last executing test programs: 14m4.107884866s ago: executing program 1 (id=805): syz_genetlink_get_family_id$batadv(&(0x7f00000005c0), 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f00000000c0)={0xcf50, 0x0, 0xffff, 0x9dff, 0x15}) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x0, 0xfffffff9, 0x2, 0xd, "62007d820000dec52311002240f7ffff6f1a00"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r3, @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, r6}, [@IFA_LOCAL={0x14, 0x2, @ipv4}]}, 0x2c}}, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r6}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x210}]}, 0x34}}, 0x8000) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000700)={'team0\x00', 0x0}) r10 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r11, {0x0, 0x4}, {0xffff, 0xffff}, {0x7, 0xffe5}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x0, 0xb, 0x4}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@bridge_newneigh={0x28, 0x1c, 0x1, 0x70bd29, 0x25dfdbfe, {0x7, 0x0, 0x0, r13, 0x80, 0x7e, 0xa}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) r14 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(r14, 0x107, 0x7, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r14, 0x107, 0xf, &(0x7f0000000280)=0xf3f, 0x4) sendto$packet(r14, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c642b4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r15, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000000e40)={&(0x7f0000000000), 0xc, &(0x7f0000000e00)={&(0x7f0000000740)={0x6a8, 0x0, 0x100, 0x70bd25, 0x25dfdbff, {}, [{{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x9, 0xf2, 0x7, 0x6}]}}}]}}, {{0x8}, {0x16c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x80}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1af7}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x1d4, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x1a8, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xa88}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8000}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x9b}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}]}}, {{0x8, 0x1, r6}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x94}}}]}}, {{0x8, 0x1, r9}, {0xb8, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r11}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r13}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r15}}}]}}]}, 0x6a8}, 0x1, 0x0, 0x0, 0x8080}, 0x4000000) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000200)=0x17) 14m3.661861387s ago: executing program 1 (id=809): io_setup(0x6, 0x0) mount_setattr(0xffffffffffffff9c, 0x0, 0x8000, 0x0, 0x0) open(0x0, 0x20000, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x200, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x312000, 0x800, 0x0, 0x7}, 0x20) migrate_pages(0x0, 0x5, &(0x7f0000000040)=0x9, &(0x7f0000000080)=0x272) 14m3.088748537s ago: executing program 1 (id=810): bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(0xffffffffffffffff, 0x7) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) 14m3.016380026s ago: executing program 1 (id=811): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x47, &(0x7f0000000040)={0x0, 0x6e98, 0xc000, 0x80008, 0x150}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) sendmmsg(0xffffffffffffffff, &(0x7f0000000100)=[{{0x0, 0x2d, &(0x7f00000000c0)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x51, 0x0) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x300) 14m3.016133016s ago: executing program 1 (id=812): setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_256={{0x304}, "41328ac33100", "e8582491a0c4050000000000f6542a9b6800000000000000003967d2daa45b4e", "61241765", "89a01ffff55f00fd"}, 0xffd6) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x8, 0x20280) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r0, 0x80184132, &(0x7f0000000080)) mkdir(&(0x7f0000000000)='./cgroup/file0\x00', 0xd0939199c36b4d28) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000040)=[@acquire], 0x0, 0x0, 0x0}) prlimit64(0xffffffffffffffff, 0x2, &(0x7f00000001c0)={0x10001, 0x1}, &(0x7f0000000280)) mount$fuse(0x0, 0x0, 0x0, 0x281063, &(0x7f00000001c0)=ANY=[@ANYRES16, @ANYRESDEC, @ANYBLOB=',rootmode=000000000000000000', @ANYRESDEC]) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x189002, 0x40) write$cgroup_devices(r1, &(0x7f0000000200)=ANY=[@ANYBLOB='c *:'], 0x11) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x4cc5}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x1, './cgroup/file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4) r5 = syz_open_dev$video4linux(&(0x7f0000000000), 0x806, 0x1233c1) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x40000, 0x0) fcntl$notify(r6, 0x402, 0x40000029) r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r7, 0x40086602, &(0x7f00000002c0)=0x20) ioctl$VIDIOC_QUERY_EXT_CTRL(r5, 0xc0445624, &(0x7f0000019480)={0x80980914, 0x7, "9a555c14c966e1344198b9aaaa7da8c83e58e12800", 0x2000000000000, 0x100000004, 0x4, 0xfffffffffffffffe, 0x200008, 0x5, 0x4, 0x9, [0x9, 0x0, 0x9, 0xfffffffb]}) 14m1.824016951s ago: executing program 1 (id=818): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_DEL_SERVICE(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x80, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x836}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xee3a}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6c}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x57}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x1c}}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x10000}]}, 0x80}, 0x1, 0x0, 0x0, 0x5}, 0x4000000) prctl$PR_SCHED_CORE(0x3e, 0xfffffffffffffffd, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f0000000140)="77a62d888b", 0x5}, {0x0}], 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), r1) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x74, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x44, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2b}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}]}, @TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}, @TIPC_NLA_SOCK={0x8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x2000000}, 0x404c854) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) inotify_add_watch(r5, 0x0, 0x330007a5) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000480), r1) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r1, &(0x7f00000005c0)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x5c, r6, 0x400, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x26}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfffffc01}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x10}, @BATADV_ATTR_GW_SEL_CLASS={0x8}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x4000040) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x20, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="6c00000010004b0429bd7000faffffff7a000000", @ANYRES32=0x0, @ANYBLOB="08b0010006820000400012800b0001006272696467650000300002800c002200000000040000000005002400010000000600080088a80000080005000100000005002b00050000000a000100aa"], 0x6c}, 0x1, 0x0, 0x0, 0x40001}, 0x20000000) r8 = dup3(r3, r0, 0x80000) getsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x2, &(0x7f0000000040), &(0x7f00000000c0)=0x8) 13m43.760124424s ago: executing program 32 (id=818): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_DEL_SERVICE(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x80, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x836}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xee3a}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6c}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x57}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x1c}}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x10000}]}, 0x80}, 0x1, 0x0, 0x0, 0x5}, 0x4000000) prctl$PR_SCHED_CORE(0x3e, 0xfffffffffffffffd, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f0000000140)="77a62d888b", 0x5}, {0x0}], 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), r1) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x74, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x44, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2b}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}]}, @TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}, @TIPC_NLA_SOCK={0x8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x2000000}, 0x404c854) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) inotify_add_watch(r5, 0x0, 0x330007a5) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000480), r1) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r1, &(0x7f00000005c0)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x5c, r6, 0x400, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x26}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfffffc01}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x10}, @BATADV_ATTR_GW_SEL_CLASS={0x8}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x4000040) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x20, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="6c00000010004b0429bd7000faffffff7a000000", @ANYRES32=0x0, @ANYBLOB="08b0010006820000400012800b0001006272696467650000300002800c002200000000040000000005002400010000000600080088a80000080005000100000005002b00050000000a000100aa"], 0x6c}, 0x1, 0x0, 0x0, 0x40001}, 0x20000000) r8 = dup3(r3, r0, 0x80000) getsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x2, &(0x7f0000000040), &(0x7f00000000c0)=0x8) 13.98435896s ago: executing program 2 (id=5194): mprotect(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0) sendto(0xffffffffffffffff, 0x0, 0x0, 0x8800, 0x0, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) write(r0, &(0x7f0000000680)="6729eed1ffe3dcddd69599c8ae771a23a15ce785fe51b210726696c74b847f9f5a682ac9e0e324bb3a8f51db7eb50208310c7c375070c520d25d9540f8c1e6b9501c21b2187c272165739bb1a44333bbe405e17632a21f80d6db1f3b00006c304a5ab5d800000000005b3724c9d56449df73264a1d9766eebd244de220412366be77528abfd18af95cc7e507643889150f4d952878c3f7daf18ec961f76eeea610a2520b808769295f463550ac501fe751cb68695080ce4537", 0xb9) 13.224903608s ago: executing program 2 (id=5197): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000280)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088018000c8014000b8008000900000003"], 0x44}}, 0x0) (async) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000280)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088018000c8014000b8008000900000003"], 0x44}}, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10930501}, 0xc, &(0x7f0000000240)={&(0x7f0000000080)={0x1c, r2, 0x300, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_DOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40014}, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c010000", @ANYRES16, @ANYBLOB="0702000000000000000001000005e400088024000780080006008d0000002000060069000000080005008395011708000610c30000000c00078008000600a7000000040007800c00078008000500d3cb4e320c0007800800050085507e563400078008000600e3000000080006001c000000080005005131953508000500b9103d47080005008cc22742080006001100000014000780080005009a308465080005003f5f20463c00078008000500cd3ae82e08000500a17188b8ed2971ed22ad000008000600560000000800060010000000080006003a00000008000500d043317c0c000780080005002ac7423804000780140004800500030001000000050003000100000008000100030000000800020001"], 0x11c}}, 0x400c800) 10.813233171s ago: executing program 2 (id=5201): syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) syz_usb_connect(0x5, 0x3d, &(0x7f00000001c0)=ANY=[@ANYBLOB="12011201b1fb66101e090300bb350102030109022b0001080540040904ce01026fda0d000705f71f"], 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000012c0)='/sys/power/reserved_size', 0x2000, 0x186) read$FUSE(r0, &(0x7f0000002980)={0x2020}, 0x2020) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket(0x10, 0x3, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0xc0189436, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000200)="be", 0xfffffd0c}], 0x1, 0x0, 0x0, 0x4080}, 0x8000) accept4(r2, 0x0, 0x0, 0x800) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0x22, 0x0, &(0x7f00000008c0)="f6f4e9a1000000000000000d0800c32a8bc678bbd404fcd535fdc8a75167efec52a9", 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000700)="0102", 0x0}, 0x50) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r4, 0xfffffffc) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=ANY=[@ANYBLOB="d70a000020000000620a00000000000007000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0x12, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x62) syz_usb_connect$cdc_ecm(0x0, 0x7e, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6c, 0x1, 0x1, 0x0, 0x10, 0x9e, "", [{{0x9, 0x4, 0x0, 0x81, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x4c}, {0xd, 0x24, 0xf, 0x1, 0x3, 0x9, 0x0, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0x200, 0x3ff, 0xe, 0x3, 0x3, 0x81}, @mbim_extended={0x8, 0x24, 0x1c, 0x8, 0x8, 0x9}, @mbim_extended={0x8, 0x24, 0x1c, 0x5, 0x1, 0xf000}, @mdlm={0x15, 0x24, 0x12, 0xff45}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x40, 0x8, 0x6, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x27, 0x26, 0x3}}}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x300, 0x7, 0x10, 0x5, 0xff, 0x2}, 0x5, &(0x7f0000000240)={0x5, 0xf, 0x5}, 0x3, [{0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x403}}, {0xfa, &(0x7f0000000500)=@string={0xfa, 0x3, "517ddcbd099f966f1a1ded2a4fcb6aeb01b20807264db0a0dbd898c194269b1241049189f57214038f22c7cb0f2203b1c2e65ec4d1cb98dcce5f7ce280d15be8539468c7bbd24eeeba44929149801f907a47be6ef353cea1abde0d49ccdc26047f6782bed11cacd199fdc309d652a019192f1581b236079e9f9f8fdfcff90dda72f669e0e4bbeff590e1a872112c82db5c20e3b1a3288503880e369afb3412ade3fb4dbf6dc483486fa5cc7298c7a2a782234be4b488b09386bd8b539e08a6955980c1f7974fcdc8bd2e65e5ac2664f767d9ff0285a1d847a6951d4f81b71bff204c0fa0fd730f714ac324a9f6e23ccaf9c0a81e9825a219"}}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0xc7d}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r6, 0x1, 0x70bd2c, 0x1000000, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}, 0x1, 0xff07}, 0x2000000) 9.907800009s ago: executing program 0 (id=5205): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb000000010902"], 0x0) syz_usb_connect$uac1(0x3, 0x72, &(0x7f0000000480)=ANY=[], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket(0x2, 0x80805, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) socket$inet6_tcp(0xa, 0x1, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48640) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)=[0x7fffffff], 0x0, 0x1}) (fail_nth: 5) 7.473852526s ago: executing program 2 (id=5215): openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x40, 0x16f) mount(0x0, &(0x7f0000000400)='./file0\x00', 0x0, 0x1c3425, 0x0) execve(&(0x7f0000000180)='./file0\x00', &(0x7f00000004c0)={[&(0x7f0000000340)=' wO\xd5\xce\x82\x89r\xa0\r\xc4Z\x15\xfds\x17g\n\xee\x9f\a0\xc3\x80\xbf\x80j$\xe6Z\xde\xf1pc\x96\x8f\xb5\x9d\xe3\x11m\x88~\xe3\xc7\xe3\t\xab\xbb@\xd9\xf8\xa2N\x03\xcf\xe4\xd6\x0ew\x10\xc2\xaa\x84bC\xc8\xd0\xe07\xa1\rIa\xb1^\xc5WG\xccV\xd3\x91\x84x\x9d\x8eg\x84\xeb\x9e;\x8f\xa1\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8r\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13S\x04\x12$\xcb\xbeV!\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m']}, 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)={[&(0x7f00000000c0)=' wO\xd5\xce\x82\x89r\xa0\r\xc4Z\x15\xfds\x17g\n\xee\x9f\a0\xc3\x80\xbf\x80j$\xe6Z\xde\xf1pc\x96\x8f\xb5\x9d\xe3\x11m\x88~\xe3\xc7\xe3\t\xab\xbb@\xd9\xf8\xa2N\x03\xcf\xe4\xd6\x0ew\x10\xc2\xaa\x84bC\xc8\xd0\xe07\xa1\rIa\xb1^\xc5WG\xccV\xd3\x91\x84x\x9d\x8eg\x84\xeb\x9e;\x8f\xa1\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8r\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13S\x04\x12$\xcb\xbeV!\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m']}, &(0x7f0000000080)={[&(0x7f0000000280)='D8[\xaf)m^\x9f\x17L\xd2\x9b\x06\x9ck\x18{\xb72\xeb\x86\x1eF]\x04\xd4\x10]K\xe4\x9e\x14\x91P_\xca\v\xefe\x02\x97\xad\xa6\xd8%\t\xe5@\xbb\x9a\x10\x99\x14fr3\x8e\xba\x0e?&\xcbH\x8cl\x14\xbf\xbe\xf3\xde\x8bjN\xaa(=%\xceY\xd9\x02\xf8\x96\xf4\x9a\x18\x19l)J\f\xc3J\x86\x996\xf9\x1d$\xde\x04=:N\xac\xecl\xbc\xd5_ \x8c\a\xfe\x99\xe0`']}) 7.405015998s ago: executing program 2 (id=5216): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="00000100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, &(0x7f00000003c0)={0x14, &(0x7f0000000280)={0x40, 0x23, 0xc2, {0xc2, 0x23, "c043b78e477a9b9e61ca1ffc86beefa4f57b093a59cabf8e53e3654b04b30ed1ead05b1428b3aa32cb7d7d9b26d013755ff734e24b7d141a648c549a0de7444df88ba3d4e3d3736595b30990bdf488de789e9e454bfd9e101a5abd22002a08b17455ecfd31ac596c23877af5f514d0d71ba71942d95cae0a87262778aa6539ceebbe4869099bc439cce01d245a727c64bbb99b191a22203a50ff11a7bcbe44c6645cd0584bb1ffb1f9948d9848a140b0db2cd68ac8bb934ccf67dd1ec928c32c"}}, &(0x7f0000000380)={0x0, 0x3, 0x31, @string={0x31, 0x3, "2a48ef9957f139527311a50dfe67106acdc5d393da72460cac432105163b9c4d59ccf44a70787a172e6e0e078b4bc1"}}}, &(0x7f0000000900)={0x44, &(0x7f0000000580)=ANY=[@ANYBLOB="401791000000cb2176601e225d97ba361eab47cc8a804c343c553378fef7109119647d122d8ba6b23178e17dccc4301beb4c024bdd5465571280a422d6c54fee8cb413086f6f0945b4cf7d7e1aa855fd79d3d40b2a87f2d792ae1df2e1baeaf58fc19bfa4ea495242630df344c92b627c83cef5442201588c20d779515923bb3f43dc1c97b4f7c6b0f203e6e0604b6f90c0e020e000000"], &(0x7f0000000640)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000680)={0x0, 0x8, 0x1, 0x40}, &(0x7f00000006c0)={0x20, 0x81, 0x1, "83"}, &(0x7f0000000800)=ANY=[@ANYBLOB], &(0x7f0000000840)={0x20, 0x83, 0x3, "77668d"}, &(0x7f0000000880)=ANY=[@ANYBLOB="20610200000089d2"], &(0x7f00000008c0)={0x20, 0x85, 0x3, "db82f1"}}) 7.304546139s ago: executing program 0 (id=5218): r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) r1 = bpf$BPF_LINK_CREATE_XDP(0x25, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20000) ioctl$SG_BLKTRACESTOP(r3, 0x1275, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000180)={0x11400, 0x8, 0x2, 0x0, 0x7, 0x2}, 0x30, 0x1) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r4, 0x1, &(0x7f00000001c0)={0x21, r1}, 0x1) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x20, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x4}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r5 = syz_open_dev$vim2m(0x0, 0x7fffffffffffffff, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, 0x0) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x0, @rand_addr=0x64010100}, {0x2, 0x200, @multicast1}, {0x2, 0x0, @empty}, 0x2a0, 0x0, 0x0, 0x0, 0x802a, 0x0, 0x0, 0x2000000}) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5393, &(0x7f0000000000)) socket$packet(0x11, 0x2, 0x300) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000100010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a30"], 0xec}, 0x1, 0x0, 0x0, 0x24004005}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r7 = syz_open_dev$dri(&(0x7f0000000040), 0x7, 0x2) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r7, 0x4010640d, &(0x7f0000000080)={0x7}) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, 0x0, 0x40000c4) socket(0x10, 0x3, 0x0) syz_open_dev$vim2m(&(0x7f0000000140), 0x1, 0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 7.159344531s ago: executing program 0 (id=5219): syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003173610ef171e7206de010203010902f3c8010000000009040000000206"], 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x4d, 0x1, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, &(0x7f0000000300)) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f00000003c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x7}, {0x0, [0x0, 0x0, 0x30, 0x2e, 0xf63b98aba439d69d]}}, 0x0, 0x1f, 0x0, 0x1, 0x4}, 0x28) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000003b00)=[{{&(0x7f0000000040)={0x2, 0x0, @empty}, 0x10, 0x0}}, {{&(0x7f0000000000)={0x2, 0x0, @empty}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000080)="2e7be370f88e801dcbfd6fc9b169aadf2d788f31060000002c9c1ea0d17dc8387758e4428f3e298ab317415fd80b0cf47466f42c8884034bfe", 0x39}], 0x367}}], 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x2, 0x3, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r2, &(0x7f0000000840)="a6", 0x1, 0x200080c0, &(0x7f00000001c0)={0xa, 0x2, 0x8000, @loopback, 0x8}, 0x1c) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r3, 0x89e7, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000140)='bic', 0x3) timer_create(0x2, &(0x7f0000000540)={0x0, 0x28, 