last executing test programs: 9m41.093819054s ago: executing program 2 (id=1572): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000007c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x7, [@struct={0x5, 0x1, 0x0, 0xf, 0x0, 0x5, [{0x9, 0x1, 0x5}]}]}, {0x0, [0x5f, 0x0, 0x0, 0x61, 0x61]}}, 0x0, 0x37, 0x0, 0x9}, 0x28) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r0, &(0x7f0000000140)={@val={0x3, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x14}, @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x8016, 0x1400, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @dest_unreach={0x4, 0x0, 0x0, 0x0, 0x0, 0x1400, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @local, @loopback}}}}, 0xfdef) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000080a0103000000000000000001000005080009400000000208000b40000000020c00064000000000000000010c00064000000000000000041c000580080001400000809b080001400000002c08000140000092000c000340000000000000000258000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000414000980100002800c0001800802"], 0xe4}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r5, 0x0, 0x30, &(0x7f0000000600)={0x2, {{0x2, 0x0, @multicast2}}, 0x0, 0x2, [{{0x2, 0x2, @remote}}, {{0x2, 0x0, @local}}]}, 0x190) r6 = syz_genetlink_get_family_id$smc(0x0, r2) sendmsg$SMC_PNETID_GET(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000340)={0x5c, r6, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'netdevsim0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'bond0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x5c}}, 0x20000005) r7 = epoll_create1(0x0) socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet6(0xa, 0x3, 0x5) r9 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER(r9, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x10, 0x3ed, 0x200, 0x70bd27, 0x25dfdbfc, "", [""]}, 0x10}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r8, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r8, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1200", @ANYRES64=r8], 0x108}}], 0x1, 0xc040) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r3, &(0x7f0000000000)={0x2}) 9m40.113929922s ago: executing program 2 (id=1576): r0 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x8000, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000140)={0x48, 0x2, 0x0, "d569e80006a1ade8470000800000000000000000000000008000"}) 9m39.944846527s ago: executing program 2 (id=1577): r0 = fsopen(&(0x7f0000000000)='overlay\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x8, 0x20, 0x0, 0x0) 9m39.904002275s ago: executing program 2 (id=1578): mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', r1, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0/file0\x00') 9m39.772806871s ago: executing program 2 (id=1580): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$inet_tcp(0x2, 0x1, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x0, 0x23, 0x3}, 0x0, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) fsopen(0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, 0x0, 0x0) ioctl$SIOCGETMIFCNT_IN6(0xffffffffffffffff, 0x89e0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r4 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_TIOCINQ(r4, 0x8917, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x1) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@ipv6_newaddrlabel={0x38, 0x48, 0x3d3b866cab67281, 0x70bd25, 0x25dfdbff, {0xa, 0x0, 0x78, 0x0, 0x0, 0xff}, [@IFAL_LABEL={0x8, 0x2, 0xb}, @IFAL_ADDRESS={0x14, 0x1, @mcast2}]}, 0x38}}, 0x4) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f0000000200), 0x0) epoll_pwait2(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)={[0x6]}, 0x8) io_submit(0x0, 0x1, &(0x7f0000000440)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffffc}]) r6 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000800)={r6, r6, r6}, 0x0, 0x0, 0x0) socket$igmp(0x2, 0x3, 0x2) recvfrom(r0, &(0x7f0000000000)=""/116, 0xffffffdd, 0x734, 0x0, 0x0) 9m39.367113262s ago: executing program 2 (id=1582): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x238, &(0x7f00000003c0)={0x0, 0x20c26, 0x10100, 0x2, 0x2d0, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) pause() 9m38.624881768s ago: executing program 32 (id=1582): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x238, &(0x7f00000003c0)={0x0, 0x20c26, 0x10100, 0x2, 0x2d0, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) pause() 12.250339848s ago: executing program 0 (id=4273): syz_open_dev$cec(&(0x7f0000000040), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee4, 0x0, 0x2, 0xbfdffffc}, 0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, r3, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x8001}}) io_uring_enter(r2, 0x2b93, 0xf9d0, 0x22, 0x0, 0x0) 10.567982974s ago: executing program 0 (id=4276): socket(0x2b, 0x1, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x1) syz_io_uring_setup(0x62cf, &(0x7f0000000040)={0x0, 0x3b11, 0x10100, 0x1, 0x1be}, &(0x7f00000000c0), 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) r1 = syz_io_uring_setup(0x7440, &(0x7f00000004c0)={0x0, 0xa6e9, 0x10100, 0x2, 0x26}, &(0x7f0000000140)=0x0, &(0x7f0000000380)=0x0) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f00000001c0)=@IORING_OP_MADVISE={0x19, 0x10, 0x0, 0x0, 0x0, &(0x7f0000002000/0x2000)=nil, 0x2000, 0x65, 0x1, {0x0, r4}}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB='.'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_MKDIRAT={0x25, 0x3, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r1, 0x2d3e, 0x0, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000180)={&(0x7f0000cad000/0x3000)=nil, 0x3000}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x400000000003, 0x7ffff, &(0x7f0000006680)) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x2}, 0x1c) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x32, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x4, "d57e190d001e6e1d16c1711bbd8adbf65bd846957b378a02340c68117aa1b390", "b0b4e2d8157cddfb9792c8e37bafb99e319950347e93f4d34870ee24c0ea06d56270e45c8d3e7d708161ba81dd33c54b", "01acae6f69ea1443db8d53af54944d4894a87f20c65bfb8e0c8cfb67", {"38f5e54b3dc7c070b4d66f0f9565df74", "d2653a13d554fee0e7be27c873db314d"}}}}}}}, 0x0) r7 = msgget$private(0x0, 0x722) msgsnd(r7, &(0x7f00000001c0)={0x3}, 0x8, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_clone(0x101000, &(0x7f0000000200)="686b7100ab60e035955734f9245b7244252313f827dab8bcd6a5519f8bf5a2d308cdb57e4e2bde13338da2c142c2dc7c0e71e401c1b662de088c8f728150d13e21c126b2829d9114b6d7de4448a601a8e1462874f19820600fca88356a0067845841ed39faecde8b41c9d2dc2a7c5b7bedf5cf27df774de8", 0x78, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f0000000300)="b5f9ed94df8cb20173d2e8a6e6965d11519b6b8d94c22bcb40998401fe21282b9c807e4c0983e7be17e51c06814f475cb2197c6380282489ddbbd156794ee2aa30209d9fdc612725b7846ff05944903b2d1994470ca53ff8a66a565be0023bb63f11b63864a92a6f030486497242137721e9f5dc2978d8e57c85eec52f68366df91a865fb291b3efd6fe65a4d9c8d2b12658a3406cd0b3f7ca0bebb2c7ef84fe71f48e") sendmsg$IPSET_CMD_LIST(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c00000007060f0080000000000000000a00000405000100070000000f363d"], 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) 10.30080934s ago: executing program 0 (id=4278): openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file0\x00', 0x814400, &(0x7f0000000040)=ANY=[], 0x20, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000000), 0x101, 0xab02) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f0000000180)=0x1) ioctl$VIDIOC_S_CROP(r0, 0x4014563c, &(0x7f0000000100)={0x9, {0xf8000002, 0x9, 0x6f70, 0xb}}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, 0x0) socket$alg(0x26, 0x5, 0x0) socket(0x13, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x11517d, 0x0) syz_open_dev$sndpcmc(0x0, 0x81, 0x6b4482) write$binfmt_script(0xffffffffffffffff, &(0x7f00000006c0)={'#! ', './file0', [], 0xa, "ecfb2da4955bfd5861d978042a6ad22f6baf924d7bb1f5c47274d2a120e923d6033f5d05901d3dc2bb8087032f8259d85360490a4aa339abd0356bd229401537468c79ba0b2b5d465f3260ed5552d927b0a0c0907dcdbdf460f3b3268b828016289f11222b0135e68943de197f2e6c57289f0fbe7bc357b520795b5a42277a9ac3cab4d25bc9c74284f3de70249515065c8652008fc6bf105d12ec7c17a172d2b5852c05043c187b425a8014f48c8ab9c6"}, 0xbc) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000180)=@raw={'raw\x00', 0x8, 0x3, 0x4a8, 0x0, 0xffffffff, 0xffffffff, 0x150, 0xffffffff, 0x3d8, 0xffffffff, 0xffffffff, 0x3d8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x128, 0x150, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x508) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) r6 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r6, &(0x7f0000000140)={0xa, 0xfffd, 0x0, @mcast2, 0x9}, 0x1c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000000c0)={r5, 0x0}, 0x20) 9.094200741s ago: executing program 4 (id=4280): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c020000190001000000000001000000fe8800000000000000000000000001010000000000000000000000000000000100000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000500000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078ef00000000000000000000000000000000000000000000000000000000000084010500"], 0x23c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 9.006489265s ago: executing program 4 (id=4281): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020000000900020073797a32000000000900010073797a3000000000140003800800024000000000080001400000000014000000110001"], 0x68}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000040000000000a40000000160a01080000000000000000020000000900020073797a30000000000900010073797a3000000000140003800800024000000000080001400000000014000000110001"], 0x68}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x34, 0x10, 0x40d, 0x70bd25, 0x25ffdbfc, {0x0, 0x0, 0x0, 0x0, 0x10}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 8.8645892s ago: executing program 4 (id=4282): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000540)=0x0) lchown(&(0x7f0000000280)='./file0\x00', 0x0, r3) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, 0x0, 0x0) capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000040)={0x200000, 0x200003, 0x0, 0x0, 0x7}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP_SET_OP_GET_FNAME(r0, 0x1, 0x53, &(0x7f0000000100)={0x8, 0x7, 0x0, 'syz1\x00'}, &(0x7f0000000140)=0x2c) r5 = fsopen(&(0x7f0000000400)='xfs\x00', 0x0) close(r5) sched_setattr(0x0, 0x0, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000a40), 0x6, 0x98000) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000180)=0x10, 0x4) ioctl$DRM_IOCTL_MODE_GETPROPBLOB(r6, 0xc01064ac, &(0x7f0000000000)={0x0, 0xe1d, &(0x7f0000019600)=""/4096}) timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) r7 = openat$nullb(0xffffffffffffff9c, 0x0, 0x80200, 0x0) syz_io_uring_setup(0x37ff, &(0x7f00000002c0)={0x0, 0x9191, 0x40, 0x3, 0x20b}, &(0x7f0000000240)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r7, 0xc000000, &(0x7f0000000000)=[{0x0}], 0x1, 0x12}) r10 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080)='ns/cgroup\x00') setns(r10, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) r11 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r11, 0x6, 0x9, 0x0, 0x0) getsockopt$inet_tcp_int(r11, 0x6, 0x9, 0x0, &(0x7f0000000040)) unshare(0x62040200) 7.192201342s ago: executing program 4 (id=4289): syz_usb_connect(0x0, 0x30, &(0x7f00000000c0)={{0x12, 0x1, 0x141, 0xf2, 0xc5, 0x96, 0x20, 0x16d0, 0x10b8, 0xde8e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x0, 0x83, 0xec, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x2, 0x0, 0xa}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) (async) r0 = syz_usb_connect(0x0, 0x30, &(0x7f00000000c0)={{0x12, 0x1, 0x141, 0xf2, 0xc5, 0x96, 0x20, 0x16d0, 0x10b8, 0xde8e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x0, 0x83, 0xec, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x2, 0x0, 0xa}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x42) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0xfffffffffffffffd, 0x4, 0xfe, @buffer={0x0, 0x0, 0x0}, &(0x7f00000000c0)="0c36bc46", 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000f80)=ANY=[@ANYBLOB="00301c"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r1, 0xf501, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000c80)={0x44, &(0x7f0000000a40)={0x0, 0x10, 0x28, "e84d1e7505000000000000004ead1ee50c5bde33e8a6a80fa6290ad6099b215461035b0367072d1c"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 7.122624773s ago: executing program 0 (id=4291): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x87, @loopback, 0x4e24, 0x1, 'none\x00', 0x1, 0x32bd, 0x9}, {@loopback, 0x4e22, 0x2, 0xfffffffe, 0x4, 0x12d5c}}, 0x44) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x2710, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000020000/0x18000)=nil, &(0x7f0000000300)=[@textreal={0x8, 0x0}], 0x1, 0x69, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f0000000180)={0x0, 0x10d000}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f"], 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x680c82, 0x0) socket$packet(0x11, 0x2, 0x300) syz_usbip_server_init(0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) 5.900246509s ago: executing program 5 (id=4293): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0xe2202, 0x0) writev(r0, &(0x7f0000000880)=[{&(0x7f0000000340)="ec", 0x1}], 0x1) close(0x3) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x275a, 0x0) write$cgroup_int(r2, 0x0, 0x0) write$rfkill(r2, &(0x7f0000000140)={0x8, 0x5, 0x0, 0x0, 0x1}, 0x8) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f0000000100)={0xd, 0x1, {r3}, {r4}, 0xa, 0x6}) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x1) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000180)={{0x1, 0x1, 0x18, r2, {r4, r5}}, './file0\x00'}) quotactl_fd$Q_GETNEXTQUOTA(r9, 0xffffffff80000900, r10, &(0x7f00000001c0)) 5.816250839s ago: executing program 3 (id=4294): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000180), 0x129202, 0x0) r1 = socket$l2tp(0x2, 0x2, 0x73) sendmsg(r1, 0x0, 0x20040001) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000000)=0x1000) r2 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x10cc, 0x0, 0x0, 0xc3}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x3, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000000)=0x4000) timer_create(0x0, &(0x7f0000000200)={0x0, 0x29, 0x4, @thr={&(0x7f0000000380)="290f32e6c41d498d3273f569c0770b37923466e128e1f7763eb2b77e549fb24e38125652fcaacc2f575e450f56c9a200e1786e5f0eeb7efb0039bb2e1de3bf45f6715b042cf2ae67528bd3ab550fe6da1af7f046d3864bc30d3f8c6471d047e0d6bc7d2e102ad171893377967b58a52f3ac1603ce969f834675d386d276866459f8cd7c2725c70c618448dee6cf02aaeeac6c49868aba019b04e72d857f0e00d47e04fa800ff62147003b16c2cdacbbe0f2354e4c077d224ae44d1a30c17ac8ad225c12004677a22ef6baebbffcb25019ef781a2f19fd4a25fc709242abdeba98a3840b3859d25a583f0f39f256cb2bb25b7101f057a471d", &(0x7f0000000480)="f8e34a452845b533452cb1d66b44f02b5357a5711dacc1c07d5da369d56d0682154fcf980b1ef09e2768617e260c5c94252c042e952d0f961b1e48d0ac3a33a5aa2a70161e3787ba600d64bf3811cf353afa35ca817053b48403e5edc6de6f8c55f8d16b6ba801a4f4ce54f5c72595b9f996e27ac62acabd41678947719241ef3e3c1b8365c40d07e145a75aa7dd3b31c83419999fe3b22c8ab5bd50c00697b80d665b75c9326a0995c156405683ba71c04c3dd1e26ba7fd287b32ef404b3f8d528c289cef5b3561498a953ef2d36f47a29560d30bb04778125a0d4e"}}, &(0x7f0000000240)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r5 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xf}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_BETA={0x8, 0x6, 0x5}, @TCA_FQ_PIE_ALPHA={0x8, 0x5, 0x3}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) socket$packet(0x11, 0x2, 0x300) 5.680893875s ago: executing program 5 (id=4295): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000240), 0x140, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x400, 0xa, 0x0, 0x0, 0x0, 0x180, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x4, 0x80, 0x0, 0x0, 0x2, 0x0, 0x1}) 5.468662348s ago: executing program 5 (id=4297): r0 = socket$nl_generic(0x10, 0x3, 0x10) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) r2 = io_uring_setup(0x3eae, &(0x7f0000000080)={0x0, 0x7db1, 0x400, 0x3}) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x1ef6e3}], 0x100000000000011a) syz_usb_connect(0x5, 0x3f, &(0x7f0000000580)=ANY=[@ANYBLOB="12010000aa3a3740480b032061390000000109022d000100000000090453000327a1410009140c1000000a02fe09058b"], 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x22200, 0x0) fcntl$setstatus(r3, 0x4, 0x40c00) r4 = syz_io_uring_setup(0xcf, &(0x7f0000000480)={0x0, 0x5afa, 0x100, 0x22, 0x335}, &(0x7f0000000400)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000000)=0x103, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/15, 0xf}], 0x1}) io_uring_enter(r4, 0x47ba, 0x0, 0x0, 0x0, 0x0) read$FUSE(r1, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r7, {0x7, 0x1f, 0x0, 0x1000040c, 0xffff}}, 0x50) syz_fuse_handle_req(r1, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80f81, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x1c, 0x0, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKMODES_LANES={0x8, 0x9, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004850}, 0x4044014) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8, @ANYBLOB="05"], 0x0) 4.052570784s ago: executing program 4 (id=4298): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = syz_open_dev$usbfs(&(0x7f00000001c0), 0xfffffffffffffff8, 0x2) r1 = dup(r0) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000040)={0x0, 0x12, 0xf2a, 0x2, 0x0, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)={{0x12, 0x1, 0x0, 0x35, 0xff, 0xaa, 0x20, 0xccd, 0x10af, 0x384e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x59, 0x2, 0x1, 0x9b, 0x1e, 0x2a, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000009b768405e0483020b9901e40201090227000100000000090400fb015cc7aa00090509"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x3, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xfffffffffffffd63}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r6, &(0x7f0000005540)=[{{0x0, 0x0, &(0x7f0000004280)=[{&(0x7f0000004b00)="38f7a466442abb46f49d4d0a4fb953b0d6bdd88905bb06505b7569d22032d88d285001d666684dc3cbb5f5c48835c10237aa541cabb68ecd6987d7b870088b3bc7e9a35ce24a4159c66419bdb57de32b7126ba8bc6967aade0041f5953ac5c1882cffae4120fda6df1f3f1e8af2ef6977fa85485e7afb983f362c81e3929e712ec3d4d3ca60aecd2adcca7359c5199b40a926abd49ab5b008952dea235df51f6d3b63fcb5c963dad185df834ee34f16f53bc1c2ef8a4209e6e8bbc62136b4ce64e1f5d6f28e00e19e4a2f9c3df30bad3d72f5d39d8f1", 0xd6}, {&(0x7f0000004200)="e0eae9ece9f66497aa8205bfb6c8da98dc9ce63f9b32d22e9b7e3820a0be84195b994cfa6f9458e6977e07a1de48a5ecac65e1aef11b2f51cefdbb98aa69966ab6ef08212323fd1b1b3ffd028f", 0x4d}], 0x2, &(0x7f0000004d40)=[@rights={{0x28, 0x1, 0x1, [r5, 0xffffffffffffffff, r5, r2, r0, r2]}}, @cred={{0x1c, 0x1, 0x2, {r4}}}], 0x48, 0x20000080}}, {{0x0, 0x0, &(0x7f0000005240)=[{&(0x7f0000004dc0)="1649508e9cef53b417315dab67476fcb222056243fd8e5d851aff93231b83c1d05eb3d76f02b891a9740715cf1d18ea189eb0842768e60456008d237867032181747346a51aed03eb0fe1140d97e8ee36f48fa9857292fe79aed570bc6501a6bcda18d00d0e75b0413ed7f5a69c8010f8ba45662617378a0c200b516f73aac013192ff11e69b4dbb6462ce31c5a53400aa705dd63a340659d21237e6aab4e092302b7758e38112501d61373e43a71b18c445f3ec1c3e40d6eab76ae3", 0xbc}, {&(0x7f0000004e80)="6737d8a033a1036a28c2ce48454a6833d461e2838d0194611c8c14197fea2c7df9f6f0038463a2c2b8a7c15f8a252635f9d444ae3c1a5dbeb8307a924ce3f376ffa4088b7ffcaa9ec915351c", 0x4c}, {&(0x7f0000004f00)="51813d86869cf9741a83d8279d97b53e838d74bf3d7a98dcf67904611e1a7e2cf3bf05ee4cd8a9e41f4e6a4274e5d74ac746e24619c40db5c8cc136d03eac7c1c2fcafb485c8913717c0e472ab38a87bac86153efec8bf9f9abe07919cf465fcfa1a385a6f96812215477bd445037f47d3de7e4dbc1d48a807838cf8174d342270b7d6c5c99d8fc7933e57a04b2bffe8f77af45b1985bd5dc8273ecdbd45ebb9c477390e98d980c872c78e8980ff10b43574c1431e46cacbe2b0ce0230301c", 0xbf}, {&(0x7f0000004fc0)="c84fdd229e20daac824f821ab424d7971dbc950940ae047a22ad11da11e2d819e9033c95fdcbbeacc2387f24798e409489f63cc4b3f1c13ac96d50120cb7fa9fb90c266da4b4b457f542b05e432b5ae240403221fbae8989abcdefc686ff01af130aa40c62f7b562766979a40c5e", 0x6e}, {&(0x7f0000005040)="18ccd0f80fa1e074ca30e25cc7a78ce5a2d9f0b76b07627e246580f1d37dd846ff4322b7e5eb2ef1421d127f1846cfa76c623ea0a578eb6e00c4ceaca21a000575d160c20a3dad88ed3136d40de95cca879033aca8ee678c5f2f9ebd673b88ff0a301b4c5f06443d68e124aa8ecb67c2eef470afed44621495d9849606259218c70f68c0dccc85b50de4eac811c4c11918a57fba426ca5b08418286ac8e50c01c860c3bdebdc3f0f508048bfe82581077a92d03e4708d68c5a93bc8ef1750844615b20160f1bdc0dfa77c2cc94a605da7de25902f4c7abf2345056a4591f3278593fc8710edc76253e88fbc777ffbbc5c3cd34b65ccb159dc44cdaf3", 0xfc}, {&(0x7f0000005140)="a0178f07af24b05d23d5f49fcb4158573aab54e62eb6c8d15b061713d5d3c74b957022d59b55351c979b7245404255ba5ecc9c3d96d169c4558fd9d35102a6bb8fe4e7fb1a961f7c4d8c1b43fba0611fef524d7a44e258a7effdd208819b54cca3e34c9ee9757501d48f4af75f7f63ea3c85d2c252631feab6e9a18a9f5714e1a5c0b6b30f49ac4cf4b1893e8090215dec875d908ad623475afa1164319bf0420fd635ed28c1c6f99dc8d14c4adb80bcd1ca65f08a512a33e05a7c8030b76219dc20ff502d076e46a44a9f7f765368af17dc3adce889d7aa668efa877702086848f8c3ad24e5a496ae22646d3a7ec7e781557cdee84bbb5f", 0xf8}], 0x6, &(0x7f0000005440)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, r6, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [r1, r1, r2, r2, r1, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r4}}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [r2, r1, 0xffffffffffffffff, r6, r1]}}, @cred={{0x1c}}], 0xe8, 0x40}}], 0x2, 0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f0000004940)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000300)=""/200, 0xc8}, {&(0x7f0000000000)=""/25, 0x19}, {&(0x7f0000000640)=""/4096, 0x1000}], 0x3, &(0x7f0000000500)=""/184, 0xb8}, 0x8001}, {{&(0x7f0000000400)=@pppol2tpin6, 0x80, &(0x7f00000029c0)=[{&(0x7f0000001640)=""/86, 0x56}, {&(0x7f00000016c0)=""/4096, 0x1000}, {&(0x7f00000026c0)=""/127, 0x7f}, {&(0x7f0000002740)=""/169, 0xa9}, {&(0x7f0000002800)=""/77, 0x4d}, {&(0x7f0000002880)=""/115, 0x73}, {&(0x7f0000002900)=""/180, 0xb4}], 0x7, &(0x7f0000002a40)=""/112, 0x70}, 0x6fc4}, {{&(0x7f0000002ac0)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000002b40)=""/142, 0x8e}], 0x1, &(0x7f0000002c00)=""/4096, 0x1000}, 0x1c9}, {{&(0x7f0000003c00)=@x25, 0x80, &(0x7f0000003fc0)=[{&(0x7f0000003c80)=""/95, 0x5f}, {&(0x7f0000003d00)=""/120, 0x78}, {&(0x7f0000003d80)=""/159, 0x9f}, {&(0x7f0000003e40)=""/60, 0x3c}, {&(0x7f0000003e80)=""/110, 0x6e}, {&(0x7f0000003f00)=""/75, 0x4b}, {&(0x7f0000003f80)=""/16, 0x10}], 0x7}, 0xe}, {{&(0x7f0000004040)=@alg, 0x80, &(0x7f00000041c0)=[{&(0x7f00000040c0)=""/224, 0xe0}], 0x1}, 0x7}, {{0x0, 0x0, &(0x7f0000004280), 0x0, &(0x7f00000042c0)=""/134, 0x86}, 0x1ff}, {{0x0, 0x0, &(0x7f0000004840)=[{&(0x7f0000004380)=""/122, 0x7a}, {&(0x7f0000004400)=""/162, 0xa2}, {&(0x7f00000044c0)=""/105, 0x69}, {&(0x7f0000004540)=""/100, 0x64}, {&(0x7f00000045c0)=""/237, 0xed}, {&(0x7f00000046c0)=""/117, 0x75}, {&(0x7f0000004740)=""/237, 0xed}], 0x7, &(0x7f00000048c0)=""/93, 0x5d}, 0x9}], 0x7, 0x2, 0x0) dup(0xffffffffffffffff) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) unlink(0x0) bind$inet6(r7, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 3.893985559s ago: executing program 3 (id=4299): r0 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0x2a382) r1 = memfd_create(&(0x7f0000000180)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6*t\xc8\xf4>q%\xa4\x81\xe2\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\x1cf\xf0\xf2xW?