last executing test programs: 2m29.376100405s ago: executing program 0 (id=4502): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0xf0ffffff) timerfd_create(0x5, 0x80000) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000006, 0x46032, 0xffffffffffffffff, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x400000000000000) unshare(0x10020000) fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x400055e) r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x200, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x20a, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syzkaller0\x00'}) socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x8}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0x4}, {0xffff, 0xffff}, {0x2, 0xfff1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xd, 0x5, 0x0, 0xd, 0x10, 0x2, 0x4, 0x2, 0xb, 0x6, 0x3, 0x7, 0x8, 0x0, 0x10, 0x4], 0x3, [0x1751, 0xb, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xc, 0x0, 0xa, 0x8, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0x1, 0xfff5, 0x9, 0x8, 0x1, 0x9, 0x5, 0x2, 0xf, 0x40, 0xfffc, 0x3, 0x1, 0x2002]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x24000080) r6 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') read$FUSE(r6, &(0x7f0000000080)={0x2020}, 0x2020) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket(0x400000000010, 0x3, 0x0) 2m28.722350034s ago: executing program 0 (id=4504): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x9, 0xc, 0x32314142, 0x2, 0x6, 0x6, 0x4, 0xa6e, 0x0, 0x2, 0x1, 0x5}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000480)={0xffffffffffffffff, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f00000001c0), &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xec, &(0x7f0000000280)=[{}, {}], 0x10, 0x10, &(0x7f00000002c0), &(0x7f0000000300), 0x8, 0xbf, 0x8, 0x8, &(0x7f0000000340)}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000004c0)={r1}, 0x4) r2 = socket$can_j1939(0x1d, 0x2, 0x7) r3 = socket$can_raw(0x1d, 0x3, 0x1) connect(r3, &(0x7f00000001c0)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-generic\x00'}, 0x80) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = fcntl$dupfd(r4, 0x0, r4) setsockopt$inet_mtu(r5, 0x111, 0xa, &(0x7f0000000000)=0x3, 0x4) ioctl$sock_ifreq(r2, 0x89b0, &(0x7f0000000000)={'dvmrp0\x00', @ifru_names='bond_slave_1\x00'}) 2m28.611928349s ago: executing program 0 (id=4506): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x15, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000fd3f0000000000000900000818110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000e0000007b1bf8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001000000850000006c00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000070000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) syz_open_dev$sndpcmc(&(0x7f0000000040), 0x7, 0x30800) 2m28.344668564s ago: executing program 0 (id=4508): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x8}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x2, 0x1, 0x0, 0x158}, &(0x7f0000000100)=0x0, 0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r2, 0x0, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0xfbb, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f00000000c0)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xffbffffe, 0x257, 0x0, r1}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0x1000000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffff8, 0x1000, 0x0, 0x146, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x4, 0x1, 0x2, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8, 0x1, 0x2}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r4, '\x00', {0x3, 0x5, 0x0, 0x0}}, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x12, 0x4, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sock_addr=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'ip6_vti0\x00', 0x0}) r10 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1b, 0x7, 0x7ff, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1, 0x10, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000ff7f0000000000000000000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b702000014000000b7030000000000005400000083000000bf0900000000000055090100000000009500000000000000d509040001000000bf91000000000000b7020000010000007500000000000010bf2000000000000095"], 0x0, 0x9, 0x0, 0x0, 0x41000, 0x21, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) r12 = open(&(0x7f0000000040)='.\x00', 0x0, 0x6c) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) ioctl$KVM_IRQFD(r14, 0x4020ae76, &(0x7f0000000240)={r12, 0x7, 0x3}) r15 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=r7, @ANYBLOB='\v\x00'/20, @ANYRES32=0x0, @ANYRES32=r7, @ANYBLOB="0000000004e5050000000000000001000000d5060000000000c87cb05f369b2e4ad893000000"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x1e, 0x3ff, 0xfffffff6, 0xb, 0x200, 0xffffffffffffffff, 0x80000001, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x12, 0x16, &(0x7f0000000b00)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xad10, 0x0, 0x0, 0x0, 0x1000}, {{0x18, 0x1, 0x1, 0x0, r10}}, {}, [@jmp={0x5, 0x1, 0x7, 0x3, 0x3, 0xfffffffffffffffe, 0x1}, @map_val={0x18, 0xb, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1}, @ldst={0x2, 0x0, 0x1, 0x2, 0xa, 0x98, 0x8}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x2e}, @jmp={0x5, 0x0, 0x2, 0xb, 0x5, 0xffffffffffffffe6, 0x10}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000540)='syzkaller\x00', 0x7f, 0x0, 0x0, 0x41100, 0x54, '\x00', r9, @fallback=0x2e, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000580)={0x1, 0x1, 0xc0f2, 0x3ff}, 0x10, 0x0, r8, 0x7, &(0x7f0000000640)=[r7, r12, 0x1, r15], &(0x7f0000000680)=[{0x1, 0x1, 0x9, 0x7}, {0x3, 0x5, 0xf, 0x2}, {0x4, 0x5, 0x6, 0xc}, {0x4, 0x1, 0x0, 0x8}, {0x2, 0x5, 0x8, 0xa}, {0x1, 0x2, 0x6, 0x3}, {0x5, 0x0, 0x8, 0x8}], 0x10, 0x8000}, 0x94) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRESOCT=r0], 0x90}, 0x1, 0x0, 0x0, 0x40000}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r16 = socket(0x1, 0x5, 0x0) close(r16) r17 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r17, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) syz_open_pts(r17, 0x0) epoll_create1(0x80000) 2m27.871909162s ago: executing program 0 (id=4510): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x64, 0x18, 0x229, 0x0, 0x0, {0x2}, [@typed={0x8, 0x800, 0x0, 0x0, @u32}, @typed={0x47, 0x116, 0x0, 0x0, @binary="e7de41242c58670020a40da48ee5f9e4fd461cb3e0887627ac6d2297672423bce3ee4b6eef07a07c97a52440f46a2d9aea6655415a5a7f6509510ad77bf0299c3f9c9c"}]}, 0x64}}, 0x44040) 2m27.616877642s ago: executing program 0 (id=4512): r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) preadv(r3, 0x0, 0x0, 0x2, 0x9) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) 2m12.402490425s ago: executing program 32 (id=4512): r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) preadv(r3, 0x0, 0x0, 0x2, 0x9) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) 1m47.612111479s ago: executing program 5 (id=4704): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) syz_clone(0x20000, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)="a3") r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') (async) syz_clone(0x640c7400, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000020030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f00000001c0)={0x5, 0x2, 0xdddd0000, 0x2000, &(0x7f0000112000/0x2000)=nil}) 1m47.174170723s ago: executing program 5 (id=4706): r0 = syz_usb_connect$sierra_net(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x43978451d8f6fedb, 0x2, 0x40, 0x2, 0x1b, 0xfe}, {0x9, 0x5, 0x7, 0x2, 0x200, 0x9, 0x77, 0x4}, {0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xf5, 0xab}}}}}}]}}, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) (async) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) (async) openat$sequencer2(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'syz_tun\x00'}) (async) mkdirat(0xffffffffffffff9c, 0x0, 0x0) (async) umount2(0x0, 0x5) r1 = socket$netlink(0x10, 0x3, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x6, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x0, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x6, 0x7, 0x4, 0x100002, 0xc3, 0x5d6, 0x0, 0x8a, 0x79, 0x2, 0x10080, 0xfffffffe, 0x83f4, 0x129, 0x1, 0x16, 0x8, 0x7, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007b, 0xffffffff, 0x1, 0x2], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x7, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x3, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x6, 0x2e6bf783, 0x80000001, 0x5, 0x40000005, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4e, 0x2000104, 0x1, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x9, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x80000000, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x2, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x2, 0x13fff, 0x1, 0x9]}, 0x45c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000000209010100000000000000000a0000040900010073797a30000000000800034000000005040002000c000480080001407fffffff0800064000000001ada65903f97d9b19f796a7505e45ef8475abe63729e8f966e29f45cf0c0b6f453a12c1091560d8ad3064d73653fc312f06a6323aaa0efe43b7729b9b4df34edfc8f3c9f0f3e7a7c4923602056e6afb465e72766787f9e30d2a09dab47898c9eb7a9b2a2496fa6ae7"], 0x40}, 0x1, 0x0, 0x0, 0x44800}, 0x4004054) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x2000000035, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xcd3, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) (async) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000240), 0x4) (async) socket$netlink(0x10, 0x3, 0x4) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFBR(r9, 0x8940, 0x0) 1m45.300069482s ago: executing program 5 (id=4716): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000700)="cf1a7a60b269e900"/20, 0x14) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x40806685, &(0x7f0000000380)={0x1, 0x3, 0x1000, 0xd2, &(0x7f0000000140)="be9bb19c1b03c69f5f9b21545dbc3f2419a28ac5a5979c969a70fb88e7ba47b04d976b53bd844199c9d26879518b5d676605adbbf73f66e5d0ca35882e47d2981a6c61cc38ac8be29aae9fdfba9a01ef3c4d8c9b544adaea907144e46e901b0d178eccdab5b1798944c382bae0b34459bada9d34e39e32dea73a6ad228fa2317df80459d2aa4ff7497bf304bf9fa74c136212b166ac38e4bcd83c01a3e17540650a42a1c8d4113152a0d04ce6466255661842bb582ce3d64b82e8a9e517f7bcaeb6a5c6b30f576fa78bb5813d16ac93ac9ff", 0x0, 0x0, 0x0}) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000208, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000020000ffffffffff000055aa00", "2809e8dbe108598948224ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac00", "90be8b1c55080000000c547d03d8a0f4bd00", [0x0, 0x6]}}) 1m45.213882795s ago: executing program 5 (id=4717): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000100)={0x30, 0x5, 0x0, {0x0, 0x0, 0xc6, 0xa}}, 0x30) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7ff, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000280)={0x1, @pix_mp={0xfffffff8, 0x93cf, 0x41565559, 0x0, 0x8, [{0x6, 0x1}, {0x9, 0x5}, {0x8, 0x3}, {0x4, 0x9}, {0x2, 0xb68a}, {0x6, 0x7ff}, {0x3, 0x2}, {0x50ad0a9a}], 0x9, 0x7f, 0x2, 0x2}}) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x41) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) modify_ldt$write2(0x11, &(0x7f0000000340)={0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}, 0x10) unshare(0x2c020400) 1m44.24315949s ago: executing program 5 (id=4722): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0xa, 0x3, 0x3a) r2 = accept4(r0, &(0x7f0000000240)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x80, 0x80800) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000300)=0x40000000) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3}, {0xa, 0x4e22, 0x0, @empty}, 0x4000, {[0x8000, 0x0, 0x1000, 0xffffffff, 0x6, 0x3, 0xfffffff8]}}, 0xb7) r4 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r4, 0xc0285628, &(0x7f0000000080)={0x3, @win={{0x7, 0x4, 0x9, 0x4}, 0x2, 0x401a, &(0x7f00000021c0)={{0x6, 0x2, 0x5, 0x40}}, 0x3317, 0x0, 0x8}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) ioctl$vim2m_VIDIOC_G_FMT(r4, 0xc0285629, &(0x7f0000000080)={0x0, @meta={0x54505356, 0xf4b83c9, 0xc4bb, 0xe663, 0xc55c324}}) bind$can_raw(r1, &(0x7f0000000000)={0x1d, r3}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB='\x00'/20, @ANYRES32, @ANYRESDEC=r4], 0x48}}, 0x20040094) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x5c, 0x2, 0x6, 0x1, 0x6000006, 0x1c02, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0xfe}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x21c}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x5c}, 0x1, 0x0, 0x0, 0xc8c5}, 0x0) 1m44.020945274s ago: executing program 5 (id=4723): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newtfilter={0x34, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0x4}}]}, 0x34}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_BEACONS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x20, r5, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@void, @void, @val={0xc, 0x99, {0x5, 0xa}}}}, ["", ""]}, 0x20}, 0x1, 0x0, 0x0, 0xc000}, 0x4) r6 = socket(0x28, 0x5, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x1c, 0x2f, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}, @typed={0x4, 0x1f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x10) setsockopt$sock_linger(r6, 0x1, 0x3c, 0x0, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)=ANY=[@ANYBLOB="58010000100013070000000000000000fc020000000000000000000000000001fe8000000000000000000000000000aa00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141417000000000000000000000000002004d533000000e000000100000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000220000000000000000000000000000000200000000000000000000005c001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000003509fe8fd57fd44aa5074c50bc700e530c001c00", @ANYRES32=0x0, @ANYBLOB="06"], 0x158}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 1m43.885335208s ago: executing program 33 (id=4723): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newtfilter={0x34, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0x4}}]}, 0x34}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_BEACONS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x20, r5, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@void, @void, @val={0xc, 0x99, {0x5, 0xa}}}}, ["", ""]}, 0x20}, 0x1, 0x0, 0x0, 0xc000}, 0x4) r6 = socket(0x28, 0x5, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x1c, 0x2f, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}, @typed={0x4, 0x1f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x10) setsockopt$sock_linger(r6, 0x1, 0x3c, 0x0, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)=ANY=[@ANYBLOB="58010000100013070000000000000000fc020000000000000000000000000001fe8000000000000000000000000000aa00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141417000000000000000000000000002004d533000000e000000100000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000220000000000000000000000000000000200000000000000000000005c001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000003509fe8fd57fd44aa5074c50bc700e530c001c00", @ANYRES32=0x0, @ANYBLOB="06"], 0x158}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 24.263834655s ago: executing program 6 (id=5127): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) shutdown(r0, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x7c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x4c, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0x17}, @NFTA_INNER_EXPR={0x18, 0x5, 0x0, 0x1, @immediate={{0xe}, @val={0x4}}}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x82}, @NFTA_INNER_NUM={0x8}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xa4}, 0x1, 0x0, 0x0, 0x8894}, 0x24000000) pselect6(0x40, &(0x7f0000000840)={0x7, 0x1ff, 0x4, 0x7, 0x1, 0x8, 0x5, 0x9}, 0x0, &(0x7f00000008c0)={0x9, 0x9, 0x401, 0x9, 0x6, 0x8000000000000001, 0xa94f, 0x2}, &(0x7f0000000900), 0x0) 23.623001832s ago: executing program 6 (id=5130): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@ipv6_newrule={0x24, 0x20, 0x1, 0x70bd2d, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x3, 0x2801e}, [@FIB_RULE_POLICY=@FRA_IP_PROTO={0x5, 0x16, 0x1d}]}, 0x24}}, 0x480d0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000a00)=ANY=[@ANYBLOB="5c0000001000390400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b000100697036746e6c00002c00028014000300200100000000faffffffffffffff000114000200fc"], 0x5c}, 0x1, 0x0, 0x0, 0x50}, 0x0) (fail_nth: 8) 23.0054104s ago: executing program 6 (id=5133): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg(r1, 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000001b40)=[r1, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0xa) 22.627970477s ago: executing program 6 (id=5134): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x8020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0xf, 0x0, 0x100000}, 0x20) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r3, &(0x7f0000001d80)='.\x00', 0x8000, &(0x7f0000001dc0)={0x89, 0x0, 0x80000}, 0x20) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) ioctl$XFS_IOC_FSGEOMETRY(r4, 0x8100587e, &(0x7f00000001c0)) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000040)={0x54, 0xe, 0x3, "3205c576e8b41e000000000000000020000000000000001a00", 0x32315559}) 21.547296546s ago: executing program 6 (id=5139): ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000040)={0x3, 0x8, 0x80, "55ac07d4c7e2d1870000060000000000200000000000000200", 0x56544943}) capset(0x0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x4, 0x94}) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000140)=@ethtool_cmd={0x0, 0x0, 0x3, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x45}}) r1 = socket$kcm(0xa, 0x2, 0x73) sendmsg$inet(r1, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0xfc00, @multicast2}, 0x10, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e02721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0x1000}], 0x1, &(0x7f00000010c0)=[@ip_tos_int={{0x14, 0x29, 0xb, 0xfc00}}, @ip_tos_u8={{0x11, 0x29, 0x4}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @remote}}}], 0x50}, 0x0) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0xa0201, 0x0) r3 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x40003, 0x12f}, &(0x7f00000002c0)=0x0, &(0x7f0000000140)=0x0, &(0x7f00000003c0)=0x0) syz_clone3(&(0x7f00000012c0)={0x101000280, 0x0, 0x0, 0x0, {0x33}, &(0x7f0000000480)=""/220, 0xdc, 0x0, 0x0}, 0x58) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, &(0x7f0000000240)=0x9) r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r7, &(0x7f0000000280)=ANY=[@ANYBLOB='lock io'], 0xc) write$vga_arbiter(r7, &(0x7f0000000180)=@other={'unlock', ' ', 'io'}, 0xa) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000011c0), 0x2, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x35) syz_emit_ethernet(0x76, &(0x7f0000000300)=ANY=[@ANYBLOB="ffffffffffff00000000000086dd60f4a30000403a01fe8000000000000000000000000000bbff02000000000000000000000000000104009078008000066cf6cd5302002cff20010000000000200000000000000002fe8000000000000000000000000000aa2f0000010000000013d86558da0a7f6b2f2832b53310d40761992cfcd9615dc3df1e4b488d208f59fdf9d2d1f7a066101c7b5c3bf70025e846fee7f77012f20c5c91476a835a57ec6064d0eb0a23efa366b4653e6752cbaa"], 0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r3, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) write$dsp(r2, &(0x7f0000000040)="c7", 0x1) ioctl$SOUND_MIXER_READ_RECMASK(r2, 0x80044dfd, &(0x7f0000001140)) ioctl$SNDCTL_DSP_SYNC(r2, 0x5001, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r2, 0x800c5012, &(0x7f0000000100)) 20.915670156s ago: executing program 6 (id=5143): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3801000010000100fdffffbf00010000e000000200000000000000000000000000000000000000000000ffff7f000001000320003c00"/64, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="7f000001000000000000000000000000000004d46c0000007f000001000000001400000000000000000000000000000009000000000000000600000000000000ffff0000000000001c25080000000000020000000000000083000000000000002b06000000000000fcffffffffffffffff7f0000000000001f00000000000000ff0100000000000006000000fcffffff000000002abd700000000000020000fd2000000000000000480003006465666c617465"], 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x20000810) 10.407184588s ago: executing program 4 (id=5175): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x37) listen(r0, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x3f00) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x9901) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x89901) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x80000, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r4, r4, &(0x7f0000000000)=0x2eb4, 0x80000002000007ff) io_uring_setup(0x6749, &(0x7f0000000380)={0x0, 0xe58f, 0x4000, 0x2, 0x1db, 0x0, r3}) r5 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) ioctl$PTP_PEROUT_REQUEST2(r6, 0x40383d0c, &(0x7f0000000080)={{0x81, 0x7}, {0x5, 0xff32}, 0x6}) r7 = openat$binfmt(0xffffffffffffff9c, r5, 0x42, 0x1ff) close(r7) execveat$binfmt(0xffffffffffffff9c, r5, 0x0, 0x0, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0xfffffffbfffffdfd, 0x2a00) 7.738337501s ago: executing program 4 (id=5182): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c00000010000700"/20, @ANYRES32=0x0, @ANYBLOB="04010100010a0000140003007866726d30000000000000000000000008000a00", @ANYRES32=r1, @ANYBLOB="16e845f124ad9624db0052508cb41193fb8020b2b37e5af4607aab61080b7ca9a23d7a817b016fa17d43af"], 0x3c}}, 0x0) 7.178799078s ago: executing program 4 (id=5185): fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x1) r0 = socket$vsock_stream(0x28, 0x1, 0x0) fgetxattr(r0, &(0x7f0000000000)=ANY=[], 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) sendmsg$unix(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000000c0)="10", 0xfffffffe}], 0x1, &(0x7f00000004c0)=[@rights={{0x14, 0x1, 0x1, [r1]}}], 0x18}, 0x8841) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_dev$sg(&(0x7f00000002c0), 0xe6, 0x42403) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000400)=0x4000000) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f00000005c0)={0x1, 0x0, [{0xb3d6f7a7dc543318, 0x45, &(0x7f0000000480)=""/69}]}) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af04, &(0x7f0000000200)) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0xffff, 0x5}, 0x8) r6 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f0000000200)={&(0x7f0000001340)=@caif=@dgm={0x25, 0x7, 0xa}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000000)='G', 0x28}], 0x1}, 0x200480c0) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x380000f, 0x12, r3, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c01000016000104fdffffff00000000fc020000000000000000000000000001ac14142f00000000000000000000000000040000000000000000c02000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000102000000033000000ffffffff0000000000000000000000000400000000000000feffffffffffffff0500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000200000000009697acf33a3eb734000003000000feffffff0000000000000000900000000000000008000000fdffffff1c0017000000000029bd700029bd700026bd70002cbd7000060000000800270009000000"], 0x11c}}, 0x4808) syz_usb_connect$uac1(0x2, 0xaa, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902980003010000000904000000010100000a2401000000020102132406040006030000000000000000000000000924030000010000ff0924050000f8431cfd0924030604030204001b240404020904", @ANYBLOB="0abbf59326"], 0x0) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f0000000080)=0x3) syz_open_dev$tty1(0xc, 0x4, 0x1) 6.647930846s ago: executing program 1 (id=5187): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="010000000c000000faff000007"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000004c0), &(0x7f0000000400), 0x3f, r0}, 0x38) (fail_nth: 52) 6.297011874s ago: executing program 1 (id=5189): openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) syz_clone3(&(0x7f00000000c0)={0x200000400, 0x0, 0x0, 0x0, {0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, {r0}}, 0x58) r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x46d, 0xc294, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x21, "", [{{0x9, 0x4, 0x0, 0xa8, 0x3, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x26}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0xf, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000140)={0x2c, &(0x7f00000001c0)=ANY=[@ANYBLOB='@!