0x4, @thr={&(0x7f0000000380)="10034912e4eb657adddf1f4aff45e45854f3cf56ffd74e7f4a5d7e34b2eb873c28cfb349a2906d8d824b65e5e9acb91ae3c348688c6669086d428b1a1dbdfaee74df274f790f54c9b75f2e2b0995e402418b4d17c8ee509acbbf6032c99d9938256d2dd188f1cddc714a04866b48561868193aa7c831829904c06fbb950018bedb705f03a547489f4e64b5e1e078aaaa7ce2deefb3f609a60e95e36e104fd3739b640cde546dde8105d24abb7c99979f8b6fdc16f7ff1837dba6cc44786d20a430b6bc4a919ca6d0689b28ab11c56d5b27", &(0x7f0000000480)="12f78c655b0abf4ca066ddbe95a3d4b9cc32d7a2e40cfd510f613e536fbc0796eb9bf36a6b3cdd402815e6b076583af6d319f6549f656b575e812642d8620de5d4bb3ea8a9a5a67e04fa6a2e9c57b7d1b459e8c2e0839a252d740cbb834a3ab360c1261408e8725c1302c8ec1ce41521cea82c174138b4f3ad6c544fba9603b971e969dc43f9d5792da43661abbb110f404172a4eaa83000e10039ec40892a640391b02519865258f23be99f5654"}}, &(0x7f00000005c0)) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000280)={0xffff, 0xee}, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001200011900000000000000000a00aa"], 0x26}}, 0x0) getrlimit(0x2, &(0x7f0000000340)) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000240)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r5, &(0x7f00000001c0)={0xf, 0x8, 0xfa00, {r7, 0x6}}, 0x10) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r1, {0xa}}, './file0\x00'}) readv(r8, &(0x7f0000000d00)=[{&(0x7f0000000700)=""/49, 0x31}, {&(0x7f0000000880)=""/252, 0xfc}, {&(0x7f0000000980)=""/122, 0x7a}, {&(0x7f0000000a00)=""/221, 0xdd}, {&(0x7f0000000b00)=""/179, 0xb3}, {&(0x7f0000000bc0)=""/86, 0x56}, {&(0x7f0000000c40)=""/179, 0xb3}], 0x7) sendmsg$kcm(r4, &(0x7f0000000740)={&(0x7f0000000240)=@pppoe={0x18, 0x0, {0x1, @remote, 'pim6reg1\x00'}}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000600)="6ed91a920d7bcec45b75918d4d60fbda597be5696cbc687981effbe0a2c43c509dc3b25ad953571dc71a1adb0cbce79db5921a856bf4f36a96c06f2a6d1c151f65312ae41a912aecf0446124365f41763d2bdd799129753cedc6493f3a83337a86643886d101857cf54c3741d5cde3f9337c17c109e020cd689412613806e49cc7ef33e681c1d2e05c7de862879a55235e8ce84fb9f4968658c88b4af365e181011d6f1c844d46af426dd898f659d0e96a5691b9961aacfacb", 0xb9}], 0x1, &(0x7f0000000700)}, 0x0) 6.41999284s ago: executing program 5 (id=5222): r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) write$P9_RREAD(r0, &(0x7f00000003c0)=ANY=[@ANYRESDEC, @ANYRESDEC], 0x100b) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0x8) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$inet(r3, &(0x7f00000002c0)="cc", 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x0, 0x3c}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f00000005c0)={0x0, 0x2, 0x7a}, 0x8) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002abd7000000000004400000008000300", @ANYRES32=r5, @ANYBLOB="0c0023800600010053000000"], 0x28}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSBRKP(r6, 0x5425, 0x0) ioctl$TCXONC(r6, 0x540a, 0x3) ioctl$TIOCGICOUNT(r6, 0x5409, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000300)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000fed000/0x11000)=nil, &(0x7f00000001c0)="0d3f8322c28e2ee2d7a9bf97a38c8e03eed42748c9675c8721a6c8047af8f14feaf7b2900dc00c7c7ecbb92e870ca60db775ff0c7fc9ee75f5a853de4304838b32c4f98a090c", 0x46, r0}, 0x68) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) r9 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) r10 = fsmount(r9, 0x0, 0x20) symlinkat(&(0x7f0000000000)='.\x00', r10, &(0x7f0000000140)='./file0\x00') syz_genetlink_get_family_id$nl80211(0x0, r10) openat(r10, &(0x7f00000000c0)='./file0\x00', 0x10f602, 0x52abe154ad664fa4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="18040000ff020000000000000000000095"], &(0x7f0000000040)='GPL\x00', 0x7, 0x0, 0x0, 0x40e00, 0x0, '\x00', r8, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x609}, 0x94) 5.891406855s ago: executing program 0 (id=5226): syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) syz_usb_connect(0x5, 0x3d, &(0x7f00000001c0)=ANY=[@ANYBLOB="12011201b1fb66101e090300bb350102030109022b0001080540040904ce01026fda0d000705f71f"], 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000012c0)='/sys/power/reserved_size', 0x2000, 0x186) read$FUSE(r0, &(0x7f0000002980)={0x2020}, 0x2020) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket(0x10, 0x3, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0xc0189436, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000200)="be", 0xfffffd0c}], 0x1, 0x0, 0x0, 0x4080}, 0x8000) accept4(r2, 0x0, 0x0, 0x800) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0x22, 0x0, &(0x7f00000008c0)="f6f4e9a1000000000000000d0800c32a8bc678bbd404fcd535fdc8a75167efec52a9", 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000700)="0102", 0x0}, 0x50) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r4, 0xfffffffc) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=ANY=[@ANYBLOB="d70a000020000000620a00000000000007000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0x12, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x62) syz_usb_connect$cdc_ecm(0x0, 0x7f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6d, 0x1, 0x1, 0x0, 0x10, 0x9e, "", [{{0x9, 0x4, 0x0, 0x81, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "db"}, {0x5, 0x24, 0x0, 0x4c}, {0xd, 0x24, 0xf, 0x1, 0x3, 0x9, 0x0, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0x200, 0x3ff, 0xe, 0x3, 0x3, 0x81}, @mbim_extended={0x8, 0x24, 0x1c, 0x8, 0x8, 0x9}, @mbim_extended={0x8, 0x24, 0x1c, 0x5, 0x1, 0xf000}, @mdlm={0x15, 0x24, 0x12, 0xff45}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x40, 0x8, 0x6, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x27, 0x26, 0x3}}}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x300, 0x7, 0x10, 0x5, 0xff, 0x2}, 0x5, &(0x7f0000000240)={0x5, 0xf, 0x5}, 0x3, [{0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x403}}, {0xfa, &(0x7f0000000500)=@string={0xfa, 0x3, "517ddcbd099f966f1a1ded2a4fcb6aeb01b20807264db0a0dbd898c194269b1241049189f57214038f22c7cb0f2203b1c2e65ec4d1cb98dcce5f7ce280d15be8539468c7bbd24eeeba44929149801f907a47be6ef353cea1abde0d49ccdc26047f6782bed11cacd199fdc309d652a019192f1581b236079e9f9f8fdfcff90dda72f669e0e4bbeff590e1a872112c82db5c20e3b1a3288503880e369afb3412ade3fb4dbf6dc483486fa5cc7298c7a2a782234be4b488b09386bd8b539e08a6955980c1f7974fcdc8bd2e65e5ac2664f767d9ff0285a1d847a6951d4f81b71bff204c0fa0fd730f714ac324a9f6e23ccaf9c0a81e9825a219"}}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0xc7d}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r6, 0x1, 0x70bd2c, 0x1000000, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}, 0x1, 0xff07}, 0x2000000) 5.676429867s ago: executing program 5 (id=5227): capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff008}, {0x6, 0xe, 0x3, 0x800}]}, 0x10) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022d000100000000090400001503000000092140000001220f00090581", @ANYRES8], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) r3 = fcntl$getown(r0, 0x9) capget(&(0x7f00000000c0)={0x0, r3}, &(0x7f0000000100)={0x0, 0x5, 0x10, 0x3ff, 0xfffffffb, 0x4}) syz_usb_control_io(r2, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f"], 0x0, 0x0, 0x0, 0x0}, 0x0) r4 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x40040) ioctl$HIDIOCGUSAGE(r4, 0x501c4814, 0x0) 5.303741519s ago: executing program 2 (id=5228): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f00000003c0)=[{0x6, 0x0, 0xff}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x200800, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',,=']) r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x60a4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x90, 0x27, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xc1, 0xfe, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x9, 0xc0, 0x1}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) mremap(&(0x7f0000064000/0x3000)=nil, 0x3000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000300)=ANY=[], 0x24, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = eventfd(0x8c66) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f0000000080)={0x2ce, 0x0, 0x4, r6, 0x11}) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f0000000240)={0x27800000000, 0x0, 0x1, r6, 0x1}) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f0000000040)={0x10, 0x0, 0x1, r6}) r7 = syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_tables_matches\x00') pread64(r7, &(0x7f0000000480)=""/177, 0xb1, 0xe0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x511a01, 0x80) r8 = syz_open_dev$usbmon(&(0x7f00000001c0), 0x0, 0x4000) tee(r0, r8, 0x4, 0xd) close_range(r0, 0xffffffffffffffff, 0x4000008) syz_usb_connect$uac2(0x6, 0xc9, &(0x7f0000000580)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x763, 0x2008, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xb7, 0x3, 0x1, 0x5b, 0xf0, 0x82, {0x8, 0xb, 0x0, 0x1, 0x1, 0x9, 0x20, 0xfc}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x10, 0x3, 0x1d, 0x9}, [@processing_unit={0xd, 0x24, 0x8, 0x6, 0x2, [0x2, 0x3, 0x3, 0x2]}, @multiply_unit={0x7, 0x24, 0xc, 0x7f, 0xef, 0x0, 0x2}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x5, 0xb, 0x8a, 0x5}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x1000, 0xe1b9, 0x10, "661aaa3c77"}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x3f, 0x3, 0x13, 0x3}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x0, 0x1, 0x4, 0xbe}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x4, 0x9, 0x0, "07d31ddbfaafd3e80a"}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x13, 0xe, 0x81, {0x8, 0x25, 0x1, 0x1, 0xc, 0x3, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x4, 0x4, 0x11, {0x8, 0x25, 0x1, 0x80, 0x5a, 0x2, 0x100}}}}}}}}]}}, &(0x7f0000000980)={0xa, &(0x7f00000006c0)={0xa, 0x6, 0x201, 0xd9, 0x40, 0x1, 0x10, 0x7}, 0x1e, &(0x7f0000000700)={0x5, 0xf, 0x1e, 0x3, [@ptm_cap={0x3}, @ssp_cap={0xc, 0x10, 0xa, 0x2, 0x0, 0x6, 0x8, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x1, 0x19, 0xfe, 0x80}]}, 0x8, [{0xf, &(0x7f0000000740)=@string={0xf, 0x3, "c058c2cfc50b7d40e498a8b847"}}, {0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x421}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x411}}, {0x0, 0x0}, {0x4, &(0x7f0000000880)=@lang_id={0x4, 0x3, 0x1c01}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x3409}}, {0x8, &(0x7f0000000900)=@string={0x8, 0x3, "87cfddf947a8"}}, {0x4, &(0x7f0000000940)=@lang_id={0x4, 0x3, 0xc01}}]}) 4.876413897s ago: executing program 3 (id=5231): mprotect(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0) sendto(0xffffffffffffffff, 0x0, 0x0, 0x8800, 0x0, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) write(r0, &(0x7f0000000680)="6729eed1ffe3dcddd69599c8ae771a23a15ce785fe51b210726696c74b847f9f5a682ac9e0e324bb3a8f51db7eb50208310c7c375070c520d25d9540f8c1e6b9501c21b2187c272165739bb1a44333bbe405e17632a21f80d6db1f3b00006c304a5ab5d800000000005b3724c9d56449df73264a1d9766eebd244de220412366be77528abfd18af95cc7e507643889150f4d952878c3f7daf18ec961f76eeea610a2520b808769295f463550ac501fe751cb68695080ce4537333ba5", 0xbc) 4.854851374s ago: executing program 3 (id=5232): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x18, 0x3, &(0x7f00000002c0)=@framed, &(0x7f0000000140)='syzkaller\x00'}, 0x94) bpf$OBJ_PIN_PROG(0x11, &(0x7f0000000280)=@generic={&(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', r0}, 0x18) 4.794396109s ago: executing program 3 (id=5234): r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000480), 0x8100, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000080)=0x80000003) r1 = dup2(r0, r0) read$FUSE(r1, &(0x7f0000008400)={0x2020}, 0x2020) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000300)=0x5) 3.816637851s ago: executing program 3 (id=5236): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_linger(r0, 0x1, 0x3d, &(0x7f00000000c0)={0x0, 0x2}, 0x8) sendmmsg$sock(r0, &(0x7f00000020c0)=[{{&(0x7f0000000500)=@hci={0x1f, 0xffffffffffffffff, 0x1}, 0x80, 0x0}}], 0x1, 0x8845) 3.757558356s ago: executing program 3 (id=5237): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4048084) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(xeta)\x00'}, 0x58) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x48d0}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x40000060, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) connect$inet(r1, &(0x7f00000002c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) sendmsg$inet(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)}], 0x1}, 0x4004045) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) sendfile(r1, r2, 0x0, 0x7ffff006) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000fe6000/0x14000)=nil, 0x14000, 0x0, 0x0, 0x0, &(0x7f00000001c0)=""/174, 0xae, 0x0, 0x0}, &(0x7f0000000100)=0x40) setsockopt$inet_mtu(r0, 0x0, 0xa, 0x0, 0x0) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, 0x0) ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000140)=0x7) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a28000000000a01040000000000000000010080030900010073797a300000000008000240000000011c0000050a010400000000000000000700000408000a40000000012c000000030a05000000000000000000010000050c00024000000000000000010900010073797a3000bdbcfd063c38b54d00010000000000000000000700000a00"], 0x98}, 0x1, 0x0, 0x0, 0x80}, 0x800) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r4, 0xfffffffc) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) 3.576264187s ago: executing program 5 (id=5238): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f00000002c0)={r0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, &(0x7f0000000180)="06", 0x0, 0x2, 0x0, 0x2}, 0x50) 3.563926875s ago: executing program 5 (id=5239): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x8b}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f0000000040)=0xffffffffffffffff) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x67) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {&(0x7f0000001480)}], 0x2) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5393, &(0x7f0000000000)) 3.543302071s ago: executing program 4 (id=5240): r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) r1 = bpf$BPF_LINK_CREATE_XDP(0x25, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20000) ioctl$SG_BLKTRACESTOP(r3, 0x1275, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000180)={0x11400, 0x8, 0x2, 0x0, 0x7, 0x2}, 0x30, 0x1) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r4, 0x1, &(0x7f00000001c0)={0x21, r1}, 0x1) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x20, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x4}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r5 = syz_open_dev$vim2m(0x0, 0x7fffffffffffffff, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, 0x0) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x0, @rand_addr=0x64010100}, {0x2, 0x200, @multicast1}, {0x2, 0x0, @empty}, 0x2a0, 0x0, 0x0, 0x0, 0x802a, 0x0, 0x0, 0x2000000}) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5393, &(0x7f0000000000)) socket$packet(0x11, 0x2, 0x300) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000100010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a30"], 0xec}, 0x1, 0x0, 0x0, 0x24004005}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r7 = syz_open_dev$dri(&(0x7f0000000040), 0x7, 0x2) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r7, 0x4010640d, &(0x7f0000000080)={0x7}) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, 0x0, 0x40000c4) socket(0x10, 0x3, 0x0) syz_open_dev$vim2m(&(0x7f0000000140), 0x1, 0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 3.228853645s ago: executing program 4 (id=5241): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3, 0x7}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040041}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="d800000025"], 0xd8}, 0x1, 0x0, 0x0, 0x4004041}, 0x20004440) 3.154628728s ago: executing program 4 (id=5242): socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0x31c5, &(0x7f0000000140)={0x0, 0xd73c, 0x2}, 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r0, 0x6, 0x17, &(0x7f0000000100)=0xa8, 0x4) socket$kcm(0x29, 0x5, 0x0) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) syz_open_dev$vim2m(&(0x7f0000000040), 0x2000b, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @private=0xa010100}, {0x2, 0x0, @local}, {0x2, 0x4e24, @rand_addr=0x64010102}, 0x11b, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x200004, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32=r2, @ANYRES16=r2, @ANYRES8=r1], 0x1c}, 0x1, 0x0, 0x0, 0x8c4}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) 3.152660498s ago: executing program 4 (id=5243): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000180)={0xffffffffffffffff}, 0x111, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000200)={0x10, 0x30, 0xfa00, {&(0x7f0000000100), 0x2, {0xa, 0x4e22, 0x0, @local, 0x3}, r1}}, 0x38) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010700000000000000006700000008000300", @ANYRES32=0x0, @ANYBLOB="e579ccf30a212d1b6701b4ee0000b8fa617572800b51edc44d546a9b648306bc97caccaeaf9d5964b6f3ad31a6b77281c745c39288b8f65537891154d26f4d555de8ae50ca2a4871a9c431c6ea11454b"], 0x24}}, 0x0) sendmsg$inet6(r2, &(0x7f0000000000)={&(0x7f0000000400)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0x18}}, 0x1c, 0x0, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="180000000000000029000000040000003b000000000100001800000000000000290000003700000000000000000000002848ae0000800000290000000522641c55705f7dc4cc1ab37fc11fbf080000eebeb0d5456a310100"], 0x58}, 0x80001) setresuid(0xee00, 0xee00, 0x0) r5 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="e8000000120001"], 0xe8}}, 0xc050) r6 = socket$kcm(0x10, 0x2, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x4041080) accept4$phonet_pipe(r7, &(0x7f00000003c0), 0x0, 0x0) r8 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r8, &(0x7f00000000c0)={0x1d, r9}, 0x18) connect$can_j1939(r8, &(0x7f0000000140)={0x1d, r9, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) r10 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r10, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) sendmmsg(r8, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) setsockopt$SO_TIMESTAMPING(r8, 0x1, 0x41, &(0x7f0000000080)=0x6d9a, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x15, 0xe, &(0x7f0000000400)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0xf921c036978d676d, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340), 0x10}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9bec", 0xc}], 0x1}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x18, 0x3, &(0x7f00000004c0)=ANY=[@ANYBLOB="180086c9546e9b9b5e0727ae7328c200000000000090bd991d89735ea495000002"], &(0x7f0000000140)='syzkaller\x00'}, 0x94) r11 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_SET_VERSION(r11, 0xc0106407, &(0x7f0000000c00)={0x1, 0xf, 0x6, 0x1513}) 2.82491889s ago: executing program 4 (id=5244): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = fcntl$getown(0xffffffffffffffff, 0x9) ptrace$ARCH_GET_UNTAG_MASK(0x1e, r1, &(0x7f0000000040), 0x4001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$PNPIPE_ENCAP(r4, 0x113, 0x1, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) openat$ptmx(0xffffffffffffff9c, 0x0, 0x441c2, 0x0) r5 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000480), 0x8100, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, &(0x7f0000000080)=0x80000003) r6 = dup2(r5, r5) read$FUSE(r6, &(0x7f0000008400)={0x2020}, 0x2020) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_open_dev$loop(0x0, 0x4, 0x41040) r7 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r7, 0xc0045005, &(0x7f0000000140)=0x2000) mmap$dsp(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x100000f, 0x11, r7, 0x0) 2.625053562s ago: executing program 3 (id=5245): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40040) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0xb2a42000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) recvmmsg(r3, 0x0, 0x0, 0x12143, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="090d0000000000f0ff000700000008000300", @ANYRES32=r6, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc0008"], 0x58}}, 0x0) 2.565278918s ago: executing program 5 (id=5246): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000003c0)={'wg2\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x18001}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r1}]}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) 560.012083ms ago: executing program 0 (id=5247): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_linger(r0, 0x1, 0x3d, &(0x7f00000000c0)={0x0, 0x2}, 0x8) sendmmsg$sock(r0, &(0x7f00000020c0)=[{{&(0x7f0000000500)=@hci={0x1f, 0xffffffffffffffff, 0x1}, 0x80, 0x0}}], 0x1, 0x8845) 152.038659ms ago: executing program 5 (id=5248): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x121000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, &(0x7f00000002c0)='\x00\x00', 0x2) ioctl$XFS_IOC_SCRUB_METADATA(r1, 0xc040583c, &(0x7f00000000c0)={0x8, 0x87, 0x100000000, 0x2, 