\x8e\xd9\x06\xc7\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n<+l\xfdG\x8e\t\x96rT|\xe3\x13\x19\xe3%g\xa7n\xa93\xf5>\x81R\xe7`\x83N\xf4\xa7\xc8:\x8eY\x0e@\x1b\x17Y>b\x85\xd3\x12I\xbf\xac\x9eM\x884Z\xaf\xf3\'\x8aj\"\xd1~k\x7f%\x96\xf95&\x84A%\x97\xb8\x18\xa7\x88\xe3w', 0x1) writev(r1, &(0x7f0000000500)=[{&(0x7f0000000480)="f6bbd6eec7a4453b579834bb605b0f57a83a0d53ce7ac78e1f72a6c4edb3ab954973ddfc8887287b21c3a4b789e322649844bd8432a081e96fbb1e40ddac7e345182e87252a085982e99b2d70e4256b4b2196d8d9e3dcb32fd04b7da1e9d00", 0x5f}, {&(0x7f0000000ac0)="4467cce80fb74fb59f11cabb44599d603b12d81ce8f472453833bf396805511c05bef6e77711c56f5b09060000000000000062f2ee3b259d6a5bef5276fb7b3add780f954382c2fa74cbaa74eda99f59f4a1e11e8c5d37dd03e732cf6c87548e839aaeaa70a50904cf7ccea421a2833d9922dfdea4f39077291b9b6fc343b9f052835fe7cb7fad6d21393d70a63f2c48f1038261fec3d273cb476ed582984b244a67a8240714e173f4cb8a40d34c7375417910e2023ca94390fbbef81340690ea8b34ce799f36b84a5c827840f181bcb0bc3ef1b642c4f8519a5131199f4e4a714e33f73b21f6010324296", 0xeb}, {&(0x7f0000000700)="bb0468960f2e53261fa9ca5cf873d344613dd61f309869a64e6f891bc5cfca8eadd70239d7d36b701bf1e603a2c4171ffebc635dd880c380ba8760cefe8c1f827af9b1efa65cf75a04005d957d891db5c3bc7e000f6b6b453de044c14fc8f866d81095efbf56fde3f2babe4886ede8b7f93ebac8fdf2484a85910056dd52f15c72edf8e882d128a7e956cf2d4d1dd17d4f6475af0f8afb8be1668e12c83ed66c62c103900d2c55f72a00a73d5aea7e05fd96946db735", 0xb6}], 0x3) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000000)={0x0, {}, 0x0, {}, 0x0, 0x0, 0x25, 0xd, "eeddb7c25540993ad642248c7b01570000000000000066cdddf2e9ce8bb87ae03e87a61fb648d5c6a3e9977956be87176a30a90000000000000000002200", "a863a5170a11d26a730cb3d1e9fb18cb0e58986d58e881bbe5e4230de84eea7a", [0x3, 0x800]}) 3.703323776s ago: executing program 3 (id=4300): ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x10001}}, './file0\x00'}) r1 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x3fd, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r1, 0xc0285628, &(0x7f0000000080)={0x3, @raw_data="8641ae658f29b15d58b8712cb73722a98e10894c2b5c09b8d78849e750c817c83d70116b19faf388bb4c1db638dc1bd9b910f7e481cb9c62d86046a733ea08e94c1d4ae293108243682952a875aec594300909e5bc3c90e46866e037d6c04f4a2b689f2d52fc11d3673a0c2fdeea258a99d7d3e52d40fb123f89e0d880b13b1b51d3c8efe8c2778a85e1a9a823da8d5f3c629d1a6c8fe65c15dee8aa74491e2a9eab1745e86d26e26180c7491e7c081529abe1c6e1d8bfc9d15442553ec84fa2deb0a6aa00"}) io_submit(0x0, 0x0, 0x0) r2 = syz_open_dev$vim2m(0x0, 0x7, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r2, 0xc0285629, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x10d2, 0x0, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) r4 = openat$userfaultfd(0xffffffffffffff9c, &(0x7f0000000180), 0x80800, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x89f0, 0x0) signalfd4(r5, 0x0, 0x0, 0x80000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYRES64=r4], 0x74}}, 0xc0f8828b55a93088) syz_io_uring_submit(0x0, 0x0, 0x0) r7 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_S_CTRL(r7, 0xc008561c, &(0x7f0000000080)={0xf0f041}) io_uring_enter(r3, 0x47bc, 0x0, 0x0, 0x0, 0x0) unshare(0x2a020400) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r8, 0x0, 0x21, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) 3.56644863s ago: executing program 3 (id=4301): r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000080)={0x0, 0x2, 0x2, 0x0, 0x2}) landlock_create_ruleset(&(0x7f0000000040)={0x200}, 0x18, 0x0) (async) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x200}, 0x18, 0x0) landlock_restrict_self(r1, 0x5) pivot_root(&(0x7f0000000140)='./cgroup\x00', &(0x7f00000001c0)='./cgroup\x00') socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x30, 0x1, 0x1, 0x201, 0x0, 0x0, {}, [@CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x400006}, @CTA_STATUS={0x8}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x4316d5206da97f33}]}]}, 0x30}}, 0x0) (async) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x30, 0x1, 0x1, 0x201, 0x0, 0x0, {}, [@CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x400006}, @CTA_STATUS={0x8}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x4316d5206da97f33}]}]}, 0x30}}, 0x0) r3 = io_uring_setup(0x115c, &(0x7f0000000440)={0x0, 0x8270, 0x40, 0x3, 0x117}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000000640)=[{0x0}], 0x178) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000140)=""/189, 0xbd}], 0x0, 0x1}, 0x20) (async) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000140)=""/189, 0xbd}], 0x0, 0x1}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x6a, 0xa, 0x0, 0xffc4, 0x2, 0x71, 0x10, 0x69, 0x3}}, 0x0}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x6a, 0xa, 0x0, 0xffc4, 0x2, 0x71, 0x10, 0x69, 0x3}}, 0x0}, 0x94) io_uring_register$IORING_REGISTER_FILES(r3, 0x1e, &(0x7f0000000000)=[r3], 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0x67, &(0x7f0000000180)=0x1, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x3, &(0x7f0000000040)=[{0x35, 0x1, 0x0, 0xffffffff}, {0x87, 0xfe, 0x4, 0xff}, {0x6}]}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(0xffffffffffffffff, 0x3b86, &(0x7f0000000080)={0x18, r5}) socket$unix(0x1, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000580)=@abs={0x1, 0x0, 0x4e1c}, 0x6e) syz_open_dev$sndctrl(&(0x7f0000000040), 0x1, 0x0) (async) syz_open_dev$sndctrl(&(0x7f0000000040), 0x1, 0x0) 2.780742889s ago: executing program 0 (id=4302): socketpair$unix(0x1, 0x3, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, 0x0, 0x6) sendto$unix(0xffffffffffffffff, &(0x7f0000000000)="355a09400e0a5549031050cab953e8ee195cfb3ddc55cfdea72c2943473724cf17ea4d8ae339ce874ed5f6d1301a58fbd145158004fcf320ba65cdd5a1b33b", 0x3f, 0x4000000, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000440)=""/98, 0x62) ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = syz_io_uring_setup(0x1239, &(0x7f0000002c80)={0x0, 0xe3d3, 0x0, 0x800005, 0x21ed}, &(0x7f0000000440)=0x0, &(0x7f0000002d00)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r0, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000002e40)="f8f5", 0x2}], 0x1}, 0x0, 0x24000890, 0x1}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000980)={0x20, 0x1, 0x1, 0x201, 0x0, 0x0, {0xa, 0x0, 0x4}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x22}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x0) io_uring_enter(r1, 0x3516, 0x0, 0x41, 0x0, 0x0) 2.720746826s ago: executing program 3 (id=4303): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400c000}, 0x44) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x7, 0x10, 0x0, 0x0, 0xb47, 0x9, 0x8, 0xffffeffc, 0x3}, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) mknod$loop(0x0, 0x0, 0x1) r3 = socket(0x8000000010, 0x2, 0x0) write(r3, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) syz_genetlink_get_family_id$ethtool(0x0, r3) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) r4 = socket(0x840000000002, 0x3, 0x100) sendmmsg$inet(r4, &(0x7f00000003c0), 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r5, 0x8955, &(0x7f0000000180)={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x32}}, {0x20000010304, @local}, 0x4, {0x2, 0x4e20, @rand_addr=0x64010102}}) 2.340040087s ago: executing program 1 (id=4304): syz_genetlink_get_family_id$tipc2(&(0x7f0000000d00), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYBLOB="030700000000000000000800000068000480040007801300010062726f6164636173742d6c696e6b00001900078008000300000000000800020000000000080003000000000008000200000000000800030000000000040004"], 0x7c}}, 0x0) 2.139302756s ago: executing program 1 (id=4305): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000280)={'wg0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv4_newroute={0x2c, 0x1a, 0x1, 0x70fd29, 0x0, {0x2, 0x20, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, [@RTA_IIF={0x8, 0x3, r1}, @RTA_DST={0x8, 0x1, @multicast1}]}, 0x2c}}, 0x0) 2.046787895s ago: executing program 1 (id=4306): ioctl$FBIOGET_VSCREENINFO(0xffffffffffffffff, 0x4600, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x3, 0x8f, &(0x7f0000000580)=ANY=[], 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x9, 0x31, 0xffffffffffffffff, 0x0) process_vm_writev(r2, &(0x7f0000001c80), 0x0, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x74}], 0x1, 0x0) (async, rerun: 64) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) socketpair(0x1, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) (async, rerun: 64) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (rerun: 64) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) (async, rerun: 32) openat$ptp0(0xffffffffffffff9c, 0x0, 0x100, 0x0) (rerun: 32) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r3, &(0x7f0000000000)="f461c5bbd75c3583", 0x8, 0x200540c1, &(0x7f0000000040)={0x2, 0x4e23, @empty}, 0x10) (async, rerun: 32) r4 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) (rerun: 32) ioctl$SW_SYNC_IOC_INC(r4, 0x40045701, &(0x7f0000000440)=0xffffffff) recvmmsg(r3, &(0x7f000000e280), 0x58a, 0x42, 0x0) (async, rerun: 32) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (rerun: 32) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000500)={0x0, 0x1, 0x20000000000000, 0x2000, &(0x7f0000000000/0x2000)=nil}) 1.923364503s ago: executing program 0 (id=4307): unshare(0x2060000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, &(0x7f00000000c0)}) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb00000001090224"], 0x0) syz_open_dev$midi(0x0, 0x3, 0x4a243) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x1c, 0x24, 0x301, 0x70bd25, 0xfffffffc, {0x11}, [@typed={0x8, 0x142, 0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x448d3}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_HELLO_TIME={0x8, 0x2, 0x1}, @IFLA_BR_FORWARD_DELAY={0x8}]}}}]}, 0x44}}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x28a02, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0x19) syz_emit_ethernet(0x46, &(0x7f0000000140)={@broadcast, @random="17043a73dbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x7, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa, @rand_addr, {[@lsrr={0x83, 0x3}, @rr={0x7, 0x3}]}}}}}}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'ip6tnl0\x00', 0x0, 0x0, 0xff, 0x0, 0x7, 0x0, @dev, @private1={0xfc, 0x1, '\x00', 0x1}, 0x0, 0x1, 0xfffffffe}}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x4058534c, &(0x7f0000000040)={0x80, 0x1, 0x7, 0xcb25, 0x0, 0x3}) openat$urandom(0xffffff9c, &(0x7f0000000640), 0xe32ce1477acc83bf, 0x0) 1.825048399s ago: executing program 1 (id=4308): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020200000d0000000000000000000000030006000000000002000000ac1414bb000000000000000002000100000000000000000000000000030005000000000002000000ac1414aa000000000000002001001500000000000100140000000000010016"], 0x68}, 0x1, 0x7}, 0x0) 1.817916121s ago: executing program 5 (id=4309): openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file0\x00', 0x814400, &(0x7f0000000040)=ANY=[], 0x20, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000000), 0x101, 0xab02) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f0000000180)=0x1) ioctl$VIDIOC_S_CROP(r0, 0x4014563c, &(0x7f0000000100)={0x9, {0xf8000002, 0x9, 0x6f70, 0xb}}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, 0x0) socket$alg(0x26, 0x5, 0x0) socket(0x13, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x11517d, 0x0) syz_open_dev$sndpcmc(0x0, 0x81, 0x6b4482) write$binfmt_script(0xffffffffffffffff, &(0x7f00000006c0)={'#! ', './file0', [], 0xa, "ecfb2da4955bfd5861d978042a6ad22f6baf924d7bb1f5c47274d2a120e923d6033f5d05901d3dc2bb8087032f8259d85360490a4aa339abd0356bd229401537468c79ba0b2b5d465f3260ed5552d927b0a0c0907dcdbdf460f3b3268b828016289f11222b0135e68943de197f2e6c57289f0fbe7bc357b520795b5a42277a9ac3cab4d25bc9c74284f3de70249515065c8652008fc6bf105d12ec7c17a172d2b5852c05043c187b425a8014f48c8ab9c6"}, 0xbc) r3 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000180)=@raw={'raw\x00', 0x8, 0x3, 0x4a8, 0x0, 0xffffffff, 0xffffffff, 0x150, 0xffffffff, 0x3d8, 0xffffffff, 0xffffffff, 0x3d8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x128, 0x150, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x508) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) r5 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r5, &(0x7f0000000140)={0xa, 0xfffd, 0x0, @mcast2, 0x9}, 0x1c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000000c0)={r4, 0x0}, 0x20) 1.386548979s ago: executing program 1 (id=4310): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB, @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 1.135455584s ago: executing program 1 (id=4311): socket$netlink(0x10, 0x3, 0x10) bind$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x8, 0x0, 0x1, 0x4, 0x6, @random="e3054f3dc327"}, 0x14) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)=@generic={&(0x7f0000000100)='./file1\x00', 0x0, 0x38}, 0x18) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x14}, 0x0) setsockopt$inet6_int(r2, 0x29, 0xb, &(0x7f0000000400)=0x6, 0x4) recvmmsg(r2, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 834.808465ms ago: executing program 3 (id=4312): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x1003ffffffc]}, 0x8, 0x0) read$FUSE(r2, &(0x7f0000006f00)={0x2020}, 0x2020) write$6lowpan_enable(r2, &(0x7f0000000040)='0', 0x1) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x7, 0x10, 0x0, 0x0, 0xb47, 0x9, 0x8, 0xffffeffc, 0x3}, 0x0) mknod$loop(0x0, 0x0, 0x1) r3 = socket(0x8000000010, 0x2, 0x0) write(r3, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xb, &(0x7f0000001580)=ANY=[@ANYBLOB="18000000010000000000000008000000180500002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000010000008500000006000000950000"], &(0x7f0000000000)='syzkaller\x00', 0xe, 0xff5, &(0x7f00000003c0)=""/4085}, 0x94) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f0000000400)={0x2, 0x4e20, @remote}, 0x10) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r5, 0x8955, &(0x7f0000000180)={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x32}}, {0x20000010304, @local}, 0x4, {0x2, 0x4e20, @rand_addr=0x64010102}}) 759.464045ms ago: executing program 5 (id=4313): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f00000000c0)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) fcntl$getflags(r0, 0x40a) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x4080) r1 = syz_open_dev$vim2m(&(0x7f0000000080), 0x200000000000004, 0x2) r2 = socket$alg(0x26, 0x5, 0x0) unshare(0x22020400) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$sock_int(r3, 0x1, 0x4a, 0x0, &(0x7f0000000080)) bind$alg(r2, &(0x7f0000000940)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f00000007c0)={0x0}, &(0x7f0000000800)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r4, 0x84, 0x6c, &(0x7f0000000740)={r5, 0x57, "9b00b2f38ec4188cf8730ca695b6046a304a802ec9a80c204719d1f6649851f1ba1925dedab973e0fa1ace9f3cbea8b907d8c6ba9c5dfe08a087e3d00370f2a892990babd8e963e633e39314a0b58e3202bd14c2b72252"}, &(0x7f00000002c0)=0x5f) r6 = accept$alg(r2, 0x0, 0x0) write$binfmt_script(r6, &(0x7f0000000180)={'#! ', '', [{0x20, '/proc/mdstat\x00'}, {}, {0x20, '#! '}]}, 0x17) recvmmsg(r6, &(0x7f00000008c0)=[{{&(0x7f00000000c0)=@pptp={0x18, 0x2, {0x0, @initdev}}, 0x80, &(0x7f00000005c0)=[{&(0x7f00000001c0)=""/200, 0x6}, {&(0x7f0000000140)=""/9, 0xa}, {&(0x7f0000000300)=""/225, 0x2}, {&(0x7f0000000400)=""/55, 0xfeb2}, {&(0x7f0000000440)=""/123, 0xfffffe37}, {&(0x7f00000004c0)=""/203, 0xcb}], 0x6, &(0x7f0000000640)=""/123, 0x7b, 0x2000000}}, {{&(0x7f00000006c0), 0x80, &(0x7f0000000840), 0x0, &(0x7f0000000880)=""/24, 0xffffffffffffffe0}}], 0x2, 0x400000eb, &(0x7f0000008000)={0x0, 0x989680}) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x9, 0x1, 0x1, "3a8e07000034b52ba75088c27891ca55e21f0000000000b2b679d2009800", 0x41414770}) mbind(&(0x7f00008dc000/0x3000)=nil, 0x3000, 0x3, 0x0, 0xfffffffffffffffd, 0x0) 208.810468ms ago: executing program 5 (id=4314): sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) chmod(&(0x7f0000000040)='./file0\x00', 0x134) r1 = syz_io_uring_setup(0xcaf, &(0x7f0000000100)={0x0, 0xb601, 0x1, 0x5, 0x17a}, &(0x7f0000000240)=0x0, &(0x7f00000000c0)=0x0) r4 = timerfd_create(0x0, 0x0) timerfd_gettime(r4, &(0x7f0000000000)={{0x0, 0x0}}) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYRES64=r5, @ANYRES32, @ANYBLOB="00000004c4"], 0x50) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0xc000000, &(0x7f00000001c0)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x1e}) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_NOP={0x0, 0x59}) io_uring_enter(r1, 0x847ba, 0x20000000, 0xe, 0x0, 0x0) fsconfig$FSCONFIG_SET_FLAG(0xffffffffffffffff, 0x0, &(0x7f0000000000)='async\x00', 0x0, 0x0) 0s ago: executing program 4 (id=4315): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r2, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r1, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x6}, 0x10) bind$tipc(r1, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x22, 0xf, {[@global=@item_012={0x0, 0x1, 0x5}, @local=@item_4={0x3, 0x2, 0x0, "45501821"}, @global=@item_012={0x1, 0x1, 0x9, "f5"}, @global=@item_012={0x1, 0x1, 0x7, "84"}, @local=@item_4={0x3, 0x2, 0x3, "af8df2f7"}]}}, 0x0}, 0x0) r7 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGFIELDINFO(r7, 0xc038480a, &(0x7f0000000080)={0x1, 0x200, 0x10ac, 0x4, 0x7, 0x82, 0x4, 0x5, 0x1, 0x6, 0x7, 0x3ff, 0x1, 0x54}) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r4, r10, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, &(0x7f0000000080)="0f0119f226ff6ffb0f20e06635000200000f22e00f01d1f26db871008ed866b9eb0b00000f3266b80500000066b90b0000000f01c1baa000ec360f09", 0x3c}], 0x1, 0x60, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x5b, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x19, &(0x7f0000000100)=[@cr4={0x1, 0x40240}], 0x1) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='io.stat\x00', 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) kernel console output (not intermixed with test programs): USB device number 108 using dummy_hcd [ 897.188440][T18689] usb 5-1: device descriptor read/64, error -71 [ 897.232338][T19159] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3692'. [ 897.348537][ T5938] gspca_sonixj: reg_w err -71 [ 897.353332][ T5938] sonixj 4-1:0.0: probe with driver sonixj failed with error -71 [ 897.405591][ T5938] usb 4-1: USB disconnect, device number 22 [ 897.468413][T18689] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 897.620113][T18689] usb 5-1: device descriptor read/64, error -71 [ 897.748806][T18689] usb usb5-port1: attempt power cycle [ 897.917082][T19165] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3695'. [ 898.070085][T19166] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3695'. [ 