last executing test programs: 11.800458235s ago: executing program 3 (id=5180): prctl$PR_SCHED_CORE(0x3e, 0x80000000000001, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000006540)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002840)=ANY=[], 0x18}}], 0x1, 0x20004010) r1 = socket$inet_sctp(0x2, 0x5, 0x84) sendmmsg$inet_sctp(r1, &(0x7f0000000500)=[{&(0x7f0000000040)=@in={0x2, 0x8, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000200)=[{&(0x7f00000000c0)="6c09ca95e8", 0x5}], 0x1, &(0x7f0000000280)=[@prinfo={0x18, 0x84, 0x5, {0x30}}, @init={0x18, 0x84, 0xdc05, {0x7ff, 0x0, 0x3}}, @sndrcv={0x30, 0x84, 0x1, {0x30c, 0x100, 0x2, 0x4, 0x10, 0x5, 0xb8e, 0x8000}}], 0x60}], 0x1, 0x4044040) socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 10.729208758s ago: executing program 3 (id=5185): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000041436120410e5150e8d5000000010902f98a5c01000000090401"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, 0x0, &(0x7f0000000140)) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000ec0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x8, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}, @NFTA_CMP_SREG={0x8}, @NFTA_CMP_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc8}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000100)=0x3ff) close(r2) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r4, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = userfaultfd(0x1) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_WRITEPROTECT(r6, 0xc020aa00, &(0x7f0000000440)={{&(0x7f0000aeb000/0x4000)=nil, 0x4000}}) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) ioctl$UFFDIO_CONTINUE(r7, 0xc020aa08, &(0x7f00000000c0)={{&(0x7f0000800000/0x800000)=nil, 0x800000}}) close_range(r5, 0xffffffffffffffff, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$TCXONC(r8, 0x540a, 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x3264, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xc, 0x0, 0xba, [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x1, 0x2, 0x8, {0x9, 0x21, 0x4, 0x5e, 0x1, {0x22, 0xe6}}, {{{0x9, 0x5, 0x81, 0x3, 0xf072a884bda35a37, 0x8, 0x2, 0x81}}}}}]}}]}}, &(0x7f00000003c0)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x200, 0x8, 0x2, 0xc, 0x8, 0x7}, 0x89, &(0x7f00000000c0)={0x5, 0xf, 0x89, 0x4, [@wireless={0xb, 0x10, 0x1, 0x2, 0x10, 0x4, 0x3c, 0xfffe, 0x7d}, @generic={0x2e, 0x10, 0x3, "945dbafb1723da9159f359b40c9160ca6525ba9a35778509df6200fe567f5a53b9e39bd4de9d8d4ac8a8b2"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xd, 0x3, 0x2b, 0x6}, @generic={0x41, 0x10, 0xa, "024f033225868aef6dfcef6183755e333e5d9f19bf497e2b1868e4284e8eb4353a6d6385498e81b0c7b62688cc9d6ebd9921eaf09e9841f25bc27f9d1c58"}]}, 0x5, [{0xbc, &(0x7f0000000180)=@string={0xbc, 0x3, "d9fbda27da57b308405da0baecc868190f1cec94705c1bba95a4338c5ac4e544fe8b7cc45f94777beedaf729d16483aba395345604f1e855deae9c9c15067405779cdc5c7804e93c0a3cc38c9092c8e924c2c2ac778ab0df151a4fe42848984c3330412b42f6925e9cad85481e8517d85676924cd9e145ef78a7d79cb2c11b17f223c2d9eacc26368747031bc5aca26fefb35021f7a05658050498bc7e54ada9ee404dfc370e4e93eb8586c0fffc018cd3873cd48fe7b80393fa"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x402}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x40b}}, {0x7d, &(0x7f00000002c0)=@string={0x7d, 0x3, "ede2bf004ea410ff32f68547dfc744962b01411f02399f9ea71173d8e370d0bd36daeb5b7672c8fe1d9f251420f3c8f550c8b45eb0ddca53a837a4a33f467b1a91c0c32a719c8a7daf92046e7be37de4b7db4ee9d825fd21310ab6c57e923d2be0dbf774478aeebdd8250ef2a589a8e87fbc1eb7961ba9df482ca7"}}, {0x63, &(0x7f0000000340)=@string={0x63, 0x3, "08c300efbfff7d10dd3e2bd7edf8430e0ef2e5261bc2623750a9e00f32e1c0a8ffed8ef7faccb3241ef73b4e300196eac180a3f4fd3f20c7e0a00f347a418fc2234b7aacbd4c469659ad9f8155e4384759a339e5045c2b96ec199215853c0758ae"}}]}) 9.690592207s ago: executing program 0 (id=5191): msgget$private(0x0, 0x0) msgctl$MSG_STAT_ANY(0x0, 0xd, 0xfffffffffffffffe) r0 = socket$inet(0x2, 0x4000000805, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x4, 0x0, &(0x7f0000000000)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0xffffffffffffffca, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) creat(0x0, 0x0) r2 = socket(0x8000000010, 0x2, 0x0) r3 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x0) quotactl_fd$Q_SYNC(r3, 0xffffffff80000101, 0x0, 0x0) ioctl$VIDIOC_S_SELECTION(r3, 0xc0405668, &(0x7f0000000000)={0x0, 0x0, 0x7}) write(r2, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9463cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r4 = socket(0x840000000002, 0x3, 0x100) syz_extract_tcp_res$synack(&(0x7f0000000000)={0x41424344}, 0x1, 0x0) r6 = socket$netlink(0x10, 0x3, 0x13) sendmsg$netlink(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000001240)=ANY=[@ANYRES32, @ANYRESDEC, @ANYRESOCT=r5, @ANYRESHEX], 0x200}, {0x0}], 0x2}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd608e37f300142c00fe8000000000000000000000000000bbfe8000000000000000000002000000aa3a000005", @ANYRES32=0x41424344, @ANYRES32=r5], 0x0) r7 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_dccp_int(r4, 0x21, 0x10, &(0x7f00000000c0)=0x5, 0x4) ioctl$TUNSETLINK(r7, 0x400454cd, 0xfffe) lseek(0xffffffffffffffff, 0x0, 0x0) connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r8, 0x8955, &(0x7f0000000180)={{0x2, 0x0, @remote}, {0x20000010304, @dev}, 0x4, {0x2, 0x0, @multicast1=0xe000cc02}}) listen(r0, 0x3f) 8.638466168s ago: executing program 0 (id=5192): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a000090400000103010100092100080001220100090581"], 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0xb3, 0x0, 0x0}) r2 = dup3(r1, r1, 0x0) ioctl$BINDER_GET_EXTENDED_ERROR(r2, 0xc00c6211, &(0x7f00000001c0)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ipv6_route\x00') lseek(r3, 0xae7e, 0x0) 7.642554451s ago: executing program 1 (id=5196): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000001180)) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0xb, 0x12, r0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000180)) 7.520515649s ago: executing program 2 (id=5197): openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c002000190001000000000000000000021800000000fd000000ed0008000100ac141400080008000400"], 0x2c}}, 0x0) 7.382855533s ago: executing program 1 (id=5198): syz_io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0x0, 0x2}, 0x0, 0x0) r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x5) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) sendmmsg(r1, &(0x7f0000007540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=[{0x10, 0x10d, 0x800005}], 0x10}}], 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@ipv4_newrule={0x1c, 0x1e, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0x1c}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) open(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r4 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000200), 0x1c24c2, 0x0) r5 = memfd_create(&(0x7f00000003c0)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecj\x02\xc8\xc4\f\x04\x99\xf6\xfc', 0x3) ftruncate(r5, 0xffff) fcntl$addseals(r5, 0x409, 0x7) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f0000000300)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0x3f, 0x4, 0x20, @mcast2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8, 0x60, 0x2, 0x20}}) bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000001dc0)={@ifindex=r6, 0xffffffffffffffff, 0x5, 0x0, 0xffffffffffffffff, @prog_id}, 0x20) r7 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000240), 0x2) r8 = ioctl$UDMABUF_CREATE(r7, 0x40187542, &(0x7f00000002c0)={r5, 0x0, 0x0, 0x2000}) r9 = fcntl$dupfd(r8, 0x0, r8) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000180)={0x0, 0x0, r9}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c00000010", @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005001d000000000005"], 0x4c}}, 0x0) 7.238702648s ago: executing program 2 (id=5199): openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100"], 0x2c}}, 0x0) 7.068385653s ago: executing program 1 (id=5200): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x2, 0x7, 0x102, 0x1}, 0x48) r2 = socket$inet(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) sendmmsg$inet(r2, &(0x7f0000003ac0)=[{{&(0x7f0000000180)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x20044840) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000800), 0x802, 0x0) write$UHID_CREATE(r3, &(0x7f0000000380)={0x0, {'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000040)=""/2, 0x2}}, 0x120) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6}]}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x10, 0xffffffffffffffff, 0x0) readv(r3, &(0x7f0000000140)=[{&(0x7f0000000080)=""/155, 0x9b}, {0x0, 0x4}], 0x2) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x70, 0x4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x2, 0x4, 0x5}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b, 0x0, 0x0, 0x0, 0x3}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r6}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000600)=0x1801, 0x4) sendto$inet(r4, &(0x7f0000000700)="09268a60fcfaf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88ff4f90b1a7511bf746bec66ba1fe92e8615fc3f7af9c3310b39cc2dc3616dcdfaebc65ca325fd99357ed9d11b266a7c88722db6e38df1089394f438cb9fbc08e62754c233cced4a4d4d05a3e5029a01298d3ee87d8a0803a2d26906f42f5b5aaf47d2752a8b23954f309cae13ef250cf76775ddfd153eef2b1a8458a3cb6dc764f19b41c8c61c7305a51a4bfa0c897c7c1f438a851222a5560c0e77b0b5934296bc6f28af87d651f7348a2ba2ca67f930cc655afe0220cbeb79a2a87bba6be2de3e756e674c405bcc51843b4cc75ff7ec38a34d1a2a61f0a1223e69484b5d922b5590758c33317df18c401ff910f9b3f0eaef8b9d928392097a025b0459", 0xfe6a, 0x40040, 0x0, 0xfffffffffffffe93) sendmmsg$inet(r2, &(0x7f0000000a80)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000100)='*', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)='\\', 0x1}], 0x1}}], 0x2, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) getsockopt$packet_int(r7, 0x107, 0x6, &(0x7f0000000280), &(0x7f00000002c0)=0x4) splice(r2, 0x0, r8, 0x0, 0x2, 0x0) 7.063411286s ago: executing program 2 (id=5201): r0 = syz_io_uring_setup(0x444b, &(0x7f0000000100)={0x0, 0x0, 0x2}, &(0x7f0000000540), &(0x7f0000000280)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_STATS(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r2, 0x400, 0x70bd2c, 0x25dfdbfd, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000040}, 0x40050) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x13, 0x2000ac0a, r3) r4 = syz_usb_connect(0x2, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x110, 0x94, 0x96, 0x7a, 0x40, 0x565, 0x5, 0x90b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x4, [{{0x9, 0x4, 0xd5, 0x0, 0x1, 0xb6, 0x42, 0x64, 0x0, [], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0xf1, 0xf3, 0xa6, [@generic={0x9, 0x4, "e581365e6f0131"}]}}]}}]}}]}}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r5, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x220, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000500], 0x7, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000000006e2a30456b880000145b41fe6900000079616d3000000000000000000000000079616d3000000000000000000000000076657468315f742f5f626f6e640000000180c20000000000000000000180c20000000000000000000000b0000000670100009001000073746174697374696300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000646e61740000000000000000ff0300000000000000000000000000000000000010000000000000000180c20000000000ffffffff000000006e666c010000000000000000000000000000000000000000000000000000000050000000121b6eb244d4f0fffbf04a000000007e4b000022d4e27ebdf3b9dc569e338e2c551c2fc4a19597ba4c501c8b1f16fb7809c40aee86f4fe16383d2afb577ed2bb6dd99f024b3f54ba000000004155444954000000000000000000000000000000000000000000000000000000080000000000002000000000000000000002000000000000"]}, 0x298) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x20040, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r7 = syz_usb_connect$uac1(0x0, 0xa4, &(0x7f00000000c0)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d24070000030769dc000049c40c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r6, @ANYBLOB="05"], 0x0) syz_usb_control_io$uac1(r7, &(0x7f0000000280)={0x74, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0003040000002203"]}, 0x0) syz_usb_control_io$uac1(r7, &(0x7f0000000680)={0x14, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="00032a0000002a03"]}, 0x0) syz_usb_control_io$printer(r4, 0x0, 0x0) 6.807391739s ago: executing program 0 (id=5203): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x6, 0x4, 0x5b, 0x8a}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x6, 0x4, 0x5b, 0x8a}, 0x48) syz_open_dev$radio(&(0x7f00000005c0), 0x0, 0x2) (async) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netfilter\x00') fchdir(r0) (async, rerun: 64) readv(0xffffffffffffffff, &(0x7f0000002680), 0x0) (rerun: 64) r1 = open(&(0x7f0000000100)='./file0/file0\x00', 0x401, 0x174) fcntl$notify(r1, 0x402, 0x8000003d) (async) fcntl$setsig(r1, 0xa, 0x21) (async, rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 64) r2 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) keyctl$get_security(0x11, r2, &(0x7f0000000300)=""/47, 0x2f) (async, rerun: 64) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) (async, rerun: 64) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) (async) mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r4, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) (async) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) (async) rename(&(0x7f00000001c0)='./file0\x00', 0x0) (async) open(0x0, 0x1c9501, 0x0) (async) unshare(0x2a020400) r5 = getpid() (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="8500001100000000660000000000000016000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x8, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff4e}, 0x23) (async, rerun: 64) unshare(0x20000000) syz_pidfd_open(r5, 0x0) 6.554334267s ago: executing program 0 (id=5204): connect$inet6(0xffffffffffffffff, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x300, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600)={&(0x7f00000002c0)={0x50}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x3, 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) utimensat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)={{r2, r3/1000+60000}, {0x77359400}}, 0x100) mkdir(&(0x7f0000000540)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r4, &(0x7f00000077c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000004200)={0x50, 0x0, r5, {0x7, 0x1f, 0x0, 0x207601a}}, 0x50) syz_fuse_handle_req(r4, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000090c400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000542d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ea8286a2fba523440000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000633956a1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007d6ab715107fa1820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6ffffffffffffff0000000000000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000286071480000000000b13bc1e6d970884f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3ffffffffffffff00", 0x2000, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006340)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r4, &(0x7f0000002140)="4627563e95d073e9c44031e486c6c3c887234dab29bb5d4444d206b6ed7b2b3001b6ed59a692ab0f0251ebf104d3747ab90777b96df4449e5275f86a62902df16f5fba75e202cbdf6fe7cc018a76b412f6485398037d6cb464f1dcf7fda3c76e43cdf64a53f6182a0b7e6476035e8bce74d0582b1ccf32dc8b0cc3b610b143afb4d3c163308a66f2dedd0d45f392d7899f5c4d2ded35c1602f7338dea29e0dff356a32c9e921eeebf8b9845ec2a40b68a8bdcb88009c910e110de23a02648667d740186ee2a3f4a59672477230c4a3a62a1417659b1978cf2b671f836d49fd361ad0af9157916d29cb4fcc1e873a336660b639383485a5322faca6694c74f58fa428582950bd136778dff61da52778dade8b2c3331b31a89259469b0900ab4173202f6256b2d23d3feb8517556292de52662192eca03da5744515c4a92cd3f0f296209bacb28a0267776c9797a784cfd95a52f9de496a5ed70459d55041b663a70d7d471da4f86cd187fd53e667422a0fdfe5eb34e2f2b8c133f2271fe5b1e71533b698169ac8107187533e37765fbd69c327ec608249c44018e3496b2f66fb8bb942f4bd26ed687ee1f7d2a53d7233fbde91cd03f4b4db0c23ed56ff9a61e0d5a1bf6ed50c308e8af0c32b2e0b15df009046ed88d60b772e0cdbfb3d765251aae01b01660df364dce51971ea2034b316a0b0071cb1d28bb86279de377ccb5a18ce981241b5d566e248866f280d71c6775e14fad44342945663bd56ad056f79e49f8071153391f8de78b05496a5f174e812ee0b102e0421c632e4a9f8ffd87ea68df1d7e85af4b30024b2a3cf0e1106871b3427eedfe857f3bc2a021d42fc09224ece3c56e57806a2da229231cc8e3ed5dbd82fd2d3894cba01e36c2ba91a42456eb570446fa3e2eddfe30264572d5d778cbf5d676ad4bd37d11e09573a5566b3656a760c9d3030b2bcd90be0d670866010e2d33c93f223a79ca167bce1a46670db33470c75776582f26b5d9ce847493ddb34612bc829f93f473c24263246011c4ca689f62f4539550ee13b246aeeec477fb2e9e4b223f66c006303abdb003809b9cd4e993b90821750b86608882355e5f587182c1ac6c677b07c26956073ff3a78d4f325139d9c0b8aead052e73fd21b3615ea22acc084bf5060f72936796311e31c038426f0a0e6c304cd2d9c363e7a1a21752032be17adca8b476b0e571b591c9dd923b0066fd5e32e045494c0a9e1e511f147988e0a5fe9652b92ed0e015ef54e3ed2a510b9383f1938dece777ca866f1a21082052827f3a48c2f38482fe3a8286c0ff17d4c24a468a5a0ec0a2eb1165f48cf76fc07450c82294d973a1793dd58008834f0d3aba4e097ceff0ba44656c67839ff3e489975297b334ecf6c7ce4634afbe3d8ab70827563aa75ffafc43429170c3fe3854238485c5a9b567a959a746010c22a92e863e318312e0efc06ab86d1435e06aca5f4b7b7f06a78f90795545c145c9941b74adb9a31ab4f749f81665dd9308acba8d7861856b548eab226377be82611ad79c8d25b176de98003c1ea28b556a2b90360913c39f8f64f0d122c732af5a990603429b354ecd4de797e17722c66546cc38349cb09c40ea54972562734e9816c83103e0bd19451e6144d005e6ce6d6d6fc1ce90238b73d1e0aaa4ee9fd0545054cea97639a404edf3b27c0073be84961084ea685e8ace53c7d7f52b62e378d9ee167aec3e5cbd60ff36c0d3ad40181bad59f111c30e9414112fbc71ad7ede21c288c878dd2509c36f93c31dab5d091107c8e8bdcadffdcb3053eba35b44c70a6421b343922cb11c69b886db0f412e5c23f89dbaff9e5847fd749e28356cab3999f1142449047a3a6c43bf670244e55d888f36ef1dc87bc5bb1460b6c8d1e69efca9a02ba834591906a65102c3e1c1c7dbdeccc7e261795f349d110836445d8ba19cbc699c46d4edc34942a488de1cc1140dc6acf23c8ec1f475e613c85ba025ff7ae639cb2499629eb5f5c88c4057e30bcf41767424af763c9204084856d87cd99f0da06ae6ee5b7382c1f6f2cbb2cf2dfd8320271f16ba7ebd8f0e3c742482f5426530b1ab946c7118f70aa4eac41dd78569341a0f3dd250531aaefdff4cab9e9eed7efdaa865f9b804ade79ced061a1fcd18a6c61a708fdf119841dc232cc5c4e5343cb8a82e9dd9647779bca053b5a2c43481c06ce2a593e388f5f5f4e681771021aaaf0589dac69db22c7285035d1eb89c75935fa4208b3786f2640ce9d65b0e671967dc27808fea5d17ac70a3ac2802f65d45d9c0372aeed530ee58bf04e190f50dac25139caec0b253d17af28eaed173c7043d66567188f04ea51733835c1c66ac7a634d7b90bdac4a6d1075bb277dc6ca420b24485012db44aed5a2e8099f4f3ed53bdb0b35b35905db28169b3e3b3d13ff94bdf2c9549f4a54c64b8d27098b86ff46cfd515f35b1d5a1bbf1bb29df16cdf296e804977a6b583d018c4fdb66264d5f2d9e162059017d6b6cbc6d6c2f1009717c67093f6feaafce1f242f4b730a2e714e9bba79f18c42a158425147b7b2cd9add4ac1d2c1a95b13a4f352d51982a5d967cd611911e6d0777afbc10883c6293f056acc69da89a0a64913be996466ed63f969d5ccd124cd3052d6654e6db0519449f3cbf3a2011541d26e5b76c3c192857905bcf989fd943d42aee9ebd40fee33094eae69154092e9514819ff126040ea7d43a927809149cfaffcc76cb1e332426bf0eb1ac1a3968c70030453a284a0fe39b9ebd704f0950cb5350d4c60d65566b3f24ec4636cd5bb3e23066f4d4f1814e60f286f3ad2d3c10e79c5991c8bf5fdb561723873fe0c75c7bb6ba262aa3a6655349df95f07abb0200d5b9152da4bfdd66a311b29a15755e8465b7b0d99f7f8ccefe9cb3561b5619d4c21b36c9b29442ccd5949882d0167244d84b677685d62074f63b8dc66941f317c78bb093491e2acb7207cc80fe51c22199aae878170af9fa1eb164854587007eb108f23d1c7946bf75aee50eee6fffdae24b992393bd37d268a136b3dcb1b7d2c9b9fbfe0c860b0d344f488e85de2a65a20eb057f0047d0b6b8898bdd68e21f2234a2c66b963a2d86f62297a7d1176c14acaddd4861f5bb74ee91eb3b6ba0c7328433b977e23c02ab67d82a12d620fc034f1c9c3a99a6a07ddf59eaa18384e429101dacbd93ee794e27b774242446fa433a8c03e4312ad56f6c4dfd1ad014d07932480e07caedabda36caaeaaf405dfa1a650843f2e09ae89c666ab8754d9bf9b290f4c4c9242d8f98533bfdbae191a6fbcba6bdb9096427d2d8efb5dcfbd58df7763cc445bf44a0be6de2335a395ab8157dee25794be81c3d87a7d457b52d88f86cabf91f2ec16a8e05a00f72277943737839a5242163025704c7b938f3f424ef5db6b60d3181e3ef94cbdc6516f0ecf01b52164b92f2e12ed55db595fd8de6862a3b12ebe06b19d1f93132b83b2f5ddbc9808b3ce8fa40352c84664d824edd2631a5e2fddaae887689092007d3d0f22a948f54bfd5c42bea5f0d6bf5018cee5ef232c8b6ea3f54ee6f4997c8ad5ccfd28227eeca811312375a849bdf4d343c1b0ec7035279d1bc0892ef193a74018d5ccd5ccaf0503a697b23abb44b7aa3beced0626daa5e1fbfc4d29d2804292fcc60b775f656179510168bf05929dbc92e009d94561d946f7b4b5a18c08d29678c482d90e07abb029e80546e5cee6c4a30712a9b92d556a29b2de021bd49b6398340a9363b689bedc007416bcb659c0c4b6eaa31ec4976ee4896ff87a7dfab48dc7046d44c9c2db6881f7d6b252e582eb878b0be9b24666e74e8eb565c07582f17817ea2422de5da79cb367e76b9b8a9d056de06ad0483986fef2a3b62d64d5d2128cf55499025ad0739ad3ce5e1bfa6aaac16828bdacad2f86b32ed933a2f672efd1f4a32dd23e59aed872d1015eaaf701a0ef8e1427d59728450c4f1bd561e7ef6f8e34d12ae2120a51746a5c346e739c09854caeec07af0d70dd4d9164b3ae8a098a41c081465fdb5537cb560426bc0de4b735f253dbc779b9dce429d99700cd6c0cbd778caeb56401b2bb5c1ca310ab0c91e1d9f4578b5fb3b4f0dad4c565495797e8e83603f3ef188a896fad5bfec24457e0f6f962b8613434f16acf74308171567eae5ad9ec11186a56493a5394042bd1b29fbe0ce64e5f1b0b56e8910343666d627d71c729c0c90bfae0134e117842d67b160ff50688f7b45f0ae330c2d4890732ace7795ff74b6e36466da623c8eef75528b22199c9bf589a1fcd2aca6c5fe3cce2eddabf1ddc8e87380b815ed5928222613383db7941eb9d55b45487b399a9a35ca4cbd9eaf08c71273fc3334b0acdbd117b13697a9ae475e79a44911ce4fed1490a2ec654fe469c9ea933999dae3616b063769446cfefb4562bd124e42f62a3dd0385fe3d21029ad8fd1c58b0badd42e415a76e3e92f246629d3579dd80d940e6dd9bee3d9a6ef8a7840fb253507e718eca32ff4119eb0bcc02aa210939a3bc41704a63202139c68e276254395ab6b858f4528ea2b3a57328e0b31816de3ad85e50e7f4ec9445eaf21a8b9916ed209bb7e79a7a08c2e4e09644ab831c0ba68d05d5ebf57a9eb36bb9caa8e7ac78a8ccca1bcb03cef0c5eb31fafa6e283632c117031aa3919f72aa80a2b9b2557749951348d5294ed2414ffcbafdf976bfb7a401bedb208fe1285738df515af493047aec962bcacb8ea7bad5fc12d5bf415e66c06c4c87044e694291e104ef53850cbc7ef73ab57982d77a3f941c226a915163e8eebd256cb8a1f0130023d2c5d3be77cab39bae4449711d6f39e50cc83eefaf6cc727b1c0b3fc4f7bd110d18262cd872cee8ca95f1be8005d5b339abbde923ef2d4290d5579e4420ff2beb705c16e96101c38c31cfd05639f252730c145182e4406aab68f556e0290ccf05e25a7bf13cdb5db47a8a0841fbeb880d4f0add608d1badb8992924b548ef1426ec774ec9d86678d4c2aae8f1e3b2dfb295802f75727a308dd1b39460f26858eff99fae8d27f24ea6902adabc89311a5fd18c3d9c606db7295f25acd22624bcc753c4c3acdb3f6c563174441333b69a126e4fcc6b06165f6221539c5ed277c20dac4b7978619e10616475de88810bbac714f3651efaa59b75791080a1086c0f3f1b5edb4b3976cc936665855f6a56788d76c6e771b1c968c859fd1ba995d336d301695fc012b8031a14ca529e3e9bf622db6813417925bb4e1a7a5b786aa90f4d048f1f442a2696970dd442d3a6ee117a3e768644c99951b75e51e98de61bc7ed8eb9e87fd43ec75e948829bd19fc545cddefee7a6f068a419e216982ca4ce6ad3256f1e64d203ba1da27e9e175738124ca86a312d0dd0caae6d64751d459d8134830ebb4f4c7931aa90c1ad6fefd99ea4ded3d246236719d6fd48979ee31eaabbea385e91aea0557a58d73a63660ecee981e3da40a39fec3f01caaffafee3504e9f8dc990cc2d69c513db25f6e722ea4811f778af8a338498b6b908682aca6e02e898cb65377f820529d35707cb83ba69b16c92b571728c58188fb08ed6f6c27d6b70e963b147605714468b90966f082d7175fcbc6e770835efb6e7bac5eeaeb5b2c23eb30ecc102e647f1ff71bc6b35f629a55dd305f8ed5287e35403a91b4dc77a6df2fff354460bf563c071846c84617da4df4c46a9e359c45d217a2b096c830ac8614947d110334ca17f587d86825b2b7ae1039fc11109687c1ad0a16f0180d1700414a4694e7ab73c715436dce437a9b3dff55f62fc1ffffc33d3be037c34c9ee7a0fcfeaec1778268565663f39b69c141304c892ae80da42cc854a87c955e6d8060a731eb16ee91e8ea27f90da85196e4f034d40b85ff59eb4b7c76218342f9c9f8d3749c874562829b7ad0c786c5c25ed240aa14755ff7f5ba5298f9f6b6ec3a46ac36d6a39c59c2ecf7781da77931214ac9a8697691d933b20cb64acde409fc159d748e4f92d83ff7767260fdec04b2e80cc524a2366e8fa5b70eb8684d164dec49fa95f42e7e75daa8c268204beec1fbc58cbbe3317af0993a8676dfdb13db7875f50cebdbc629bcd605dd4c4a65c31870495fb9a9ec51c1867ca8b117a6f9507aa26cee54c4c12f8f22b9d88072639ad765bb7906435128d1c146b9e2029880eccbdf78449bd0630381ad16c13444d709a11890d80fae0d24c037180a8726143306a7cd67abbc830167f524008f9a8e3172df597a63af2e87a92e90b70ce53069657f9b46acc9da241a1b00571540ec5fed4a9acfdd0066ba248cb2bf24540d7296256d4c9a5a5bc821817ada912cdde59876d86d4c53c1d047c6bc3442c2ee78326d7c51b6d01bd4f7ff5bc45db88649220d44099b406ac2e4744996b869ea688ecb4e758e755b29717869d5dfccbf5fd553ad83de0c4cd16b3fd4913451734226e4cf29bc0a860943b3e854d8cf49f07d2bfba1c280efaa85bb8f0f8818d1e58178c338c9e46c873adc0a4b6c832aaf0878956d8a04fcc043ff307f60a263cf1bc57ad0434b6a6f99075d932ff75deb8b017cbd16b272139a4addc24749d9551ba44d5bef0536e58de5e9d0b8985f1044163d542859c699f27f033b01d1e5d4c5598bcc4279f29c56eca82cf40c3b2799277e9b0aea04ba5cdd679e3eb63ceb0eafc21c373356caadc0f5730054a0979d7e32117962af0444b7e0e75bf1d30fd1af656956367bbbddf018531833f6c383b76cd63d014c91f67b41548e558cfae6a953a78c36ba3a896b3a0bf48aaa947d042a456a48c8f323682f560f2679f53578f00746cb04c4ef12b905b37f1b1bac9c75a85d6f173d531198f150ee6dbe7fcdbed4e0baf7610b82a793c17124970924ae32c86f9b7b40a229219958cd2445fca613e264adbf29644b1f405c68ef8afff7f4c1dc86f0e578e3716fa86c53f776dc42e7d28978f1e694428560b923b5d44e3aacb18cb38d3efd90ca0812027d336b011557e9e953cbff769e9ba84b903f5fcf1e6b4ab3e210ceaac574f80607116b196b6ded8668729f9be216bfdd049e88d1cb45581701c6ca7c991488a73e6ae5decdfc6416fa69b76f82e92246ee2b29c91885be24e96ea72438499c5c421ffd199f172667adf7d257947bb47945817930a7f2f0dfc73c2a5f6002fd40b9ea51c4a0c610e9759d43c082ed0c126c0de63c5a079b4c8bac46fcc8a1f74d8929ee2b7878430e3caed5f5aad7378fcbc4d659144a7cdbd654185ffdabd9b36257993ca823990df4aa7809ee58b7a278f38085202f3618fefef67f71b39f8ed35a28b3ff47e6caa3cecdbb41b899ea7ef3179ec3d67d0e3380f61d5a57453b9b790d171e1838c68f988a6914f4b81a7a12a0f50612182de8844a5f18026bc4110a10a31a88dae4bb40a3fea22360830784cf82ccde8187d04635e7e5bc6cda8252fa77d7022ae5fdeb978315f925cdbe7cbe0e3894965795fda4b94068bee89f79f86c420b211411929b9b3074703583c0ba0703a4d282441495110dd167c228079db163febc9ea0bcb02ab400999abfecfbca274fca55a055859eb256fcddc1d1773d72d5c3793ca3ff5f2fbe647b04f5ff2b2dc50a3a897e03634a36d21e391e6b6290cf85064711600de9a74057b78d9c04857017bc762300872f674eed1b68fac65025f3252bb803a9ff8ccf4b2b49028622168439db3bc01ea9ae7618b73dc7f858ba388891da14b88f7fee4f5f49abd687ba947969b8b923c2e119fe172126835ab4d1429133a38bbb80f1f6c308ffd180a179c05d9fb112a70e7658f9e3c7b6545556726e6589ba479edf21afd08da62963b5b724fa7b618c27fba201297dd465217de92395734355e9b34e27ff4916d78dbe0424df3d6110297a7847efda2675f12a3bf5e4b07827cdae6c61b0d969f6bb15be656b394a3f3ca8d705a4cac9c78c66c4be58c40888d49ceb08eb9a90c230faace7e4c837a8cb1aa69b020f9f43532cb7315cd698dfffb0179fb24e135480af4c437170c010e6e8f94108523dca95598c59b9e483753b79bafb02a455ceec727fd271b4cb4af7d958751a747afe6625c1e8b0316af5e13e42dc8d97dc42d5960edcaa391164693250a6f98653fa20c78823e1c1a77b798491f197a647b291cdd04087b3143e5b0fc550ecbbff19666b1c8e2a5bf2cb40f9f54c11828a8dd16489f36583e3128cda7a9abde8abbf61294450af638f56444176b5a11f84e67e4e666d6df58c45c0adc45938a2639fb1717a44c8dedf8471ac82fc1771a704f778fb812acb953493a831be5b28b16b20a112aafcee4e44640a6653c4b3035d5de4fcc16312057046bc3c650057dd9be4450b3e837ff8ac19019e67550a124416d671ccc76de36946c2d91f3d63b212111f4f09f39c24c1a981a7e63dd37a8d94ebfae1df5796d971193a8c723f172a9266af23d1d0e48aae73de4e7545a13f09a1ae3feb147ba1c700776148f027abc7dbdd1f3cb823b9a4c0e9dd43fd0bc411dc3eac2369f10fc9669ffaec5ef76da6b7f8884430b3a00da63a0e5272de159ea047584f4804a14159b1321309db45c55af563081d126300dc3ac446936f6653db92fc09d225716f425997dc247939b8c1e09a11f8b10c36b671cc590922051871ce19f6db85eefac9a666c3cec6fd5a69e7610ae5123413b458024b02521420d8c50c265d7b763f070b8fd1981824da47079135a667ee2395e43cae172e6a5ae96aeb7ce490212792498e427b80036f52cc557d3f94b118b2248af9a75a6d27d084ba423edc616981864cb0069a06f359a953a6e7df6b765d222626030248253e4e93eb0979b0a5550ee15d1489f56cc1d30b1584f37b51dfa029af5b45a85b141f4f8ffdc809a19e01f22f80c8a11e9d35f790a6de2d898462a19f412de4df26896a3d107baa7a661b5482cd71453b5f88f889b93ee6df84363ecaf04cb0dcd4369f9d1a827b955182334a998e8f2edbfe74beb14e9ff50134f03d24d70b068801684e25370c1cfc065d88582389713500f974e8a6c6e7f015b8e84e5b9861e45d4ce4eef79f0e8d4f15eaf7c1b33e64287470b5b3c0b8b6bdadae567f977341b57486c1eb279be8ee1cdf11b6e0dbd42d32c95b6801cea98e6000ea80777c6ad3f62012732859497080b3aa127a0f3a7b80a99182406ccfd54affb463f8eaf01b0c65ab582628b3c2237d039ee68d307dd113e4b593b243bd64eb6f58a0ccdd8e9a78f9ed393e2affde8d616d57c7aa1d12ebb4be718b49843ec6a90d5d8c197f154f27805046c410d4e1b66cbf4a8e495a3a229a2a1d58b4909a240d7ae6ea9e740c055b06e756e57e2ff19c148cbaf37357c0d3273b7f2ec631565e9f6c6c8722ddb0c1180695fb204f35917dc2fe11469801c545b2560a59d0666ec129b88e4f427989e820982329c2c39321f25648666af651f87b495195a95a5d158fd161324796272303114d99d22890385853dbc66d37ce22de0db447260217cf51aaed240e4f4963ca7510522fc6e7dbe164ccdedc334787ddb24bbc8205bf3353d447a1de2407c248775fa7e318d83e3ff18150b3cd9a7cbb0df0703aab6ef8d0f71bf9b5a305dc25fbd200e06b73c7f298320bd90dab05ec62b5f885e7cf95274c656051c71628f31196354460b001b6366c26fd2e92f6ad68ea37d7e3fe91fe98223563b4d23f802b3911a5241a793cb9f5b4f80081ace5877f95da7499f728ab09837120ca75c63d725e46f9f77c3da16318c9bcdd4a9d68379b627c1a71a34b684e5614ab3fabceab8d2741aca921b1b018098060686c56d7ed190e7470f529f6e680ed72e749fe7c9c2f37ea8cf08d4520e496361d2437018bbda93396c05abb2aeba443ea1ee56a3da04a8b880452a3610cb4163154e02df8a08a5e48c03fb0b0cdd4d355142cc736b344b9fd987b49b85791e5bf7805250dfe63b04c7ff56608129ef43664aa2acf82f18b49cdfd2ae5551ea4d486b35cd2ea60e3f032c58f531d4d36054f5ce268a29862ded0a3cc0ff1d30882f7c85b95e9a8599bf1d143d2d25555bbaa6f8b673b76ca8cc17b693519194784833d902581fec4e656ca546eade53abfd7e4650df648cb61a146bef5382f9255bf4a7c380854568495bdb7b33f490d240ead3d1851ce3b6400eda5a370f13ec998605f46b234bc9293c026bd1d648647bf52d506deb522012ae89c4ea75414ae6677c4aef28dd756f877af23d1a5ae3cb2205850c14f27f595d1a1542bb1eaf641293e3ba40e0bb54193a1e5db969d37c97709efbc34ab509f08a51ba71ecc4f9f66c27190115948cffaae914e7eb4e8d0c59ef7368e9b08a05bbbd340e1c1d34319f150d299c0ddf3bb2138359e826f4997068b99d13cc454fea46b8664d413b79b19656d62cbb5b31744aa33f99651fa56703eaec2e6998c7321f69f6cd110c89ae0c612a96f9a84dd751fd81ff66c80563e7091f5c5b67f89d52e7c58eb26218cddeaf5c6def3ad07a610bd4e5785675580c199b8550cbb02e3b4e1d240bb8df8e514fb505f39fd222209584331bef5d271056accaef84c88741ebd9f116cce3fe7b07b78ac4bad346c0d6e71c9daecd8d60aa8ea0914f85c9078dfaff04ba5e9bbbacddbc0cb40fe20f869d7f196c5edb6657c50b82c67f1abab663bff0a8da16422fe31a4a17995ee25081a06154d1c03f1a87a9d4ad5141a9227849bd920d2515ca16a245b635c85a77884cce0b8ae56929b5e22c52f971c2eed4ccfd64f7790a616f719fc0305af71405abae9407ed1cdaa26606331fdcf9b3c19b90e561f646ea15e0e668ef37b349594a335baf26962b89ef33c98aec3ca3e7df47c20dc2928d074e5f87c0edcf37cb25d3b8304f57f8257a5ae96791697e3c6d04f4ec2eb6a69f25346defed5b509368dea2b1960218bc6dd21b567583c229fc7b5fc85f7f2032eb304c3a1f72204f75ee950344cdef846d94e916b29a43d00c789256810de5fff6f9fd1af0fcfc2edd3fff9e2010d88083fc0b9e6a291e9a7a08af62433689a39e34bed8dafc90fec82be5c63a843d82132ce8916e395791dc86c8d11caf57f7fd096c28537ec38d6c14df9782312abc85fba2d04b0b159637b0e09f7e9faa1a6136359d17cf7c58b83994d58674ddbc248b804a82156900ca95a5002ef62de046e2f5ddf8e1e19f00189d4f5169bfc3c67afc149c6bc155767e64eac433cfb787be7f7bae7f869c0ec3d142668c2f90d383af7207a635850c515d69c6a62e24e0d58c5da244a917a17caa6be01992c4f8be0b9fff57522db4756840bdf72cafa6061ff2b86305c180c470b3af589e7c9e5328d98cf737bf01d80762e1e41a4d63a8655387be7f295862fdea629aa97b40c2ba1b563f1a103a860f7dff7fd5ee8423ce3dbf0fad41b66965c67299e35483130d461ac6c68215850fd441323bb856cdf03f624520743f7b445641c72e08994c8f252fe179b29226637b533f0ed6c94a0b84efc1a884af940fbc05c654b59d37a54047de233c496103bb27b657e7f63c24ef3ce29709622f67653f398dc7c4e44", 0x2000, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0xb0, 0x0, 0x0, [{{0x0, 0x0, 0x0, 0x8000000000000}, {0x0, 0x0, 0x6, 0x0, ',/&\\&-'}}]}, 0x0, 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000240), 0x14) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000400)={@empty, @multicast1, 0x0}, &(0x7f0000000440)=0xc) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000480)={'ip_vti0\x00', &(0x7f00000007c0)={'syztnl1\x00', 0x0, 0x80, 0x10, 0xb603, 0x9, {{0x26, 0x4, 0x0, 0x1, 0x98, 0x64, 0x0, 0x9, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x1e}, @loopback, {[@rr={0x7, 0x1b, 0xf8, [@dev={0xac, 0x14, 0x14, 0x43}, @remote, @remote, @broadcast, @dev={0xac, 0x14, 0x14, 0xe}, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @lsrr={0x83, 0x5, 0x15, [@private=0xa010100]}, @timestamp={0x44, 0x4, 0x7d, 0x0, 0x6}, @generic={0x86, 0xe, "0344dbe534b7e8e44783e029"}, @noop, @end, @timestamp_addr={0x44, 0x2c, 0xde, 0x1, 0xd, [{@dev={0xac, 0x14, 0x14, 0x3a}, 0x2}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4}, {@dev={0xac, 0x14, 0x14, 0x29}, 0x81}, {@broadcast, 0x4459}, {@remote, 0x8ae2}]}, @ssrr={0x89, 0x1f, 0xe7, [@rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, @local, @local, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast]}]}}}}}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000004c0)={'macvlan1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000500)={'syztnl1\x00', &(0x7f0000000580)={'ip_vti0\x00', 0x0, 0x10, 0x10, 0x165, 0x0, {{0xd, 0x4, 0x3, 0x3, 0x34, 0x66, 0x0, 0x5, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x10}, @rand_addr=0x64010100, {[@generic={0x44, 0xa, "c0c5391fd501b6f1"}, @ra={0x94, 0x4}, @generic={0x89, 0xf, "411d5f83bae438647ec79d28e7"}, @end]}}}}}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000680)={'wg0\x00', 0x0}) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000006c0)={@empty, @dev, 0x0}, &(0x7f0000000700)=0xc) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000940)={'syztnl0\x00', &(0x7f00000008c0)={'ip6tnl0\x00', 0x0, 0x4, 0x1, 0xd4, 0x4, 0x48, @private0, @remote, 0x7, 0x7800, 0x1, 0x4}}) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000980)={0x16c, 0x0, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}]}]}, 0x16c}, 0x1, 0x0, 0x0, 0x24044000}, 0x4004010) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000200)={'tunl0\x00', &(0x7f0000000c40)={'ip_vti0\x00', r10, 0x80, 0x0, 0x4a8, 0x7, {{0x17, 0x4, 0x2, 0x3, 0x5c, 0x68, 0x0, 0x63, 0x0, 0x0, @dev={0xac, 0x14, 0x14, 0x35}, @empty, {[@rr={0x7, 0x7, 0xff, [@local]}, @cipso={0x86, 0x2a, 0x2, [{0x5, 0xf, "6c6e41fc2dd5f33abf13df7795"}, {0x1, 0x5, "a19c96"}, {0x7, 0x10, "dbc6d6dbb96c883ae0067e30f490"}]}, @timestamp_prespec={0x44, 0x14, 0x8c, 0x3, 0xa, [{@dev={0xac, 0x14, 0x14, 0x2c}, 0x6}, {@broadcast, 0x4}]}]}}}}}) getdents64(0xffffffffffffffff, 0x0, 0x2000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) r14 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.empty_time\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r14, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ff9000/0x4000)=nil, 0x4000}, 0x2}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000001000010400"/20, @ANYRES32=r13, @ANYBLOB="0000000000800200380012800b0001006272696467650000280002800c002300fbffffffffffffff05002400000000010500240001000000060027"], 0x58}}, 0x0) 6.473979026s ago: executing program 3 (id=5205): socket$alg(0x26, 0x5, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$kcm(0x10, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000300)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a0010000600028000001294", 0x2e}], 0x1}, 0x0) 6.25169898s ago: executing program 3 (id=5206): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x458, 0x4018, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x2}}}}]}}]}}, 0x0) setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, &(0x7f0000000200)={0x2, 0x0, @multicast1}, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000100)={0x0}) memfd_create(0x0, 0x0) pwrite64(0xffffffffffffffff, &(0x7f0000000380), 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc038563b, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, 0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0x0) symlink(0x0, &(0x7f00000000c0)='./file0\x00') socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) syz_open_dev$midi(&(0x7f0000000400), 0xb6, 0x48801) syz_io_uring_submit(0x0, 0x0, &(0x7f00000009c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x6, 0x0, &(0x7f0000000040)=[{0x0}], 0x1}) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f00000005c0)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}, 0x45c) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(0x0, 0x22) syz_emit_vhci(0x0, 0x0) ioctl$MON_IOCX_GET(0xffffffffffffffff, 0x40189206, &(0x7f00000002c0)={0x0, &(0x7f00000003c0)=""/122, 0xffffffffffffff61}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102377, 0x18fe9}], 0x1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000029c0)={0x0, 0x0, 0x0}, 0x0) 5.970065826s ago: executing program 1 (id=5207): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/disk', 0x149a82, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000001140)={[0x7]}, 0x8, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ifreq(r1, 0x89a3, &(0x7f0000000000)={'bridge0\x00', @ifru_addrs=@l2={0x1f, 0x0, @fixed}}) capset(&(0x7f0000000380)={0x20080522}, &(0x7f00000003c0)) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000740)="58000000140019234083feff040d8c560a06580200ff000000000a000020ffff00000000000064009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100070c100000000200ffffffff", 0x58}], 0x1) write$cgroup_int(r0, &(0x7f0000000040), 0x12) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x4, &(0x7f0000000340)={@local={0xac, 0x2, 0x44, 0xa}, @private=0x5000000}, 0xc) 5.817099683s ago: executing program 1 (id=5208): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000491000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000140)) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) write$sndseq(r2, &(0x7f00000005c0)=[{0x6, 0x0, 0x0, 0x0, @tick=0x1000, {}, {0x0, 0x3}, @result={0x6, 0x2}}, {0x0, 0x0, 0x0, 0x0, @tick=0xb35, {}, {0xfd}, @queue}, {0x3, 0x0, 0x2, 0x0, @time, {0x4}, {}, @note={0xdc, 0x4, 0x8e, 0x4, 0x9}}, {0x0, 0x3, 0x0, 0x0, @tick, {0x0, 0xff}}], 0x70) r3 = syz_usb_connect(0x2, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e5cf01406e0510401c20000000010902120001000000000904"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000dc0)={0x84, &(0x7f0000000740)=ANY=[@ANYBLOB="20059f000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000c40)={0x40, 0x21, 0x1}}) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000440)={0x44, &(0x7f00000002c0)=ANY=[@ANYBLOB='\x00+2'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) socket$igmp6(0xa, 0x3, 0x2) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x1, @dev={0xfe, 0x80, '\x00', 0x22}, 0x14}]}, &(0x7f0000000140)=0x10) listen(r5, 0xfff) r6 = syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0) ioctl$EVIOCSMASK(r6, 0x40104593, &(0x7f0000000080)={0x0, 0x0, 0x0}) ioctl$EVIOCSKEYCODE_V2(r6, 0x80104592, &(0x7f0000000040)={0x7, 0x2, 0x0, 0xf773, "00207d200000001200000000000900"}) accept4(r5, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000001180)) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0xb, 0x12, r4, 0x0) r7 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r4, &(0x7f0000000180)) 5.694470901s ago: executing program 4 (id=5209): socket$packet(0x11, 0x3, 0x300) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0xd6, 0x0, 0x32}, 0x9c) bind$inet6(0xffffffffffffffff, &(0x7f00004b8fe4)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) prctl$PR_SCHED_CORE(0x3e, 0x80000000000001, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) pivot_root(0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x0, @dev}, 0x10) r3 = socket(0x10, 0x3, 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16], 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000080)={0x5}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) syz_open_dev$dri(0x0, 0x0, 0x0) mknod(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x6, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x7a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1e, 0x2004, 0xe5, 0xa5f, 0x0, r0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0x14, &(0x7f00000004c0)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0xbf) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(r5, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0xfd73) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000040)) 5.489414005s ago: executing program 0 (id=5210): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000940)=@newqdisc={0x24, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@delchain={0x24, 0x66, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0x0, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x4, 0x70bd28, 0x25dfdbfe, {0xa, 0x0, 0x9, 0xfd, r1}, [@IFA_ADDRESS={0x14, 0x1, @loopback}, @IFA_ADDRESS={0x14, 0x1, @empty}]}, 0x40}}, 0x0) 5.071904594s ago: executing program 0 (id=5211): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, &(0x7f0000000040)=@keyring) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0xffff, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0xd000}) ioctl$KVM_NMI(r3, 0xae9a) bpf$BPF_LINK_CREATE(0x8, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff, 0x7, 0x0, @val=@tracing={0x0, 0x200}}, 0x40) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r4 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$CAPI_GET_PROFILE(r4, 0xc0404309, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f00000000c0)=0x1, 0x4) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) write$binfmt_aout(r5, 0x0, 0x420) close(r5) r6 = openat$pidfd(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) pidfd_send_signal(r6, 0x0, &(0x7f0000000080)={0x0, 0x0, 0xfffffffd}, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000100)) epoll_wait(0xffffffffffffffff, &(0x7f0000000040)=[{}], 0x1, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_usb_connect(0x0, 0x172, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000e6bef1403c419681e01f0000000109026001010000000009049a0000020600000724060000ba4f05240004000d240f0108000000ff0f0000ff8e2413fed57d0cc0e1305e327d1adda7b5b7e76f1fade54a9533e6d2669f06967acff2c14b25d20551e26f3a9180ec68248b55c17b65dd2b8cbf151af1da9cbce5463cae0b36cd9340ca75b95beea676dbdb9d0dae12f6adfebe9f88e6b25453cf88ac4e45100877fe7eae65aa050dac42bf4f7201f91087dac488c4aa95765ffad55f53837d8788855a81ad4119742413"], 0x0) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) mincore(&(0x7f0000996000/0x2000)=nil, 0x2000, &(0x7f0000000100)=""/111) 4.22660571s ago: executing program 2 (id=5213): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a000090400000103010100092100080001220100090581"], 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0xb3, 0x0, 0x0}) dup3(r1, r1, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ipv6_route\x00') lseek(r2, 0xae7e, 0x0) 3.296137994s ago: executing program 3 (id=5214): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/disk', 0x149a82, 0x0) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000001140)={[0x7]}, 0x8, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ifreq(r2, 0x89a3, &(0x7f0000000000)={'bridge0\x00', @ifru_addrs=@l2={0x1f, 0x0, @fixed}}) capset(&(0x7f0000000380)={0x20080522}, &(0x7f00000003c0)) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000740)="58000000140019234083feff040d8c560a06580200ff000000000a000020ffff00000000000064009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100070c100000000200ffffffff", 0x58}], 0x1) readv(r1, &(0x7f0000001200)=[{&(0x7f0000001180)=""/116, 0x74}], 0x1) write$cgroup_int(r0, &(0x7f0000000040), 0x12) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x4, &(0x7f0000000340)={@local={0xac, 0x2, 0x44, 0xa}, @private=0x5000000}, 0xc) 2.423264006s ago: executing program 4 (id=5215): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000100)={'#! ', '', [{0x20, 'blkio.bfq.io_serviced_recursive\x00'}, {0x20, '#! '}, {}, {0x20, '%}@\x14.