0x1}) kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{&(0x7f0000000100)="047715ac7141c111fab2fcda5de4dc8b278029bcb1bd17524f177856cac105f463c77e2d2ab44d875217dc82baa911f236f959fb9227524d4fe6b621a19823457d04c399283edbac755852623c82f7206d26e918a2981c8f68476969bf8c4bcd37ba24e4ba1683339879a11b854a7478f898805f327af12eaab8ac918c201b7f", 0x80, 0x5, 0xffffffff}], 0x0) ioctl$NILFS_IOCTL_RESIZE(r1, 0x40086e8b, &(0x7f0000000280)=0xfffffffffffffffe) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000008004f0000500000000000059078ac1e0001ac141434441409030000000000000100ac1414aa00000000890fceffffffffe000000200000000830200000000004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYRESHEX=r1], 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) io_setup(0x2, &(0x7f0000000000)) eventfd(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$MRT_PIM(0xffffffffffffffff, 0x0, 0xcf, &(0x7f0000000080), 0x4) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_io_uring_setup(0x38, 0x0, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) 84.905052ms ago: executing program 4 (id=5249): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000100)=0x8b, 0x4) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000240)={0x0, 0x38, &(0x7f0000000180)=[@in6={0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x20}, @in6={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}]}, &(0x7f0000000280)=0x10) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000180)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001e0000000c00018008000100", @ANYRES32=r5, @ANYBLOB="050003"], 0x28}}, 0x0) socket$inet6(0xa, 0x80002, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001500010300000000000000000b"], 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x4000820) socket$kcm(0x2, 0x200000000000001, 0x106) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x0) r6 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r6, &(0x7f0000000040)={0x2a, 0xffffffff, 0xfffffffe}, 0xc) r7 = syz_io_uring_setup(0x57a5, &(0x7f0000000400)={0x0, 0xd95f, 0x10000, 0x0, 0x51}, &(0x7f0000000300)=0x0, &(0x7f0000000140)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x4110}, 0x1}) io_uring_enter(r7, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000040)='source', &(0x7f0000000080)='//', 0x0) 0s ago: executing program 0 (id=5250): syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd69010000001406fffe800000000000000000000039fe8000000000000000000000000000aa4e224e24000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="51c2"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x4000000) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r1) symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000000)='./file0\x00') mount_setattr(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0, &(0x7f0000000180)={0x200001, 0x81, 0x100000}, 0x20) chroot(&(0x7f0000000440)='./file0\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x5, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) kernel console output (not intermixed with test programs): e: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1025.990252][T21394] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1025.991632][ T821] usb usb1-port1: unable to enumerate USB device [ 1026.115782][T21400] FAULT_INJECTION: forcing a failure. [ 1026.115782][T21400] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1026.116016][T21400] CPU: 1 UID: 0 PID: 21400 Comm: syz.2.4838 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1026.116046][T21400] Tainted: [L]=SOFTLOCKUP [ 1026.116053][T21400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1026.116066][T21400] Call Trace: [ 1026.116074][T21400] [ 1026.116082][T21400] dump_stack_lvl+0xe8/0x150 [ 1026.116109][T21400] should_fail_ex+0x467/0x600 [ 1026.116142][T21400] _copy_from_user+0x2d/0xb0 [ 1026.116165][T21400] __sys_sendto+0x2b5/0x5d0 [ 1026.116187][T21400] ? __pfx___sys_sendto+0x10/0x10 [ 1026.116212][T21400] ? lock_release+0x4b/0x3c0 [ 1026.116235][T21400] ? fdget_pos+0x252/0x320 [ 1026.116264][T21400] ? __pfx_ksys_write+0x10/0x10 [ 1026.116294][T21400] __x64_sys_sendto+0xde/0x100 [ 1026.116314][T21400] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1026.116334][T21400] do_syscall_64+0x174/0x580 [ 1026.116354][T21400] ? trace_irq_disable+0x3b/0x140 [ 1026.116374][T21400] ? clear_bhb_loop+0x40/0x90 [ 1026.116394][T21400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1026.116410][T21400] RIP: 0033:0x7f9168bece59 [ 1026.116428][T21400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1026.116445][T21400] RSP: 002b:00007f9166e46028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1026.116467][T21400] RAX: ffffffffffffffda RBX: 00007f9168e65fa0 RCX: 00007f9168bece59 [ 1026.116491][T21400] RDX: 0000000000000a00 RSI: 0000000000000000 RDI: 0000000000000004 [ 1026.116504][T21400] RBP: 00007f9166e46090 R08: 0000200000000100 R09: 0000000000000010 [ 1026.116517][T21400] R10: 0000000000048890 R11: 0000000000000246 R12: 0000000000000001 [ 1026.116530][T21400] R13: 00007f9168e66038 R14: 00007f9168e65fa0 R15: 00007ffc095214f8 [ 1026.116554][T21400] [ 1026.166630][T17058] appletouch 6-1:0.85: Geyser mode initialized. [ 1026.206408][T21403] overlayfs: missing 'lowerdir' [ 1026.281802][T17058] input: appletouch as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.85/input/input70 [ 1026.303533][T17925] garmin_gps 5-1:8.206: Garmin GPS usb/tty converter detected [ 1026.310129][T17925] garmin_gps ttyUSB0: failed to submit interrupt urb: -90 [ 1026.310168][T17925] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -90 [ 1026.323380][T17925] usb 5-1: USB disconnect, device number 41 [ 1026.376535][T17925] garmin_gps 5-1:8.206: device disconnected [ 1026.390989][T18584] udevd[18584]: setting owner of /dev/bus/usb/005/041 to uid=0, gid=0 failed: No such file or directory [ 1026.584385][T21414] FAULT_INJECTION: forcing a failure. [ 1026.584385][T21414] name failslab, interval 1, probability 0, space 0, times 0 [ 1026.584420][T21414] CPU: 1 UID: 0 PID: 21414 Comm: syz.2.4844 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1026.584446][T21414] Tainted: [L]=SOFTLOCKUP [ 1026.584454][T21414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1026.584474][T21414] Call Trace: [ 1026.584482][T21414] [ 1026.584491][T21414] dump_stack_lvl+0xe8/0x150 [ 1026.584517][T21414] should_fail_ex+0x467/0x600 [ 1026.584546][T21414] should_failslab+0xa8/0x100 [ 1026.584572][T21414] __kmalloc_cache_noprof+0x84/0x690 [ 1026.584596][T21414] ? rtnl_newlink+0x136/0x1bd0 [ 1026.584618][T21414] rtnl_newlink+0x136/0x1bd0 [ 1026.584638][T21414] ? kasan_save_track+0x4f/0x80 [ 1026.584659][T21414] ? kasan_save_track+0x3e/0x80 [ 1026.584678][T21414] ? kasan_save_free_info+0x40/0x50 [ 1026.584705][T21414] ? __kasan_slab_free+0x5c/0x80 [ 1026.584726][T21414] ? kmem_cache_free+0x187/0x6c0 [ 1026.584749][T21414] ? dev_hard_start_xmit+0x2df/0x870 [ 1026.584773][T21414] ? __netlink_deliver_tap+0x5b4/0x860 [ 1026.584794][T21414] ? netlink_deliver_tap+0x19c/0x1b0 [ 1026.584814][T21414] ? netlink_unicast+0x7b8/0x990 [ 1026.584830][T21414] ? netlink_sendmsg+0x813/0xb40 [ 1026.584852][T21414] ? __pfx_rtnl_newlink+0x10/0x10 [ 1026.584867][T21414] ? do_syscall_64+0x174/0x580 [ 1026.584885][T21414] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1026.584907][T21414] ? __css_rstat_updated+0x235/0x540 [ 1026.585033][T21414] ? __pfx___css_rstat_updated+0x10/0x10 [ 1026.585061][T21414] ? __cgroup_account_cputime+0xe5/0x120 [ 1026.585085][T21414] ? update_cfs_rq_load_avg+0x426/0x4e0 [ 1026.585111][T21414] ? kvm_sched_clock_read+0x11/0x20 [ 1026.585137][T21414] ? sched_clock+0x3f/0x60 [ 1026.585155][T21414] ? finish_task_switch+0x15d/0xbc0 [ 1026.585178][T21414] ? rcu_is_watching+0x15/0xb0 [ 1026.585203][T21414] ? rcu_is_watching+0x15/0xb0 [ 1026.585227][T21414] ? rcu_is_watching+0x15/0xb0 [ 1026.585252][T21414] ? trace_irq_enable+0x3b/0x140 [ 1026.585276][T21414] ? rcu_is_watching+0x15/0xb0 [ 1026.585300][T21414] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1026.585320][T21414] ? rcu_is_watching+0x15/0xb0 [ 1026.585340][T21414] ? __pfx_rtnl_newlink+0x10/0x10 [ 1026.585357][T21414] ? rcu_is_watching+0x15/0xb0 [ 1026.585380][T21414] ? __pfx_rtnl_newlink+0x10/0x10 [ 1026.585397][T21414] ? lock_release+0x4b/0x3c0 [ 1026.585419][T21414] ? bpf_lsm_capable+0x9/0x20 [ 1026.585441][T21414] ? security_capable+0x7e/0x2c0 [ 1026.585475][T21414] ? __pfx_rtnl_newlink+0x10/0x10 [ 1026.585493][T21414] rtnetlink_rcv_msg+0x802/0xc00 [ 1026.585513][T21414] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1026.585531][T21414] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1026.585549][T21414] ? lapic_next_event+0x11/0x20 [ 1026.585572][T21414] ? clockevents_program_event+0x4bb/0x630 [ 1026.585599][T21414] ? __pfx___schedule+0x10/0x10 [ 1026.585628][T21414] netlink_rcv_skb+0x226/0x4a0 [ 1026.585649][T21414] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1026.585669][T21414] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1026.585687][T21414] ? irqentry_exit+0x218/0x8f0 [ 1026.585707][T21414] ? __pfx_rtnetlink_rcv+0x10/0x10 [ 1026.585724][T21414] ? rtnetlink_rcv+0xd/0x20 [ 1026.585739][T21414] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1026.585760][T21414] netlink_unicast+0x7f5/0x990 [ 1026.585783][T21414] netlink_sendmsg+0x813/0xb40 [ 1026.585805][T21414] ? lock_release+0x4b/0x3c0 [ 1026.585827][T21414] ? lock_release+0x4b/0x3c0 [ 1026.585847][T21414] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1026.585859][T21414] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1026.585873][T21414] ? __kernel_text_address+0xd/0x30 [ 1026.585889][T21414] ? unwind_get_return_address+0x4d/0x90 [ 1026.585925][T21414] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1026.585946][T21414] sock_sendmsg_nosec+0x13a/0x180 [ 1026.585975][T21414] ____sys_sendmsg+0x565/0x870 [ 1026.585999][T21414] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1026.586012][T21414] ? lock_release+0x4b/0x3c0 [ 1026.586024][T21414] ? import_iovec+0x73/0xa0 [ 1026.586036][T21414] ___sys_sendmsg+0x2a5/0x360 [ 1026.586047][T21414] ? rcu_is_watching+0x15/0xb0 [ 1026.586071][T21414] ? get_pid_task+0x20/0x1f0 [ 1026.586091][T21414] ? __pfx____sys_sendmsg+0x10/0x10 [ 1026.586116][T21414] ? rcu_is_watching+0x15/0xb0 [ 1026.586153][T21414] ? __fget_files+0x2a/0x420 [ 1026.586168][T21414] ? __fget_files+0x3a8/0x420 [ 1026.586181][T21414] __x64_sys_sendmsg+0x1b7/0x290 [ 1026.586193][T21414] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1026.586207][T21414] ? rcu_is_watching+0x15/0xb0 [ 1026.586232][T21414] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1026.586252][T21414] do_syscall_64+0x174/0x580 [ 1026.586271][T21414] ? trace_irq_disable+0x3b/0x140 [ 1026.586292][T21414] ? clear_bhb_loop+0x40/0x90 [ 1026.586313][T21414] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1026.586323][T21414] RIP: 0033:0x7f9168bece59 [ 1026.586334][T21414] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1026.586343][T21414] RSP: 002b:00007f9166e46028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1026.586355][T21414] RAX: ffffffffffffffda RBX: 00007f9168e65fa0 RCX: 00007f9168bece59 [ 1026.586363][T21414] RDX: 0000000020008004 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1026.586375][T21414] RBP: 00007f9166e46090 R08: 0000000000000000 R09: 0000000000000000 [ 1026.586387][T21414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1026.586399][T21414] R13: 00007f9168e66038 R14: 00007f9168e65fa0 R15: 00007ffc095214f8 [ 1026.586422][T21414] [ 1027.051185][T21436] FAULT_INJECTION: forcing a failure. [ 1027.051185][T21436] name failslab, interval 1, probability 0, space 0, times 0 [ 1027.051222][T21436] CPU: 0 UID: 0 PID: 21436 Comm: syz.2.4852 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1027.051249][T21436] Tainted: [L]=SOFTLOCKUP [ 1027.051255][T21436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1027.051265][T21436] Call Trace: [ 1027.051272][T21436] [ 1027.051280][T21436] dump_stack_lvl+0xe8/0x150 [ 1027.051305][T21436] should_fail_ex+0x467/0x600 [ 1027.051331][T21436] should_failslab+0xa8/0x100 [ 1027.051355][T21436] kmem_cache_alloc_noprof+0x87/0x680 [ 1027.051374][T21436] ? skb_clone+0x212/0x3a0 [ 1027.051398][T21436] skb_clone+0x212/0x3a0 [ 1027.051420][T21436] __netlink_deliver_tap+0x413/0x860 [ 1027.051447][T21436] ? netlink_deliver_tap+0x2e/0x1b0 [ 1027.051466][T21436] netlink_deliver_tap+0x19c/0x1b0 [ 1027.051487][T21436] netlink_unicast+0x7b8/0x990 [ 1027.051510][T21436] netlink_sendmsg+0x813/0xb40 [ 1027.051530][T21436] ? rcu_is_watching+0x15/0xb0 [ 1027.051559][T21436] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1027.051583][T21436] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1027.051610][T21436] ? __kernel_text_address+0xd/0x30 [ 1027.051635][T21436] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1027.051657][T21436] sock_sendmsg_nosec+0x13a/0x180 [ 1027.051686][T21436] ____sys_sendmsg+0x565/0x870 [ 1027.051708][T21436] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1027.051728][T21436] ? lock_release+0x4b/0x3c0 [ 1027.051750][T21436] ? import_iovec+0x73/0xa0 [ 1027.051770][T21436] ___sys_sendmsg+0x2a5/0x360 [ 1027.051789][T21436] ? rcu_is_watching+0x15/0xb0 [ 1027.051812][T21436] ? get_pid_task+0x20/0x1f0 [ 1027.051829][T21436] ? __pfx____sys_sendmsg+0x10/0x10 [ 1027.051862][T21436] ? rcu_is_watching+0x15/0xb0 [ 1027.051896][T21436] ? __fget_files+0x2a/0x420 [ 1027.051916][T21436] ? __fget_files+0x3a8/0x420 [ 1027.051939][T21436] __x64_sys_sendmsg+0x1b7/0x290 [ 1027.051959][T21436] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1027.051985][T21436] ? rcu_is_watching+0x15/0xb0 [ 1027.052011][T21436] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1027.052031][T21436] do_syscall_64+0x174/0x580 [ 1027.052050][T21436] ? trace_irq_disable+0x3b/0x140 [ 1027.052070][T21436] ? clear_bhb_loop+0x40/0x90 [ 1027.052092][T21436] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1027.052110][T21436] RIP: 0033:0x7f9168bece59 [ 1027.052127][T21436] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1027.052145][T21436] RSP: 002b:00007f9166e46028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1027.052167][T21436] RAX: ffffffffffffffda RBX: 00007f9168e65fa0 RCX: 00007f9168bece59 [ 1027.052181][T21436] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 1027.052194][T21436] RBP: 00007f9166e46090 R08: 0000000000000000 R09: 0000000000000000 [ 1027.052206][T21436] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1027.052216][T21436] R13: 00007f9168e66038 R14: 00007f9168e65fa0 R15: 00007ffc095214f8 [ 1027.052236][T21436] [ 1027.261046][T21443] syzkaller0: entered promiscuous mode [ 1027.261304][T21443] syzkaller0: entered allmulticast mode [ 1027.527341][T21454] FAULT_INJECTION: forcing a failure. [ 1027.527341][T21454] name failslab, interval 1, probability 0, space 0, times 0 [ 1027.527364][T21454] CPU: 0 UID: 0 PID: 21454 Comm: syz.2.4858 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1027.527379][T21454] Tainted: [L]=SOFTLOCKUP [ 1027.527383][T21454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1027.527390][T21454] Call Trace: [ 1027.527397][T21454] [ 1027.527402][T21454] dump_stack_lvl+0xe8/0x150 [ 1027.527418][T21454] should_fail_ex+0x467/0x600 [ 1027.527435][T21454] should_failslab+0xa8/0x100 [ 1027.527451][T21454] __kmalloc_noprof+0xdf/0x7a0 [ 1027.527463][T21454] ? drm_atomic_commit_init+0x9e/0x370 [ 1027.527480][T21454] drm_atomic_commit_init+0x9e/0x370 [ 1027.527493][T21454] drm_atomic_commit_alloc+0xbc/0x100 [ 1027.527506][T21454] drm_mode_atomic_ioctl+0x4a3/0x24c0 [ 1027.527523][T21454] ? rcu_is_watching+0x15/0xb0 [ 1027.527541][T21454] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 1027.527560][T21454] ? rt_spin_unlock+0x160/0x200 [ 1027.527574][T21454] ? drm_is_current_master+0x1a2/0x210 [ 1027.527589][T21454] drm_ioctl_kernel+0x2e2/0x3b0 [ 1027.527602][T21454] ? lock_acquire+0x5f/0x350 [ 1027.527615][T21454] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 1027.527630][T21454] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 1027.527642][T21454] ? __might_fault+0xcb/0x130 [ 1027.527656][T21454] drm_ioctl+0x713/0xba0 [ 1027.527670][T21454] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 1027.527684][T21454] ? __pfx_drm_ioctl+0x10/0x10 [ 1027.527699][T21454] ? __fget_files+0x2a/0x420 [ 1027.527711][T21454] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1027.527723][T21454] ? __pfx_drm_ioctl+0x10/0x10 [ 1027.527735][T21454] __se_sys_ioctl+0xff/0x170 [ 1027.527749][T21454] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1027.527760][T21454] do_syscall_64+0x174/0x580 [ 1027.527770][T21454] ? trace_irq_disable+0x3b/0x140 [ 1027.527782][T21454] ? clear_bhb_loop+0x40/0x90 [ 1027.527793][T21454] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1027.527803][T21454] RIP: 0033:0x7f9168bece59 [ 1027.527812][T21454] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1027.527821][T21454] RSP: 002b:00007f9166e46028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1027.527833][T21454] RAX: ffffffffffffffda RBX: 00007f9168e65fa0 RCX: 00007f9168bece59 [ 1027.527844][T21454] RDX: 0000200000000180 RSI: 00000000c03864bc RDI: 000000000000000e [ 1027.527850][T21454] RBP: 00007f9166e46090 R08: 0000000000000000 R09: 0000000000000000 [ 1027.527857][T21454] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1027.527863][T21454] R13: 00007f9168e66038 R14: 00007f9168e65fa0 R15: 00007ffc095214f8 [ 1027.527874][T21454] [ 1027.657759][T21443] tipc: Started in network mode [ 1027.657786][T21443] tipc: Node identity f2d31a75736d, cluster identity 4711 [ 1027.657997][T21443] tipc: Enabled bearer , priority 0 [ 1027.771361][T21442] tipc: Resetting bearer [ 1028.039455][T17058] usb 6-1: USB disconnect, device number 3 [ 1028.065091][T21442] tipc: Disabling bearer [ 1028.295719][T21486] Can't find a SQUASHFS superblock on nullb0 [ 1029.319101][T17058] appletouch 6-1:0.85: input: appletouch disconnected [ 1029.611480][T21520] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4884'. [ 1029.678795][T17925] tipc: Node number set to 2176719477 [ 1029.791117][ T821] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 1029.849810][T21523] binder: BINDER_SET_CONTEXT_MGR already set [ 1029.849844][T21523] binder: 21513:21523 ioctl 4018620d 200000004a80 returned -16 [ 1030.036318][ T821] usb 4-1: Using ep0 maxpacket: 16 [ 1030.038999][ T821] usb 4-1: config 1 has an invalid interface number: 19 but max is 0 [ 1030.039019][ T821] usb 4-1: config 1 has no interface number 0 [ 1030.039037][ T821] usb 4-1: config 1 interface 19 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1030.039049][ T821] usb 4-1: config 1 interface 19 has no altsetting 0 [ 1030.041647][ T821] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 1030.041673][ T821] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1030.041683][ T821] usb 4-1: Product: syz [ 1030.041691][ T821] usb 4-1: Manufacturer: syz [ 1030.041698][ T821] usb 4-1: SerialNumber: syz [ 1030.118200][ T821] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1030.286960][ T821] usb 4-1: USB disconnect, device number 23 [ 1030.287971][T12679] usb 4-1: Failed to submit usb control message: -71 [ 1030.287991][T12679] usb 4-1: unable to send the bmi data to the device: -71 [ 1030.288001][T12679] usb 4-1: unable to get target info from device [ 1030.288009][T12679] usb 4-1: could not get target info (-71) [ 1030.288021][T12679] usb 4-1: could not probe fw (-71) [ 1030.383278][T21545] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4889'. [ 1030.835750][T21523] syz.4.4881 (21523): drop_caches: 2 [ 1030.915458][T21572] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4901'. [ 1031.196335][T21589] FAULT_INJECTION: forcing a failure. [ 1031.196335][T21589] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1031.196372][T21589] CPU: 1 UID: 0 PID: 21589 Comm: syz.4.4910 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1031.196400][T21589] Tainted: [L]=SOFTLOCKUP [ 1031.196408][T21589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1031.196420][T21589] Call Trace: [ 1031.196427][T21589] [ 1031.196436][T21589] dump_stack_lvl+0xe8/0x150 [ 1031.196463][T21589] should_fail_ex+0x467/0x600 [ 1031.196494][T21589] prepare_alloc_pages+0x223/0x690 [ 1031.196522][T21589] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1031.196550][T21589] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1031.196578][T21589] ? __pfx_policy_nodemask+0x10/0x10 [ 1031.196605][T21589] ? unwind_next_frame+0x8f/0x2550 [ 1031.196629][T21589] ? rcu_is_watching+0x15/0xb0 [ 1031.196657][T21589] alloc_pages_mpol+0xce/0x280 [ 1031.196684][T21589] folio_alloc_mpol_noprof+0x3b/0x1e0 [ 1031.196711][T21589] vma_alloc_folio_noprof+0xe1/0x1e0 [ 1031.196738][T21589] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1031.196761][T21589] ? __pte_offset_map+0x29/0x200 [ 1031.196785][T21589] do_pte_missing+0x835/0x28f0 [ 1031.196811][T21589] ? rcu_is_watching+0x15/0xb0 [ 1031.196835][T21589] ? lock_release+0x4b/0x3c0 [ 1031.196869][T21589] handle_mm_fault+0xd28/0x13f0 [ 1031.196894][T21589] ? handle_mm_fault+0xe8/0x13f0 [ 1031.196916][T21589] ? __pfx_handle_mm_fault+0x10/0x10 [ 1031.196943][T21589] ? rcu_is_watching+0x15/0xb0 [ 1031.196973][T21589] ? lock_mm_and_find_vma+0xa7/0x340 [ 1031.197000][T21589] do_user_addr_fault+0x744/0x1340 [ 1031.197030][T21589] exc_page_fault+0x6a/0xc0 [ 1031.197059][T21589] asm_exc_page_fault+0x26/0x30 [ 1031.197078][T21589] RIP: 0010:__put_user_4+0xd/0x30 [ 1031.197097][T21589] Code: 66 89 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 1031.197115][T21589] RSP: 0018:ffffc9000f60fb38 EFLAGS: 00050206 [ 1031.197133][T21589] RAX: 0000000000000035 RBX: 0000000000000000 RCX: 0000200000001700 [ 1031.197147][T21589] RDX: 0000200000001700 RSI: ffffffff8ba7f080 RDI: ffffffff8ba7f040 [ 1031.197162][T21589] RBP: ffffc9000f60fc10 R08: 0000000000000001 R09: 0000000000000000 [ 1031.197175][T21589] R10: dffffc0000000000 R11: ffffed100ba61f01 R12: 0000000000000000 [ 1031.197189][T21589] R13: 1ffff11006c69600 R14: 1ffff11004949c0d R15: ffff88803634b005 [ 1031.197212][T21589] drm_mode_getresources+0x9b1/0xc90 [ 1031.197246][T21589] ? __pfx_drm_mode_getresources+0x10/0x10 [ 1031.197278][T21589] drm_ioctl_kernel+0x2e2/0x3b0 [ 1031.197302][T21589] ? lock_acquire+0x5f/0x350 [ 1031.197325][T21589] ? __pfx_drm_mode_getresources+0x10/0x10 [ 1031.197353][T21589] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 1031.197377][T21589] ? __might_fault+0xcb/0x130 [ 1031.197402][T21589] drm_ioctl+0x713/0xba0 [ 1031.197428][T21589] ? __pfx_drm_mode_getresources+0x10/0x10 [ 1031.197456][T21589] ? __pfx_drm_ioctl+0x10/0x10 [ 1031.197484][T21589] ? __fget_files+0x2a/0x420 [ 1031.197508][T21589] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1031.197529][T21589] ? __pfx_drm_ioctl+0x10/0x10 [ 1031.197552][T21589] __se_sys_ioctl+0xff/0x170 [ 1031.197580][T21589] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1031.197600][T21589] do_syscall_64+0x174/0x580 [ 1031.197617][T21589] ? trace_irq_disable+0x3b/0x140 [ 1031.197640][T21589] ? clear_bhb_loop+0x40/0x90 [ 1031.197660][T21589] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1031.197678][T21589] RIP: 0033:0x7f4c0bf7ce59 [ 1031.197691][T21589] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1031.197700][T21589] RSP: 002b:00007f4c0a1ce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1031.197711][T21589] RAX: ffffffffffffffda RBX: 00007f4c0c1f5fa0 RCX: 00007f4c0bf7ce59 [ 1031.197719][T21589] RDX: 00002000000006c0 RSI: 00000000c04064a0 RDI: 0000000000000003 [ 1031.197726][T21589] RBP: 00007f4c0a1ce090 R08: 0000000000000000 R09: 0000000000000000 [ 1031.197732][T21589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1031.197739][T21589] R13: 00007f4c0c1f6038 R14: 00007f4c0c1f5fa0 R15: 00007ffc9870f588 [ 1031.197750][T21589] [ 1031.470463][ T5709] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1031.844999][ T5709] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1031.845030][ T5709] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1031.845050][ T5709] usb 4-1: Product: syz [ 1031.845065][ T5709] usb 4-1: Manufacturer: syz [ 1031.845080][ T5709] usb 4-1: SerialNumber: syz [ 1032.088237][T21613] netlink: 76 bytes leftover after parsing attributes in process `syz.5.4921'. [ 1032.365514][ T5709] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1032.365561][ T5709] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1032.368528][ T5709] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 1032.368570][ T5709] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1032.368978][ T5709] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1032.422171][ T5709] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -32 [ 1032.844970][T21667] FAULT_INJECTION: forcing a failure. [ 1032.844970][T21667] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1032.845021][T21667] CPU: 1 UID: 0 PID: 21667 Comm: syz.2.4941 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1032.845049][T21667] Tainted: [L]=SOFTLOCKUP [ 1032.845057][T21667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1032.845069][T21667] Call Trace: [ 1032.845082][T21667] [ 1032.845091][T21667] dump_stack_lvl+0xe8/0x150 [ 1032.845118][T21667] should_fail_ex+0x467/0x600 [ 1032.845148][T21667] prepare_alloc_pages+0x223/0x690 [ 1032.845177][T21667] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1032.845206][T21667] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1032.845234][T21667] ? __pfx_policy_nodemask+0x10/0x10 [ 1032.845260][T21667] ? rcu_is_watching+0x15/0xb0 [ 1032.845289][T21667] ? trace_irq_enable+0x3b/0x140 [ 1032.845314][T21667] alloc_pages_mpol+0xce/0x280 [ 1032.845341][T21667] alloc_pages_noprof+0xd2/0x2f0 [ 1032.845369][T21667] get_free_pages_noprof+0xf/0x80 [ 1032.845395][T21667] __kasan_populate_vmalloc+0x38/0x1c0 [ 1032.845417][T21667] ? rt_spin_unlock+0x160/0x200 [ 1032.845444][T21667] alloc_vmap_area+0xd1a/0x1420 [ 1032.845472][T21667] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1032.845492][T21667] ? __kasan_kmalloc+0x93/0xb0 [ 1032.845516][T21667] ? __kmalloc_cache_node_noprof+0x279/0x6f0 [ 1032.845542][T21667] ? __get_vm_area_node+0x136/0x300 [ 1032.845564][T21667] __get_vm_area_node+0x1f2/0x300 [ 1032.845588][T21667] __vmalloc_node_range_noprof+0x358/0x1730 [ 1032.845611][T21667] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1032.845648][T21667] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1032.845672][T21667] ? irqentry_exit+0x218/0x8f0 [ 1032.845696][T21667] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1032.845719][T21667] __vmalloc_noprof+0xd2/0x120 [ 1032.845747][T21667] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1032.845773][T21667] bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1032.845796][T21667] ? bpf_prog_alloc+0x2a/0x1a0 [ 1032.845820][T21667] bpf_prog_alloc+0x3c/0x1a0 [ 1032.845845][T21667] bpf_prog_load+0x7f8/0x1c00 [ 1032.845875][T21667] ? __pfx_bpf_prog_load+0x10/0x10 [ 1032.845910][T21667] __sys_bpf+0xd0d/0xd90 [ 1032.845936][T21667] ? __pfx___sys_bpf+0x10/0x10 [ 1032.845958][T21667] ? trace_irq_enable+0x3b/0x140 [ 1032.845995][T21667] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1032.846017][T21667] __x64_sys_bpf+0xba/0xd0 [ 1032.846037][T21667] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1032.846057][T21667] do_syscall_64+0x174/0x580 [ 1032.846077][T21667] ? clear_bhb_loop+0x40/0x90 [ 1032.846099][T21667] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1032.846118][T21667] RIP: 0033:0x7f9168bece59 [ 1032.846136][T21667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1032.846154][T21667] RSP: 002b:00007f9166e04028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1032.846175][T21667] RAX: ffffffffffffffda RBX: 00007f9168e66180 RCX: 00007f9168bece59 [ 1032.846191][T21667] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 1032.846205][T21667] RBP: 00007f9166e04090 R08: 0000000000000000 R09: 0000000000000000 [ 1032.846218][T21667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1032.846230][T21667] R13: 00007f9168e66218 R14: 00007f9168e66180 R15: 00007ffc095214f8 [ 1032.846253][T21667] [ 1032.846484][T21667] syz.2.4941: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1032.846638][T21667] CPU: 1 UID: 0 PID: 21667 Comm: syz.2.4941 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1032.846666][T21667] Tainted: [L]=SOFTLOCKUP [ 1032.846674][T21667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1032.846686][T21667] Call Trace: [ 1032.846693][T21667] [ 1032.846700][T21667] dump_stack_lvl+0xe8/0x150 [ 1032.846723][T21667] warn_alloc+0x24c/0x270 [ 1032.846754][T21667] ? trace_irq_enable+0x3b/0x140 [ 1032.846777][T21667] ? __pfx_warn_alloc+0x10/0x10 [ 1032.846801][T21667] ? __get_vm_area_node+0x20b/0x300 [ 1032.846824][T21667] ? __get_vm_area_node+0x20b/0x300 [ 1032.846848][T21667] __vmalloc_node_range_noprof+0x37d/0x1730 [ 1032.846883][T21667] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1032.846906][T21667] ? irqentry_exit+0x218/0x8f0 [ 1032.846927][T21667] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1032.846950][T21667] __vmalloc_noprof+0xd2/0x120 [ 1032.846971][T21667] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1032.846997][T21667] bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1032.847020][T21667] ? bpf_prog_alloc+0x2a/0x1a0 [ 1032.847044][T21667] bpf_prog_alloc+0x3c/0x1a0 [ 1032.847068][T21667] bpf_prog_load+0x7f8/0x1c00 [ 1032.847096][T21667] ? __pfx_bpf_prog_load+0x10/0x10 [ 1032.847131][T21667] __sys_bpf+0xd0d/0xd90 [ 1032.847156][T21667] ? __pfx___sys_bpf+0x10/0x10 [ 1032.847179][T21667] ? trace_irq_enable+0x3b/0x140 [ 1032.847215][T21667] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1032.847237][T21667] __x64_sys_bpf+0xba/0xd0 [ 1032.847257][T21667] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1032.847277][T21667] do_syscall_64+0x174/0x580 [ 1032.847296][T21667] ? clear_bhb_loop+0x40/0x90 [ 1032.847320][T21667] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1032.847339][T21667] RIP: 0033:0x7f9168bece59 [ 1032.847354][T21667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1032.847369][T21667] RSP: 002b:00007f9166e04028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1032.847388][T21667] RAX: ffffffffffffffda RBX: 00007f9168e66180 RCX: 00007f9168bece59 [ 1032.847403][T21667] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 1032.847416][T21667] RBP: 00007f9166e04090 R08: 0000000000000000 R09: 0000000000000000 [ 1032.847429][T21667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1032.847441][T21667] R13: 00007f9168e66218 R14: 00007f9168e66180 R15: 00007ffc095214f8 [ 1032.847463][T21667] [ 1032.847524][T21667] Mem-Info: [ 1032.847560][T21667] active_anon:198 inactive_anon:12659 isolated_anon:0 [ 1032.847560][T21667] active_file:23048 inactive_file:37968 isolated_file:0 [ 1032.847560][T21667] unevictable:768 dirty:239 writeback:0 [ 1032.847560][T21667] slab_reclaimable:13146 slab_unreclaimable:111042 [ 1032.847560][T21667] mapped:37449 shmem:7466 pagetables:1544 [ 1032.847560][T21667] sec_pagetables:0 bounce:0 [ 1032.847560][T21667] kernel_misc_reclaimable:0 [ 1032.847560][T21667] free:1243563 free_pcp:4866 free_cma:0 [ 1032.847626][T21667] Node 0 active_anon:792kB inactive_anon:50636kB active_file:91844kB inactive_file:151872kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:149652kB dirty:956kB writeback:0kB shmem:28328kB kernel_stack:14208kB pagetables:6028kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1032.847689][T21667] Node 1 active_anon:0kB inactive_anon:0kB active_file:348kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:144kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:64kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1032.847756][T21667] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1032.847839][T21667] lowmem_reserve[]: 0 2505 2506 2506 2506 [ 1032.847968][T21667] Node 0 DMA32 free:1010324kB boost:0kB min:3928kB low:6464kB high:9000kB reserved_highatomic:0KB free_highatomic:0KB active_anon:792kB inactive_anon:50636kB active_file:91844kB inactive_file:151872kB unevictable:1536kB writepending:956kB zspages:0kB present:3129332kB managed:2566024kB mlocked:0kB bounce:0kB free_pcp:19464kB local_pcp:13400kB free_cma:0kB [ 1032.848055][T21667] lowmem_reserve[]: 0 0 0 0 0 [ 1032.848186][T21667] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:192kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1032.848272][T21667] lowmem_reserve[]: 0 0 0 0 0 [ 1032.848402][T21667] Node 1 Normal free:3948568kB boost:0kB min:6368kB low:10476kB high:14584kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:348kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1032.848486][T21667] lowmem_reserve[]: 0 0 0 0 0 [ 1032.848691][T21667] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1032.849043][T21667] Node 0 DMA32: 549*4kB (UE) 500*8kB (UME) 240*16kB (UE) 278*32kB (UME) 159*64kB (UME) 91*128kB (UME) 57*256kB (M) 29*512kB (UME) 10*1024kB (UM) 12*2048kB (UME) 221*4096kB (UM) = 1010228kB [ 1032.849593][T21667] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1032.849943][T21667] Node 1 Normal: 4*4kB (UM) 7*8kB (UM) 11*16kB (UM) 11*32kB (UM) 11*64kB (UM) 6*128kB (UM) 6*256kB (UM) 5*512kB (UM) 2*1024kB (UM) 0*2048kB 962*4096kB (M) = 3948568kB [ 1032.850445][T21667] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1032.850475][T21667] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1032.850505][T21667] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1032.850535][T21667] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1032.850565][T21667] 68478 total pagecache pages [ 1032.850585][T21667] 2 pages in swap cache [ 1032.850606][T21667] Free swap = 124988kB [ 1032.850627][T21667] Total swap = 124996kB [ 1032.850649][T21667] 2097051 pages RAM [ 1032.850669][T21667] 0 pages HighMem/MovableOnly [ 1032.850689][T21667] 423882 pages reserved [ 1032.850710][T21667] 0 pages cma reserved [ 1033.386052][ T5797] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 1033.539896][ T5797] usb 5-1: device descriptor read/64, error -71 [ 1033.994623][ T5797] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 1034.199365][ T5797] usb 5-1: device descriptor read/64, error -71 [ 1034.248534][T21680] FAULT_INJECTION: forcing a failure. [ 1034.248534][T21680] name failslab, interval 1, probability 0, space 0, times 0 [ 1034.248559][T21680] CPU: 1 UID: 0 PID: 21680 Comm: syz.2.4947 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1034.248577][T21680] Tainted: [L]=SOFTLOCKUP [ 1034.248581][T21680] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1034.248588][T21680] Call Trace: [ 1034.248593][T21680] [ 1034.248598][T21680] dump_stack_lvl+0xe8/0x150 [ 1034.248616][T21680] should_fail_ex+0x467/0x600 [ 1034.248633][T21680] should_failslab+0xa8/0x100 [ 1034.248648][T21680] __kmalloc_noprof+0xdf/0x7a0 [ 1034.248661][T21680] ? hash_netport4_add+0x1e3e/0x28b0 [ 1034.248749][T21680] hash_netport4_add+0x1e3e/0x28b0 [ 1034.248765][T21680] ? hash_netport4_add+0x7b/0x28b0 [ 1034.248793][T21680] hash_netport4_uadt+0xbf0/0xfa0 [ 1034.248817][T21680] ? __pfx_hash_netport4_add+0x10/0x10 [ 1034.248839][T21680] ? __pfx_hash_netport4_uadt+0x10/0x10 [ 1034.248859][T21680] ? __nla_validate_parse+0x2429/0x2d50 [ 1034.248879][T21680] ? kasan_save_free_info+0x40/0x50 [ 1034.248908][T21680] call_ad+0x2ee/0xa30 [ 1034.248946][T21680] ? __pfx_call_ad+0x10/0x10 [ 1034.248955][T21680] ? rcu_is_watching+0x15/0xb0 [ 1034.248971][T21680] ? ip_set_pernet+0x23/0x240 [ 1034.248986][T21680] ? __nla_parse+0x40/0x60 [ 1034.248996][T21680] ip_set_ad+0x82a/0x9d0 [ 1034.249007][T21680] ? __pfx_ip_set_ad+0x10/0x10 [ 1034.249015][T21680] ? unwind_next_frame+0x8f/0x2550 [ 1034.249034][T21680] ? trace_irq_enable+0x3b/0x140 [ 1034.249047][T21680] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1034.249071][T21680] ? mutex_lock_nested+0x152/0x1d0 [ 1034.249083][T21680] ? nfnetlink_rcv_msg+0xa7f/0x12c0 [ 1034.249095][T21680] nfnetlink_rcv_msg+0xcd6/0x12c0 [ 1034.249105][T21680] ? unwind_get_return_address+0x4d/0x90 [ 1034.249118][T21680] ? nfnetlink_rcv_msg+0x22e/0x12c0 [ 1034.249132][T21680] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 1034.249151][T21680] netlink_rcv_skb+0x226/0x4a0 [ 1034.249163][T21680] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 1034.249173][T21680] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1034.249186][T21680] ? bpf_lsm_capable+0x9/0x20 [ 1034.249199][T21680] ? security_capable+0x7e/0x2c0 [ 1034.249213][T21680] nfnetlink_rcv+0x2b9/0x28d0 [ 1034.249224][T21680] ? rcu_is_watching+0x15/0xb0 [ 1034.249238][T21680] ? trace_irq_enable+0x3b/0x140 [ 1034.249249][T21680] ? __dev_queue_xmit+0x291/0x3890 [ 1034.249263][T21680] ? __dev_queue_xmit+0x1f31/0x3890 [ 1034.249276][T21680] ? do_syscall_64+0x174/0x580 [ 1034.249291][T21680] ? __dev_queue_xmit+0x291/0x3890 [ 1034.249316][T21680] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1034.249337][T21680] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1034.249362][T21680] ? ref_tracker_free+0x668/0x820 [ 1034.249388][T21680] ? __pfx_ref_tracker_free+0x10/0x10 [ 1034.249417][T21680] ? __skb_clone+0x449/0x6c0 [ 1034.249431][T21680] ? skb_clone+0x246/0x3a0 [ 1034.249443][T21680] ? __netlink_deliver_tap+0x811/0x860 [ 1034.249454][T21680] ? netlink_deliver_tap+0x2e/0x1b0 [ 1034.249465][T21680] ? rcu_is_watching+0x15/0xb0 [ 1034.249478][T21680] ? netlink_deliver_tap+0x2e/0x1b0 [ 1034.249489][T21680] ? lock_release+0x4b/0x3c0 [ 1034.249502][T21680] ? netlink_deliver_tap+0x2e/0x1b0 [ 1034.249514][T21680] netlink_unicast+0x7f5/0x990 [ 1034.249526][T21680] netlink_sendmsg+0x813/0xb40 [ 1034.249538][T21680] ? lock_release+0x4b/0x3c0 [ 1034.249549][T21680] ? lock_release+0x4b/0x3c0 [ 1034.249564][T21680] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1034.249576][T21680] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1034.249591][T21680] ? __kernel_text_address+0xd/0x30 [ 1034.249602][T21680] ? unwind_get_return_address+0x4d/0x90 [ 1034.249616][T21680] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1034.249627][T21680] sock_sendmsg_nosec+0x13a/0x180 [ 1034.249643][T21680] ____sys_sendmsg+0x565/0x870 [ 1034.249656][T21680] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1034.249668][T21680] ? lock_release+0x4b/0x3c0 [ 1034.249680][T21680] ? import_iovec+0x73/0xa0 [ 1034.249692][T21680] ___sys_sendmsg+0x2a5/0x360 [ 1034.249704][T21680] ? rcu_is_watching+0x15/0xb0 [ 1034.249717][T21680] ? get_pid_task+0x20/0x1f0 [ 1034.249727][T21680] ? __pfx____sys_sendmsg+0x10/0x10 [ 1034.249740][T21680] ? rcu_is_watching+0x15/0xb0 [ 1034.249758][T21680] ? __fget_files+0x2a/0x420 [ 1034.249771][T21680] ? __fget_files+0x3a8/0x420 [ 1034.249784][T21680] __x64_sys_sendmsg+0x1b7/0x290 [ 1034.249796][T21680] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1034.249810][T21680] ? rcu_is_watching+0x15/0xb0 [ 1034.249824][T21680] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1034.249835][T21680] do_syscall_64+0x174/0x580 [ 1034.249844][T21680] ? trace_irq_disable+0x3b/0x140 [ 1034.249855][T21680] ? clear_bhb_loop+0x40/0x90 [ 1034.249866][T21680] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1034.249876][T21680] RIP: 0033:0x7f9168bece59 [ 1034.249887][T21680] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1034.249896][T21680] RSP: 002b:00007f9166e46028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1034.249908][T21680] RAX: ffffffffffffffda RBX: 00007f9168e65fa0 RCX: 00007f9168bece59 [ 1034.249916][T21680] RDX: 0000000000000080 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1034.249923][T21680] RBP: 00007f9166e46090 R08: 0000000000000000 R09: 0000000000000000 [ 1034.249929][T21680] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1034.249935][T21680] R13: 00007f9168e66038 R14: 00007f9168e65fa0 R15: 00007ffc095214f8 [ 1034.249948][T21680] [ 1034.330335][ T5797] usb usb5-port1: attempt power cycle [ 1034.708970][ T5797] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 1034.741498][ T5797] usb 5-1: device descriptor read/8, error -71 [ 1034.977283][T17727] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1034.977576][T17727] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1034.977815][T17727] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1034.978473][T17727] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1034.979039][T17727] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1035.014785][ T5797] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 1035.034871][ T5797] usb 5-1: device descriptor read/8, error -71 [ 1035.110261][ T821] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 1035.155051][ T5797] usb usb5-port1: unable to enumerate USB device [ 1035.206895][ T5709] usb 4-1: USB disconnect, device number 24 [ 1035.381276][ T821] usb 6-1: Using ep0 maxpacket: 16 [ 1035.383480][ T821] usb 6-1: config 8 has an invalid interface number: 206 but max is 0 [ 1035.383509][ T821] usb 6-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1035.383526][ T821] usb 6-1: config 8 has no interface number 0 [ 1035.383560][ T821] usb 6-1: config 8 interface 206 altsetting 1 has an endpoint descriptor with address 0xF7, changing to 0x87 [ 1035.383588][ T821] usb 6-1: config 8 interface 206 altsetting 1 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1035.383612][ T821] usb 6-1: config 8 interface 206 altsetting 1 endpoint 0x87 has invalid wMaxPacketSize 0 [ 1035.383634][ T821] usb 6-1: config 8 interface 206 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1035.383659][ T821] usb 6-1: config 8 interface 206 