&'], 0x0, 0x0, 0x0, 0x0}, 0x0) 5.907989837s ago: executing program 2 (id=5190): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@ipv6_newrule={0x24, 0x20, 0x1, 0x70bd2d, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x3, 0x2801e}, [@FIB_RULE_POLICY=@FRA_IP_PROTO={0x5, 0x16, 0x1d}]}, 0x24}}, 0x480d0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000a00)=ANY=[@ANYBLOB="5c0000001000390400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b000100697036746e6c00002c00028014000300200100000000faffffffffffffff000114000200fc"], 0x5c}, 0x1, 0x0, 0x0, 0x50}, 0x0) (fail_nth: 14) 5.483375346s ago: executing program 2 (id=5192): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x9, 0x8, 0x0, 0x7, 0x9, 0x100, 0x3, 0x1}, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f0000000300)='fd', 0x0, r0) read$FUSE(0xffffffffffffffff, &(0x7f00000009c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) sched_getattr(r2, &(0x7f0000000100)={0x38}, 0x10, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) r3 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x2) readv(r3, &(0x7f0000000980)=[{&(0x7f0000000000)=""/58, 0x3a}], 0x1) 4.629208132s ago: executing program 2 (id=5195): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0xf5ff, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000851}, 0x24044010) 4.316610118s ago: executing program 2 (id=5196): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') preadv(r1, &(0x7f0000000200)=[{&(0x7f0000000340)=""/127, 0x7f}], 0x1, 0x4f, 0x0) (async, rerun: 32) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r4, 0x11, 0x67, &(0x7f0000000000)=0x507, 0x4) (async, rerun: 64) socket$can_raw(0x1d, 0x3, 0x1) (async, rerun: 64) bpf$MAP_CREATE(0x0, 0x0, 0x50) (async) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r5, &(0x7f0000000000)={0x2, 0x4e23, 0x7f, @rand_addr=' \x01\x00', 0x4}, 0x1c) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac710aa7d0000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) (async) syz_open_dev$sg(0x0, 0x0, 0x40100) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) (async, rerun: 32) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async, rerun: 32) r7 = socket$netlink(0x10, 0x3, 0x4) preadv(0xffffffffffffffff, &(0x7f0000002240)=[{&(0x7f0000000680)=""/15, 0xf}, {&(0x7f00000006c0)=""/63, 0x3f}, {&(0x7f0000000700)=""/124, 0x7c}, {&(0x7f0000001240)=""/4096, 0x1000}], 0x10000000000000af, 0x0, 0x0) (async) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={0xffffffffffffffff, 0x0, &(0x7f0000000640)=""/13, 0x2}, 0x20) r8 = socket$netlink(0x10, 0x3, 0x0) writev(r8, &(0x7f00000003c0), 0x0) (async) sendto$inet(r4, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440606769ebdf12cfacae8e8c03f5db079da7d9ecda75e2a7d49d5cbcb370c4d789390a328ba42c9c60cf2154d1b659aa709e8980a522cfb72f23ad87fb7019706ccae98cfe7c4fd23e8297b8cabc46ede1ac3da78f1b488c6357e7edfcd417df6660af20a54ecdcb02f689ae15ee655d4b7b1ea733e88ee9f53669388dff487c1c49953f3bc142112bd4b582b29b35d43962ed245c2cd5d5df40a3e0ed6beaf3b641e84b0f0dfa121a9efe05269f9f4a0e9bcbf43c7a90a711f453668c730c3badedca687b71a9c27bab9e724cc4a4918713031596ea6fd01124f973f257ccd9665aee7df4a9d64f079d176abc00000000d7af3e2dd4396f72373fb0a787a6129ca41181f5087fb843212550b58e3707d5a0399de36c2503836cbe2133de4f574e9e05c96788b0de1bd13e390445433d96737b964fa8af2ac4b2f0f9390ca93d8d3d810044d024359e067c4553230ab748947d33f8fc115ce9a49e6571c45a05d786cbd49342c236537dbbeec666b07baab917252113a5b9a77283189b518f356debe42d80cf2d0687b9c64d0253a6a09286fded6e4f8557b8fb4f25ca4fb138af8945c74bbc98748eaaa030be5317646f195e6e085ac6ddb29542e3581961259987241f7e7061526a7afec8962e74215fea43703a4e543ee9d1a3c3f5f2a41977ece8fdadcf89ce331ce59bebae5f53513d0e10485d7ddbda60513bf339602510b3a23ea29a0d5d03a61e34d12942ea4a847c884b27b5344a456d02a55f8929cc567e7c792c01fab7a7b32780a14c361000609b817dd91507b04d875279527946fdb8fb92a512485e234d092c28f1d0a0498731ccc0eb10515d510e8945839307b46512ceca6f495fdd2c6ae5eb2ef3b2a40ebdc7edf0048e3fb5e3d97a9ea5113a6b70d20ad5c43f0df95d88c0f121a1884da21a21f0ba47420f8391a97921cc51871dbb272e43710fe71d5e342c3afd10608a8b02f00e8fbd8d570b6faace86c494ecea8913233391e7b7cec3d571bb3032181ed58e1b513e511f79ee562c8cde9b3b74c2e95dcde7fadb5a666bdc0c1684794620ce8cf0c0aee8e90b3ef6e7160d3f055cb4d1ced32e4edc15e7d102952d3237e6c02c591a95a182bf190c0124abc7f1225332ff1c5e1b94e4e9bf02c1a18bd7bfce20707f7298da322560bc1a4cf298d46f5bf8ff41da21e25aa17f65f9ee43ca890b5ef6a3ccf3efedf3ca60a9acef1352ad0c43e6cf375108cf0974ce89a99adba7e6a3f8949dc573440fafe0e3abdd0066057a2d868e8386080f18a421568d8e7a89536a4173861bd55245c8fcf7dcba18edce36d2e85b9630fbc218db9ebd16abb11ac06fdbf2bc3e6394d4c6e7ae71813d30772d487743a2856348fee09989ce03331e7848770fc91e62191c20fe5f4a73c5dae467dd612bdb63b1e50921d38271305d7412103d5a6214d6d534d1d530b9169f882b6926bbd338f0282a8bd9a44603934e5249e83f1d0947b39f82a7843d2b6f796d8abf7ff3e66cfd4519324d71cebbf6580dffc10d555e479e9acaa12c3c59e3732c181aa4223d0fcdac514e9d7c7963c2634964520286b028f60a4ae612b8e6049315139e884cbffd6836253094ad023329183496cf663366ad4d7f7f5f1bd2db9b0d33f106c041fba4494c7da404d45d8955e5459ca4a62862721ec1fa534fd95e262c5814426816e60000000000000000001aa4fb6f40ec24f42f6949cc28d2a0d4eb61cb1664627582d962523586539445b81e9759321652280ecb", 0xffe3, 0x6000000000000000, 0x0, 0x0) 4.181140367s ago: executing program 1 (id=5197): ptrace(0x10, 0x0) (async) r0 = syz_clone(0x11080000, &(0x7f0000000000)="73534cf1de6b54aed81d736721fe8e12ed2aacb052a5e45db25b97890d9dbc8c1fcc6ef70cb4e4e654dff6b29f76afb9b153390f6aedf151971f275189092939d6b16754b03ebd56d5f6381b924f2c9f9e205699bd12703e4e6b6cbe548a7e8363c909d10ce621702c72c42f89a55f0fcdd2eabc267dbfe571eac44d4ad0de255da5e497cd149fc21cdd4a39bcf44286fe7decca75c659e9bfc0dbe945ee802f7c0ee8140ace2d9ef5e1822da3d89cf68f35e38fd4b171e77c51212d472d51576611f241f753e5a81933597d397709bab53d8eb3fe", 0xd5, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)="cbdb6a35a1d520c4b6362ce566a8e73f1ed9588e75230d2b8fc4632801a6778efe573fecf7a45a9d171fb66ea601a9a8a8bfb03c8fdd4da1124899ca506cb3f493a723876815da68a95b11030da62c9dfecd8754bf36dd0d59ba8e9ca5c2f695098f69b0e82bddc0a8ee46a865a7cca539d726b414146854e71c9725a34f5f6b8b2c10c326b13470d1aa70f40e87952724530f8701da275ab0691ad48b1222317a1d6b79a44a3f7d2966f67c1e1eb5eb81a87e2e4a8cdd443b7851d81018f0cb00b0c5c143d113e3") sched_getparam(r0, &(0x7f0000000280)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f00000005c0), 0x10703, 0x0) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000600), 0x541881, 0x0) (async) socketpair(0x15, 0x6, 0xd5c8, &(0x7f0000000640)={0xffffffffffffffff}) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680), 0x91000, 0x0) (async) r6 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) (async) r7 = socket$key(0xf, 0x3, 0x2) (async) r8 = socket$tipc(0x1e, 0x2, 0x0) r9 = syz_io_uring_setup(0x1a8f, &(0x7f0000000700)={0x0, 0xf88b, 0x200, 0x1, 0x24b}, &(0x7f0000000780), &(0x7f00000007c0), &(0x7f0000000800)) (async) r10 = signalfd(0xffffffffffffffff, &(0x7f0000000840)={[0x5]}, 0x8) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000880)={0x1, 0xffffffffffffffff}, 0x4) (async) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=@base={0x0, 0x1, 0x5, 0x5195, 0x1, 0xffffffffffffffff, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x3}, 0x50) r13 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000980)={0x4, 0x9, {r0}, {0xee00}, 0xa4e, 0x3}) (async) read$FUSE(0xffffffffffffffff, &(0x7f00000009c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000002a00)={0x2020, 0x0, 0x0, 0x0}, 0x2020) (async) r17 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000004a40)=0xffffffffffffffff, 0x4) (async) r18 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) r19 = openat$vnet(0xffffffffffffff9c, &(0x7f0000004a80), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000004ac0)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r21 = syz_open_dev$ptys(0xc, 0x3, 0x0) r22 = syz_open_pts(0xffffffffffffffff, 0x80000) (async) r23 = openat$panthor(0xffffffffffffff9c, &(0x7f0000004b00), 0x2, 0x0) (async) r24 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000004e80)=@bpf_ext={0x1c, 0x27, &(0x7f0000004b40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3ff}, {}, {}, [@call={0x85, 0x0, 0x0, 0x2f}, @map_val={0x18, 0x7, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x18}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8001}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @jmp={0x5, 0x1, 0xa, 0xa, 0x3, 0x40, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000004c80)='syzkaller\x00', 0x81, 0x5f, &(0x7f0000004cc0)=""/95, 0x40f00, 0x75, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000004d40)={0x9, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x12632, 0xffffffffffffffff, 0xa, &(0x7f0000004d80)=[0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000004dc0)=[{0x5, 0x5, 0x3, 0x7}, {0x2, 0x3, 0x3, 0x3}, {0x3, 0x3, 0x8, 0x5}, {0x4, 0x1, 0xc, 0xa}, {0x1, 0x5, 0xf, 0x3}, {0x3, 0x3, 0xb, 0x1}, {0x1, 0x5, 0x1, 0x9}, {0x0, 0x5, 0xc, 0x9}, {0x4, 0x3, 0x6, 0x1}, {0x2, 0x1, 0x5, 0x9}], 0x10, 0x4}, 0x94) r25 = getuid() (async) stat(&(0x7f0000004f40)='./file0\x00', &(0x7f0000004f80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r1, &(0x7f0000008d80)=[{{&(0x7f0000000300)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000580)=[{&(0x7f0000000380)="64ae1d25a40d6056", 0x8}, {&(0x7f00000003c0)="8b9a6102c50d09f20f070b7f3d9681a0b6c7132b7f5e17f6cca5f3d4e8400cfa986ac7d6cef6d28ff7b3878365b71360088ed1d885aafa6cd24ac5b06cf3e250805370996d9ac7fb4fe8227a6576454ea9b493b853b9419c297d4b7783980a07d405031e7660951da977eb8b94337fe555c445749519f3d803dd44cf00ca65d7311056b6457fec3857a7b10f0f681a3ec73b6888040fa40d43a8a078e5253f475efc572047b46cf3d97fea", 0xab}, {&(0x7f0000000480)="97b37a7dd812e140f709855a131d181afaf92f7ca005e60b0f0683a0cfd0b753b6171beddfa5894fd547a0f7e8e15392feb282f31fa1f7e25187406569299248121c57953917f6b27357242b022ca2505c3c89590e23fb8624948e10695aab26f81b09307ff8cfdaadcc0fec52453c31d8079e33b4dea046b801b58d80dc19d6c03b76a753dce09d247084d835b5273d530af03d7261ad361be2e9236bf3f8", 0x9f}, {&(0x7f0000000540)="b79245b291c07f701582419fb4dd7f0003e74247b61e820c7893b2ec4da45cc13e01ea6ac65d9fb3f7010660afa25f0fa9b9ed471b0ca8f13042", 0x3a}], 0x4, &(0x7f0000005040)=[@rights={{0x2c, 0x1, 0x1, [r2, 0xffffffffffffffff, r3, r4, r5, r6, r7]}}, @rights={{0x2c, 0x1, 0x1, [r8, r9, r10, r11, r12, 0xffffffffffffffff, r13]}}, @cred={{0x1c, 0x1, 0x2, {r0, r14, r15}}}, @cred={{0x1c, 0x1, 0x2, {r0, r16, 0xffffffffffffffff}}}, @rights={{0x28, 0x1, 0x1, [r17, r18, 0xffffffffffffffff, r19, r20, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [r21, r22, r23, r24]}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r25, r26}}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x120, 0x4000051}}, {{&(0x7f0000005180)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000057c0)=[{&(0x7f0000005200)="e9f7f6336c113d2dff8f2c014a0d5a8bbffba498579dc2faafbd1975900e4889cae95545206cb9ca43bf0819a73061bbb0bcadf185f1977048bea92c878229b4184545bd29cbf8cc3c8b665074e58b3ac3b1dbb6d0a8b248c47acc499cfa3b85ef7afb41045ff8fac193ee58eef3c2a61a20601b008cafda5f6ad5cc607d2f78593505b49742806a7e96775f6edd8d6ffb4c3f7d7629a4e91fb5ac1371c2bcb9368caa10067128929a58102b16900b9e186051aaca20bd96b6b775f1e9de1e7b30d7495a82310a841b248157f02814a256253f35ef19c1c76aad8fc12782a28386001cb6d12f12e109a93a850d4e9fae9790", 0xf2}, {&(0x7f0000005300)="4d9502c8b6b6ba81ae786fff2f7a3c41c99b3bdfb3821ddfc0a2fe72d65aae27cd8e252ea2d5274c0198fd25bc4a23f27908bbd5c5007ef09f2e21382a90bf661caba838e72b03df55166a5a3c00a32aaef5b1f53fb22f38c2159ba1d941bbc5ab211d2b4b3062cec1fb79e7f96bd18fdf87fcd0d691c57712180dea35a0a740977c80d12d9ffb57d92c890f3ee4e9c6457b6f2a868f7fe6c0c10faf8e63e8a0c874cd72cc50baef10e50090d0013f168c87f08ba25d741312", 0xb9}, {&(0x7f00000053c0)="938035385d7265550d7624998bdb952d89faa33cec2066b11046270688952080a42ac36b34bae96f9f6c060a070086c019441653e585db5ebbab2936ae494493ff68f2eea0b4bcb661859699b7eb64b8c463204306791f9359150eb98cebdf340ee9a67377cd9477e2101fc6847612af127cc617c9c13c1ebdc84e6012c8258ab09deb929c", 0x85}, {&(0x7f0000005480)="bc2945397c1233684e4cb2f3ec579aa5e3a6027b9ab804d3c99221ccad5a6cb9114d443327b4ff93980daecd02d920ad574c7a70284cba758c91c26f51da36b9e94b21d4bf9be2f7407ac114f962c040da47462cb995dc45bc2f69da5eb6c32dd3b316011075d954f44b8db49995b158d81dc4a07b4aa9b16b87d1e7c9d44b6b58ebf96e4f98460481d48494305833f9446565185b32f5b68ea4fb2fecc780d186dda6a43601ee568658c206eb9f3980e6fedae39877fcd3ff97", 0xba}, {&(0x7f0000005540)="cfa5910ace1decf26880d13d106f6317334f15c68c9c26a55603c40a6e2d41019d2fd6094bfeedd8071cb67d686bd87dfce8b9f9390148db27cc38ef476ce0d9902ce9ad7ff0d102964e25a7666e1aa47ed405f4413793d82ba9c4c849060088ef1f515b9e28b0f30ab7344e06d3ea68e8391f3c2f2c04d52526d5ed46357b5b2807c3827f987c08267277c0af833c770cb0fbba683cc102e1d40d87ffe1ddbfa29aa76bdd269c4224ef1846605a17d010ac03df02ecd817ab17b296af1138d5b7c1fc893beb859bf531a21c3d17b16ec6a522fc1d630c865c827ba529141b11b129619840bd3f44e542349a776b40aa5bf1066105c367", 0xf7}, {&(0x7f0000005640)="7db96ef98b7ab91106d1a1eeebc99808cdd43fad48c7e85a47ef7fe230437ced13517348ccd67c885d8beb2628013b838cbeadab1a61674e401c30528782f988c0e141d49f93676b8726ff43084962e7e67c069b5165b5eee795d7b69e1a46294e8e99550ecf6134368b8adbef7e3ce46e27e98c0d79a88279666958b59bd23ec61df4794bb8fd601b305bf6b17ae8d53952b45efe3d9746c58bd1dfaa442eb02214ab422007d3c76c25ffa1b8d33649", 0xb0}, {&(0x7f0000005700)="f3ce345a477e4e6d58c15447f7b9aa682d07723ccabd502336138d163eafc0447d1411f564194804ac14d2566bbe33dfac688ba57f8e6e1ef222", 0x3a}, {&(0x7f0000005740)="c3f6663d0e7dd1f103a8df6c76d4212bfe630351caf66e89c5ba7707d3dd3e9aa4c8462392212b12ea2495416a3572497355a626771d1353b233e9ee31c88a806ee7d60879240976cdc2f103825af7f11231b9dc", 0x54}], 0x8, &(0x7f00000082c0)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r0}}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {r0}}}, @cred={{0x1c, 0x1, 0x2, {r0, 0x0, 0xee00}}}, @cred={{0x1c, 0x1, 0x2, {r0}}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r0}}}], 0x150, 0x8001}}, {{0x0, 0x0, &(0x7f0000008580)=[{&(0x7f0000008440)="e23abd51a46ec3b99ddee20efc8bd50b70eb1d5114ed79f60469929b8f8fdb67f1f67b98a212e2b4087a69ddb750a0a450ed8b3bf74e34df221ebdfc69b04da29d20cf2e861f67c9ab90a563963fe322eddd60973ef3e96caaabaddb4078781f516d2fcd075e929f754b7954910e44c2672c4505b0de3c74bb3369a7abd511af3104347707ca8fa3215840d141dfee4cd3b4becdd78bf70a9194b7b6c8772786175da2cd927764a5e972a8c50121062f11ad49ab1cbe06b507eb15d46efe748b8466f27723bf5a5acc583643f1659d977500cff855", 0xd5}, {&(0x7f0000008540)="472f255f0b30513264cd029ab23ee9855cdb71", 0x13}], 0x2, &(0x7f0000008900)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x88, 0x20004880}}, {{&(0x7f00000089c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000008a80)=[{&(0x7f0000008a40)="476c75381f254588dd8714385be7f42a725f024138f2a01e11047f61879c2f85c8352b59460aaf7c690aabea", 0x2c}], 0x1, &(0x7f0000008d00)=[@cred={{0x1c, 0x1, 0x2, {r0}}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50, 0x40080}}], 0x4, 0xc000) 3.911635947s ago: executing program 1 (id=5198): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e24, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg(r0, &(0x7f0000002280)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000500)="9f", 0xfffe}], 0x1, &(0x7f0000000800)=ANY=[@ANYBLOB="10000000000000000f010000000000003000000000000000ff00000005000000dae7c65afdd9d1d5073fbf984e560f7f7af0377a701ad4e8ab3a00000000000090000000000000000000000004000a78474995282b8d35b2efb349cfa55288ab0139064c723f71e2d9ced0cbb2d46df48f8ee505b82850c69ed841ec12c3b6392c378033c46278ff6bc63d6d5bf4c8b718e78b05ad817aac3b5239cd4fe877aff14721f369a8fb6e6daa5710be61d3edc36edbd248ee581a70263663739cac6a0b0dc55ac9b2f56dc43f04dc78a3000058"], 0x128}}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000340)="94", 0x1}], 0x1, &(0x7f0000002040)=ANY=[], 0x10}}], 0x2, 0x4000045) 3.747797204s ago: executing program 4 (id=5200): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000700)="cf1a7a60b269e900"/20, 0x14) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x40806685, &(0x7f0000000380)={0x1, 0x3, 0x1000, 0xd2, &(0x7f0000000140)="be9bb19c1b03c69f5f9b21545dbc3f2419a28ac5a5979c969a70fb88e7ba47b04d976b53bd844199c9d26879518b5d676605adbbf73f66e5d0ca35882e47d2981a6c61cc38ac8be29aae9fdfba9a01ef3c4d8c9b544adaea907144e46e901b0d178eccdab5b1798944c382bae0b34459bada9d34e39e32dea73a6ad228fa2317df80459d2aa4ff7497bf304bf9fa74c136212b166ac38e4bcd83c01a3e17540650a42a1c8d4113152a0d04ce6466255661842bb582ce3d64b82e8a9e517f7bcaeb6a5c6b30f576fa78bb5813d16ac93ac9ff", 0x0, 0x0, 0x0}) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000208, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000020000ffffffffff0000000000000000001200", "2809e8dbe108598948224ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac00", "90be8b1c55080000000c547d03d8a0f4bd00", [0x0, 0x6]}}) 3.643700232s ago: executing program 1 (id=5201): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x5) mmap(&(0x7f0000f02000/0x3000)=nil, 0x3000, 0x300000b, 0x204033, 0xffffffffffffffff, 0xec776000) socket$vsock_stream(0x28, 0x1, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x6d, 0xfffffffffffffffe, 0xfffffe0000000001, 0xda11, 0x90000000}, 0x0) unshare(0x42060680) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x40500, 0x0) ioctl$PTP_EXTTS_REQUEST(r2, 0x40103d02, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000000406010300000000000000000500000805000100070000eca777215e4970a1310000000005871a5b3c55a2036b3490585c8680d4b90f1c3ed86347cb095d855e535e8551c5e04cf293080401c8c49835ef06562f55db747575e3fe1c0f65c6a0ac39891ddac621f9bd3cbf328be4e17c86a5259ec1a6047bbf319f921e8fda1750034a2203b596e2fc59496e0e879997f964597aacc05792ab67cf827cb08efa5c5bd437de531d72f775265d29cfb0a33b436fd1ac72246a98f4305d1babfaf3a8fce40f1be2bda116b1d34e47473f39aa995a813a710dae914618c4d6fe5ba44aca3e0570dd32977ed521baedf6801196e24f18640f84add06d5a3d091db19c0afcfc4fe365e11e5c9b82d02b079c934b9324386f08f8f13b68e630f47ac96b480f"], 0x28}, 0x1, 0x0, 0x0, 0x408c0}, 0x4000000) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0x4000000a00}) fsopen(0x0, 0x0) socket(0x11, 0x0, 0xc) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)=0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00'}) timer_settime(r5, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0x80, 0x2, 0x0, 0x0, 0xffffeffa) r7 = userfaultfd(0x801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x18) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f00004b2000/0x400000)=nil) ioctl$UFFDIO_CONTINUE(r7, 0xc020aa07, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) 3.400454717s ago: executing program 4 (id=5203): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000080)='.pending_reads\x00', 0x4040, 0x34) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000800)=ANY=[@ANYBLOB="540000001000010428bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="8884010000000000340012800b00010067656e657665000024000280040006000500090001000000140006fffd00"/60], 0x54}, 0x1, 0x0, 0x0, 0x2000c830}, 0x4080) 2.618436941s ago: executing program 3 (id=5204): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000001c0)="995adea9cb8cbb9cd6231b18ea98b82f77911ba8bdae80fceb2b013f94969bf5bb42373692b95bfbd9d9f8165139bfad2822954f7b21af825a551f8e6842cce81f2311e31797d06bff10c52f4290e0ec4e61b5a35e01e09e6a9003a2f3157f70615aacf7ffc5694271b2e5a9722bc053b7fc91", 0x73, 0xfffffffffffffff8) r4 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ipv6_route\x00') read$FUSE(r4, &(0x7f00000061c0)={0x2020}, 0x2020) pread64(r4, &(0x7f0000003b00)=""/195, 0xc3, 0x591f) read$FUSE(r4, &(0x7f0000001300)={0x2020}, 0x2020) r5 = add_key(&(0x7f0000000240)='cifs.spnego\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f0000000340)="cce3d8f7906b5668c08f0b2c1337a07475f9e88c2f3cb0cee50fa1a7837666e630a901aa603bc775a76873502c9111d659b5ac8e9c3221c22a0eb8e2ebdf48c445df878b5657cc33631628838f128f9d509e1502b31471ce93ee5907f0accf60730c543246ed69905edf0461823ea117afe1df499af7718d9975baabca2ee5377d3ef1d022557daffb717b8793b17d43606d917ade23a4a422c03b11e664a1cb22699d55f10be69a5dab5b71ac144433ecbd2d4a8b4f8ed3d42221b2647a28c326c736bf", 0xc4, 0xfffffffffffffffe) mount_setattr(0xffffffffffffff9c, 0x0, 0x100, &(0x7f0000000000)={0x1000f2, 0x102, 0x20000}, 0x20) r6 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r7 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r6) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000180)={r7, 0x0, 0x600}, &(0x7f00000008c0)=ANY=[@ANYBLOB="656e633d706b63733120686173683d6d6435000000000000000000000000000000000000000000000000000000000000002900000000000000000000000000000000000000000000000000000000005419a81690ced2afb3b3671179dec10e8b6ec46acf736d6a6ee1dae1b129b3133ee3fd0d814b0fb404a252391712779801b6fcd84cd616beecbaa395fd12ad3f61616d80a32efc376a9a5a604a70c66e3f1a8af566eef1011da266c190e84c2dd71bd27b876413619f96190cf24aa410b482e4e249ff91dce19be4103442c377429d3ffa9851ce6003edfad3f6e13c704a9a60617bbce2519f1bf5414b67d37b3fba901382d9d5730cf8516aadae707b0c3aab462bac967a4726770e827a00bf019112a9aaf73dcf9023b725add4190d01226de7a21ebc19333350e1da90b35a211dbe08b9ac6ce5c0ce"], 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, &(0x7f0000000a00)='ceph\x00', 0x0) keyctl$dh_compute(0x17, &(0x7f0000000440)={r3, r5, r7}, &(0x7f0000000480)=""/89, 0x59, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20040084) r8 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000007c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x5, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1fb7e}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x9, 0x8, 0xfffffffd, 0x526}, 0xd7}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x4894}, 0x42) 2.244732661s ago: executing program 3 (id=5205): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7000000f8004000bfa300000000000007030000f8ffffff7a0af0fff8ffffff71a4f0ff000000002d040200000000001d400200000000004604000001ed000062030000000000001d440000000000007a0a00fe00ffffffc3030000f1000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0465f2f994114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840b08000000f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e82623951743283070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00a5b4f7e9ad0500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0xffffffffffffffb7, 0x10, &(0x7f0000000000)={0x0, 0x3}, 0xfffffffffffffd64, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x19}, 0x48) 1.984880032s ago: executing program 3 (id=5206): syz_usb_connect(0x0, 0x24, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x1f, &(0x7f0000001680)=""/193, &(0x7f0000000180)=0xc1) (fail_nth: 5) 1.358592193s ago: executing program 3 (id=5207): socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f00000001c0)={0x0, 0x80000, 0xffffffffffffffff}) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000280)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000180)={0x0, 0x0, r3, 0x0}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r2, 0xc01864b0, &(0x7f0000000000)={r3, r4, 0x1, 0x0, 0xd4}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r1, 0xc01864b0, &(0x7f0000000200)={0x0, r4, 0xe, 0x3, 0x1}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000280)={r4, 0x6, 0x0, 0x4, 0x3, [], [0x6, 0x10001, 0x5, 0x3], [0x3, 0x4, 0x8001, 0x3], [0x3, 0x179, 0xffff, 0x80000000]}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=@newtfilter={0x24, 0x11, 0xd27, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x74, r7, {0x4, 0xfff2}, {0xafabc05531515610, 0xd}, {0x8, 0x2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x1c005}, 0x24048004) r8 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x44, 0x10, 0x1, 0x70bd29, 0x259fdbfd, {0x0, 0x0, 0x0, 0x0, 0x21120, 0x68591}, [@IFLA_GROUP={0x8}, @IFLA_VFINFO_LIST={0x1c, 0x16, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0xf, 0x3}}]}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x8040}, 0x4000804) r10 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r10, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r10, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r10, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r11 = socket$netlink(0x10, 0x3, 0x10) r12 = socket$unix(0x1, 0x2, 0x0) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)={0x44, r13, 0x1, 0x30bd26, 0x25dfdc00, {{}, {@void, @val={0x8, 0x3, r14}, @val={0xc, 0x99, {0x7ff, 0x56}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xa}]}, 0x44}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) 726.578477ms ago: executing program 3 (id=5208): r0 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@private0, 0x8000000, 0x0, 0xff, 0x1, 0x0, 0xc}, 0x20) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) ioperm(0x10001, 0x4, 0x4) sendmsg$NFNL_MSG_ACCT_GET(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="10000000010701"], 0x14}, 0x1, 0x0, 0x0, 0x2400c040}, 0x0) close(0x3) mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000240)=0x7, 0x6, 0x0) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x270}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1}) r3 = userfaultfd(0x80801) r4 = add_key(&(0x7f0000000140)='syzkaller\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000003c0)="99bd4093648a88cc3f589dc4ad83f475", 0x10, 0xfffffffffffffffa) r5 = add_key$user(&(0x7f0000001980), &(0x7f00000019c0)={'syz', 0x3}, &(0x7f0000001a00)="84c912d37fe36d1bdb3cc6e8b715fd290737e41950146b7aa2722516dd2daadf03676222133bbd88930c8d3b9f525134c8b0b8f72cb2594e6eee79ef816adb2cd36488594914f5a869447a4604a3207c8abc28cc1040277f4cbc85400e8bacedeee84675af9f4c8b34f0b76d364d19c3c666147cfafc4177cf1f6ad362180729e8ba9ad6b27358705785fc224e2491d7177d8d4472eaee881a6837a649acbca2f3e407203bde00f6c26879919f34aeb599056a188a0fc07a5545e5c5557df694aa739191f37da86bd7d83fbd2cfdbf46430ae36fcb539c15815ecfe78f5e9aa0b83d", 0xe2, 0xfffffffffffffff9) keyctl$instantiate_iov(0x14, r4, &(0x7f0000001900)=[{&(0x7f0000000400)="63c74dc48be6b5a1c81fdc43423bf5e52ad31add050f9303dbaad20b0fcd671a35827bd430fb8e48100137acec5274f69ddf1b70eefdb5c305f85767cd618d40c92eb2ba6097b5a5c3a0c6dc7dde37df366e7c31fe141ea54fd737e824b595160075ef51b504cc0e5e0519a0f6f61642276c2996666ba2d7f56bea5a485c4da7c2ba6fdf99e54c13274a335f54c327db2faf2cbb6c7c9e0c100a042c7eb8c3e146421e3761bf4a5d", 0xa8}, {&(0x7f0000000640)="7d12d92929d38022339049686c5b09a2d4a79600693711289c52b3b1cf9d5d8e7b3aa89aadd12afeafdfb231ab4b02e8a7bcd8bcf59a5b9c4df9bfae4bbe075bb42a3b0d5a532d74155f028c5eba2c102bab9762d2c8e7e2eaf8a2c7feca3dc2bda7ec1d9b15926cfb7954eb357c7dee0286ef9b5c4e9cfe9344424bae2c12a1f11156a99b5662a7c58a41de6e91d5b227f6852ccc5e603922735ff313f6c55ad18327e7c79559acc16fc33f3c9fba4d2f3eb4dfa8c8e4e805345c81353a81b27a47b560de7d9ceb37c6cfa13d3210d214082d7271be8a74ed6908441bab00cbe18c3453ad3d03fed46e9b34cea411071c88cdab518a9c0aa7c0e21b43f7", 0xfe}, {&(0x7f0000000740)="40e48a6b0252602f1df0a12d5d74aa53be53d756041339c357c0d74774d6d32d7bc01c13615c13d98358046cbb365645f3d81c850b0953b8bc42b62db186d907b65f67158aa830c0bb778f2d0d6d021fc3a7d2a1baaa5c0fca5c116468793b722a0c46254a85530ae8", 