-$'}], 0xa, "492ef7148b13888d3b8662c9bc71ffa014b0f54bd03b92598dcb4b1abc4cf1f884c84bf3716e9c7f3c5fb7bbed04a23cbe786192cc156096dc5e711251cbb30db8ba77c56b1e4363397ba8ed789b82576c105aa1c9c32d944aeaed3eae16918415d5afaecb4f9321c101010000dc0e9707d9c0b70ce0398047ebe5abd4f65d195795da32110537afc911c7ba1449582e8638638acec039a9904ca8ae09e17d0dd27982ce61c6e4a8823abd7100abb9494debc9337c259b833e6659c02e34792748fffb12f0c2a1acc158a0801f26976118d24f92cb311460eba1a75ce481c9fd4c661609f20aa183ab1cd2"}, 0xfffffffffffffeb1) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) 2.377028971s ago: executing program 2 (id=5216): r0 = socket$inet6(0xa, 0x6, 0x7) bind$tipc(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x80) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r0, 0xc0605345, &(0x7f0000000080)={0x1000, 0x0, {0x3, 0x1, 0x6, 0x1, 0x5}, 0x3}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x0, 0x16, &(0x7f0000001180)=ANY=[@ANYBLOB="61154400000000006113500000000000bfa00000000000001503000008004e002d3501000000000095004100000000006916480000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffbd4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0a"], 0x0}, 0x90) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r4, &(0x7f0000000040)="aa", 0x1, 0x0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) shutdown(r4, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x19, &(0x7f0000000cc0), 0x8) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1400000010005f010000000000000000000000000a1c010000060a95b87d3f8bebe8777e8579bc3a60f80e0b040000000000000000020000002c000480280001800b00010064796e73657400001800028008000340000000000900010073797a3000005c69eaa1537391793eda0000090001007379743000000000cd00074013213a49135b987d2179d2420ca0f8ca1095ede85583fbb19da9fe513f7d31d08858627febcc2d1fbd38fe47af78d7ddec8285eaf8ce40ceeadb3b985a1901f721c81b8000084e0600000000000000fd1b93b3899bb22a01bb3eb70820c9d40da2ef22ea16b45d6e4d1a813a16747f67d80ec37215c31c407da4eb1766782f2a7063b10b337f3d89f29f259dea7beaf3cb4fa8fbe034cd3e4d6a3dc54fb5060097970ff4b9b98b70d30f423718db4b1053bd05c6791ee6d6229fe6004527ff000000140400007b00000000000000000000009828cc5743c007e72843beaf1e565c7f00e7a36d35bebfe397a8e84df3a666cb6079b56e9ac6fb46169a6b9ad3a55f22c301b57b3c256d2241b68636536ac95f8f279592a17004b659a952be97f4bc610e4b368e9347e2921826e777f7a786c6efc6bd2390315e2b9844e3c7510f31d26ca4b9edc7dc"], 0x144}}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905"], 0x0) ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000100)={0xc1, 0x0, 0x3}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r1, 0xc0045520, &(0x7f00000001c0)=0x34) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000280), r2) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYRES64=r3, @ANYRESDEC=r0, @ANYRESOCT=r3], &(0x7f0000000100)='syzkaller\x00', 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='kmem_cache_free\x00', r5}, 0x9) r6 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$restrict_keyring(0x1d, r6, &(0x7f0000000180)='rxrpc_s\x00', &(0x7f00000001c0)='\'\x00') socket$nl_generic(0x10, 0x3, 0x10) pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r8, &(0x7f0000000280)={0xa, 0x2, 0x0, @loopback, 0x9}, 0x1c) ioctl$UI_SET_PROPBIT(r7, 0x4004556e, 0x6) sendto$inet6(r8, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5dac14e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xadf29f33fb903ae1, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) shutdown(r8, 0x1) 2.062573978s ago: executing program 4 (id=5217): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/keys\x00', 0x0, 0x0) r1 = add_key$user(&(0x7f0000000100), &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="ed", 0x1, 0xffffffffffffffff) getsockopt$inet_buf(r0, 0x0, 0x23, &(0x7f0000000000)=""/74, &(0x7f0000000080)=0x4a) keyctl$set_timeout(0xf, r1, 0xfffffffffffffffd) read$FUSE(r0, &(0x7f0000001580)={0x2020}, 0x2020) 1.894392823s ago: executing program 4 (id=5218): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/disk', 0x149a82, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000001140)={[0x7]}, 0x8, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ifreq(r1, 0x89a3, &(0x7f0000000000)={'bridge0\x00', @ifru_addrs=@l2={0x1f, 0x0, @fixed}}) capset(&(0x7f0000000380)={0x20080522}, &(0x7f00000003c0)) socket$netlink(0x10, 0x3, 0x8000000004) write$cgroup_int(r0, &(0x7f0000000040), 0x12) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x4, &(0x7f0000000340)={@local={0xac, 0x2, 0x44, 0xa}, @private=0x5000000}, 0xc) 909.677721ms ago: executing program 3 (id=5219): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) io_setup(0x6, &(0x7f0000000240)) preadv(r0, &(0x7f0000000580)=[{&(0x7f0000000640)=""/102396, 0xfffffd6e}, {&(0x7f0000019740)=""/242}], 0x2, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) syz_open_dev$video4linux(0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) semop(0x0, &(0x7f0000000000)=[{0x0, 0xffff}], 0x1) write$sysctl(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r2 = socket$isdn(0x22, 0x2, 0x25) r3 = socket$isdn(0x22, 0x2, 0x22) r4 = dup3(r2, r3, 0x0) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a34000000090a01040000000000000000010000000900020073790900010073797a3000000000080005400000001f140000000000000aa0b9f3a3c240cb7840415fdf504ae3631447138cf037d3"], 0x5c}}, 0x4000000) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x8080, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000000), 0x0) ioctl$KVM_RUN(r9, 0xaece, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000500)=[{&(0x7f00000003c0)=""/120, 0x78}, {&(0x7f0000000440)=""/107, 0x6b}, {&(0x7f00000004c0)=""/28, 0x1c}, {&(0x7f0000019840)=""/4096, 0x1000}, {&(0x7f000001a840)=""/172, 0xac}], 0x5, 0x3, 0xa) sendmsg$nl_route(r5, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=ANY=[@ANYBLOB="6400000010001fff00"/20, @ANYBLOB="0000000000000000440012800b000100697036746e6c000034000280140003000000000000000d000000000000000001050006000000000014000200fe80"], 0x64}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000380)={'wg2\x00'}) 846.70592ms ago: executing program 4 (id=5220): connect$inet6(0xffffffffffffffff, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x300, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600)={&(0x7f00000002c0)={0x50}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xa1ff, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000001000010400"/20, @ANYRES32=r2, @ANYBLOB="0000000000800200380012800b0001006272696467650000280002800c002300fbffffffffffffff05002400000000010500240001000000060027"], 0x58}}, 0x0) 162.551076ms ago: executing program 4 (id=5221): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4048aec9, &(0x7f0000000080)={0x6}) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="17090000000000000000010000000500070040000000080009000000000008000a0000000000060002000000000014001f00000000000000000000000000000000001400200000000004000000000000ffffac1414bb06001b000010"], 0x64}}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sm3\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x0) sendmmsg$inet6(r5, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0, 0xfdf0}}], 0x1, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r5, &(0x7f00000006c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000680)={&(0x7f0000000580)=ANY=[], 0xdc}, 0x1, 0x0, 0x0, 0x40000c0}, 0x4004005) set_mempolicy(0x6, &(0x7f00000003c0)=0x8000000000000001, 0xe0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) r7 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) r8 = signalfd(r6, 0x0, 0x0) ioctl$GIO_UNISCRNMAP(r8, 0x4b69, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="002222000000962313839fea28c8931e8503e82a703187060000007c000000000000009393cb2e"], 0x0}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r9, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x30}}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x401}, 0x90) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000399000/0x4000)=nil, 0x4000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) r10 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r10, 0x0, 0x0) 162.228007ms ago: executing program 2 (id=5222): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140), 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {}, {0x2}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000600)={'#! ', '', [{0x20, '\x00'}], 0xa, "0b22659f293be856d9175b6a18b65c897709ac7903ba057e769dc11b72a564b2607aac587653422d8363e52441cff5a9ae5cb1097cf709a9c29389b903003a310000333f0178d49946ea8c9a755942e1c2fd66108bc3ce78b3806b763f013c51f544a1083dd403aabc8abf17fb7eb65f3c4c958b0183f3b78acfb17b8f85fad583d62fb6f538582e804d2d3149d96d4e7428"}, 0x98) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r2, 0x0) r3 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc0205647, &(0x7f00000000c0)={0xf010004, 0x9, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f906}}) socket$netlink(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0xffffffffffffffca, &(0x7f0000000040)=0x10001) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) preadv(r4, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYRES16=r7, @ANYBLOB="050000000000000000004400000008000300", @ANYRES32=r8, @ANYBLOB="1400238005000e00000000000600100095a4"], 0x30}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'veth1_virt_wifi\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_CREATE_SOCKETS={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x40}}, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) 0s ago: executing program 1 (id=5223): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000380)={0x0, 0x4}, 0x8) sendto$inet6(r0, &(0x7f0000000040)="aa", 0x1, 0x0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0) pwrite64(r3, &(0x7f0000000280)='+', 0x1, 0x0) unshare(0x2c020400) unshare(0x22020000) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x551203, 0x0) r4 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) copy_file_range(r4, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffff8) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x70}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=@ipv6_newroute={0x30, 0x18, 0x20, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0xfe}, [@RTA_GATEWAY={0x14, 0x5, @private2}]}, 0x30}}, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000002c0)={0x0, 0x0, 0x2}, 0x8) kernel console output (not intermixed with test programs): 29610][ T8] cp210x 1-1:0.0: querying part number failed [ 1554.563710][ T8] usb 1-1: cp210x converter now attached to ttyUSB0 [ 1554.686718][T11914] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 1554.746599][ T5294] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 1554.782312][T20731] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1554.800125][T20731] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1554.813383][T20731] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1554.842404][T20731] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1554.850931][T20731] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1554.859862][T20731] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1554.888815][T11914] usb 2-1: Using ep0 maxpacket: 16 [ 1554.899030][T11914] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1554.915630][T11914] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1554.926317][T11914] usb 2-1: New USB device found, idVendor=1294, idProduct=1320, bcdDevice= 0.00 [ 1554.935964][T11914] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1554.944350][ T5294] usb 4-1: Using ep0 maxpacket: 8 [ 1554.966287][ T5294] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 1554.990974][T11914] usb 2-1: config 0 descriptor?? [ 1555.017190][ T5294] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1555.068334][ T5294] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1555.088609][ T5294] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1555.126448][ T5294] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1555.156515][ T5294] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1555.200807][ T5294] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1555.514667][ T5294] usb 4-1: usb_control_msg returned -71 [ 1555.523355][ T5294] usbtmc 4-1:16.0: can't read capabilities [ 1555.526576][T25375] chnl_net:caif_netlink_parms(): no params data found [ 1555.542171][ T5294] usb 4-1: USB disconnect, device number 55 [ 1556.013733][T25375] bridge0: port 1(bridge_slave_0) entered blocking state [ 1556.033335][T25375] bridge0: port 1(bridge_slave_0) entered disabled state [ 1556.055183][T25375] bridge_slave_0: entered allmulticast mode [ 1556.092813][T25375] bridge_slave_0: entered promiscuous mode [ 1556.123598][T25375] bridge0: port 2(bridge_slave_1) entered blocking state [ 1556.148220][T25375] bridge0: port 2(bridge_slave_1) entered disabled state [ 1556.171024][T25375] bridge_slave_1: entered allmulticast mode [ 1556.192814][T25375] bridge_slave_1: entered promiscuous mode [ 1556.357398][T25375] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1556.425824][T25375] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1556.651014][T25375] team0: Port device team_slave_0 added [ 1556.747219][T25375] team0: Port device team_slave_1 added [ 1556.916796][ T5248] Bluetooth: hci0: command tx timeout [ 1556.924568][ T5308] usb 1-1: USB disconnect, device number 15 [ 1556.970549][ T5308] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1557.041007][ T5294] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 1557.086874][ T5308] cp210x 1-1:0.0: device disconnected [ 1557.094558][T25375] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1557.123919][T25375] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1557.211483][T25375] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1557.267463][T25375] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1557.286769][T25375] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1557.324778][ T5294] usb 4-1: Using ep0 maxpacket: 32 [ 1557.370847][ T5294] usb 4-1: New USB device found, idVendor=a97a, idProduct=5131, bcdDevice=c0.00 [ 1557.396432][ T5294] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1557.415496][T25375] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1557.427009][ T5294] usb 4-1: Product: syz [ 1557.431264][ T5294] usb 4-1: Manufacturer: syz [ 1557.435907][ T5294] usb 4-1: SerialNumber: syz [ 1557.488002][ T5294] usb 4-1: config 0 descriptor?? [ 1557.523319][ T5294] usb-storage 4-1:0.0: USB Mass Storage device detected [ 1557.634222][T11914] usbhid 2-1:0.0: can't add hid device: -71 [ 1557.654804][T11914] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1557.773194][T11914] usb 2-1: USB disconnect, device number 27 [ 1557.846308][T25375] hsr_slave_0: entered promiscuous mode [ 1557.888060][T25375] hsr_slave_1: entered promiscuous mode [ 1557.906622][T25375] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1557.946708][T25375] Cannot create hsr debugfs directory [ 1557.962888][T25400] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4786'. [ 1558.324305][T25409] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4789'. [ 1558.585114][T25375] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1558.706761][ T5294] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 1558.753867][T25375] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1558.781430][T25415] netlink: 'syz.0.4792': attribute type 4 has an invalid length. [ 1558.926501][ T5294] usb 2-1: Using ep0 maxpacket: 16 [ 1558.938696][T25375] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1558.940952][ T5294] usb 2-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice=93.b9 [ 1558.969547][ T5294] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1558.982875][ T5294] usb 2-1: Product: syz [ 1558.987762][ T5294] usb 2-1: Manufacturer: syz [ 1558.992786][ T5294] usb 2-1: SerialNumber: syz [ 1558.996763][ T5248] Bluetooth: hci0: command tx timeout [ 1559.001241][ T5294] usb 2-1: config 0 descriptor?? [ 1559.060297][T25375] bond0: (slave netdevsim0): Releasing backup interface [ 1559.069149][T25375] netdevsim netdevsim2 netdevsim0 (unregistering): left promiscuous mode [ 1559.083374][T25375] netdevsim netdevsim2 netdevsim0 (unregistering): left allmulticast mode [ 1559.088174][T16400] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 1559.099643][T25375] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1559.286478][T16400] usb 5-1: Using ep0 maxpacket: 16 [ 1559.303162][T16400] usb 5-1: config 0 has no interfaces? [ 1559.307979][T25375] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1559.322080][T16400] usb 5-1: New USB device found, idVendor=0582, idProduct=05e6, bcdDevice=4e.00 [ 1559.326439][T25375] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1559.346184][T25375] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1559.354861][T16400] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1559.363470][T16400] usb 5-1: Product: syz [ 1559.367829][T16400] usb 5-1: Manufacturer: syz [ 1559.372496][T16400] usb 5-1: SerialNumber: syz [ 1559.380534][T25375] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1559.387904][T16400] usb 5-1: config 0 descriptor?? [ 1559.578257][T25375] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1559.639025][T25375] 8021q: adding VLAN 0 to HW filter on device team0 [ 1559.661327][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 1559.668578][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1559.686065][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 1559.693352][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1559.712259][ T8] usb 5-1: USB disconnect, device number 21 [ 1559.893985][T25375] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1559.944254][ T5308] usb 4-1: USB disconnect, device number 56 [ 1560.025499][T25375] veth0_vlan: entered promiscuous mode [ 1560.060790][T25375] veth1_vlan: entered promiscuous mode [ 1560.149133][T25375] veth0_macvtap: entered promiscuous mode [ 1560.163696][T25429] loop6: detected capacity change from 0 to 524287999 [ 1560.180862][T25375] veth1_macvtap: entered promiscuous mode [ 1560.186894][ C1] blk_print_req_error: 7 callbacks suppressed [ 1560.186912][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1560.202270][ C1] buffer_io_error: 7 callbacks suppressed [ 1560.202289][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1560.216305][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1560.225758][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1560.236301][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1560.245631][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1560.258217][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1560.267445][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1560.276872][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1560.281765][T25375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1560.286307][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1560.308930][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1560.316435][T25375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1560.318205][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1560.338879][T25375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1560.345301][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1560.358673][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1560.360825][T25375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1560.388428][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1560.397746][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1560.405855][T25429] ldm_validate_partition_table(): Disk read failed. [ 1560.413801][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1560.423045][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1560.434882][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1560.444201][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1560.454623][T25429] Dev loop6: unable to read RDB block 0 [ 1560.474722][T25429] loop6: unable to read partition table [ 1560.487376][T25429] loop_reread_partitions: partition scan of loop6 (3 xC) failed (rc=-5) [ 1560.506471][T25375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1560.531950][ T4687] ldm_validate_partition_table(): Disk read failed. [ 1560.547618][ T4687] Dev loop6: unable to read RDB block 0 [ 1560.568058][ T4687] loop6: unable to read partition table [ 1560.570057][T25375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1560.630719][T25375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1560.653691][T25375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1560.695445][T25375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1560.733281][T25375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1560.754896][T25375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1560.772800][T25439] x_tables: arp_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 0 [ 1560.777539][T25375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1560.836405][T25375] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1560.846016][T25435] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4799'. [ 