has no altsetting 0 [ 1035.386276][ T821] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 1035.386305][ T821] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1035.386325][ T821] usb 6-1: Product: syz [ 1035.386339][ T821] usb 6-1: Manufacturer: syz [ 1035.386353][ T821] usb 6-1: SerialNumber: syz [ 1036.612591][T21727] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4960'. [ 1036.627552][T21729] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1036.637435][T21729] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1036.686081][T21731] syzkaller1: entered promiscuous mode [ 1036.686105][T21731] syzkaller1: entered allmulticast mode [ 1036.716837][ T36] kauditd_printk_skb: 129 callbacks suppressed [ 1036.716855][ T36] audit: type=1326 audit(1802512065.493:8812): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21725 comm="syz.4.4959" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c0bf7ce59 code=0x7ffc0000 [ 1036.720319][ T36] audit: type=1326 audit(1802512065.503:8813): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21725 comm="syz.4.4959" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4c0bf7ce59 code=0x7ffc0000 [ 1036.720361][ T36] audit: type=1326 audit(1802512065.503:8814): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21725 comm="syz.4.4959" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c0bf7ce59 code=0x7ffc0000 [ 1036.721309][ T36] audit: type=1326 audit(1802512065.503:8815): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21725 comm="syz.4.4959" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f4c0bf7ce59 code=0x7ffc0000 [ 1036.722420][ T36] audit: type=1326 audit(1802512065.503:8816): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21725 comm="syz.4.4959" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c0bf7ce59 code=0x7ffc0000 [ 1036.727652][ T36] audit: type=1326 audit(1802512065.512:8817): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21725 comm="syz.4.4959" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c0bf7ce59 code=0x7ffc0000 [ 1036.727694][ T36] audit: type=1326 audit(1802512065.512:8818): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21725 comm="syz.4.4959" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7f4c0bf7ce59 code=0x7ffc0000 [ 1036.727726][ T36] audit: type=1326 audit(1802512065.512:8819): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21725 comm="syz.4.4959" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c0bf7ce59 code=0x7ffc0000 [ 1036.728957][ T36] audit: type=1326 audit(1802512065.512:8820): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21725 comm="syz.4.4959" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4c0bf7ce59 code=0x7ffc0000 [ 1036.729788][ T36] audit: type=1326 audit(1802512065.512:8821): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21725 comm="syz.4.4959" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c0bf7ce59 code=0x7ffc0000 [ 1036.955658][T12679] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1036.955692][T12679] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1037.018699][ T5709] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 1037.047579][T21693] bridge0: port 1(bridge_slave_0) entered blocking state [ 1037.047653][T21693] bridge0: port 1(bridge_slave_0) entered disabled state [ 1037.047832][T21693] bridge_slave_0: entered allmulticast mode [ 1037.049856][T21693] bridge_slave_0: entered promiscuous mode [ 1037.081160][T21693] bridge0: port 2(bridge_slave_1) entered blocking state [ 1037.081614][T21693] bridge0: port 2(bridge_slave_1) entered disabled state [ 1037.081834][T21693] bridge_slave_1: entered allmulticast mode [ 1037.098972][T21693] bridge_slave_1: entered promiscuous mode [ 1037.147789][T21693] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1037.181425][ T5709] usb 4-1: Using ep0 maxpacket: 16 [ 1037.181526][T17727] Bluetooth: hci5: command tx timeout [ 1037.186199][ T5709] usb 4-1: config 8 has an invalid interface number: 206 but max is 0 [ 1037.186226][ T5709] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1037.186244][ T5709] usb 4-1: config 8 has no interface number 0 [ 1037.186283][ T5709] usb 4-1: config 8 interface 206 altsetting 1 has an endpoint descriptor with address 0xF7, changing to 0x87 [ 1037.186309][ T5709] usb 4-1: config 8 interface 206 altsetting 1 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1037.186334][ T5709] usb 4-1: config 8 interface 206 altsetting 1 endpoint 0x87 has invalid wMaxPacketSize 0 [ 1037.186356][ T5709] usb 4-1: config 8 interface 206 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1037.186382][ T5709] usb 4-1: config 8 interface 206 has no altsetting 0 [ 1037.189062][ T5709] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 1037.189091][ T5709] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.189110][ T5709] usb 4-1: Product: syz [ 1037.189124][ T5709] usb 4-1: Manufacturer: syz [ 1037.189136][ T5709] usb 4-1: SerialNumber: syz [ 1037.400984][T12679] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1037.401007][T12679] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1037.425229][T21693] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1037.475091][ T5797] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 1037.523596][T21693] team0: Port device team_slave_0 added [ 1037.534346][T21693] team0: Port device team_slave_1 added [ 1037.578518][T21748] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1037.579230][T21748] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1037.636825][ T5797] usb 1-1: Using ep0 maxpacket: 32 [ 1037.639859][ T5797] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1037.639884][ T5797] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1037.642521][ T5797] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1037.642548][ T5797] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.642569][ T5797] usb 1-1: Product: syz [ 1037.642582][ T5797] usb 1-1: Manufacturer: syz [ 1037.642626][ T5797] usb 1-1: SerialNumber: syz [ 1037.649064][ T5797] usb 1-1: config 0 descriptor?? [ 1037.713550][T12679] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1037.713586][T12679] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1037.773425][T21693] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1037.773442][T21693] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1037.773665][T21693] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1037.778464][T21693] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1037.778480][T21693] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1037.778506][T21693] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1037.830028][ T5709] garmin_gps 4-1:8.206: Garmin GPS usb/tty converter detected [ 1037.833405][ T5709] garmin_gps ttyUSB0: failed to submit interrupt urb: -90 [ 1037.833444][ T5709] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -90 [ 1037.844776][ T5709] usb 4-1: USB disconnect, device number 25 [ 1037.847349][ T5709] garmin_gps 4-1:8.206: device disconnected [ 1037.987566][T21693] hsr_slave_0: entered promiscuous mode [ 1037.988324][T21693] hsr_slave_1: entered promiscuous mode [ 1037.988826][T21693] debugfs: 'hsr0' already exists in 'hsr' [ 1037.988844][T21693] Cannot create hsr debugfs directory [ 1038.107156][ T821] garmin_gps 6-1:8.206: Garmin GPS usb/tty converter detected [ 1038.111086][ T821] garmin_gps ttyUSB0: failed to submit interrupt urb: -90 [ 1038.111138][ T821] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -90 [ 1038.123440][T12679] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1038.123473][T12679] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1038.159506][ T821] usb 6-1: USB disconnect, device number 4 [ 1038.160947][ T821] garmin_gps 6-1:8.206: device disconnected [ 1038.422906][T21757] FAULT_INJECTION: forcing a failure. [ 1038.422906][T21757] name failslab, interval 1, probability 0, space 0, times 0 [ 1038.422939][T21757] CPU: 0 UID: 0 PID: 21757 Comm: syz.3.4966 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1038.422965][T21757] Tainted: [L]=SOFTLOCKUP [ 1038.422972][T21757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1038.422983][T21757] Call Trace: [ 1038.422990][T21757] [ 1038.422997][T21757] dump_stack_lvl+0xe8/0x150 [ 1038.423023][T21757] should_fail_ex+0x467/0x600 [ 1038.423052][T21757] should_failslab+0xa8/0x100 [ 1038.423103][T21757] kmem_cache_alloc_noprof+0x87/0x680 [ 1038.423125][T21757] ? rcu_is_watching+0x15/0xb0 [ 1038.423153][T21757] ? security_file_alloc+0x34/0x310 [ 1038.423175][T21757] security_file_alloc+0x34/0x310 [ 1038.423195][T21757] init_file+0x96/0x2d0 [ 1038.423215][T21757] alloc_empty_file+0x74/0x1d0 [ 1038.423237][T21757] path_openat+0x8f/0x3850 [ 1038.423262][T21757] ? stack_depot_save_flags+0x33/0x800 [ 1038.423293][T21757] ? kasan_save_track+0x4f/0x80 [ 1038.423314][T21757] ? kasan_save_track+0x3e/0x80 [ 1038.423333][T21757] ? __kasan_slab_alloc+0x6c/0x80 [ 1038.423353][T21757] ? kmem_cache_alloc_noprof+0x337/0x680 [ 1038.423371][T21757] ? do_getname+0x2e/0x250 [ 1038.423388][T21757] ? do_sys_openat2+0xcc/0x200 [ 1038.423409][T21757] ? __x64_sys_open+0x11e/0x150 [ 1038.423429][T21757] ? do_syscall_64+0x174/0x580 [ 1038.423447][T21757] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1038.423469][T21757] ? do_raw_spin_lock+0x12b/0x2f0 [ 1038.423488][T21757] ? rcu_is_watching+0x15/0xb0 [ 1038.423518][T21757] do_file_open+0x23e/0x4a0 [ 1038.423546][T21757] ? trace_irq_enable+0x3b/0x140 [ 1038.423570][T21757] ? __pfx_do_file_open+0x10/0x10 [ 1038.423593][T21757] ? rt_mutex_slowunlock+0x4ee/0xa20 [ 1038.423628][T21757] ? alloc_fd+0x654/0x6d0 [ 1038.423652][T21757] do_sys_openat2+0x115/0x200 [ 1038.423674][T21757] ? __pfx_do_sys_openat2+0x10/0x10 [ 1038.423696][T21757] ? ksys_write+0x248/0x270 [ 1038.423723][T21757] ? __pfx_ksys_write+0x10/0x10 [ 1038.423749][T21757] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1038.423770][T21757] __x64_sys_open+0x11e/0x150 [ 1038.423793][T21757] do_syscall_64+0x174/0x580 [ 1038.423813][T21757] ? clear_bhb_loop+0x40/0x90 [ 1038.423834][T21757] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1038.423853][T21757] RIP: 0033:0x7ff204b1ce59 [ 1038.423871][T21757] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1038.423887][T21757] RSP: 002b:00007ff202d6e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 1038.423909][T21757] RAX: ffffffffffffffda RBX: 00007ff204d95fa0 RCX: 00007ff204b1ce59 [ 1038.423924][T21757] RDX: 000000000000006c RSI: 0000000000000000 RDI: 0000200000000040 [ 1038.423936][T21757] RBP: 00007ff202d6e090 R08: 0000000000000000 R09: 0000000000000000 [ 1038.423949][T21757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1038.423961][T21757] R13: 00007ff204d96038 R14: 00007ff204d95fa0 R15: 00007ffd49e9cc28 [ 1038.423983][T21757] [ 1038.465197][T21759] netlink: 'syz.3.4967': attribute type 1 has an invalid length. [ 1038.522185][ T821] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 1038.749032][ T821] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 1038.753046][ T821] usb 6-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 1038.753075][ T821] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1038.753093][ T821] usb 6-1: Product: syz [ 1038.753107][ T821] usb 6-1: Manufacturer: syz [ 1038.753122][ T821] usb 6-1: SerialNumber: syz [ 1038.802614][ T821] usb 6-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 1038.817262][T12679] bridge_slave_1: left allmulticast mode [ 1038.817290][T12679] bridge_slave_1: left promiscuous mode [ 1038.817494][T12679] bridge0: port 2(bridge_slave_1) entered disabled state [ 1038.992779][T12679] bridge_slave_0: left allmulticast mode [ 1038.992803][T12679] bridge_slave_0: left promiscuous mode [ 1038.992936][T12679] bridge0: port 1(bridge_slave_0) entered disabled state [ 1039.436917][T17727] Bluetooth: hci5: command tx timeout [ 1039.466724][T21780] fuse: Invalid rootmode [ 1039.719388][T12679] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1039.785287][T12679] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1039.807928][T12679] bond0 (unregistering): Released all slaves [ 1039.915092][T21759] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1039.915870][T21760] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1039.921880][ T5258] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1040.050244][T21790] FAULT_INJECTION: forcing a failure. [ 1040.050244][T21790] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1040.050277][T21790] CPU: 0 UID: 0 PID: 21790 Comm: syz.3.4969 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1040.050305][T21790] Tainted: [L]=SOFTLOCKUP [ 1040.050313][T21790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1040.050325][T21790] Call Trace: [ 1040.050333][T21790] [ 1040.050341][T21790] dump_stack_lvl+0xe8/0x150 [ 1040.050373][T21790] should_fail_ex+0x467/0x600 [ 1040.050404][T21790] _copy_to_user+0x31/0xb0 [ 1040.050425][T21790] simple_read_from_buffer+0xe1/0x170 [ 1040.050452][T21790] proc_fail_nth_read+0x1be/0x230 [ 1040.050478][T21790] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1040.050506][T21790] ? rw_verify_area+0x250/0x4d0 [ 1040.050533][T21790] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1040.050555][T21790] vfs_read+0x219/0xa90 [ 1040.050584][T21790] ? __pfx_vfs_read+0x10/0x10 [ 1040.050609][T21790] ? rcu_is_watching+0x15/0xb0 [ 1040.050636][T21790] ? trace_irq_enable+0x3b/0x140 [ 1040.050657][T21790] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1040.050687][T21790] ? mutex_lock_nested+0x152/0x1d0 [ 1040.050708][T21790] ? fdget_pos+0x252/0x320 [ 1040.050734][T21790] ksys_read+0x156/0x270 [ 1040.050768][T21790] ? __pfx_ksys_read+0x10/0x10 [ 1040.050794][T21790] ? rcu_is_watching+0x15/0xb0 [ 1040.050827][T21790] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1040.050847][T21790] do_syscall_64+0x174/0x580 [ 1040.050865][T21790] ? trace_irq_disable+0x3b/0x140 [ 1040.050886][T21790] ? clear_bhb_loop+0x40/0x90 [ 1040.050907][T21790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1040.050938][T21790] RIP: 0033:0x7ff204add68e [ 1040.050956][T21790] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1040.050973][T21790] RSP: 002b:00007ff202d6dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1040.051002][T21790] RAX: ffffffffffffffda RBX: 00007ff202d6e6c0 RCX: 00007ff204add68e [ 1040.051017][T21790] RDX: 000000000000000f RSI: 00007ff202d6e0a0 RDI: 0000000000000004 [ 1040.051030][T21790] RBP: 00007ff202d6e090 R08: 0000000000000000 R09: 0000000000000000 [ 1040.051043][T21790] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1040.051056][T21790] R13: 00007ff204d96038 R14: 00007ff204d95fa0 R15: 00007ffd49e9cc28 [ 1040.051078][T21790] [ 1040.132975][T21754] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1040.133283][T21754] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1040.154012][T21792] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4970'. [ 1040.293743][ T821] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1040.294035][ T821] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 1040.294070][ T821] usb 6-1: media controller created [ 1040.358773][ T821] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1040.707470][ T821] usb 6-1: USB disconnect, device number 5 [ 1040.827849][T21812] fuse: Bad value for 'user_id' [ 1040.827869][T21812] fuse: Bad value for 'user_id' [ 1041.161088][ T821] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 1041.171814][ T5797] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 1041.273875][ T5709] usb 1-1: USB disconnect, device number 50 [ 1041.326590][ T821] usb 6-1: config index 0 descriptor too short (expected 1572, got 36) [ 1041.326620][ T821] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1041.328526][ T821] usb 6-1: New USB device found, idVendor=05ac, idProduct=0238, bcdDevice= 0.40 [ 1041.328553][ T821] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1041.328573][ T821] usb 6-1: Product: syz [ 1041.328584][ T821] usb 6-1: Manufacturer: syz [ 1041.328598][ T821] usb 6-1: SerialNumber: syz [ 1041.347197][ T5797] usb 5-1: Using ep0 maxpacket: 16 [ 1041.378483][ T5797] usb 5-1: config 8 has an invalid interface number: 206 but max is 0 [ 1041.378511][ T5797] usb 5-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1041.378530][ T5797] usb 5-1: config 8 has no interface number 0 [ 1041.378559][ T5797] usb 5-1: config 8 interface 206 altsetting 1 has an endpoint descriptor with address 0xF7, changing to 0x87 [ 1041.378583][ T5797] usb 5-1: config 8 interface 206 altsetting 1 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1041.378607][ T5797] usb 5-1: config 8 interface 206 altsetting 1 endpoint 0x87 has invalid wMaxPacketSize 0 [ 1041.378638][ T5797] usb 5-1: config 8 interface 206 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1041.378663][ T5797] usb 5-1: config 8 interface 206 has no altsetting 0 [ 1041.380652][ T5797] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 1041.380679][ T5797] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1041.380698][ T5797] usb 5-1: Product: syz [ 1041.380712][ T5797] usb 5-1: Manufacturer: syz [ 1041.380726][ T5797] usb 5-1: SerialNumber: syz [ 1041.504214][ T821] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input72 [ 1041.554554][T21812] fuse: Unknown parameter '5 ׂm [ 1041.554554][T21812] ' [ 1041.692353][T17727] Bluetooth: hci5: command tx timeout [ 1041.774495][ T4948] bcm5974 6-1:1.0: could not read from device [ 1041.795731][T21841] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1041.796039][T21841] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1041.817874][ T821] bcm5974 6-1:1.0: could not read from device [ 1041.846190][ T4948] bcm5974 6-1:1.0: could not read from device [ 1041.916860][T21846] use of bytesused == 0 is deprecated and will be removed in the future, [ 1041.916877][T21846] use the actual size instead. [ 1041.936029][ T821] input: failed to attach handler mousedev to device input72, error: -5 [ 1041.940543][ T4948] bcm5974 6-1:1.0: could not read from device [ 1041.957131][ T821] usb 6-1: USB disconnect, device number 6 [ 1041.967898][T21850] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4980'. [ 1042.185610][T21856] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4981'. [ 1042.329090][T21861] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4982'. [ 1042.932246][ T5797] garmin_gps 5-1:8.206: Garmin GPS usb/tty converter detected [ 1042.938576][ T5797] garmin_gps ttyUSB0: failed to submit interrupt urb: -90 [ 1042.938617][ T5797] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -90 [ 1042.953686][ T5797] usb 5-1: USB disconnect, device number 46 [ 1042.957372][ T5797] garmin_gps 5-1:8.206: device disconnected [ 1043.080607][T12679] hsr_slave_0: left promiscuous mode [ 1043.123703][T12679] hsr_slave_1: left promiscuous mode [ 1043.124403][T12679] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1043.124423][T12679] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1043.288157][T12679] veth1_macvtap: left promiscuous mode [ 1043.288194][T12679] veth0_macvtap: left promiscuous mode [ 1043.288266][T12679] veth1_vlan: left promiscuous mode [ 1043.288313][T12679] veth0_vlan: left promiscuous mode [ 1043.862736][ T821] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 1043.947742][T17727] Bluetooth: hci5: command tx timeout [ 1044.036376][ T821] usb 5-1: config 0 has no interfaces? [ 1044.037298][ T821] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 8.40 [ 1044.037325][ T821] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1044.037345][ T821] usb 5-1: SerialNumber: syz [ 1044.039149][ T821] usb 5-1: config 0 descriptor?? [ 1044.349477][T12679] team0 (unregistering): Port device team_slave_1 removed [ 1044.396491][T12679] team0 (unregistering): Port device team_slave_0 removed [ 1045.017202][T21693] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1045.056412][T21693] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1045.057061][T21693] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1045.109852][T21693] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1045.110534][T21693] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1045.319627][ T821] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 1045.402675][T21693] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1045.473349][T21693] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1045.489908][T21693] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1045.520051][ T821] usb 4-1: Using ep0 maxpacket: 8 [ 1045.521575][ T821] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1045.521607][ T821] usb 4-1: New USB device found, idVendor=1b96, idProduct=0005, bcdDevice= 0.00 [ 1045.521629][ T821] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1045.526092][ T821] usb 