0x69}, {&(0x7f00000007c0)="b535375edf3f9a90fe74afc981ccb930c3f82547033635e1705c647c5d36c5faf4333cdf668e554ba3ef724083cbd443f819a1f2809449da4f52d53da4a6ed3f57579befa931cf4a8fe21e38a82464075c7cfe8f6b339a097ce2c2ee15c85f5ddf0d8dc247afd09560f8701c335417b13e69bdbf667d231051d9fb63ea1ecc49130367984219751ddbf0be5f6c2341f76f6bed85fbbfade2bf07cd08bcdf876b1b2fd9c31ed6fa8ae1f2a31534eaff00327715a049d595fec32ea99f2efa97cdb25f301b89c868deced13badbecf6c2cb6ef95aa081ab34c3537c5c0355a4fc637b5b258c07940ad57a9df918005d433f60beb15f9ecd0a522dcddec5933c96c6e0a4ee3092a757e377322a5be99cb93be44b172077aed6bbafc238e7bb2770532ac9fe220c02bcf3c0caa5e3b0b81840150e8671a73e9a8791805d24210298e6f09444c89e26612c2323dcde06ca5b87c1a1543dcc7cce5ddfbde988c935ae1844a7e847f0690e9a57b76073161768c6f80fe9f18f14a27f708befb5e12c3a886f091b444924982708afc6ec2dd32c30e6dd4ebbf29e00a7787b12e22ab60e0b2bc9b2b3ada6875c6a80c02643d14c2edcea921797eb47826cd2a6ae5d5273211058b1ecdbc465388371b13a8721543cd7e40bd50dd76a5e2cda5aa49f39e113dbe0c1d78b46c3ee83fdf86a2509d46b7d61ef33c4ae543ffb7d9fd81223232a8a05faa68d043d5b85ba035ac307b3d424138c9a3253ed7da4b4da5fec20587c91589a54b2400f8750db5dfd132df288b0bb4554187d5b6786ccd65d6ca398ef10470ab0eed15a352d527d02e54749208ab7c6f59d008b198153c25c9d6cd5beeb479f5837657cb5a8cc55f6446c31ed9aa9182bbb4e801460af7d43df75b6bbfac60652d6d3cee166a4942c63355bcc228e311488e6d99d445c8a115b01d891aaa5d7d1c8f7470ec95c0595287b3bc5db14b065fd4e3e558899722cac39af4cf7a90f0d04913157197e95dbffc86669bcec4f19bf1cd972d839a063274bb2946351683d6c5fb5195a12c12ce8beb0d7d2a4307dd26962c45b6489c652abcb87691993dc937d4c635a3cd0de8812265a9bd41a87ffece060462face2f44fe2d9d735dc1920b040ca816f90b756beebc765fbf92c0fe70352f3acdea3920f817de3e6474cf82342c6057fe4d6babfe309add196997df93388030c28003f7c0e39c578e8599cf4e4025babbfabf94698c9f9f27806f70e211c87e1b4111db4bf6cb798db142e684250ef06832e0bf7b5cbca7137bd91716b5061c3c8c52f0c2c5c507756df4afa02fcb1213a80dba699aa32fed3945e974516ccb2e4cecad693806dc35cb0defbe8960cf90c884414f0a75ce19a9e11b700a1e3093486f82a50d572d820984e5733d222af25ce46437ca971a20d6adb7cf72d946cf4fbd2e6c9dca18557de1459c5dd452b8acd97aedaa861fb313bb7eb0fb93600eb2e210b3336a34dc0e65c552573d2075a2414587cbacdd30ad9f08b0e7d94ec142ff147c2b7a837c38472c3d59750fc0703bd767b0edfd31a1beb4c534e33955806f9edda6d1fa87823adab54c9320656fb17e350325d42032aad7a6298b7260babdc51b33a1294572a57068571f7d5dec73f104d7027fcfce38179dfc91db563ffd194e6d612c522268efbb698b2dec6ae0c782ca704176ce3dfd6039450838dc7fda16574e1c2470b09cb5cfde312a9292b0cc42e2985ef180f5f0049358a3cebfdfac0fb6d53347161e0987746872597bc53e68353a3fcb97f17e4883eacb070c01ed5274f4983d652127bc0899a022d770ebc94f161fb552c52bf4e66c748370746ebc241710845ccf9421937dbecdae69764f022f257700325c80dbd826a817fc6ece00c36007729a5a468805608fcdea22fa56bd8a5a5edd59820fbdab269bf790dd41873afad8937afbd8b0463d019203866412a2068009e1baae8eef94b3afacd2778296b23dafe34f40847ed525ab81929260bc057116a59892ed68970d6c08e31566f39e516d43fd549028c2eafc4ae94a7a96ea02fc273c994daeef62a1ab1f21ffc60f9d8c3d86f30002f770e966b6f7759d94e092ae7d4df9733c6edea797bc6f4aa0d7041afef5fc8b838d3b3c69b6ca510d5f2dd310a3b1f4c44a3d8a046faba7337a37214a5a9793d9c2759c9181612edd26da72938736e68dd040a8f2a584e12ca4104e8bc37634f8c4c07ee48b3ec0f29fcddab25126c52d505476cd7c8438a95d73707faacd340a0c4fc705e821990dbf420d338d58541ebe3988ec12ac3b6b9ffa3a2dd4c76a85a188a116fcf59af679898f0e5ce662294db5c56ebb402108ccd2601eda243030da3b7b58afa83035bbee96bd9e02c77deaa2d7fc150f980331ae6f1ba7525da36f741cf5e04607b25317a22736aa109860c7a21be3d2fcd0c5b848ba5dffbc5f6d97a4d0f3423171e744b5c8f854babfbd8c1c07e03ce8420448eacdfbabe6e72e72b5a9168b3e82b87501acd94b3b889ddba89d9509edbafc1a975f3d8f1bd58ccc08fb45e679e530db716652937313b3d8cdebaea6d2df7adca951c5b2c8793d9c838b8a037661219415e2e46744f4d871cf35b9bf86d610a9554f1ac48040f38fbcac08bb4fcf9bdcbcf46976d4410cfaa13bfa815eff2fe7ff15cd2d7b2c8faa02d70231618d31cbef219a494bdafa0f45c62e0c79f7c50daa238c1ab41192c305c89ee0b8213a29523cf601cc482d490a7c1b10b0a3d015341fc3fe9294670c9c2dba9f69f7e18b307ed85379f99bff515e7c1a41e046ce137ad77de7122a644e072d86d97ddaa672f6484c93700f19691c538af56f20cb93f64d762ae06b3e1eaf689d415958aae07cba6342f3543655ca0f0a2a90f0fb72563c020d2585e7c4f3182cf4efb6245631acec7f7d7637eb2afa0cf617716d616567558ae4fc1a8fc5614b3ab2722859f74a39ee3657e5333ffbd4a44d663c930ade6febd22f15da85000acce504e4b9f8000f88ca7e7d932b57b0efca07bc26168bfd4f97b7a98c229d295f85daa27b864bb3ba4b6c389da75ce35e059e7f57b397ce410f9a78f4d005eefe18c59fbffc49514805650991814cd68a1595aaa8fd092b0cd997f44ff39db41e6fe6dd49c177181d51ceeff8aed9f50b09f21cb8054643d81a813d164d531711ba6ad6dc6f613aa635c8f0d309484f8ea54f3bc54c1b797d6dac8a7219c483bfb05db68831f814f41482423b34bf01a07308c8c688cf1806b267712c361117bd7da79222a9004d9a6eed2702a8c515fcb9a7fedfb330694ced141b07df6c2c7ddd5b27365ab92215477119216f01498e3ffb5cf654a231211da90d8e4acb3a575cc368e86c551af888aed8b2708fedc5c9ff9b43f7881ce414978678d811d19520a5782379a9ff10026f85943ac96f08d96184f34038142df8e7efc327abd245809ab3623b1adcc31a8169aead8f8bc50fc11aefdac0c9923b9422b5993d9ca625f2519e1273dd6d18d338304974fbb44d56e5f216eff244acfbd1c6fbe03a823dd4e13e524e911ed32ac604445acd0ed6c715f96889164c39f8cdb871ea0070c8cfa277bc4de7c2aab6b7068d29742790c592d64c308aa95b201e6ff5d429f882fe39469fdc4911a1b1b8d0a95153f8044bbb0dfa26e860c4d23b2f302e9f92d76019f42700c3da5b067e375b69629b9da9ef1d83d0e302808690c98a0c43a3e7eadcd9b1b7e5247553ffd89e55f5ca485736bf256f63407d7072cbcb9c83dd7bed56ccefe307995a4c82b072e407e8078d07de8bce34e40c1dff4af58503217a02ba7b3e7a274b85dd1a2ebffc4f20acbc2dbd41aa05aff22f5cefaeb85b71c9f37b12efe9499310b8274e0d492d66ade219682a0fc27424c25f5bcd72d3808ff0d16b3ecaa93db0e4987923df3f3f21bc2b95d62190a1b84c1e97093259e5d376871142bad11bb2428a4e054774160673779f80e859c0599f05aaa34248e40d6d0f544d644edb774b19cd48eadf33eb9fb73e8de2b56393dec70623c0620d62da282a6f35cd1d28b4a5457780bc45e212266610a17d3187e67997fcdf2912f85432211697c5f784c2c1c4888badb7abafb064a9c9be978ce67f36eab5127372db7adfc07309d12da5731b91e0993d8479cc0afd592ff4ae7654621d9e62e5442ec46197ade37c55263f6e4b3e14431dd7f80f1d6f9b44f5926b65f9f954abe315a59a135ba28e5dcae2cc7f9c7d25716536729b0bcd5e2a97300060dedf4d0c260692122920c5e4aa5699243c7bade113e312a452f7a2259fa8c024f524bfd9d41f67afb2e4aa2322facc2695f769a7ed6561d20c4d0cafd4f8238ca1ed9a09571289125e55729492cf4f1e9ff7963af260254340a8fad7491214ad826d1d07cddd0a8c1f00888d59e20c61f0ce39d577d491b485810616f56d162f78f085148489e2b4f86328e83eed06c07006b9d88b2a7e52a1412018a332b798b28430b6e4f64f40f2db5f4845b628873dae17be2de87406a8d3cea468d4a3493072709e9e6ef40ac1348bfb2caeafcb7f3a008e334c47327bb06403e5efc97b8fe1fb2df9b0aac702931198f56b09baefc39c0319d4cb09779b20fed096ad690279f812c7322655a3a528aaad48a3e468c7e6db13049261470d2de2e3f44b1f285ef5af9c8f218ccc9e7c7f3fce67bd7415d17b07926011b562d7d97f12a9848206c15c2200554a1ca05dc5d723056db9089b7d22c03c99d5d37a34f4ee9cc2f21f86860c5e9eefec7e58df70c235f3ecc28eda3362b32c1cc1b9d4acf0ec3ebbd6a2b05d89174c85a03448a044725ea48ff7f88b230aca0db9bdc7eee8914909541426e7df78e2a07db86c31707ba178e56fd06e238431f5566e3e104cdae9ea4a10f2e75858aad3c6fb824aae4c2305765483c4047e9588f3bb7175c3aa8ff5923354c05562dff7723526c5aa775428478daadd5e5a74859a20f7182b55bfcd6235787df9943e1348c8c571eb278d023ffd72dfd22f808597549eff0f6542464d0b149f759c4045c363532152408a336b7bcda8abac902811930feba5c8611220f9e620a1a5bbb443bfa2bc4c914502a7782693949b61187acaf5f6d783e44c0614c284b4d266b99ab8248b8e13d93da00199691f03f1e78fa3f88831e72b18ac9c63f99a126611c7e4dcce78178136247d9016be5b239992500841c4d0134c3e984f0b14366920804d50973e0730409f8f06860d22b88a9b54027f461efe0f95ed3cad79afa3317ee3c8211dadcbb8232088c6790cdd2bd9dcf1f060ddc5148a8ad80da6b876f9b0dbf95f7b841b95ae6bbe7f3ea70320188bd8597c432ad959fd72a12c9f4c4fe4e365ae41b3926de5216361f2003d11e1ed319a1534580073de9ce0d3dcf0b41193804caedbe57c47dc3f60e7a717f0a9c64942ebcdcf6b2e99747e5373af2439aa897af460b724af2312bbebab1c57d442903869b594befbba4059baea3e064025783d99bbebab33e228c616151974e67d9c18d6ad3b3733509d288baccf8f640ee3c6f0ee5b40e927a3f559acc7c8e8a064ee78fc9a88f781a0906b0978c3f758272b46318a1be7bcba0f48ad0c3c9ab5413e3400fa4fc6259c6425fd0f36e37ac5c4b4390bc09e6f209f61a5cc65ea528fb80d5c69a25ad37d11ddc5927e5f227d3562bf81550c8315fc1771c62fb778cae2f0c48d6fa9d5539df7214880d984bd48d41ebc0f48296b95255d95a2bd23f4b1892a9ddd7ed709bbb99cd3030d6437dfe6393a", 0x1000}, {&(0x7f00000017c0)="a2a15f6964e36f820844f73dd178af9b9c94c3c79e8a25d08bf3ba40f616f9d976d3d8c7f84a4431c2b4cfb42d1a5a27a10c4f2abe65209ab37b60f7b8d4bc6d9a12883a70d65adf2488a2dc0238b647819d63565addd73a9fee5860e1a7b200f949d51bd4e12373f9888e51007b39d048459a15610b888b5db180bdff42001e15342ccc21f38eec4efeaf2b7e9130aa406fe2ae67a6f4bf40d0520d3e9a50608fbc6716e49ed9db03f6acdf51b75d0169bbb1c8b6934ac62108d08f928e20eae93c6d015e25cf68644106750bc0ed5b8f2a338192477d070f09e920042dffb05c61bfb0ace3d5db030366d22d51fc85d7e545c98f1386", 0xf7}, {&(0x7f00000018c0)="5f54e2c0fd069d82c796c8ade0fe5498bd", 0x11}], 0x6, r5) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x145}) r6 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r7 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x0, 0x0, 0x3631564e, 0x0, 0x0, 0x0, 0x0, 0xfeedcafe, 0x3}}) keyctl$set_timeout(0xf, r6, 0x101fffffe) add_key$user(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000300)="1bc0a644ebe88dedb0fbf78ab86a4146215876c650c7d925fa98d0880d070d65f7e13530bad9085ea4345d08db7f2cd3c47683143035333534cd7701c563ddd981f2090358090884f4b84e58de7c8ddfdff157d989758c1e752cda45035c0355d9bbb916a261d68b226a5bd2f1e0cedff9d7bfb033c534700f6fd0e79e1e8f141294f5c268c13393bd0b103ae71fd27b194e77f05afa5bcc8c7021f784ec067802ccf9886c211eeaa90a907f65f6efc3feb4c3a1", 0xb4, r6) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1}) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x3000)=nil, 0x3000, &(0x7f0000000540)='fou\x00') 563.850905ms ago: executing program 2 (id=5209): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x802, 0x0) r2 = openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000140)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = dup(r6) write$UHID_INPUT(r7, &(0x7f0000000000)={0xc, {"a2e3ad214fc752f91b25060987f70e06d038e7ff7fc6e5539b325d078b089b3b08386e090890e0878f0e1ac6e7049b334d959b429a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31303b305d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946817591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c0428918246d9e9e01feffffffffffff83a2b210520106b8a358b502b7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff13d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1ccab2689bee59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c98e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae23034202210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ecdf5e08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdcabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c145f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) io_uring_enter(r2, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x10000, &(0x7f0000006680)) mlockall(0x2) r8 = dup3(r1, r0, 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) add_key(&(0x7f0000001040)='id_resolver\x00', &(0x7f0000001080)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000002340)={&(0x7f00000010c0)="c1c8174519f5f5fc217942f5e24b74d9ce63477a06bd7e41592fd4e4d30a0f569bd17c0a28e695171157924d970638246ec89e06ccafec4e182d1a26d55bc420b1b596f15d7498f874d5fb6b95a34b367ff482db0d3dd8d12433a7736c79e7d664b16855ff53f70c81a978fc8a31d5ea80aefae90eeaf9467936ddb204b26086e5bd4d3945367cc0b4624ceb5910541f2e539537e9c57487e16f948bdd24891c00138b4f3c253313c5e5b25648c5e7dfe396ca7cf2d92f658f6d3e8174ecb729da62a2f1d6b9b8823bb0be09c5d2a27b085ddff4c0f55cbc7352bbef65535ed99165f8b57dd102c4ddacd26eb40e93f05bdceb7f80d9c9ac86f9ff2d2e5c4b49d9ee77f8fbe260604d93f0513080e3892423913c3cecf3a996bd01532fbbb16cc0b6aed75c07f81fabd9613d732c370810898c4d693c7c5e5960ac24b09785a7e25004fd09f693cf3f7bd637191b33ddc43110b446bc252b82c0ba0481822dcacce706a42776c42b600321dffa8774f6a515c0cf988316c35e1aeb808e5c807d30e3ab3ea1372a0ce4a5503a88b2c6d5009a015c04fb4ed08d8d7eb2e00f4c9344d4f817fc216faa904bda0b24cdc2f744a1ec8ace0f62d14417cc6bfde4bcae60640d6b65b85f6324c7b4e8228130d089f0e82d584f8d0bb05ae25be560b535d9d7fdaa3ca1a52a830a46ff3420a974c3c8d71693e3b7af39b80ea66b2558213a945d97d7af5805d440024218cd682e378783e751272f487c1f87ab0e2fdbb0e0ebb2eb71ee9efe5399b535ac7c879d6920c8406502c17ada112a9d2e2ff0fea7d2fc83b5a801aef40a7b86e8159d8cd00991fef58561b527ab6b5f3d4c31f5a5dc772aaa3bb847a5c4b69d4ff65bfc2d14610d62a6b81e5b35e8f5e90add0fc72220e9b62d9a271bf1678387c780ee46ceea78ee8e86423affcc26964cd2788a978b5fd19cf3c3a689f914552c46cc88c7af0655d5f394de38be47840ba327a9adf6ecdec51be37abd14569dd2ce3d5c5b4d1c555ffed99a0179b99a8308158dd6292e64d510416dfc453c6c3a7fe3886e0ee770b029869a17962324be3ca9884f18133bc7f77c95ec0f566b52053bb705114f710715e77312c1772fd0f64391d9785aa10aa96af93b294c7eb0aae40ec0e072e1ceaa11500f881a880b55190361d6451268c79e27ad7fdeacc2204cdb92527c5c7e5588a7f437a9e3345f767b47028ce155e5ae4918fd9ce020d655183719b3169de54f04a618e55800621bb3dbebbd145ac563f8bc725c222112ed99546f8926328cf487c816181a0d6e633f4accf36f825dc5bd1137e542c92997aa9b4cd21bf7c77584618d7b9682f612b38e6cd77c1a015498ff18b9cef802493c6a7d8e6ff4897afe663ea2b31d50ff20089aee547f6be37eeb3c016b615808af8f332d29b2a59ecfecae264bb9cec3b881850b09df5bbad17422baf0e7b5814a74d9e6229d993b9461570c3b2800669fc4707707d16b39ae27fbe3f85fa07f337a07d0a92e155ac5db970fad33e683bb0c6a1c1486f82d1c960fbd3b317f19e1da786a28c91801563553ea0404e35ae0382a292cb48429c8a93750774b6396fdfe2f53b4109e62ced0c40bcbbbd1b641ca228aa2b59b39e8b9dbc462e09ecb3c7c1c51c0d5d5a074235aa18b1220b9c095d8243228e081fe034efe2eb89a3f6dd049c179d03785712870753273bfcf7321c6f60dd43e6c3a3afedc71f17f2327159cce7d34385c8981f402c3ab08c96b5c5433bc0a1ba46b66eac56a340c96cd0a81897cdac1a6e34a11d24e3ed9e3a03bee05ca1d764c27c80004529185568b6887dbe1fc7339f390bba7c6940e5f2e4061b7ab3e8114f9a8b8f5de0a665dc1ede1c6d606aa053b28e0966600742e565da86ba5ba7082560a17044a2c176ef2caf4dacd3d0c9245b2ba337b77da0868faedb3312046aded658cbf3d09409a60f1889b31419cf73c8a2066206e8ff4707659d15d5e7b979ef81c42bc76a0e077213d03584cc6eb4971d463cfb8f9a12d12c12fb98874fc4df3020663ab5efb4c121235a288b0877536ad31338d2e16876f5d2a175f7f809e6fc4519608c9d7068dd5dd93f3244213522056ddd30c32ff12d3b02943973019fcdd1723d599a11edae67b6549fea36c827e04d3d9974be09afef00bdaa07fb71b2f539c78d6837fec0d0afc9293faadb443968748a439e4f73f04f5e2500c390b49899fc8dd4acaaccfd0ac34b87f7b374b6b132e0986655bdc354542e928f0772a4cf7bf0924bd8a8bd21d4b583f6f053062bd18f0cff077d6fdba29f8de07686cab1a31f9257d42e01051cb5bda0f4571c7e83e6fe05fd169906c9c7b4a1e386e19c5c1eec26e7747030072b840733507ca76a2fa5cede13e518a517ae282582e0f954fd1db7ca57ceaf8d289ca32a1de060b46063f34763c3eea26b27931ac87247d96242c14b7c2113ab5c24d50627a8f0d67bf0aa2291777922e2c0cfbee1782367b9f48ae1b639386ffe30b53739d6929438f5937f6fe19a346cafda6bb80acbc6d18041b295b77c1426012a7289061c65b4749a546e21bdf3afece35ab90b588066ccb4e81c6bd382d3eda8d2e0d0d35a89148a71fdf8cdac8d923e565fcb5a01fc5d791e7e5591007e8cd730149788ad0a3aa5fac8f55f094977f086f0982f4436e7b377852b7fa2e62eb6ec20f324028902765defa8c4ed2df5482c73a50d14e9b31cd40973f9616a1b773ffced41a3aef442017e2ecbd71f50f4a8b3951f68d11ec27e1bc0b8e96e4c0943c8ca9876f5739d56958ae0a3e7f762fbe611b0f4be16731bc126d80861eef035212a7920c8b95a26e881f6fb64d60456da53606ad48362bdf2d70c4591a757dd052e73b301dcc5b704a1d1bfbfb31ff557a0015883fdc6c492ba1a153ce403353ecb43aeb83a074785473d740c3fe816c79266a90324dd77a24750e037d122156026d8894396bdd2132f000cf5e58d66a4530e3cf49b0238e9a45d6d96b45a5646acf8f376aa6718fd7f033b186a0e9a354e5f1605422966db78ce7838f45334c0690cb987c5373777c48994b3a9cf6b84caffa1e735bd435aea6c006525b8bcd334d7fdad5018da976dd82803f912e9d4cc594245eadcfabe9003816b064147beef76ae75d0164fddf76348774eb2801e8a7da8094d47cb67aaa7a66198ebba185495a7f2c40389a4d7e09fbd13d27716cd86880cff90de971899227f6c0964d371bd9000935186930b7c13e3c9cceacdfe7370c0b9971d85b43efa4c52dd2de5c86471cc87453a88816c854cdffedbb786a4a5f189857378a8f28998e1460fcfc868e299ad477eef1b7a43b10790039d938e927dde88741b4b8efe4dbb2cc73d46f74722881a721a73d8ba1d612002611273da73c85d0cd07983393c32ec979041b4138aaf969798896c6e652c5f0c4018e963763cad43934b475d825c8ca03c582578c671b7ab3c2896e9a2a37c08883d36c44b166e8720386e56b4db2927816d79637cebe5a5f00d995d095b9d41dfee23ad9639479b7b4d9a59772e3ae383428d06ba8fab37642c87c59bb9c56f5f15697f5b0f981d0d9e395aab2443df546871258c5f011efd62efa8737414ccf9f2ea8eaec3016d475bf4da6fed1d95b5566578f46e103ca8666826f1bf5ec33fa6cd12883f9316515089ce643d052ff620b77d6f5bb06e057f94576f9d38105320234d65fc6b3a45fb510beb18e495320146906f43959d25fd0b3eb15db084674e9f8b44f94cad3c2489159e10a66eddb4b13c048b1fe2440ded9f691459a42a06eab738681738dee979943f8731bf2328a23d0a341eb06293484d431fc321034a851a13d8aa914f99863dadfd09b2b58120bd7ea22f6c06236376c0b3756e75e0738ea5a642b11ebe75d2415c906daaec97ab62dd60cf5ff4e25df33699bfbe82f4743c77c30621c03cfceb5476a8a4370316df73da3f7ad5b63d43be1e189bbdaab7005959bfaf00f44abec4bbc3ac7091505eb502ef54baa46c29127d2c10230e7ec64c2977d7400cd9bfed697717d54ebfe68bb937ee31e036d236a42bed8cb8b47d002a57769e9213b379021b9210c023d0c7730e45b21f44c5a803a283b5721749f6511b5154e757919e8b964cdbb05c028a23d52e98b9c5e59cec5de5726ab2b59a0e888b36978670af24196c92f984648fd70644493d2a9bcf9adf42b1bb101b82a82a0bf19186087fd70077fa91b7a22e4ac505285393aece0f7ac5395ba485dbaeffd5895cafb9ad5b05a039f3fe2e3c3ddb4a8b2ceb0e9068d07684501de81011040aa75274aa7fe6d607d40bcae5f4230f2eb8b9dfa0676cfed5eb0b5e2d3dfafa67d93c7b187ce5af76051127a2f5ff49bd485e0da64c069bb1c01e2789a6507e3cff042b8a53f6006ead29c8fe71738d946f15a883854cc88c8154a9cf8e98c6d6179c9b6b1605f8846ea245137e1f27ca66471587c8360c0e7c9f6ee6e234ca5a3a9c7f31d34db908f92e76755a32f971b98be906f051bb4d19fe489b95a07525a8571e02eabce28e9cefca0e65f803f82f8df713b8cf87498fd06f70cfca2cf1a55518438064ccd099422a63a11fde17173042e3b8f44e4f0775e6a0fedb76e99e3de1b4552cdd2f8665602fa5bdf30dc328c5c41351751c9af13c6645651cc4b41f5c62404f9c0918c15a41f6c083a742e495947da0ea109cfe2f93808562a8a4f667dcba2a128006987a005caa012ddb5ffd2e9ddb6b9ff983b6cde5a71df8332a9f6a36a9b188597b80f4fa65b0631f4d07621413b49363116630c177955dd16c010cfa2df10f9f98241d99be139c8c54e059893ea1a63f15b29e6d2dce28bea0f5ea439bd27c9fdcfe23f9c199850e96b581bf0f5ddc0777f4b2aed20a498e934bc6606769808bc9d4d454cd8eb715ef3954a716aa6f47515cca28cd7ea29a43317025c4519809b3b126f3ce0fdf00ea1ac04722e88252a09c20b4bc71230e6ed1d16f5f411a0f638860d4c3fa0f9364138e90b3124f8a492afa3e3e492995499974e83cce18162f55bc4d5bb965f1eebb2c0d1f924db438dcecfa20dc8538d8fd056b7e18e4b244904dde459a9afc489525dc24ef5bdbab2e45bf5c7f8a8a7b19aa79a38ba583e7b1f30bc0f199252e393fd3172045d867539115fe7057b593f77748ea2b889f2e075a53c0a65e17a10c6869f8f3dc0afdc562189425ecd9077d5d4f38b4a6b756b8a89db6eb0686cc5741e0df5da28ac766a474680e88892a211987bf7e0b05c06666263c76795f3726c11338f3fae53599537d1b93a653a15a5f5aaf9b09118c74dad94087d4e9bfdb09a621c2de3778aaa36bce283a7b801bfe0df02be1a0c925f653be3e3abee775c2231a9c6b0857ff1e0159e9a266b1670e3b8341bf3f544780e2322668b79c6d42346f765df8759025766a4d6ebb1a323b80d9f03b9fde9c7e0cc847e3c57bbca609b9bd206a98f59f19453f38c8edfcea52a95475b13bdad403a25a42b3504f2d0bfeb02696c05e07582895a5b87180798f6f10490732b95a61a995b34c5b286528330ab886beb197efc6794b447f8db6828c790a7484fe220c19c2013cc6260b38aac8ae3a7e14ae5fabbf2e3126369dfba257a71e0bcc510a34db1dd5908c352d3c42d12c6c0137edbb9a47d5503410ef043883930943231180a8200b33fae39e0c45ca2ec42ae1f897794685ef9a1ea5889e62ab259c9474f54336d13101cb0d6bdc3359a58bc4c86df7cccdfabdd6299cab2824dd2c43eb9", &(0x7f00000020c0)=""/249, &(0x7f00000021c0)="e24e5f289009c1e705e50e4c0bbe90c831696078001b9ac93f386495e58d5da796e795c52dc2c0f513a7dfb4652a75d1c055ac3cc83e309ca531354d2acec6c9d9d64f8eebedc3609024ccbff8c4cc52759ca16d645fc7c9b53118e979473ad9d9", &(0x7f0000002240)="481d41fb37b3e3ece9c496093d34117bd0d270c8fed8a616593d9a559eb71d854a5a2caad8e8ba44c8c4670afaec4405c95ec61207f4144d44c6a5609b51be8301e719cd25f7a9c90b1cd17d52f48c4e1ff23c665088409a1f8e1c89e19e2e03381686b5bc7376d812788813a1c42a30d10e77cb898e3adf002dd218afdf32b192a11ca110c737ddc50f25a998a7b66d203c00ba1f13ed746f3e4bbd11f2d97805dbe30995f8f3664a0ebef60bdbfef04158566e7c0d635de7086f2a2a4d9643ef8ac6d08522bc0b4de64d3d87", 0x3, r8, 0x4}, 0x38) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000300)={0x54, 0x0, &(0x7f0000000240)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/74, 0x4a, 0x2, 0x12}, @flat=@weak_handle={0x77682a85, 0x100, 0x1}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000200)={0x0, 0x28, 0x40}}}, @acquire={0x40046305, 0x3}], 0x0, 0x0, 0x0}) 496.356778ms ago: executing program 3 (id=5210): socket$packet(0x11, 0x3, 0x300) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) r1 = socket$inet(0x2, 0x2, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000000e40)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000980)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7888d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c85244beacba255854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7ffffffff984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38542c35292cf3fdbfc45af8630174371535dbab0b2ec6403658ab3b48a93093de50c743a4f987cc433b546f194f00ba2d1cb675b44bdec6b6955889fcc8cce51ecd73721ad8c044534221e457a1fa6ce4f38845f0077e10f19314402484b81bc3727426283f803d9c60eb5e9320574a599d763952148fb2bd655e900c850243e43246c70a3b317b0d87a001ce1972a24ba7a5e294243829ead8f34d4d740101eb880d8c51bc1f55905e873c1e2c6a411503f02ef69a757e52e6db9e9566232c3323909b8ac8d2ab060db81c109b1239c44a9420d9251e6fa5", 0x1e8}, {&(0x7f0000000f00)="44900001000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02", 0x3a}], 0x2}}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000640)="3da39b2ad5defd21d90486407e56e26daf1a5c6f937e2b330e7f2a369d4e1d7d075b45ee8b8b533ce21787a34cc98008199ec62730423ed278abd4e2bb8877d253d1c697ecb90b33871b36094c4147ad2fee445105fc4e7c5c81085705792d8826b0ac7cd3b3a9cb56b879719d2f4eb8993d039207f46b2c6a38bbf20456", 0x7e}, {&(0x7f0000000780)="1d603f8414984774e404cec66360f9d4d4892eb91e3c91a2c4020ef536748012bc2f2f78eba95703840dad561da3bf32b3e6e4459419af41b845483434f66105e4192fe71b", 0x45}, {0x0}], 0x3}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdf8, 0x4) write(r0, &(0x7f0000001e00)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a060bc6c836862451c4e76fc9cb221db8d4b449c27aa44564cb33ef144ed0c51bdd66675302692d979297f30e2d9523f85afbbf54c5b5e2261f8b792f83b33cca78c44a5c4e6ff96273979acbb447d49c0502cc9f8991e9bc784a2e978912d8102d867b631d54269936f54bb20ee57e2b4ba4b6c44e767aef24f6c3a8bb5a3b2084d793082e4c5e517694b220e35ac140913e0e55257af03c4dcf376f24773642c14279e2b55906b0b8a4a34fa4d73f37a5feeca1cf93395b998ddcc557d0e2ae112cf1566f7097e7acb6c0bdf9350781341bb83936b355779417839a70c3cbe13e9561b0820df44dbd2a24bd3d6d8b0d9e83983cb7ad8f147f980b06be823e93a93395f5e60b7f31f5aeadc81f02e177446888c15d2845fd675b98360ac2f584a8ab618789499babac77e3311c563fa519a8dbbe49b91a46cc355f8e956c04dfc3b8e218dbe0302ff463fc94eceec7050b7477d9542f6d05d36ee13e664dfc0bb165601e6bd70615f3c299a9c7c7004cc9987a76afc54b3c83e5d23c0790f39593437b2592cf0548f21823f61076340a87dae9d3427acc844357d6bdbba726e7a41eb30a916df698ab241b5e4991f41d34afd2c2b99f259ca582f09c8027c3381e64070aad6ec7f7c7c973d55a33eca3cc4245bf488a497ac966aa13111ec3033172a3512e97700b3b58b621ccb71309d6ccafb05352718a362d14c38501ec45a522fb865635", 0x39b) 203.125401ms ago: executing program 2 (id=5211): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)={0x1c, 0x4, 0x6, 0x301, 0x0, 0x0, {0x5, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x408c0}, 0x4000000) 101.384741ms ago: executing program 1 (id=5212): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e24, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg(r0, &(0x7f0000002280)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000500)="9f", 0xfffe}], 0x1, &(0x7f0000000800)=ANY=[@ANYBLOB="10000000000000000f010000000000003000000000000000ff00000005000000dae7c65afdd9d1d5073fbf984e560f7f7af0377a701ad4e8ab3a0000000000009000000000000000000000000400ffa6474995282b8d35b2efb349cfa55288ab0139064c723f71e2d9ced0cbb2d46df48f8ee505b82850c69ed841ec12c3b6392c378033c46278ff6bc63d6d5bf4c8b718e78b05ad817aac3b5239cd4fe877aff14721f369a8fb6e6daa5710be61d3edc36edbd248ee581a70263663739cac6a0b0dc55ac9b2f56dc43f04dc78a3000058"], 0x128}}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000340)="94", 0x1}], 0x1, &(0x7f0000002040)=ANY=[], 0x10}}], 0x2, 0x4000045) 0s ago: executing program 4 (id=5213): madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2) sched_setattr(0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000de9000/0x1000)=nil, 0x1000, 0x1000000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, 0x0, 0x40080) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) r1 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000040)) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) r2 = syz_open_dev$video(&(0x7f0000000580), 0x7, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x16d201) r3 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r2, 0xc0945662, &(0x7f0000000440)={0x400, 0x0, '\x00', {0x0, @reserved}}) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r4, 0xe5) keyctl$clear(0x7, r3) rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) r5 = getpid() r6 = gettid() syz_open_procfs$pagemap(r5, &(0x7f0000000000)) rt_tgsigqueueinfo(r5, r6, 0xb, &(0x7f0000000280)={0x12, 0x0, 0x4}) syz_usb_connect(0x3, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000062a10b40450c1010fce60102030109021b00010000000009043200019740a400"], 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r7, &(0x7f0000000180)="e13248a98d8ab55d", 0x8) r8 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xfffffffffffffff5]}, 0x8, 0x80000) readv(r8, &(0x7f0000002940)=[{&(0x7f00000000c0)=""/121, 0x80}, {0x0}], 0x20000000000000d6) kernel console output (not intermixed with test programs): face number 0 [ 888.824037][T14854] usb 3-1: config 14 has no interface number 1 [ 888.824117][T14854] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 888.824143][T14854] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 888.824169][T14854] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 