898.238341][T18689] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 898.266236][T18689] usb 5-1: device descriptor read/8, error -71 [ 898.282720][T19170] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 898.296121][T19170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 898.528172][T18689] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 898.570912][T18689] usb 5-1: device descriptor read/8, error -71 [ 898.583509][T19175] kvm: pic: non byte write [ 898.686145][ T5948] usb 6-1: USB disconnect, device number 41 [ 898.711330][T18689] usb usb5-port1: unable to enumerate USB device [ 898.878396][T18689] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 898.942866][T19180] kvm: pic: non byte write [ 899.060735][T18689] usb 2-1: Using ep0 maxpacket: 8 [ 899.108099][T18689] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 899.131608][T18689] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 899.157265][T18689] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 899.198366][T18689] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 899.224199][T18689] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 899.260783][T18689] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 899.279089][T18689] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 899.525818][T19174] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3698'. [ 899.577538][T18689] usb 2-1: usb_control_msg returned -71 [ 899.608443][T18689] usbtmc 2-1:16.0: can't read capabilities [ 899.731919][T18689] usb 2-1: USB disconnect, device number 127 [ 899.925078][T19199] netlink: 'syz.3.3704': attribute type 1 has an invalid length. [ 899.940656][T19199] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3704'. [ 899.953692][T19199] bond0: option mode: unable to set because the bond device has slaves [ 899.978301][ T5938] usb 6-1: new full-speed USB device number 42 using dummy_hcd [ 900.209888][ T5938] usb 6-1: config 8 has an invalid interface number: 177 but max is 0 [ 900.218524][ T5938] usb 6-1: config 8 has no interface number 0 [ 900.224646][ T5938] usb 6-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 900.237259][ T5938] usb 6-1: config 8 interface 177 altsetting 9 endpoint 0x4 has invalid wMaxPacketSize 0 [ 900.247592][ T5938] usb 6-1: config 8 interface 177 has no altsetting 0 [ 900.248018][T18670] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 900.254599][ T5938] usb 6-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 900.271963][ T5938] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 900.287243][T19196] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 900.468004][T18670] usb 4-1: Using ep0 maxpacket: 8 [ 900.500616][T19207] loop7: detected capacity change from 0 to 1 [ 900.510633][T18670] usb 4-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 900.537779][T18670] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 900.586910][T18670] usb 4-1: Product: syz [ 900.624830][T18670] usb 4-1: Manufacturer: syz [ 900.640489][T19208] Dev loop7: unable to read RDB block 1 [ 900.646198][T18670] usb 4-1: SerialNumber: syz [ 900.675961][T19208] loop7: unable to read partition table [ 900.700642][T19208] loop7: partition table beyond EOD, truncated [ 900.703794][T18670] usb 4-1: config 0 descriptor?? [ 900.723149][T19208] loop_reread_partitions: partition scan of loop7 (îÝ·ÂU@™:ÖB$Œ{W) failed (rc=-5) [ 900.770869][T18670] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 901.433158][ T5938] usb 6-1: string descriptor 0 read error: -71 [ 901.446829][ T5938] ir_toy 6-1:8.177: required endpoints not found [ 901.504255][T19227] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3712'. [ 901.622815][ T5938] usb 6-1: USB disconnect, device number 42 [ 903.043891][T19238] veth3: entered promiscuous mode [ 903.081158][T19238] bond0: (slave veth3): Enslaving as an active interface with an up link [ 903.320529][T18670] gspca_sonixj: reg_w err -71 [ 903.325380][T18670] sonixj 4-1:0.0: probe with driver sonixj failed with error -71 [ 903.388237][T18671] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 903.412995][T18670] usb 4-1: USB disconnect, device number 23 [ 903.538570][T18671] usb 6-1: device descriptor read/64, error -71 [ 903.823318][T18671] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 903.988320][T18671] usb 6-1: device descriptor read/64, error -71 [ 904.108348][T18671] usb usb6-port1: attempt power cycle [ 904.370673][T19257] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 904.618531][T18671] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 904.739078][T19260] trusted_key: encrypted_key: keyword 'update' not allowed when called from .instantiate method [ 904.770724][T18671] usb 6-1: device descriptor read/8, error -71 [ 905.058405][T18671] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 905.146342][T19272] kvm: pic: non byte write [ 905.159048][T18671] usb 6-1: device descriptor read/8, error -71 [ 905.299373][T18671] usb usb6-port1: unable to enumerate USB device [ 905.725286][T19287] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 905.796152][T19287] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 906.753405][T19305] netlink: 'syz.0.3733': attribute type 10 has an invalid length. [ 906.812904][T19305] team0: Port device syz_tun added [ 907.428118][T19316] input: syz1 as /devices/virtual/input/input57 [ 907.635862][T19316] netlink: 'syz.4.3736': attribute type 1 has an invalid length. [ 908.178999][T18689] usb 6-1: new full-speed USB device number 47 using dummy_hcd [ 908.339854][T18689] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 908.397835][T19317] gretap1: entered allmulticast mode [ 908.475996][T18689] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 908.504071][T18689] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 908.535529][T18689] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 908.561602][T18689] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 908.662168][T18689] usb 6-1: Product: syz [ 908.677440][T18689] usb 6-1: Manufacturer: syz [ 908.686793][T18689] usb 6-1: SerialNumber: syz [ 908.758808][T19323] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 908.821681][T19323] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 908.848695][T19323] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 908.861050][T19331] tipc: Can't bind to reserved service type 0 [ 908.874413][T19323] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 908.894000][T19323] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 908.905656][T19323] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 908.920786][T19323] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 908.930115][T19323] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 908.954545][T19323] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 908.988586][T19323] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 909.103419][T19335] fuse: Unknown parameter 'context' [ 909.653024][T19337] tipc: Enabling of bearer rejected, failed to enable media [ 910.058019][ T5931] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 910.227975][ T5931] usb 5-1: Using ep0 maxpacket: 8 [ 910.263684][ T5931] usb 5-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 910.278357][ T5931] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 910.291294][ T5931] usb 5-1: Product: syz [ 910.295596][ T5931] usb 5-1: Manufacturer: syz [ 910.301450][ T5931] usb 5-1: SerialNumber: syz [ 910.309234][ T5931] usb 5-1: config 0 descriptor?? [ 910.327080][ T5931] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 911.164967][T18689] usb 6-1: USB disconnect, device number 47 [ 911.300207][ T6144] udevd[6144]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 912.386443][T19374] input: syz1 as /devices/virtual/input/input58 [ 912.554082][T19374] netlink: 'syz.1.3753': attribute type 1 has an invalid length. [ 912.703847][T19375] gretap1: entered allmulticast mode [ 912.881764][ T5931] gspca_sonixj: reg_w err -71 [ 912.886689][ T5931] sonixj 5-1:0.0: probe with driver sonixj failed with error -71 [ 912.947316][ T5931] usb 5-1: USB disconnect, device number 112 [ 913.201510][T19385] tipc: Enabling of bearer rejected, failed to enable media [ 913.596731][T19391] fuse: Bad value for 'fd' [ 914.455032][T19400] loop6: detected capacity change from 0 to 7 [ 914.464073][ T6144] Dev loop6: unable to read RDB block 7 [ 914.471103][ T6144] loop6: unable to read partition table [ 914.476938][ T6144] loop6: partition table beyond EOD, truncated [ 914.489516][T19400] Dev loop6: unable to read RDB block 7 [ 914.495155][T19400] loop6: unable to read partition table [ 914.501608][T19400] loop6: partition table beyond EOD, truncated [ 914.510205][T19400] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 914.828770][T19408] fuse: Bad value for 'fd' [ 915.138246][T17449] Bluetooth: hci4: command 0x0c1a tx timeout [ 915.145134][T19378] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 915.893863][T19378] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 915.902260][T19378] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 915.908555][T19378] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 915.914778][T19378] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 916.171485][T19419] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3766'. [ 916.208460][T18670] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 916.378179][T18670] usb 6-1: device descriptor read/64, error -71 [ 916.418603][ T6027] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 916.588184][ T6027] usb 5-1: Using ep0 maxpacket: 32 [ 916.631064][ T6027] usb 5-1: config index 0 descriptor too short (expected 36, got 31) [ 916.648581][T18670] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 916.648830][ T6027] usb 5-1: config 0 has an invalid interface number: 83 but max is 0 [ 916.728444][ T6027] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 916.783484][ T6027] usb 5-1: config 0 has no interface number 0 [ 916.800727][ T6027] usb 5-1: config 0 interface 83 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 916.812914][ T6027] usb 5-1: config 0 interface 83 altsetting 0 bulk endpoint 0xF has invalid maxpacket 0 [ 916.824267][T18670] usb 6-1: device descriptor read/64, error -71 [ 916.910166][ T6027] usb 5-1: config 0 interface 83 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 916.954847][ T6027] usb 5-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=d8.11 [ 916.958617][T18670] usb usb6-port1: attempt power cycle [ 916.969456][ T6027] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=232 [ 916.969485][ T6027] usb 5-1: Product: syz [ 916.969502][ T6027] usb 5-1: Manufacturer: syz [ 916.969519][ T6027] usb 5-1: SerialNumber: syz [ 917.009163][ T6027] usb 5-1: config 0 descriptor?? [ 917.057126][ T6027] redrat3 5-1:0.83: Couldn't find all endpoints [ 917.218010][T17449] Bluetooth: hci5: command 0x0c1a tx timeout [ 917.273301][ T6027] usb 5-1: USB disconnect, device number 113 [ 917.529445][T18670] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 917.751786][T19431] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3769'. [ 917.870490][T18670] usb 6-1: device descriptor read/8, error -71 [ 917.938677][T17449] Bluetooth: hci0: command 0x0c1a tx timeout [ 917.940968][ T5874] Bluetooth: hci1: command 0x0c1a tx timeout [ 917.944763][ T5185] Bluetooth: hci3: command 0x040f tx timeout [ 917.965196][T19434] loop2: detected capacity change from 0 to 8 [ 918.006612][T19434] loop2: [CUMANA/ADFS] p1 [ADFS] p1 [ 918.025923][T19434] loop2: partition table partially beyond EOD, truncated [ 918.067430][T19434] loop2: p1 size 3004527350 extends beyond EOD, truncated [ 918.223087][T19445] tipc: Enabling of bearer rejected, failed to enable media [ 918.338134][T18670] usb 6-1: new full-speed USB device number 51 using dummy_hcd [ 918.359150][ T6144] udevd[6144]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 918.402692][T18670] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 918.471048][T18670] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 918.510370][T19450] dvmrp0: entered allmulticast mode [ 918.536611][T18670] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 918.568444][T18670] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 918.698204][T19448] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(11) [ 918.704837][T19448] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 918.717745][T19448] vhci_hcd vhci_hcd.0: Device attached [ 918.832083][T18670] usb 6-1: GET_CAPABILITIES returned 0 [ 918.870027][T18670] usbtmc 6-1:16.0: can't read capabilities [ 919.008348][T18667] usb 41-1: new low-speed USB device number 3 using vhci_hcd [ 919.047022][T19437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 919.183271][T19437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 919.195201][T19462] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3777'. [ 919.209831][T19437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 919.224578][T19437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 919.240896][T18689] usb 6-1: USB disconnect, device number 51 [ 920.171070][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 920.171092][ T30] audit: type=1326 audit(1758866825.176:1236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19468 comm="syz.3.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc54438eec9 code=0x7ffc0000 [ 920.410519][T19483] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3783'. [ 920.468428][ T30] audit: type=1326 audit(1758866825.176:1237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19468 comm="syz.3.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc54438eec9 code=0x7ffc0000 [ 920.758875][ T30] audit: type=1326 audit(1758866825.306:1238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19468 comm="syz.3.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=63 compat=0 ip=0x7fc54438eec9 code=0x7ffc0000 [ 920.882076][ T30] audit: type=1326 audit(1758866825.306:1239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19468 comm="syz.3.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc54438eec9 code=0x7ffc0000 [ 921.078797][ T6027] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 921.111204][ T30] audit: type=1326 audit(1758866825.306:1240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19468 comm="syz.3.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc54438eec9 code=0x7ffc0000 [ 921.243108][T19495] cgroup: fork rejected by pids controller in /syz1 [ 921.278195][ T30] audit: type=1326 audit(1758866825.306:1241): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19468 comm="syz.3.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fc54438eec9 code=0x7ffc0000 [ 921.325696][ T6027] usb 4-1: device descriptor read/64, error -71 [ 921.467063][ T30] audit: type=1326 audit(1758866825.306:1242): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19468 comm="syz.3.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc54438eec9 code=0x7ffc0000 [ 921.573470][ T30] audit: type=1326 audit(1758866825.306:1243): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19468 comm="syz.3.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc54438eec9 code=0x7ffc0000 [ 921.597684][ T6027] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 921.732212][ T30] audit: type=1326 audit(1758866825.306:1244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19468 comm="syz.3.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fc54438eec9 code=0x7ffc0000 [ 921.755283][ T6027] usb 4-1: device descriptor read/64, error -71 [ 921.868680][ T6027] usb usb4-port1: attempt power cycle [ 921.884537][ T30] audit: type=1326 audit(1758866825.306:1245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19468 comm="syz.3.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc54438eec9 code=0x7ffc0000 [ 921.944084][T19455] vhci_hcd: connection reset by peer [ 922.000881][T10055] vhci_hcd: stop threads [ 922.005185][T10055] vhci_hcd: release socket [ 922.065466][T10055] vhci_hcd: disconnect device [ 922.248430][ T6027] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 922.299131][ T6027] usb 4-1: device descriptor read/8, error -71 [ 922.538517][ T6027] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 922.598875][ T6027] usb 4-1: device descriptor read/8, error -71 [ 922.724488][ T6027] usb usb4-port1: unable to enumerate USB device [ 922.839476][T19810] netlink: 'syz.5.3787': attribute type 12 has an invalid length. [ 923.367844][T19813] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3789'. [ 923.969244][T19817] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3790'. [ 924.004978][T19817] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3790'. [ 924.100329][T18667] vhci_hcd: vhci_device speed not set [ 924.208508][T19819] netlink: 'syz.0.3790': attribute type 4 has an invalid length. [ 924.284527][T19825] netlink: 'syz.0.3790': attribute type 4 has an invalid length. [ 924.488195][ T6027] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 924.628661][T19832] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3795'. [ 924.659033][ T6027] usb 2-1: Using ep0 maxpacket: 32 [ 924.688830][ T6027] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 924.727943][ T6027] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 924.758192][ T6027] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 924.799777][ T6027] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 7 [ 924.831477][ T6027] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 924.858878][ T6027] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 924.884472][T19835] netlink: 'syz.4.3792': attribute type 12 has an invalid length. [ 924.914567][ T6027] usb 2-1: Product: syz [ 924.925918][ T6027] usb 2-1: Manufacturer: syz [ 924.951588][ T6027] usb 2-1: SerialNumber: syz [ 924.989222][T19845] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 925.039427][ T6027] usb 2-1: config 0 descriptor?? [ 925.074950][T19845] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 925.518541][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 925.635682][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 925.845793][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 925.857325][T19859] loop4: detected capacity change from 0 to 7 [ 925.864000][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 925.871255][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 925.878101][T19859] Dev loop4: unable to read RDB block 7 [ 925.883718][T19859] loop4: unable to read partition table [ 925.890752][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 925.905736][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 925.912223][T19859] loop4: partition table beyond EOD, truncated [ 925.935012][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 925.941454][T19859] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 925.952035][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 925.984768][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 926.031488][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 926.058044][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 926.074379][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 926.084578][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 926.104926][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 926.130550][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 926.161386][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 926.184262][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 926.237330][ T6027] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 926.265495][ T6027] input input59: Timeout waiting for response from device. [ 926.316372][ T6027] usb 2-1: USB disconnect, device number 2 [ 927.075382][T19880] sctp: [Deprecated]: syz.3.3806 (pid 19880) Use of struct sctp_assoc_value in delayed_ack socket option. [ 927.075382][T19880] Use struct sctp_sack_info instead [ 927.131018][T19881] netlink: 'syz.4.3803': attribute type 12 has an invalid length. [ 927.674968][T18671] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 928.018974][T18671] usb 2-1: device descriptor read/64, error -71 [ 928.198950][T19887] netlink: 'syz.4.3807': attribute type 33 has an invalid length. [ 928.206810][T19887] netlink: 152 bytes leftover after parsing attributes in process `syz.4.3807'. [ 928.239776][T19887] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3807'. [ 928.398053][T18671] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 928.553246][T19891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 928.598252][T18667] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 928.635260][T18671] usb 2-1: device descriptor read/64, error -71 [ 928.670346][T19891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 928.768346][T18667] usb 5-1: Using ep0 maxpacket: 8 [ 928.784821][T18667] usb 5-1: config 5 contains an unexpected descriptor of type 0x1, skipping [ 928.798732][T18667] usb 5-1: config 5 interface 0 altsetting 9 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 928.818948][T18671] usb usb2-port1: attempt power cycle [ 928.831083][T18667] usb 5-1: config 5 interface 0 altsetting 9 has a duplicate endpoint with address 0x4, skipping [ 928.842660][T18667] usb 