4-1: config 0 descriptor?? [ 1045.611775][T21693] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1045.640890][T21693] 8021q: adding VLAN 0 to HW filter on device team0 [ 1045.647590][T12688] bridge0: port 1(bridge_slave_0) entered blocking state [ 1045.647772][T12688] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1045.659789][T21905] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4990'. [ 1045.684878][T12688] bridge0: port 2(bridge_slave_1) entered blocking state [ 1045.684979][T12688] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1045.970624][T21893] cgroup: Invalid name [ 1045.980820][ T821] ntrig 0003:1B96:0005.002E: unknown main item tag 0x2 [ 1045.980854][ T821] ntrig 0003:1B96:0005.002E: unknown main item tag 0x6 [ 1045.980879][ T821] ntrig 0003:1B96:0005.002E: reserved main item tag 0xd [ 1045.980904][ T821] ntrig 0003:1B96:0005.002E: unknown global tag 0xe [ 1045.980919][ T821] ntrig 0003:1B96:0005.002E: item 0 4 1 14 parsing failed [ 1045.982518][ T821] ntrig 0003:1B96:0005.002E: parse failed [ 1045.982590][ T821] ntrig 0003:1B96:0005.002E: probe with driver ntrig failed with error -22 [ 1046.036411][T17925] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 1046.099027][T12679] IPVS: stop unused estimator thread 0... [ 1046.161931][T21693] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1046.195256][T17925] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1046.195304][T17925] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1046.195336][T17925] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1046.195358][T17925] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1046.203744][T21908] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1046.237437][T21693] veth0_vlan: entered promiscuous mode [ 1046.260676][T21693] veth1_vlan: entered promiscuous mode [ 1046.352645][T17925] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1046.571103][T21908] IPVS: length: 232 != 8 [ 1046.581126][T21693] veth0_macvtap: entered promiscuous mode [ 1046.589070][T21693] veth1_macvtap: entered promiscuous mode [ 1046.646906][T17925] usb 6-1: USB disconnect, device number 7 [ 1046.656621][T21693] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1046.668730][T18671] udevd[18671]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1046.697433][T21693] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1046.716467][T21928] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1046.716629][T21928] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1046.728969][T12692] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1046.752978][T12684] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1046.758323][T12684] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1046.758496][T12684] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1046.909739][T16887] usb 5-1: USB disconnect, device number 47 [ 1047.003736][T12687] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1047.003758][T12687] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1047.056154][T12687] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1047.056169][T12687] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1047.775952][T18755] Bluetooth: hci0: command 0x0406 tx timeout [ 1047.849331][T21957] FAULT_INJECTION: forcing a failure. [ 1047.849331][T21957] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1047.849355][T21957] CPU: 1 UID: 0 PID: 21957 Comm: syz.2.4997 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1047.849371][T21957] Tainted: [L]=SOFTLOCKUP [ 1047.849375][T21957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1047.849383][T21957] Call Trace: [ 1047.849387][T21957] [ 1047.849392][T21957] dump_stack_lvl+0xe8/0x150 [ 1047.849409][T21957] should_fail_ex+0x467/0x600 [ 1047.849426][T21957] _copy_from_user+0x2d/0xb0 [ 1047.849439][T21957] __se_sys_mount+0x18b/0x420 [ 1047.849453][T21957] ? __pfx___se_sys_mount+0x10/0x10 [ 1047.849466][T21957] ? rcu_is_watching+0x15/0xb0 [ 1047.849481][T21957] ? __x64_sys_mount+0x20/0xc0 [ 1047.849492][T21957] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1047.849503][T21957] do_syscall_64+0x174/0x580 [ 1047.849514][T21957] ? trace_irq_disable+0x3b/0x140 [ 1047.849526][T21957] ? clear_bhb_loop+0x40/0x90 [ 1047.849538][T21957] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1047.849548][T21957] RIP: 0033:0x7f4d2aeace59 [ 1047.849558][T21957] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1047.849567][T21957] RSP: 002b:00007f4d29106028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1047.849579][T21957] RAX: ffffffffffffffda RBX: 00007f4d2b125fa0 RCX: 00007f4d2aeace59 [ 1047.849587][T21957] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 0000000000000000 [ 1047.849594][T21957] RBP: 00007f4d29106090 R08: 0000200000000280 R09: 0000000000000000 [ 1047.849601][T21957] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 1047.849608][T21957] R13: 00007f4d2b126038 R14: 00007f4d2b125fa0 R15: 00007fff5ddcdb68 [ 1047.849619][T21957] [ 1047.850066][T21957] overlay: ./file0 is not a directory [ 1048.053629][T21959] CUSE: unknown device info "" [ 1048.053647][T21959] CUSE: unknown device info "" [ 1048.053655][T21959] CUSE: unknown device info "" [ 1048.053662][T21959] CUSE: unknown device info "" [ 1048.053670][T21959] CUSE: unknown device info "" [ 1048.053675][T21959] CUSE: unknown device info "" [ 1048.053679][T21959] CUSE: unknown device info "" [ 1048.053684][T21959] CUSE: unknown device info "" [ 1048.053688][T21959] CUSE: zero length info key specified [ 1048.143752][T21966] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5000'. [ 1048.362425][ T5709] usb 4-1: USB disconnect, device number 26 [ 1048.697245][ T9] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 1048.838276][ T9] usb 5-1: device descriptor read/64, error -71 [ 1048.965747][T21987] FAULT_INJECTION: forcing a failure. [ 1048.965747][T21987] name failslab, interval 1, probability 0, space 0, times 0 [ 1048.965781][T21987] CPU: 1 UID: 0 PID: 21987 Comm: syz.0.5008 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1048.965808][T21987] Tainted: [L]=SOFTLOCKUP [ 1048.965816][T21987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1048.965829][T21987] Call Trace: [ 1048.965837][T21987] [ 1048.965845][T21987] dump_stack_lvl+0xe8/0x150 [ 1048.965871][T21987] should_fail_ex+0x467/0x600 [ 1048.965900][T21987] should_failslab+0xa8/0x100 [ 1048.965928][T21987] __kmalloc_noprof+0xdf/0x7a0 [ 1048.965950][T21987] ? kfree+0x4d/0x6c0 [ 1048.965978][T21987] ? get_pid_task+0x20/0x1f0 [ 1048.965996][T21987] ? tomoyo_realpath_from_path+0xef/0x640 [ 1048.966021][T21987] tomoyo_realpath_from_path+0xef/0x640 [ 1048.966043][T21987] ? lock_release+0x4b/0x3c0 [ 1048.966065][T21987] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1048.966082][T21987] tomoyo_path_number_perm+0x246/0x5f0 [ 1048.966101][T21987] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1048.966123][T21987] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1048.966142][T21987] ? preempt_count_add+0x91/0x190 [ 1048.966168][T21987] ? sb_end_write+0xe5/0x190 [ 1048.966187][T21987] ? vfs_write+0x9e0/0xbb0 [ 1048.966219][T21987] ? hook_file_ioctl+0x1f3/0x600 [ 1048.966254][T21987] ? ksys_write+0x202/0x270 [ 1048.966280][T21987] security_file_ioctl+0xc3/0x2a0 [ 1048.966301][T21987] __se_sys_ioctl+0x47/0x170 [ 1048.966328][T21987] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1048.966348][T21987] do_syscall_64+0x174/0x580 [ 1048.966368][T21987] ? trace_irq_disable+0x3b/0x140 [ 1048.966389][T21987] ? clear_bhb_loop+0x40/0x90 [ 1048.966409][T21987] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1048.966428][T21987] RIP: 0033:0x7fe4d81bce59 [ 1048.966445][T21987] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1048.966462][T21987] RSP: 002b:00007fe4d640e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1048.966484][T21987] RAX: ffffffffffffffda RBX: 00007fe4d8435fa0 RCX: 00007fe4d81bce59 [ 1048.966500][T21987] RDX: 0000200000000000 RSI: 0000000000004c02 RDI: 0000000000000003 [ 1048.966513][T21987] RBP: 00007fe4d640e090 R08: 0000000000000000 R09: 0000000000000000 [ 1048.966526][T21987] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1048.966538][T21987] R13: 00007fe4d8436038 R14: 00007fe4d8435fa0 R15: 00007ffd609fe2b8 [ 1048.966560][T21987] [ 1048.966568][T21987] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1048.969968][T17925] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1049.109365][ T9] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 1049.170972][T17925] usb 6-1: config 0 has no interfaces? [ 1049.174505][T17925] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 8.40 [ 1049.174534][T17925] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1049.174565][T17925] usb 6-1: SerialNumber: syz [ 1049.250277][ T9] usb 5-1: device descriptor read/64, error -71 [ 1049.272401][ T5708] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 1049.287025][T17925] usb 6-1: config 0 descriptor?? [ 1049.369722][ T9] usb usb5-port1: attempt power cycle [ 1049.435003][ T5708] usb 4-1: Using ep0 maxpacket: 32 [ 1049.436653][ T5708] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1049.436668][ T5708] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1049.440494][ T5708] usb 4-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 1049.440522][ T5708] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1049.440541][ T5708] usb 4-1: Product: syz [ 1049.440556][ T5708] usb 4-1: Manufacturer: syz [ 1049.440569][ T5708] usb 4-1: SerialNumber: syz [ 1049.465434][ T5708] usb 4-1: interface 1 not found [ 1050.205712][ T9] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 1050.205806][ T5709] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 1050.226909][ T9] usb 5-1: device descriptor read/8, error -71 [ 1050.364171][T21998] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5011'. [ 1050.367228][ T5709] usb 1-1: Using ep0 maxpacket: 32 [ 1050.370656][ T5709] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1050.373218][ T5709] usb 1-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 1050.373244][ T5709] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1050.373263][ T5709] usb 1-1: Product: syz [ 1050.373276][ T5709] usb 1-1: Manufacturer: syz [ 1050.373290][ T5709] usb 1-1: SerialNumber: syz [ 1050.376492][ T5709] usb 1-1: config 0 descriptor?? [ 1050.389552][ T5709] usb 1-1: No union descriptors [ 1050.390128][ T5709] usb 1-1: unsupported MDLM descriptors [ 1050.486504][ T9] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 1050.508536][ T9] usb 5-1: device descriptor read/8, error -71 [ 1050.708366][ T9] usb usb5-port1: unable to enumerate USB device [ 1050.869511][ T36] kauditd_printk_skb: 19 callbacks suppressed [ 1050.869523][ T36] audit: type=1326 audit(1802512078.552:8841): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21992 comm="syz.0.5010" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4d81bce59 code=0x7ffc0000 [ 1050.869802][ T36] audit: type=1326 audit(1802512078.552:8842): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21992 comm="syz.0.5010" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4d81bce59 code=0x7ffc0000 [ 1050.869829][ T36] audit: type=1326 audit(1802512078.552:8843): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21992 comm="syz.0.5010" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4d81bce59 code=0x7ffc0000 [ 1050.869944][ T36] audit: type=1326 audit(1802512078.552:8844): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21992 comm="syz.0.5010" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=125 compat=0 ip=0x7fe4d81bce59 code=0x7ffc0000 [ 1050.870108][ T36] audit: type=1326 audit(1802512078.552:8845): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21992 comm="syz.0.5010" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4d81bce59 code=0x7ffc0000 [ 1050.870127][ T36] audit: type=1326 audit(1802512078.552:8846): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21992 comm="syz.0.5010" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4d81bce59 code=0x7ffc0000 [ 1050.870258][ T36] audit: type=1326 audit(1802512078.552:8847): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21992 comm="syz.0.5010" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4d81bce59 code=0x7ffc0000 [ 1050.870417][ T36] audit: type=1326 audit(1802512078.552:8848): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21992 comm="syz.0.5010" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=311 compat=0 ip=0x7fe4d81bce59 code=0x7ffc0000 [ 1050.870437][ T36] audit: type=1326 audit(1802512078.552:8849): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21992 comm="syz.0.5010" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4d81bce59 code=0x7ffc0000 [ 1050.870558][ T36] audit: type=1326 audit(1802512078.552:8850): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=21992 comm="syz.0.5010" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4d81bce59 code=0x7ffc0000 [ 1050.872022][T17925] usb 1-1: USB disconnect, device number 51 [ 1051.481490][T22006] ubi0: attaching mtd0 [ 1051.491513][T22006] ubi0: scanning is finished [ 1051.491547][T22006] ubi0: empty MTD device detected [ 1051.963255][ T821] usb 6-1: USB disconnect, device number 8 [ 1052.197844][ T5708] usb 4-1: USB disconnect, device number 27 [ 1052.249305][T22006] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 1052.551783][T22035] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5022'. [ 1052.630313][T22020] binder: BINDER_SET_CONTEXT_MGR already set [ 1052.630329][T22020] binder: 22013:22020 ioctl 4018620d 200000004a80 returned -16 [ 1052.743028][ T5708] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 1052.759877][T22028] loop5: detected capacity change from 0 to 7 [ 1052.760607][T22028] Dev loop5: unable to read RDB block 7 [ 1052.760646][T22028] loop5: unable to read partition table [ 1052.760763][T22028] loop5: partition table beyond EOD, truncated [ 1052.760779][T22028] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 1052.904709][ T5708] usb 4-1: Using ep0 maxpacket: 32 [ 1052.906164][ T5708] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1052.906196][ T5708] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1052.906228][ T5708] usb 4-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00 [ 1052.906251][ T5708] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1052.910818][ T5708] usb 4-1: config 0 descriptor?? [ 1052.964271][ T821] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 1053.133696][ T821] usb 6-1: config 0 has no interfaces? [ 1053.134641][ T821] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 8.40 [ 1053.134667][ T821] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1053.134687][ T821] usb 6-1: SerialNumber: syz [ 1053.138713][ T821] usb 6-1: config 0 descriptor?? [ 1053.350279][ T5708] usbhid 4-1:0.0: can't add hid device: -71 [ 1053.351081][ T5708] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1053.360931][ T5708] usb 4-1: USB disconnect, device number 28 [ 1054.057190][T22058] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5030'. [ 1054.937403][T22070] Can't find a SQUASHFS superblock on nullb0 [ 1056.092701][T17058] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 1056.128706][T16887] usb 6-1: USB disconnect, device number 9 [ 1056.181463][T22080] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5035'. [ 1056.257322][T17058] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 1056.257351][T17058] usb 5-1: config 220 has an invalid descriptor of length 255, skipping remainder of the config [ 1056.257370][T17058] usb 5-1: config 220 has no interface number 2 [ 1056.257419][T17058] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1056.257444][T17058] usb 5-1: config 220 interface 0 has no altsetting 0 [ 1056.257463][T17058] usb 5-1: config 220 interface 76 has no altsetting 0 [ 1056.257481][T17058] usb 5-1: config 220 interface 1 has no altsetting 0 [ 1056.260070][T17058] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1056.260099][T17058] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1056.260116][T17058] usb 5-1: Product: syz [ 1056.260129][T17058] usb 5-1: Manufacturer: syz [ 1056.260144][T17058] usb 5-1: SerialNumber: syz [ 1056.494867][T17058] usb 5-1: selecting invalid altsetting 0 [ 1056.495899][T17058] uvcvideo 5-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1056.495930][T17058] uvcvideo 5-1:220.0: No valid video chain found. [ 1056.504323][T17058] usb 5-1: selecting invalid altsetting 0 [ 1056.504353][T17058] usbtest 5-1:220.1: probe with driver usbtest failed with error -22 [ 1056.537717][T16887] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 1057.162753][T17058] usb 5-1: USB disconnect, device number 52 [ 1057.242018][T16887] usb 6-1: Using ep0 maxpacket: 8 [ 1057.244615][T16887] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1057.244651][T16887] usb 6-1: New USB device found, idVendor=046d, idProduct=c225, bcdDevice= 0.00 [ 1057.244674][T16887] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1057.250263][T16887] usb 6-1: config 0 descriptor?? [ 1057.470985][T22099] netlink: 232 bytes leftover after parsing attributes in process `syz.5.5036'. [ 1057.471866][T16887] hid (null): usage index exceeded [ 1057.474832][T16887] lg-g15 0003:046D:C225.002F: unknown main item tag 0x3 [ 1057.474866][T16887] lg-g15 0003:046D:C225.002F: collection stack underflow [ 1057.474891][T16887] lg-g15 0003:046D:C225.002F: item 0 2 0 12 parsing failed [ 1057.475388][T16887] lg-g15 0003:046D:C225.002F: probe with driver lg-g15 failed with error -22 [ 1058.774356][T22108] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5043'. [ 1059.889488][ T5709] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 1060.060397][ T5709] usb 5-1: config 0 has no interfaces? [ 1060.147916][ T5709] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 8.40 [ 1060.148087][ T5709] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1060.148229][ T5709] usb 5-1: SerialNumber: syz [ 1060.172766][ T5730] usb 6-1: USB disconnect, device number 10 [ 1060.541992][ T5709] usb 5-1: config 0 descriptor?? [ 1060.924915][T22121] FAULT_INJECTION: forcing a failure. [ 1060.924915][T22121] name failslab, interval 1, probability 0, space 0, times 0 [ 1060.924951][T22121] CPU: 0 UID: 0 PID: 22121 Comm: syz.5.5047 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1060.924979][T22121] Tainted: [L]=SOFTLOCKUP [ 1060.924986][T22121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1060.925000][T22121] Call Trace: [ 1060.925008][T22121] [ 1060.925017][T22121] dump_stack_lvl+0xe8/0x150 [ 1060.925044][T22121] should_fail_ex+0x467/0x600 [ 1060.925074][T22121] should_failslab+0xa8/0x100 [ 1060.925101][T22121] kmem_cache_alloc_node_noprof+0x8f/0x710 [ 1060.925125][T22121] ? __alloc_skb+0x1d7/0x7a0 [ 1060.925148][T22121] __alloc_skb+0x1d7/0x7a0 [ 1060.925168][T22121] netlink_sendmsg+0x5d4/0xb40 [ 1060.925191][T22121] ? lock_release+0x4b/0x3c0 [ 1060.925214][T22121] ? lock_release+0x4b/0x3c0 [ 1060.925237][T22121] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1060.925261][T22121] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1060.925288][T22121] ? __kernel_text_address+0xd/0x30 [ 1060.925311][T22121] ? unwind_get_return_address+0x4d/0x90 [ 1060.925338][T22121] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1060.925360][T22121] sock_sendmsg_nosec+0x13a/0x180 [ 1060.925389][T22121] ____sys_sendmsg+0x565/0x870 [ 1060.925415][T22121] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1060.925441][T22121] ? import_iovec+0x73/0xa0 [ 1060.925464][T22121] ___sys_sendmsg+0x2a5/0x360 [ 1060.925485][T22121] ? rcu_is_watching+0x15/0xb0 [ 1060.925511][T22121] ? get_pid_task+0x20/0x1f0 [ 1060.925531][T22121] ? __pfx____sys_sendmsg+0x10/0x10 [ 1060.925556][T22121] ? rcu_is_watching+0x15/0xb0 [ 1060.925593][T22121] ? __fget_files+0x2a/0x420 [ 1060.925615][T22121] ? __fget_files+0x3a8/0x420 [ 1060.925641][T22121] __x64_sys_sendmsg+0x1b7/0x290 [ 1060.925665][T22121] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1060.925693][T22121] ? rcu_is_watching+0x15/0xb0 [ 1060.925769][T22121] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1060.925791][T22121] do_syscall_64+0x174/0x580 [ 1060.925811][T22121] ? clear_bhb_loop+0x40/0x90 [ 1060.925833][T22121] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1060.925852][T22121] RIP: 0033:0x7fae07fcce59 [ 1060.925870][T22121] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1060.925887][T22121] RSP: 002b:00007fae0621e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1060.925908][T22121] RAX: ffffffffffffffda RBX: 00007fae08245fa0 RCX: 00007fae07fcce59 [ 1060.925924][T22121] RDX: 0000000020000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1060.925937][T22121] RBP: 00007fae0621e090 