888.824194][T14854] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 888.824221][T14854] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 888.824247][T14854] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 888.824274][T14854] usb 3-1: config 14 interface 57 has no altsetting 0 [ 888.824292][T14854] usb 3-1: config 14 interface 228 has no altsetting 0 [ 888.827161][T14854] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 888.827190][T14854] usb 3-1: Product: syz [ 888.827205][T14854] usb 3-1: Manufacturer: syz [ 888.827220][T14854] usb 3-1: SerialNumber: syz [ 888.960955][ T5746] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 889.131517][ T5746] usb 4-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 889.132964][ T5746] usb 4-1: config 0 has an invalid interface number: 120 but max is 0 [ 889.132990][ T5746] usb 4-1: config 0 has no interface number 0 [ 889.133029][ T5746] usb 4-1: config 0 interface 120 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 889.133054][ T5746] usb 4-1: config 0 interface 120 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 889.133078][ T5746] usb 4-1: config 0 interface 120 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 889.133118][ T5746] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 889.136186][ T5746] usb 4-1: config 0 descriptor?? [ 889.144137][ T5746] input: USB Touchscreen 16e3:f9e9 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.120/input/input80 [ 889.246219][T14854] legousbtower 3-1:14.57: interrupt endpoints not found [ 889.344865][ T7557] usb 4-1: USB disconnect, device number 9 [ 889.648727][T14854] legousbtower 3-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 889.659444][T14854] legousbtower 3-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 889.733816][T21388] xt_CT: No such helper "snmp_trap" [ 890.444212][ C1] usb 3-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 890.457910][T21401] bridge0: port 3(wlan1) entered blocking state [ 890.464972][ T7564] usb 3-1: USB disconnect, device number 109 [ 890.481545][T21401] bridge0: port 3(wlan1) entered disabled state [ 890.497374][T21401] mac80211_hwsim hwsim95 wlan1: entered allmulticast mode [ 890.507635][ T7564] legousbtower 3-1:14.228: LEGO USB Tower #-160 now disconnected [ 890.541883][T21401] mac80211_hwsim hwsim95 wlan1: entered promiscuous mode [ 890.570075][T14969] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 890.721387][T14969] usb 4-1: Using ep0 maxpacket: 16 [ 890.722279][T14969] usb 4-1: New USB device found, idVendor=046d, idProduct=c227, bcdDevice= 0.00 [ 890.723415][T14969] usb 4-1: too many endpoints for config 0 interface 0 altsetting 16: 254, using maximum allowed: 30 [ 890.723464][T14969] usb 4-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 890.723491][T14969] usb 4-1: config 0 interface 0 has no altsetting 0 [ 890.723525][T14969] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 890.728358][T14969] usb 4-1: config 0 descriptor?? [ 891.053497][T21411] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4798'. [ 891.134580][ T5746] usb 2-1: USB disconnect, device number 12 [ 891.147933][T14969] usbhid 4-1:0.0: can't add hid device: -71 [ 891.148142][T14969] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 891.169016][T14969] usb 4-1: USB disconnect, device number 10 [ 891.226963][T21417] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4799'. [ 891.227057][T21417] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4799'. [ 892.207753][T21438] FAULT_INJECTION: forcing a failure. [ 892.207753][T21438] name failslab, interval 1, probability 0, space 0, times 0 [ 892.207811][T21438] CPU: 0 UID: 0 PID: 21438 Comm: syz.2.4805 Tainted: G L syzkaller #0 PREEMPT(full) [ 892.207842][T21438] Tainted: [L]=SOFTLOCKUP [ 892.207850][T21438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 892.207862][T21438] Call Trace: [ 892.207870][T21438] [ 892.207878][T21438] dump_stack_lvl+0xe8/0x150 [ 892.207914][T21438] should_fail_ex+0x410/0x560 [ 892.207950][T21438] should_failslab+0xa8/0x100 [ 892.207975][T21438] __kmalloc_cache_noprof+0xa3/0x600 [ 892.208005][T21438] ? push_stack+0x7e/0x380 [ 892.208029][T21438] ? push_stack+0x7e/0x380 [ 892.208059][T21438] push_stack+0x7e/0x380 [ 892.208089][T21438] sanitize_speculative_path+0x2e/0x550 [ 892.208114][T21438] ? do_check_insn+0x5d76/0x17d70 [ 892.208142][T21438] do_check_insn+0xb2fd/0x17d70 [ 892.208191][T21438] ? __pfx_do_check_insn+0x10/0x10 [ 892.208239][T21438] ? kasan_quarantine_put+0xbb/0x1f0 [ 892.208268][T21438] ? lockdep_hardirqs_on+0x7b/0x110 [ 892.208300][T21438] ? kfree+0x1c5/0x650 [ 892.208323][T21438] ? krealloc_node_align_noprof+0x235/0x390 [ 892.208347][T21438] ? krealloc_node_align_noprof+0x235/0x390 [ 892.208371][T21438] ? bpf_push_jmp_history+0x27d/0x6d0 [ 892.208401][T21438] do_check_common+0x3c19/0x5d30 [ 892.208459][T21438] ? __pfx_do_check_common+0x10/0x10 [ 892.208494][T21438] bpf_check+0x2639/0x2e10 [ 892.208524][T21438] ? ktime_get_with_offset+0x93/0x2d0 [ 892.208549][T21438] ? __pfx_bpf_check+0x10/0x10 [ 892.208571][T21438] ? bpf_obj_name_cpy+0x194/0x1e0 [ 892.208599][T21438] bpf_prog_load+0x14d6/0x1c20 [ 892.208633][T21438] ? __pfx_bpf_prog_load+0x10/0x10 [ 892.208677][T21438] __sys_bpf+0xd0d/0xd90 [ 892.208705][T21438] ? __pfx___sys_bpf+0x10/0x10 [ 892.208735][T21438] ? __fget_files+0x2a/0x420 [ 892.208776][T21438] ? ksys_write+0x242/0x270 [ 892.208804][T21438] ? __pfx_ksys_write+0x10/0x10 [ 892.208834][T21438] __x64_sys_bpf+0xba/0xd0 [ 892.208856][T21438] do_syscall_64+0x166/0x520 [ 892.208881][T21438] ? trace_irq_disable+0x3b/0x140 [ 892.208903][T21438] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.208922][T21438] ? clear_bhb_loop+0x70/0xc0 [ 892.208945][T21438] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.208964][T21438] RIP: 0033:0x7f729679e159 [ 892.208985][T21438] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 892.209002][T21438] RSP: 002b:00007f729762b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 892.209025][T21438] RAX: ffffffffffffffda RBX: 00007f7296a25fa0 RCX: 00007f729679e159 [ 892.209039][T21438] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 892.209052][T21438] RBP: 00007f729762b090 R08: 0000000000000000 R09: 0000000000000000 [ 892.209065][T21438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 892.209077][T21438] R13: 00007f7296a26038 R14: 00007f7296a25fa0 R15: 00007f7296b4fa48 [ 892.209107][T21438] [ 893.312381][ T7557] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 893.475120][ T7557] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 893.486105][T21460] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4813'. [ 893.486152][T21460] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4813'. [ 893.517261][ T7557] usb 4-1: config index 0 descriptor too short (expected 65183, got 72) [ 893.538074][ T7557] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 893.547123][ T7557] usb 4-1: Product: syz [ 893.547210][ T7557] usb 4-1: Manufacturer: syz [ 893.547232][ T7557] usb 4-1: SerialNumber: syz [ 893.625793][T14854] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 893.760733][T21463] loop3: detected capacity change from 0 to 7 [ 893.767410][T21463] Dev loop3: unable to read RDB block 7 [ 893.767459][T21463] loop3: unable to read partition table [ 893.767676][T21463] loop3: partition table beyond EOD, truncated [ 893.767698][T21463] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 893.850181][T21450] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 893.862180][T21450] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 893.883803][T21450] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 893.903613][T21450] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 893.925266][T21450] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 893.944006][T21450] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 893.950504][T21450] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 893.957501][T21450] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 893.962395][ T5746] usb 4-1: USB disconnect, device number 11 [ 894.314652][T21470] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 894.692665][T14854] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 894.700759][T14854] ath9k_htc: Failed to initialize the device [ 894.708309][ T5746] usb 4-1: ath9k_htc: USB layer deinitialized [ 894.850128][ T10] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 894.989903][ T10] usb 3-1: device descriptor read/64, error -71 [ 895.060276][ T5746] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 895.220179][ T5746] usb 4-1: Using ep0 maxpacket: 32 [ 895.226421][ T5746] usb 4-1: New USB device found, idVendor=110a, idProduct=2210, bcdDevice=bd.da [ 895.237732][ T5746] usb 4-1: config index 0 descriptor too short (expected 241, got 72) [ 895.237822][ T5746] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 895.237873][ T5746] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 895.240208][ T10] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 895.281441][ T5746] usb 4-1: config 0 descriptor?? [ 895.292706][ T5746] mos7840 4-1:0.0: Moschip 7840/7820 USB Serial Driver converter detected [ 895.372286][ T10] usb 3-1: device descriptor read/64, error -71 [ 895.427525][T21495] xt_CT: You must specify a L4 protocol and not use inversions on it [ 895.480552][ T10] usb usb3-port1: attempt power cycle [ 895.664581][T21504] nvme_fabrics: unknown parameter or missing value '#! »›¦1ÝÖæ³R¹Û?¾Ó&nâ¶õ%²ßõƒºë“~ˆÜì[6=pÍŠyz\UÔj@5NãfåWÎrs„)ìq²‰' in ctrl creation request [ 895.829998][ T10] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 895.853091][ T10] usb 3-1: device descriptor read/8, error -71 [ 896.111193][ T10] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 896.143031][ T10] usb 3-1: device descriptor read/8, error -71 [ 896.250984][ T10] usb usb3-port1: unable to enumerate USB device [ 896.296126][T21512] trusted_key: encrypted_key: insufficient parameters specified [ 896.547505][T21516] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4830'. [ 896.547573][T21516] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4830'. [ 896.984130][ T5746] mos7840 ttyUSB0: probe with driver mos7840 failed with error -71 [ 896.995881][ T5746] mos7840 ttyUSB1: probe with driver mos7840 failed with error -71 [ 897.026885][ T5746] usb 4-1: USB disconnect, device number 12 [ 897.078824][ T5746] mos7840 4-1:0.0: device disconnected [ 897.172969][T21522] netlink: 'syz.4.4831': attribute type 10 has an invalid length. [ 897.185799][T21522] 8021q: adding VLAN 0 to HW filter on device bond0 [ 897.190341][T21522] team0: Port device bond0 added [ 897.501312][T21528] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4833'. [ 897.671847][T21533] tipc: Started in network mode [ 897.671933][T21533] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 897.672142][T21533] tipc: Enabled bearer , priority 10 [ 897.771342][T21538] vivid-001: ================= START STATUS ================= [ 897.791521][T21538] vivid-001: Radio HW Seek Mode: Bounded [ 897.806150][T21538] vivid-001: Radio Programmable HW Seek: false [ 897.806190][T21538] vivid-001: RDS Rx I/O Mode: Block I/O [ 897.806224][T21538] vivid-001: Generate RBDS Instead of RDS: false [ 897.806248][T21538] vivid-001: RDS Reception: true [ 897.806270][T21538] vivid-001: RDS Program Type: 0 inactive [ 897.852653][T21538] vivid-001: RDS PS Name: inactive [ 897.858537][T21538] vivid-001: RDS Radio Text: inactive [ 897.864550][T21538] vivid-001: RDS Traffic Announcement: false inactive [ 897.872897][T21538] vivid-001: RDS Traffic Program: false inactive [ 897.872999][T21538] vivid-001: RDS Music: false inactive [ 897.873040][T21538] vivid-001: ================== END STATUS ================== [ 898.273067][T21551] sit0: entered promiscuous mode [ 898.273273][T21551] netlink: 'syz.3.4841': attribute type 1 has an invalid length. [ 898.273292][T21551] netlink: 1 bytes leftover after parsing attributes in process `syz.3.4841'. [ 898.501117][T21558] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4844'. [ 898.743517][T21562] bond3: option ad_user_port_key: invalid value (45094) [ 898.743581][T21562] bond3: option ad_user_port_key: allowed values 0 - 1023 [ 898.763316][T21562] bond3 (unregistering): Released all slaves [ 898.800757][ T5746] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 898.846674][T21566] loop5: detected capacity change from 0 to 7 [ 898.873520][T14854] tipc: Node number set to 11578026 [ 898.885909][T21566] loop5: [ 898.885966][T21566] loop5: partition table partially beyond EOD, truncated [ 899.005545][ T5746] usb 4-1: Using ep0 maxpacket: 16 [ 899.036099][ T5746] usb 4-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 899.056605][ T5746] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 899.056629][ T5746] usb 4-1: config 0 has no interface number 0 [ 899.080734][ T5746] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 899.080790][ T5746] usb 4-1: Product: syz [ 899.080812][ T5746] usb 4-1: Manufacturer: syz [ 899.080832][ T5746] usb 4-1: SerialNumber: syz [ 899.093434][ T5746] usb 4-1: config 0 descriptor?? [ 899.120852][ T5746] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 900.060450][T21569] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 900.060610][T21569] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 900.094085][T21569] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 900.252868][T21583] FAULT_INJECTION: forcing a failure. [ 900.252868][T21583] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 900.252930][T21583] CPU: 1 UID: 0 PID: 21583 Comm: syz.1.4851 Tainted: G L syzkaller #0 PREEMPT(full) [ 900.252957][T21583] Tainted: [L]=SOFTLOCKUP [ 900.252965][T21583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 900.252976][T21583] Call Trace: [ 900.252984][T21583] [ 900.252992][T21583] dump_stack_lvl+0xe8/0x150 [ 900.253027][T21583] should_fail_ex+0x410/0x560 [ 900.253062][T21583] _copy_from_user+0x2d/0xb0 [ 900.253085][T21583] generic_map_update_batch+0x6a3/0x9a0 [ 900.253120][T21583] ? __pfx_generic_map_update_batch+0x10/0x10 [ 900.253147][T21583] ? __fget_files+0x2a/0x420 [ 900.253177][T21583] ? __pfx_generic_map_update_batch+0x10/0x10 [ 900.253212][T21583] bpf_map_do_batch+0x391/0x630 [ 900.253239][T21583] __sys_bpf+0xbe5/0xd90 [ 900.253267][T21583] ? __pfx___sys_bpf+0x10/0x10 [ 900.253297][T21583] ? __fget_files+0x2a/0x420 [ 900.253335][T21583] ? ksys_write+0x242/0x270 [ 900.253363][T21583] ? __pfx_ksys_write+0x10/0x10 [ 900.253392][T21583] __x64_sys_bpf+0xba/0xd0 [ 900.253413][T21583] do_syscall_64+0x166/0x520 [ 900.253439][T21583] ? trace_irq_disable+0x3b/0x140 [ 900.253456][T21583] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.253475][T21583] ? clear_bhb_loop+0x70/0xc0 [ 900.253498][T21583] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.253516][T21583] RIP: 0033:0x7f1a5ad9e159 [ 900.253536][T21583] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 900.253553][T21583] RSP: 002b:00007f1a5bc2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 900.253575][T21583] RAX: ffffffffffffffda RBX: 00007f1a5b025fa0 RCX: 00007f1a5ad9e159 [ 900.253589][T21583] RDX: 0000000000000038 RSI: 00002000000002c0 RDI: 000000000000001a [ 900.253602][T21583] RBP: 00007f1a5bc2d090 R08: 0000000000000000 R09: 0000000000000000 [ 900.253615][T21583] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 900.253626][T21583] R13: 00007f1a5b026038 R14: 00007f1a5b025fa0 R15: 00007f1a5b14fa48 [ 900.253655][T21583] [ 900.370260][T14854] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 900.422707][T21587] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 900.509985][T14854] usb 3-1: device descriptor read/64, error -71 [ 900.556834][ T5746] gspca_spca1528: reg_w err -71 [ 900.557024][ T5746] spca1528 4-1:0.1: probe with driver spca1528 failed with error -71 [ 900.563921][ T5746] usb 4-1: USB disconnect, device number 13 [ 900.740450][T14854] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 900.870276][T14854] usb 3-1: device descriptor read/64, error -71 [ 900.982960][T14854] usb usb3-port1: attempt power cycle [ 901.178076][T21594] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4856'. [ 901.188062][T21594] netlink: 'syz.3.4856': attribute type 10 has an invalid length. [ 901.188096][T21594] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4856'. [ 901.322769][T14854] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 901.334530][T19731] Bluetooth: hci6: command 0x0c1a tx timeout [ 901.344603][T14854] usb 3-1: device descriptor read/8, error -71 [ 901.362943][T21594] geneve2: entered promiscuous mode [ 901.363007][T21594] geneve2: entered allmulticast mode [ 901.396665][T21598] loop5: detected capacity change from 0 to 7 [ 901.402137][T21598] loop5: [ 901.402166][T21598] loop5: partition table partially beyond EOD, truncated [ 901.580498][T14854] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 901.595750][T21600] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4858'. [ 901.601479][T14854] usb 3-1: device descriptor read/8, error -71 [ 901.679242][T21604] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4859'. [ 901.679318][T21604] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4859'. [ 901.712727][T14854] usb usb3-port1: unable to enumerate USB device [ 902.128435][T21616] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4864'. [ 902.140954][T21617] loop3: detected capacity change from 0 to 7 [ 902.152531][T21617] Dev loop3: unable to read RDB block 7 [ 902.152597][T21617] loop3: unable to read partition table [ 902.152843][T21617] loop3: partition table beyond EOD, truncated [ 902.152874][T21617] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 902.646689][T21632] loop5: detected capacity change from 0 to 7 [ 902.648144][T21632] loop5: [ 902.648182][T21632] loop5: partition table partially beyond EOD, truncated [ 902.854647][T21640] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4871'. [ 903.069938][T14969] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 903.097921][T21625] bridge0: port 3(wlan1) entered disabled state [ 903.107041][T21649] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4873'. [ 903.116949][T21649] A link change request failed with some changes committed already. Interface veth1_to_team may have been left with an inconsistent configuration, please check. [ 903.219952][T14969] usb 2-1: Using ep0 maxpacket: 32 [ 903.227152][T14969] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 903.238488][T14969] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 903.238513][T14969] usb 2-1: config 0 has no interfaces? [ 903.238547][T14969] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 903.268561][T14969] usb 2-1: config 0 descriptor?? [ 903.280656][ T7564] usb 4-1: new low-speed USB device number 14 using dummy_hcd [ 903.410171][T19731] Bluetooth: hci6: command 0x0c1a tx timeout [ 903.434996][ T7564] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 903.437669][ T7564] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 903.437703][ T7564] usb 4-1: config 179 has no interface number 0 [ 903.437750][ T7564] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 10 [ 903.437776][ T7564] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 903.437799][ T7564] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 903.437824][ T7564] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 58368, setting to 8 [ 903.437851][ T7564] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 903.437894][ T7564] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 903.561688][T21645] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 903.574382][ T7564] xpad 4-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 903.588279][ T7564] xpad 4-1:179.65: probe with driver xpad failed with error -90 [ 903.590026][ T7561] usb 2-1: USB disconnect, device number 13 [ 903.647203][T21658] FAULT_INJECTION: forcing a failure. [ 903.647203][T21658] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 903.647257][T21658] CPU: 1 UID: 0 PID: 21658 Comm: syz.2.4877 Tainted: G L syzkaller #0 PREEMPT(full) [ 903.647288][T21658] Tainted: [L]=SOFTLOCKUP [ 903.647295][T21658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 903.647307][T21658] Call Trace: [ 903.647316][T21658] [ 903.647326][T21658] dump_stack_lvl+0xe8/0x150 [ 903.647362][T21658] should_fail_ex+0x410/0x560 [ 903.647396][T21658] _copy_from_user+0x2d/0xb0 [ 903.647423][T21658] generic_map_update_batch+0x6a3/0x9a0 [ 903.647459][T21658] ? __pfx_generic_map_update_batch+0x10/0x10 [ 903.647486][T21658] ? __fget_files+0x2a/0x420 [ 903.647518][T21658] ? __pfx_generic_map_update_batch+0x10/0x10 [ 903.647543][T21658] bpf_map_do_batch+0x391/0x630 [ 903.647571][T21658] __sys_bpf+0xbe5/0xd90 [ 903.647599][T21658] ? __pfx___sys_bpf+0x10/0x10 [ 903.647628][T21658] ? __fget_files+0x2a/0x420 [ 903.647666][T21658] ? ksys_write+0x242/0x270 [ 903.647695][T21658] ? __pfx_ksys_write+0x10/0x10 [ 903.647725][T21658] __x64_sys_bpf+0xba/0xd0 [ 903.647747][T21658] do_syscall_64+0x166/0x520 [ 903.647773][T21658] ? trace_irq_disable+0x3b/0x140 [ 903.647790][T21658] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 903.647809][T21658] ? clear_bhb_loop+0x70/0xc0 [ 903.647832][T21658] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 903.647851][T21658] RIP: 0033:0x7f729679e159 [ 903.647871][T21658] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 903.647888][T21658] RSP: 002b:00007f729762b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 903.647912][T21658] RAX: ffffffffffffffda RBX: 00007f7296a25fa0 RCX: 00007f729679e159 [ 903.647926][T21658] RDX: 0000000000000038 RSI: 00002000000002c0 RDI: 000000000000001a [ 903.647939][T21658] RBP: 00007f729762b090 R08: 0000000000000000 R09: 0000000000000000 [ 903.647952][T21658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 903.647964][T21658] R13: 00007f7296a26038 R14: 00007f7296a25fa0 R15: 00007f7296b4fa48 [ 903.647993][T21658] [ 903.774450][ T7564] usb 4-1: USB disconnect, device number 14 [ 903.813127][T21661] IPVS: nq: FWM 3 0x00000003 - no destination available [ 903.858269][T18332] IPVS: starting estimator thread 0... [ 903.949947][T21662] IPVS: using max 29 ests per chain, 69600 per kthread [ 904.000743][T21668] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4879'. [ 904.000834][T21668] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4879'. [ 904.250327][T21672] loop5: detected capacity change from 0 to 7 [ 904.259686][T21672] loop5: [ 904.263971][T21672] loop5: partition table partially beyond EOD, truncated [ 904.425626][T21676] netlink: 180 bytes leftover after parsing attributes in process `syz.3.4883'. [ 904.440347][T21676] trusted_key: encrypted_key: insufficient parameters specified [ 904.854408][T21688] FAULT_INJECTION: forcing a failure. [ 904.854408][T21688] name failslab, interval 1, probability 0, space 0, times 0 [ 904.868670][T21688] CPU: 0 UID: 0 PID: 21688 Comm: syz.1.4888 Tainted: G L syzkaller #0 PREEMPT(full) [ 904.868721][T21688] Tainted: [L]=SOFTLOCKUP [ 904.868729][T21688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 904.868741][T21688] Call Trace: [ 904.868750][T21688] [ 904.868759][T21688] dump_stack_lvl+0xe8/0x150 [ 904.868798][T21688] should_fail_ex+0x410/0x560 [ 904.868834][T21688] should_failslab+0xa8/0x100 [ 904.868860][T21688] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 904.868893][T21688] ? copy_array+0x71/0x100 [ 904.868919][T21688] ? copy_array+0x71/0x100 [ 904.868946][T21688] ? copy_array+0x71/0x100 [ 904.868974][T21688] krealloc_node_align_noprof+0x19a/0x390 [ 904.868995][T21688] ? __kmalloc_cache_noprof+0x14d/0x600 [ 904.869024][T21688] ? bpf_copy_verifier_state+0xb1f/0x1170 [ 904.869053][T21688] copy_array+0x71/0x100 [ 904.869087][T21688] bpf_copy_verifier_state+0x9b0/0x1170 [ 904.869128][T21688] push_stack+0x1b9/0x380 [ 904.869162][T21688] sanitize_speculative_path+0x2e/0x550 [ 904.869189][T21688] ? do_check_insn+0x5d76/0x17d70 [ 904.869220][T21688] do_check_insn+0xb2fd/0x17d70 [ 904.869274][T21688] ? __pfx_do_check_insn+0x10/0x10 [ 904.869311][T21688] ? kasan_quarantine_put+0xbb/0x1f0 [ 904.869341][T21688] ? lockdep_hardirqs_on+0x7b/0x110 [ 904.869374][T21688] ? kfree+0x1c5/0x650 [ 904.869397][T21688] ? krealloc_node_align_noprof+0x235/0x390 [ 904.869422][T21688] ? krealloc_node_align_noprof+0x235/0x390 [ 904.869444][T21688] ? bpf_push_jmp_history+0x27d/0x6d0 [ 904.869475][T21688] do_check_common+0x3c19/0x5d30 [ 904.869541][T21688] ? __pfx_do_check_common+0x10/0x10 [ 904.869580][T21688] bpf_check+0x2639/0x2e10 [ 904.869612][T21688] ? ktime_get_with_offset+0x93/0x2d0 [ 904.869638][T21688] ? __pfx_bpf_check+0x10/0x10 [ 904.869663][T21688] ? bpf_obj_name_cpy+0x194/0x1e0 [ 904.869705][T21688] bpf_prog_load+0x14d6/0x1c20 [ 904.869741][T21688] ? __pfx_bpf_prog_load+0x10/0x10 [ 904.869784][T21688] __sys_bpf+0xd0d/0xd90 [ 904.869814][T21688] ? __pfx___sys_bpf+0x10/0x10 [ 904.869847][T21688] ? __fget_files+0x2a/0x420 [ 904.869889][T21688] ? ksys_write+0x242/0x270 [ 904.869918][T21688] ? __pfx_ksys_write+0x10/0x10 [ 904.869948][T21688] __x64_sys_bpf+0xba/0xd0 [ 904.869971][T21688] do_syscall_64+0x166/0x520 [ 904.869998][T21688] ? trace_irq_disable+0x3b/0x140 [ 904.870017][T21688] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 904.870037][T21688] ? clear_bhb_loop+0x70/0xc0 [ 904.870061][T21688] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 904.870079][T21688] RIP: 0033:0x7f1a5ad9e159 [ 904.870099][T21688] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 904.870116][T21688] RSP: 002b:00007f1a5bc2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 904.870138][T21688] RAX: ffffffffffffffda RBX: 00007f1a5b025fa0 RCX: 00007f1a5ad9e159 [ 904.870151][T21688] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 904.870164][T21688] RBP: 00007f1a5bc2d090 R08: 0000000000000000 