5-1: config 5 interface 0 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 928.854209][T18667] usb 5-1: config 5 interface 0 has no altsetting 0 [ 928.865687][T18667] usb 5-1: Dual-Role OTG device on HNP port [ 928.874626][T18667] usb 5-1: New USB device found, idVendor=12d1, idProduct=7ad0, bcdDevice=58.d0 [ 928.884924][T18667] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 928.893991][T18667] usb 5-1: Product: क़뇙脌쓪븹館ꉚ糶ï›ê†è¨³ì»¥â°ë¸‰ê»î½“⒡ꕔڲᥒ䞗襬呷⛙⑓䉱㮤씵⚥磫깗徜欑ጊ컿ᖑ䱤혀ä€äˆî¬ æ¥žá…供藴ï¯Ï¬å¹ˆåš¾î¬½åœµç±‡åŒ±ã¨°í€—蔻髯鲖뵞갫팃å•ê‚½ä¡ã¬å‹¬æž ä« à¬¢â®¤êœžî£³è’Ꚇ㗺á³ä„®í‘žï¸•è’§à¨â¬¢â½ä§ˆä¸®æ¼žå¸¢äƒ¥â±®î¶à Œç¹ä›¶ã³ƒ [ 928.925725][T18667] usb 5-1: Manufacturer: ä¼´ã¡æ©µâ”‰â£‰åž’㒻⃓⎒蹼鯫ꅜé´î‘©é·µâ ‰ç¿½ç±ª [ 928.937604][T18667] usb 5-1: SerialNumber: 馣熊ꑙ찅店Õì£åª½æº²î¨´æ±«ã¢ºë“䔮ʂ耜ì•à¼²å¤–⨚ベä€ì³‚ë²ê„뿡ﵛ䚡騊埠é„ì²è·®à¤¹í›”䨴쬨諔䷨䀓ࢣêŽç«¤è²ê§‡íž˜ä¬µè ¸ã¿°ãªæ§®è®’â»ë¸ë­ºè˜ä¸¼ï½²å¬î¦ï¤©á‹·ã™˜ê¨œä’¿ëš»á¶žà«°ì«·äž¼ë´§é—ⲩꥠ涱à²è™€î«‡æ¯¼èƒ—嫵ᾋê—ã»­ [ 928.974055][ T6027] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 929.128266][ T6027] usb 4-1: Using ep0 maxpacket: 8 [ 929.134867][ T6027] usb 4-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 929.153050][ T6027] usb 4-1: too many endpoints for config 1 interface 0 altsetting 0: 187, using maximum allowed: 30 [ 929.166647][ T6027] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 187 [ 929.188512][T18671] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 929.198257][ T6027] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 929.212123][ T6027] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 929.221522][ T6027] usb 4-1: Product: syz [ 929.238322][ T6027] usb 4-1: Manufacturer: syz [ 929.247691][ T6027] usb 4-1: SerialNumber: syz [ 929.280359][T18667] option 5-1:5.0: GSM modem (1-port) converter detected [ 929.320386][T18667] usb 5-1: USB disconnect, device number 114 [ 929.329478][T18671] usb 2-1: device descriptor read/8, error -71 [ 929.349821][T18667] option 5-1:5.0: device disconnected [ 929.519289][T19896] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 929.519637][T19896] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 929.588565][T19896] pim6reg1: entered promiscuous mode [ 929.588591][T19896] pim6reg1: entered allmulticast mode [ 929.646237][T18671] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 929.818145][T18667] usb 5-1: new full-speed USB device number 115 using dummy_hcd [ 929.975458][T18667] usb 5-1: not running at top speed; connect to a high speed hub [ 929.982324][T18671] usb 2-1: device descriptor read/8, error -71 [ 930.006615][T18667] usb 5-1: config 5 contains an unexpected descriptor of type 0x1, skipping [ 930.017002][T18667] usb 5-1: config 5 interface 0 altsetting 9 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 930.031992][T18667] usb 5-1: config 5 interface 0 altsetting 9 has a duplicate endpoint with address 0x4, skipping [ 930.049639][T19913] netlink: 312 bytes leftover after parsing attributes in process `syz.5.3814'. [ 930.068722][T18667] usb 5-1: config 5 interface 0 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 930.085608][T18667] usb 5-1: config 5 interface 0 has no altsetting 0 [ 930.099246][T18671] usb usb2-port1: unable to enumerate USB device [ 930.113774][T18667] usb 5-1: Dual-Role OTG device on HNP port [ 930.136850][T18667] usb 5-1: New USB device found, idVendor=12d1, idProduct=7ad0, bcdDevice=58.d0 [ 930.166292][T18667] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 930.189581][T18667] usb 5-1: Product: ｨã©å£¡ä¤–೒覗謹ᓂ浘éºäˆáž‘苎ﶕ蘞î°î‚潓黫嬯攣氰㆘âŸé©–螶 [ 930.218796][T18667] usb 5-1: Manufacturer:   [ 930.224121][T18667] usb 5-1: SerialNumber: ꧉햇éŸê‡›âªŠÇ¹ä…´å©•â›´ç‹²êŒ¾Ê¨s햨識ꯌᾷé³ì§ŠÂ æ¼«î²¹ê©»é¡ƒï™¤æŸ¥å¾’뮲㣙é斲Ŭ阥즼㕀鰟ڮ׮㻈홪ï™ìŒî¶Ÿá½½î‚¢é¥ˆá††á¶¢åœ°íŸ¢ç€€á‰†å·…轎夒냊ç¾à³³æ¶»ê‹Šè¶ªë¦³ê‰´à¹Ÿè­“漙補퉇娵ᷬ複½濗â¥äƒ…ﲒ篙幠㫧佫꼟㰤ì‘ç‚蜿焿ã’ê”狒 [ 930.281432][T19919] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3817'. [ 930.517414][T18667] option 5-1:5.0: GSM modem (1-port) converter detected [ 930.554232][T18667] usb 5-1: USB disconnect, device number 115 [ 930.582475][T18667] option 5-1:5.0: device disconnected [ 931.541543][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.548568][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.837083][ T6027] usb 4-1: USB disconnect, device number 28 [ 932.594449][T19958] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 932.624235][T19958] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 933.000530][T18670] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 933.330392][T18670] usb 5-1: device descriptor read/64, error -71 [ 933.668253][T18670] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 933.776561][T19968] netlink: 'syz.1.3829': attribute type 1 has an invalid length. [ 933.868732][T18670] usb 5-1: device descriptor read/64, error -71 [ 933.978636][T18670] usb usb5-port1: attempt power cycle [ 934.358854][T18670] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 934.449608][T18670] usb 5-1: device descriptor read/8, error -71 [ 934.508252][ T6027] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 934.699322][ T6027] usb 2-1: device descriptor read/64, error -71 [ 934.848217][T18670] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 934.962497][ T6027] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 935.128548][ T6027] usb 2-1: device descriptor read/64, error -71 [ 935.271064][ T6027] usb usb2-port1: attempt power cycle [ 935.588608][T20007] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3840'. [ 935.622013][T20007] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3840'. [ 935.698268][ T6027] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 935.761608][ T6027] usb 2-1: device descriptor read/8, error -71 [ 936.012423][T18670] usb 5-1: device descriptor read/8, error -71 [ 936.128331][ T6027] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 936.163083][T18670] usb usb5-port1: unable to enumerate USB device [ 936.168353][T18667] usb 6-1: new full-speed USB device number 52 using dummy_hcd [ 936.448481][ T6027] usb 2-1: device descriptor read/8, error -71 [ 936.573340][T18667] usb 6-1: config 0 has no interfaces? [ 936.579996][ T6027] usb usb2-port1: unable to enumerate USB device [ 936.598621][T18667] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 936.620534][T18667] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 936.641320][T18667] usb 6-1: Product: syz [ 936.645533][T18667] usb 6-1: Manufacturer: syz [ 936.659069][T18667] usb 6-1: SerialNumber: syz [ 936.703639][T18667] usb 6-1: config 0 descriptor?? [ 937.052801][T20022] vlan0: entered promiscuous mode [ 937.083211][T20024] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3846'. [ 937.118483][T18667] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 937.190964][T20030] netlink: 'syz.0.3849': attribute type 1 has an invalid length. [ 937.196791][T20031] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3848'. [ 937.226042][T20030] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3849'. [ 937.240391][T20030] bond0: option mode: unable to set because the bond device has slaves [ 937.282573][T18667] usb 4-1: config 0 has an invalid interface number: 69 but max is 0 [ 937.291021][T20033] tipc: Enabling of bearer rejected, failed to enable media [ 937.293067][T20033] FAULT_INJECTION: forcing a failure. [ 937.293067][T20033] name failslab, interval 1, probability 0, space 0, times 0 [ 937.313988][T20033] CPU: 0 UID: 0 PID: 20033 Comm: syz.0.3850 Not tainted syzkaller #0 PREEMPT(full) [ 937.314014][T20033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 937.314025][T20033] Call Trace: [ 937.314034][T20033] [ 937.314042][T20033] dump_stack_lvl+0x189/0x250 [ 937.314069][T20033] ? __pfx____ratelimit+0x10/0x10 [ 937.314089][T20033] ? __pfx_dump_stack_lvl+0x10/0x10 [ 937.314111][T20033] ? __pfx__printk+0x10/0x10 [ 937.314145][T20033] ? __pfx___might_resched+0x10/0x10 [ 937.314160][T20033] ? fs_reclaim_acquire+0x7d/0x100 [ 937.314184][T20033] should_fail_ex+0x414/0x560 [ 937.314218][T20033] should_failslab+0xa8/0x100 [ 937.314248][T20033] __kmalloc_noprof+0xcb/0x4f0 [ 937.314273][T20033] ? kfree+0x4d/0x440 [ 937.314293][T20033] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 937.314320][T20033] tomoyo_realpath_from_path+0xe3/0x5d0 [ 937.314344][T20033] ? tomoyo_domain+0xd9/0x130 [ 937.314370][T20033] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 937.314397][T20033] tomoyo_path_number_perm+0x1e8/0x5a0 [ 937.314424][T20033] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 937.314468][T20033] ? __lock_acquire+0xab9/0xd20 [ 937.314509][T20033] ? __fget_files+0x2a/0x420 [ 937.314529][T20033] ? __fget_files+0x2a/0x420 [ 937.314546][T20033] ? __fget_files+0x3a0/0x420 [ 937.314563][T20033] ? __fget_files+0x2a/0x420 [ 937.314584][T20033] security_file_ioctl+0xcb/0x2d0 [ 937.314614][T20033] __se_sys_ioctl+0x47/0x170 [ 937.314641][T20033] do_syscall_64+0xfa/0x3b0 [ 937.314663][T20033] ? lockdep_hardirqs_on+0x9c/0x150 [ 937.314684][T20033] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 937.314704][T20033] ? clear_bhb_loop+0x60/0xb0 [ 937.314729][T20033] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 937.314749][T20033] RIP: 0033:0x7f70fd58eec9 [ 937.314768][T20033] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 937.314785][T20033] RSP: 002b:00007f70fe430038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 937.314803][T20033] RAX: ffffffffffffffda RBX: 00007f70fd7e5fa0 RCX: 00007f70fd58eec9 [ 937.314817][T20033] RDX: 0000200000002280 RSI: 0000000000008922 RDI: 0000000000000004 [ 937.314837][T20033] RBP: 00007f70fe430090 R08: 0000000000000000 R09: 0000000000000000 [ 937.314847][T20033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 937.314860][T20033] R13: 00007f70fd7e6038 R14: 00007f70fd7e5fa0 R15: 00007f70fd90fa28 [ 937.314893][T20033] [ 937.314903][T20033] ERROR: Out of memory at tomoyo_realpath_from_path. [ 937.316335][T18667] usb 4-1: config 0 has no interface number 0 [ 937.458613][T18670] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 937.525031][T18667] usb 4-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 937.594398][T18667] usb 4-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 937.613162][T18667] usb 4-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 937.623652][T18667] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 937.631915][T18667] usb 4-1: Product: syz [ 937.636260][T18667] usb 4-1: Manufacturer: syz [ 937.641126][T18667] usb 4-1: SerialNumber: syz [ 937.648156][T18667] usb 4-1: config 0 descriptor?? [ 937.653981][T20018] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 937.664203][T18667] cyberjack 4-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 937.679572][T18667] usb 4-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 937.761883][T20040] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3852'. [ 937.773546][T18670] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 937.790644][T20040] netlink: 59 bytes leftover after parsing attributes in process `syz.0.3852'. [ 937.800264][T18670] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 937.817089][T18670] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 937.833580][T18670] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 937.841700][T18670] usb 2-1: SerialNumber: syz [ 937.858610][T20031] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 937.886941][T20042] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3852'. [ 937.911670][T20042] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 937.938243][T18667] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 938.084885][T18670] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 938.131782][T18670] usb 2-1: USB disconnect, device number 11 [ 938.155249][T18671] usb 4-1: USB disconnect, device number 29 [ 938.195232][T18671] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 938.226611][T18671] cyberjack 4-1:0.69: device disconnected [ 938.428869][T18667] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 938.636949][T20057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 938.647723][T20057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 938.732029][T20057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 938.745180][T20057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 938.924986][ T6027] usb 6-1: USB disconnect, device number 52 [ 939.088718][T20068] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3859'. [ 939.150518][T20057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 939.237005][T20057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 939.261071][T20073] netlink: 'syz.4.3860': attribute type 1 has an invalid length. [ 939.431402][T20073] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3860'. [ 939.498004][T18671] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 939.541864][T20077] netlink: 'syz.5.3861': attribute type 9 has an invalid length. [ 939.573898][T20073] bond0: option mode: unable to set because the bond device has slaves [ 939.749672][T18671] usb 4-1: Using ep0 maxpacket: 8 [ 939.789537][T18671] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 939.815067][T18671] usb 4-1: config 0 has no interface number 0 [ 939.853691][T18671] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 939.896987][T18671] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 939.954997][T18671] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 940.048820][T18671] usb 4-1: config 0 descriptor?? [ 940.088613][T18671] iowarrior 4-1:0.1: no interrupt-in endpoint found [ 940.299992][T20086] fuse: Bad value for 'fd' [ 940.621811][T20089] loop4: detected capacity change from 0 to 7 [ 940.631209][ T6144] Dev loop4: unable to read RDB block 7 [ 940.636970][ T6144] loop4: unable to read partition table [ 940.674870][ T6144] loop4: partition table beyond EOD, truncated [ 940.697175][T20089] Dev loop4: unable to read RDB block 7 [ 940.725308][T20089] loop4: unable to read partition table [ 940.749921][T20089] loop4: partition table beyond EOD, truncated [ 940.861668][T20089] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 941.234390][T20091] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 942.089788][T20096] __nla_validate_parse: 2 callbacks suppressed [ 942.089809][T20096] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3870'. [ 942.339434][T20103] loop6: detected capacity change from 0 to 7 [ 942.358346][T18667] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 942.374254][T20103] Dev loop6: unable to read RDB block 7 [ 942.417342][T20103] loop6: AHDI p2 p3 [ 942.433556][T20103] loop6: partition table partially beyond EOD, truncated [ 942.463745][T20103] loop6: p2 size 46 extends beyond EOD, truncated [ 942.548624][T18667] usb 6-1: device descriptor read/64, error -71 [ 942.565726][T18671] usb 4-1: USB disconnect, device number 30 [ 942.758637][T18670] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 942.808556][T18667] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 942.958839][T18667] usb 6-1: device descriptor read/64, error -71 [ 942.965320][T18670] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 942.997187][T18670] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 943.059198][T18670] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 943.094199][T18670] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 943.130640][T18670] usb 5-1: Product: syz [ 943.148768][T18670] usb 5-1: Manufacturer: syz [ 943.150503][T18667] usb usb6-port1: attempt power cycle [ 943.168775][T18670] usb 5-1: SerialNumber: syz [ 943.211500][T18670] usb 5-1: config 0 descriptor?? [ 943.481933][T20109] (unnamed net_device) (uninitialized): option min_links: invalid value (18446744073709551608) [ 943.533992][T18667] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 943.568665][T20109] (unnamed net_device) (uninitialized): option min_links: allowed values 0 - 2147483647 [ 943.629864][T18667] usb 6-1: device descriptor read/8, error -71 [ 943.641514][T20121] tipc: Started in network mode [ 943.651803][T20121] tipc: Node identity 5f000040000000000000000000000001, cluster identity 4711 [ 943.712979][T20121] tipc: Enabling of bearer rejected, failed to enable media [ 943.842677][T18670] usb 5-1: USB disconnect, device number 120 [ 943.908221][T18667] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 943.951779][T18667] usb 6-1: device descriptor read/8, error -71 [ 944.068719][T18667] usb usb6-port1: unable to enumerate USB device [ 944.124554][ T5875] udevd[5875]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 945.459507][T20145] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3881'. [ 945.911614][T18667] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 946.118298][T18667] usb 6-1: Using ep0 maxpacket: 32 [ 946.144173][T18667] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 946.182134][T18667] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 946.214007][T18667] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 946.239275][T18667] usb 6-1: Product: syz [ 946.251243][T18667] usb 6-1: Manufacturer: syz [ 946.266338][T18667] usb 6-1: SerialNumber: syz [ 946.278801][T18667] usb 6-1: config 0 descriptor?? [ 946.284343][T20155] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 946.623319][T20167] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3888'. [ 946.697711][T20155] netlink: 92 bytes leftover after parsing attributes in process `syz.5.3884'. [ 946.733903][T20167] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 946.744253][T18689] usb 6-1: USB disconnect, device number 57 [ 947.134492][T20175] loop4: detected capacity change from 0 to 7 [ 947.173931][T20175] Dev loop4: unable to read RDB block 7 [ 947.185786][T20175] loop4: unable to read partition table [ 947.193327][T20175] loop4: partition table beyond EOD, truncated [ 947.203521][T20175] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 947.217242][T20167] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 947.358867][T20179] loop7: detected capacity change from 0 to 1 [ 947.599753][T20179] Dev loop7: unable to read RDB block 1 [ 947.639635][T20179] loop7: unable to read partition table [ 947.706851][T20179] loop7: partition table beyond EOD, truncated [ 947.901425][T20179] loop_reread_partitions: partition scan of loop7 (îÝ·ÂU@™:ÖB$Œ{W) failed (rc=-5) [ 948.252742][T20199] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7) [ 948.259304][T20199] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 948.400093][T20199] vhci_hcd vhci_hcd.0: Device attached [ 948.413965][T20201] vhci_hcd: connection closed [ 948.416276][T18059] vhci_hcd: stop threads [ 948.442017][T18059] vhci_hcd: release socket [ 948.493990][T18059] vhci_hcd: disconnect device [ 948.808456][T18670] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 949.038889][T20209] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3899'. [ 949.310899][T20216] mac80211_hwsim hwsim27 è: renamed from wlan1 [ 949.547997][T18670] usb 4-1: Using ep0 maxpacket: 16 [ 949.749361][ T5931] usb 6-1: new full-speed USB device number 58 using dummy_hcd [ 949.946518][T18670] usb 4-1: device descriptor read/all, error -71 [ 949.981767][ T5931] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 950.037721][ T5931] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 950.157468][ T5931] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 950.291931][ T5931] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 950.416557][T20229] loop4: detected capacity change from 0 to 7 [ 950.456223][T20229] Dev loop4: unable to read RDB block 7 [ 950.467604][T20229] loop4: unable to read partition table [ 950.475429][T20229] loop4: partition table beyond EOD, truncated [ 950.486385][T20229] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 950.591805][ T5931] usb 6-1: GET_CAPABILITIES returned 0 [ 950.613091][ T5931] usbtmc 6-1:16.0: can't read capabilities [ 950.732683][T20226] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3902'. [ 950.788709][T20221] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 950.813846][T20221] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 950.844022][T20221] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 950.870134][T20221] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 950.912975][T18689] usb 6-1: USB disconnect, device number 58 [ 951.378195][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 952.671050][T20282] netlink: 'syz.0.3915': attribute type 7 has an invalid length. [ 952.779082][T20284] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3916'. [ 953.908475][ T6027] usb 5-1: new full-speed USB device number 121 using dummy_hcd [ 953.911546][T20309] Only authenc() type AEADs are supported by ESSIV [ 954.084587][ T6027] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 954.114766][ T6027] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 954.142031][ T6027] usb 5-1: Product: syz [ 954.151948][ T6027] usb 5-1: Manufacturer: syz [ 954.167438][ T6027] usb 5-1: SerialNumber: syz [ 954.197705][ T6027] usb 5-1: config 0 descriptor?? [ 954.425848][ T6027] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 954.515097][T20319] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3925'. [ 954.768568][T18689] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 