1560.895401][T25375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1560.925114][T25375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1560.949703][T25375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1560.971753][T25375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.025866][T25375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1561.040638][T25375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.057730][T25375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1561.071404][T25375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.071428][T25375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1561.071444][T25375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.071460][T25375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1561.071471][T25375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1561.073379][T25375] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1561.077917][ T5248] Bluetooth: hci0: command tx timeout [ 1561.082224][T25375] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1561.082292][T25375] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1561.082325][T25375] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1561.082358][T25375] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1561.366679][ T5294] speedtch 2-1:0.0: speedtch_bind: wrong device class 141 [ 1561.374059][ T5294] speedtch 2-1:0.0: usbatm_usb_probe: bind failed: -19! [ 1561.425100][ T5294] usb 2-1: USB disconnect, device number 28 [ 1561.451355][T25448] fuse: Unknown parameter '0x000000000000000e' [ 1561.557661][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1561.576283][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1561.727894][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1561.742710][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1561.923517][T25454] IPVS: set_ctl: invalid protocol: 58 10.1.1.0:20003 [ 1562.055223][T25457] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4804'. [ 1562.062975][T25456] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1562.266884][T25463] fuse: Unknown parameter '0x000000000000000e' [ 1562.386680][T14247] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 1562.596768][T14247] usb 1-1: Using ep0 maxpacket: 8 [ 1562.634475][T14247] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1562.668232][T14247] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1562.695512][T14247] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1562.708599][T14247] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1562.722484][T14247] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1562.735578][T14247] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1562.809027][T25470] FAULT_INJECTION: forcing a failure. [ 1562.809027][T25470] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1562.822872][T25470] CPU: 1 UID: 0 PID: 25470 Comm: syz.1.4808 Not tainted 6.11.0-rc6-syzkaller-00019-g67784a74e258 #0 [ 1562.833692][T25470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 1562.843784][T25470] Call Trace: [ 1562.847081][T25470] [ 1562.850038][T25470] dump_stack_lvl+0x241/0x360 [ 1562.854730][T25470] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1562.859938][T25470] ? __pfx__printk+0x10/0x10 [ 1562.864530][T25470] ? get_sigframe+0x566/0x700 [ 1562.869319][T25470] ? __pfx_lock_release+0x10/0x10 [ 1562.874374][T25470] should_fail_ex+0x3b0/0x4e0 [ 1562.879686][T25470] _copy_to_user+0x2f/0xb0 [ 1562.884135][T25470] copy_siginfo_to_user+0x24/0xa0 [ 1562.889179][T25470] x64_setup_rt_frame+0x75d/0xcc0 [ 1562.894217][T25470] ? lockdep_hardirqs_on+0x99/0x150 [ 1562.899435][T25470] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1562.904665][T25470] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 1562.910249][T25470] ? __fget_files+0x29/0x470 [ 1562.914861][T25470] arch_do_signal_or_restart+0x458/0x860 [ 1562.920514][T25470] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1562.926692][T25470] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 1562.932726][T25470] ? syscall_exit_to_user_mode+0xa3/0x370 [ 1562.938507][T25470] syscall_exit_to_user_mode+0xc9/0x370 [ 1562.944073][T25470] do_syscall_64+0x100/0x230 [ 1562.948678][T25470] ? clear_bhb_loop+0x35/0x90 [ 1562.953806][T25470] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1562.959716][T25470] RIP: 0033:0x7f0976179eb7 [ 1562.964256][T25470] Code: ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 [ 1562.983960][T25470] RSP: 002b:00007f0976f68038 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 [ 1562.992420][T25470] RAX: 0000000000000013 RBX: 00007f0976316058 RCX: 00007f0976179eb9 [ 1563.000589][T25470] RDX: 0000000000000001 RSI: 00000000200003c0 RDI: 0000000000000007 [ 1563.008593][T25470] RBP: 00007f0976f68090 R08: 0000000000000000 R09: 0000000000000000 [ 1563.016935][T25470] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1563.025116][T25470] R13: 0000000000000000 R14: 00007f0976316058 R15: 00007f097643fa28 [ 1563.033119][T25470] [ 1563.112813][T14247] usb 1-1: GET_CAPABILITIES returned 0 [ 1563.118816][T14247] usbtmc 1-1:16.0: can't read capabilities [ 1563.156893][ T5248] Bluetooth: hci0: command tx timeout [ 1563.496595][T14247] usb 4-1: new low-speed USB device number 57 using dummy_hcd [ 1563.548948][T25478] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4811'. [ 1563.686503][T14247] usb 4-1: Invalid ep0 maxpacket: 16 [ 1563.846726][T14247] usb 4-1: new low-speed USB device number 58 using dummy_hcd [ 1563.895443][T25481] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1564.009226][T25482] fuse: Unknown parameter '0x000000000000000b' [ 1564.060826][T14247] usb 4-1: Invalid ep0 maxpacket: 16 [ 1564.089559][T14247] usb usb4-port1: attempt power cycle [ 1564.098271][ T29] kauditd_printk_skb: 49 callbacks suppressed [ 1564.098290][ T29] audit: type=1326 audit(1725366236.297:912): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25473 comm="syz.4.4810" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3e52579eb9 code=0x0 [ 1564.353122][T25492] atomic_op ffff88805cfb4998 conn xmit_atomic 0000000000000000 [ 1564.546618][T14247] usb 4-1: new low-speed USB device number 59 using dummy_hcd [ 1564.599879][T14247] usb 4-1: Invalid ep0 maxpacket: 16 [ 1564.776630][T14247] usb 4-1: new low-speed USB device number 60 using dummy_hcd [ 1564.847993][T14247] usb 4-1: Invalid ep0 maxpacket: 16 [ 1564.856142][T14247] usb usb4-port1: unable to enumerate USB device [ 1564.904282][ T5294] usb 1-1: USB disconnect, device number 16 [ 1564.986662][ T5632] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 1565.183731][ T5632] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1565.217549][T25500] atomic_op ffff888033e8c998 conn xmit_atomic 0000000000000000 [ 1565.237926][ T5632] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1565.260551][ T5632] usb 5-1: New USB device found, idVendor=04b4, idProduct=de61, bcdDevice= 0.00 [ 1565.279720][ T5632] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1565.311122][ T5632] usb 5-1: config 0 descriptor?? [ 1565.551422][T25497] trusted_key: encrypted_key: keyword 'update' not allowed when called from .instantiate method [ 1565.566983][ T5294] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1565.588937][ T5632] usbhid 5-1:0.0: can't add hid device: -71 [ 1565.613209][ T5632] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1565.654328][ T5632] usb 5-1: USB disconnect, device number 22 [ 1565.746817][T14261] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 1565.776566][ T5294] usb 3-1: Using ep0 maxpacket: 8 [ 1565.787399][ T5294] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1565.807033][ T5294] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1565.823512][ T5294] usb 3-1: New USB device found, idVendor=0421, idProduct=008f, bcdDevice=ba.de [ 1565.833817][ T5294] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1565.862913][ T5294] usb 3-1: config 0 descriptor?? [ 1565.894356][ T5294] rndis_host 3-1:0.0: invalid descriptor buffer length [ 1565.913054][ T5294] usb 3-1: bad CDC descriptors [ 1565.922702][ T5294] cdc_acm 3-1:0.0: invalid descriptor buffer length [ 1565.954323][T14261] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1565.967019][T14261] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1565.977530][T14261] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1565.994433][T14261] usb 2-1: New USB device found, idVendor=056a, idProduct=0094, bcdDevice= 0.00 [ 1566.004347][T14261] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1566.027301][T14261] usb 2-1: config 0 descriptor?? [ 1566.266771][T25508] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1566.303545][T25513] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1566.310095][T25508] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1566.351168][T25505] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4819'. [ 1566.371531][T25513] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1566.420764][T25519] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4824'. [ 1566.452049][T25517] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4823'. [ 1566.579607][T25520] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4819'. [ 1566.709116][T25526] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1566.738683][T14247] usb 3-1: USB disconnect, device number 34 [ 1566.912941][T25531] fuse: Unknown parameter '0x000000000000000e' [ 1567.631750][T25537] netlink: 'syz.2.4828': attribute type 10 has an invalid length. [ 1567.672288][T25537] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 1567.886779][T25542] delete_channel: no stack [ 1567.934265][T25543] atomic_op ffff88807c7fd198 conn xmit_atomic 0000000000000000 [ 1567.950147][T25542] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4829'. [ 1568.100901][T25542] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4829'. [ 1568.283318][T25555] netlink: 184 bytes leftover after parsing attributes in process `syz.3.4833'. [ 1568.338573][T25556] trusted_key: encrypted_key: insufficient parameters specified [ 1568.395215][T25555] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4833'. [ 1568.605455][T25538] delete_channel: no stack [ 1568.651964][T14261] usbhid 2-1:0.0: can't add hid device: -71 [ 1568.658170][T14247] usb 3-1: new full-speed USB device number 35 using dummy_hcd [ 1568.708665][T14261] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1568.737740][T14261] usb 2-1: USB disconnect, device number 29 [ 1568.817741][T25558] loop6: detected capacity change from 0 to 524287999 [ 1568.827668][ T5632] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 1568.841886][T20731] Bluetooth: hci1: command 0x0406 tx timeout [ 1568.859381][ C1] blk_print_req_error: 24 callbacks suppressed [ 1568.859403][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1568.874997][ C1] buffer_io_error: 24 callbacks suppressed [ 1568.875015][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1568.929284][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1568.938567][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1568.952005][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1568.961286][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1568.973483][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1568.983052][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1569.000399][T14247] usb 3-1: config index 0 descriptor too short (expected 6427, got 27) [ 1569.001826][T25563] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4837'. [ 1569.009589][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1569.027113][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1569.036392][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1569.041948][T14247] usb 3-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 1569.045629][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1569.067080][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1569.073719][ T5632] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 1569.076295][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1569.098162][T14247] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1569.098738][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1569.117592][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1569.118562][T25562] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4836'. [ 1569.125745][T25558] ldm_validate_partition_table(): Disk read failed. [ 1569.137873][ T5632] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 51, changing to 9 [ 1569.143071][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1569.161709][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1569.167648][T14247] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1569.170344][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1569.187851][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1569.202224][ T5632] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 33540, setting to 1024 [ 1569.213538][T25558] Dev loop6: unable to read RDB block 0 [ 1569.227353][T14247] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1569.230905][T25558] loop6: unable to read partition table [ 1569.250335][T14247] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1569.266913][ T5632] usb 4-1: New USB device found, idVendor=05ac, idProduct=030a, bcdDevice=65.8c [ 1569.267061][T25558] loop_reread_partitions: partition scan of loop6 (3 xC) failed (rc=-5) [ 1569.300882][ T5632] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1569.324525][T14247] usb 3-1: config 0 descriptor?? [ 1569.347631][ T5632] usb 4-1: config 0 descriptor?? [ 1569.366872][ T4687] ldm_validate_partition_table(): Disk read failed. [ 1569.369148][ T5632] appletouch 4-1:0.0: Could not find int-in endpoint [ 1569.403887][ T5632] appletouch 4-1:0.0: probe with driver appletouch failed with error -5 [ 1569.412415][ T4687] Dev loop6: unable to read RDB block 0 [ 1569.424268][ T4687] loop6: unable to read partition table [ 1569.432049][ T5632] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 1569.627076][ T5632] usb 3-1: USB disconnect, device number 35 [ 1569.749718][T25575] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1569.873368][T25577] fuse: Unknown parameter '0x000000000000000e' [ 1570.516576][T14261] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 1570.716614][T14261] usb 5-1: Using ep0 maxpacket: 8 [ 1570.746439][T14261] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1570.773963][T14261] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1570.779626][T25595] delete_channel: no stack [ 1570.795128][T14261] usb 5-1: Product: syz [ 1570.807328][T25595] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4846'. [ 1570.810186][T14261] usb 5-1: Manufacturer: syz [ 1570.835129][T14261] usb 5-1: SerialNumber: syz [ 1570.846472][T14261] usb 5-1: config 0 descriptor?? [ 1570.908182][T25595] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4846'. [ 1571.059071][T25598] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4848'. [ 1571.080731][T14261] usb 5-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 1571.275086][T14247] usb 4-1: USB disconnect, device number 61 [ 1571.652292][T25591] delete_channel: no stack [ 1572.057116][T25614] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4853'. [ 1572.096449][T14247] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 1572.280674][T14247] usb 2-1: device descriptor read/64, error -71 [ 1572.386530][ T5632] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 1572.576598][ T5632] usb 1-1: Using ep0 maxpacket: 32 [ 1572.605479][ T5632] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1572.661017][ T5632] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1572.674773][T14247] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 1572.676492][T14261] usb write operation failed. (-71) [ 1572.706278][ T5632] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1572.757576][ T5632] usb 1-1: config 0 descriptor?? [ 1572.798585][ T5632] hub 1-1:0.0: bad descriptor, ignoring hub [ 1572.834204][ T5632] hub 1-1:0.0: probe with driver hub failed with error -5 [ 1572.848715][T14247] usb 2-1: device descriptor read/64, error -71 [ 1572.878316][ T5632] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 1572.900056][T14261] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1572.910969][T14261] dvbdev: DVB: registering new adapter (Terratec H7) [ 1572.921346][T14261] usb 5-1: media controller created [ 1572.936810][T14261] usb read operation failed. (-71) [ 1572.944798][T14261] usb write operation failed. (-71) [ 1572.957818][T14261] dvb_usb_az6007 5-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 1572.976036][T14261] usb 5-1: USB disconnect, device number 23 [ 1572.996906][T14247] usb usb2-port1: attempt power cycle [ 1573.051379][T25618] binder: 25617:25618 ioctl c0306201 20000000 returned -14 [ 1573.103853][T25618] binder: BINDER_SET_CONTEXT_MGR already set [ 1573.133773][T25618] binder: 25617:25618 ioctl 4018620d 20000040 returned -16 [ 1573.269257][T25630] fuse: Unknown parameter '0x000000000000000e' [ 1573.393403][T25618] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1573.435974][T25618] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1573.476806][T14247] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 1573.532706][T14247] usb 2-1: device descriptor read/8, error -71 [ 1573.576823][ T5361] usb 1-1: USB disconnect, device number 17 [ 1573.812970][T14247] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 1573.868318][T14247] usb 2-1: device descriptor read/8, error -71 [ 1573.971260][ T35] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1574.037489][T14247] usb usb2-port1: unable to enumerate USB device [ 1574.224364][ T35] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1574.472901][ T35] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1574.593415][ T35] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1575.141484][ T35] bridge_slave_1: left allmulticast mode [ 1575.163318][ T35] bridge_slave_1: left promiscuous mode [ 1575.188575][ T35] bridge0: port 2(bridge_slave_1) entered disabled state [ 1575.226155][ T35] bridge_slave_0: left allmulticast mode [ 1575.239026][T25659] IPVS: set_ctl: invalid protocol: 58 10.1.1.0:20003 [ 1575.262311][ T35] bridge_slave_0: left promiscuous mode [ 1575.296669][ T35] bridge0: port 1(bridge_slave_0) entered disabled state [ 1575.468067][T25664] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1575.481024][T25664] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1575.493327][T25664] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1575.513713][T25664] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1575.551614][T25664] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1575.562129][T25664] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1576.224667][T25683] netlink: 76 bytes leftover after parsing attributes in process `syz.2.4873'. [ 1576.539453][T16400] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 1576.747455][T16400] usb 3-1: Using ep0 maxpacket: 32 [ 1576.766661][T16400] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1576.784131][T16400] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1576.795794][T16400] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1576.815418][T16400] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1576.825723][T16400] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1576.868591][T16400] usb 3-1: config 0 descriptor?? [ 1576.897630][T25683] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1576.915617][T16400] hub 3-1:0.0: USB hub found [ 1577.020791][ T35] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1577.035237][ T35] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1577.054833][ T35] bond0 (unregistering): Released all slaves [ 1577.156833][T16400] hub 3-1:0.0: 2 ports detected [ 1577.437385][T25698] FAULT_INJECTION: forcing a failure. [ 1577.437385][T25698] name failslab, interval 1, probability 0, space 0, times 0 [ 1577.456588][T25698] CPU: 1 UID: 0 PID: 25698 Comm: syz.0.4875 Not tainted 6.11.0-rc6-syzkaller-00019-g67784a74e258 #0 [ 1577.467411][T25698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 1577.477499][T25698] Call Trace: [ 1577.480800][T25698] [ 1577.483748][T25698] dump_stack_lvl+0x241/0x360 [ 1577.488443][T25698] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1577.493677][T25698] ? __pfx__printk+0x10/0x10 [ 1577.498295][T25698] ? kmem_cache_alloc_noprof+0x44/0x2a0 [ 1577.503859][T25698] ? __pfx___might_resched+0x10/0x10 [ 1577.509168][T25698] should_fail_ex+0x3b0/0x4e0 [ 1577.514094][T25698] ? sk_prot_alloc+0x58/0x210 [ 1577.518804][T25698] should_failslab+0xac/0x100 [ 1577.524577][T25698] ? sk_prot_alloc+0x58/0x210 [ 1577.529379][T25698] kmem_cache_alloc_noprof+0x6c/0x2a0 [ 1577.534784][T25698] sk_prot_alloc+0x58/0x210 [ 1577.539314][T25698] ? sk_alloc+0x26/0x370 [ 1577.543578][T25698] sk_alloc+0x38/0x370 [ 1577.547770][T25698] inet6_create+0x6d4/0x1100 [ 1577.552997][T25698] ? inet6_create+0x78/0x1100 [ 1577.557718][T25698] ? __sock_create+0x337/0x920 [ 1577.562514][T25698] __sock_create+0x490/0x920 [ 1577.567161][T25698] udp_sock_create6+0xe7/0x870 [ 1577.571969][T25698] ? __local_bh_enable_ip+0x168/0x200 [ 1577.577361][T25698] ? lockdep_hardirqs_on+0x99/0x150 [ 1577.582870][T25698] ? __pfx_udp_sock_create6+0x10/0x10 [ 1577.588280][T25698] ? __local_bh_enable_ip+0x168/0x200 [ 1577.593709][T25698] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1577.599453][T25698] ? l2tp_tunnel_register+0x5b6/0x1c50 [ 1577.604932][T25698] l2tp_tunnel_register+0xa0a/0x1c50 [ 1577.610262][T25698] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 1577.616207][T25698] ? __pfx_l2tp_tunnel_register+0x10/0x10 [ 1577.621954][T25698] ? __asan_memset+0x23/0x50 [ 1577.626572][T25698] ? lockdep_init_map_type+0xa1/0x910 [ 1577.631972][T25698] ? __pfx_lockdep_init_map_type+0x10/0x10 [ 1577.637826][T25698] ? __kasan_kmalloc+0x98/0xb0 [ 1577.642628][T25698] l2tp_nl_cmd_tunnel_create+0x713/0xae0 [ 1577.648391][T25698] ? __pfx_l2tp_nl_cmd_tunnel_create+0x10/0x10 [ 1577.654561][T25698] ? genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 1577.660830][T25698] ? __nla_parse+0x40/0x60 [ 1577.665309][T25698] ? genl_family_rcv_msg_attrs_parse+0x1d1/0x290 [ 1577.671688][T25698] genl_rcv_msg+0xb14/0xec0 [ 1577.676247][T25698] ? mark_lock+0x9a/0x350 [ 1577.680642][T25698] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1577.685748][T25698] ? __pfx_lock_acquire+0x10/0x10 [ 1577.690812][T25698] ? __pfx_l2tp_nl_cmd_tunnel_create+0x10/0x10 [ 1577.697001][T25698] ? __pfx___might_resched+0x10/0x10 [ 1577.702326][T25698] netlink_rcv_skb+0x1e3/0x430 [ 1577.707132][T25698] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1577.712263][T25698] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1577.717573][T25698] ? __netlink_deliver_tap+0x77e/0x7c0 [ 1577.723067][T25698] genl_rcv+0x28/0x40 [ 1577.727066][T25698] netlink_unicast+0x7f6/0x990 [ 1577.731897][T25698] ? __pfx_netlink_unicast+0x10/0x10 [ 1577.737202][T25698] ? __virt_addr_valid+0x183/0x530 [ 1577.742352][T25698] ? __check_object_size+0x49c/0x900 [ 1577.747688][T25698] ? bpf_lsm_netlink_send+0x9/0x10 [ 1577.752844][T25698] netlink_sendmsg+0x8e4/0xcb0 [ 1577.757649][T25698] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1577.762954][T25698] ? __import_iovec+0x536/0x820 [ 1577.767840][T25698] ? aa_sock_msg_perm+0x91/0x160 [ 1577.772806][T25698] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1577.778113][T25698] ? security_socket_sendmsg+0x87/0xb0 [ 1577.783699][T25698] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1577.789013][T25698] __sock_sendmsg+0x221/0x270 [ 1577.793729][T25698] ____sys_sendmsg+0x525/0x7d0 [ 1577.798523][T25698] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1577.803837][T25698] __sys_sendmsg+0x2b0/0x3a0 [ 1577.808450][T25698] ? __pfx___sys_sendmsg+0x10/0x10 [ 1577.813579][T25698] ? vfs_write+0x7c4/0xc90 [ 1577.818314][T25698] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 1577.824659][T25698] ? do_syscall_64+0x100/0x230 [ 1577.829437][T25698] ? do_syscall_64+0xb6/0x230 [ 1577.834126][T25698] do_syscall_64+0xf3/0x230 [ 1577.838643][T25698] ? clear_bhb_loop+0x35/0x90 [ 1577.843344][T25698] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1577.849263][T25698] RIP: 0033:0x7f4dcf779eb9 [ 1577.853688][T25698] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1577.873391][T25698] RSP: 002b:00007f4dd063d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1577.881906][T25698] RAX: ffffffffffffffda RBX: 00007f4dcf915f80 RCX: 00007f4dcf779eb9 [ 1577.889894][T25698] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003 [ 1577.897877][T25698] RBP: 00007f4dd063d090 R08: 0000000000000000 R09: 0000000000000000 [ 1577.905860][T25698] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1577.913839][T25698] R13: 0000000000000000 R14: 00007f4dcf915f80 R15: 00007f4dcfa3fa28 [ 1577.921837][T25698] [ 1577.951451][T25664] Bluetooth: hci1: command tx timeout [ 1578.050262][T25703] loop6: detected capacity change from 0 to 524287999 [ 1578.061328][ C0] blk_print_req_error: 24 callbacks suppressed [ 1578.061344][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1578.076785][ C0] buffer_io_error: 24 callbacks suppressed [ 1578.076799][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1578.095423][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1578.104699][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1578.113307][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1578.122739][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1578.131868][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1578.141185][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1578.158778][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1578.168164][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1578.178565][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1578.187912][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1578.201141][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1578.210583][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1578.219103][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1578.228645][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1578.236579][T25703] ldm_validate_partition_table(): Disk read failed. [ 1578.245119][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1578.254492][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1578.274603][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1578.283944][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1578.302915][T25703] Dev loop6: unable to read RDB block 0 [ 1578.312345][T25703] loop6: unable to read partition table [ 1578.318823][T25703] loop_reread_partitions: partition scan of loop6 (3 xC) failed (rc=-5) [ 1578.361199][T25704] netlink: 1064 bytes leftover after parsing attributes in process `syz.1.4877'. [ 1578.749214][ T35] hsr_slave_0: left promiscuous mode [ 1578.774941][ T35] hsr_slave_1: left promiscuous mode [ 1578.799793][ T35] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1578.825819][ T35] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1578.876862][ T35] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1578.896553][ T35] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1579.139338][ T35] veth1_macvtap: left promiscuous mode [ 1579.157333][ T35] veth0_macvtap: left promiscuous mode [ 1579.197019][ T35] veth1_vlan: left promiscuous mode [ 1579.225403][ T35] veth0_vlan: left promiscuous mode [ 1579.796773][T16400] usb 3-1: reset high-speed USB device number 36 using dummy_hcd [ 1579.999441][T25728] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4881'. [ 1580.003677][T16400] usb 3-1: device descriptor read/64, error -32 [ 1580.038407][T25664] Bluetooth: hci1: command tx timeout [ 1580.066862][T25728] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4881'. [ 1580.976059][T16400] hub 3-1:0.0: set hub depth failed [ 1580.981732][ T5361] usb 3-1: USB disconnect, device number 36 [ 1581.650868][ T35] team0 (unregistering): Port device team_slave_1 removed [ 1581.771974][ T35] team0 (unregistering): Port device team_slave_0 removed [ 1581.886670][T25754] atomic_op ffff888031e1a198 conn xmit_atomic 0000000000000000 [ 1582.130564][T25664] Bluetooth: hci1: command tx timeout [ 1583.570221][T25669] chnl_net:caif_netlink_parms(): no params data found [ 1583.597275][ T29] audit: type=1326 audit(1725366255.777:913): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25762 comm="syz.0.4891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4dcf779eb9 code=0x7ffc0000 [ 1583.681368][ T29] audit: type=1326 audit(1725366255.817:914): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25762 comm="syz.0.4891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=449 compat=0 ip=0x7f4dcf779eb9 code=0x7ffc0000 [ 1583.760570][ T29] audit: type=1326 audit(1725366255.817:915): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25762 comm="syz.0.4891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4dcf779eb9 code=0x7ffc0000 [ 1583.763657][T11914] hid-generic 0000:0000:0000.004A: unknown main item tag 0x0 [ 1583.852613][T11914] hid-generic 0000:0000:0000.004A: unknown main item tag 0x0 [ 1583.896309][T11914] hid-generic 0000:0000:0000.004A: hidraw0: HID v0.00 Device [syz0] on syz0 [ 1583.912778][ T29] audit: type=1326 audit(1725366255.817:916): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25762 comm="syz.0.4891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4dcf779eb9 code=0x7ffc0000 [ 1583.956740][T14261] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 1583.997289][T25773] netlink: 168 bytes leftover after parsing attributes in process `syz.1.4889'. [ 1584.009850][ T29] audit: type=1326 audit(1725366255.817:917): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25762 comm="syz.0.4891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f4dcf779eb9 code=0x7ffc0000 [ 1584.046718][ T29] audit: type=1326 audit(1725366255.817:918): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25762 comm="syz.0.4891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4dcf779eb9 code=0x7ffc0000 [ 1584.131522][ T29] audit: type=1326 audit(1725366255.817:919): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25762 comm="syz.0.4891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4dcf779eb9 code=0x7ffc0000 [ 1584.156628][ T5294] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 1584.175072][ T29] audit: type=1326 audit(1725366255.817:920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25762 comm="syz.0.4891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4dcf779eb9 code=0x7ffc0000 [ 1584.197850][ T29] audit: type=1326 audit(1725366255.817:921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25762 comm="syz.0.4891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4dcf779eb9 code=0x7ffc0000 [ 1584.221441][T25664] Bluetooth: hci1: command tx timeout [ 1584.232263][ T29] audit: type=1326 audit(1725366255.827:922): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25762 comm="syz.0.4891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=0 compat=0 ip=0x7f4dcf779eb9 code=0x7ffc0000 [ 1584.258330][T14261] usb 4-1: config index 0 descriptor too short (expected 27271, got 36) [ 1584.266931][T14261] usb 4-1: config 18 has too many interfaces: 94, using maximum allowed: 32 [ 1584.275750][T14261] usb 4-1: config 18 has an invalid descriptor of length 61, skipping remainder of the config [ 1584.296514][T14261] usb 4-1: config 18 has 0 interfaces, different from the descriptor's value: 94 [ 1584.305742][T14261] usb 4-1: New USB device found, idVendor=056a, idProduct=0094, bcdDevice= 0.00 [ 1584.325258][T14261] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1584.329493][T25669] bridge0: port 1(bridge_slave_0) entered blocking state [ 1584.366473][ T5294] usb 1-1: Using ep0 maxpacket: 8 [ 1584.381426][T25669] bridge0: port 1(bridge_slave_0) entered disabled state [ 1584.415605][ T5294] usb 1-1: config index 0 descriptor too short (expected 1307, got 27) [ 1584.426971][T25669] bridge_slave_0: entered allmulticast mode [ 1584.434682][T25669] bridge_slave_0: entered promiscuous mode [ 1584.443605][ T5294] usb 1-1: config 0 has an invalid interface number: 0 but max is -1 [ 1584.462199][ T5294] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1584.515962][ T5294] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1584.565830][ T5294] usb 1-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=c3.de [ 1584.566707][T25669] bridge0: port 2(bridge_slave_1) entered blocking state [ 1584.603822][T25669] bridge0: port 2(bridge_slave_1) entered disabled state [ 1584.604340][ T5294] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1584.627299][T25669] bridge_slave_1: entered allmulticast mode [ 1584.662386][T25669] bridge_slave_1: entered promiscuous mode [ 1584.699001][ T5294] usb 1-1: Product: syz [ 1584.762186][ T5294] usb 1-1: Manufacturer: syz [ 1584.786102][ T5294] usb 1-1: SerialNumber: syz [ 1584.875559][T25669] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1584.909369][ T5294] usb 1-1: config 0 descriptor?? [ 1584.915640][T25669] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1585.000030][ T5294] hub 1-1:0.0: bad descriptor, ignoring hub [ 1585.023314][T25801] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1585.085009][ T5294] hub 1-1:0.0: probe with driver hub failed with error -5 [ 1585.117478][T25669] team0: Port device team_slave_0 added [ 1585.160853][T25669] team0: Port device team_slave_1 added [ 1585.337669][T25669] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1585.367286][T25669] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1585.403487][T25669] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1585.492656][T25669] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1585.542438][T25669] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1585.575476][T25669] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1585.929431][T25669] hsr_slave_0: entered promiscuous mode [ 1585.963239][T25669] hsr_slave_1: entered promiscuous mode [ 1586.092491][T25808] x_tables: arp_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 0 [ 1586.730393][T14261] usb 4-1: string descriptor 0 read error: -71 [ 1586.737841][ T5361] usb 1-1: USB disconnect, device number 18 [ 1586.798613][T14261] usb 4-1: USB disconnect, device number 62 [ 1586.867035][T25818] xt_l2tp: v2 doesn't support IP mode [ 1586.931418][T25820] Cannot find add_set index 0 as target [ 1587.098511][ T5361] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 1587.298812][ T5361] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1587.341110][ T5361] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1587.355401][T25828] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4899'. [ 1587.401858][ T5361] usb 3-1: New USB device found, idVendor=060b, idProduct=700a, bcdDevice= 0.00 [ 1587.482181][ T5361] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1587.520151][ T5361] usb 3-1: config 0 descriptor?? [ 1587.577139][ T5361] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1587.655465][T25843] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1588.289111][T25855] fuse: Unknown parameter '0x000000000000000e' [ 1588.354222][T25669] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1588.371232][T25669] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1588.385478][T25669] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1588.412596][T25669] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1588.465414][T14261] hid-generic 0009:0000:0000.004B: unknown main item tag 0x0 [ 1588.522591][T14261] hid-generic 0009:0000:0000.004B: unknown main item tag 0x0 [ 1588.605692][T14261] hid-generic 0009:0000:0000.004B: unknown main item tag 0x0 [ 1588.714622][T25669] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1588.742880][T14261] hid-generic 0009:0000:0000.004B: unknown main item tag 0x0 [ 1588.772419][T14261] hid-generic 0009:0000:0000.004B: unknown main item tag 0x0 [ 1588.806296][T14261] hid-generic 0009:0000:0000.004B: unknown main item tag 0x0 [ 1588.806674][T11914] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 1588.824649][T14261] hid-generic 0009:0000:0000.004B: unknown main item tag 0x0 [ 1588.825833][T25669] 8021q: adding VLAN 0 to HW filter on device team0 [ 1588.866479][T14261] hid-generic 0009:0000:0000.004B: unknown main item tag 0x0 [ 1588.893805][T14261] hid-generic 0009:0000:0000.004B: unknown main item tag 0x0 [ 1588.894790][T25867] bridge_slave_1: left allmulticast mode [ 1588.916755][T25867] bridge_slave_1: left promiscuous mode [ 1588.931095][T25867] bridge0: port 2(bridge_slave_1) entered disabled state [ 1588.948688][T14261] hid-generic 0009:0000:0000.004B: unknown main item tag 0x0 [ 1588.992937][T14261] hid-generic 0009:0000:0000.004B: unknown main item tag 0x0 [ 1589.040537][T16032] bridge0: port 1(bridge_slave_0) entered blocking state [ 1589.047815][T16032] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1589.060372][T14261] hid-generic 0009:0000:0000.004B: hidraw0: HID v0.00 Device [syz0] on syz0 [ 1589.104599][T11914] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1589.120222][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1589.127512][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1589.137442][T11914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1589.145493][T11914] usb 2-1: Product: syz [ 1589.184942][T11914] usb 2-1: Manufacturer: syz [ 1589.212801][T11914] usb 2-1: SerialNumber: syz [ 1589.242639][T11914] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1589.428640][T14261] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1589.478541][T25669] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1589.626372][T25669] veth0_vlan: entered promiscuous mode [ 1589.632497][T14247] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 1589.744303][T25669] veth1_vlan: entered promiscuous mode [ 1589.811917][T16400] usb 2-1: USB disconnect, device number 34 [ 1589.830973][T14247] usb 4-1: device descriptor read/64, error -71 [ 1589.857477][T25669] veth0_macvtap: entered promiscuous mode [ 1589.891060][T25669] veth1_macvtap: entered promiscuous mode [ 1589.951844][T25669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1589.966189][T25669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1589.978637][T25669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1589.996652][T25669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.012005][T25669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1590.022664][T25669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.033990][T25669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1590.049409][T25891] xt_l2tp: v2 doesn't support IP mode [ 1590.064861][T25669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.090807][T25669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1590.111009][T25669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.123154][T25669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1590.133994][T25669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.136675][T14247] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 1590.147589][T25669] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1590.163217][T25669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1590.187453][T25669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.198613][T25669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1590.209226][T25669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.219351][T25669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1590.230008][T25669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.240223][T25669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1590.251777][T25669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.261764][T25669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1590.272349][T25669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.283737][T25669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1590.296103][T25669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.309185][ T5294] usb 3-1: USB disconnect, device number 37 [ 1590.326720][T14247] usb 4-1: device descriptor read/64, error -71 [ 1590.332744][T25669] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1590.440823][T25669] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1590.452541][T25669] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1590.471014][T14247] usb usb4-port1: attempt power cycle [ 1590.476419][T25669] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1590.476462][T25669] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1590.535057][T14261] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1590.573853][T14261] ath9k_htc: Failed to initialize the device [ 1590.613837][T16400] usb 2-1: ath9k_htc: USB layer deinitialized [ 1590.714275][T25901] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4912'. [ 1590.896718][ T5294] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 1590.912381][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1590.937991][T14247] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 1590.945034][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1590.957496][T25912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1591.029280][T14247] usb 4-1: device descriptor read/8, error -71 [ 1591.045772][T25912] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1591.115495][T16032] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1591.116447][ T5294] usb 3-1: Using ep0 maxpacket: 16 [ 1591.149111][ T5294] usb 3-1: config 0 has no interfaces? [ 1591.174604][ T5294] usb 3-1: New USB device found, idVendor=0582, idProduct=05e6, bcdDevice=4e.00 [ 1591.196595][ T5294] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1591.227726][ T5294] usb 3-1: Product: syz [ 1591.231967][ T5294] usb 3-1: Manufacturer: syz [ 1591.244829][ T8] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 1591.256780][ T5294] usb 3-1: SerialNumber: syz [ 1591.280320][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1591.285284][ T5294] usb 3-1: config 0 descriptor?? [ 1591.304962][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1591.313251][T14247] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 1591.363030][T14247] usb 4-1: device descriptor read/8, error -71 [ 1591.416630][ T8] usb 1-1: device descriptor read/64, error -71 [ 1591.428382][T16032] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1591.490944][T14247] usb usb4-port1: unable to enumerate USB device [ 1591.605444][T16032] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1591.713025][ T8] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 1591.802334][ T5294] usb 3-1: USB disconnect, device number 38 [ 1591.829676][T16032] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1591.830714][T25926] delete_channel: no stack [ 1591.897991][T25926] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4862'. [ 1591.906739][ T8] usb 1-1: device descriptor read/64, error -71 [ 1591.998631][T25928] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4862'. [ 1592.053802][T25930] netlink: 1064 bytes leftover after parsing attributes in process `syz.3.4917'. [ 1592.096504][ T8] usb usb1-port1: attempt power cycle [ 1592.236186][ T5248] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1592.252222][ T5248] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1592.270034][ T5248] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1592.284686][ T5248] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1592.297013][ T5248] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1592.310176][T16032] bridge_slave_1: left allmulticast mode [ 1592.320682][ T5248] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1592.357251][T16032] bridge_slave_1: left promiscuous mode [ 1592.429884][T16032] bridge0: port 2(bridge_slave_1) entered disabled state [ 1592.521509][T16032] bridge_slave_0: left allmulticast mode [ 1592.547288][T16032] bridge_slave_0: left promiscuous mode [ 1592.568326][ T8] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 1592.590604][T16032] bridge0: port 1(bridge_slave_0) entered disabled state [ 1592.618447][T25922] delete_channel: no stack [ 1592.629411][ T8] usb 1-1: device descriptor read/8, error -71 [ 1592.913742][T25951] xt_l2tp: v2 doesn't support IP mode [ 1592.936644][ T8] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 1592.999163][ T8] usb 1-1: device descriptor read/8, error -71 [ 1593.127817][ T8] usb usb1-port1: unable to enumerate USB device [ 1593.315859][T25963] kvm: pic: non byte write [ 1594.342600][T16032] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1594.376118][T16032] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1594.394333][T16032] bond0 (unregistering): Released all slaves [ 1594.424253][T25971] macsec1: entered promiscuous mode [ 1594.437244][ T5248] Bluetooth: hci3: command tx timeout [ 1594.447789][T25971] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 1594.478750][T25971] macsec1: entered allmulticast mode [ 1594.541688][T25971] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 1594.560142][T25974] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4923'. [ 1594.643841][T25987] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4926'. [ 1594.729869][T25985] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.4926'. [ 1594.801458][T25985] openvswitch: netlink: Geneve option length err (len 3060, max 255). [ 1595.074346][T26006] delete_channel: no stack [ 1595.099141][T26006] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4930'. [ 1595.189276][T26009] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_macvtap, syncid = 0, id = 0 [ 1595.275391][T26010] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4930'. [ 1595.789643][T16032] hsr_slave_0: left promiscuous mode [ 1595.827125][T16032] hsr_slave_1: left promiscuous mode [ 1595.841139][T26023] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1595.849445][T25999] delete_channel: no stack [ 1595.860908][T16032] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1595.868777][T16032] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1595.901604][T16032] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1595.924159][T16032] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1596.012510][T16032] veth1_macvtap: left promiscuous mode [ 1596.029099][T16032] veth0_macvtap: left promiscuous mode [ 1596.034848][T16032] veth1_vlan: left promiscuous mode [ 1596.043382][T16032] veth0_vlan: left promiscuous mode [ 1596.186567][T14247] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 1596.367687][T14247] usb 3-1: Using ep0 maxpacket: 16 [ 1596.385212][T14247] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1596.412618][T14247] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1596.441986][T14247] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1596.466090][T26037] xt_l2tp: v2 doesn't support IP mode [ 1596.484359][T14247] usb 3-1: config 1 has no interface number 1 [ 1596.496453][T14247] usb 3-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 1596.508231][T14247] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1596.526891][ T5248] Bluetooth: hci3: command tx timeout [ 1596.562171][T14247] usb 3-1: config 1 interface 2 has no altsetting 0 [ 1596.589818][T14247] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1596.620070][T14247] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1596.644244][T14247] usb 3-1: Product: syz [ 1596.656699][T14247] usb 3-1: Manufacturer: syz [ 1596.671701][T14247] usb 3-1: SerialNumber: syz [ 1596.922521][T14247] usb 3-1: 2:1 : no or invalid class specific endpoint descriptor [ 1596.946499][T14247] usb 3-1: 2:1 : format type 39 is not supported yet [ 1596.962230][T14247] usb 3-1: selecting invalid altsetting 0 [ 1597.042873][T14247] usb 3-1: USB disconnect, device number 39 [ 1597.109651][T21350] udevd[21350]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1597.615873][T16032] team0 (unregistering): Port device team_slave_1 removed [ 1597.689192][T16032] team0 (unregistering): Port device team_slave_0 removed [ 1598.455537][T26020] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4932'. [ 1598.482743][T26042] netlink: 'syz.3.4938': attribute type 10 has an invalid length. [ 1598.552352][T26055] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4939'. [ 1598.596808][ T5248] Bluetooth: hci3: command tx timeout [ 1598.770712][T26061] atomic_op ffff888068226198 conn xmit_atomic 0000000000000000 [ 1598.876734][T26070] netlink: 'syz.2.4943': attribute type 10 has an invalid length. [ 1598.965028][T26070] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 1599.002750][T25939] chnl_net:caif_netlink_parms(): no params data found [ 1599.623311][T25939] bridge0: port 1(bridge_slave_0) entered blocking state [ 1599.641120][ T5361] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 1599.656743][T25939] bridge0: port 1(bridge_slave_0) entered disabled state [ 1599.676762][T25939] bridge_slave_0: entered allmulticast mode [ 1599.708095][T25939] bridge_slave_0: entered promiscuous mode [ 1599.826035][T25939] bridge0: port 2(bridge_slave_1) entered blocking state [ 1599.846512][ T5361] usb 3-1: Using ep0 maxpacket: 32 [ 1599.852601][T25939] bridge0: port 2(bridge_slave_1) entered disabled state [ 1599.864524][ T5361] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1599.876257][T25939] bridge_slave_1: entered allmulticast mode [ 1599.886595][ T5361] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1599.905525][T25939] bridge_slave_1: entered promiscuous mode [ 1599.916843][ T5361] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1599.948533][ T5361] usb 3-1: config 0 descriptor?? [ 1599.968784][ T5361] hub 3-1:0.0: bad descriptor, ignoring hub [ 1599.974752][ T5361] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1600.027810][ T5361] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1600.202079][T25939] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1600.296136][T25939] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1600.358015][T26083] binder: 26082:26083 ioctl c0306201 20000000 returned -14 [ 1600.540439][T25939] team0: Port device team_slave_0 added [ 1600.590027][T25939] team0: Port device team_slave_1 added [ 1600.678805][ T5248] Bluetooth: hci3: command tx timeout [ 1600.829742][T25939] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1600.840285][T25939] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1600.905601][T25939] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1600.981503][T25939] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1601.026432][T25939] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1601.117404][T25939] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1601.227038][ T5308] usb 3-1: USB disconnect, device number 40 [ 1601.525147][T25939] hsr_slave_0: entered promiscuous mode [ 1601.565428][T25939] hsr_slave_1: entered promiscuous mode [ 1601.589385][T25939] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1601.613019][T25939] Cannot create hsr debugfs directory [ 1601.754109][T26124] xt_l2tp: v2 doesn't support IP mode [ 1602.331307][T26135] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4952'. [ 1603.023713][T26156] atomic_op ffff8880283b8998 conn xmit_atomic 0000000000000000 [ 1603.216508][ T5294] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 1603.479876][ T5294] usb 5-1: too many configurations: 249, using maximum allowed: 8 [ 1603.537995][ T5294] usb 5-1: invalid descriptor for config index 0: type = 0x2, length = 8 [ 1603.628404][ T5294] usb 5-1: can't read configurations, error -22 [ 1603.734907][T26169] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1603.836938][ T5294] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 1603.842695][T26174] xt_l2tp: v2 doesn't support IP mode [ 1603.923390][T25939] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1603.953893][T25939] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1603.999804][T25939] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1604.040584][T26175] fuse: Unknown parameter '0x000000000000000e' [ 1604.069924][T25939] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1604.089420][ T5294] usb 5-1: too many configurations: 249, using maximum allowed: 8 [ 1604.134770][ T5294] usb 5-1: invalid descriptor for config index 0: type = 0x2, length = 8 [ 1604.171872][ T5294] usb 5-1: can't read configurations, error -22 [ 1604.209690][ T5294] usb usb5-port1: attempt power cycle [ 1604.225155][T26180] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4964'. [ 1604.478425][T25939] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1604.567137][T26187] macsec1: entered promiscuous mode [ 1604.587138][T26187] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 1604.615744][T26187] macsec1: entered allmulticast mode [ 1604.628511][T26187] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 1604.666543][ T5294] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 1604.685154][T26192] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4966'. [ 1604.751381][ T5294] usb 5-1: too many configurations: 249, using maximum allowed: 8 [ 1604.764878][ T5294] usb 5-1: invalid descriptor for config index 0: type = 0x2, length = 8 [ 1604.784109][ T5294] usb 5-1: can't read configurations, error -22 [ 1604.852204][T25939] 8021q: adding VLAN 0 to HW filter on device team0 [ 1604.936647][ T5294] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 1604.958153][T16032] bridge0: port 1(bridge_slave_0) entered blocking state [ 1604.965569][T16032] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1605.008610][ T5294] usb 5-1: too many configurations: 249, using maximum allowed: 8 [ 1605.043359][ T5294] usb 5-1: invalid descriptor for config index 0: type = 0x2, length = 8 [ 1605.052183][ T5294] usb 5-1: can't read configurations, error -22 [ 1605.059792][T16032] bridge0: port 2(bridge_slave_1) entered blocking state [ 1605.066987][T16032] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1605.096243][ T5294] usb usb5-port1: unable to enumerate USB device [ 1605.537955][T25939] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1605.709005][T25939] veth0_vlan: entered promiscuous mode [ 1605.812788][T25939] veth1_vlan: entered promiscuous mode [ 1605.935914][T25939] veth0_macvtap: entered promiscuous mode [ 1605.973287][T25939] veth1_macvtap: entered promiscuous mode [ 1606.026947][T16400] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 1606.041895][T25939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1606.086539][T25939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.112693][T25939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1606.150937][T25939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.197972][T25939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1606.229169][T25939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.242768][T16400] usb 4-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1606.256854][T25939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1606.268351][T16400] usb 4-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1606.282898][T25939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.301526][T16400] usb 4-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1606.320104][T25939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1606.343756][T16400] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1606.366418][T25939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.377920][T16400] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1606.399251][T25939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1606.417240][T26222] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1606.461078][T25939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.515355][T25939] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1606.603254][T25939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1606.645905][T25939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.706446][T25939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1606.741988][T25939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.784635][T25939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1606.805679][T25939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.835311][T25939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1606.870183][T25939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.880934][T25939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1606.898201][T25939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.948267][T25939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1606.959846][T25939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.984497][T26222] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1607.005935][T25939] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1607.016666][T26244] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4975'. [ 1607.083778][T25939] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1607.131007][T25939] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1607.179806][T25939] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1607.210026][T25939] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1607.711192][T16035] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1607.725985][ T1271] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.739708][ T1271] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.757432][T16035] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1607.972594][ T3034] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1608.014245][ T3034] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1608.934642][T16400] aiptek 4-1:17.0: Aiptek using 400 ms programming speed [ 1608.980494][T16400] input: Aiptek as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:17.0/input/input55 [ 1609.122003][ T5628] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 1609.146157][T16400] usb 4-1: USB disconnect, device number 67 [ 1609.146261][ C1] aiptek 4-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1609.369020][ T5628] usb 2-1: config 0 has an invalid interface number: 185 but max is 0 [ 1609.404148][ T5628] usb 2-1: config 0 has an invalid interface association descriptor of length 5, skipping [ 1609.421783][T26282] fuse: Bad value for 'user_id' [ 1609.466790][T26282] fuse: Bad value for 'user_id' [ 1609.485665][ T5628] usb 2-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 1609.518078][ T5628] usb 2-1: config 0 has no interface number 0 [ 1609.550322][ T5628] usb 2-1: config 0 interface 185 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 1609.600337][ T5628] usb 2-1: config 0 interface 185 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 16 [ 1609.645184][ T5628] usb 2-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=d2.82 [ 1609.666595][ T5628] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1609.702701][ T5628] usb 2-1: Product: syz [ 1609.711506][ T5628] usb 2-1: Manufacturer: syz [ 1609.716764][ T5628] usb 2-1: SerialNumber: syz [ 1609.751056][ T5628] usb 2-1: config 0 descriptor?? [ 1609.772967][ T5628] cdc_ether 2-1:0.185: skipping garbage [ 1609.786574][ T5628] cdc_ether 2-1:0.185: skipping garbage [ 1609.795253][ T5628] cdc_ether 2-1:0.185: skipping garbage [ 1609.812198][ T5628] usb 2-1: bad CDC descriptors [ 1609.821661][ T5628] usb 2-1: unsupported MDLM descriptors [ 1610.390875][T26292] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1611.086505][T25904] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 1611.318646][T25904] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1611.345005][T25904] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1611.361212][T25904] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1611.375194][T25904] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1611.413095][T26295] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1611.501120][T25904] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1611.522361][ T5628] usb 2-1: USB disconnect, device number 35 [ 1611.722835][T25904] usb 4-1: USB disconnect, device number 68 [ 1611.756201][ T5248] Bluetooth: hci3: unknown advertising packet type: 0x63 [ 1612.179575][T26320] delete_channel: no stack [ 1612.214860][T26320] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4994'. [ 1612.278519][T26320] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4994'. [ 1612.476540][ T8] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 1612.706662][ T8] usb 2-1: Using ep0 maxpacket: 32 [ 1612.727563][ T8] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1612.759829][ T8] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1612.795341][ T8] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 1612.864166][ T8] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1612.917937][ T8] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 1612.937349][T26316] delete_channel: no stack [ 1612.978193][ T8] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 1613.007056][ T8] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1613.062327][T26336] netlink: 1064 bytes leftover after parsing attributes in process `syz.4.4999'. [ 1613.104762][ T8] usb 2-1: config 0 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1613.205733][ T8] usb 2-1: New USB device found, idVendor=072f, idProduct=2200, bcdDevice=3f.bf [ 1613.258166][ T8] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1613.295124][ T8] usb 2-1: Product: syz [ 1613.320451][ T8] usb 2-1: Manufacturer: syz [ 1613.325112][ T8] usb 2-1: SerialNumber: syz [ 1613.359946][ T8] usb 2-1: config 0 descriptor?? [ 1613.375672][T26315] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1613.384486][ T8] usb 2-1: NFC: Reader power on cmd error -90 [ 1613.401723][ T8] pn533_usb 2-1:0.0: NFC: Couldn't poweron the reader (error -90) [ 1613.436573][ T8] pn533_usb 2-1:0.0: probe with driver pn533_usb failed with error -90 [ 1613.478247][ T5628] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 1613.590214][T26348] xt_TCPMSS: Only works on TCP SYN packets [ 1613.701270][ T5628] usb 5-1: Using ep0 maxpacket: 16 [ 1613.739494][ T5628] usb 5-1: config 0 has no interfaces? [ 1613.755066][T25904] usb 2-1: USB disconnect, device number 36 [ 1613.791227][ T5628] usb 5-1: New USB device found, idVendor=0582, idProduct=05e6, bcdDevice=4e.00 [ 1613.823972][ T5628] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1613.854410][ T5628] usb 5-1: Product: syz [ 1613.864350][ T5628] usb 5-1: Manufacturer: syz [ 1613.874413][ T5628] usb 5-1: SerialNumber: syz [ 1613.874841][T26356] netlink: 'syz.3.5006': attribute type 1 has an invalid length. [ 1613.899509][ T5628] usb 5-1: config 0 descriptor?? [ 1614.216169][T26368] loop6: detected capacity change from 0 to 524287999 [ 1614.224461][ C0] blk_print_req_error: 7 callbacks suppressed [ 1614.224485][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1614.239926][ C0] buffer_io_error: 7 callbacks suppressed [ 1614.239944][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1614.259923][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1614.269251][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1614.287241][T16400] usb 5-1: USB disconnect, device number 28 [ 1614.293986][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1614.303257][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1614.314552][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1614.323793][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1614.333109][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1614.342553][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1614.357405][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1614.366757][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1614.375192][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1614.384489][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1614.400777][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1614.410237][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1614.418206][T26368] ldm_validate_partition_table(): Disk read failed. [ 1614.425067][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1614.434377][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1614.443170][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1614.452396][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1614.476453][T26368] Dev loop6: unable to read RDB block 0 [ 1614.486038][T26368] loop6: unable to read partition table [ 1614.492059][ T8] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 1614.497248][T26368] loop_reread_partitions: partition scan of loop6 (3 xC) failed (rc=-5) [ 1614.683036][ T8] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1614.700746][ T8] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1614.709594][T26372] delete_channel: no stack [ 1614.716224][ T8] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1614.743595][T26372] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5011'. [ 1614.755460][ T8] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1614.767982][T26365] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1614.778500][ T8] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1614.872305][T26377] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5011'. [ 1615.117044][T11914] usb 4-1: USB disconnect, device number 69 [ 1615.226549][T16400] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 1615.416559][T16400] usb 5-1: Using ep0 maxpacket: 16 [ 