R09: 0000000000000000 [ 904.870177][T21688] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 904.870190][T21688] R13: 00007f1a5b026038 R14: 00007f1a5b025fa0 R15: 00007f1a5b14fa48 [ 904.870224][T21688] [ 905.170455][ T7557] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 905.319921][ T7557] usb 3-1: Using ep0 maxpacket: 32 [ 905.321441][ T7557] usb 3-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 905.322809][ T7557] usb 3-1: config 0 has an invalid interface number: 35 but max is 0 [ 905.322836][ T7557] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 905.322855][ T7557] usb 3-1: config 0 has no interface number 0 [ 905.322893][ T7557] usb 3-1: config 0 interface 35 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 905.325321][ T7557] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 905.325345][ T7557] usb 3-1: Product: syz [ 905.325359][ T7557] usb 3-1: Manufacturer: syz [ 905.325373][ T7557] usb 3-1: SerialNumber: syz [ 905.332056][ T7557] usb 3-1: config 0 descriptor?? [ 905.345004][ T7557] radio-si470x 3-1:0.35: could not find interrupt in endpoint [ 905.345097][ T7557] radio-si470x 3-1:0.35: probe with driver radio-si470x failed with error -5 [ 905.490022][T19731] Bluetooth: hci6: command 0x0c1a tx timeout [ 905.624624][T21690] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 905.625200][T21690] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 905.635917][ T7557] radio-raremono 3-1:0.35: this is not Thanko's Raremono. [ 905.636334][ T7557] usbhid 3-1:0.35: couldn't find an input interrupt endpoint [ 905.654949][T21703] loop5: detected capacity change from 0 to 7 [ 905.655728][T21703] loop5: [ 905.655750][T21703] loop5: partition table partially beyond EOD, truncated [ 905.710361][ T5612] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 905.860870][ T5612] usb 2-1: Using ep0 maxpacket: 32 [ 905.867094][ T5612] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 905.878444][ T5612] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 905.887109][ T5612] usb 2-1: config 0 has no interface number 0 [ 905.891132][ T5612] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 905.891168][ T5612] usb 2-1: Product: syz [ 905.891183][ T5612] usb 2-1: Manufacturer: syz [ 905.891197][ T5612] usb 2-1: SerialNumber: syz [ 905.903345][ T5612] usb 2-1: config 0 descriptor?? [ 905.914837][ T5612] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 905.914925][ T5612] usb 2-1: selecting invalid altsetting 1 [ 905.914943][ T5612] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 905.922205][ T5612] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 905.922545][ T5612] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 905.922592][ T5612] usb 2-1: media controller created [ 905.933839][T14969] usb 3-1: USB disconnect, device number 118 [ 905.959213][ T5612] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 906.301653][ T5746] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 906.398522][T21716] FAULT_INJECTION: forcing a failure. [ 906.398522][T21716] name failslab, interval 1, probability 0, space 0, times 0 [ 906.398592][T21716] CPU: 0 UID: 0 PID: 21716 Comm: syz.4.4900 Tainted: G L syzkaller #0 PREEMPT(full) [ 906.398633][T21716] Tainted: [L]=SOFTLOCKUP [ 906.398642][T21716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 906.398653][T21716] Call Trace: [ 906.398662][T21716] [ 906.398670][T21716] dump_stack_lvl+0xe8/0x150 [ 906.398704][T21716] should_fail_ex+0x410/0x560 [ 906.398737][T21716] should_failslab+0xa8/0x100 [ 906.398762][T21716] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 906.398792][T21716] ? copy_array+0x71/0x100 [ 906.398816][T21716] ? copy_array+0x71/0x100 [ 906.398843][T21716] ? copy_array+0x71/0x100 [ 906.398869][T21716] krealloc_node_align_noprof+0x19a/0x390 [ 906.398888][T21716] ? __kmalloc_cache_noprof+0x14d/0x600 [ 906.398913][T21716] ? bpf_copy_verifier_state+0xb1f/0x1170 [ 906.398942][T21716] copy_array+0x71/0x100 [ 906.398969][T21716] bpf_copy_verifier_state+0x9b0/0x1170 [ 906.399006][T21716] push_stack+0x1b9/0x380 [ 906.399036][T21716] sanitize_speculative_path+0x2e/0x550 [ 906.399061][T21716] ? do_check_insn+0x5d76/0x17d70 [ 906.399089][T21716] do_check_insn+0xb2fd/0x17d70 [ 906.399147][T21716] ? __pfx_do_check_insn+0x10/0x10 [ 906.399171][T21716] ? bpf_live_stack_query_init+0x6d1/0x790 [ 906.399193][T21716] ? bpf_mark_reg_not_init+0x5f/0x1c0 [ 906.399220][T21716] ? __asan_memcpy+0x40/0x70 [ 906.399248][T21716] ? bpf_explored_state+0x79/0x1a0 [ 906.399276][T21716] ? bpf_is_state_visited+0x3750/0x47e0 [ 906.399317][T21716] ? bpf_push_jmp_history+0x27d/0x6d0 [ 906.399344][T21716] do_check_common+0x3c19/0x5d30 [ 906.399402][T21716] ? __pfx_do_check_common+0x10/0x10 [ 906.399437][T21716] bpf_check+0x2639/0x2e10 [ 906.399466][T21716] ? ktime_get_with_offset+0x93/0x2d0 [ 906.399490][T21716] ? __pfx_bpf_check+0x10/0x10 [ 906.399512][T21716] ? bpf_obj_name_cpy+0x194/0x1e0 [ 906.399541][T21716] bpf_prog_load+0x14d6/0x1c20 [ 906.399573][T21716] ? __pfx_bpf_prog_load+0x10/0x10 [ 906.399618][T21716] __sys_bpf+0xd0d/0xd90 [ 906.399647][T21716] ? __pfx___sys_bpf+0x10/0x10 [ 906.399678][T21716] ? __fget_files+0x2a/0x420 [ 906.399718][T21716] ? ksys_write+0x242/0x270 [ 906.399745][T21716] ? __pfx_ksys_write+0x10/0x10 [ 906.399776][T21716] __x64_sys_bpf+0xba/0xd0 [ 906.399797][T21716] do_syscall_64+0x166/0x520 [ 906.399823][T21716] ? trace_irq_disable+0x3b/0x140 [ 906.399840][T21716] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 906.399859][T21716] ? clear_bhb_loop+0x70/0xc0 [ 906.399882][T21716] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 906.399900][T21716] RIP: 0033:0x7f0e7b59e159 [ 906.399920][T21716] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 906.399937][T21716] RSP: 002b:00007f0e7c43f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 906.399958][T21716] RAX: ffffffffffffffda RBX: 00007f0e7b825fa0 RCX: 00007f0e7b59e159 [ 906.399973][T21716] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 906.399985][T21716] RBP: 00007f0e7c43f090 R08: 0000000000000000 R09: 0000000000000000 [ 906.399997][T21716] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 906.400009][T21716] R13: 00007f0e7b826038 R14: 00007f0e7b825fa0 R15: 00007f0e7b94fa48 [ 906.400051][T21716] [ 906.450503][ T5746] usb 4-1: device descriptor read/64, error -71 [ 906.652081][T21718] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 906.655713][T21718] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 906.692551][ T5746] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 906.818958][T21721] fuse: Unknown parameter '' [ 906.831367][ T5746] usb 4-1: device descriptor read/64, error -71 [ 906.946044][ T5746] usb usb4-port1: attempt power cycle [ 907.092019][ T5612] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 907.094992][ T5612] zl10353_read_register: readreg error (reg=127, ret==-110) [ 907.189391][ T5612] usb 2-1: USB disconnect, device number 14 [ 907.279987][ T5746] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 907.279987][ T7557] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 907.303592][ T5746] usb 4-1: device descriptor read/8, error -71 [ 907.441410][ T7557] usb 3-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 907.443716][ T7557] usb 3-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 907.443750][ T7557] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 907.447402][ T7557] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 907.447435][ T7557] usb 3-1: Product: syz [ 907.447451][ T7557] usb 3-1: Manufacturer: syz [ 907.447466][ T7557] usb 3-1: SerialNumber: syz [ 907.458431][ T7557] usb 3-1: config 0 descriptor?? [ 907.466012][ T7557] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 907.549971][ T5746] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 907.578127][ T5746] usb 4-1: device descriptor read/8, error -71 [ 907.681227][ T5746] usb usb4-port1: unable to enumerate USB device [ 907.784892][T21739] vlan0: entered promiscuous mode [ 908.242753][T21748] program syz.6.4913 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 908.841817][T21752] IPVS: nq: FWM 3 0x00000003 - no destination available [ 908.849706][T12541] IPVS: starting estimator thread 0... [ 908.949891][T21753] IPVS: using max 33 ests per chain, 79200 per kthread [ 909.238930][T21760] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3303861288 (422894244864 ns) > initial count (241705619456 ns). Using initial count to start timer. [ 909.257898][T21760] kvm: apic: phys broadcast and lowest prio [ 909.326101][T21756] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4915'. [ 909.919584][T21779] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4924'. [ 910.085952][ T5746] usb 3-1: USB disconnect, device number 119 [ 910.141664][ T5612] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 910.271367][ T7557] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 910.323555][ T5612] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 910.324818][ T5612] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 910.324846][ T5612] usb 2-1: config 0 has no interface number 0 [ 910.338564][ T5612] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 910.338595][ T5612] usb 2-1: Product: syz [ 910.338610][ T5612] usb 2-1: Manufacturer: syz [ 910.338625][ T5612] usb 2-1: SerialNumber: syz [ 910.351361][ T5612] usb 2-1: config 0 descriptor?? [ 910.454014][ T7557] usb 4-1: unable to get BOS descriptor or descriptor too short [ 910.456121][ T7557] usb 4-1: New USB device found, idVendor=100d, idProduct=3342, bcdDevice=99.ba [ 910.475392][ T7557] usb 4-1: config 8 has an invalid interface number: 129 but max is 1 [ 910.484016][ T7557] usb 4-1: config 8 has an invalid interface number: 158 but max is 1 [ 910.484077][ T7557] usb 4-1: config 8 has no interface number 0 [ 910.484099][ T7557] usb 4-1: config 8 has no interface number 1 [ 910.484164][ T7557] usb 4-1: config 8 interface 158 has no altsetting 0 [ 910.517266][ T7557] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 910.517319][ T7557] usb 4-1: Product: syz [ 910.517355][ T7557] usb 4-1: Manufacturer: syz [ 910.517375][ T7557] usb 4-1: SerialNumber: syz [ 910.827898][ T7557] cxacru 4-1:8.129: cxacru_bind: interface has incorrect endpoints [ 910.828089][ T7557] cxacru 4-1:8.129: usbatm_usb_probe: bind failed: -19! [ 910.855933][ T5612] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 910.862911][ T5612] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 910.867445][ T5612] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 910.867505][ T5612] usb 2-1: media controller created [ 910.906883][ T7557] cxacru 4-1:8.158: cxacru_bind: interface has incorrect endpoints [ 910.907063][ T7557] cxacru 4-1:8.158: usbatm_usb_probe: bind failed: -19! [ 910.946610][ T7557] usb 4-1: USB disconnect, device number 19 [ 910.965520][ T5612] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 911.149915][T14969] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 911.318549][T21801] IPVS: nq: FWM 3 0x00000003 - no destination available [ 911.340484][T14969] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 911.340599][T14969] usb 3-1: too many configurations: 17, using maximum allowed: 8 [ 911.345987][T14969] usb 3-1: config index 0 descriptor too short (expected 65111, got 72) [ 911.347904][T14969] usb 3-1: config index 1 descriptor too short (expected 65111, got 72) [ 911.349585][T14969] usb 3-1: config index 2 descriptor too short (expected 65111, got 72) [ 911.351637][T14969] usb 3-1: config index 3 descriptor too short (expected 65111, got 72) [ 911.354147][T14969] usb 3-1: config index 4 descriptor too short (expected 65111, got 72) [ 911.369266][T14969] usb 3-1: config index 5 descriptor too short (expected 65111, got 72) [ 911.371129][T14969] usb 3-1: config index 6 descriptor too short (expected 65111, got 72) [ 911.372327][T14969] usb 3-1: config index 7 descriptor too short (expected 65111, got 72) [ 911.552114][T21804] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4932'. [ 911.999908][ T7561] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 912.149912][ T7561] usb 4-1: Using ep0 maxpacket: 16 [ 912.151938][ T5612] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 912.162882][ T7561] usb 4-1: New USB device found, idVendor=0bfd, idProduct=000b, bcdDevice=a9.3d [ 912.176987][ T7561] usb 4-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 912.177059][ T7561] usb 4-1: config 3 has 0 interfaces, different from the descriptor's value: 1 [ 912.203053][ T7561] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 912.212704][ T7561] usb 4-1: Product: syz [ 912.212733][ T7561] usb 4-1: Manufacturer: syz [ 912.212749][ T7561] usb 4-1: SerialNumber: syz [ 912.263321][ T5612] usb 2-1: USB disconnect, device number 16 [ 912.463561][ T7561] usb 4-1: USB disconnect, device number 20 [ 912.549580][T21809] loop3: detected capacity change from 0 to 7 [ 912.558788][T21809] Dev loop3: unable to read RDB block 7 [ 912.566716][T21809] loop3: unable to read partition table [ 912.567308][T21809] loop3: partition table beyond EOD, truncated [ 912.567351][T21809] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 912.808491][T21811] netlink: 60 bytes leftover after parsing attributes in process `syz.6.4935'. [ 912.996349][T21815] netlink: 128 bytes leftover after parsing attributes in process `syz.6.4937'. [ 913.006150][T21815] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 913.512125][T21832] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 913.656938][T21834] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4943'. [ 913.719565][T14969] usb 3-1: string descriptor 0 read error: -71 [ 913.719811][T14969] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 913.762230][T14969] usb 3-1: can't set config #1, error -71 [ 913.776688][T14969] usb 3-1: USB disconnect, device number 120 [ 913.969451][T21836] IPVS: nq: FWM 3 0x00000003 - no destination available [ 914.282268][T14854] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 914.292239][T14969] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 914.458926][T14854] usb 3-1: unable to get BOS descriptor or descriptor too short [ 914.459018][T14854] usb 3-1: New USB device found, idVendor=100d, idProduct=3342, bcdDevice=99.ba [ 914.479323][T14854] usb 3-1: config 8 has an invalid interface number: 129 but max is 1 [ 914.479390][T14854] usb 3-1: config 8 has an invalid interface number: 158 but max is 1 [ 914.479415][T14854] usb 3-1: config 8 has no interface number 0 [ 914.479432][T14854] usb 3-1: config 8 has no interface number 1 [ 914.479486][T14854] usb 3-1: config 8 interface 158 has no altsetting 0 [ 914.494802][T14854] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 914.494836][T14854] usb 3-1: Product: syz [ 914.494851][T14854] usb 3-1: Manufacturer: syz [ 914.494865][T14854] usb 3-1: SerialNumber: syz [ 915.079559][T21852] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4947'. [ 915.326895][T14854] cxacru 3-1:8.129: cxacru_bind: interface has incorrect endpoints [ 915.327083][T14854] cxacru 3-1:8.129: usbatm_usb_probe: bind failed: -19! [ 915.418546][T14854] cxacru 3-1:8.158: cxacru_bind: interface has incorrect endpoints [ 915.418764][T14854] cxacru 3-1:8.158: usbatm_usb_probe: bind failed: -19! [ 915.475870][T14854] usb 3-1: USB disconnect, device number 121 [ 915.490025][ T5612] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 915.610091][T21864] loop3: detected capacity change from 0 to 1 [ 915.621241][T21864] Dev loop3: unable to read RDB block 1 [ 915.621329][T21864] loop3: unable to read partition table [ 915.621607][T21864] loop3: partition table beyond EOD, truncated [ 915.621665][T21864] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 915.674131][ T5612] usb 4-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 915.688952][ T5612] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 915.711527][ T5612] usb 4-1: config 0 descriptor?? [ 915.735397][ T5612] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 915.948379][T21870] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4954'. [ 915.974580][ T5612] gp8psk: usb in 128 operation failed. [ 916.343502][ T5612] gp8psk: usb in 146 operation failed. [ 916.343544][ T5612] gp8psk: failed to get FW version [ 916.358155][ T5612] gp8psk: FPGA Version = 224 [ 916.382205][T21888] IPVS: nq: FWM 3 0x00000003 - no destination available [ 916.425683][T21890] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4958'. [ 916.638801][ T30] audit: type=1326 audit(1788058109.375:7292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21893 comm="syz.2.4959" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f729679e159 code=0x0 [ 916.840006][ T7557] usb 2-1: new full-speed USB device number 18 using dummy_hcd [ 916.969958][ T7557] usb 2-1: device descriptor read/64, error -71 [ 917.209923][ T7557] usb 2-1: new full-speed USB device number 19 using dummy_hcd [ 917.286384][ T5612] gp8psk: usb in 138 operation failed. [ 917.292666][ T5612] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 917.303693][ T5612] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 917.317981][ T5612] usb 4-1: USB disconnect, device number 21 [ 917.341828][ T7557] usb 2-1: device descriptor read/64, error -71 [ 917.450446][ T7557] usb usb2-port1: attempt power cycle [ 917.786645][T21903] netlink: 100 bytes leftover after parsing attributes in process `syz.2.4962'. [ 917.790051][ T7557] usb 2-1: new full-speed USB device number 20 using dummy_hcd [ 917.814964][ T7557] usb 2-1: device descriptor read/8, error -71 [ 918.020973][T21906] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4963'. [ 918.030488][T21906] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4963'. [ 918.051593][ T7557] usb 2-1: new full-speed USB device number 21 using dummy_hcd [ 918.101662][ T7557] usb 2-1: device descriptor read/8, error -71 [ 918.210554][ T7557] usb usb2-port1: unable to enumerate USB device [ 918.269943][ T5612] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 918.420635][ T5612] usb 4-1: Using ep0 maxpacket: 16 [ 918.426810][ T5612] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 918.438049][ T5612] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 918.450417][ T5612] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 918.450484][ T5612] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 918.450545][ T5612] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 918.494010][ T5612] usb 4-1: config 0 descriptor?? [ 918.559096][T21914] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4966'. [ 918.806805][T21921] netlink: 'syz.6.4967': attribute type 4 has an invalid length. [ 918.828237][T21921] netlink: 'syz.6.4967': attribute type 4 has an invalid length. [ 918.943178][ T5612] microsoft 0003:045E:07DA.001C: ignoring exceeding usage max [ 918.972041][ T5612] microsoft 0003:045E:07DA.001C: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 918.989922][T14969] usb 3-1: new low-speed USB device number 122 using dummy_hcd [ 919.130069][T14969] usb 3-1: device descriptor read/64, error -71 [ 919.132629][ T7557] usb 4-1: USB disconnect, device number 22 [ 919.379957][T14969] usb 3-1: new low-speed USB device number 123 using dummy_hcd [ 919.502590][T21929] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4969'. [ 919.513999][T21929] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4969'. [ 919.526520][T14969] usb 3-1: device descriptor read/64, error -71 [ 919.630273][T14969] usb usb3-port1: attempt power cycle [ 919.748778][T21932] netlink: 40 bytes leftover after parsing attributes in process `syz.6.4970'. [ 919.830798][T21935] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 919.971464][T14969] usb 3-1: new low-speed USB device number 124 using dummy_hcd [ 920.001276][T14969] usb 3-1: device descriptor read/8, error -71 [ 920.241453][T14969] usb 3-1: new low-speed USB device number 125 using dummy_hcd [ 920.281620][T14969] usb 3-1: device descriptor read/8, error -71 [ 920.290116][T21939] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 920.392694][T14969] usb usb3-port1: unable to enumerate USB device [ 920.839917][ T7561] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 920.991212][ T7561] usb 2-1: New USB device found, idVendor=194f, idProduct=010c, bcdDevice= 0.40 [ 920.995334][ T7561] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 1023 [ 921.001014][ T7561] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 921.001047][ T7561] usb 2-1: Product: syz [ 921.001062][ T7561] usb 2-1: Manufacturer: syz [ 921.001076][ T7561] usb 2-1: SerialNumber: syz [ 921.057332][T21951] bond7: option ad_user_port_key: invalid value (23571) [ 921.057399][T21951] bond7: option ad_user_port_key: allowed values 0 - 1023 [ 921.076960][T21951] bond7 (unregistering): Released all slaves [ 921.279605][ T7561] usb 2-1: incorrect wMaxPacketSize 0x3ff for BADD profile [ 921.556120][ T7561] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 921.588089][ T7561] usb 2-1: USB disconnect, device number 22 [ 921.808896][T17890] udevd[17890]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 922.033002][T21967] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 922.096706][T21966] IPVS: nq: FWM 3 0x00000003 - no destination available [ 922.440413][ T7561] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 922.569966][ T7561] usb 2-1: device descriptor read/64, error -71 [ 922.590457][T21992] FAULT_INJECTION: forcing a failure. [ 922.590457][T21992] name failslab, interval 1, probability 0, space 0, times 0 [ 922.603733][T21992] CPU: 0 UID: 0 PID: 21992 Comm: syz.3.4987 Tainted: G L syzkaller #0 PREEMPT(full) [ 922.603775][T21992] Tainted: [L]=SOFTLOCKUP [ 922.603783][T21992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 922.603796][T21992] Call Trace: [ 922.603804][T21992] [ 922.603813][T21992] dump_stack_lvl+0xe8/0x150 [ 922.603851][T21992] should_fail_ex+0x410/0x560 [ 922.603889][T21992] should_failslab+0xa8/0x100 [ 922.603917][T21992] __kmalloc_cache_noprof+0xa3/0x600 [ 922.603948][T21992] ? push_stack+0x7e/0x380 [ 922.603975][T21992] ? push_stack+0x7e/0x380 [ 922.604007][T21992] push_stack+0x7e/0x380 [ 922.604035][T21992] sanitize_speculative_path+0x2e/0x550 [ 922.604062][T21992] ? do_check_insn+0x5d76/0x17d70 [ 922.604093][T21992] do_check_insn+0xb2fd/0x17d70 [ 922.604148][T21992] ? __pfx_do_check_insn+0x10/0x10 [ 922.604190][T21992] ? kasan_quarantine_put+0xbb/0x1f0 [ 922.604222][T21992] ? lockdep_hardirqs_on+0x7b/0x110 [ 922.604267][T21992] ? kfree+0x1c5/0x650 [ 922.604291][T21992] ? krealloc_node_align_noprof+0x235/0x390 [ 922.604319][T21992] ? krealloc_node_align_noprof+0x235/0x390 [ 922.604343][T21992] ? bpf_push_jmp_history+0x27d/0x6d0 [ 922.604376][T21992] do_check_common+0x3c19/0x5d30 [ 922.604439][T21992] ? __pfx_do_check_common+0x10/0x10 [ 922.604476][T21992] bpf_check+0x2639/0x2e10 [ 922.604510][T21992] ? ktime_get_with_offset+0x93/0x2d0 [ 922.604535][T21992] ? __pfx_bpf_check+0x10/0x10 [ 922.604558][T21992] ? bpf_obj_name_cpy+0x194/0x1e0 [ 922.604590][T21992] bpf_prog_load+0x14d6/0x1c20 [ 922.604626][T21992] ? __pfx_bpf_prog_load+0x10/0x10 [ 922.604673][T21992] __sys_bpf+0xd0d/0xd90 [ 922.604705][T21992] ? __pfx___sys_bpf+0x10/0x10 [ 922.604739][T21992] ? __fget_files+0x2a/0x420 [ 922.604795][T21992] ? ksys_write+0x242/0x270 [ 922.604828][T21992] ? __pfx_ksys_write+0x10/0x10 [ 922.604859][T21992] __x64_sys_bpf+0xba/0xd0 [ 922.604880][T21992] do_syscall_64+0x166/0x520 [ 922.604906][T21992] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 922.604925][T21992] ? clear_bhb_loop+0x70/0xc0 [ 922.604949][T21992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 922.604969][T21992] RIP: 0033:0x7fda7cb9e159 [ 922.604987][T21992] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 922.605005][T21992] RSP: 002b:00007fda7d9f1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 922.605028][T21992] RAX: ffffffffffffffda RBX: 00007fda7ce25fa0 RCX: 00007fda7cb9e159 [ 922.605042][T21992] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 922.605055][T21992] RBP: 00007fda7d9f1090 R08: 0000000000000000 R09: 0000000000000000 [ 922.605068][T21992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 922.605079][T21992] R13: 00007fda7ce26038 R14: 00007fda7ce25fa0 R15: 00007fda7cf4fa48 [ 922.605112][T21992] [ 922.691888][T21994] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4988'. [ 922.820095][ T7561] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 922.950521][ T7561] usb 2-1: device descriptor read/64, error -71 [ 923.061516][ T7561] usb usb2-port1: attempt power cycle [ 923.324833][T22011] netlink: 176 bytes leftover after parsing attributes in process `syz.3.4994'. [ 923.400246][ T7561] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 923.423773][ T7561] usb 2-1: device descriptor read/8, error -71 [ 923.660016][ T7561] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 923.684917][ T7561] usb 2-1: device descriptor read/8, error -71 [ 923.791219][ T7561] usb usb2-port1: unable to enumerate USB device [ 924.477218][T22017] bond7: option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 924.484485][T22017] bond7 (unregistering): Released all slaves [ 924.573315][ T30] audit: type=1326 audit(1788058117.315:7293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22020 comm="syz.2.4997" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f729679e159 code=0x0 [ 924.873451][T22027] 8021q: adding VLAN 0 to HW filter on device bond0 [ 924.876560][T22032] FAULT_INJECTION: forcing a failure. [ 924.876560][T22032] name failslab, interval 1, probability 0, space 0, times 0 [ 924.876603][T22032] CPU: 1 UID: 0 PID: 22032 Comm: syz.4.5000 Tainted: G L syzkaller #0 PREEMPT(full) [ 924.876630][T22032] Tainted: [L]=SOFTLOCKUP [ 924.876638][T22032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 