R08: 0000000000000000 R09: 0000000000000000 [ 1060.925950][T22121] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1060.925962][T22121] R13: 00007fae08246038 R14: 00007fae08245fa0 R15: 00007fff2e32beb8 [ 1060.925987][T22121] [ 1064.285630][ T821] usb 5-1: USB disconnect, device number 53 [ 1064.293011][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 1064.293340][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 1064.680613][T22142] FAULT_INJECTION: forcing a failure. [ 1064.680613][T22142] name failslab, interval 1, probability 0, space 0, times 0 [ 1064.680648][T22142] CPU: 1 UID: 0 PID: 22142 Comm: syz.4.5051 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1064.680676][T22142] Tainted: [L]=SOFTLOCKUP [ 1064.680684][T22142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1064.680696][T22142] Call Trace: [ 1064.680704][T22142] [ 1064.680712][T22142] dump_stack_lvl+0xe8/0x150 [ 1064.680739][T22142] should_fail_ex+0x467/0x600 [ 1064.680773][T22142] should_failslab+0xa8/0x100 [ 1064.680806][T22142] __kmalloc_cache_noprof+0x84/0x690 [ 1064.680831][T22142] ? snd_pcm_oss_change_params_locked+0x1e4/0x3c80 [ 1064.680865][T22142] snd_pcm_oss_change_params_locked+0x1e4/0x3c80 [ 1064.680895][T22142] ? lock_release+0x4b/0x3c0 [ 1064.680918][T22142] ? kfree+0x1c5/0x6c0 [ 1064.680939][T22142] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1064.680962][T22142] ? do_vfs_ioctl+0x1184/0x1550 [ 1064.680993][T22142] ? do_raw_spin_lock+0x12b/0x2f0 [ 1064.681013][T22142] ? rcu_is_watching+0x15/0xb0 [ 1064.681043][T22142] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 1064.681073][T22142] ? do_raw_spin_lock+0x12b/0x2f0 [ 1064.681094][T22142] ? rcu_is_watching+0x15/0xb0 [ 1064.681123][T22142] ? trace_irq_enable+0x3b/0x140 [ 1064.681147][T22142] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1064.681179][T22142] ? mutex_lock_interruptible_nested+0x152/0x1d0 [ 1064.681204][T22142] ? snd_pcm_oss_get_active_substream+0x136/0x280 [ 1064.681225][T22142] snd_pcm_oss_get_active_substream+0x1e2/0x280 [ 1064.681247][T22142] snd_pcm_oss_set_format+0x10d/0x510 [ 1064.681278][T22142] snd_pcm_oss_ioctl+0xbec/0xe00 [ 1064.681305][T22142] ? __pfx_snd_pcm_oss_ioctl+0x10/0x10 [ 1064.681334][T22142] __se_sys_ioctl+0xff/0x170 [ 1064.681361][T22142] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1064.681382][T22142] do_syscall_64+0x174/0x580 [ 1064.681401][T22142] ? trace_irq_disable+0x3b/0x140 [ 1064.681422][T22142] ? clear_bhb_loop+0x40/0x90 [ 1064.681443][T22142] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1064.681460][T22142] RIP: 0033:0x7f4c0bf7ce59 [ 1064.681477][T22142] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1064.681492][T22142] RSP: 002b:00007f4c0a1ad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1064.681513][T22142] RAX: ffffffffffffffda RBX: 00007f4c0c1f6090 RCX: 00007f4c0bf7ce59 [ 1064.681526][T22142] RDX: 0000200000000300 RSI: 00000000c0045005 RDI: 0000000000000003 [ 1064.681539][T22142] RBP: 00007f4c0a1ad090 R08: 0000000000000000 R09: 0000000000000000 [ 1064.681551][T22142] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1064.681562][T22142] R13: 00007f4c0c1f6128 R14: 00007f4c0c1f6090 R15: 00007ffc9870f588 [ 1064.681583][T22142] [ 1064.954184][T22150] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5052'. [ 1066.437097][T18755] Bluetooth: hci2: command 0x0406 tx timeout [ 1066.759796][T22163] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5058'. [ 1067.183357][T17925] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 1067.355818][T17925] usb 3-1: config 0 has no interfaces? [ 1067.356946][T17925] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 8.40 [ 1067.356972][T17925] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1067.356993][T17925] usb 3-1: SerialNumber: syz [ 1067.361947][T17925] usb 3-1: config 0 descriptor?? [ 1067.536275][T16887] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 1067.901306][T16887] usb 5-1: Using ep0 maxpacket: 32 [ 1069.379479][T16887] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 1069.379508][T16887] usb 5-1: config 0 has no interface number 0 [ 1069.394603][T16887] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1069.394635][T16887] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1069.394656][T16887] usb 5-1: Product: syz [ 1069.394670][T16887] usb 5-1: Manufacturer: syz [ 1069.394685][T16887] usb 5-1: SerialNumber: syz [ 1069.436664][T16887] usb 5-1: config 0 descriptor?? [ 1069.501171][T16887] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1069.630274][T22197] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5068'. [ 1069.630332][T22197] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5068'. [ 1069.635727][T22197] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1069.667255][T16887] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1069.673000][T16887] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1069.904137][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 6 [ 1070.254208][T22144] Set syz1 is full, maxelem 65536 reached [ 1070.332831][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1070.333619][T17925] usb 5-1: USB disconnect, device number 54 [ 1070.343221][T17925] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1070.349868][T17925] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1070.351626][T17925] quatech2 5-1:0.51: device disconnected [ 1070.519499][ T5730] usb 3-1: USB disconnect, device number 40 [ 1070.544497][T22210] Invalid logical block size (238) [ 1070.552989][ T36] kauditd_printk_skb: 48 callbacks suppressed [ 1070.553007][ T36] audit: type=1326 audit(1802512097.200:8899): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=22195 comm="syz.3.5068" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff204b1ce59 code=0x7fc00000 [ 1070.553086][ T36] audit: type=1326 audit(1802512097.200:8900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=22195 comm="syz.3.5068" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff204b1ce59 code=0x7fc00000 [ 1070.553163][ T36] audit: type=1326 audit(1802512097.200:8901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=22195 comm="syz.3.5068" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff204b1ce59 code=0x7fc00000 [ 1070.553259][ T36] audit: type=1326 audit(1802512097.200:8902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=22195 comm="syz.3.5068" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff204b1ce59 code=0x7fc00000 [ 1070.553358][ T36] audit: type=1326 audit(1802512097.200:8903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=22195 comm="syz.3.5068" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff204b1ce59 code=0x7fc00000 [ 1070.553447][ T36] audit: type=1326 audit(1802512097.200:8904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=22195 comm="syz.3.5068" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff204b1ce59 code=0x7fc00000 [ 1070.553493][ T36] audit: type=1326 audit(1802512097.200:8905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=22195 comm="syz.3.5068" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff204b1ce59 code=0x7fc00000 [ 1070.553592][ T36] audit: type=1326 audit(1802512097.200:8906): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=22195 comm="syz.3.5068" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff204b1ce59 code=0x7fc00000 [ 1070.555953][ T36] audit: type=1326 audit(1802512097.200:8907): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=22195 comm="syz.3.5068" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff204b1ce59 code=0x7fc00000 [ 1070.555998][ T36] audit: type=1326 audit(1802512097.200:8908): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=22195 comm="syz.3.5068" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff204b1ce59 code=0x7fc00000 [ 1070.579768][T16887] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 1070.775438][T16887] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1070.775482][T16887] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1070.782608][T16887] usb 1-1: config 0 descriptor?? [ 1070.796377][T16887] cp210x 1-1:0.0: cp210x converter detected [ 1071.068449][T22223] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5074'. [ 1071.119479][T22212] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5072'. [ 1071.119641][T22213] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5072'. [ 1071.221129][T22234] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5078'. [ 1071.364002][T22207] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1071.364904][T22207] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1071.367853][T22207] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1071.368695][T22207] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1071.371529][T22207] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1071.371800][T22207] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1071.371912][T16887] cp210x 1-1:0.0: failed to get vendor val 0x000e size 3: -121 [ 1071.421120][ T5730] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 1071.644979][T22245] Can't find a SQUASHFS superblock on nullb0 [ 1072.292888][ T5730] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1072.292920][ T5730] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1072.314487][ T5730] usb 4-1: config 0 descriptor?? [ 1072.327769][ T5730] cp210x 4-1:0.0: cp210x converter detected [ 1072.364815][T16887] cp210x 1-1:0.0: failed to get vendor val 0x3711 size 2: -71 [ 1072.364850][T16887] cp210x 1-1:0.0: GPIO initialisation failed: -71 [ 1072.387936][T16887] usb 1-1: cp210x converter now attached to ttyUSB0 [ 1072.405698][T16887] usb 1-1: USB disconnect, device number 52 [ 1072.423181][T16887] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1072.424788][T16887] cp210x 1-1:0.0: device disconnected [ 1072.540408][ T5730] cp210x 4-1:0.0: failed to get vendor val 0x370b size 1: -32 [ 1072.540438][ T5730] cp210x 4-1:0.0: querying part number failed [ 1072.545819][ T5730] usb 4-1: cp210x converter now attached to ttyUSB0 [ 1073.285754][T22255] CIFS mount error: No usable UNC path provided in device string! [ 1073.285754][T22255] [ 1073.285789][T22255] smb3_fs_context_validate: 12 callbacks suppressed [ 1073.285893][T22255] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 1074.469731][ T5730] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 1074.716842][ T5730] usb 5-1: Using ep0 maxpacket: 32 [ 1074.862643][ T5730] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1074.863373][ T5730] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1074.993166][ T5730] usb 5-1: config 0 descriptor?? [ 1075.257423][T16887] usb 4-1: USB disconnect, device number 29 [ 1075.291036][T16887] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1075.293239][T16887] cp210x 4-1:0.0: device disconnected [ 1075.315596][ T5730] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 1075.316631][ T5730] usb 5-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 1075.316732][ T5730] usb 5-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 1075.470437][T22268] netlink: 76 bytes leftover after parsing attributes in process `syz.5.5090'. [ 1075.556378][T22271] FAULT_INJECTION: forcing a failure. [ 1075.556378][T22271] name failslab, interval 1, probability 0, space 0, times 0 [ 1075.556414][T22271] CPU: 1 UID: 0 PID: 22271 Comm: syz.0.5091 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1075.556442][T22271] Tainted: [L]=SOFTLOCKUP [ 1075.556449][T22271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1075.556461][T22271] Call Trace: [ 1075.556468][T22271] [ 1075.556477][T22271] dump_stack_lvl+0xe8/0x150 [ 1075.556504][T22271] should_fail_ex+0x467/0x600 [ 1075.556534][T22271] should_failslab+0xa8/0x100 [ 1075.556560][T22271] kmem_cache_alloc_noprof+0x87/0x680 [ 1075.556583][T22271] ? skb_clone+0x212/0x3a0 [ 1075.556617][T22271] skb_clone+0x212/0x3a0 [ 1075.556641][T22271] __netlink_deliver_tap+0x413/0x860 [ 1075.556671][T22271] ? netlink_deliver_tap+0x2e/0x1b0 [ 1075.556694][T22271] netlink_deliver_tap+0x19c/0x1b0 [ 1075.556716][T22271] netlink_unicast+0x7b8/0x990 [ 1075.556740][T22271] netlink_sendmsg+0x813/0xb40 [ 1075.556762][T22271] ? lock_release+0x4b/0x3c0 [ 1075.556786][T22271] ? lock_release+0x4b/0x3c0 [ 1075.556811][T22271] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1075.556834][T22271] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1075.556861][T22271] ? __kernel_text_address+0xd/0x30 [ 1075.556892][T22271] ? unwind_get_return_address+0x4d/0x90 [ 1075.556918][T22271] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1075.556940][T22271] sock_sendmsg_nosec+0x13a/0x180 [ 1075.556969][T22271] ____sys_sendmsg+0x565/0x870 [ 1075.556995][T22271] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1075.557021][T22271] ? lock_release+0x4b/0x3c0 [ 1075.557045][T22271] ? import_iovec+0x73/0xa0 [ 1075.557067][T22271] ___sys_sendmsg+0x2a5/0x360 [ 1075.557089][T22271] ? rcu_is_watching+0x15/0xb0 [ 1075.557115][T22271] ? get_pid_task+0x20/0x1f0 [ 1075.557136][T22271] ? __pfx____sys_sendmsg+0x10/0x10 [ 1075.557160][T22271] ? rcu_is_watching+0x15/0xb0 [ 1075.557197][T22271] ? __fget_files+0x2a/0x420 [ 1075.557219][T22271] ? __fget_files+0x3a8/0x420 [ 1075.557245][T22271] __x64_sys_sendmsg+0x1b7/0x290 [ 1075.557269][T22271] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1075.557298][T22271] ? rcu_is_watching+0x15/0xb0 [ 1075.557325][T22271] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1075.557346][T22271] do_syscall_64+0x174/0x580 [ 1075.557366][T22271] ? trace_irq_disable+0x3b/0x140 [ 1075.557388][T22271] ? clear_bhb_loop+0x40/0x90 [ 1075.557410][T22271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1075.557429][T22271] RIP: 0033:0x7fe4d81bce59 [ 1075.557447][T22271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1075.557463][T22271] RSP: 002b:00007fe4d640e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1075.557485][T22271] RAX: ffffffffffffffda RBX: 00007fe4d8435fa0 RCX: 00007fe4d81bce59 [ 1075.557500][T22271] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 1075.557514][T22271] RBP: 00007fe4d640e090 R08: 0000000000000000 R09: 0000000000000000 [ 1075.557527][T22271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1075.557539][T22271] R13: 00007fe4d8436038 R14: 00007fe4d8435fa0 R15: 00007ffd609fe2b8 [ 1075.557561][T22271] [ 1076.750536][T16887] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 1076.862571][ T821] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 1078.065826][T16887] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1078.066214][T16887] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1078.066407][T16887] usb 1-1: Product: syz [ 1078.069614][T16887] usb 1-1: Manufacturer: syz [ 1078.070119][T16887] usb 1-1: SerialNumber: syz [ 1078.172588][ T821] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1078.172953][ T821] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1078.331033][ T821] usb 6-1: config 0 descriptor?? [ 1078.724106][ T821] cp210x 6-1:0.0: cp210x converter detected [ 1078.890000][ T821] cp210x 6-1:0.0: failed to get vendor val 0x370b size 1: -32 [ 1078.890029][ T821] cp210x 6-1:0.0: querying part number failed [ 1078.893042][ T821] usb 6-1: cp210x converter now attached to ttyUSB0 [ 1079.017412][T22312] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5104'. [ 1079.547813][T22327] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5110'. [ 1080.454690][ T5780] usb 6-1: USB disconnect, device number 11 [ 1080.484323][ T5780] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1080.495056][ T5780] cp210x 6-1:0.0: device disconnected [ 1081.205824][T22348] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5116'. [ 1081.676095][T22361] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5115'. [ 1081.845664][T16887] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000400. ret = -EPROTO [ 1081.845858][T16887] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1081.881115][T16887] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1081.952707][T16887] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 1081.983091][T16887] usb 1-1: USB disconnect, device number 53 [ 1082.239806][ T5780] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 1082.426951][ T5780] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1082.426982][ T5780] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1082.428823][ T5780] usb 4-1: config 0 descriptor?? [ 1082.432322][ T5780] cp210x 4-1:0.0: cp210x converter detected [ 1082.478033][T16887] usb 6-1: new full-speed USB device number 12 using dummy_hcd [ 1082.653113][T16887] usb 6-1: not running at top speed; connect to a high speed hub [ 1082.656088][T16887] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1082.656118][T16887] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1082.656137][T16887] usb 6-1: Product: 캮邪Ჿ㛣兖릉뒵㹱ഫ㳽ሺ෽鍗⿪㘎蠩撜鷆Ḟ需谟⅞⊺鈾꜅扴嬿擜챏᣿濫热囯ﯖ퉾ﰞ񗗗갵椟鉮닅陴䬦樗 [ 1082.656137][T16887] 雠뒦松상᏿Ա漿쏂鶶䆠㡊熑৥膅욥ត贍醮厌癿滒汔ㄧ瀅㇣釘薞ꮱᕯ뭎쪟쨓ች牃娋ﺶ滙吆겱胼꾖锈℅쥓儙낫笛쎸 [ 1082.656154][T16887] usb 6-1: Manufacturer: ู䈳툻໌㕤ꂸ钘꓋ú࿢ꅊ巇鸫ꧪ쏱肓삅졩䍹頻≿鵀⮮ㅫ⼛ꠃ噡怯琯ꚉ엺粷᯽㮼Јᨿ鼆 [ 1082.710674][ T5780] cp210x 4-1:0.0: failed to get vendor val 0x370b size 1: -32 [ 1082.710705][ T5780] cp210x 4-1:0.0: querying part number failed [ 1082.749571][ T5780] usb 4-1: cp210x converter now attached to ttyUSB0 [ 1084.407277][T22341] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1084.490957][T16887] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1084.492583][T16887] usb 6-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1084.540102][T16887] usb 6-1: USB disconnect, device number 12 [ 1084.597442][T18589] udevd[18589]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1084.677711][T22388] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5131'. [ 1085.052964][T17925] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 1085.621506][ T5709] usb 4-1: USB disconnect, device number 30 [ 1085.644786][ T5709] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1085.645183][ T5709] cp210x 4-1:0.0: device disconnected [ 1085.784387][T17925] usb 3-1: config 0 interface 0 altsetting 255 endpoint 0x9 has invalid maxpacket 160, setting to 64 [ 1085.784423][T17925] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1085.786507][T17925] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1085.786534][T17925] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1085.786553][T17925] usb 3-1: Product: syz [ 1085.786567][T17925] usb 3-1: Manufacturer: syz [ 1085.786580][T17925] usb 3-1: SerialNumber: syz [ 1085.791131][T17925] usb 3-1: config 0 descriptor?? [ 1085.799486][T17925] usb 3-1: selecting invalid altsetting 0 [ 1086.286141][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.327267][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.391121][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.391317][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.391517][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.391696][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.391866][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.400217][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.433027][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.433375][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.433726][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.440492][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.440883][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.441716][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.444481][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.457546][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.466974][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.472518][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.483505][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.484411][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.494584][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.495255][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.502314][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.516311][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.658627][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1086.695787][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.194294][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.208536][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.214089][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.217961][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.218276][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.218614][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.218951][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.223421][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.229246][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.236828][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.237147][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.237481][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.237821][T22384] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 