribute type 1 has an invalid length. [ 334.382245][ T8439] netlink: 64 bytes leftover after parsing attributes in process `syz.0.753'. [ 334.598180][ T8441] blktrace: Concurrent blktraces are not allowed on sg0 [ 334.871163][ T1461] team0 (unregistering): Port device team_slave_1 removed [ 334.962720][ T5878] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 335.120218][ T5878] usb 1-1: Using ep0 maxpacket: 8 [ 335.124373][ T5878] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 335.124404][ T5878] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 335.124427][ T5878] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 335.124442][ T5878] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 335.124466][ T5878] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 335.124478][ T5878] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.211218][ T1461] team0 (unregistering): Port device team_slave_0 removed [ 335.394219][ T5878] usb 1-1: GET_CAPABILITIES returned 0 [ 335.394265][ T5878] usbtmc 1-1:16.0: can't read capabilities [ 335.690862][ T5878] usb 1-1: USB disconnect, device number 18 [ 336.953446][ T8451] syz.5.757 (8451) used greatest stack depth: 16504 bytes left [ 339.041626][ T8472] netlink: 260 bytes leftover after parsing attributes in process `syz.4.763'. [ 340.116511][ T8165] 8021q: adding VLAN 0 to HW filter on device bond0 [ 340.607427][ T8165] 8021q: adding VLAN 0 to HW filter on device team0 [ 340.623455][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 340.623586][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 340.634380][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 340.634549][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 341.020226][ T5905] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 341.170446][ T5905] usb 5-1: Using ep0 maxpacket: 8 [ 341.176550][ T5905] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 341.176578][ T5905] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 341.176603][ T5905] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 341.176626][ T5905] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 341.176668][ T5905] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 341.176690][ T5905] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 341.460188][ T5905] usb 5-1: GET_CAPABILITIES returned 0 [ 341.460234][ T5905] usbtmc 5-1:16.0: can't read capabilities [ 341.625246][ T8165] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 341.662835][ T31] usb 5-1: USB disconnect, device number 20 [ 341.769150][ T8511] netlink: 260 bytes leftover after parsing attributes in process `syz.0.775'. [ 341.888367][ T8518] overlayfs: failed to clone upperpath [ 342.410539][ T8547] netlink: 260 bytes leftover after parsing attributes in process `syz.5.787'. [ 342.633257][ T8165] veth0_vlan: entered promiscuous mode [ 342.672055][ T8165] veth1_vlan: entered promiscuous mode [ 342.803722][ T8165] veth0_macvtap: entered promiscuous mode [ 342.832905][ T8165] veth1_macvtap: entered promiscuous mode [ 342.909428][ T8165] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 342.959658][ T8165] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 342.996805][ T1177] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.002715][ T1177] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.003218][ T1177] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.003256][ T1177] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.506653][ T8584] netlink: 260 bytes leftover after parsing attributes in process `syz.4.799'. [ 343.522084][ T1479] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 343.522105][ T1479] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 343.671787][ T1461] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 343.671808][ T1461] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 344.067184][ T8602] mmap: syz.5.805 (8602) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 344.160179][ T5805] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 344.325695][ T5805] usb 5-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 344.325727][ T5805] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 