1615.433707][T16400] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1615.451983][T16400] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1615.470033][T16400] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1615.511846][T16400] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1615.532195][T16400] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1615.555402][T16400] usb 5-1: config 0 descriptor?? [ 1615.617286][T26370] delete_channel: no stack [ 1616.031796][T26403] loop6: detected capacity change from 0 to 524287999 [ 1616.084571][T26403] ldm_validate_partition_table(): Disk read failed. [ 1616.109609][T26403] Dev loop6: unable to read RDB block 0 [ 1616.150018][T26403] loop6: unable to read partition table [ 1616.165709][T26403] loop_reread_partitions: partition scan of loop6 (3 xC) failed (rc=-5) [ 1616.280656][ T4687] ldm_validate_partition_table(): Disk read failed. [ 1616.299294][ T4687] Dev loop6: unable to read RDB block 0 [ 1616.319636][ T4687] loop6: unable to read partition table [ 1616.390660][T16400] usbhid 5-1:0.0: can't add hid device: -71 [ 1616.398401][T26411] netlink: 'syz.3.5020': attribute type 12 has an invalid length. [ 1616.421434][T16400] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1616.461312][T16400] usb 5-1: USB disconnect, device number 29 [ 1616.600257][T26419] netlink: 175260 bytes leftover after parsing attributes in process `syz.1.5021'. [ 1616.643438][T26419] netlink: zone id is out of range [ 1616.648862][T26419] netlink: zone id is out of range [ 1616.663267][T26419] netlink: zone id is out of range [ 1616.675624][T26419] netlink: zone id is out of range [ 1616.682876][T26419] netlink: zone id is out of range [ 1616.688517][T26419] netlink: zone id is out of range [ 1616.688870][T26421] openvswitch: netlink: Missing key (keys=80040, expected=2000) [ 1616.693645][T26419] netlink: zone id is out of range [ 1616.777634][T26419] netlink: zone id is out of range [ 1616.782797][T26419] netlink: zone id is out of range [ 1617.365359][T26432] fuse: Bad value for 'fd' [ 1617.411508][T26432] fuse: Unknown parameter 'fq' [ 1617.982874][ T5361] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 1618.206806][ T5361] usb 3-1: Using ep0 maxpacket: 8 [ 1618.234254][ T5361] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1618.279668][ T5361] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1618.330533][ T5361] usb 3-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 1618.371262][ T5361] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1618.400008][ T5361] usb 3-1: config 0 descriptor?? [ 1618.522410][T26457] x_tables: arp_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 0 [ 1618.543185][T26456] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5034'. [ 1618.852302][ T5361] logitech 0003:046D:C20E.004C: rdesc size test failed for formula gp [ 1618.888171][ T5361] logitech 0003:046D:C20E.004C: item fetching failed at offset 7/11 [ 1618.926297][ T5361] logitech 0003:046D:C20E.004C: parse failed [ 1618.943550][ T5361] logitech 0003:046D:C20E.004C: probe with driver logitech failed with error -22 [ 1619.785109][T26486] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5043'. [ 1620.854753][T16400] usb 3-1: USB disconnect, device number 41 [ 1620.942603][T26494] binder: 26488:26494 ioctl c0306201 200001c0 returned -14 [ 1621.186578][T26512] x_tables: arp_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 0 [ 1621.448004][T26519] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5052'. [ 1621.901578][T26528] netlink: 'syz.3.5055': attribute type 12 has an invalid length. [ 1621.960432][T26525] block device autoloading is deprecated and will be removed. [ 1622.609613][ T5361] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 1622.816639][ T5361] usb 2-1: Using ep0 maxpacket: 16 [ 1622.826062][ T5361] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1622.847720][ T5361] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1622.858118][ T5361] usb 2-1: New USB device found, idVendor=054c, idProduct=05c4, bcdDevice= 0.00 [ 1622.871570][ T5361] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1622.884281][ T5361] usb 2-1: config 0 descriptor?? [ 1623.379582][ T5361] playstation 0003:054C:05C4.004D: hidraw0: USB HID v0.00 Device [HID 054c:05c4] on usb-dummy_hcd.1-1/input0 [ 1623.538513][ T5361] playstation 0003:054C:05C4.004D: Invalid byte count transferred, expected 16 got 0 [ 1623.578703][ T5361] playstation 0003:054C:05C4.004D: Failed to retrieve DualShock4 pairing info: -22 [ 1623.596907][ T5361] playstation 0003:054C:05C4.004D: Failed to get MAC address from DualShock4 [ 1623.632792][ T5361] playstation 0003:054C:05C4.004D: Failed to create dualshock4. [ 1623.677658][ T5361] playstation 0003:054C:05C4.004D: probe with driver playstation failed with error -22 [ 1623.766522][ T8] usb 4-1: new full-speed USB device number 70 using dummy_hcd [ 1623.774604][ T5361] usb 2-1: USB disconnect, device number 37 [ 1623.862619][T26563] netlink: 1064 bytes leftover after parsing attributes in process `syz.2.5066'. [ 1623.988587][ T8] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1624.026757][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1624.052343][ T8] usb 4-1: Product: syz [ 1624.072233][ T8] usb 4-1: Manufacturer: syz [ 1624.078561][ T8] usb 4-1: SerialNumber: syz [ 1624.089397][ T8] usb 4-1: config 0 descriptor?? [ 1624.295369][T26572] delete_channel: no stack [ 1624.323757][T26572] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5069'. [ 1624.383943][ T5294] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 1624.403638][T26550] sg_write: data in/out 613/64 bytes for SCSI command 0x77-- guessing data in; [ 1624.403638][T26550] program syz.3.5062 not setting count and/or reply_len properly [ 1624.440482][T26572] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5069'. [ 1624.518045][ T8] dvb_usb_dtv5100 4-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 1624.546916][ T8] usb 4-1: USB disconnect, device number 70 [ 1624.583542][T26575] kAFS: unable to lookup cell '/' [ 1624.636451][ T5294] usb 3-1: Using ep0 maxpacket: 32 [ 1624.648096][ T5294] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1624.673755][ T5294] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1624.703232][ T5294] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1624.730611][ T5294] usb 3-1: config 0 descriptor?? [ 1624.781331][ T5294] hub 3-1:0.0: bad descriptor, ignoring hub [ 1624.811828][ T5294] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1624.840243][ T5294] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1625.083990][T26567] binder: 26566:26567 ioctl c0306201 20000000 returned -14 [ 1625.147747][T26569] delete_channel: no stack [ 1625.382737][T26589] bridge_slave_1: left allmulticast mode [ 1625.411934][T26589] bridge_slave_1: left promiscuous mode [ 1625.432766][T26589] bridge0: port 2(bridge_slave_1) entered disabled state [ 1625.601592][T26594] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5076'. [ 1625.752377][ T29] kauditd_printk_skb: 23 callbacks suppressed [ 1625.752400][ T29] audit: type=1326 audit(1725366297.947:946): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26597 comm="syz.0.5078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4dcf779eb9 code=0x7fc00000 [ 1625.842747][ T5361] usb 3-1: USB disconnect, device number 42 [ 1625.892967][ T29] audit: type=1326 audit(1725366298.017:947): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26597 comm="syz.0.5078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4dcf779eb9 code=0x7fc00000 [ 1626.009736][T26614] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5084'. [ 1626.305075][T26620] kvm: pic: non byte write [ 1626.468639][ T29] audit: type=1326 audit(1725366298.667:948): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26597 comm="syz.0.5078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4dcf779eb9 code=0x7fc00000 [ 1626.694486][T26631] netlink: 1064 bytes leftover after parsing attributes in process `syz.1.5090'. [ 1626.978876][T26639] netlink: 'syz.1.5093': attribute type 10 has an invalid length. [ 1627.005797][T26639] net_ratelimit: 395 callbacks suppressed [ 1627.005814][T26639] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 1627.207779][T26643] netlink: 'syz.0.5094': attribute type 10 has an invalid length. [ 1627.268861][T26643] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 1627.666585][ T5361] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 1627.858217][ T5361] usb 5-1: Using ep0 maxpacket: 16 [ 1627.896162][ T5361] usb 5-1: config 0 has no interfaces? [ 1627.915544][ T5361] usb 5-1: New USB device found, idVendor=0582, idProduct=05e6, bcdDevice=4e.00 [ 1627.946693][ T5361] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1627.955042][ T5361] usb 5-1: Product: syz [ 1627.972668][ T5361] usb 5-1: Manufacturer: syz [ 1627.988959][ T5361] usb 5-1: SerialNumber: syz [ 1628.017495][ T5361] usb 5-1: config 0 descriptor?? [ 1628.252688][T26663] binder: 26661:26663 ioctl c0306201 200001c0 returned -14 [ 1628.350036][ T8] usb 5-1: USB disconnect, device number 30 [ 1628.504033][T26670] loop9: detected capacity change from 0 to 7 [ 1628.539473][T26670] Dev loop9: unable to read RDB block 7 [ 1628.557405][T26670] loop9: AHDI p2 p3 p4 [ 1628.561639][T26670] loop9: partition table partially beyond EOD, truncated [ 1628.579760][T26670] loop9: p2 start 2961973428 is beyond EOD, truncated [ 1628.588652][T26670] loop9: p3 start 1756542996 is beyond EOD, truncated [ 1628.604879][T26673] netlink: 'syz.2.5105': attribute type 10 has an invalid length. [ 1628.605662][T26674] xt_l2tp: v2 doesn't support IP mode [ 1628.633680][T26673] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 1629.536738][ T5361] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 1629.667389][T16400] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 1629.745336][ T5361] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1629.756181][T25904] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 1629.773776][ T5361] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1629.788068][ T5361] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1629.799695][ T5361] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1629.809953][ T5361] usb 4-1: SerialNumber: syz [ 1629.879530][T16400] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1629.897225][T16400] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1629.926500][T16400] usb 5-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 1629.951037][T25904] usb 2-1: Using ep0 maxpacket: 32 [ 1629.969320][T16400] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1629.990704][T25904] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1630.020183][T25904] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1630.041109][T16400] usb 5-1: config 0 descriptor?? [ 1630.066831][ T5361] usb 4-1: 0:2 : does not exist [ 1630.075739][T25904] usb 2-1: config 0 descriptor?? [ 1630.081685][ T5361] usb 4-1: unit 255 not found! [ 1630.100632][T25904] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1630.153339][ T5361] usb 4-1: USB disconnect, device number 71 [ 1630.286746][T21350] udevd[21350]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1630.972496][T26706] netlink: 'syz.3.5116': attribute type 10 has an invalid length. [ 1630.993993][T26706] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 1631.263234][T16400] usbhid 5-1:0.0: can't add hid device: -71 [ 1631.296573][T16400] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1631.297654][T26709] xt_l2tp: v2 doesn't support IP mode [ 1631.332395][T16400] usb 5-1: USB disconnect, device number 31 [ 1631.572593][T26716] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1631.592195][T26716] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1631.838309][T16400] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 1631.927431][ T8] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 1632.052359][T16400] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.9e [ 1632.075984][T16400] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1632.093396][T16400] usb 3-1: config 0 descriptor?? [ 1632.166612][ T8] usb 1-1: Using ep0 maxpacket: 16 [ 1632.197239][ T8] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1632.227515][ T8] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1632.248784][ T8] usb 1-1: New USB device found, idVendor=04d8, idProduct=00df, bcdDevice= 0.00 [ 1632.286391][ T8] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1632.319191][ T8] usb 1-1: config 0 descriptor?? [ 1632.388618][T26717] usb usb9: usbfs: process 26717 (syz.2.5120) did not claim interface 0 before use [ 1632.417232][T26717] usb usb9: selecting invalid altsetting 21783 [ 1632.450849][T26724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1632.492357][T26717] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1632.553012][T26724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1632.589362][T26717] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1632.662919][T16400] ath6kl: Failed to submit usb control message: -71 [ 1632.683496][T16400] ath6kl: unable to send the bmi data to the device: -71 [ 1632.691496][T16400] ath6kl: Unable to send get target info: -71 [ 1632.723077][T16400] ath6kl: Failed to init ath6kl core: -71 [ 1632.740090][T16400] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 1632.743127][ T8] mcp2200 0003:04D8:00DF.004E: unbalanced delimiter at end of report description [ 1632.797090][T16400] usb 3-1: USB disconnect, device number 43 [ 1632.811070][ T8] mcp2200 0003:04D8:00DF.004E: can't parse reports [ 1632.846737][ T8] mcp2200 0003:04D8:00DF.004E: probe with driver mcp2200 failed with error -22 [ 1632.852008][T26740] netlink: 'syz.4.5127': attribute type 10 has an invalid length. [ 1632.876569][T26740] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 1632.961050][T26697] xt_policy: neither incoming nor outgoing policy selected [ 1633.009368][T25904] gspca_vc032x: reg_r err -71 [ 1633.015223][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.027124][T26743] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1633.042320][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.062230][T26744] netlink: 'syz.0.5121': attribute type 12 has an invalid length. [ 1633.070313][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.092254][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.110690][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.123884][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.136451][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.152072][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.162196][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.176456][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.198376][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.226649][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.238422][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.254044][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.268669][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.283154][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.325068][T25904] gspca_vc032x: I2c Bus Busy Wait 00 [ 1633.353473][T25904] gspca_vc032x: Unknown sensor... [ 1633.403389][T25904] vc032x 2-1:0.0: probe with driver vc032x failed with error -22 [ 1633.413118][T26756] xt_l2tp: v2 doesn't support IP mode [ 1633.437923][T25904] usb 2-1: USB disconnect, device number 38 [ 1633.502872][T26754] Cannot find del_set index 4 as target [ 1634.223634][T26778] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5136'. [ 1634.297910][T26783] netlink: 'syz.2.5139': attribute type 10 has an invalid length. [ 1634.314089][T26783] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 1634.384118][T26786] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1634.700109][T26793] netlink: 'syz.2.5141': attribute type 12 has an invalid length. [ 1634.719262][ T5294] usb 1-1: USB disconnect, device number 23 [ 1634.736654][T26792] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1635.006527][T26802] xt_l2tp: v2 doesn't support IP mode [ 1635.400150][ T5248] Bluetooth: hci2: command 0x0406 tx timeout [ 1635.555034][T26807] binder: 26806:26807 ioctl c00c620f 20000480 returned -22 [ 1635.807968][T26815] can: request_module (can-proto-0) failed. [ 1635.906869][ T5294] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 1635.977720][T14261] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 1636.106399][ T5294] usb 5-1: Using ep0 maxpacket: 32 [ 1636.126124][ T5294] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1636.143897][ T5294] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1636.179529][ T5294] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1636.189671][T14261] usb 1-1: no configurations [ 1636.195733][T14261] usb 1-1: can't read configurations, error -22 [ 1636.227070][ T5294] usb 5-1: config 0 descriptor?? [ 1636.264012][ T5294] hub 5-1:0.0: bad descriptor, ignoring hub [ 1636.290758][ T5294] hub 5-1:0.0: probe with driver hub failed with error -5 [ 1636.340873][ T5294] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 1636.387585][T14261] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 1636.485983][T26813] binder: 26812:26813 ioctl c0306201 20000000 returned -14 [ 1636.608876][T14261] usb 1-1: no configurations [ 1636.628280][T14261] usb 1-1: can't read configurations, error -22 [ 1636.656964][T14261] usb usb1-port1: attempt power cycle [ 1636.696930][ T5308] usb 5-1: USB disconnect, device number 32 [ 1636.707101][T26833] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1636.850391][T26838] support for the xor transformation has been removed. [ 1636.976061][T26845] xt_l2tp: v2 doesn't support IP mode [ 1637.025940][T14247] hid (null): unknown global tag 0xd [ 1637.037733][T14247] hid (null): unknown global tag 0xd [ 1637.048459][T14247] hid-generic 0006:00F0:FFFFFFFD.004F: unknown main item tag 0x6 [ 1637.057244][T14247] hid-generic 0006:00F0:FFFFFFFD.004F: unknown main item tag 0x6 [ 1637.065583][T14247] hid-generic 0006:00F0:FFFFFFFD.004F: unknown global tag 0xd [ 1637.090599][T14247] hid-generic 0006:00F0:FFFFFFFD.004F: item 0 0 1 13 parsing failed [ 1637.105446][T14247] hid-generic 0006:00F0:FFFFFFFD.004F: probe with driver hid-generic failed with error -22 [ 1637.116612][T14261] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 1637.177786][T14261] usb 1-1: no configurations [ 1637.192553][T14261] usb 1-1: can't read configurations, error -22 [ 1637.272070][T26848] Cannot find add_set index 0 as target [ 1637.366470][T14261] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 1637.396529][T26854] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_macvtap, syncid = 0, id = 0 [ 1637.410646][T26852] IPVS: stopping backup sync thread 26854 ... [ 1637.455660][T26853] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5158'. [ 1637.480988][T14261] usb 1-1: no configurations [ 1637.488239][T14261] usb 1-1: can't read configurations, error -22 [ 1637.508783][T14261] usb usb1-port1: unable to enumerate USB device [ 1637.951843][T14261] usb 5-1: new full-speed USB device number 33 using dummy_hcd [ 1638.196770][T14261] usb 5-1: not running at top speed; connect to a high speed hub [ 1638.227198][T14261] usb 5-1: config 1 interface 0 has no altsetting 0 [ 1638.253172][T14261] usb 5-1: New USB device found, idVendor=1e7d, idProduct=3138, bcdDevice= 0.40 [ 1638.282191][T14261] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1638.292956][T14261] usb 5-1: Product: Є [ 1638.297172][T14261] usb 5-1: Manufacturer: Л [ 1638.303496][T14261] usb 5-1: SerialNumber: ⧇ꕡẅᵢퟒ쉽싘呢ⶔ䆋涼ﯠ䖝୊슔췖ࣥ᪑陽岯쀐嗀錭袒쿑Ꮀֵ矠骃ᅐḦ㇏ᙐ런噴پ䭍瘟쥝엸⩈ፒ⻶ٞ [ 1638.360291][T26873] syz.3.5167 (26873): attempted to duplicate a private mapping with mremap. This is not supported. [ 1638.386632][T14247] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 1638.586053][T14247] usb 2-1: New USB device found, idVendor=0f11, idProduct=1000, bcdDevice=be.42 [ 1638.613746][T14247] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1638.651954][T14247] usb 2-1: config 0 descriptor?? [ 1638.676168][T14247] ldusb 2-1:0.0: Interrupt in endpoint not found [ 1638.738013][T26874] netlink: 'syz.3.5167': attribute type 10 has an invalid length. [ 1638.757690][T26874] team0: Port device netdevsim0 added [ 1638.790009][T26881] netlink: 1064 bytes leftover after parsing attributes in process `syz.0.5168'. [ 1638.886225][T26870] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1638.906944][T26870] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1639.068039][T14261] usbhid 5-1:1.0: can't add hid device: -71 [ 1639.078274][T14261] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 1639.092241][T26884] xt_l2tp: v2 doesn't support IP mode [ 1639.103228][T14261] usb 5-1: USB disconnect, device number 33 [ 1639.543876][T16400] usb 2-1: USB disconnect, device number 39 [ 1639.546459][T26892] libceph: resolve '400' (ret=-3): failed [ 1639.656514][T14261] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 1639.708030][T26899] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5174'. [ 1639.856503][T14261] usb 5-1: Using ep0 maxpacket: 32 [ 1639.873728][T14261] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1639.894255][T14261] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1639.894295][T14261] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1639.909316][T14261] usb 5-1: config 0 descriptor?? [ 1639.918021][T14261] hub 5-1:0.0: bad descriptor, ignoring hub [ 1639.918061][T14261] hub 5-1:0.0: probe with driver hub failed with error -5 [ 1639.920039][T14261] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 1639.967720][T26902] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5174'. [ 1640.058219][ T8] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 1640.147255][T26888] binder: 