1087.238420][ T5709] usb 3-1: USB disconnect, device number 41 [ 1089.046236][T22434] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5145'. [ 1089.871743][T22447] 9p: Bad value for 'rfdno' [ 1089.873913][T22447] netlink: zone id is out of range [ 1089.873928][T22447] netlink: zone id is out of range [ 1089.873936][T22447] netlink: zone id is out of range [ 1089.873943][T22447] netlink: zone id is out of range [ 1089.873950][T22447] netlink: zone id is out of range [ 1089.873955][T22447] netlink: zone id is out of range [ 1089.873961][T22447] netlink: zone id is out of range [ 1089.873968][T22447] netlink: zone id is out of range [ 1089.874273][T22447] netlink: zone id is out of range [ 1089.874314][T22447] netlink: zone id is out of range [ 1091.046215][T22469] netlink: 76 bytes leftover after parsing attributes in process `syz.5.5158'. [ 1092.223003][T22504] can0: slcan on ttyS3. [ 1092.268057][T22507] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5170'. [ 1092.366920][T22504] can0 (unregistered): slcan off ttyS3. [ 1092.984234][ T9] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 1093.419922][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 1093.421399][ T9] usb 6-1: config 0 has no interfaces? [ 1093.424448][ T9] usb 6-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 1093.424475][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1093.424494][ T9] usb 6-1: Product: syz [ 1093.424507][ T9] usb 6-1: Manufacturer: syz [ 1093.424521][ T9] usb 6-1: SerialNumber: syz [ 1093.426621][ T9] usb 6-1: config 0 descriptor?? [ 1093.649454][T22536] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1093.782593][T22520] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1094.004530][ T9] usb 6-1: USB disconnect, device number 13 [ 1094.362150][T22551] can0: slcan on ttyS3. [ 1094.784598][T22551] can0 (unregistered): slcan off ttyS3. [ 1095.302720][ T5780] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 1095.595001][ T5780] usb 1-1: Using ep0 maxpacket: 16 [ 1096.461230][ T5780] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1096.461265][ T5780] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1096.461295][ T5780] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 1096.461319][ T5780] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1096.472055][ T5780] usb 1-1: config 0 descriptor?? [ 1097.404878][ T5780] usbhid 1-1:0.0: can't add hid device: -71 [ 1097.404964][ T5780] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1097.412885][ T5780] usb 1-1: USB disconnect, device number 54 [ 1099.073086][T22595] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5197'. [ 1099.079035][T22595] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5197'. [ 1100.413339][ T5780] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 1100.696505][ T5780] usb 3-1: Using ep0 maxpacket: 16 [ 1100.698222][ T5780] usb 3-1: config 8 has an invalid interface number: 206 but max is 0 [ 1100.698246][ T5780] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1100.698265][ T5780] usb 3-1: config 8 has no interface number 0 [ 1100.698294][ T5780] usb 3-1: config 8 interface 206 altsetting 1 has an endpoint descriptor with address 0xF7, changing to 0x87 [ 1100.698318][ T5780] usb 3-1: config 8 interface 206 altsetting 1 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1100.698342][ T5780] usb 3-1: config 8 interface 206 altsetting 1 endpoint 0x87 has invalid wMaxPacketSize 0 [ 1100.698364][ T5780] usb 3-1: config 8 interface 206 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1100.698396][ T5780] usb 3-1: config 8 interface 206 has no altsetting 0 [ 1100.701534][ T5780] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 1100.701562][ T5780] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1100.701581][ T5780] usb 3-1: Product: syz [ 1100.701595][ T5780] usb 3-1: Manufacturer: syz [ 1100.701608][ T5780] usb 3-1: SerialNumber: syz [ 1101.397283][T22639] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1101.397573][T22639] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1101.595529][ T5709] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 1102.084349][ T5709] usb 1-1: config 0 has no interfaces? [ 1102.084382][ T5709] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1102.084405][ T5709] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1102.090790][ T5709] usb 1-1: config 0 descriptor?? [ 1102.166050][ T5780] garmin_gps 3-1:8.206: Garmin GPS usb/tty converter detected [ 1102.166633][ T5780] garmin_gps ttyUSB0: failed to submit interrupt urb: -90 [ 1102.168182][ T5780] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -90 [ 1102.195146][ T5780] usb 3-1: USB disconnect, device number 42 [ 1102.196549][ T5780] garmin_gps 3-1:8.206: device disconnected [ 1102.197392][T22654] syzkaller1: left promiscuous mode [ 1102.197419][T22654] syzkaller1: left allmulticast mode [ 1102.311195][T22634] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1102.311454][T22634] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1102.316863][T22634] FAULT_INJECTION: forcing a failure. [ 1102.316863][T22634] name failslab, interval 1, probability 0, space 0, times 0 [ 1102.316885][T22634] CPU: 0 UID: 0 PID: 22634 Comm: syz.0.5205 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1102.316900][T22634] Tainted: [L]=SOFTLOCKUP [ 1102.316904][T22634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1102.316911][T22634] Call Trace: [ 1102.316916][T22634] [ 1102.316921][T22634] dump_stack_lvl+0xe8/0x150 [ 1102.316940][T22634] should_fail_ex+0x467/0x600 [ 1102.316957][T22634] should_failslab+0xa8/0x100 [ 1102.316972][T22634] __kmalloc_noprof+0xdf/0x7a0 [ 1102.316985][T22634] ? drm_atomic_commit_init+0x9e/0x370 [ 1102.316999][T22634] drm_atomic_commit_init+0x9e/0x370 [ 1102.317012][T22634] drm_atomic_commit_alloc+0xbc/0x100 [ 1102.317025][T22634] drm_mode_atomic_ioctl+0x4a3/0x24c0 [ 1102.317042][T22634] ? rcu_is_watching+0x15/0xb0 [ 1102.317060][T22634] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 1102.317079][T22634] ? rt_spin_unlock+0x160/0x200 [ 1102.317093][T22634] ? drm_is_current_master+0x1a2/0x210 [ 1102.317108][T22634] drm_ioctl_kernel+0x2e2/0x3b0 [ 1102.317121][T22634] ? lock_acquire+0x5f/0x350 [ 1102.317134][T22634] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 1102.317149][T22634] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 1102.317161][T22634] ? __might_fault+0xcb/0x130 [ 1102.317175][T22634] drm_ioctl+0x713/0xba0 [ 1102.317188][T22634] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 1102.317203][T22634] ? __pfx_drm_ioctl+0x10/0x10 [ 1102.317245][T22634] ? __fget_files+0x2a/0x420 [ 1102.317258][T22634] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1102.317270][T22634] ? __pfx_drm_ioctl+0x10/0x10 [ 1102.317282][T22634] __se_sys_ioctl+0xff/0x170 [ 1102.317297][T22634] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1102.317307][T22634] do_syscall_64+0x174/0x580 [ 1102.317319][T22634] ? clear_bhb_loop+0x40/0x90 [ 1102.317330][T22634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1102.317339][T22634] RIP: 0033:0x7fe4d81bce59 [ 1102.317349][T22634] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1102.317358][T22634] RSP: 002b:00007fe4d640e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1102.317371][T22634] RAX: ffffffffffffffda RBX: 00007fe4d8435fa0 RCX: 00007fe4d81bce59 [ 1102.317378][T22634] RDX: 0000200000000180 RSI: 00000000c03864bc RDI: 000000000000000f [ 1102.317385][T22634] RBP: 00007fe4d640e090 R08: 0000000000000000 R09: 0000000000000000 [ 1102.317392][T22634] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1102.317399][T22634] R13: 00007fe4d8436038 R14: 00007fe4d8435fa0 R15: 00007ffd609fe2b8 [ 1102.317410][T22634] [ 1102.397064][ T5709] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 1102.473800][T17058] usb 1-1: USB disconnect, device number 55 [ 1102.560838][ T5709] usb 6-1: Using ep0 maxpacket: 8 [ 1102.562590][ T5709] usb 6-1: config 0 interface 0 altsetting 15 endpoint 0x81 has an invalid bInterval 33, changing to 9 [ 1102.562621][ T5709] usb 6-1: config 0 interface 0 altsetting 15 endpoint 0x81 has invalid maxpacket 1056, setting to 1024 [ 1102.562647][ T5709] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1102.562674][ T5709] usb 6-1: New USB device found, idVendor=04e7, idProduct=0909, bcdDevice= 0.00 [ 1102.562695][ T5709] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1102.566032][ T5709] usb 6-1: config 0 descriptor?? [ 1102.566715][T22653] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 1103.119165][T22653] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5211'. [ 1103.341374][ T5709] hid-generic 0003:04E7:0909.0030: unknown main item tag 0x0 [ 1103.341409][ T5709] hid-generic 0003:04E7:0909.0030: unknown main item tag 0x0 [ 1103.341435][ T5709] hid-generic 0003:04E7:0909.0030: unknown main item tag 0x0 [ 1103.341459][ T5709] hid-generic 0003:04E7:0909.0030: unknown main item tag 0x0 [ 1103.341483][ T5709] hid-generic 0003:04E7:0909.0030: unknown main item tag 0x0 [ 1103.341507][ T5709] hid-generic 0003:04E7:0909.0030: unknown main item tag 0x0 [ 1103.341531][ T5709] hid-generic 0003:04E7:0909.0030: unknown main item tag 0x0 [ 1103.341554][ T5709] hid-generic 0003:04E7:0909.0030: unknown main item tag 0x0 [ 1103.341579][ T5709] hid-generic 0003:04E7:0909.0030: unknown main item tag 0x0 [ 1103.341604][ T5709] hid-generic 0003:04E7:0909.0030: unknown main item tag 0x0 [ 1103.344667][ T5709] hid-generic 0003:04E7:0909.0030: hidraw0: USB HID v8.0c Device [HID 04e7:0909] on usb-dummy_hcd.5-1/input0 [ 1103.567116][ T5780] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 1103.729488][ T987] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 1103.755486][ T5780] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1103.755518][ T5780] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1103.757342][ T5780] usb 3-1: config 0 descriptor?? [ 1103.760459][ T5780] cp210x 3-1:0.0: cp210x converter detected [ 1103.891943][ T987] usb 1-1: Using ep0 maxpacket: 16 [ 1103.893985][ T987] usb 1-1: config index 0 descriptor too short (expected 51443, got 18) [ 1103.896001][ T987] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1103.896085][ T987] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1103.896099][ T987] usb 1-1: Product: syz [ 1103.896107][ T987] usb 1-1: Manufacturer: syz [ 1103.896114][ T987] usb 1-1: SerialNumber: syz [ 1103.900753][ T987] r8152-cfgselector 1-1: Unknown version 0x0000 [ 1103.900774][ T987] r8152-cfgselector 1-1: config 0 descriptor?? [ 1104.114938][ T821] usb 6-1: USB disconnect, device number 14 [ 1104.151534][ T987] r8152-cfgselector 1-1: Unknown version 0x0000 [ 1104.159825][ T987] r8152-cfgselector 1-1: No union descriptors [ 1104.176387][ T987] r8152-cfgselector 1-1: USB disconnect, device number 56 [ 1104.201431][ T5780] cp210x 3-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 1104.230284][ T5780] usb 3-1: cp210x converter now attached to ttyUSB0 [ 1104.592888][ T5709] usb 3-1: USB disconnect, device number 43 [ 1104.599481][ T5709] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1104.802328][ T5709] cp210x 3-1:0.0: device disconnected [ 1104.996771][T17058] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 1105.159552][T17058] usb 1-1: Using ep0 maxpacket: 16 [ 1105.161446][T17058] usb 1-1: config 8 has an invalid interface number: 206 but max is 0 [ 1105.161473][T17058] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1105.161492][T17058] usb 1-1: config 8 has no interface number 0 [ 1105.161532][T17058] usb 1-1: config 8 interface 206 altsetting 1 has an endpoint descriptor with address 0xF7, changing to 0x87 [ 1105.161559][T17058] usb 1-1: config 8 interface 206 altsetting 1 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1105.161585][T17058] usb 1-1: config 8 interface 206 altsetting 1 endpoint 0x87 has invalid wMaxPacketSize 0 [ 1105.161608][T17058] usb 1-1: config 8 interface 206 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1105.161634][T17058] usb 1-1: config 8 interface 206 has no altsetting 0 [ 1105.169407][T17058] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 1105.169438][T17058] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1105.169459][T17058] usb 1-1: Product: syz [ 1105.169474][T17058] usb 1-1: Manufacturer: syz [ 1105.169488][T17058] usb 1-1: SerialNumber: syz [ 1105.235092][ T5709] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 1105.325296][ T36] kauditd_printk_skb: 7 callbacks suppressed [ 1105.325314][ T36] audit: type=1326 audit(1802512129.316:8916): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=22700 comm="syz.2.5228" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4d2aeace59 code=0x0 [ 1105.401736][ T5709] usb 6-1: config index 0 descriptor too short (expected 45, got 36) [ 1105.401780][ T5709] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1105.401805][ T5709] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1105.402669][ T5709] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1105.402712][ T5709] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1105.402736][ T5709] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1105.429178][ T5709] usb 6-1: config 0 descriptor?? [ 1105.547324][T22707] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1105.547632][T22707] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1105.755085][ T9] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 1106.027341][T22721] netlink: 'syz.4.5233': attribute type 11 has an invalid length. [ 1106.027393][T22721] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5233'. [ 1106.105374][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 1106.436835][ T5709] usbhid 6-1:0.0: can't add hid device: -71 [ 1106.436891][ T5709] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1106.450862][ T5709] usb 6-1: USB disconnect, device number 15 [ 1106.456991][ T9] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1106.457024][ T9] usb 3-1: New USB device found, idVendor=17ef, idProduct=60a4, bcdDevice= 0.00 [ 1106.457047][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1106.472461][ T9] usb 3-1: config 0 descriptor?? [ 1107.480574][T22745] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5243'. [ 1107.481587][T22745] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5243'. [ 1109.580515][T22753] netlink: 'syz.3.5245': attribute type 11 has an invalid length. [ 1109.580537][T22753] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5245'. [ 1110.071071][T22757] batman_adv: batadv0: Adding interface: gretap1 [ 1110.071089][T22757] batman_adv: batadv0: The MTU of interface gretap1 is too small (1382) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1110.071119][T22757] batman_adv: batadv0: Interface activated: gretap1 [ 1110.388960][T17058] garmin_gps 1-1:8.206: Garmin GPS usb/tty converter detected [ 1110.389766][T17058] garmin_gps ttyUSB0: failed to submit interrupt urb: -90 [ 1110.389802][T17058] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -90 [ 1110.408625][T17058] usb 1-1: USB disconnect, device number 57 [ 1110.414540][T17058] garmin_gps 1-1:8.206: device disconnected [ 1111.048657][T17058] ================================================================== [ 1111.048675][T17058] BUG: KASAN: vmalloc-out-of-bounds in __li[ 1111.048675][T17058] BUG: KASAN: vmalloc-out-of-bounds in __list_add_valid_or_report+0x4e/0x130 [ 1111.048798][T17058] Read of size 8 at addr ffffc90004659008 by task kworker/0:1/17058 [ 1111.048814][T17058] [ 1111.048828][T17058] CPU: 0 UID: 0 PID: 17058 Comm: kworker/0:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1111.048852][T17058] Tainted: [L]=SOFTLOCKUP [ 1111.048858][T17058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1111.048870][T17058] Workqueue: usb_hub_wq hub_event [ 1111.048936][T17058] Call Trace: [ 1111.048944][T17058] [ 1111.048952][T17058] dump_stack_lvl+0xe8/0x150 [ 1111.048975][T17058] print_address_description+0x55/0x1e0 [ 1111.048997][T17058] ? __list_add_valid_or_report+0x4e/0x130 [ 1111.049021][T17058] print_report+0x58/0x70 [ 1111.049041][T17058] kasan_report+0x117/0x150 [ 1111.049067][T17058] ? __list_add_valid_or_report+0x4e/0x130 [ 1111.049095][T17058] __list_add_valid_or_report+0x4e/0x130 [ 1111.049122][T17058] kcov_remote_stop+0x457/0x680 [ 1111.049146][T17058] hub_event+0x4789/0x4cf0 [ 1111.049185][T17058] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1111.049207][T17058] ? __pfx_hub_event+0x10/0x10 [ 1111.049230][T17058] ? rcu_is_watching+0x15/0xb0 [ 1111.049255][T17058] ? lock_acquire+0x5f/0x350 [ 1111.049277][T17058] ? rcu_is_watching+0x15/0xb0 [ 1111.049302][T17058] ? process_scheduled_works+0xa20/0x14e0 [ 1111.049329][T17058] process_scheduled_works+0xa8e/0x14e0 [ 1111.049363][T17058] ? __pfx_process_scheduled_works+0x10/0x10 [ 1111.049387][T17058] ? do_raw_spin_lock+0x12b/0x2f0 [ 1111.049408][T17058] ? assign_work+0x3cf/0x5d0 [ 1111.049433][T17058] worker_thread+0xa47/0xfb0 [ 1111.049465][T17058] ? __kthread_parkme+0x71/0x1f0 [ 1111.049497][T17058] kthread+0x388/0x470 [ 1111.049517][T17058] ? __pfx_worker_thread+0x10/0x10 [ 1111.049543][T17058] ? __pfx_kthread+0x10/0x10 [ 1111.049562][T17058] ret_from_fork+0x514/0xb70 [ 1111.049584][T17058] ? __pfx_ret_from_fork+0x10/0x10 [ 1111.049605][T17058] ? __switch_to+0xc89/0x1420 [ 1111.049630][T17058] ? __pfx_kthread+0x10/0x10 [ 1111.049647][T17058] ret_from_fork_asm+0x1a/0x30 [ 1111.049673][T17058] [ 1111.049680][T17058] [ 1111.049684][T17058] The buggy address belongs to a vmalloc virtual mapping [ 1111.049699][T17058] Memory state around the buggy address: [ 1111.049709][T17058] ffffc90004658f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1111.049720][T17058] ffffc90004658f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1111.049731][T17058] >ffffc90004659000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1111.049740][T17058] ^ [ 1111.049760][T17058] ffffc90004659080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1111.049772][T17058] ffffc90004659100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1111.049780][T17058] ================================================================== [ 1111.065539][T17058] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1111.065568][T17058] CPU: 0 UID: 0 PID: 17058 Comm: kworker/0:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1111.065597][T17058] Tainted: [L]=SOFTLOCKUP [ 1111.065604][T17058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1111.065618][T17058] Workqueue: usb_hub_wq hub_event [ 1111.065654][T17058] Call Trace: [ 1111.065662][T17058] [ 1111.065671][T17058] vpanic+0x56c/0xa60 [ 1111.065698][T17058] ? __pfx_vpanic+0x10/0x10 [ 1111.065720][T17058] ? rcu_is_watching+0x15/0xb0 [ 1111.065747][T17058] ? trace_irq_enable+0x3b/0x140 [ 1111.065772][T17058] panic+0xc5/0xd0 [ 1111.065794][T17058] ? __pfx_panic+0x10/0x10 [ 1111.065820][T17058] ? __list_add_valid_or_report+0x4e/0x130 [ 1111.065847][T17058] check_panic_on_warn+0x89/0xb0 [ 1111.065869][T17058] ? __list_add_valid_or_report+0x4e/0x130 [ 1111.065894][T17058] end_report+0x73/0x170 [ 1111.065918][T17058] ? __list_add_valid_or_report+0x4e/0x130 [ 1111.065943][T17058] kasan_report+0x128/0x150 [ 1111.065968][T17058] ? __list_add_valid_or_report+0x4e/0x130 [ 1111.065997][T17058] __list_add_valid_or_report+0x4e/0x130 [ 1111.066023][T17058] kcov_remote_stop+0x457/0x680 [ 1111.066046][T17058] hub_event+0x4789/0x4cf0 [ 1111.066091][T17058] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1111.066112][T17058] ? __pfx_hub_event+0x10/0x10 [ 1111.066138][T17058] ? rcu_is_watching+0x15/0xb0 [ 1111.066164][T17058] ? lock_acquire+0x5f/0x350 [ 1111.066188][T17058] ? rcu_is_watching+0x15/0xb0 [ 1111.066215][T17058] ? process_scheduled_works+0xa20/0x14e0 [ 1111.066242][T17058] process_scheduled_works+0xa8e/0x14e0 [ 1111.066279][T17058] ? __pfx_process_scheduled_works+0x10/0x10 [ 1111.066304][T17058] ? do_raw_spin_lock+0x12b/0x2f0 [ 1111.066332][T17058] ? assign_work+0x3cf/0x5d0 [ 1111.066359][T17058] worker_thread+0xa47/0xfb0 [ 1111.066392][T17058] ? __kthread_parkme+0x71/0x1f0 [ 1111.066423][T17058] kthread+0x388/0x470 [ 1111.066442][T17058] ? __pfx_worker_thread+0x10/0x10 [ 1111.066468][T17058] ? __pfx_kthread+0x10/0x10 [ 1111.066488][T17058] ret_from_fork+0x514/0xb70 [ 1111.066510][T17058] ? __pfx_ret_from_fork+0x10/0x10 [ 1111.066530][T17058] ? __switch_to+0xc89/0x1420 [ 1111.066559][T17058] ? __pfx_kthread+0x10/0x10 [ 1111.066579][T17058] ret_from_fork_asm+0x1a/0x30 [ 1111.066610][T17058] [ 1111.066900][T17058] Kernel Offset: disabled