954.808346][T18667] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 954.938800][T18689] usb 6-1: Using ep0 maxpacket: 8 [ 954.950346][T18689] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 954.976463][T18689] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 954.988757][T18667] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 955.017785][T18667] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 955.038727][T18689] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 955.050415][T18689] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 955.061267][T20324] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3927'. [ 955.078506][T18667] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 955.098699][T18689] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 955.121901][T18667] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 955.130757][T18667] usb 2-1: Manufacturer: syz [ 955.135439][T18689] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 955.147342][T18667] usb 2-1: config 0 descriptor?? [ 955.164244][T18689] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 955.379897][T18667] usb 2-1: USB disconnect, device number 12 [ 955.418710][T18689] usb 6-1: GET_CAPABILITIES returned 0 [ 955.424367][T18689] usbtmc 6-1:16.0: can't read capabilities [ 955.653037][T18667] usb 6-1: USB disconnect, device number 59 [ 955.711974][T20335] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 955.741413][T20335] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 956.739914][ T6027] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 957.005735][ T6027] usb 5-1: USB disconnect, device number 121 [ 957.788612][T20366] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 957.810888][T20366] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 957.842115][T20366] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 957.869625][T20366] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 957.928014][T20366] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 958.985031][T18670] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 959.170793][T18670] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 959.191689][T18670] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 959.242969][T18670] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 959.316172][T18670] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 959.453094][T18670] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 959.559013][T18670] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 959.680596][T18670] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 959.786269][T18670] usb 2-1: config 0 descriptor?? [ 959.847426][T20385] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 959.868909][ T5874] Bluetooth: hci3: command 0x040f tx timeout [ 959.868937][ T5185] Bluetooth: hci5: command 0x0c1a tx timeout [ 959.875165][ T5874] Bluetooth: hci4: command 0x0c1a tx timeout [ 959.938722][ T5874] Bluetooth: hci0: command 0x0c1a tx timeout [ 959.938752][ T5185] Bluetooth: hci1: command 0x0c1a tx timeout [ 960.078029][T18667] usb 4-1: new full-speed USB device number 33 using dummy_hcd [ 960.265476][T18667] usb 4-1: config 0 has an invalid interface number: 69 but max is 0 [ 960.294766][T18667] usb 4-1: config 0 has no interface number 0 [ 960.325416][T18667] usb 4-1: too many endpoints for config 0 interface 69 altsetting 66: 232, using maximum allowed: 30 [ 960.347306][T18670] plantronics 0003:047F:FFFF.0024: unknown main item tag 0x0 [ 960.350943][T18667] usb 4-1: config 0 interface 69 altsetting 66 has 0 endpoint descriptors, different from the interface descriptor's value: 232 [ 960.413795][T18670] plantronics 0003:047F:FFFF.0024: unknown main item tag 0x0 [ 960.433071][T18667] usb 4-1: config 0 interface 69 has no altsetting 0 [ 960.452232][T18670] plantronics 0003:047F:FFFF.0024: unknown main item tag 0x0 [ 960.458651][T18667] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 960.502768][T18667] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 960.510911][T18670] plantronics 0003:047F:FFFF.0024: unknown main item tag 0x0 [ 960.510946][T18670] plantronics 0003:047F:FFFF.0024: unknown main item tag 0x0 [ 960.510974][T18670] plantronics 0003:047F:FFFF.0024: unknown main item tag 0x0 [ 960.511014][T18670] plantronics 0003:047F:FFFF.0024: unknown main item tag 0x0 [ 960.511042][T18670] plantronics 0003:047F:FFFF.0024: unknown main item tag 0x0 [ 960.511068][T18670] plantronics 0003:047F:FFFF.0024: unknown main item tag 0x0 [ 960.511094][T18670] plantronics 0003:047F:FFFF.0024: unknown main item tag 0x0 [ 960.575587][T18667] usb 4-1: config 0 descriptor?? [ 960.730583][T18670] plantronics 0003:047F:FFFF.0024: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 960.831671][T18670] usb 2-1: USB disconnect, device number 13 [ 961.008699][ T6027] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 961.039257][T20414] fido_id[20414]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 961.062123][T20406] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 961.076700][T20406] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 961.158119][ T6027] usb 6-1: Using ep0 maxpacket: 16 [ 961.182915][ T6027] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 961.229833][ T6027] usb 6-1: config 0 has no interfaces? [ 961.253082][ T6027] usb 6-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 961.273965][ T6027] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 961.292548][ T6027] usb 6-1: Product: syz [ 961.302665][ T6027] usb 6-1: Manufacturer: syz [ 961.323132][ T6027] usb 6-1: SerialNumber: syz [ 961.343367][ T6027] usb 6-1: config 0 descriptor?? [ 961.600293][T18689] usb 6-1: USB disconnect, device number 60 [ 961.719383][T20406] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 961.777607][T20406] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 962.340874][T18667] asix 4-1:0.69 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 962.358086][T18667] asix 4-1:0.69 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 962.401117][T18667] asix 4-1:0.69: probe with driver asix failed with error -71 [ 962.434154][T18667] usb 4-1: USB disconnect, device number 33 [ 963.621109][T20448] netlink: 'syz.0.3958': attribute type 12 has an invalid length. [ 964.302436][T20468] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 964.417011][T20473] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 964.499285][T20473] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 964.730983][T20477] netlink: 120 bytes leftover after parsing attributes in process `syz.0.3968'. [ 965.088002][T18667] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 965.242539][T20492] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 965.253105][T20492] block device autoloading is deprecated and will be removed. [ 965.278210][T18667] usb 5-1: device descriptor read/64, error -71 [ 965.679868][T18667] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 965.838098][T18667] usb 5-1: device descriptor read/64, error -71 [ 965.968533][T18667] usb usb5-port1: attempt power cycle [ 966.108299][T18689] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 966.274644][T18689] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 966.285733][T18689] usb 4-1: config 1 has no interface number 0 [ 966.296702][T18689] usb 4-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 966.321956][T18667] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 966.337807][T18689] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 966.360701][T18689] usb 4-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 966.372987][T18667] usb 5-1: device descriptor read/8, error -71 [ 966.382013][T18689] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 966.392006][T18689] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 966.400429][T18689] usb 4-1: Product: syz [ 966.404985][T18689] usb 4-1: Manufacturer: syz [ 966.410418][T18689] usb 4-1: SerialNumber: syz [ 966.419236][T20498] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 966.618500][T18667] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 966.637232][T20498] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 966.659696][T18667] usb 5-1: device descriptor read/8, error -71 [ 966.671781][T18689] usb 4-1: Incompatible driver and firmware versions [ 966.699194][T20506] syzkaller0: entered promiscuous mode [ 966.715328][T20506] syzkaller0: entered allmulticast mode [ 966.778603][T18667] usb usb5-port1: unable to enumerate USB device [ 966.893834][T18670] usb 4-1: USB disconnect, device number 34 [ 967.598585][T18670] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 967.780929][T18670] usb 4-1: Using ep0 maxpacket: 16 [ 967.848806][T18670] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 967.905376][T18670] usb 4-1: New USB device found, idVendor=0c70, idProduct=f003, bcdDevice= 0.00 [ 968.047979][T18670] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 968.074720][T20529] netlink: 'syz.4.3982': attribute type 1 has an invalid length. [ 968.189134][T18670] usb 4-1: config 0 descriptor?? [ 968.389444][T20532] netlink: 5 bytes leftover after parsing attributes in process `syz.0.3981'. [ 968.965299][T18670] aquacomputer_d5next 0003:0C70:F003.0025: hidraw0: USB HID v0.00 Device [HID 0c70:f003] on usb-dummy_hcd.3-1/input0 [ 970.271715][T18667] usb 5-1: new full-speed USB device number 126 using dummy_hcd [ 970.520389][T18667] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 970.597720][T20563] fuse: Bad value for 'fd' [ 970.607307][T18667] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 970.639009][T18667] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 970.678576][T18667] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 970.899869][T18667] usb 5-1: GET_CAPABILITIES returned 0 [ 970.905570][T18667] usbtmc 5-1:16.0: can't read capabilities [ 971.112100][T20562] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 971.142745][T20562] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 971.166421][T20562] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 971.184583][T20562] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 971.195251][T18667] usb 5-1: USB disconnect, device number 126 [ 971.235584][ T5948] usb 4-1: USB disconnect, device number 35 [ 971.989193][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 971.989211][ T30] audit: type=1326 audit(1758866877.296:1271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20576 comm="syz.1.3994" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a8af8eec9 code=0x7ffc0000 [ 972.066337][ T30] audit: type=1326 audit(1758866877.296:1272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20576 comm="syz.1.3994" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a8af8eec9 code=0x7ffc0000 [ 972.189915][ T30] audit: type=1326 audit(1758866877.296:1273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20576 comm="syz.1.3994" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f5a8af8eec9 code=0x7ffc0000 [ 972.351035][ T30] audit: type=1326 audit(1758866877.296:1274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20576 comm="syz.1.3994" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a8af8eec9 code=0x7ffc0000 [ 972.429766][ T30] audit: type=1326 audit(1758866877.296:1275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20576 comm="syz.1.3994" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a8af8eec9 code=0x7ffc0000 [ 972.578893][T18670] usb 5-1: new high-speed USB device number 127 using dummy_hcd [ 972.718460][T18670] usb 5-1: device descriptor read/64, error -71 [ 972.825698][T20596] binder: BINDER_SET_CONTEXT_MGR already set [ 972.834662][T20596] binder: 20564:20596 ioctl 4018620d 200000000040 returned -16 [ 972.918203][T20596] netlink: 'syz.3.3990': attribute type 12 has an invalid length. [ 973.018515][T18670] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 973.198174][T18670] usb 5-1: device descriptor read/64, error -71 [ 973.318338][T18670] usb usb5-port1: attempt power cycle [ 973.698438][T18670] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 973.864524][T20605] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3999'. [ 974.018612][T18670] usb 5-1: device descriptor read/8, error -71 [ 974.360587][T18670] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 974.431702][T18670] usb 5-1: device descriptor read/8, error -71 [ 974.558425][T18670] usb usb5-port1: unable to enumerate USB device [ 974.998018][T18670] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 975.144679][T20619] syzkaller0: entered promiscuous mode [ 975.151785][T18670] usb 2-1: config index 0 descriptor too short (expected 2075, got 27) [ 975.165571][T20619] syzkaller0: entered allmulticast mode [ 975.175120][T18670] usb 2-1: config 0 has an invalid interface number: 110 but max is 0 [ 975.231060][T18670] usb 2-1: config 0 has no interface number 0 [ 975.279989][T18670] usb 2-1: config 0 interface 110 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 975.363386][T18670] usb 2-1: config 0 interface 110 has no altsetting 0 [ 975.407890][T18670] usb 2-1: New USB device found, idVendor=0547, idProduct=2720, bcdDevice=af.55 [ 975.431269][T20625] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4005'. [ 975.448632][T18670] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.472865][T18670] usb 2-1: Product: syz [ 975.487323][T18670] usb 2-1: Manufacturer: syz [ 975.543256][T18670] usb 2-1: SerialNumber: syz [ 975.589258][T18670] usb 2-1: config 0 descriptor?? [ 975.635307][T20612] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 976.174794][T18670] cdc_subset 2-1:0.110: probe with driver cdc_subset failed with error -71 [ 976.306930][T18670] usb 2-1: USB disconnect, device number 14 [ 976.520610][T20651] netlink: 180 bytes leftover after parsing attributes in process `syz.1.4011'. [ 976.564646][T20651] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4011'. [ 976.616341][ T6027] usb 6-1: new full-speed USB device number 61 using dummy_hcd [ 977.048468][T20661] input: syz1 as /devices/virtual/input/input60 [ 977.131950][T20660] netlink: 'syz.5.4014': attribute type 12 has an invalid length. [ 977.158249][T20661] netlink: 'syz.3.4013': attribute type 1 has an invalid length. [ 978.034822][T20676] program syz.5.4017 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 978.219272][T18667] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 978.358074][ T6027] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 978.365829][T18667] usb 2-1: device descriptor read/64, error -71 [ 978.528112][ T6027] usb 6-1: Using ep0 maxpacket: 8 [ 978.535745][ T6027] usb 6-1: config 0 has an invalid interface number: 240 but max is 0 [ 978.549781][ T6027] usb 6-1: config 0 has no interface number 0 [ 978.565887][ T6027] usb 6-1: config 0 interface 240 has no altsetting 0 [ 978.618152][T18667] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 978.650259][ T6027] usb 6-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=3a.b2 [ 978.666613][ T6027] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 978.688332][ T6027] usb 6-1: Product: syz [ 978.692529][ T6027] usb 6-1: Manufacturer: syz [ 978.711660][ T6027] usb 6-1: SerialNumber: syz [ 978.732200][ T6027] usb 6-1: config 0 descriptor?? [ 978.768081][T18667] usb 2-1: device descriptor read/64, error -71 [ 978.912076][T18667] usb usb2-port1: attempt power cycle [ 979.298604][T18667] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 979.319299][T18667] usb 2-1: device descriptor read/8, error -71 [ 979.557972][T18667] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 979.609070][T18667] usb 2-1: device descriptor read/8, error -71 [ 979.719856][T18667] usb usb2-port1: unable to enumerate USB device [ 980.468847][T20698] netlink: 'syz.0.4025': attribute type 12 has an invalid length. [ 980.834813][T20702] loop4: detected capacity change from 0 to 7 [ 980.844217][ T5867] Dev loop4: unable to read RDB block 7 [ 980.853713][ T5867] loop4: unable to read partition table [ 980.886170][ T5867] loop4: partition table beyond EOD, truncated [ 980.899413][T20702] Dev loop4: unable to read RDB block 7 [ 980.905031][T20702] loop4: unable to read partition table [ 980.951386][T20702] loop4: partition table beyond EOD, truncated [ 980.970445][T20702] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 981.008572][ T6027] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 981.036101][ T6027] gspca_sunplus: reg_w_riv err -71 [ 981.051922][ T6027] sunplus 6-1:0.240: probe with driver sunplus failed with error -71 [ 981.153856][ T6027] usb 6-1: USB disconnect, device number 62 [ 981.195206][T20707] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4031'. [ 981.252206][T20712] netlink: 'syz.0.4027': attribute type 12 has an invalid length. [ 982.211958][T20726] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 982.224697][T20726] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 982.298671][ T6027] usb 2-1: new full-speed USB device number 19 using dummy_hcd [ 982.323371][T20728] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4034'. [ 982.459640][ T6027] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 982.487407][ T6027] usb 2-1: config 0 has no interface number 0 [ 982.506014][ T6027] usb 2-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 982.523470][ T6027] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 982.545934][ T6027] usb 2-1: Product: syz [ 982.554716][ T6027] usb 2-1: Manufacturer: syz [ 982.560783][ T6027] usb 2-1: SerialNumber: syz [ 982.577070][ T6027] usb 2-1: config 0 descriptor?? [ 982.598555][ T5931] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 982.604479][ T6027] gspca_main: sq930x-2.14.0 probing 2770:930c [ 982.764801][ T5931] usb 5-1: config 0 has an invalid interface number: 204 but max is 0 [ 982.778616][ T5931] usb 5-1: config 0 has no interface number 0 [ 982.787321][ T5931] usb 5-1: New USB device found, idVendor=12d6, idProduct=0444, bcdDevice=29.3d [ 982.806152][ T5931] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 982.814972][ T5931] usb 5-1: Product: syz [ 982.825074][ T5931] usb 5-1: Manufacturer: syz [ 982.832578][ T5931] usb 5-1: SerialNumber: syz [ 982.846794][ T5931] usb 5-1: config 0 descriptor?? [ 982.879459][ T5931] ems_usb 5-1:0.204 (unnamed net_device) (uninitialized): couldn't initialize controller: -22 [ 982.893852][ T5931] ems_usb 5-1:0.204: probe with driver ems_usb failed with error -22 [ 982.904851][T20739] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4037'. [ 983.163944][T18689] usb 5-1: USB disconnect, device number 5 [ 983.392377][T20743] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 983.403627][T20743] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 983.619834][ T6027] gspca_sq930x: ucbus_write failed -71 [ 983.642969][ T6027] sq930x 2-1:0.8: probe with driver sq930x failed with error -71 [ 983.670528][ T6027] usb 2-1: USB disconnect, device number 19 [ 983.694440][T20746] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4039'. [ 983.913849][T20748] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4040'. [ 983.963469][T20750] loop4: detected capacity change from 0 to 7 [ 983.974726][T20750] Dev loop4: unable to read RDB block 7 [ 983.995039][T20750] loop4: unable to read partition table [ 984.002799][T20750] loop4: partition table beyond EOD, truncated [ 984.035148][T20750] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 984.658246][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 984.929883][T20773] netlink: 'syz.1.4043': attribute type 12 has an invalid length. [ 984.974208][T20775] tipc: Enabling of bearer rejected, failed to enable media [ 985.009152][T18670] IPVS: starting estimator thread 0... [ 985.131680][T20776] IPVS: using max 32 ests per chain, 76800 per kthread [ 985.238800][T20784] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4051'. [ 986.892111][T20804] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4057'. [ 987.038608][T20797] netlink: 'syz.1.4055': attribute type 12 has an invalid length. [ 987.242006][T20814] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4059'. [ 987.263018][T20814] vlan2: entered promiscuous mode [ 987.296947][T20814] gretap0: entered promiscuous mode [ 987.526603][T20817] tipc: Enabling of bearer rejected, failed to enable media [ 988.254501][T20827] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 988.282594][T20827] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 988.342681][T20827] netlink: 312 bytes leftover after parsing attributes in process `syz.0.4064'. [ 989.713174][T20843] fuse: Unknown parameter '' [ 989.799909][T20829] netlink: 'syz.4.4065': attribute type 12 has an invalid length. [ 990.782722][T20850] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4070'. [ 991.698582][ T5931] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 991.890227][ T5931] usb 2-1: Using ep0 maxpacket: 16 [ 991.915162][ T5931] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 991.963661][ T5931] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 992.001512][ T5931] usb 2-1: New USB device found, idVendor=0458, idProduct=5012, bcdDevice= 0.00 [ 992.063300][ T5931] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 992.130387][ T5931] usb 