26886:26888 ioctl c0306201 20000000 returned -14 [ 1640.257725][ T8] usb 3-1: Using ep0 maxpacket: 32 [ 1640.276558][ T8] usb 3-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1640.287763][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1640.303952][ T8] usb 3-1: config 0 descriptor?? [ 1640.343801][ T8] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1640.838951][T14261] usb 5-1: USB disconnect, device number 34 [ 1640.871033][T26922] bridge_slave_1: left allmulticast mode [ 1640.892042][T26922] bridge_slave_1: left promiscuous mode [ 1640.930820][T26922] bridge0: port 2(bridge_slave_1) entered disabled state [ 1641.159625][T16400] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 1641.389128][T16400] usb 2-1: Using ep0 maxpacket: 32 [ 1641.446714][T16400] usb 2-1: New USB device found, idVendor=04e6, idProduct=0007, bcdDevice= 1.44 [ 1641.500064][T16400] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1641.535338][T16400] usb 2-1: Product: syz [ 1641.560928][T16400] usb 2-1: Manufacturer: syz [ 1641.582637][T16400] usb 2-1: SerialNumber: syz [ 1641.615727][T16400] usb 2-1: config 0 descriptor?? [ 1641.645658][T16400] usb-storage 2-1:0.0: USB Mass Storage device detected [ 1641.666701][T16400] usb-storage 2-1:0.0: Quirks match for vid 04e6 pid 0007: 1 [ 1641.675854][T16400] usb-storage 2-1:0.0: This device (04e6,0007,0144 S 3e P 01) has an unneeded Protocol entry in unusual_devs.h (kernel 6.11.0-rc6-syzkaller-00019-g67784a74e258) [ 1641.675854][T16400] Please send a copy of this message to and [ 1641.887174][ T5361] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 1642.088588][ T5361] usb 4-1: Using ep0 maxpacket: 32 [ 1642.116218][ T5361] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 1642.135491][ T5361] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 1642.167029][ T5361] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1642.179400][T26944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1642.198666][ T5361] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 1642.219395][ T5361] usb 4-1: config 1 has no interface number 0 [ 1642.225599][ T5361] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1642.235387][T26944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1642.253467][ T5361] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1642.300843][ T5361] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 1642.511212][ T5361] snd_usb_pod 4-1:1.1: endpoint not available, using fallback values [ 1642.545964][ T5361] snd_usb_pod 4-1:1.1: invalid control EP [ 1642.563117][ T5361] snd_usb_pod 4-1:1.1: cannot start listening: -22 [ 1642.586747][ T5361] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 1642.609971][ T5361] snd_usb_pod 4-1:1.1: probe with driver snd_usb_pod failed with error -22 [ 1642.648903][T26952] netlink: 'syz.0.5191': attribute type 12 has an invalid length. [ 1642.815623][ T29] audit: type=1326 audit(1725366314.987:949): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26932 comm="syz.3.5185" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fdddeb79eb9 code=0x0 [ 1642.964182][T16400] usb 4-1: USB disconnect, device number 72 [ 1643.154218][T26901] xt_policy: neither incoming nor outgoing policy selected [ 1643.256539][ T8] gspca_vc032x: reg_r err -71 [ 1643.271399][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.287639][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.300874][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.317788][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.358089][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.393419][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.414936][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.436722][T16400] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 1643.443363][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.478915][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.510812][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.534541][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.555690][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.586362][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.633174][T16400] usb 4-1: config 1 interface 0 altsetting 254 endpoint 0x81 has invalid maxpacket 16951, setting to 1024 [ 1643.646768][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.666169][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.674087][T16400] usb 4-1: config 1 interface 0 has no altsetting 0 [ 1643.696573][T16400] usb 4-1: New USB device found, idVendor=1e7d, idProduct=3264, bcdDevice= 0.40 [ 1643.717467][T16400] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1643.725645][T16400] usb 4-1: Product: Ћ [ 1643.740896][T16400] usb 4-1: Manufacturer: Ђ [ 1643.751326][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.751354][T16400] usb 4-1: SerialNumber: ¿ꑎ０䞅쟟附īὁ㤂麟ᆧ烣뷐寫牶ﻈ鼝ᐥ졐庴及㞨ꎤ䘿᩻삑⫃鱱綊銯渄◘⇽਱얶鉾⬽瓷詇뷮◘覥뱿뜞ᮖⱈ [ 1643.832755][ T8] gspca_vc032x: I2c Bus Busy Wait 00 [ 1643.852392][ T8] gspca_vc032x: Unknown sensor... [ 1643.885070][T14247] usb 2-1: USB disconnect, device number 40 [ 1643.890969][ T8] vc032x 3-1:0.0: probe with driver vc032x failed with error -22 [ 1643.891289][T25904] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 1643.922897][ T8] usb 3-1: USB disconnect, device number 44 [ 1644.166479][T25904] usb 1-1: Using ep0 maxpacket: 32 [ 1644.183539][T25904] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1644.194121][T26965] bridge_slave_1: left allmulticast mode [ 1644.197096][T25904] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1644.211835][T26966] x_tables: arp_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 0 [ 1644.236414][T26965] bridge_slave_1: left promiscuous mode [ 1644.236979][T25904] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1644.259323][T26965] bridge0: port 2(bridge_slave_1) entered disabled state [ 1644.268967][T25904] usb 1-1: config 0 descriptor?? [ 1644.305569][T25904] hub 1-1:0.0: bad descriptor, ignoring hub [ 1644.325376][T25904] hub 1-1:0.0: probe with driver hub failed with error -5 [ 1644.338890][T25904] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 1644.531965][T26959] binder: 26958:26959 ioctl c0306201 20000000 returned -14 [ 1644.922586][T26977] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5199'. [ 1645.188096][ T29] audit: type=1326 audit(1725366317.377:950): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26979 comm="syz.1.5200" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1d92b79eb9 code=0x0 [ 1645.192445][ T8] hid-generic 0000:0000:0000.0050: unknown main item tag 0x0 [ 1645.227040][T14261] usb 1-1: USB disconnect, device number 28 [ 1645.305946][ T8] hid-generic 0000:0000:0000.0050: unknown main item tag 0x0 [ 1645.357991][ T8] hid-generic 0000:0000:0000.0050: hidraw0: HID v0.00 Device [syz0] on syz1 [ 1645.408234][T26992] delete_channel: no stack [ 1645.434405][T26992] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5202'. [ 1645.563710][T16400] usbhid 4-1:1.0: can't add hid device: -71 [ 1645.576573][T14261] usb 3-1: new full-speed USB device number 45 using dummy_hcd [ 1645.586631][T16400] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 1645.617423][T16400] usb 4-1: USB disconnect, device number 73 [ 1645.686236][T26998] netlink: 'syz.3.5205': attribute type 10 has an invalid length. [ 1645.738138][T26998] team0: Port device netdevsim0 removed [ 1645.800565][T14261] usb 3-1: config 0 has an invalid interface number: 213 but max is 0 [ 1645.809162][T14261] usb 3-1: config 0 has an invalid interface number: 229 but max is 0 [ 1645.824068][T14261] usb 3-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 1645.834383][T14261] usb 3-1: config 0 has no interface number 0 [ 1645.840885][T14261] usb 3-1: config 0 has no interface number 1 [ 1645.850490][T14261] usb 3-1: config 0 interface 213 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1645.863596][T14261] usb 3-1: too many endpoints for config 0 interface 229 altsetting 129: 54, using maximum allowed: 30 [ 1645.875919][T14261] usb 3-1: config 0 interface 229 altsetting 129 has 0 endpoint descriptors, different from the interface descriptor's value: 54 [ 1645.902118][T14261] usb 3-1: config 0 interface 229 has no altsetting 0 [ 1645.940885][T14261] usb 3-1: New USB device found, idVendor=0565, idProduct=0005, bcdDevice= 9.0b [ 1645.985763][T14261] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1646.008917][T14261] usb 3-1: Product: syz [ 1646.013560][T14261] usb 3-1: Manufacturer: syz [ 1646.036043][T14261] usb 3-1: SerialNumber: syz [ 1646.062658][T14261] usb 3-1: config 0 descriptor?? [ 1646.149003][T26983] delete_channel: no stack [ 1646.180855][T27004] bridge_slave_1: left allmulticast mode [ 1646.189413][T27004] bridge_slave_1: left promiscuous mode [ 1646.195274][T27004] bridge0: port 2(bridge_slave_1) entered disabled state [ 1646.246626][T25904] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 1646.350690][T26986] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1646.395676][T26986] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1646.445856][T14261] kaweth 3-1:0.213: Firmware present in device. [ 1646.446636][T25904] usb 4-1: Using ep0 maxpacket: 32 [ 1646.492163][T25904] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1646.539614][T25904] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1646.572685][T25904] usb 4-1: New USB device found, idVendor=0458, idProduct=4018, bcdDevice= 0.00 [ 1646.598434][T25904] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1646.647857][T14261] kaweth 3-1:0.213: Error reading configuration (-71), no net device created [ 1646.661161][T25904] usb 4-1: config 0 descriptor?? [ 1646.756136][T14261] kaweth 3-1:0.213: probe with driver kaweth failed with error -5 [ 1646.791772][T14261] kaweth 3-1:0.229: Firmware present in device. [ 1646.834814][T14261] kaweth 3-1:0.229: Error reading configuration (-71), no net device created [ 1646.864059][T14261] kaweth 3-1:0.229: probe with driver kaweth failed with error -5 [ 1646.921809][T14261] usb 3-1: USB disconnect, device number 45 [ 1646.978931][T16400] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 1647.186513][T16400] usb 5-1: Using ep0 maxpacket: 8 [ 1647.227886][T16400] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1647.277909][T16400] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1647.323611][T16400] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1647.368929][T16400] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1647.398556][T16035] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1647.420196][T16400] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1647.485007][T16400] usb 5-1: Product: syz [ 1647.534063][T16400] usb 5-1: Manufacturer: syz [ 1647.555414][T16400] usb 5-1: SerialNumber: syz [ 1647.577257][T16400] usb 5-1: config 0 descriptor?? [ 1647.600759][T16400] streamzap 5-1:0.0: streamzap_probe: endpoint Max Packet Size is 0!?! [ 1647.721892][T16035] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1647.969769][T16035] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1648.186557][T25904] usbhid 4-1:0.0: can't add hid device: -71 [ 1648.218253][T25904] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1648.233720][T16035] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1648.258718][T25904] usb 4-1: USB disconnect, device number 74 [ 1648.274952][ T5308] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 1648.476454][ T5308] usb 3-1: Using ep0 maxpacket: 32 [ 1648.499551][ T5308] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1648.536133][ T5308] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1648.581576][ T5308] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1648.651195][ T5308] usb 3-1: config 0 descriptor?? [ 1648.660947][ T5248] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1648.674913][ T5248] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1648.689686][ T5248] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1648.702978][ T5248] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1648.713512][ T5248] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1648.726682][T14247] usb 2-1: new full-speed USB device number 41 using dummy_hcd [ 1648.755030][ T5308] hub 3-1:0.0: bad descriptor, ignoring hub [ 1648.766444][ T5308] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1648.775235][ T5248] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1648.842786][ T5308] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1648.908545][T16035] bridge_slave_0: left allmulticast mode [ 1648.950080][T16035] bridge_slave_0: left promiscuous mode [ 1648.971283][T27018] binder: 27017:27018 ioctl c0306201 20000000 returned -14 [ 1649.000021][T16035] bridge0: port 1(bridge_slave_0) entered disabled state [ 1649.100204][T14247] usb 2-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1649.141367][T14247] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1649.187954][T14247] usb 2-1: config 0 descriptor?? [ 1649.587219][ T5361] usb 5-1: USB disconnect, device number 35 [ 1649.787550][T14261] usb 3-1: USB disconnect, device number 46 [ 1650.333851][T25904] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 1650.528522][T25904] usb 3-1: Using ep0 maxpacket: 8 [ 1650.557042][T25904] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x5B, changing to 0xB [ 1650.569272][T25904] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 1650.584285][T25904] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 1650.618061][T25904] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1650.656506][T25904] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1650.711551][T25904] usb 3-1: config 0 descriptor?? [ 1650.720821][T25904] iowarrior 3-1:0.0: no interrupt-in endpoint found [ 1650.903701][T16035] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1650.916848][T25664] Bluetooth: hci2: command tx timeout [ 1650.929469][T16035] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1650.953729][T16035] bond0 (unregistering): Released all slaves [ 1650.987551][T16035] bond1 (unregistering): Released all slaves [ 1651.085425][T14247] pegasus 2-1:0.0: probe with driver pegasus failed with error -110 [ 1651.154554][T14247] usb 3-1: USB disconnect, device number 47 [ 1651.461865][T27045] delete_channel: no stack [ 1651.470543][T27045] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5219'. [ 1651.486878][T14261] usb 2-1: USB disconnect, device number 41 [ 1651.987241][T16035] ------------[ cut here ]------------ [ 1651.992781][T16035] Have pending ack frames! [ 1652.051543][T16035] WARNING: CPU: 0 PID: 16035 at net/mac80211/main.c:1701 ieee80211_free_ack_frame+0x4c/0x60 [ 1652.062227][T16035] Modules linked in: [ 1652.066199][T16035] CPU: 0 UID: 0 PID: 16035 Comm: kworker/u8:11 Not tainted 6.11.0-rc6-syzkaller-00019-g67784a74e258 #0 [ 1652.077619][T16035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 1652.087777][T16035] Workqueue: netns cleanup_net [ 1652.092608][T16035] RIP: 0010:ieee80211_free_ack_frame+0x4c/0x60 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1652.098896][T16035] Code: 00 00 00 e8 56 5a 5e fe 31 c0 5b c3 cc cc cc cc e8 09 18 72 f6 c6 05 67 db e0 04 01 90 48 c7 c7 60 23 29 8d e8 25 3c 34 f6 90 <0f> 0b 90 90 eb c9 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 [ 1652.118685][T16035] RSP: 0000:ffffc90003c877d0 EFLAGS: 00010246 [ 1652.124896][T16035] RAX: d3c80a1f4444b000 RBX: ffff8880317283c0 RCX: ffff88802ddc9e00 [ 1652.134419][T16035] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 1652.143339][T16035] RBP: ffffc90003c878d8 R08: ffffffff8155b372 R09: fffffbfff1cfa0e0 [ 1652.151393][T16035] R10: dffffc0000000000 R11: fffffbfff1cfa0e0 R12: ffffc90003c87840 [ 1652.159533][T16035] R13: dffffc0000000000 R14: ffff8880654e952c R15: ffff888078ad4df0 [ 1652.167541][T16035] FS: 0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000 [ 1652.176542][T16035] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1652.183151][T16035] CR2: 00007f0e5d594bc0 CR3: 0000000033716000 CR4: 00000000003526f0 [ 1652.191241][T16035] DR0: 0000000000000000 DR1: 000000000000000a DR2: 0000000000000000 [ 1652.199414][T16035] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1652.207442][T16035] Call Trace: [ 1652.210748][T16035] [ 1652.213695][T16035] ? __warn+0x163/0x4e0 [ 1652.217977][T16035] ? ieee80211_free_ack_frame+0x4c/0x60 [ 1652.223560][T16035] ? report_bug+0x2b3/0x500 [ 1652.229143][T16035] ? ieee80211_free_ack_frame+0x4c/0x60 [ 1652.234739][T16035] ? handle_bug+0x3e/0x70 [ 1652.239674][T16035] ? exc_invalid_op+0x1a/0x50 [ 1652.244380][T16035] ? asm_exc_invalid_op+0x1a/0x20 [ 1652.249482][T16035] ? __warn_printk+0x292/0x360 [ 1652.254274][T16035] ? ieee80211_free_ack_frame+0x4c/0x60 [ 1652.259919][T16035] idr_for_each+0x1e2/0x2d0 [ 1652.264446][T16035] ? __pfx_ieee80211_free_ack_frame+0x10/0x10 [ 1652.270553][T16035] ? __pfx_idr_for_each+0x10/0x10 [ 1652.275593][T16035] ? kobject_put+0x272/0x480 [ 1652.280249][T16035] ? kfree+0x149/0x360 [ 1652.284332][T16035] ieee80211_free_hw+0xd0/0x480 [ 1652.289227][T16035] mac80211_hwsim_del_radio+0x32b/0x4c0 [ 1652.294797][T16035] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10 [ 1652.300937][T16035] hwsim_exit_net+0x5c1/0x670 [ 1652.305654][T16035] ? __pfx_hwsim_exit_net+0x10/0x10 [ 1652.310923][T16035] ? __ip_vs_dev_cleanup_batch+0x239/0x260 [ 1652.316803][T16035] cleanup_net+0x802/0xcc0 [ 1652.321236][T16035] ? __pfx_cleanup_net+0x10/0x10 [ 1652.326187][T16035] ? process_scheduled_works+0x945/0x1830 [ 1652.332674][T16035] process_scheduled_works+0xa2c/0x1830 [ 1652.338888][T16035] ? __pfx_process_scheduled_works+0x10/0x10 [ 1652.344926][T16035] ? assign_work+0x364/0x3d0 [ 1652.349579][T16035] worker_thread+0x86d/0xd10 [ 1652.354207][T16035] ? __kthread_parkme+0x169/0x1d0 [ 1652.359464][T16035] ? __pfx_worker_thread+0x10/0x10 [ 1652.364619][T16035] kthread+0x2f0/0x390 [ 1652.368766][T16035] ? __pfx_worker_thread+0x10/0x10 [ 1652.373902][T16035] ? __pfx_kthread+0x10/0x10 [ 1652.378597][T16035] ret_from_fork+0x4b/0x80 [ 1652.383030][T16035] ? __pfx_kthread+0x10/0x10 [ 1652.387673][T16035] ret_from_fork_asm+0x1a/0x30 [ 1652.392482][T16035] [ 1652.395502][T16035] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1652.402781][T16035] CPU: 0 UID: 0 PID: 16035 Comm: kworker/u8:11 Not tainted 6.11.0-rc6-syzkaller-00019-g67784a74e258 #0 [ 1652.413822][T16035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 1652.423926][T16035] Workqueue: netns cleanup_net [ 1652.428892][T16035] Call Trace: [ 1652.432178][T16035] [ 1652.435124][T16035] dump_stack_lvl+0x241/0x360 [ 1652.439843][T16035] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1652.445071][T16035] ? __pfx__printk+0x10/0x10 [ 1652.449756][T16035] ? _printk+0xd5/0x120 [ 1652.453961][T16035] ? vscnprintf+0x5d/0x90 [ 1652.458305][T16035] panic+0x349/0x860 [ 1652.462207][T16035] ? __warn+0x172/0x4e0 [ 1652.466375][T16035] ? __pfx_panic+0x10/0x10 [ 1652.470826][T16035] ? show_trace_log_lvl+0x4e6/0x520 [ 1652.476153][T16035] ? ret_from_fork_asm+0x1a/0x30 [ 1652.481252][T16035] __warn+0x346/0x4e0 [ 1652.485259][T16035] ? ieee80211_free_ack_frame+0x4c/0x60 [ 1652.490854][T16035] report_bug+0x2b3/0x500 [ 1652.495296][T16035] ? ieee80211_free_ack_frame+0x4c/0x60 [ 1652.500877][T16035] handle_bug+0x3e/0x70 [ 1652.505050][T16035] exc_invalid_op+0x1a/0x50 [ 1652.509604][T16035] asm_exc_invalid_op+0x1a/0x20 [ 1652.514486][T16035] RIP: 0010:ieee80211_free_ack_frame+0x4c/0x60 [ 1652.520657][T16035] Code: 00 00 00 e8 56 5a 5e fe 31 c0 5b c3 cc cc cc cc e8 09 18 72 f6 c6 05 67 db e0 04 01 90 48 c7 c7 60 23 29 8d e8 25 3c 34 f6 90 <0f> 0b 90 90 eb c9 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 [ 1652.540365][T16035] RSP: 0000:ffffc90003c877d0 EFLAGS: 00010246 [ 1652.546536][T16035] RAX: d3c80a1f4444b000 RBX: ffff8880317283c0 RCX: ffff88802ddc9e00 [ 1652.554661][T16035] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 1652.562659][T16035] RBP: ffffc90003c878d8 R08: ffffffff8155b372 R09: fffffbfff1cfa0e0 [ 1652.570642][T16035] R10: dffffc0000000000 R11: fffffbfff1cfa0e0 R12: ffffc90003c87840 [ 1652.578714][T16035] R13: dffffc0000000000 R14: ffff8880654e952c R15: ffff888078ad4df0 [ 1652.586709][T16035] ? __warn_printk+0x292/0x360 [ 1652.591605][T16035] idr_for_each+0x1e2/0x2d0 [ 1652.596119][T16035] ? __pfx_ieee80211_free_ack_frame+0x10/0x10 [ 1652.602216][T16035] ? __pfx_idr_for_each+0x10/0x10 [ 1652.607275][T16035] ? kobject_put+0x272/0x480 [ 1652.611880][T16035] ? kfree+0x149/0x360 [ 1652.615980][T16035] ieee80211_free_hw+0xd0/0x480 [ 1652.620876][T16035] mac80211_hwsim_del_radio+0x32b/0x4c0 [ 1652.626478][T16035] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10 [ 1652.632656][T16035] hwsim_exit_net+0x5c1/0x670 [ 1652.637360][T16035] ? __pfx_hwsim_exit_net+0x10/0x10 [ 1652.642593][T16035] ? __ip_vs_dev_cleanup_batch+0x239/0x260 [ 1652.648442][T16035] cleanup_net+0x802/0xcc0 [ 1652.652879][T16035] ? __pfx_cleanup_net+0x10/0x10 [ 1652.657870][T16035] ? process_scheduled_works+0x945/0x1830 [ 1652.663595][T16035] process_scheduled_works+0xa2c/0x1830 [ 1652.669191][T16035] ? __pfx_process_scheduled_works+0x10/0x10 [ 1652.675186][T16035] ? assign_work+0x364/0x3d0 [ 1652.679892][T16035] worker_thread+0x86d/0xd10 [ 1652.684500][T16035] ? __kthread_parkme+0x169/0x1d0 [ 1652.689560][T16035] ? __pfx_worker_thread+0x10/0x10 [ 1652.694699][T16035] kthread+0x2f0/0x390 [ 1652.698776][T16035] ? __pfx_worker_thread+0x10/0x10 [ 1652.703913][T16035] ? __pfx_kthread+0x10/0x10 [ 1652.708505][T16035] ret_from_fork+0x4b/0x80 [ 1652.712948][T16035] ? __pfx_kthread+0x10/0x10 [ 1652.717560][T16035] ret_from_fork_asm+0x1a/0x30 [ 1652.722345][T16035] [ 1652.725671][T16035] Kernel Offset: disabled [ 1652.730095][T16035] Rebooting in 86400 seconds..