924.876650][T22032] Call Trace: [ 924.876659][T22032] [ 924.876668][T22032] dump_stack_lvl+0xe8/0x150 [ 924.876702][T22032] should_fail_ex+0x410/0x560 [ 924.876736][T22032] should_failslab+0xa8/0x100 [ 924.876761][T22032] __kmalloc_cache_noprof+0xa3/0x600 [ 924.876798][T22032] ? push_stack+0x7e/0x380 [ 924.876822][T22032] ? push_stack+0x7e/0x380 [ 924.876853][T22032] push_stack+0x7e/0x380 [ 924.876898][T22032] sanitize_speculative_path+0x2e/0x550 [ 924.876923][T22032] ? do_check_insn+0x5d76/0x17d70 [ 924.876950][T22032] do_check_insn+0xb2fd/0x17d70 [ 924.876999][T22032] ? __pfx_do_check_insn+0x10/0x10 [ 924.877037][T22032] ? kasan_quarantine_put+0xbb/0x1f0 [ 924.877065][T22032] ? lockdep_hardirqs_on+0x7b/0x110 [ 924.877095][T22032] ? kfree+0x1c5/0x650 [ 924.877117][T22032] ? krealloc_node_align_noprof+0x235/0x390 [ 924.877147][T22032] ? krealloc_node_align_noprof+0x235/0x390 [ 924.877172][T22032] ? bpf_push_jmp_history+0x27d/0x6d0 [ 924.877201][T22032] do_check_common+0x3c19/0x5d30 [ 924.877271][T22032] ? __pfx_do_check_common+0x10/0x10 [ 924.877306][T22032] bpf_check+0x2639/0x2e10 [ 924.877337][T22032] ? ktime_get_with_offset+0x93/0x2d0 [ 924.877362][T22032] ? __pfx_bpf_check+0x10/0x10 [ 924.877384][T22032] ? bpf_obj_name_cpy+0x194/0x1e0 [ 924.877413][T22032] bpf_prog_load+0x14d6/0x1c20 [ 924.877446][T22032] ? __pfx_bpf_prog_load+0x10/0x10 [ 924.877491][T22032] __sys_bpf+0xd0d/0xd90 [ 924.877519][T22032] ? __pfx___sys_bpf+0x10/0x10 [ 924.877550][T22032] ? __fget_files+0x2a/0x420 [ 924.877591][T22032] ? ksys_write+0x242/0x270 [ 924.877619][T22032] ? __pfx_ksys_write+0x10/0x10 [ 924.877649][T22032] __x64_sys_bpf+0xba/0xd0 [ 924.877671][T22032] do_syscall_64+0x166/0x520 [ 924.877697][T22032] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 924.877717][T22032] ? clear_bhb_loop+0x70/0xc0 [ 924.877739][T22032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 924.877758][T22032] RIP: 0033:0x7f0e7b59e159 [ 924.877786][T22032] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 924.877802][T22032] RSP: 002b:00007f0e7c43f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 924.877825][T22032] RAX: ffffffffffffffda RBX: 00007f0e7b825fa0 RCX: 00007f0e7b59e159 [ 924.877839][T22032] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 924.877851][T22032] RBP: 00007f0e7c43f090 R08: 0000000000000000 R09: 0000000000000000 [ 924.877862][T22032] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 924.877874][T22032] R13: 00007f0e7b826038 R14: 00007f0e7b825fa0 R15: 00007f0e7b94fa48 [ 924.877904][T22032] [ 924.986063][T22027] 8021q: adding VLAN 0 to HW filter on device team0 [ 924.991870][T22027] tipc: Resetting bearer [ 925.004135][T22027] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 925.146044][T22036] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5001'. [ 925.146093][T22036] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5001'. [ 925.345193][T22027] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 925.357440][T22027] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 925.578666][T22027] veth1_vlan: left promiscuous mode [ 925.621384][T22027] veth0_vlan: left promiscuous mode [ 925.659349][T22027] veth0_vlan: entered promiscuous mode [ 925.687597][T22027] veth1_vlan: entered promiscuous mode [ 925.789020][T22027] veth1_macvtap: left promiscuous mode [ 925.813551][T22027] veth0_macvtap: left promiscuous mode [ 925.833470][T22027] veth0_macvtap: entered promiscuous mode [ 925.855640][T22027] veth1_macvtap: entered promiscuous mode [ 925.935788][T22048] IPVS: nq: FWM 3 0x00000003 - no destination available [ 926.007009][T22027] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 926.016114][T22027] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 926.025484][T22027] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 926.041452][T22027] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 926.107102][ T5746] bridge0: entered promiscuous mode [ 926.270026][ T7561] usb 3-1: new full-speed USB device number 127 using dummy_hcd [ 926.300474][T14969] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 926.450329][T14969] usb 2-1: device descriptor read/64, error -71 [ 926.530383][T12541] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 926.570236][T12541] bond1: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 926.586935][T12541] bond1: (slave veth3): making interface the new active one [ 926.592852][T12541] bond1: active interface up! [ 926.603627][T18332] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 926.604850][T18332] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 926.604902][T18332] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 926.700266][T14969] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 926.743358][ T10] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 926.850886][T14969] usb 2-1: device descriptor read/64, error -71 [ 926.901815][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 926.903120][ T10] usb 4-1: New USB device found, idVendor=0458, idProduct=501b, bcdDevice= 0.00 [ 926.906041][ T10] usb 4-1: too many endpoints for config 0 interface 0 altsetting 253: 141, using maximum allowed: 30 [ 926.906091][ T10] usb 4-1: config 0 interface 0 altsetting 253 has 1 endpoint descriptor, different from the interface descriptor's value: 141 [ 926.906118][ T10] usb 4-1: config 0 interface 0 has no altsetting 0 [ 926.906153][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 926.961385][ T10] usb 4-1: config 0 descriptor?? [ 926.970474][T14969] usb usb2-port1: attempt power cycle [ 927.272020][T22072] netlink: 'syz.2.5013': attribute type 21 has an invalid length. [ 927.280578][T22072] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5013'. [ 927.286054][T22072] netlink: 'syz.2.5013': attribute type 21 has an invalid length. [ 927.286085][T22072] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5013'. [ 927.310186][T14969] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 927.332583][T14969] usb 2-1: device descriptor read/8, error -71 [ 927.354036][T22072] vimc link validate: Scaler:src:4096x2160 (0x33424752, 12, 0, 6, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 927.409858][ T10] kye 0003:0458:501B.001D: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 927.416202][ T10] hid_parser_main: 460 callbacks suppressed [ 927.416234][ T10] kye 0003:0458:501B.001D: unknown main item tag 0x0 [ 927.416263][ T10] kye 0003:0458:501B.001D: unknown main item tag 0x0 [ 927.416288][ T10] kye 0003:0458:501B.001D: unknown main item tag 0x0 [ 927.416351][ T10] kye 0003:0458:501B.001D: unknown main item tag 0x0 [ 927.416376][ T10] kye 0003:0458:501B.001D: unknown main item tag 0x0 [ 927.416400][ T10] kye 0003:0458:501B.001D: unknown main item tag 0x0 [ 927.416424][ T10] kye 0003:0458:501B.001D: unknown main item tag 0x0 [ 927.443680][ T10] kye 0003:0458:501B.001D: hidraw0: USB HID v0.02 Device [HID 0458:501b] on usb-dummy_hcd.3-1/input0 [ 927.443720][ T10] kye 0003:0458:501B.001D: tablet-enabling feature report not found [ 927.443736][ T10] kye 0003:0458:501B.001D: tablet enabling failed [ 927.580052][T14969] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 927.614215][T14969] usb 2-1: device descriptor read/8, error -71 [ 927.616072][ T10] usb 4-1: USB disconnect, device number 23 [ 927.730570][T14969] usb usb2-port1: unable to enumerate USB device [ 928.921424][T22096] netlink: 'syz.3.5020': attribute type 1 has an invalid length. [ 929.035980][T22092] veth7: entered promiscuous mode [ 929.414444][T22105] IPVS: nq: FWM 3 0x00000003 - no destination available [ 929.948084][T22123] netlink: 'syz.2.5026': attribute type 10 has an invalid length. [ 929.948141][T22123] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5026'. [ 929.994502][T22123] netlink: 'syz.2.5026': attribute type 29 has an invalid length. [ 930.136203][T22127] fuse: Bad value for 'user_id' [ 930.136258][T22127] fuse: Bad value for 'user_id' [ 930.157405][T22127] blktrace: Concurrent blktraces are not allowed on nullb0 [ 930.684323][T22136] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5030'. [ 931.283809][T22153] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5035'. [ 931.283890][T22153] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5035'. [ 931.410433][ T7557] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 931.735719][T22145] syzkaller0: entered promiscuous mode [ 931.735781][T22145] syzkaller0: entered allmulticast mode [ 931.884060][ T7557] usb 2-1: unable to get BOS descriptor or descriptor too short [ 931.884145][ T7557] usb 2-1: New USB device found, idVendor=2a39, idProduct=3fb0, bcdDevice= 0.40 [ 931.905130][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.905198][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.927829][ T7557] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 931.936592][ T7557] usb 2-1: can't read configurations, error -71 [ 932.221916][ T30] audit: type=1326 audit(1788058124.965:7294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22164 comm="syz.3.5040" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fda7cb9e159 code=0x0 [ 933.051554][ T30] audit: type=1326 audit(1788058125.795:7295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22178 comm="syz.1.5045" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1a5ad9e159 code=0x0 [ 933.487874][T22182] could not allocate digest TFM handle sha1-ssse3 [ 933.508448][T22186] could not allocate digest TFM handle sha224-ssse3 [ 934.030087][ T7557] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 934.180221][ T7557] usb 3-1: Using ep0 maxpacket: 8 [ 934.186695][ T7557] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 934.200517][ T7557] usb 3-1: config index 0 descriptor too short (expected 6427, got 27) [ 934.200592][ T7557] usb 3-1: config 0 has an invalid interface number: 21 but max is 0 [ 934.200635][ T7557] usb 3-1: config 0 has no interface number 0 [ 934.200684][ T7557] usb 3-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 934.200718][ T7557] usb 3-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 934.200749][ T7557] usb 3-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 934.215112][T22204] IPVS: nq: FWM 3 0x00000003 - no destination available [ 934.253172][ T7557] usb 3-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 934.253207][ T7557] usb 3-1: Product: syz [ 934.299975][ T7557] usb 3-1: config 0 descriptor?? [ 934.516757][T22197] CIFS: VFS: UNC: path must begin with // or \\ [ 934.517033][T22197] CIFS: VFS: Malformed UNC in devname [ 934.520663][T22197] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 934.522278][T22197] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 934.939377][ T7557] input: syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.21/input/input82 [ 934.965025][ T7557] input: failed to attach handler kbd to device input82, error: -5 [ 935.239560][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807e873c00: rx timeout, send abort [ 935.251690][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88807e873c00: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 935.725394][ T30] audit: type=1326 audit(1788058128.465:7296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22217 comm="syz.6.5056" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbffcf9e159 code=0x0 [ 936.867951][ T7557] usb 3-1: USB disconnect, device number 2 [ 937.032002][T22238] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5061'. [ 937.032075][T22238] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5061'. [ 937.168709][T22245] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5062'. [ 937.168763][T22245] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5062'. [ 937.821824][T22261] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5067'. [ 937.957773][T22262] netlink: 80 bytes leftover after parsing attributes in process `syz.4.5067'. [ 938.147852][T22256] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5066'. [ 938.177553][T22266] loop6: detected capacity change from 0 to 2640 [ 938.191924][T17890] buffer_io_error: 14 callbacks suppressed [ 938.198385][T17890] Buffer I/O error on dev loop6, logical block 0, async page read [ 938.207624][T17890] Buffer I/O error on dev loop6, logical block 0, async page read [ 938.208245][T17890] Buffer I/O error on dev loop6, logical block 0, async page read [ 938.227592][T17890] Buffer I/O error on dev loop6, logical block 0, async page read [ 938.237307][T17890] Buffer I/O error on dev loop6, logical block 0, async page read [ 938.827371][ T30] audit: type=1326 audit(1788058131.545:7297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22269 comm="syz.2.5070" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f729679e159 code=0x0 [ 939.090648][T22280] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5074'. [ 939.090730][T22280] netlink: 48 bytes leftover after parsing attributes in process `syz.1.5074'. [ 939.559954][T14969] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 939.689936][T14969] usb 4-1: device descriptor read/64, error -71 [ 939.929893][T14969] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 940.069977][T14969] usb 4-1: device descriptor read/64, error -71 [ 940.184213][T14969] usb usb4-port1: attempt power cycle [ 940.354767][T22304] kvm: requested 131581 ns i8254 timer period limited to 200000 ns [ 940.396172][T22304] kvm: requested 124876 ns i8254 timer period limited to 200000 ns [ 940.409311][T22304] kvm: requested 14247 ns i8254 timer period limited to 200000 ns [ 940.419101][T22304] kvm: requested 188571 ns i8254 timer period limited to 200000 ns [ 940.420137][T22304] kvm: requested 51123 ns i8254 timer period limited to 200000 ns [ 940.422186][T22304] kvm: requested 67885 ns i8254 timer period limited to 200000 ns [ 940.422634][T22304] kvm: requested 67885 ns i8254 timer period limited to 200000 ns [ 940.423092][T22304] kvm: requested 118171 ns i8254 timer period limited to 200000 ns [ 940.530155][T14969] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 940.550725][T14969] usb 4-1: device descriptor read/8, error -71 [ 940.608552][T22310] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 940.790036][T14969] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 940.812248][T14969] usb 4-1: device descriptor read/8, error -71 [ 940.852975][T22312] input: syz0 as /devices/virtual/input/input83 [ 940.927831][T14969] usb usb4-port1: unable to enumerate USB device [ 940.989430][T22312] input: failed to attach handler leds to device input83, error: -6 [ 941.472328][ T30] audit: type=1326 audit(1788058134.215:7298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22323 comm="syz.6.5089" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbffcf9e159 code=0x0 [ 941.609512][T22331] netlink: 'syz.2.5090': attribute type 1 has an invalid length. [ 941.646488][T22331] 8021q: adding VLAN 0 to HW filter on device bond3 [ 941.784443][T22331] bond3: (slave gretap1): making interface the new active one [ 941.804648][T22331] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 942.472207][T22338] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5091'. [ 942.660896][T22342] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5092'. [ 942.670737][T22342] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5092'. [ 942.925425][T22345] netlink: 72 bytes leftover after parsing attributes in process `syz.6.5093'. [ 943.250980][T22347] team0: Device xfrm0 is of different type [ 943.943534][T22350] netlink: 28 bytes leftover after parsing attributes in process `syz.6.5093'. [ 945.379348][T22376] input: syz0 as /devices/virtual/input/input84 [ 945.566346][T22375] bond1: option ad_user_port_key: invalid value (15035) [ 945.566418][T22375] bond1: option ad_user_port_key: allowed values 0 - 1023 [ 945.607267][T22375] bond1 (unregistering): Released all slaves [ 946.748870][ T30] audit: type=1326 audit(1788058139.485:7299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22396 comm="syz.2.5106" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f729679e159 code=0x0 [ 946.759340][T22376] input: syz1 as /devices/virtual/input/input85 [ 947.099974][ T10] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 947.258909][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 947.271671][ T10] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 947.300342][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 947.300416][ T10] usb 4-1: Product: syz [ 947.300433][ T10] usb 4-1: Manufacturer: syz [ 947.300448][ T10] usb 4-1: SerialNumber: syz [ 947.351397][ T10] usb 4-1: config 0 descriptor?? [ 947.796511][ T10] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 948.103911][ T30] audit: type=1326 audit(1788058140.845:7300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22413 comm="syz.4.5111" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e7b59e159 code=0x7ffc0000 [ 948.137375][ T30] audit: type=1326 audit(1788058140.875:7301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22413 comm="syz.4.5111" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e7b59e159 code=0x7ffc0000 [ 948.172601][ T30] audit: type=1326 audit(1788058140.915:7302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22413 comm="syz.4.5111" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e7b59e159 code=0x7ffc0000 [ 948.175484][ T30] audit: type=1326 audit(1788058140.915:7304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22413 comm="syz.4.5111" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=468 compat=0 ip=0x7f0e7b59e159 code=0x7ffc0000 [ 948.175543][ T30] audit: type=1326 audit(1788058140.915:7305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22413 comm="syz.4.5111" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e7b59e159 code=0x7ffc0000 [ 948.175585][ T30] audit: type=1326 audit(1788058140.915:7306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22413 comm="syz.4.5111" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e7b59e159 code=0x7ffc0000 [ 948.184645][ T30] audit: type=1326 audit(1788058140.915:7303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22413 comm="syz.4.5111" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e7b59e159 code=0x7ffc0000 [ 948.184722][ T30] audit: type=1326 audit(1788058140.925:7307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22413 comm="syz.4.5111" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e7b59e159 code=0x7ffc0000 [ 948.184767][ T30] audit: type=1326 audit(1788058140.925:7308): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22413 comm="syz.4.5111" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e7b59e159 code=0x7ffc0000 [ 948.237912][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 948.245563][ T10] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 948.245626][ T10] usb 4-1: media controller created [ 948.413983][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 948.428125][T22419] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5112'. [ 948.477520][T22420] usb usb5: usbfs: process 22420 (syz.1.5112) did not claim interface 0 before use [ 948.680693][ T10] zl10353_read_register: readreg error (reg=127, ret==0) [ 948.680800][ T10] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 948.680839][ T10] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 948.691323][ T10] usb 4-1: USB disconnect, device number 29 [ 948.840758][ T10] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 949.569444][T22429] loop5: detected capacity change from 0 to 7 [ 949.581343][T22429] loop5: [ 949.581405][T22429] loop5: partition table partially beyond EOD, truncated [ 949.685174][T22431] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5115'. [ 949.869630][T22435] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.5115'. [ 949.869681][T22435] openvswitch: netlink: Message has 512 unknown bytes. [ 951.175113][T22468] binder: 22456:22468 ioctl c0306201 0 returned -14 [ 951.342413][T22475] binder: 22456:22475 ioctl c0306201 0 returned -14 [ 951.386368][T22476] FAULT_INJECTION: forcing a failure. [ 951.386368][T22476] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 951.391153][T22476] CPU: 0 UID: 0 PID: 22476 Comm: syz.1.5126 Tainted: G L syzkaller #0 PREEMPT(full) [ 951.391191][T22476] Tainted: [L]=SOFTLOCKUP [ 951.391198][T22476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 951.391210][T22476] Call Trace: [ 951.391220][T22476] [ 951.391230][T22476] dump_stack_lvl+0xe8/0x150 [ 951.391272][T22476] should_fail_ex+0x410/0x560 [ 951.391310][T22476] _copy_from_user+0x2d/0xb0 [ 951.391332][T22476] generic_map_update_batch+0x651/0x9a0 [ 951.391370][T22476] ? __pfx_generic_map_update_batch+0x10/0x10 [ 951.391397][T22476] ? __fget_files+0x2a/0x420 [ 951.391431][T22476] ? __pfx_generic_map_update_batch+0x10/0x10 [ 951.391456][T22476] bpf_map_do_batch+0x391/0x630 [ 951.391483][T22476] __sys_bpf+0xbe5/0xd90 [ 951.391511][T22476] ? __pfx___sys_bpf+0x10/0x10 [ 951.391541][T22476] ? __fget_files+0x2a/0x420 [ 951.391581][T22476] ? ksys_write+0x242/0x270 [ 951.391609][T22476] ? __pfx_ksys_write+0x10/0x10 [ 951.391638][T22476] __x64_sys_bpf+0xba/0xd0 [ 951.391659][T22476] do_syscall_64+0x166/0x520 [ 951.391689][T22476] ? trace_irq_disable+0x3b/0x140 [ 951.391707][T22476] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 951.391731][T22476] ? clear_bhb_loop+0x70/0xc0 [ 951.391754][T22476] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 951.391774][T22476] RIP: 0033:0x7f1a5ad9e159 [ 951.391794][T22476] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 951.391811][T22476] RSP: 002b:00007f1a5bc2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 951.391833][T22476] RAX: ffffffffffffffda RBX: 00007f1a5b025fa0 RCX: 00007f1a5ad9e159 [ 951.391847][T22476] RDX: 0000000000000038 RSI: 00002000000002c0 RDI: 000000000000001a [ 951.391860][T22476] RBP: 00007f1a5bc2d090 R08: 0000000000000000 R09: 0000000000000000 [ 951.391873][T22476] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 951.391884][T22476] R13: 00007f1a5b026038 R14: 00007f1a5b025fa0 R15: 00007f1a5b14fa48 [ 951.391913][T22476] [ 952.044125][T22488] FAULT_INJECTION: forcing a failure. [ 952.044125][T22488] name failslab, interval 1, probability 0, space 0, times 0 [ 952.044289][T22488] CPU: 0 UID: 0 PID: 22488 Comm: syz.6.5130 Tainted: G L syzkaller #0 PREEMPT(full) [ 952.044325][T22488] Tainted: [L]=SOFTLOCKUP [ 952.044347][T22488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 952.044361][T22488] Call Trace: [ 952.044374][T22488] [ 952.044385][T22488] dump_stack_lvl+0xe8/0x150 [ 952.044425][T22488] should_fail_ex+0x410/0x560 [ 952.044463][T22488] should_failslab+0xa8/0x100 [ 952.044492][T22488] kmem_cache_alloc_lru_noprof+0xa7/0x5f0 [ 952.044525][T22488] ? __d_lookup+0x66/0x790 [ 952.044555][T22488] ? __d_alloc+0x37/0x6f0 [ 952.044591][T22488] ? __d_alloc+0x37/0x6f0 [ 952.044622][T22488] __d_alloc+0x37/0x6f0 [ 952.044666][T22488] d_alloc+0x4b/0x190 [ 952.044692][T22488] ? lookup_one_qstr_excl+0xc4/0x360 [ 952.044724][T22488] lookup_one_qstr_excl+0xd8/0x360 [ 952.044754][T22488] ? lookup_noperm_common+0x245/0x430 [ 952.044796][T22488] start_dirop+0x5c/0x90 [ 952.044833][T22488] simple_start_creating+0xcc/0x110 [ 952.044868][T22488] ? __pfx_simple_start_creating+0x10/0x10 [ 952.044900][T22488] ? do_raw_spin_unlock+0xf5/0x200 [ 952.044933][T22488] ? mntput+0x65/0xc0 [ 952.044963][T22488] debugfs_start_creating+0xca/0x1b0 [ 952.045111][T22488] __debugfs_create_file+0x6f/0x400 [ 952.045145][T22488] debugfs_create_file_full+0x3f/0x60 [ 952.045180][T22488] ref_tracker_dir_debugfs+0x197/0x360 [ 952.045202][T22488] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 952.045250][T22488] ? __kvmalloc_node_noprof+0x52f/0x820 [ 952.045274][T22488] ? __kvmalloc_node_noprof+0x345/0x820 [ 952.045298][T22488] ? __raw_spin_lock_init+0x45/0x100 [ 952.045326][T22488] alloc_netdev_mqs+0x275/0x12a0 [ 952.045355][T22488] ? __pfx_snprintf+0x10/0x10 [ 952.045406][T22488] ? __pfx_ip6_tnl_dev_setup+0x10/0x10 [ 952.045482][T22488] rtnl_create_link+0x321/0xd70 [ 952.045517][T22488] rtnl_newlink_create+0x258/0x7b0 [ 952.045546][T22488] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 952.045580][T22488] ? __pfx___mutex_lock+0x10/0x10 [ 952.045619][T22488] ? ns_capable+0x89/0xe0 [ 952.045650][T22488] rtnl_newlink+0x166d/0x1c30 [ 952.045696][T22488] ? __pfx_rtnl_newlink+0x10/0x10 [ 952.045722][T22488] ? do_syscall_64+0x166/0x520 [ 952.045747][T22488] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.045805][T22488] ? kasan_quarantine_put+0xbb/0x1f0 [ 952.045836][T22488] ? lockdep_hardirqs_on+0x7b/0x110 [ 952.045868][T22488] ? nlmon_xmit+0xb0/0x100 [ 952.045942][T22488] ? kmem_cache_free+0x182/0x650 [ 952.045974][T22488] ? __lock_acquire+0x6df/0x2e50 [ 952.045998][T22488] ? __dev_queue_xmit+0x29b/0x3820 [ 952.046025][T22488] ? __local_bh_enable_ip+0xd6/0x140 [ 952.046050][T22488] ? lockdep_hardirqs_on+0x7b/0x110 [ 952.046074][T22488] ? __dev_queue_xmit+0x29b/0x3820 [ 952.046095][T22488] ? __local_bh_enable_ip+0xd6/0x140 [ 952.046118][T22488] ? __dev_queue_xmit+0x29b/0x3820 [ 952.046147][T22488] ? lock_acquire+0x115/0x350 [ 952.046181][T22488] ? __pfx_rtnl_newlink+0x10/0x10 [ 952.046207][T22488] rtnetlink_rcv_msg+0x802/0xc00 [ 952.046239][T22488] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 952.046265][T22488] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 952.046300][T22488] ? ref_tracker_free+0x689/0x830 [ 952.046322][T22488] ? __pfx_ref_tracker_free+0x10/0x10 [ 952.046352][T22488] netlink_rcv_skb+0x226/0x4a0 [ 952.046379][T22488] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 952.046408][T22488] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 952.046444][T22488] ? netlink_deliver_tap+0x2e/0x1b0 [ 952.046466][T22488] ? netlink_deliver_tap+0x2e/0x1b0 [ 952.046493][T22488] netlink_unicast+0x7bd/0x940 [ 952.046526][T22488] netlink_sendmsg+0x813/0xb40 [ 