344.325748][ T5805] usb 5-1: Product: syz [ 344.325761][ T5805] usb 5-1: Manufacturer: syz [ 344.325775][ T5805] usb 5-1: SerialNumber: syz [ 344.376237][ T5805] usb 5-1: config 0 descriptor?? [ 344.398578][ T5805] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 344.398631][ T5805] dvb-usb: bulk message failed: -22 (2/0) [ 344.428568][ T5805] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 344.429535][ T5805] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 344.429590][ T5805] usb 5-1: media controller created [ 344.469064][ T5805] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 344.597122][ T5805] cxusb: set interface failed [ 344.597143][ T5805] dvb-usb: bulk message failed: -22 (1/0) [ 344.748721][ T5805] DVB: Unable to find symbol mt352_attach() [ 344.748803][ T5805] dvb-usb: bulk message failed: -22 (5/0) [ 344.748823][ T5805] zl10353_read_register: readreg error (reg=127, ret==-121) [ 344.748867][ T5805] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 344.890161][ T5805] rc_core: IR keymap rc-dvico-mce not found [ 344.890179][ T5805] Registered IR keymap rc-empty [ 344.896376][ T5805] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 344.930976][ T5805] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input7 [ 344.933354][ T5805] dvb-usb: schedule remote query interval to 100 msecs. [ 344.933375][ T5805] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 344.969179][ T5805] usb 5-1: USB disconnect, device number 21 [ 345.892021][ T5805] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 346.622705][ T8659] netlink: 260 bytes leftover after parsing attributes in process `syz.6.825'. [ 353.214152][ T60] Bluetooth: Wrong link type (-71) [ 356.002226][ T8815] IPVS: length: 528 != 8 [ 356.980099][ T36] audit: type=1326 audit(1771395267.833:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8809 comm="syz.4.885" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f2bfa26c629 code=0x0 [ 358.746928][ T8833] binder: 8824:8833 ioctl c0306201 0 returned -14 [ 361.081660][ T8857] batman_adv: batadv0: Adding interface: dummy0 [ 361.081674][ T8857] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 361.081694][ T8857] batman_adv: batadv0: Interface activated: dummy0 [ 361.094996][ T8857] net_ratelimit: 23 callbacks suppressed [ 361.095011][ T8857] batadv0: mtu less than device minimum [ 361.099067][ T8857] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 361.168662][ T8857] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 361.190501][ T8857] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 361.199217][ T8857] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 361.233388][ T8857] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 361.262393][ T8857] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 361.285462][ T8857] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 361.311326][ T8857] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 361.342074][ T8857] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 364.120825][ T8864] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.121190][ T8864] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.347495][ T8881] overlayfs: failed to resolve './file0': -2 [ 365.011688][ T8864] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 365.017037][ T8864] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 366.052367][ T8895] netlink: 'syz.0.911': attribute type 10 has an invalid length. [ 366.105722][ T8898] program syz.0.911 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 366.139681][ T8874] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 366.152307][ T8874] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 366.290471][ T5945] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 366.386777][ T13] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.426107][ T13] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.426154][ T13] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.426187][ T13] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.440237][ T5945] usb 5-1: Using ep0 maxpacket: 8 [ 366.442880][ T5945] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 366.442907][ T5945] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 366.442932][ T5945] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 366.442956][ T5945] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 366.443005][ T5945] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 366.443027][ T5945] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 366.744156][ T5945] usb 5-1: usb_control_msg returned -71 [ 366.744205][ T5945] usbtmc 5-1:16.0: can't read capabilities [ 366.785772][ T5945] usb 5-1: USB disconnect, device number 22 [ 367.065531][ T8921] netlink: 252 bytes leftover after parsing attributes in process `syz.0.920'. [ 369.963248][ T8943] siw: device registration error -23 [ 371.470994][ T8957] siw: device registration error -23 [ 373.419012][ T8969] siw: device registration error -23 [ 375.152450][ T8977] netlink: 252 bytes leftover after parsing attributes in process `syz.4.935'. [ 376.550887][ T36] audit: type=1326 audit(1771395287.703:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8983 comm="syz.4.939" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f2bfa26c629 code=0x0 [ 378.623093][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.627271][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.680232][ T5797] Bluetooth: hci5: command 0x0406 tx timeout [ 380.728366][ T9016] netlink: 252 bytes leftover after parsing attributes in process `syz.5.949'. [ 384.940564][ T9067] netlink: 4 bytes leftover after parsing attributes in process `syz.0.962'. [ 386.136474][ T9077] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 392.292852][ T9165] overlayfs: failed to resolve './file0': -2 [ 393.157637][ T9181] kvm: emulating exchange as write [ 395.711129][ T9216] siw: device registration error -23 [ 396.443454][ T36] audit: type=1326 audit(1771395307.773:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9219 comm="syz.0.1005" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fafd5dbc629 code=0x0 [ 397.402747][ T9222] overlayfs: failed to resolve './file1': -2 [ 399.578024][ T9256] siw: device registration error -23 [ 401.238103][ T9261] overlayfs: failed to resolve './file1': -2 [ 402.167327][ T9274] siw: device registration error -23 [ 405.964975][ T36] audit: type=1326 audit(1771395317.293:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9294 comm="syz.6.1031" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f12a097c629 code=0x0 [ 406.159749][ T9304] overlayfs: failed to clone upperpath [ 406.706917][ T9317] siw: device registration error -23 [ 409.562337][ T9336] overlayfs: failed to resolve './file1': -2 [ 410.500672][ T9346] overlayfs: overlapping lowerdir path [ 411.429170][ T36] audit: type=1326 audit(1771395322.703:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9355 comm="syz.0.1053" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fafd5dbc629 code=0x0 [ 416.063845][ T9407] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1064'. [ 416.844494][ T9416] IPVS: length: 528 != 192595126264 [ 419.505143][ T9462] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 423.249578][ T9514] fuse: Bad value for 'fd' [ 423.391390][ T9520] overlayfs: failed to resolve './file0': -2 [ 425.597807][ T9547] netlink: 'syz.4.1118': attribute type 1 has an invalid length. [ 425.597830][ T9547] netlink: 188 bytes leftover after parsing attributes in process `syz.4.1118'. [ 426.848317][ T9559] overlayfs: failed to resolve './file0': -2 [ 429.706302][ T9591] overlayfs: failed to resolve './file0': -2 [ 430.005297][ T9601] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1136'. [ 430.997524][ T9610] netlink: 260 bytes leftover after parsing attributes in process `syz.6.1142'. [ 433.313145][ T9640] No control pipe specified [ 434.330297][ T9646] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1153'. [ 434.466265][ T9650] netlink: 260 bytes leftover after parsing attributes in process `syz.0.1156'. [ 437.533029][ T9683] netlink: 260 bytes leftover after parsing attributes in process `syz.0.1169'. [ 437.590253][ T9685] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1170'. [ 438.323953][ T9703] siw: device registration error -23 [ 441.001138][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 441.003251][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.990922][ T9724] netlink: 260 bytes leftover after parsing attributes in process `syz.5.1183'. [ 443.145943][ T9730] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1185'. [ 443.757418][ T60] Bluetooth: hci1: command 0x0406 tx timeout [ 444.163127][ T36] audit: type=1326 audit(1771395355.483:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9735 comm="syz.6.1188" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f12a097c629 code=0x0 [ 446.153452][ T9752] siw: device registration error -23 [ 449.183614][ T9766] netlink: 'syz.0.1194': attribute type 1 has an invalid length. [ 449.216942][ T9770] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1200'. [ 455.080126][ T31] usb 1-1: new low-speed USB device number 19 using dummy_hcd [ 455.274119][ T31] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 455.274137][ T31] usb 1-1: config 0 has no interface number 0 [ 455.274162][ T31] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 455.274173][ T31] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 455.274187][ T31] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 455.274201][ T31] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 455.274213][ T31] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 455.274227][ T31] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 455.274250][ T31] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 455.274262][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 455.446021][ T31] usb 1-1: config 0 descriptor?? [ 455.449091][ T9796] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 455.456147][ T9796] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 455.504021][ T31] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 455.816522][ T9803] siw: device registration error -23 [ 457.460755][ T6119] usb 1-1: USB disconnect, device number 19 [ 457.538036][ T6119] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 463.831386][ T36] audit: type=1326 audit(1771395375.153:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9822 comm="syz.1.1214" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4d2cd2c629 code=0x0 [ 466.876856][ T9847] siw: device registration error -23 [ 468.720564][ T60] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 468.741734][ T60] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 468.768014][ T60] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 468.778120][ T60] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 468.780506][ T60] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 471.308235][ T60] Bluetooth: hci4: command tx timeout [ 471.507090][ T36] audit: type=1326 audit(1771395381.863:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9873 comm="syz.1.1228" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4d2cd2c629 code=0x0 [ 472.612087][ T9890] siw: device registration error -23 [ 474.218941][ T60] Bluetooth: hci4: command tx timeout [ 476.416546][ T36] audit: type=1326 audit(1771395387.053:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9912 comm="syz.5.1241" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5e5d51c629 code=0x0 [ 476.417612][ T5797] Bluetooth: hci4: command tx timeout [ 477.746519][ T1177] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 477.856991][ T9926] siw: device registration error -23 [ 478.733414][ T5797] Bluetooth: hci4: command tx timeout [ 479.607122][ T9855] chnl_net:caif_netlink_parms(): no params data found [ 479.923820][ T1177] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.955031][ T9938] No control pipe specified [ 481.720938][ T1177] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.919281][ T1177] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.180641][ T9969] No control pipe specified [ 486.409536][ T9975] siw: device registration error -23 [ 487.709755][ T9855] bridge0: port 1(bridge_slave_0) entered blocking state [ 487.709882][ T9855] bridge0: port 1(bridge_slave_0) entered disabled state [ 487.853356][ T9855] bridge_slave_0: entered allmulticast mode [ 487.855873][ T9855] bridge_slave_0: entered promiscuous mode [ 487.886286][ T9855] bridge0: port 2(bridge_slave_1) entered blocking state [ 487.886400][ T9855] bridge0: port 2(bridge_slave_1) entered disabled state [ 487.886621][ T9855] bridge_slave_1: entered allmulticast mode [ 487.889214][ T9855] bridge_slave_1: entered promiscuous mode [ 490.455183][ T9855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 490.459312][ T9855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 490.614700][ T9855] team0: Port device team_slave_0 added [ 490.642562][ T9855] team0: Port device team_slave_1 added [ 491.020397][T10000] No control pipe specified [ 491.446977][T10011] siw: device registration error -23 [ 493.390481][ T9855] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 493.390498][ T9855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 493.390521][ T9855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 493.705696][T10025] siw: device registration error -23 [ 494.610687][ T9855] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 494.610699][ T9855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 494.610714][ T9855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 495.540290][ T1177] bridge_slave_1: left allmulticast mode [ 495.540328][ T1177] bridge_slave_1: left promiscuous mode [ 495.540555][ T1177] bridge0: port 2(bridge_slave_1) entered disabled state [ 495.744925][ T1177] bridge_slave_0: left allmulticast mode [ 495.744954][ T1177] bridge_slave_0: left promiscuous mode [ 495.745201][ T1177] bridge0: port 1(bridge_slave_0) entered disabled state [ 498.217812][ T36] audit: type=1326 audit(1771395409.543:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10044 comm="syz.5.1277" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5e5d51c629 code=0x0 [ 499.236082][ T5945] ------------[ cut here ]------------ [ 499.236098][ T5945] faux_driver vkms: [drm] vblank wait timed out on crtc 0 [ 499.236120][ T5945] WARNING: drivers/gpu/drm/drm_vblank.c:1320 at drm_crtc_wait_one_vblank+0x357/0x500, CPU#0: kworker/0:6/5945 [ 499.236159][ T5945] Modules linked in: [ 499.236190][ T5945] CPU: 0 UID: 0 PID: 5945 Comm: kworker/0:6 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 499.236249][ T5945] Tainted: [L]=SOFTLOCKUP [ 499.236255][ T5945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 499.236268][ T5945] Workqueue: events drm_fb_helper_damage_work [ 499.236291][ T5945] RIP: 0010:drm_crtc_wait_one_vblank+0x4b6/0x500 [ 499.236311][ T5945] Code: e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 ef e8 da ee db fc 4d 8b 7d 00 48 89 df 4c 89 e6 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 48 8b 3c 24 44 89 f6 e8 e9 f4 ff ff b8 92 ff ff ff [ 499.236328][ T5945] RSP: 0018:ffffc900056df8e0 EFLAGS: 00010246 [ 499.236344][ T5945] RAX: 1ffff110049e9c00 RBX: ffffffff8f53f3f0 RCX: 0000000000000000 [ 499.236358][ T5945] RDX: ffffffff8b9eec00 RSI: ffffffff8ba0aa40 RDI: ffffffff8f53f3f0 [ 499.236372][ T5945] RBP: ffffc900056df9c8 R08: 0000000000000000 R09: 0000000000000000 [ 499.236385][ T5945] R10: dffffc0000000000 R11: fffffbfff1e9250f R12: ffffffff8ba0aa40 [ 499.236399][ T5945] R13: ffff888024f4e000 R14: 0000000000000000 R15: ffffffff8b9eec00 [ 499.236412][ T5945] FS: 0000000000000000(0000) GS:ffff888126595000(0000) knlGS:0000000000000000 [ 499.236428][ T5945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 499.236441][ T5945] CR2: 000020000037a000 CR3: 0000000036962000 CR4: 00000000003526f0 [ 499.236458][ T5945] Call Trace: [ 499.236471][ T5945] [ 499.236486][ T5945] ? __pfx_drm_crtc_wait_one_vblank+0x10/0x10 [ 499.236504][ T5945] ? rt_spin_unlock+0x14f/0x200 [ 499.236525][ T5945] ? __pfx_autoremove_wake_function+0x10/0x10 [ 499.236550][ T5945] ? rt_spin_unlock+0x160/0x200 [ 499.236572][ T5945] ? drm_vblank_get+0x147/0x260 [ 499.236600][ T5945] drm_client_modeset_wait_for_vblank+0xc5/0xf0 [ 499.236626][ T5945] drm_fb_helper_damage_work+0x131/0x6f0 [ 499.236648][ T5945] ? process_scheduled_works+0xa0f/0x17a0 [ 499.236674][ T5945] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 499.236699][ T5945] ? process_scheduled_works+0xa0f/0x17a0 [ 499.236718][ T5945] ? process_scheduled_works+0xa0f/0x17a0 [ 499.236740][ T5945] process_scheduled_works+0xaec/0x17a0 [ 499.236793][ T5945] ? __pfx_process_scheduled_works+0x10/0x10 [ 499.236821][ T5945] ? assign_work+0x3d5/0x5e0 [ 499.236847][ T5945] worker_thread+0xa50/0xfc0 [ 499.236913][ T5945] kthread+0x388/0x470 [ 499.236938][ T5945] ? __pfx_worker_thread+0x10/0x10 [ 499.236956][ T5945] ? __pfx_kthread+0x10/0x10 [ 499.236981][ T5945] ret_from_fork+0x51e/0xb90 [ 499.237006][ T5945] ? __pfx_ret_from_fork+0x10/0x10 [ 499.237026][ T5945] ? __switch_to+0xc7d/0x1400 [ 499.237051][ T5945] ? __pfx_kthread+0x10/0x10 [ 499.237076][ T5945] ret_from_fork_asm+0x1a/0x30 [ 499.237119][ T5945] [ 499.237136][ T5945] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 499.237151][ T5945] CPU: 0 UID: 0 PID: 5945 Comm: kworker/0:6 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 499.237175][ T5945] Tainted: [L]=SOFTLOCKUP [ 499.237182][ T5945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 499.237194][ T5945] Workqueue: events drm_fb_helper_damage_work [ 499.237211][ T5945] Call Trace: [ 499.237219][ T5945] [ 499.237226][ T5945] vpanic+0x1e0/0x670 [ 499.237260][ T5945] panic+0xc5/0xd0 [ 499.237281][ T5945] ? __pfx_panic+0x10/0x10 [ 499.237314][ T5945] ? ret_from_fork_asm+0x1a/0x30 [ 499.237344][ T5945] __warn+0x315/0x4a0 [ 499.237364][ T5945] ? drm_crtc_wait_one_vblank+0x357/0x500 [ 499.237385][ T5945] ? drm_crtc_wait_one_vblank+0x357/0x500 [ 499.237406][ T5945] __report_bug+0x29a/0x540 [ 499.237434][ T5945] ? drm_crtc_wait_one_vblank+0x357/0x500 [ 499.237454][ T5945] ? __pfx___report_bug+0x10/0x10 [ 499.237496][ T5945] report_bug_entry+0x19a/0x290 [ 499.237518][ T5945] ? drm_crtc_wait_one_vblank+0x4b6/0x500 [ 499.237534][ T5945] ? drm_crtc_wait_one_vblank+0x4bb/0x500 [ 499.237552][ T5945] handle_bug+0xca/0x200 [ 499.237576][ T5945] exc_invalid_op+0x1a/0x50 [ 499.237599][ T5945] asm_exc_invalid_op+0x1a/0x20 [ 499.237617][ T5945] RIP: 0010:drm_crtc_wait_one_vblank+0x4b6/0x500 [ 499.237636][ T5945] Code: e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 ef e8 da ee db fc 4d 8b 7d 00 48 89 df 4c 89 e6 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 48 8b 3c 24 44 89 f6 e8 e9 f4 ff ff b8 92 ff ff ff [ 499.237652][ T5945] RSP: 0018:ffffc900056df8e0 EFLAGS: 00010246 [ 499.237667][ T5945] RAX: 1ffff110049e9c00 RBX: ffffffff8f53f3f0 RCX: 0000000000000000 [ 499.237681][ T5945] RDX: ffffffff8b9eec00 RSI: ffffffff8ba0aa40 RDI: ffffffff8f53f3f0 [ 499.237694][ T5945] RBP: ffffc900056df9c8 R08: 0000000000000000 R09: 0000000000000000 [ 499.237706][ T5945] R10: dffffc0000000000 R11: fffffbfff1e9250f R12: ffffffff8ba0aa40 [ 499.237721][ T5945] R13: ffff888024f4e000 R14: 0000000000000000 R15: ffffffff8b9eec00 [ 499.237757][ T5945] ? __pfx_drm_crtc_wait_one_vblank+0x10/0x10 [ 499.237774][ T5945] ? rt_spin_unlock+0x14f/0x200 [ 499.237792][ T5945] ? __pfx_autoremove_wake_function+0x10/0x10 [ 499.237816][ T5945] ? rt_spin_unlock+0x160/0x200 [ 499.237838][ T5945] ? drm_vblank_get+0x147/0x260 [ 499.237865][ T5945] drm_client_modeset_wait_for_vblank+0xc5/0xf0 [ 499.237891][ T5945] drm_fb_helper_damage_work+0x131/0x6f0 [ 499.237912][ T5945] ? process_scheduled_works+0xa0f/0x17a0 [ 499.237937][ T5945] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 499.237961][ T5945] ? process_scheduled_works+0xa0f/0x17a0 [ 499.237980][ T5945] ? process_scheduled_works+0xa0f/0x17a0 [ 499.238002][ T5945] process_scheduled_works+0xaec/0x17a0 [ 499.238053][ T5945] ? __pfx_process_scheduled_works+0x10/0x10 [ 499.238081][ T5945] ? assign_work+0x3d5/0x5e0 [ 499.238107][ T5945] worker_thread+0xa50/0xfc0 [ 499.238157][ T5945] kthread+0x388/0x470 [ 499.238180][ T5945] ? __pfx_worker_thread+0x10/0x10 [ 499.238198][ T5945] ? __pfx_kthread+0x10/0x10 [ 499.238224][ T5945] ret_from_fork+0x51e/0xb90 [ 499.238254][ T5945] ? __pfx_ret_from_fork+0x10/0x10 [ 499.238273][ T5945] ? __switch_to+0xc7d/0x1400 [ 499.238296][ T5945] ? __pfx_kthread+0x10/0x10 [ 499.238321][ T5945] ret_from_fork_asm+0x1a/0x30 [ 499.238362][ T5945] [ 499.238710][ T5945] Kernel Offset: disabled