2-1: config 0 descriptor?? [ 992.189167][T18670] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 992.304539][T20877] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4079'. [ 992.993791][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.000553][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.236666][T20888] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4076'. [ 994.395997][T20907] netlink: 'syz.3.4082': attribute type 12 has an invalid length. [ 995.107961][T13900] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 995.378230][T13900] usb 5-1: Using ep0 maxpacket: 8 [ 995.419262][T13900] usb 5-1: unable to get BOS descriptor or descriptor too short [ 995.489673][T13900] usb 5-1: config 4 has an invalid interface number: 30 but max is 0 [ 995.518553][T13900] usb 5-1: config 4 has no interface number 0 [ 995.524720][T13900] usb 5-1: config 4 interface 30 has no altsetting 0 [ 995.584457][T13900] usb 5-1: string descriptor 0 read error: -22 [ 995.601292][T13900] usb 5-1: New USB device found, idVendor=9022, idProduct=d484, bcdDevice=ff.88 [ 995.629806][T13900] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 995.683687][ T5931] usbhid 2-1:0.0: can't add hid device: -71 [ 995.719906][T13900] dvb-usb: found a 'TeVii S482 (tuner 2)' in warm state. [ 995.747615][ T5931] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 995.766495][T13900] dw2102: su3000_power_ctrl: 1, initialized 0 [ 995.814800][ T5931] usb 2-1: USB disconnect, device number 20 [ 995.828807][T13900] dvb-usb: bulk message failed: -22 (2/0) [ 995.889510][T13900] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 995.920436][T20912] dw2102: i2c wr: len=69 is too big! [ 995.920436][T20912] [ 995.954513][T13900] dvbdev: DVB: registering new adapter (TeVii S482 (tuner 2)) [ 995.964153][T20912] netlink: 312 bytes leftover after parsing attributes in process `syz.4.4085'. [ 995.982797][T13900] usb 5-1: media controller created [ 996.008455][T13900] dvb-usb: bulk message failed: -22 (6/0) [ 996.075479][T13900] dw2102: i2c transfer failed. [ 996.122221][T13900] dvb-usb: bulk message failed: -22 (6/0) [ 996.158547][T13900] dw2102: i2c transfer failed. [ 996.188683][T13900] dvb-usb: bulk message failed: -22 (6/0) [ 996.238206][T13900] dw2102: i2c transfer failed. [ 996.247020][T13900] dvb-usb: bulk message failed: -22 (6/0) [ 996.268242][T13900] dw2102: i2c transfer failed. [ 996.278452][T13900] dvb-usb: bulk message failed: -22 (6/0) [ 996.296207][T13900] dw2102: i2c transfer failed. [ 996.315452][T13900] dvb-usb: bulk message failed: -22 (6/0) [ 996.323333][T13900] dw2102: i2c transfer failed. [ 996.334382][T13900] dvb-usb: MAC address: 02:02:02:02:02:02 [ 996.400428][T13900] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 996.457978][T13900] dvb-usb: bulk message failed: -22 (3/0) [ 996.507337][T13900] dw2102: command 0x0e transfer failed. [ 996.518166][T13900] dvb-usb: bulk message failed: -22 (3/0) [ 996.534083][T13900] dw2102: command 0x0e transfer failed. [ 996.858670][T13900] dvb-usb: bulk message failed: -22 (3/0) [ 996.864703][T13900] dw2102: command 0x0e transfer failed. [ 996.922456][T13900] dvb-usb: bulk message failed: -22 (3/0) [ 996.946484][T13900] dw2102: command 0x0e transfer failed. [ 996.973902][T13900] dvb-usb: bulk message failed: -22 (1/0) [ 997.021513][T13900] dw2102: command 0x51 transfer failed. [ 997.051247][T13900] dvb-usb: bulk message failed: -22 (5/0) [ 997.072320][T13900] dw2102: i2c probe for address 0x68 failed. [ 997.095167][T13900] dvb-usb: bulk message failed: -22 (5/0) [ 997.140855][T13900] dw2102: i2c probe for address 0x69 failed. [ 997.176282][T13900] dvb-usb: bulk message failed: -22 (5/0) [ 997.204865][T13900] dw2102: i2c probe for address 0x6a failed. [ 997.247090][T13900] dw2102: probing for demodulator failed. Is the external power switched on? [ 997.306457][T13900] dvb-usb: no frontend was attached by 'TeVii S482 (tuner 2)' [ 997.555822][T20941] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4093'. [ 997.558610][T13900] rc_core: IR keymap rc-tt-1500 not found [ 997.613937][T13900] Registered IR keymap rc-empty [ 997.643803][T13900] rc rc0: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 997.682398][T20941] fuse: Bad value for 'fd' [ 997.689450][T13900] input: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input61 [ 997.828245][T13900] dvb-usb: schedule remote query interval to 250 msecs. [ 997.879390][T13900] dw2102: su3000_power_ctrl: 0, initialized 1 [ 997.918786][T20944] loop7: detected capacity change from 0 to 1 [ 997.937954][T13900] dvb-usb: TeVii S482 (tuner 2) successfully initialized and connected. [ 997.970923][T13900] usb 5-1: USB disconnect, device number 6 [ 998.091578][ T5867] Dev loop7: unable to read RDB block 1 [ 998.105601][ T5867] loop7: unable to read partition table [ 998.114253][ T5867] loop7: partition table beyond EOD, truncated [ 998.124244][T20944] Dev loop7: unable to read RDB block 1 [ 998.163299][T20944] loop7: unable to read partition table [ 998.262625][T20949] vivid-000: disconnect [ 998.303690][T20944] loop7: partition table beyond EOD, truncated [ 998.481092][T20944] loop_reread_partitions: partition scan of loop7 (îÝ·ÂU@™:ÖB$Œ{W) failed (rc=-5) [ 998.549999][T13900] dvb-usb: TeVii S482 (tuner 2) successfully deinitialized and disconnected. [ 998.561845][T18667] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 998.595859][T20954] loop4: detected capacity change from 0 to 7 [ 998.622688][T20954] Dev loop4: unable to read RDB block 7 [ 998.639016][T20954] loop4: unable to read partition table [ 998.653132][T20954] loop4: partition table beyond EOD, truncated [ 998.679687][T20954] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 998.763118][T18667] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 998.780620][T18670] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 998.802275][T18667] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 998.846444][T18667] usb 6-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 998.891916][T18667] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 998.984080][T18667] usb 6-1: config 0 descriptor?? [ 998.991441][T20964] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 998.998002][T18670] usb 4-1: Using ep0 maxpacket: 32 [ 999.017968][T18670] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 999.034279][T20964] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 999.050973][T18670] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 999.079453][T18670] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 999.095827][T18670] usb 4-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 999.106604][T20964] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 999.120647][T18670] usb 4-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 999.130221][T20964] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 999.143050][T18670] usb 4-1: Product: syz [ 999.147251][T18670] usb 4-1: Manufacturer: syz [ 999.159938][T20964] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 999.173091][T18670] usb 4-1: SerialNumber: syz [ 999.180418][T20964] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 999.204891][T18670] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input62 [ 999.249983][T13900] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 999.388859][T13900] usb 5-1: device descriptor read/64, error -71 [ 999.424579][T18670] usb 4-1: USB disconnect, device number 36 [ 999.482264][T18670] appletouch 4-1:1.0: input: appletouch disconnected [ 999.637975][T13900] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 999.657247][T18667] usbhid 6-1:0.0: can't add hid device: -32 [ 999.738136][T18667] usbhid 6-1:0.0: probe with driver usbhid failed with error -32 [ 999.787956][T13900] usb 5-1: device descriptor read/64, error -71 [ 999.899288][T13900] usb usb5-port1: attempt power cycle [ 1000.242769][T20984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1000.248081][T13900] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 1000.260891][T20985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1000.261012][T20984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1000.281177][T20985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1000.300124][T13900] usb 5-1: device descriptor read/8, error -71 [ 1000.316278][T20981] bridge_slave_0: left allmulticast mode [ 1000.326794][T20981] bridge_slave_0: left promiscuous mode [ 1000.335070][T20981] bridge0: port 1(bridge_slave_0) entered disabled state [ 1000.373925][T20981] bridge_slave_1: left allmulticast mode [ 1000.381067][T20981] bridge_slave_1: left promiscuous mode [ 1000.390885][T20981] bridge0: port 2(bridge_slave_1) entered disabled state [ 1000.445716][T20981] bond0: (slave bond_slave_0): Releasing backup interface [ 1000.485004][T20981] bond0: (slave bond_slave_1): Releasing backup interface [ 1000.517233][T20981] team0: Port device team_slave_0 removed [ 1000.540088][T20981] team0: Port device team_slave_1 removed [ 1000.548754][T13900] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 1000.562388][T20981] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1000.571539][T20981] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1000.579465][T13900] usb 5-1: device descriptor read/8, error -71 [ 1000.605032][T20981] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1000.612995][T20981] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1000.699079][T13900] usb usb5-port1: unable to enumerate USB device [ 1001.058460][T20993] team0: Port device syz_tun removed [ 1001.097226][T20993] bridge_slave_0: left allmulticast mode [ 1001.105403][T20993] bridge_slave_0: left promiscuous mode [ 1001.118274][T18670] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1001.155977][T20993] bridge0: port 1(bridge_slave_0) entered disabled state [ 1001.199533][T20993] bridge_slave_1: left allmulticast mode [ 1001.208676][T20993] bridge_slave_1: left promiscuous mode [ 1001.234279][T20993] bridge0: port 2(bridge_slave_1) entered disabled state [ 1001.336312][T20993] bond0: (slave bond_slave_0): Releasing backup interface [ 1001.349723][T20993] bond0: (slave bond_slave_1): Releasing backup interface [ 1001.363709][T20993] team0: Port device team_slave_0 removed [ 1001.373377][T20993] team0: Port device team_slave_1 removed [ 1001.384283][T20993] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1001.392704][T20993] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1001.489441][T20999] netlink: 'syz.3.4111': attribute type 6 has an invalid length. [ 1001.497486][T21001] netlink: 'syz.3.4111': attribute type 6 has an invalid length. [ 1001.588030][T13900] usb 6-1: USB disconnect, device number 64 [ 1001.596019][T21004] netlink: 'syz.3.4112': attribute type 5 has an invalid length. [ 1001.717257][T21004] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.4112'. [ 1002.059889][T21021] netlink: 7 bytes leftover after parsing attributes in process `syz.5.4116'. [ 1002.108312][T13900] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1002.267016][T21028] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1002.420338][T21028] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1002.527609][T21032] input: syz1 as /devices/virtual/input/input63 [ 1002.573649][T21033] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1002.600418][T21033] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1002.619894][T21033] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1002.716504][T21032] netlink: 'syz.4.4118': attribute type 1 has an invalid length. [ 1004.551763][ T30] audit: type=1326 audit(1758866909.856:1276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21063 comm="syz.5.4126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1004.606350][ T30] audit: type=1326 audit(1758866909.856:1277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21063 comm="syz.5.4126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1004.663097][ T30] audit: type=1326 audit(1758866909.886:1278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21063 comm="syz.5.4126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=162 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1004.849860][ T30] audit: type=1326 audit(1758866910.156:1279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21063 comm="syz.5.4126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1004.905988][ T30] audit: type=1326 audit(1758866910.156:1280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21063 comm="syz.5.4126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1004.995317][ T30] audit: type=1326 audit(1758866910.246:1281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21063 comm="syz.5.4126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1005.019153][T13900] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 1005.070660][ T30] audit: type=1326 audit(1758866910.246:1282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21063 comm="syz.5.4126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1005.134288][ T30] audit: type=1326 audit(1758866910.246:1283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21063 comm="syz.5.4126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1005.178415][ T30] audit: type=1326 audit(1758866910.256:1284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21063 comm="syz.5.4126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1005.189857][T13900] usb 5-1: config 0 has an invalid interface number: 3 but max is 0 [ 1005.201527][ T30] audit: type=1326 audit(1758866910.256:1285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21063 comm="syz.5.4126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1005.258331][T13900] usb 5-1: config 0 has no interface number 0 [ 1005.274932][T13900] usb 5-1: config 0 interface 3 altsetting 0 endpoint 0xD has an invalid bInterval 104, changing to 10 [ 1005.283179][T21075] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4129'. [ 1005.304472][T13900] usb 5-1: config 0 interface 3 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 1005.317260][T13900] usb 5-1: New USB device found, idVendor=1660, idProduct=1921, bcdDevice=1f.84 [ 1005.326931][T21075] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap0 [ 1005.328492][T13900] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1005.346182][T21075] ip6gretap0: entered promiscuous mode [ 1005.363249][T21075] ip6gretap0: left promiscuous mode [ 1005.364622][T21066] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1005.375438][T21066] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1005.383127][T21066] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1005.390081][T13900] usb 5-1: Product: syz [ 1005.394500][T13900] usb 5-1: Manufacturer: syz [ 1005.400530][T21066] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1005.406531][T13900] usb 5-1: SerialNumber: syz [ 1005.411952][T21066] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1005.440801][T13900] usb 5-1: config 0 descriptor?? [ 1005.683345][T13900] dvb-usb: found a 'Medion CTX1921 DVB-T USB' in warm state. [ 1005.788910][T13900] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1005.894709][T13900] dvbdev: DVB: registering new adapter (Medion CTX1921 DVB-T USB) [ 1005.932262][T13900] usb 5-1: media controller created [ 1006.058319][T13900] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1006.359001][T13900] DVB: Unable to find symbol dib7000p_attach() [ 1006.424401][T13900] dvb-usb: no frontend was attached by 'Medion CTX1921 DVB-T USB' [ 1006.900645][T13900] rc_core: IR keymap rc-dib0700-rc5 not found [ 1006.939566][T13900] Registered IR keymap rc-empty [ 1006.980845][T13900] dvb-usb: could not initialize remote control. [ 1007.009440][T13900] dvb-usb: Medion CTX1921 DVB-T USB successfully initialized and connected. [ 1007.083143][T13900] dib0700: There's no endpoint for remote controller [ 1007.218179][ T5185] Bluetooth: hci4: command 0x0c1a tx timeout [ 1007.294886][ T6027] usb 5-1: USB disconnect, device number 11 [ 1007.458303][ T5185] Bluetooth: hci0: command 0x0c1a tx timeout [ 1007.464488][ T5874] Bluetooth: hci1: command 0x0c1a tx timeout [ 1007.464513][T17449] Bluetooth: hci3: command 0x040f tx timeout [ 1007.476995][ T5874] Bluetooth: hci5: command 0x0c1a tx timeout [ 1007.485628][ T6027] dvb-usb: Medion CTX1921 DVB-T USB successfully deinitialized and disconnected. [ 1007.665016][T21107] loop4: detected capacity change from 0 to 7 [ 1007.708106][T21107] Dev loop4: unable to read RDB block 7 [ 1007.765601][T21107] loop4: unable to read partition table [ 1007.772190][T21107] loop4: partition table beyond EOD, truncated [ 1007.779837][T21107] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1007.880899][T13900] usb 6-1: new low-speed USB device number 65 using dummy_hcd [ 1008.008835][T21114] loop7: detected capacity change from 0 to 1 [ 1008.040218][T13900] usb 6-1: device descriptor read/64, error -71 [ 1008.073496][T21114] Dev loop7: unable to read RDB block 1 [ 1008.089084][T21110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1008.097578][T21114] loop7: unable to read partition table [ 1008.130046][T21114] loop7: partition table beyond EOD, truncated [ 1008.136262][T21114] loop_reread_partitions: partition scan of loop7 (îÝ·ÂU@™:ÖB$Œ{W) failed (rc=-5) [ 1008.155863][T21110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1008.231348][T21110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1008.283958][T21110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1008.317959][T13900] usb 6-1: new low-speed USB device number 66 using dummy_hcd [ 1008.503433][T13900] usb 6-1: device descriptor read/64, error -71 [ 1008.655323][T13900] usb usb6-port1: attempt power cycle [ 1009.047968][T13900] usb 6-1: new low-speed USB device number 67 using dummy_hcd [ 1009.098440][T21131] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(11) [ 1009.105083][T21131] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1009.136026][T21131] vhci_hcd vhci_hcd.0: Device attached [ 1009.213782][T13900] usb 6-1: device descriptor read/8, error -71 [ 1009.358446][T18670] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 1009.368465][T18667] usb 35-1: new low-speed USB device number 2 using vhci_hcd [ 1009.458532][T13900] usb 6-1: new low-speed USB device number 68 using dummy_hcd [ 1009.478522][T13900] usb 6-1: device descriptor read/8, error -71 [ 1009.490320][T18670] usb 4-1: device descriptor read/64, error -71 [ 1009.608725][T13900] usb usb6-port1: unable to enumerate USB device [ 1009.817288][T18670] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 1009.855089][T21142] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4145'. [ 1009.889658][T21142] netlink: 'syz.0.4145': attribute type 1 has an invalid length. [ 1009.898861][T21142] bond0: option mode: invalid value (105) [ 1010.027952][T18670] usb 4-1: device descriptor read/64, error -71 [ 1010.100216][T21156] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4150'. [ 1010.134820][T21157] trusted_key: encrypted_key: key user:syz not found [ 1010.159375][T18670] usb usb4-port1: attempt power cycle [ 1010.189106][T21158] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4150'. [ 1010.678423][T18670] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 1010.698699][T18670] usb 4-1: device descriptor read/8, error -71 [ 1011.147947][T18670] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 1011.179746][T18670] usb 4-1: device descriptor read/8, error -71 [ 1011.286801][T21168] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4152'. [ 1011.336893][T18670] usb usb4-port1: unable to enumerate USB device [ 1011.680789][T21135] vhci_hcd: connection reset by peer [ 1011.686515][T18059] vhci_hcd: stop threads [ 1011.710555][T18059] vhci_hcd: release socket [ 1011.753460][T18059] vhci_hcd: disconnect device [ 1012.084926][T21185] netlink: 92 bytes leftover after parsing attributes in process `syz.1.4158'. [ 1012.468610][ T5948] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 1012.618640][ T5931] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 1012.639275][ T5948] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1012.674934][ T5948] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1012.696797][ T5948] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1012.712221][ T5948] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1012.735433][ T5948] usb 2-1: Product: syz [ 1012.748094][ T5931] usb 6-1: device descriptor read/64, error -71 [ 1012.859923][ T5948] usb 2-1: Manufacturer: syz [ 1012.886032][ T5948] usb 2-1: SerialNumber: syz [ 1012.924211][ T5948] usb 2-1: config 0 descriptor?? [ 1012.955800][ T5948] usb 2-1: selecting invalid altsetting 0 [ 1012.998886][ T5931] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 1013.154652][ T5931] usb 6-1: device descriptor read/64, error -71 [ 1013.199195][T21191] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1013.294184][T21191] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1013.332013][ T5931] usb usb6-port1: attempt power cycle [ 1013.432903][T21204] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4162'. [ 1013.455053][T21204] vlan3: entered promiscuous mode [ 1013.464629][T21204] gretap0: entered promiscuous mode [ 1013.588084][ T5948] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 1013.718167][T21211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1013.741298][ T5931] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 1013.750305][ T5948] usb 5-1: config 0 has no interfaces? [ 1013.756402][T21211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1013.760944][ T5948] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1013.791166][ T5931] usb 6-1: device descriptor read/8, error -71 [ 1013.810156][ T5948] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1013.841119][ T5948] usb 5-1: Product: syz [ 1013.855299][ T5948] usb 5-1: Manufacturer: syz [ 1013.863997][ T5948] usb 5-1: SerialNumber: syz [ 1013.876685][ T5948] usb 5-1: config 0 descriptor?? [ 1013.942954][T21213] tipc: Started in network mode [ 1013.954807][T21213] tipc: Node identity 9638058d762b, cluster identity 4711 [ 1013.963556][T21213] tipc: Enabled bearer , priority 0 [ 1013.976370][T21213] syzkaller0: entered promiscuous mode [ 1013.984862][T21213] syzkaller0: entered allmulticast mode [ 1014.005467][T21213] tipc: Resetting bearer [ 1014.019753][T21212] tipc: Resetting bearer [ 1014.046549][T21212] tipc: Disabling bearer [ 1014.054555][ T5931] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 1014.078737][ T5931] usb 6-1: device descriptor read/8, error -71 [ 1014.149308][T21215] netlink: 84 bytes leftover after parsing attributes in process `syz.3.4167'. [ 1014.181499][T21216] vlan2: entered promiscuous mode [ 1014.213376][ T5931] usb usb6-port1: unable to enumerate USB device [ 1014.343676][T21221] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1014.358570][T21221] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1014.488118][T18667] vhci_hcd: vhci_device speed not set [ 1014.687973][ T5931] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 1014.847945][ T5931] usb 4-1: Using ep0 maxpacket: 8 [ 1014.863925][ T5931] usb 4-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 1014.873249][ T5931] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1014.881906][ T5931] usb 4-1: Product: syz [ 1014.886104][ T5931] usb 4-1: Manufacturer: syz [ 1014.891342][ T5931] usb 4-1: SerialNumber: syz [ 1014.904845][ T5931] usb 4-1: config 0 descriptor?? [ 1014.916618][ T5931] gspca_main: sq930x-2.14.0 probing 2770:930c [ 1015.149605][T21230] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1015.159659][T21230] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1015.259721][T18689] usb 2-1: USB disconnect, device number 21 [ 1015.842438][T21239] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4174'. [ 1016.024826][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 1016.024845][ T30] audit: type=1326 audit(1758866921.326:1293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21233 comm="syz.5.4173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1016.053832][ C1] vkms_vblank_simulate: vblank timer overrun [ 1016.115781][ T5931] gspca_sq930x: ucbus_write failed -110 [ 1016.233778][ T30] audit: type=1326 audit(1758866921.326:1294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21233 comm="syz.5.4173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1016.256227][ C1] vkms_vblank_simulate: vblank timer overrun [ 1016.358574][ T5931] gspca_sq930x: Sensor ov9630 not yet treated [ 1016.384712][ T5931] sq930x 4-1:0.0: probe with driver sq930x failed with error -22 [ 1016.453797][ T30] audit: type=1326 audit(1758866921.326:1295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21233 comm="syz.5.4173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1016.551511][T18689] usb 5-1: USB disconnect, device number 12 [ 1016.648482][ T30] audit: type=1326 audit(1758866921.326:1296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21233 comm="syz.5.4173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1016.670914][ C1] vkms_vblank_simulate: vblank timer overrun [ 1016.720186][ T30] audit: type=1326 audit(1758866921.326:1297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21233 comm="syz.5.4173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=200 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1016.743524][ T30] audit: type=1326 audit(1758866921.326:1298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21233 comm="syz.5.4173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f5321d2af79 code=0x7ffc0000 [ 1016.768773][ T30] audit: type=1326 audit(1758866921.326:1299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21233 comm="syz.5.4173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1016.777514][T21258] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4178'. [ 1016.791626][ T30] audit: type=1326 audit(1758866921.376:1300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21233 comm="syz.5.4173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5321d8eec9 code=0x7ffc0000 [ 1016.924781][T21261] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap0 [ 1017.003837][T21261] ip6gretap0: entered promiscuous mode [ 1017.041718][T21261] ip6gretap0: left promiscuous mode [ 1017.168311][ T5948] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 1017.282530][T21267] loop6: detected capacity change from 0 to 7 [ 1017.306054][ T6144] Dev loop6: unable to read RDB block 7 [ 1017.318029][ T6144] loop6: unable to read partition table [ 1017.328483][ T5948] usb 5-1: Using ep0 maxpacket: 8 [ 1017.328527][ T6144] loop6: partition table beyond EOD, truncated [ 1017.349542][ T5948] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1017.359028][ T5948] usb 5-1: config 4 has an invalid interface number: 30 but max is 0 [ 1017.377623][ T5948] usb 5-1: config 4 has no interface number 0 [ 1017.387271][T21267] Dev loop6: unable to read RDB block 7 [ 1017.402024][T21267] loop6: unable to read partition table [ 1017.421775][T21267] loop6: partition table beyond EOD, truncated [ 1017.439843][ T5948] usb 5-1: config 4 interface 30 has no altsetting 0 [ 1017.440754][T21267] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1017.463469][ T5948] usb 5-1: string descriptor 0 read error: -22 [ 1017.473820][ T5948] usb 5-1: New USB device found, idVendor=9022, idProduct=d484, bcdDevice=ff.88 [ 1017.513651][ T5948] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1017.570253][ T5948] dvb-usb: found a 'TeVii S482 (tuner 2)' in warm state. [ 1017.593892][ T5948] dw2102: su3000_power_ctrl: 1, initialized 0 [ 1017.601618][ T5948] dvb-usb: bulk message failed: -22 (2/0) [ 1017.635386][ T5948] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1017.661703][ T5948] dvbdev: DVB: registering new adapter (TeVii S482 (tuner 2)) [ 1017.670335][ T5948] usb 5-1: media controller created [ 1017.675790][ T5948] dvb-usb: bulk message failed: -22 (6/0) [ 1017.682391][ T5948] dw2102: i2c transfer failed. [ 1017.690260][ T5948] dvb-usb: bulk message failed: -22 (6/0) [ 1017.704279][ T5948] dw2102: i2c transfer failed. [ 1017.742427][ T5948] dvb-usb: bulk message failed: -22 (6/0) [ 1017.767917][T18667] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 1017.783670][ T5948] dw2102: i2c transfer failed. [ 1017.861913][T21260] netlink: 312 bytes leftover after parsing attributes in process `syz.4.4177'. [ 1017.883586][T21262] dw2102: i2c wr: len=69 is too big! [ 1017.883586][T21262] [ 1017.905736][ T5948] dvb-usb: bulk message failed: -22 (6/0) [ 1017.949545][T21283] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4185'. [ 1018.000357][ T5948] dw2102: i2c transfer failed. [ 1018.008020][T18667] usb 6-1: Using ep0 maxpacket: 32 [ 1018.023515][T18689] usb 4-1: USB disconnect, device number 41 [ 1018.053485][T18667] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 1018.066339][ T5948] dvb-usb: bulk message failed: -22 (6/0) [ 1018.082636][T18667] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1018.092010][ T5948] dw2102: i2c transfer failed. [ 1018.101577][ T5948] dvb-usb: bulk message failed: -22 (6/0) [ 1018.107326][ T5948] dw2102: i2c transfer failed. [ 1018.113256][T18667] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1018.131332][ T5948] dvb-usb: MAC address: 02:02:02:02:02:02 [ 1018.152863][T18667] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1018.180637][T18667] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1018.204954][ T5948] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1018.221966][T18667] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1018.270249][ T5948] dvb-usb: bulk message failed: -22 (3/0) [ 1018.276397][T18667] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1018.285648][ T5948] dw2102: command 0x0e transfer failed. [ 1018.292505][T18667] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1018.302019][ T5948] dvb-usb: bulk message failed: -22 (3/0) [ 1018.308749][ T5948] dw2102: command 0x0e transfer failed. [ 1018.317717][T18667] usb 6-1: config 0 descriptor?? [ 1018.610103][T18667] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 73 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1018.638132][ T5948] dvb-usb: bulk message failed: -22 (3/0) [ 1018.673656][ T5948] dw2102: command 0x0e transfer failed. [ 1018.692906][ T5948] dvb-usb: bulk message failed: -22 (3/0) [ 1018.702364][T21302] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4191'. [ 1018.710948][ T5948] dw2102: command 0x0e transfer failed. [ 1018.728047][ T5948] dvb-usb: bulk message failed: -22 (1/0) [ 1018.748977][ T5948] dw2102: command 0x51 transfer failed. [ 1018.762504][ T5948] dvb-usb: bulk message failed: -22 (5/0) [ 1018.769232][ T5948] dw2102: i2c probe for address 0x68 failed. [ 1018.775328][ T5948] dvb-usb: bulk message failed: -22 (5/0) [ 1018.786261][ T5948] dw2102: i2c probe for address 0x69 failed. [ 1018.795071][ T5948] dvb-usb: bulk message failed: -22 (5/0) [ 1018.807210][ T5948] dw2102: i2c probe for address 0x6a failed. [ 1018.811289][T21302] vlan2: entered promiscuous mode [ 1018.815067][ T5948] dw2102: probing for demodulator failed. Is the external power switched on? [ 1018.828750][ T5931] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 1018.834684][ T5948] dvb-usb: no frontend was attached by 'TeVii S482 (tuner 2)' [ 1018.845377][ C1] usblp0: nonzero read bulk status received: -71 [ 1018.854629][T18667] usb 6-1: USB disconnect, device number 73 [ 1018.922099][T21302] gretap0: entered promiscuous mode [ 1019.002571][ T5948] rc_core: IR keymap rc-tt-1500 not found [ 1019.030724][ T5948] Registered IR keymap rc-empty [ 1019.065258][ T5931] usb 4-1: device descriptor read/64, error -71 [ 1019.069429][ T5948] rc rc0: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 1019.155928][ T5948] input: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input66 [ 1019.215045][ T5948] dvb-usb: schedule remote query interval to 250 msecs. [ 1019.242539][ T5948] dw2102: su3000_power_ctrl: 0, initialized 1 [ 1019.262778][ T5948] dvb-usb: TeVii S482 (tuner 2) successfully initialized and connected. [ 1019.313589][ T5948] usb 5-1: USB disconnect, device number 13 [ 1019.367569][ T5931] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 1019.552424][ T5931] usb 4-1: device descriptor read/64, error -71 [ 1019.626311][ T5948] dvb-usb: TeVii S482 (tuner 2) successfully deinitialized and disconnected. [ 1019.691905][ T5931] usb usb4-port1: attempt power cycle [ 1019.727304][T21318] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4195'. [ 1019.739234][T21317] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4195'. [ 1019.976996][T21329] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4196'. [ 1020.048486][ T5931] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 1020.089559][ T5931] usb 4-1: device descriptor read/8, error -71 [ 1020.408220][ T5931] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 1020.462747][ T5931] usb 4-1: device descriptor read/8, error -71 [ 1020.578868][ T5931] usb usb4-port1: unable to enumerate USB device [ 1020.644385][T21309] usblp0: removed [ 1020.850195][T21347] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4200'. [ 1020.904667][T21347] netlink: 'syz.5.4200': attribute type 1 has an invalid length. [ 1021.047947][T21347] bond0: option mode: unable to set because the bond device is up [ 1021.902232][ T5931] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 1021.986510][T21362] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4203'. [ 1022.065251][T21365] input: syz0 as /devices/virtual/input/input67 [ 1022.073029][ T5931] usb 4-1: config 0 has an invalid interface number: 83 but max is 0 [ 1022.081640][ T5931] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1022.187633][ T5931] usb 4-1: config 0 has no interface number 0 [ 1022.276560][T21366] netlink: 'syz.1.4204': attribute type 1 has an invalid length. [ 1022.278051][ T5931] usb 4-1: config 0 interface 83 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1022.337752][ T5931] usb 4-1: config 0 interface 83 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1022.449008][ T5931] usb 4-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=39.61 [ 1022.504947][ T5931] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1022.622344][ T5931] usb 4-1: config 0 descriptor?? [ 1022.638904][ T5931] ttusbir 4-1:0.83: cannot find expected altsetting [ 1023.682784][T21392] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1023.775778][T21392] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1024.133819][T21394] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1024.144563][T21394] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1024.155133][T21400] veth1_macvtap: left promiscuous mode [ 1024.161199][T21400] macsec0: entered allmulticast mode [ 1024.171610][T21400] veth1_macvtap: entered promiscuous mode [ 1024.177529][T21400] veth1_macvtap: entered allmulticast mode [ 1024.186066][T21400] macsec0: left allmulticast mode [ 1024.191665][T21400] veth1_macvtap: left allmulticast mode [ 1024.368401][T18667] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 1024.498711][T18667] usb 6-1: device descriptor read/64, error -71 [ 1024.691261][ T5948] usb 4-1: USB disconnect, device number 46 [ 1024.740901][T18667] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 1024.806485][T21404] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4215'. [ 1024.898045][T18667] usb 6-1: device descriptor read/64, error -71 [ 1025.026514][T18667] usb usb6-port1: attempt power cycle [ 1025.151487][T21407] kAFS: unable to lookup cell '/,' [ 1025.379304][T18667] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 1025.398217][T13900] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 1025.413853][T18667] usb 6-1: device descriptor read/8, error -71 [ 1025.562586][T13900] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1025.583222][T13900] usb 2-1: New USB device found, idVendor=3823, idProduct=0001, bcdDevice= 3.eb [ 1025.611334][T13900] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1025.615183][T21423] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4223'. [ 1025.639694][T13900] usb 2-1: Product: syz [ 1025.644361][T13900] usb 2-1: Manufacturer: syz [ 1025.652669][T13900] usb 2-1: SerialNumber: syz [ 1025.659797][T18667] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 1025.663676][T13900] usb 2-1: config 0 descriptor?? [ 1025.691864][T13900] usbtouchscreen 2-1:0.0: probe with driver usbtouchscreen failed with error -12 [ 1025.711314][T18667] usb 6-1: device descriptor read/8, error -71 [ 1025.828589][T18667] usb usb6-port1: unable to enumerate USB device [ 1025.891425][T21407] tipc: Enabling of bearer rejected, failed to enable media [ 1026.002276][T21426] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1026.010182][T21426] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1026.016389][T21426] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1026.023615][T21426] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1026.030422][T21426] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1026.044540][T21411] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1026.053834][T21411] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1026.074905][T18667] usb 2-1: USB disconnect, device number 22 [ 1026.438491][ T5948] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 1026.630192][ T5948] usb 4-1: config 0 has an invalid interface number: 83 but max is 0 [ 1026.654215][ T5948] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1026.692833][ T5948] usb 4-1: config 0 has no interface number 0 [ 1026.764244][ T5948] usb 4-1: config 0 interface 83 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1026.774433][ T5948] usb 4-1: config 0 interface 83 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1026.789605][ T5948] usb 4-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=39.61 [ 1026.801260][ T5948] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1026.844128][ T5948] usb 4-1: config 0 descriptor?? [ 1026.867289][ T5948] ttusbir 4-1:0.83: cannot find expected altsetting [ 1026.889670][T21438] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4227'. [ 1026.948338][T21438] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4227'. [ 1027.136175][T21440] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4228'. [ 1027.351977][T21445] tipc: Enabled bearer , priority 0 [ 1027.361016][T21445] syzkaller0: entered promiscuous mode [ 1027.366629][T21445] syzkaller0: entered allmulticast mode [ 1027.401215][T21445] tipc: Resetting bearer [ 1027.417759][T21444] tipc: Resetting bearer [ 1027.475556][T21444] tipc: Disabling bearer [ 1027.547975][ T5931] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 1027.709803][ T5931] usb 6-1: New USB device found, idVendor=1645, idProduct=0008, bcdDevice=cf.36 [ 1027.722778][ T5931] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1027.733435][ T5931] usb 6-1: config 0 descriptor?? [ 1027.938085][ T5185] Bluetooth: hci4: command 0x0c1a tx timeout [ 1028.007096][ T5931] kaweth 6-1:0.0: Firmware present in device. [ 1028.018913][ T5185] Bluetooth: hci3: command 0x040f tx timeout [ 1028.025193][ T5874] Bluetooth: hci5: command 0x0c1a tx timeout [ 1028.127287][ T5874] Bluetooth: hci1: command 0x0c1a tx timeout [ 1028.133452][ T5185] Bluetooth: hci0: command 0x0c1a tx timeout [ 1028.148010][ T5931] kaweth 6-1:0.0: Error reading configuration (-71), no net device created [ 1028.190227][ T5931] kaweth 6-1:0.0: probe with driver kaweth failed with error -5 [ 1028.221451][ T5931] usb 6-1: USB disconnect, device number 78 [ 1028.248332][T21454] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4232'. [ 1028.287170][T21454] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4232'. [ 1028.563341][T21458] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4234'. [ 1028.985476][T21462] pim6reg: entered allmulticast mode [ 1029.323944][T18667] usb 4-1: USB disconnect, device number 47 [ 1029.543426][T21471] tipc: Enabling of bearer rejected, failed to enable media [ 1029.608123][ T5948] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 1029.748625][ T5948] usb 5-1: device descriptor read/64, error -71 [ 1030.020376][T21478] QAT: Invalid ioctl -2147183773 [ 1030.034828][ T5948] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 1030.160594][T21482] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1030.211839][T21482] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1030.222004][ T5948] usb 5-1: device descriptor read/64, error -71 [ 1030.350070][ T5948] usb usb5-port1: attempt power cycle [ 1030.708433][ T5948] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 1030.760563][T21497] netlink: 'syz.5.4245': attribute type 12 has an invalid length. [ 1030.801723][ T5948] usb 5-1: device descriptor read/8, error -71 [ 1031.101915][ T5948] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 1031.169300][ T5948] usb 5-1: device descriptor read/8, error -71 [ 1031.288504][ T5948] usb usb5-port1: unable to enumerate USB device [ 1032.212852][T21516] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4249'. [ 1032.518414][T18673] usb 6-1: new full-speed USB device number 79 using dummy_hcd [ 1032.689988][T18673] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1032.776197][T21533] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4255'. [ 1032.827583][T18673] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1032.842405][T18673] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1032.852418][T18673] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1032.932211][T21534] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4255'. [ 1033.214687][T18673] usb 6-1: GET_CAPABILITIES returned 0 [ 1033.262933][T18673] usbtmc 6-1:16.0: can't read capabilities [ 1033.350318][T21520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1033.410553][T21520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1033.482634][T21520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1033.495621][T21520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1033.505623][T18689] usb 6-1: USB disconnect, device number 79 [ 1033.969007][T18689] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 1034.015974][ C1] raw-gadget.0 gadget.3: ignoring, device is not running [ 1034.148020][T18689] usb 4-1: device descriptor read/64, error -32 [ 1034.418134][T18689] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 