952.046558][T22488] ? __pfx_netlink_sendmsg+0x10/0x10 [ 952.046596][T22488] ? apparmor_socket_sendmsg+0x98/0x360 [ 952.046629][T22488] ? __pfx_netlink_sendmsg+0x10/0x10 [ 952.046650][T22488] sock_sendmsg_nosec+0x13a/0x180 [ 952.046679][T22488] ____sys_sendmsg+0x54e/0x850 [ 952.046706][T22488] ? __pfx_____sys_sendmsg+0x10/0x10 [ 952.046736][T22488] ? import_iovec+0x73/0xa0 [ 952.046761][T22488] ___sys_sendmsg+0x2a5/0x360 [ 952.046781][T22488] ? __lock_acquire+0x6df/0x2e50 [ 952.046805][T22488] ? __pfx____sys_sendmsg+0x10/0x10 [ 952.046861][T22488] ? __fget_files+0x2a/0x420 [ 952.046883][T22488] ? __fget_files+0x3a2/0x420 [ 952.046918][T22488] __x64_sys_sendmsg+0x1b1/0x290 [ 952.046942][T22488] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 952.046983][T22488] do_syscall_64+0x166/0x520 [ 952.047008][T22488] ? trace_irq_disable+0x3b/0x140 [ 952.047026][T22488] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.047045][T22488] ? clear_bhb_loop+0x70/0xc0 [ 952.047069][T22488] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.047088][T22488] RIP: 0033:0x7fbffcf9e159 [ 952.047111][T22488] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 952.047128][T22488] RSP: 002b:00007fbffde87028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 952.047151][T22488] RAX: ffffffffffffffda RBX: 00007fbffd225fa0 RCX: 00007fbffcf9e159 [ 952.047166][T22488] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 952.047179][T22488] RBP: 00007fbffde87090 R08: 0000000000000000 R09: 0000000000000000 [ 952.047191][T22488] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 952.047203][T22488] R13: 00007fbffd226038 R14: 00007fbffd225fa0 R15: 00007fbffd34fa48 [ 952.047234][T22488] [ 952.282325][T22490] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5129'. [ 952.282371][T22490] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5129'. [ 953.325494][T22515] loop3: detected capacity change from 0 to 7 [ 953.334190][T22515] Dev loop3: unable to read RDB block 7 [ 953.340746][T22515] loop3: unable to read partition table [ 953.341052][T22515] loop3: partition table beyond EOD, truncated [ 953.341083][T22515] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 953.594670][T22517] binder: 22516:22517 ioctl c0306201 200000000080 returned -14 [ 953.607302][T22517] netlink: 'syz.1.5137': attribute type 12 has an invalid length. [ 953.784088][T22521] pim6reg1: entered promiscuous mode [ 953.789887][T22521] pim6reg1: entered allmulticast mode [ 954.396418][T22524] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5140'. [ 954.461753][T22527] usb usb5: usbfs: process 22527 (syz.3.5140) did not claim interface 0 before use [ 954.618867][T22529] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5141'. [ 954.618943][T22529] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5141'. [ 954.799909][ T7561] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 954.969963][ T7561] usb 2-1: Using ep0 maxpacket: 8 [ 954.976918][ T7561] usb 2-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=c3.d4 [ 954.989116][ T7561] usb 2-1: config index 0 descriptor too short (expected 6427, got 27) [ 954.998079][ T7561] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 955.009019][ T7561] usb 2-1: config 0 has no interfaces? [ 955.049985][ T7561] usb 2-1: New USB device strings: Mfr=78, Product=1, SerialNumber=0 [ 955.050043][ T7561] usb 2-1: Product: syz [ 955.050105][ T7561] usb 2-1: Manufacturer: syz [ 955.071853][ T7561] usb 2-1: config 0 descriptor?? [ 955.542810][T22536] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 955.583787][T22536] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 955.786442][T14527] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 955.818490][T14527] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 955.844124][T14527] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 955.852769][T14527] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 955.861140][T14527] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 956.206604][T18508] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 956.474162][ T5612] usb 2-1: USB disconnect, device number 33 [ 957.001565][T18508] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 957.113123][T22572] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5151'. [ 957.122406][ T5612] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 957.250551][ T5612] usb 3-1: device descriptor read/64, error -71 [ 957.314009][T22576] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5153'. [ 957.491275][ T5612] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 957.627137][ T5612] usb 3-1: device descriptor read/64, error -71 [ 957.733251][ T5612] usb usb3-port1: attempt power cycle [ 957.759319][T18508] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 957.972699][T19731] Bluetooth: hci6: command tx timeout [ 958.070098][ T5612] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 958.091217][ T5612] usb 3-1: device descriptor read/8, error -71 [ 958.330080][ T5612] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 958.351216][ T5612] usb 3-1: device descriptor read/8, error -71 [ 958.460806][ T5612] usb usb3-port1: unable to enumerate USB device [ 958.492005][T18508] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 958.589899][ T7561] usb 2-1: new full-speed USB device number 34 using dummy_hcd [ 958.743996][ T7561] usb 2-1: New USB device found, idVendor=0506, idProduct=4601, bcdDevice= 1.00 [ 958.755137][ T7561] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 958.755198][ T7561] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 958.755270][ T7561] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 959.681028][T22603] FAULT_INJECTION: forcing a failure. [ 959.681028][T22603] name failslab, interval 1, probability 0, space 0, times 0 [ 959.681110][T22603] CPU: 0 UID: 0 PID: 22603 Comm: syz.4.5160 Tainted: G L syzkaller #0 PREEMPT(full) [ 959.681148][T22603] Tainted: [L]=SOFTLOCKUP [ 959.681155][T22603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 959.681167][T22603] Call Trace: [ 959.681177][T22603] [ 959.681186][T22603] dump_stack_lvl+0xe8/0x150 [ 959.681222][T22603] should_fail_ex+0x410/0x560 [ 959.681258][T22603] should_failslab+0xa8/0x100 [ 959.681283][T22603] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 959.681315][T22603] ? copy_array+0x71/0x100 [ 959.681341][T22603] ? copy_array+0x71/0x100 [ 959.681369][T22603] ? copy_array+0x71/0x100 [ 959.681395][T22603] krealloc_node_align_noprof+0x19a/0x390 [ 959.681415][T22603] ? __kmalloc_cache_noprof+0x14d/0x600 [ 959.681441][T22603] ? bpf_copy_verifier_state+0xb1f/0x1170 [ 959.681470][T22603] copy_array+0x71/0x100 [ 959.681498][T22603] bpf_copy_verifier_state+0x9b0/0x1170 [ 959.681534][T22603] bpf_is_state_visited+0x378d/0x47e0 [ 959.681565][T22603] ? diag_append_history+0x136/0x520 [ 959.681614][T22603] do_check_common+0x2848/0x5d30 [ 959.681672][T22603] ? __pfx_do_check_common+0x10/0x10 [ 959.681709][T22603] bpf_check+0x2639/0x2e10 [ 959.681739][T22603] ? ktime_get_with_offset+0x93/0x2d0 [ 959.681765][T22603] ? __pfx_bpf_check+0x10/0x10 [ 959.681788][T22603] ? bpf_obj_name_cpy+0x194/0x1e0 [ 959.681817][T22603] bpf_prog_load+0x14d6/0x1c20 [ 959.681850][T22603] ? __pfx_bpf_prog_load+0x10/0x10 [ 959.681895][T22603] __sys_bpf+0xd0d/0xd90 [ 959.681924][T22603] ? __pfx___sys_bpf+0x10/0x10 [ 959.681956][T22603] ? __fget_files+0x2a/0x420 [ 959.681997][T22603] ? ksys_write+0x242/0x270 [ 959.682025][T22603] ? __pfx_ksys_write+0x10/0x10 [ 959.682055][T22603] __x64_sys_bpf+0xba/0xd0 [ 959.682076][T22603] do_syscall_64+0x166/0x520 [ 959.682102][T22603] ? trace_irq_disable+0x3b/0x140 [ 959.682120][T22603] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 959.682147][T22603] ? clear_bhb_loop+0x70/0xc0 [ 959.682176][T22603] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 959.682195][T22603] RIP: 0033:0x7f0e7b59e159 [ 959.682215][T22603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 959.682232][T22603] RSP: 002b:00007f0e7c43f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 959.682255][T22603] RAX: ffffffffffffffda RBX: 00007f0e7b825fa0 RCX: 00007f0e7b59e159 [ 959.682269][T22603] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 959.682281][T22603] RBP: 00007f0e7c43f090 R08: 0000000000000000 R09: 0000000000000000 [ 959.682293][T22603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 959.682306][T22603] R13: 00007f0e7b826038 R14: 00007f0e7b825fa0 R15: 00007f0e7b94fa48 [ 959.682336][T22603] [ 960.017303][ T7561] pegasus 2-1:1.0: probe with driver pegasus failed with error -32 [ 960.137501][T22556] bridge0: port 1(bridge_slave_0) entered blocking state [ 960.152267][T22556] bridge0: port 1(bridge_slave_0) entered disabled state [ 960.152526][T22556] bridge_slave_0: entered allmulticast mode [ 960.174296][T22556] bridge_slave_0: entered promiscuous mode [ 960.185227][T22556] bridge0: port 2(bridge_slave_1) entered blocking state [ 960.194726][T22556] bridge0: port 2(bridge_slave_1) entered disabled state [ 960.202362][T22556] bridge_slave_1: entered allmulticast mode [ 960.211757][T22556] bridge_slave_1: entered promiscuous mode [ 960.318376][T18508] mac80211_hwsim hwsim95 wlan1: left allmulticast mode [ 960.318739][T18508] bridge0: port 3(wlan1) entered disabled state [ 960.344684][T18508] bridge_slave_1: left allmulticast mode [ 960.344729][T18508] bridge_slave_1: left promiscuous mode [ 960.345000][T18508] bridge0: port 2(bridge_slave_1) entered disabled state [ 960.368812][T22619] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5163'. [ 960.368866][T22619] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5163'. [ 960.382593][T18508] bridge_slave_0: left allmulticast mode [ 960.382624][T18508] bridge_slave_0: left promiscuous mode [ 960.382849][T18508] bridge0: port 1(bridge_slave_0) entered disabled state [ 960.590544][T22629] syz.4.5162: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 960.631044][T22629] CPU: 0 UID: 0 PID: 22629 Comm: syz.4.5162 Tainted: G L syzkaller #0 PREEMPT(full) [ 960.631092][T22629] Tainted: [L]=SOFTLOCKUP [ 960.631100][T22629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 960.631114][T22629] Call Trace: [ 960.631124][T22629] [ 960.631133][T22629] dump_stack_lvl+0xe8/0x150 [ 960.631172][T22629] warn_alloc+0x24d/0x270 [ 960.631206][T22629] ? kasan_save_track+0x4f/0x80 [ 960.631227][T22629] ? kasan_save_track+0x3e/0x80 [ 960.631249][T22629] ? __pfx_warn_alloc+0x10/0x10 [ 960.631275][T22629] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 960.631296][T22629] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 960.631336][T22629] __vmalloc_node_range_noprof+0x127/0x1540 [ 960.631383][T22629] ? rcu_is_watching+0x16/0xb0 [ 960.631410][T22629] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 960.631436][T22629] ? __kmalloc_cache_noprof+0x321/0x600 [ 960.631464][T22629] ? __kmalloc_cache_noprof+0x14d/0x600 [ 960.631494][T22629] ? xskq_create+0x56/0x220 [ 960.631622][T22629] xskq_create+0x148/0x220 [ 960.631648][T22629] ? xsk_init_queue+0x8a/0xe0 [ 960.631675][T22629] xsk_init_queue+0x8a/0xe0 [ 960.631702][T22629] xsk_setsockopt+0x52a/0x960 [ 960.631732][T22629] ? __pfx_xsk_setsockopt+0x10/0x10 [ 960.631756][T22629] ? __pfx_aa_sk_perm+0x10/0x10 [ 960.631822][T22629] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 960.631847][T22629] ? __pfx_xsk_setsockopt+0x10/0x10 [ 960.631873][T22629] do_sock_setsockopt+0x17c/0x1b0 [ 960.631899][T22629] __x64_sys_setsockopt+0x13d/0x1b0 [ 960.631925][T22629] do_syscall_64+0x166/0x520 [ 960.631954][T22629] ? trace_irq_disable+0x3b/0x140 [ 960.631974][T22629] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 960.631995][T22629] ? clear_bhb_loop+0x70/0xc0 [ 960.632019][T22629] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 960.632039][T22629] RIP: 0033:0x7f0e7b59e159 [ 960.632060][T22629] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 960.632085][T22629] RSP: 002b:00007f0e7c39a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 960.632109][T22629] RAX: ffffffffffffffda RBX: 00007f0e7b826450 RCX: 00007f0e7b59e159 [ 960.632124][T22629] RDX: 0000000000000006 RSI: 000000000000011b RDI: 000000000000000c [ 960.632136][T22629] RBP: 00007f0e7b635024 R08: 0000000000000029 R09: 0000000000000000 [ 960.632149][T22629] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 960.632161][T22629] R13: 00007f0e7b8264e8 R14: 00007f0e7b826450 R15: 00007f0e7b94fa48 [ 960.632192][T22629] [ 960.633442][T22629] Mem-Info: [ 960.633457][T22629] active_anon:6843 inactive_anon:138 isolated_anon:0 [ 960.633457][T22629] active_file:2244 inactive_file:59816 isolated_file:0 [ 960.633457][T22629] unevictable:0 dirty:178 writeback:0 [ 960.633457][T22629] slab_reclaimable:9630 slab_unreclaimable:157416 [ 960.633457][T22629] mapped:45141 shmem:527 pagetables:1985 [ 960.633457][T22629] sec_pagetables:0 bounce:0 [ 960.633457][T22629] kernel_misc_reclaimable:0 [ 960.633457][T22629] free:1202077 free_pcp:12175 free_cma:0 [ 960.633519][T22629] Node 0 active_anon:27372kB inactive_anon:552kB active_file:8976kB inactive_file:239016kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:180556kB dirty:712kB writeback:0kB shmem:2108kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:17100kB pagetables:7764kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 960.633579][T22629] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:248kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:8kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:176kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 960.633630][T22629] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 960.633692][T22629] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 960.634642][T22629] Node 0 DMA32 free:857976kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:27372kB inactive_anon:552kB active_file:8976kB inactive_file:239016kB unevictable:0kB writepending:712kB zspages:1100kB present:3129332kB managed:2546760kB mlocked:0kB bounce:0kB free_pcp:44628kB local_pcp:28084kB free_cma:0kB [ 960.634714][T22629] lowmem_reserve[]: 0 0 0 0 0 [ 960.634753][T22629] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 960.634811][T22629] lowmem_reserve[]: 0 0 0 0 0 [ 960.634849][T22629] Node 1 Normal free:3934972kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:248kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:4096kB local_pcp:4096kB free_cma:0kB [ 960.634910][T22629] lowmem_reserve[]: 0 0 0 0 0 [ 960.634959][T22629] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 960.635098][T22629] Node 0 DMA32: 2960*4kB (UME) 2241*8kB (UME) 1717*16kB (UME) 1066*32kB (UME) 525*64kB (UME) 194*128kB (UME) 72*256kB (UM) 27*512kB (UME) 8*1024kB (UM) 10*2048kB (M) 158*4096kB (UM) = 857880kB [ 960.635278][T22629] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 960.635391][T22629] Node 1 Normal: 1*4kB (M) 3*8kB (UM) 12*16kB (U) 5*32kB (U) 6*64kB (UM) 4*128kB (UM) 4*256kB (UM) 3*512kB (UM) 1*1024kB (M) 1*2048kB (U) 959*4096kB (M) = 3934972kB [ 960.636812][T22629] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 960.636834][T22629] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 960.636852][T22629] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 960.636869][T22629] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 960.636888][T22629] 62682 total pagecache pages [ 960.636924][T22629] 99 pages in swap cache [ 960.636933][T22629] Free swap = 121264kB [ 960.636941][T22629] Total swap = 124996kB [ 960.636951][T22629] 2097051 pages RAM [ 960.636958][T22629] 0 pages HighMem/MovableOnly [ 960.636966][T22629] 428745 pages reserved [ 960.636973][T22629] 0 pages cma reserved [ 961.250424][T19731] Bluetooth: hci6: command 0x040f tx timeout [ 961.250717][T22586] Bluetooth: hci6: Opcode 0x0c1a failed: -110 [ 961.328302][T22586] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 961.422613][T22586] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 961.456319][T18508] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 961.494507][T18508] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 961.507477][T18508] bond0 (unregistering): Released all slaves [ 961.536060][ T5746] usb 2-1: USB disconnect, device number 34 [ 961.658311][T22556] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 961.690347][T22556] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 961.719141][T22639] loop9: detected capacity change from 0 to 524287999 [ 961.731700][ T7557] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 961.887512][T18508] tipc: Disabling bearer [ 961.894025][ T7557] usb 4-1: Using ep0 maxpacket: 32 [ 961.901024][ T7557] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 961.911998][T18508] tipc: Left network mode [ 961.941267][ T5278] 8021q: adding VLAN 0 to HW filter on device eth1 [ 961.948319][ T7557] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 961.948360][ T7557] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 961.948382][ T7557] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 961.948407][ T7557] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 961.948427][ T7557] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 961.948450][ T7557] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 26 [ 961.962089][ T7557] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 961.962125][ T7557] usb 4-1: SerialNumber: syz [ 962.038522][ T7557] cdc_acm 4-1:1.0: Control and data interfaces are not separated! [ 962.048780][ T7557] cdc_acm 4-1:1.0: probe with driver cdc_acm failed with error -12 [ 962.077813][T22556] team0: Port device team_slave_0 added [ 962.083802][T22645] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5166'. [ 962.184952][T22556] team0: Port device team_slave_1 added [ 962.225775][T22618] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 962.226233][T22618] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 962.638924][ T7557] usb 4-1: USB disconnect, device number 30 [ 962.761144][T22556] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 962.761185][T22556] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 962.761228][T22556] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 962.814739][T22668] tipc: Enabled bearer , priority 0 [ 962.844084][T22556] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 962.844132][T22556] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 962.844178][T22556] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 962.926486][ T5746] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 962.952011][T22657] syzkaller0: entered promiscuous mode [ 962.952326][T22657] syzkaller0: entered allmulticast mode [ 963.041069][T18508] hsr_slave_0: left promiscuous mode [ 963.050511][T18508] hsr_slave_1: left promiscuous mode [ 963.061258][T18508] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 963.061323][T18508] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 963.078977][T18508] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 963.079047][T18508] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 963.096539][ T5746] usb 2-1: Using ep0 maxpacket: 8 [ 963.106351][ T5746] usb 2-1: unable to get BOS descriptor or descriptor too short [ 963.106436][ T5746] usb 2-1: New USB device found, idVendor=112a, idProduct=0005, bcdDevice=df.89 [ 963.126223][ T5746] usb 2-1: config 127 has an invalid interface number: 1 but max is 0 [ 963.126278][ T5746] usb 2-1: config 127 has no interface number 0 [ 963.126364][ T5746] usb 2-1: config 127 interface 1 altsetting 2 bulk endpoint 0xC has invalid maxpacket 16 [ 963.126399][ T5746] usb 2-1: config 127 interface 1 has no altsetting 0 [ 963.168008][ T5746] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 963.178433][ T5746] usb 2-1: Product: syz [ 963.178463][ T5746] usb 2-1: Manufacturer: syz [ 963.178481][ T5746] usb 2-1: SerialNumber: syz [ 963.198791][T22665] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 963.330575][T19731] Bluetooth: hci6: command 0x040f tx timeout [ 963.366471][T18508] veth1_macvtap: left promiscuous mode [ 963.366594][T18508] veth0_macvtap: left promiscuous mode [ 963.380022][T18508] veth1_vlan: left promiscuous mode [ 964.132157][ T7557] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 964.294485][ T7557] usb 4-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 964.298100][ T7557] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 964.298135][ T7557] usb 4-1: Product: syz [ 964.298149][ T7557] usb 4-1: Manufacturer: syz [ 964.298164][ T7557] usb 4-1: SerialNumber: syz [ 964.325470][ T7557] usb 4-1: config 0 descriptor?? [ 964.345917][ T7557] gspca_main: sonixb-2.14.0 probing 0c45:6005 [ 964.474694][T18508] team0 (unregistering): Port device team_slave_1 removed [ 964.515786][T18508] team0 (unregistering): Port device team_slave_0 removed [ 964.842198][T22657] tipc: Resetting bearer [ 964.932567][T22655] tipc: Resetting bearer [ 965.043856][ T7557] sonixb 4-1:0.0: Error writing register 01: -110 [ 965.044000][ T7557] sonixb 4-1:0.0: probe with driver sonixb failed with error -110 [ 965.080838][T22655] tipc: Disabling bearer [ 965.127948][ T5278] 8021q: adding VLAN 0 to HW filter on device eth2 [ 965.128648][T22686] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5174'. [ 965.130841][T14854] usb 4-1: USB disconnect, device number 31 [ 965.290984][T22556] hsr_slave_0: entered promiscuous mode [ 965.296521][T22556] hsr_slave_1: entered promiscuous mode [ 965.297329][T22556] debugfs: 'hsr0' already exists in 'hsr' [ 965.297352][T22556] Cannot create hsr debugfs directory [ 965.411770][T19731] Bluetooth: hci6: command 0x040f tx timeout [ 966.041458][T18508] IPVS: stop unused estimator thread 0... [ 966.111417][ T5746] redrat3 2-1:127.1: Couldn't find all endpoints [ 966.193388][ T5746] usb 2-1: USB disconnect, device number 35 [ 966.410122][T14854] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 966.580164][T14854] usb 4-1: Using ep0 maxpacket: 16 [ 966.597590][T14854] usb 4-1: unable to get BOS descriptor or descriptor too short [ 966.597678][T14854] usb 4-1: New USB device found, idVendor=05ac, idProduct=0274, bcdDevice= 0.40 [ 966.603638][T14854] usb 4-1: config 1 interface 0 altsetting 203 endpoint 0x81 has an invalid bInterval 19, changing to 8 [ 966.603679][T14854] usb 4-1: config 1 interface 0 has no altsetting 0 [ 966.609553][T14854] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 966.609584][T14854] usb 4-1: Product: syz [ 966.609599][T14854] usb 4-1: Manufacturer: syz [ 966.609614][T14854] usb 4-1: SerialNumber: syz [ 966.731319][ T5746] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 966.905627][ T5746] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 966.924652][ T5746] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 966.934664][ T5746] usb 2-1: Product: syz [ 966.939351][ T5746] usb 2-1: Manufacturer: syz [ 966.944671][ T5746] usb 2-1: SerialNumber: syz [ 966.965926][ T5746] usb 2-1: config 0 descriptor?? [ 967.194928][ T5746] usb 2-1: Firmware: major: 165, minor: 173, hardware type: UNKNOWN (213) [ 967.418659][ T5746] usb 2-1: Firmware: build [ 967.457272][ T5746] usb 2-1: no permanent extended address found, random address set [ 967.468986][ T5746] usb 2-1: atusb_probe: initialization failed, error = -524 [ 967.469700][ T5746] atusb 2-1:0.0: probe with driver atusb failed with error -524 [ 967.493180][T19731] Bluetooth: hci6: command 0x040f tx timeout [ 967.637239][T22729] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5181'. [ 967.671508][T22729] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5181'. [ 968.100375][T14969] usb 2-1: USB disconnect, device number 36 [ 968.186964][T22732] team0: Device xfrm0 is of different type [ 968.797562][T22750] FAULT_INJECTION: forcing a failure. [ 968.797562][T22750] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 968.812193][T22750] CPU: 0 UID: 0 PID: 22750 Comm: syz.1.5187 Tainted: G L syzkaller #0 PREEMPT(full) [ 968.812233][T22750] Tainted: [L]=SOFTLOCKUP [ 968.812241][T22750] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 968.812255][T22750] Call Trace: [ 968.812264][T22750] [ 968.812275][T22750] dump_stack_lvl+0xe8/0x150 [ 968.812312][T22750] should_fail_ex+0x410/0x560 [ 968.812350][T22750] _copy_from_user+0x2d/0xb0 [ 968.812374][T22750] generic_map_update_batch+0x651/0x9a0 [ 968.812415][T22750] ? __pfx_generic_map_update_batch+0x10/0x10 [ 968.812446][T22750] ? __fget_files+0x2a/0x420 [ 968.812479][T22750] ? __pfx_generic_map_update_batch+0x10/0x10 [ 968.812506][T22750] bpf_map_do_batch+0x391/0x630 [ 968.812537][T22750] __sys_bpf+0xbe5/0xd90 [ 968.812568][T22750] ? __pfx___sys_bpf+0x10/0x10 [ 968.812598][T22750] ? __fget_files+0x2a/0x420 [ 968.812639][T22750] ? ksys_write+0x242/0x270 [ 968.812668][T22750] ? __pfx_ksys_write+0x10/0x10 [ 968.812698][T22750] __x64_sys_bpf+0xba/0xd0 [ 968.812722][T22750] do_syscall_64+0x166/0x520 [ 968.812753][T22750] ? trace_irq_disable+0x3b/0x140 [ 968.812772][T22750] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 968.812795][T22750] ? clear_bhb_loop+0x70/0xc0 [ 968.812821][T22750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 968.812843][T22750] RIP: 0033:0x7f1a5ad9e159 [ 968.812871][T22750] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 968.812890][T22750] RSP: 002b:00007f1a5bc2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 968.812916][T22750] RAX: ffffffffffffffda RBX: 00007f1a5b025fa0 RCX: 00007f1a5ad9e159 [ 968.812931][T22750] RDX: 0000000000000038 RSI: 00002000000002c0 RDI: 000000000000001a [ 968.812946][T22750] RBP: 00007f1a5bc2d090 R08: 0000000000000000 R09: 0000000000000000 [ 968.812960][T22750] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 968.812974][T22750] R13: 00007f1a5b026038 R14: 00007f1a5b025fa0 R15: 00007f1a5b14fa48 [ 968.813008][T22750] [ 969.301550][T14854] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input86 [ 969.334996][ T4968] bcm5974 4-1:1.0: could not read from device [ 969.358157][T14854] usb 4-1: USB disconnect, device number 32 [ 969.479880][ T5746] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 969.570938][T19731] Bluetooth: hci6: command 0x040f tx timeout [ 969.639943][ T5746] usb 2-1: Using ep0 maxpacket: 8 [ 969.645793][T22760] FAULT_INJECTION: forcing a failure. [ 969.645793][T22760] name failslab, interval 1, probability 0, space 0, times 0 [ 969.645854][T22760] CPU: 0 UID: 0 PID: 22760 Comm: syz.2.5190 Tainted: G L syzkaller #0 PREEMPT(full) [ 969.645884][T22760] Tainted: [L]=SOFTLOCKUP [ 969.645891][T22760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 969.645904][T22760] Call Trace: [ 969.645913][T22760] [ 969.645923][T22760] dump_stack_lvl+0xe8/0x150 [ 969.645959][T22760] should_fail_ex+0x410/0x560 [ 969.645998][T22760] should_failslab+0xa8/0x100 [ 969.646028][T22760] __kvmalloc_node_noprof+0x176/0x820 [ 969.646054][T22760] ? alloc_netdev_mqs+0xae2/0x12a0 [ 969.646100][T22760] ? alloc_netdev_mqs+0xae2/0x12a0 [ 969.646133][T22760] alloc_netdev_mqs+0xae2/0x12a0 [ 969.646167][T22760] rtnl_create_link+0x321/0xd70 [ 969.646199][T22760] rtnl_newlink_create+0x258/0x7b0 [ 969.646229][T22760] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 969.646257][T22760] ? __pfx___mutex_lock+0x10/0x10 [ 969.646307][T22760] ? ns_capable+0x89/0xe0 [ 969.646341][T22760] rtnl_newlink+0x166d/0x1c30 [ 969.646388][T22760] ? __pfx_rtnl_newlink+0x10/0x10 [ 969.646418][T22760] ? __lock_acquire+0x6df/0x2e50 [ 969.646448][T22760] ? __lock_acquire+0x6df/0x2e50 [ 969.646484][T22760] ? lock_acquire+0x115/0x350 [ 969.646512][T22760] ? lock_acquire+0x115/0x350 [ 969.646554][T22760] ? is_bpf_text_address+0x26/0x2b0 [ 969.646586][T22760] ? __lock_acquire+0x6df/0x2e50 [ 969.646610][T22760] ? kernel_text_address+0xa5/0xe0 [ 969.646635][T22760] ? __kernel_text_address+0xd/0x30 [ 969.646656][T22760] ? unwind_get_return_address+0x4d/0x90 [ 969.646681][T22760] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 969.646712][T22760] ? arch_stack_walk+0xfb/0x150 [ 969.646784][T22760] ? lock_acquire+0x115/0x350 [ 969.646821][T22760] ? __pfx_rtnl_newlink+0x10/0x10 [ 969.646850][T22760] rtnetlink_rcv_msg+0x802/0xc00 [ 969.646878][T22760] ? netlink_sendmsg+0x5d4/0xb40 [ 969.646909][T22760] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 969.646939][T22760] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 969.646973][T22760] ? __lock_acquire+0x6df/0x2e50 [ 969.647009][T22760] netlink_rcv_skb+0x226/0x4a0 [ 969.647034][T22760] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 969.647068][T22760] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 969.647108][T22760] ? netlink_deliver_tap+0x2e/0x1b0 [ 969.647133][T22760] ? netlink_deliver_tap+0x2e/0x1b0 [ 969.647164][T22760] netlink_unicast+0x7bd/0x940 [ 969.647199][T22760] netlink_sendmsg+0x813/0xb40 [ 969.647246][T22760] ? __pfx_netlink_sendmsg+0x10/0x10 [ 969.647280][T22760] ? apparmor_socket_sendmsg+0x98/0x360 [ 969.647314][T22760] ? __pfx_netlink_sendmsg+0x10/0x10 [ 969.647338][T22760] sock_sendmsg_nosec+0x13a/0x180 [ 969.647370][T22760] ____sys_sendmsg+0x54e/0x850 [ 969.647399][T22760] ? __pfx_____sys_sendmsg+0x10/0x10 [ 969.647432][T22760] ? import_iovec+0x73/0xa0 [ 969.647459][T22760] ___sys_sendmsg+0x2a5/0x360 [ 969.647481][T22760] ? __lock_acquire+0x6df/0x2e50 [ 969.647506][T22760] ? __pfx____sys_sendmsg+0x10/0x10 [ 969.647575][T22760] ? __fget_files+0x2a/0x420 [ 969.647599][T22760] ? __fget_files+0x3a2/0x420 [ 969.647633][T22760] __x64_sys_sendmsg+0x1b1/0x290 [ 969.647657][T22760] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 969.647701][T22760] do_syscall_64+0x166/0x520 [ 969.647730][T22760] ? trace_irq_disable+0x3b/0x140 [ 969.647750][T22760] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 969.647772][T22760] ? clear_bhb_loop+0x70/0xc0 [ 969.647798][T22760] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 969.647820][T22760] RIP: 0033:0x7f729679e159 [ 969.647842][T22760] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 969.647862][T22760] RSP: 002b:00007f729762b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 969.647889][T22760] RAX: ffffffffffffffda RBX: 00007f7296a25fa0 RCX: 00007f729679e159 [ 969.647905][T22760] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 969.647919][T22760] RBP: 00007f729762b090 R08: 0000000000000000 R09: 0000000000000000 [ 969.647933][T22760] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 969.647947][T22760] R13: 00007f7296a26038 R14: 00007f7296a25fa0 R15: 00007f7296b4fa48 [ 969.647982][T22760] [ 969.782425][ T5746] usb 2-1: New USB device found, idVendor=046d, idProduct=c294, bcdDevice= 0.00 [ 969.858013][ T5746] usb 2-1: config 0 interface 0 altsetting 168 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 969.858131][ T5746] usb 2-1: config 0 interface 0 has no altsetting 0 [ 969.858178][ T5746] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 970.024120][ T5746] usb 2-1: config 0 descriptor?? [ 970.479475][ T5746] logitech 0003:046D:C294.001E: unknown main item tag 0x0 [ 970.487459][ T5746] logitech 0003:046D:C294.001E: unknown main item tag 0x0 [ 970.498178][ T5746] logitech 0003:046D:C294.001E: unknown main item tag 0x0 [ 970.506446][ T5746] logitech 0003:046D:C294.001E: unknown main item tag 0x0 [ 970.506485][ T5746] logitech 0003:046D:C294.001E: unknown main item tag 0x0 [ 970.506509][ T5746] logitech 0003:046D:C294.001E: unknown main item tag 0x0 [ 970.506564][ T5746] logitech 0003:046D:C294.001E: unknown main item tag 0x0 [ 970.506589][ T5746] logitech 0003:046D:C294.001E: unknown main item tag 0x0 [ 970.506612][ T5746] logitech 0003:046D:C294.001E: unknown main item tag 0x0 [ 970.506636][ T5746] logitech 0003:046D:C294.001E: unknown main item tag 0x0 [ 970.584572][ T5746] logitech 0003:046D:C294.001E: hidraw0: USB HID v0.00 Device [HID 046d:c294] on usb-dummy_hcd.1-1/input0 [ 970.597740][ T5746] logitech 0003:046D:C294.001E: no inputs found [ 970.668056][ T5746] usb 2-1: USB disconnect, device number 37 [ 970.937828][T22776] fido_id[22776]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 970.948846][T22556] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 970.959385][T22556] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 970.966268][T22556] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 970.975099][T22556] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 970.978622][T22556] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 971.004519][T22556] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 971.008025][T22556] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 971.057808][T22556] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 971.127877][T22778] tipc: Enabled bearer , priority 0 [ 971.130696][T22778] syzkaller0: entered promiscuous mode [ 971.130720][T22778] syzkaller0: entered allmulticast mode [ 971.155420][T22778] tipc: Resetting bearer [ 971.165997][T22777] tipc: Resetting bearer [ 971.321280][T22777] tipc: Disabling bearer [ 971.847329][T22814] loop3: detected capacity change from 0 to 7 [ 971.863571][T22814] Dev loop3: unable to read RDB block 7 [ 971.863641][T22814] loop3: unable to read partition table [ 971.863893][T22814] loop3: partition table beyond EOD, truncated [ 971.863915][T22814] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 971.997166][T22556] 8021q: adding VLAN 0 to HW filter on device bond0 [ 972.106081][T22556] 8021q: adding VLAN 0 to HW filter on device team0 [ 972.194467][T22823] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5202'. [ 972.279566][T22824] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5201'. [ 972.578659][T12541] bridge0: port 1(bridge_slave_0) entered blocking state [ 972.578759][T12541] bridge0: port 1(bridge_slave_0) entered forwarding state [ 972.926166][ T8610] bridge0: port 2(bridge_slave_1) entered blocking state [ 972.926304][ T8610] bridge0: port 2(bridge_slave_1) entered forwarding state [ 973.482624][T22838] FAULT_INJECTION: forcing a failure. [ 973.482624][T22838] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 973.482682][T22838] CPU: 1 UID: 0 PID: 22838 Comm: syz.3.5206 Tainted: G L syzkaller #0 PREEMPT(full) [ 973.482711][T22838] Tainted: [L]=SOFTLOCKUP [ 973.482719][T22838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 973.482731][T22838] Call Trace: [ 973.482738][T22838] [ 973.482747][T22838] dump_stack_lvl+0xe8/0x150 [ 973.482782][T22838] should_fail_ex+0x410/0x560 [ 973.482816][T22838] prepare_alloc_pages+0x223/0x600 [ 973.482853][T22838] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 973.482876][T22838] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 973.482900][T22838] ? __pfx_policy_nodemask+0x10/0x10 [ 973.482928][T22838] ? __lock_acquire+0x6df/0x2e50 [ 973.482951][T22838] alloc_pages_mpol+0x21e/0x390 [ 973.482978][T22838] folio_alloc_mpol_noprof+0x39/0x160 [ 973.483003][T22838] vma_alloc_folio_noprof+0xe1/0x1e0 [ 973.483028][T22838] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 973.483052][T22838] ? lock_acquire+0x115/0x350 [ 973.483078][T22838] do_pte_missing+0x173a/0x34b0 [ 973.483122][T22838] handle_mm_fault+0x1a53/0x3750 [ 973.483156][T22838] ? handle_mm_fault+0xf1/0x3750 [ 973.483189][T22838] ? __pfx_handle_mm_fault+0x10/0x10 [ 973.483230][T22838] ? lock_mm_and_find_vma+0xa7/0x340 [ 973.483259][T22838] do_user_addr_fault+0x746/0x1340 [ 973.483293][T22838] exc_page_fault+0x6a/0xc0 [ 973.483321][T22838] asm_exc_page_fault+0x26/0x30 [ 973.483340][T22838] RIP: 0010:rep_movs_alternative+0x33/0xa0 [ 973.483362][T22838] Code: 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 bd 65 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb [ 973.483379][T22838] RSP: 0018:ffffc9000673f8c8 EFLAGS: 00050202 [ 973.483399][T22838] RAX: 6e69666e6f636e75 RBX: 000000000000000a RCX: 000000000000000a [ 973.483412][T22838] RDX: 0000000000000000 RSI: ffff88807762fa40 RDI: 0000200000001680 [ 973.483426][T22838] RBP: ffffc9000673f9f0 R08: 0000000000000001 R09: 0000000000000003 [ 973.483438][T22838] R10: dffffc0000000000 R11: ffffed100eec5f49 R12: 000020000000168a [ 973.483452][T22838] R13: 00007ffffffff000 R14: ffff88807762fa40 R15: 0000200000001680 [ 973.483483][T22838] _copy_to_user+0x8a/0xb0 [ 973.483505][T22838] apparmor_socket_getpeersec_stream+0x3c3/0x6e0 [ 973.483553][T22838] ? __pfx_apparmor_socket_getpeersec_stream+0x10/0x10 [ 973.483593][T22838] security_socket_getpeersec_stream+0xbf/0x380 [ 973.483689][T22838] sk_getsockopt+0x1972/0x28b0 [ 973.483719][T22838] ? __pfx_sk_getsockopt+0x10/0x10 [ 973.483747][T22838] ? __pfx_aa_unix_opt_perm+0x10/0x10 [ 973.483769][T22838] ? lock_acquire+0x115/0x350 [ 973.483788][T22838] ? get_pid_task+0x20/0x1f0 [ 973.483817][T22838] ? lock_acquire+0x115/0x350 [ 973.483857][T22838] do_sock_getsockopt+0x2bd/0x7e0 [ 973.483881][T22838] ? __pfx_vfs_write+0x10/0x10 [ 973.483907][T22838] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 973.483927][T22838] ? do_sys_openat2+0x14e/0x200 [ 973.483947][T22838] ? kmem_cache_free+0x182/0x650 [ 973.483980][T22838] ? ksys_write+0x1fc/0x270 [ 973.484011][T22838] __x64_sys_getsockopt+0x1a4/0x240 [ 973.484039][T22838] do_syscall_64+0x166/0x520 [ 973.484063][T22838] ? trace_irq_disable+0x3b/0x140 [ 973.484081][T22838] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 973.484100][T22838] ? clear_bhb_loop+0x70/0xc0 [ 973.484123][T22838] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 973.484141][T22838] RIP: 0033:0x7fda7cb9e159 [ 973.484159][T22838] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 973.484174][T22838] RSP: 002b:00007fda7d9f1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 973.484194][T22838] RAX: ffffffffffffffda RBX: 00007fda7ce25fa0 RCX: 00007fda7cb9e159 [ 973.484207][T22838] RDX: 000000000000001f RSI: 0000000000000001 RDI: 0000000000000003 [ 973.484219][T22838] RBP: 00007fda7d9f1090 R08: 0000200000000180 R09: 0000000000000000 [ 973.484231][T22838] R10: 0000200000001680 R11: 0000000000000246 R12: 0000000000000001 [ 973.484244][T22838] R13: 00007fda7ce26038 R14: 00007fda7ce25fa0 R15: 00007fda7cf4fa48 [ 973.484274][T22838] [ 974.179672][T22843] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5207'. [ 974.505179][T22845] lo: entered promiscuous mode [ 974.529242][T22845] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 975.000112][T22556] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 975.229612][T22556] veth0_vlan: entered promiscuous mode [ 975.266339][T22556] veth1_vlan: entered promiscuous mode [ 975.423633][ T31] INFO: task syz.0.4512:20448 blocked for more than 143 seconds. [ 975.423707][ T31] Tainted: G L syzkaller #0 [ 975.423720][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 975.423731][ T31] task:syz.0.4512 state:D stack:28552 pid:20448 tgid:20447 ppid:14529 task_flags:0x400140 flags:0x00080002 [ 975.423793][ T31] Call Trace: [ 975.423802][ T31] [ 975.423815][ T31] __schedule+0x17d4/0x5820 [ 975.423878][ T31] ? __pfx___schedule+0x10/0x10 [ 975.423901][ T31] ? lock_acquire+0x115/0x350 [ 975.423931][ T31] ? schedule+0x90/0x2b0 [ 975.423959][ T31] schedule+0x164/0x2b0 [ 975.423986][ T31] cgroup_lock_and_drain_offline+0x51a/0x650 [ 975.424040][ T31] ? __pfx_cgroup_lock_and_drain_offline+0x10/0x10 [ 975.424069][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 975.424108][ T31] cgroup_kn_lock_live+0x120/0x230 [ 975.424138][ T31] cgroup_subtree_control_write+0x4b5/0x1080 [ 975.424180][ T31] ? __pfx_cgroup_subtree_control_write+0x10/0x10 [ 975.424208][ T31] ? kernfs_root+0x1c/0x230 [ 975.424285][ T31] ? kernfs_root+0x1c/0x230 [ 975.424312][ T31] ? kernfs_root+0x1ea/0x230 [ 975.424340][ T31] ? __pfx_cgroup_subtree_control_write+0x10/0x10 [ 975.424367][ T31] cgroup_file_write+0x331/0x8f0 [ 975.424398][ T31] ? __pfx_cgroup_file_write+0x10/0x10 [ 975.424425][ T31] ? __kmalloc_noprof+0x38c/0x720 [ 975.424462][ T31] ? __pfx_cgroup_file_write+0x10/0x10 [ 975.424486][ T31] kernfs_fop_write_iter+0x3a4/0x540 [ 975.424514][ T31] vfs_write+0x612/0xba0 [ 975.424551][ T31] ? __pfx_vfs_write+0x10/0x10 [ 975.424586][ T31] ? __fget_files+0x2a/0x420 [ 975.424620][ T31] ksys_write+0x150/0x270 [ 975.424648][ T31] ? __pfx_ksys_write+0x10/0x10 [ 975.424699][ T31] do_syscall_64+0x166/0x520 [ 975.424725][ T31] ? trace_irq_disable+0x3b/0x140 [ 975.424743][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 975.424764][ T31] ? clear_bhb_loop+0x70/0xc0 [ 975.424788][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 975.424807][ T31] RIP: 0033:0x7f2aac19e159 [ 975.433322][ T31] RSP: 002b:00007f2aad0ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 975.433360][ T31] RAX: ffffffffffffffda RBX: 00007f2aac425fa0 RCX: 00007f2aac19e159 [ 975.433374][ T31] RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000005 [ 975.433387][ T31] RBP: 00007f2aac235024 R08: 0000000000000000 R09: 0000000000000000 [ 975.433400][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 975.433413][ T31] R13: 00007f2aac426038 R14: 00007f2aac425fa0 R15: 00007f2aac54fa48 [ 975.433444][ T31] [ 975.433456][ T31] INFO: task syz.0.4512:20453 blocked for more than 143 seconds. [ 975.433477][ T31] Tainted: G L syzkaller #0 [ 975.433488][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 975.433497][ T31] task:syz.0.4512 state:D stack:28808 pid:20453 tgid:20447 ppid:14529 task_flags:0x400040 flags:0x00080002 [ 975.433559][ T31] Call Trace: [ 975.433566][ T31] [ 975.433579][ T31] __schedule+0x17d4/0x5820 [ 975.433639][ T31] ? __pfx___schedule+0x10/0x10 [ 975.433673][ T31] ? schedule+0x90/0x2b0 [ 975.433700][ T31] schedule+0x164/0x2b0 [ 975.433726][ T31] schedule_preempt_disabled+0x13/0x30 [ 975.433750][ T31] __mutex_lock+0x7c1/0x1550 [ 975.433781][ T31] ? __mutex_lock+0x5d4/0x1550 [ 975.433810][ T31] ? fdget_pos+0x246/0x320 [ 975.433839][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 975.433870][ T31] ? __fget_files+0x2a/0x420 [ 975.433898][ T31] ? __fget_files+0x3a2/0x420 [ 975.433920][ T31] ? __fget_files+0x2a/0x420 [ 975.433947][ T31] fdget_pos+0x246/0x320 [ 975.433974][ T31] ksys_write+0x79/0x270 [ 975.434004][ T31] ? __pfx_ksys_write+0x10/0x10 [ 975.434037][ T31] ? __pfx_kcov_ioctl+0x10/0x10 [ 975.434066][ T31] do_syscall_64+0x166/0x520 [ 975.434092][ T31] ? trace_irq_disable+0x3b/0x140 [ 975.434110][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 975.434130][ T31] ? clear_bhb_loop+0x70/0xc0 [ 975.434153][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 975.434172][ T31] RIP: 0033:0x7f2aac19e159 [ 975.434190][ T31] RSP: 002b:00007f2aad08d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 975.434209][ T31] RAX: ffffffffffffffda RBX: 00007f2aac426090 RCX: 00007f2aac19e159 [ 975.434223][ T31] RDX: 0000000000000005 RSI: 0000200000000040 RDI: 0000000000000005 [ 975.434236][ T31] RBP: 00007f2aac235024 R08: 0000000000000000 R09: 0000000000000000 [ 975.434248][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 975.434260][ T31] R13: 00007f2aac426128 R14: 00007f2aac426090 R15: 00007f2aac54fa48 [ 975.434291][ T31] [ 975.434334][ T31] [ 975.434334][ T31] Showing all locks held in the system: [ 975.434345][ T31] locks held by pr/ttyS0/16: 2, last CPU#0: [ 975.434359][ T31] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 [ 975.434409][ T31] #1: ffffffff9ad2f098 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 [ 975.434585][ T31] locks held by khungtaskd/31: 1, last CPU#1: [ 975.434599][ T31] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 975.434710][ T31] locks held by udevd/4983: 3, last CPU#1: [ 975.434724][ T31] #0: ffff88807ed857b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 975.434773][ T31] #1: ffff888054b570c0 (&type->i_mutex_dir_key#4){++++}-{4:4}, at: iterate_dir+0x209/0x4d0 [ 975.434822][ T31] #2: ffff88801c2d4980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_fop_readdir+0x26d/0x960 [ 975.434870][ T31] locks held by getty/5370: 2, on CPU#1: [ 975.434883][ T31] #0: ffff8880332bb0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 975.442828][ T31] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 975.442896][ T31] locks held by kworker/u8:16/8610: 3, on CPU#1: [ 975.442910][ T31] #0: ffff88802c3df940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 975.442964][ T31] #1: ffffc9000a817c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 975.443015][ T31] #2: ffffffff90250d00 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0 [ 975.443101][ T31] locks held by kworker/u8:20/12541: 3, last CPU#1: [ 975.443115][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 975.443165][ T31] #1: ffffc900040f7c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 975.443213][ T31] #2: ffffffff90250d00 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 975.443299][ T31] locks held by syz-executor/14800: 4, last CPU#0: [ 975.443313][ T31] #0: ffffffff8ee35b90 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10f/0x480 [ 975.443362][ T31] #1: ffff88801237d038 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 975.443412][ T31] #2: ffff88802d0e83b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 975.443465][ T31] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 975.443517][ T31] locks held by kworker/1:0/14854: 3, on CPU#1: [ 975.443530][ T31] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 975.443578][ T31] #1: ffffc90003597c40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 975.443627][ T31] #2: ffff8880788d8250 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1fd/0x3b0 [ 975.443757][ T31] locks held by syz.0.4512/20448: 3, on CPU#0: [ 975.443784][ T31] #0: ffff88807a8935f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 975.443838][ T31] #1: ffff88807f812460 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 975.443896][ T31] #2: ffff888064bdd480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 [ 975.443947][ T31] locks held by syz.0.4512/20453: 1, on CPU#0: [ 975.443962][ T31] #0: ffff88807a8935f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 975.444021][ T31] locks held by syz-executor/22556: 1, on CPU#1: [ 975.444036][ T31] #0: ffffffff90250d00 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x667/0xe00 [ 975.444110][ T31] locks held by sed/22866: 1, last CPU#0: [ 975.444124][ T31] #0: ffff88807b9403b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 [ 975.444178][ T31] locks held by syz.2.5211/22868: 1, last CPU#1: [ 975.444193][ T31] #0: ffff88802d0ed038 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 975.453297][ T31] locks held by syz.1.5212/22870: 1, last CPU#0: [ 975.453316][ T31] #0: ffff88802d0ec378 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1dd/0x4e0 [ 975.453370][ T31] [ 975.453376][ T31] ============================================= [ 975.453376][ T31] [ 975.453386][ T31] NMI backtrace for cpu 1 [ 975.453403][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 975.453428][ T31] Tainted: [L]=SOFTLOCKUP [ 975.453435][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 975.453446][ T31] Call Trace: [ 975.453455][ T31] [ 975.453463][ T31] dump_stack_lvl+0xe8/0x150 [ 975.453491][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 975.453600][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 975.453630][ T31] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 975.453655][ T31] sys_info+0x135/0x170 [ 975.453674][ T31] watchdog+0xfd7/0x1030 [ 975.453700][ T31] ? watchdog+0x1c7/0x1030 [ 975.453724][ T31] kthread+0x38b/0x480 [ 975.453743][ T31] ? __pfx_watchdog+0x10/0x10 [ 975.453759][ T31] ? __pfx_kthread+0x10/0x10 [ 975.453779][ T31] ret_from_fork+0x514/0xb70 [ 975.453810][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 975.453837][ T31] ? __switch_to+0xc89/0x1420 [ 975.453865][ T31] ? __pfx_kthread+0x10/0x10 [ 975.453884][ T31] ret_from_fork_asm+0x1a/0x30 [ 975.453925][ T31] [ 975.453933][ T31] Sending NMI from CPU 1 to CPUs 0: [ 975.453966][ C0] NMI backtrace for cpu 0 [ 975.453985][ C0] CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Tainted: G L syzkaller #0 PREEMPT(full) [ 975.454010][ C0] Tainted: [L]=SOFTLOCKUP [ 975.454018][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 975.454030][ C0] RIP: 0010:io_serial_out+0x7c/0xc0 [ 975.454063][ C0] Code: e7 55 fc 44 89 f9 d3 e5 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 4c af c5 fc 41 03 2e 89 d8 89 ea ee <5b> 41 5c 41 5e 41 5f 5d e9 87 cb 74 06 cc 44 89 f9 80 e1 07 38 c1 [ 975.454080][ C0] RSP: 0018:ffffc90000157900 EFLAGS: 00000002 [ 975.454098][ C0] RAX: 0000000000000020 RBX: 0000000000000020 RCX: 0000000000000000 [ 975.454111][ C0] RDX: 00000000000003f8 RSI: 0000000000000000 RDI: 0000000000000020 [ 975.454123][ C0] RBP: 00000000000003f8 R08: 0000000000000003 R09: 0000000000000004 [ 975.454134][ C0] R10: dffffc0000000000 R11: ffffffff8571cbd0 R12: dffffc0000000000 [ 975.454149][ C0] R13: 0000000000000020 R14: ffffffff9ad2f0c0 R15: 0000000000000000 [ 975.454162][ C0] FS: 0000000000000000(0000) GS:ffff888124cdc000(0000) knlGS:0000000000000000 [ 975.454178][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 975.454192][ C0] CR2: 00007f1a5bc2cff8 CR3: 00000000794ca000 CR4: 00000000003526f0 [ 975.454210][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 975.454222][ C0] DR3: 0000000000000001 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 975.454235][ C0] Call Trace: [ 975.454243][ C0] [ 975.454252][ C0] __serial8250_console_fifo_write+0x1e6/0x3e0 [ 975.454317][ C0] serial8250_console_write+0xaa1/0x1200 [ 975.454344][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 975.454373][ C0] ? __pfx_serial8250_console_write+0x10/0x10 [ 975.454398][ C0] ? __schedule+0x17ea/0x5820 [ 975.454428][ C0] nbcon_emit_next_record+0xef5/0x1a90 [ 975.454456][ C0] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 975.454478][ C0] ? nbcon_context_try_acquire+0x819/0xbd0 [ 975.454503][ C0] ? _raw_spin_lock_irqsave+0x4c/0x60 [ 975.454546][ C0] nbcon_kthread_func+0x679/0x880 [ 975.454567][ C0] ? nbcon_kthread_func+0x163/0x880 [ 975.454585][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 975.454606][ C0] ? __kthread_parkme+0x71/0x1f0 [ 975.454632][ C0] ? __kthread_parkme+0x199/0x1f0 [ 975.454659][ C0] kthread+0x38b/0x480 [ 975.454676][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 975.454693][ C0] ? __pfx_kthread+0x10/0x10 [ 975.454726][ C0] ret_from_fork+0x514/0xb70 [ 975.454754][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 975.454780][ C0] ? __switch_to+0xc89/0x1420 [ 975.454806][ C0] ? __pfx_kthread+0x10/0x10 [ 975.454824][ C0] ret_from_fork_asm+0x1a/0x30 [ 975.454858][ C0] [ 975.461125][T22556] veth0_macvtap: entered promiscuous mode [ 975.463803][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 976.756359][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 976.767327][ T31] Tainted: [L]=SOFTLOCKUP [ 976.771685][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 976.781868][ T31] Call Trace: [ 976.785170][ T31] [ 976.788113][ T31] vpanic+0x56d/0xa60 [ 976.792203][ T31] ? __pfx___schedule+0x10/0x10 [ 976.797349][ T31] ? __pfx_vpanic+0x10/0x10 [ 976.801910][ T31] panic+0xc5/0xd0 [ 976.805683][ T31] ? __pfx_panic+0x10/0x10 [ 976.810256][ T31] ? preempt_schedule_common+0x7f/0xd0 [ 976.815870][ T31] ? preempt_schedule_thunk+0x16/0x40 [ 976.821384][ T31] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 976.827611][ T31] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 976.833814][ T31] watchdog+0x1030/0x1030 [ 976.838293][ T31] ? watchdog+0x1c7/0x1030 [ 976.842788][ T31] kthread+0x38b/0x480 [ 976.846941][ T31] ? __pfx_watchdog+0x10/0x10 [ 976.852086][ T31] ? __pfx_kthread+0x10/0x10 [ 976.856738][ T31] ret_from_fork+0x514/0xb70 [ 976.861399][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 976.866818][ T31] ? __switch_to+0xc89/0x1420 [ 976.871717][ T31] ? __pfx_kthread+0x10/0x10 [ 976.876321][ T31] ret_from_fork_asm+0x1a/0x30 [ 976.881143][ T31] [ 976.884556][ T31] Kernel Offset: disabled [ 976.888893][ T31] Rebooting in 86400 seconds..