1034.798966][T18673] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 1034.958732][T18673] usb 5-1: device descriptor read/64, error -71 [ 1035.096690][T18689] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1035.113700][T18689] usb 4-1: config 0 has no interfaces? [ 1035.125125][T18689] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1035.227987][T18673] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 1035.304921][T18689] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1035.390167][T18673] usb 5-1: device descriptor read/64, error -71 [ 1035.406775][T18689] usb 4-1: config 0 descriptor?? [ 1035.547948][T18673] usb usb5-port1: attempt power cycle [ 1035.938162][T18673] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 1036.039337][T18673] usb 5-1: device descriptor read/8, error -71 [ 1036.288980][T18673] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 1036.341639][T18673] usb 5-1: device descriptor read/8, error -71 [ 1036.461841][T18673] usb usb5-port1: unable to enumerate USB device [ 1037.078019][T18689] usb 2-1: new full-speed USB device number 23 using dummy_hcd [ 1037.230577][T18689] usb 2-1: config 0 has no interfaces? [ 1037.238996][T18689] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1037.253858][T18689] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.331624][T18689] usb 2-1: Product: syz [ 1037.362001][T18689] usb 2-1: Manufacturer: syz [ 1037.370509][T18689] usb 2-1: SerialNumber: syz [ 1037.425405][T18689] usb 2-1: config 0 descriptor?? [ 1037.875975][T18689] usb 4-1: USB disconnect, device number 49 [ 1037.971899][T21603] vlan3: entered promiscuous mode [ 1038.213119][T21618] tipc: Enabled bearer , priority 0 [ 1038.314268][T21618] syzkaller0: entered promiscuous mode [ 1038.322835][T21618] syzkaller0: entered allmulticast mode [ 1038.598262][ T5948] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 1038.775822][ T5948] usb 4-1: Using ep0 maxpacket: 8 [ 1038.806505][ T5948] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1038.874597][ T5948] usb 4-1: config 0 has no interfaces? [ 1038.912086][ T5948] usb 4-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=3f.3a [ 1038.951746][ T5948] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1038.988379][ T5948] usb 4-1: Product: syz [ 1039.115913][ T5948] usb 4-1: Manufacturer: syz [ 1039.187137][ T5948] usb 4-1: SerialNumber: syz [ 1039.232716][ T5948] usb 4-1: config 0 descriptor?? [ 1039.327993][ T5948] tipc: Node number set to 3759342989 [ 1039.473343][T21618] tipc: Resetting bearer [ 1039.548338][ T5931] usb 4-1: USB disconnect, device number 50 [ 1039.562984][T21617] tipc: Resetting bearer [ 1039.592807][T21617] tipc: Disabling bearer [ 1039.604181][T18673] usb 2-1: USB disconnect, device number 23 [ 1039.798801][T21635] netlink: 36 bytes leftover after parsing attributes in process `syz.5.4284'. [ 1040.910618][T21655] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4287'. [ 1040.910715][T21655] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4287'. [ 1041.400754][T21666] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1041.401095][T21666] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1041.498274][ T5948] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 1041.637948][ T5931] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 1041.648323][ T5948] usb 2-1: Using ep0 maxpacket: 8 [ 1041.650137][ T5948] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 1041.650165][ T5948] usb 2-1: config 0 has no interface number 0 [ 1041.650198][ T5948] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1041.650232][ T5948] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1041.650265][ T5948] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1041.650289][ T5948] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1041.650314][ T5948] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1041.650327][ T5948] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1041.652692][ T5948] usb 2-1: config 0 descriptor?? [ 1041.657601][ T5948] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1041.889227][ T5931] usb 5-1: device descriptor read/64, error -71 [ 1042.012829][T21670] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(11) [ 1042.012881][T21670] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1042.014749][T21670] vhci_hcd vhci_hcd.0: Device attached [ 1042.138128][ T5931] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 1042.194665][ T5948] usb 2-1: USB disconnect, device number 24 [ 1042.196725][ T5948] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 1042.248354][T18667] usb 33-1: new low-speed USB device number 2 using vhci_hcd [ 1042.277943][ T5931] usb 5-1: device descriptor read/64, error -71 [ 1042.388361][ T5931] usb usb5-port1: attempt power cycle [ 1042.739150][ T5931] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 1042.770273][ T5931] usb 5-1: device descriptor read/8, error -71 [ 1043.068185][ T5931] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 1043.100960][ T5931] usb 5-1: device descriptor read/8, error -71 [ 1043.208641][ T5948] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 1043.256456][ T5931] usb usb5-port1: unable to enumerate USB device [ 1043.359925][ T5948] usb 6-1: config 0 has an invalid interface number: 83 but max is 0 [ 1043.373946][ T5948] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1043.400610][ T5948] usb 6-1: config 0 has no interface number 0 [ 1043.414495][ T5948] usb 6-1: config 0 interface 83 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1043.436837][ T5948] usb 6-1: config 0 interface 83 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1043.468485][ T5948] usb 6-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=39.61 [ 1043.488586][ T5948] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1043.510731][ T5948] usb 6-1: config 0 descriptor?? [ 1043.539100][ T5948] ttusbir 6-1:0.83: cannot find expected altsetting [ 1043.877631][T21689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1043.888427][T21689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1044.571870][T21694] loop7: detected capacity change from 0 to 1 [ 1044.632526][T21694] Dev loop7: unable to read RDB block 1 [ 1044.639045][T21694] loop7: unable to read partition table [ 1044.644956][T21694] loop7: partition table beyond EOD, truncated [ 1044.652125][T21694] loop_reread_partitions: partition scan of loop7 (îÝ·ÂU@™:ÖB$Œ{W) failed (rc=-5) [ 1044.701004][ T5948] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 1044.813154][ T30] audit: type=1326 audit(1758866950.116:1301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21697 comm="syz.3.4301" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc54438eec9 code=0x0 [ 1044.877983][ T5948] usb 5-1: Using ep0 maxpacket: 32 [ 1044.884883][ T5948] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 1044.893734][ T5948] usb 5-1: config 0 has no interface number 0 [ 1044.900180][ T5948] usb 5-1: config 0 interface 89 has no altsetting 0 [ 1044.913871][ T5948] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1044.923592][ T5948] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1044.931958][ T5948] usb 5-1: Product: syz [ 1044.936177][ T5948] usb 5-1: Manufacturer: syz [ 1044.940985][ T5948] usb 5-1: SerialNumber: syz [ 1044.947616][ T5948] usb 5-1: config 0 descriptor?? [ 1044.956785][ T5948] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1044.966657][ T5948] em28xx 5-1:0.89: Video interface 89 found: bulk [ 1044.999723][T21673] vhci_hcd: connection reset by peer [ 1045.007752][T18066] vhci_hcd: stop threads [ 1045.014018][T18066] vhci_hcd: release socket [ 1045.033430][T18066] vhci_hcd: disconnect device [ 1045.558573][ T5948] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 1045.984718][T21692] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1046.001422][T18670] usb 6-1: USB disconnect, device number 80 [ 1046.019720][T21692] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1046.389738][T21712] netlink: 'syz.3.4303': attribute type 12 has an invalid length. [ 1046.782437][T21726] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1046.920558][ T5948] em28xx 5-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1046.968036][ T5948] em28xx 5-1:0.89: board has no eeprom [ 1047.062619][ T5948] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 1047.084712][ T5948] em28xx 5-1:0.89: analog set to bulk mode. [ 1047.115411][T18689] em28xx 5-1:0.89: Registering V4L2 extension [ 1047.154027][T21732] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4310'. [ 1047.296138][T18689] em28xx 5-1:0.89: reading from i2c device at 0x4a failed (error=-5) [ 1047.368031][T18667] vhci_hcd: vhci_device speed not set [ 1047.374635][T18689] em28xx 5-1:0.89: reading from i2c device at 0x48 failed (error=-5) [ 1047.597021][ T6027] usb 5-1: USB disconnect, device number 26 [ 1047.608512][T18689] em28xx 5-1:0.89: reading from i2c device at 0x42 failed (error=-5) [ 1047.693243][ T6027] em28xx 5-1:0.89: Disconnecting em28xx [ 1047.758021][T18689] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 1047.805633][T18689] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 1047.875782][T18689] em28xx 5-1:0.89: No AC97 audio processor [ 1047.932459][T21726] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1048.000508][T18689] usb 5-1: Decoder not found [ 1048.005135][T18689] em28xx 5-1:0.89: failed to create media graph [ 1048.292137][T21748] netlink: 'syz.3.4312': attribute type 12 has an invalid length. [ 1048.338414][T18689] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 1048.390485][T18689] em28xx 5-1:0.89: Registering snapshot button... [ 1048.414007][T18689] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input72 [ 1048.463881][T21744] ================================================================== [ 1048.471963][T21744] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xc7/0x430 [ 1048.479325][T21744] Read of size 8 at addr ffff88807ceac740 by task v4l_id/21744 [ 1048.486851][T21744] [ 1048.489168][T21744] CPU: 1 UID: 0 PID: 21744 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 1048.489184][T21744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1048.489191][T21744] Call Trace: [ 1048.489198][T21744] [ 1048.489203][T21744] dump_stack_lvl+0x189/0x250 [ 1048.489220][T21744] ? rcu_is_watching+0x15/0xb0 [ 1048.489231][T21744] ? __kasan_check_byte+0x12/0x40 [ 1048.489246][T21744] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1048.489257][T21744] ? rcu_is_watching+0x15/0xb0 [ 1048.489267][T21744] ? lock_release+0x4b/0x3e0 [ 1048.489283][T21744] ? __virt_addr_valid+0x1c8/0x5c0 [ 1048.489296][T21744] ? __virt_addr_valid+0x4a5/0x5c0 [ 1048.489308][T21744] print_report+0xca/0x240 [ 1048.489319][T21744] ? v4l2_fh_open+0xc7/0x430 [ 1048.489329][T21744] kasan_report+0x118/0x150 [ 1048.489344][T21744] ? v4l2_fh_open+0xc7/0x430 [ 1048.489355][T21744] v4l2_fh_open+0xc7/0x430 [ 1048.489367][T21744] em28xx_v4l2_open+0x157/0x9a0 [ 1048.489385][T21744] v4l2_open+0x20c/0x360 [ 1048.489397][T21744] chrdev_open+0x4c9/0x5e0 [ 1048.489407][T21744] ? __pfx_chrdev_open+0x10/0x10 [ 1048.489416][T21744] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 1048.489434][T21744] ? __pfx_chrdev_open+0x10/0x10 [ 1048.489442][T21744] do_dentry_open+0x950/0x13f0 [ 1048.489456][T21744] vfs_open+0x3b/0x340 [ 1048.489466][T21744] ? path_openat+0x2ecd/0x3830 [ 1048.489479][T21744] path_openat+0x2ee5/0x3830 [ 1048.489491][T21744] ? arch_stack_walk+0xfc/0x150 [ 1048.489508][T21744] ? stack_depot_save_flags+0x40/0x860 [ 1048.489527][T21744] ? __pfx_path_openat+0x10/0x10 [ 1048.489538][T21744] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1048.489553][T21744] do_filp_open+0x1fa/0x410 [ 1048.489564][T21744] ? __lock_acquire+0xab9/0xd20 [ 1048.489579][T21744] ? __pfx_do_filp_open+0x10/0x10 [ 1048.489595][T21744] ? _raw_spin_unlock+0x28/0x50 [ 1048.489605][T21744] ? alloc_fd+0x64c/0x6c0 [ 1048.489621][T21744] do_sys_openat2+0x121/0x1c0 [ 1048.489633][T21744] ? __pfx_do_sys_openat2+0x10/0x10 [ 1048.489644][T21744] ? exc_page_fault+0x76/0xf0 [ 1048.489655][T21744] ? do_user_addr_fault+0xc8a/0x1390 [ 1048.489672][T21744] __x64_sys_openat+0x138/0x170 [ 1048.489684][T21744] do_syscall_64+0xfa/0x3b0 [ 1048.489695][T21744] ? lockdep_hardirqs_on+0x9c/0x150 [ 1048.489705][T21744] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1048.489715][T21744] ? clear_bhb_loop+0x60/0xb0 [ 1048.489726][T21744] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1048.489746][T21744] RIP: 0033:0x7f45874a7407 [ 1048.489764][T21744] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1048.489782][T21744] RSP: 002b:00007ffe8c8794f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1048.489802][T21744] RAX: ffffffffffffffda RBX: 00007f4587b74880 RCX: 00007f45874a7407 [ 1048.489817][T21744] RDX: 0000000000000000 RSI: 00007ffe8c879f1b RDI: ffffffffffffff9c [ 1048.489831][T21744] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1048.489842][T21744] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1048.489850][T21744] R13: 00007ffe8c879740 R14: 00007f4587c79000 R15: 000055fd475fb4d8 [ 1048.489861][T21744] [ 1048.489866][T21744] [ 1048.797121][T21744] Allocated by task 18689: [ 1048.801518][T21744] kasan_save_track+0x3e/0x80 [ 1048.806191][T21744] __kasan_kmalloc+0x93/0xb0 [ 1048.810772][T21744] __kmalloc_cache_noprof+0x230/0x3d0 [ 1048.816138][T21744] em28xx_v4l2_init+0x10b/0x2e70 [ 1048.821068][T21744] em28xx_init_extension+0x11d/0x1c0 [ 1048.826339][T21744] process_scheduled_works+0xae1/0x17b0 [ 1048.831867][T21744] worker_thread+0x8a0/0xda0 [ 1048.836444][T21744] kthread+0x70e/0x8a0 [ 1048.840515][T21744] ret_from_fork+0x439/0x7d0 [ 1048.845109][T21744] ret_from_fork_asm+0x1a/0x30 [ 1048.849962][T21744] [ 1048.852272][T21744] Freed by task 18689: [ 1048.856321][T21744] kasan_save_track+0x3e/0x80 [ 1048.860988][T21744] kasan_save_free_info+0x46/0x50 [ 1048.865999][T21744] __kasan_slab_free+0x5b/0x80 [ 1048.870756][T21744] kfree+0x18e/0x440 [ 1048.874645][T21744] em28xx_v4l2_init+0x1683/0x2e70 [ 1048.879661][T21744] em28xx_init_extension+0x11d/0x1c0 [ 1048.884938][T21744] process_scheduled_works+0xae1/0x17b0 [ 1048.890467][T21744] worker_thread+0x8a0/0xda0 [ 1048.895042][T21744] kthread+0x70e/0x8a0 [ 1048.899107][T21744] ret_from_fork+0x439/0x7d0 [ 1048.903687][T21744] ret_from_fork_asm+0x1a/0x30 [ 1048.908447][T21744] [ 1048.910756][T21744] The buggy address belongs to the object at ffff88807ceac000 [ 1048.910756][T21744] which belongs to the cache kmalloc-8k of size 8192 [ 1048.924791][T21744] The buggy address is located 1856 bytes inside of [ 1048.924791][T21744] freed 8192-byte region [ffff88807ceac000, ffff88807ceae000) [ 1048.938747][T21744] [ 1048.941057][T21744] The buggy address belongs to the physical page: [ 1048.947458][T21744] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7cea8 [ 1048.956207][T21744] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1048.964710][T21744] ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1048.972588][T21744] page_type: f5(slab) [ 1048.976560][T21744] raw: 00fff00000000040 ffff88801a442280 ffffea00011d5c00 dead000000000003 [ 1048.985131][T21744] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 1048.993705][T21744] head: 00fff00000000040 ffff88801a442280 ffffea00011d5c00 dead000000000003 [ 1049.002363][T21744] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 1049.011018][T21744] head: 00fff00000000003 ffffea0001f3aa01 00000000ffffffff 00000000ffffffff [ 1049.019770][T21744] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1049.028420][T21744] page dumped because: kasan: bad access detected [ 1049.034814][T21744] page_owner tracks the page as allocated [ 1049.040531][T21744] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x528c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP), pid 17258, tgid 17258 (syz-executor), ts 791353124528, free_ts 791346384328 [ 1049.060577][T21744] post_alloc_hook+0x240/0x2a0 [ 1049.065341][T21744] get_page_from_freelist+0x21e4/0x22c0 [ 1049.070873][T21744] __alloc_frozen_pages_noprof+0x181/0x370 [ 1049.076660][T21744] alloc_pages_mpol+0x232/0x4a0 [ 1049.081503][T21744] allocate_slab+0x8a/0x370 [ 1049.085995][T21744] ___slab_alloc+0xbeb/0x1420 [ 1049.090667][T21744] __kvmalloc_node_noprof+0x429/0x5f0 [ 1049.096029][T21744] pfifo_fast_init+0x363/0x6b0 [ 1049.100775][T21744] qdisc_create_dflt+0x138/0x4e0 [ 1049.105694][T21744] dev_activate+0x378/0x1150 [ 1049.110537][T21744] __dev_open+0x69c/0x880 [ 1049.114850][T21744] __dev_change_flags+0x1ea/0x6d0 [ 1049.119866][T21744] netif_change_flags+0x88/0x1a0 [ 1049.124790][T21744] do_setlink+0xc55/0x41c0 [ 1049.129194][T21744] rtnl_newlink+0x160b/0x1c70 [ 1049.133858][T21744] rtnetlink_rcv_msg+0x7cf/0xb70 [ 1049.138787][T21744] page last free pid 5853 tgid 5853 stack trace: [ 1049.145095][T21744] __free_frozen_pages+0xbc4/0xd30 [ 1049.150202][T21744] __slab_free+0x303/0x3c0 [ 1049.154608][T21744] qlist_free_all+0x97/0x140 [ 1049.159187][T21744] kasan_quarantine_reduce+0x148/0x160 [ 1049.164633][T21744] __kasan_slab_alloc+0x22/0x80 [ 1049.169474][T21744] kmem_cache_alloc_node_noprof+0x1bb/0x3c0 [ 1049.175360][T21744] __alloc_skb+0x112/0x2d0 [ 1049.179764][T21744] tcp_stream_alloc_skb+0x3d/0x340 [ 1049.184869][T21744] tcp_sendmsg_locked+0xf38/0x5620 [ 1049.189973][T21744] tcp_sendmsg+0x2f/0x50 [ 1049.194205][T21744] __sock_sendmsg+0x19c/0x270 [ 1049.198884][T21744] sock_write_iter+0x258/0x330 [ 1049.203639][T21744] vfs_write+0x5c9/0xb30 [ 1049.207870][T21744] ksys_write+0x145/0x250 [ 1049.212190][T21744] do_syscall_64+0xfa/0x3b0 [ 1049.216678][T21744] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1049.222556][T21744] [ 1049.224867][T21744] Memory state around the buggy address: [ 1049.230568][T21744] ffff88807ceac600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1049.238617][T21744] ffff88807ceac680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1049.246662][T21744] >ffff88807ceac700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1049.254704][T21744] ^ [ 1049.260843][T21744] ffff88807ceac780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1049.268891][T21744] ffff88807ceac800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1049.276934][T21744] ================================================================== [ 1049.298138][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1049.404003][T18689] em28xx 5-1:0.89: Remote control support is not available for this card. [ 1049.417969][ T6027] em28xx 5-1:0.89: Closing input extension [ 1049.425537][ T6027] em28xx 5-1:0.89: Deregistering snapshot button [ 1049.432861][T21744] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1049.440050][T21744] CPU: 1 UID: 0 PID: 21744 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 1049.449055][T21744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1049.459134][T21744] Call Trace: [ 1049.462416][T21744] [ 1049.465332][T21744] dump_stack_lvl+0x99/0x250 [ 1049.469909][T21744] ? __asan_memcpy+0x40/0x70 [ 1049.474487][T21744] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1049.479665][T21744] ? __pfx__printk+0x10/0x10 [ 1049.484242][T21744] vpanic+0x281/0x750 [ 1049.488205][T21744] ? rcu_is_watching+0x15/0xb0 [ 1049.492969][T21744] ? __pfx_vpanic+0x10/0x10 [ 1049.497451][T21744] ? preempt_schedule_irq+0xde/0x150 [ 1049.502716][T21744] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 1049.508417][T21744] ? preempt_schedule+0xae/0xc0 [ 1049.513255][T21744] ? __pfx_preempt_schedule+0x10/0x10 [ 1049.518628][T21744] panic+0xb9/0xc0 [ 1049.522396][T21744] ? __pfx_panic+0x10/0x10 [ 1049.526887][T21744] ? __pfx_panic+0x10/0x10 [ 1049.531293][T21744] ? v4l2_fh_open+0xc7/0x430 [ 1049.535885][T21744] check_panic_on_warn+0x89/0xb0 [ 1049.540825][T21744] ? v4l2_fh_open+0xc7/0x430 [ 1049.545412][T21744] end_report+0x78/0x160 [ 1049.549646][T21744] kasan_report+0x129/0x150 [ 1049.554151][T21744] ? v4l2_fh_open+0xc7/0x430 [ 1049.558738][T21744] v4l2_fh_open+0xc7/0x430 [ 1049.563155][T21744] em28xx_v4l2_open+0x157/0x9a0 [ 1049.568004][T21744] v4l2_open+0x20c/0x360 [ 1049.572237][T21744] chrdev_open+0x4c9/0x5e0 [ 1049.576672][T21744] ? __pfx_chrdev_open+0x10/0x10 [ 1049.581597][T21744] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 1049.587931][T21744] ? __pfx_chrdev_open+0x10/0x10 [ 1049.592869][T21744] do_dentry_open+0x950/0x13f0 [ 1049.597626][T21744] vfs_open+0x3b/0x340 [ 1049.601678][T21744] ? path_openat+0x2ecd/0x3830 [ 1049.606436][T21744] path_openat+0x2ee5/0x3830 [ 1049.611025][T21744] ? arch_stack_walk+0xfc/0x150 [ 1049.615896][T21744] ? stack_depot_save_flags+0x40/0x860 [ 1049.621351][T21744] ? __pfx_path_openat+0x10/0x10 [ 1049.626295][T21744] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1049.632344][T21744] do_filp_open+0x1fa/0x410 [ 1049.636827][T21744] ? __lock_acquire+0xab9/0xd20 [ 1049.641666][T21744] ? __pfx_do_filp_open+0x10/0x10 [ 1049.646692][T21744] ? _raw_spin_unlock+0x28/0x50 [ 1049.651522][T21744] ? alloc_fd+0x64c/0x6c0 [ 1049.655864][T21744] do_sys_openat2+0x121/0x1c0 [ 1049.660522][T21744] ? __pfx_do_sys_openat2+0x10/0x10 [ 1049.665700][T21744] ? exc_page_fault+0x76/0xf0 [ 1049.670365][T21744] ? do_user_addr_fault+0xc8a/0x1390 [ 1049.675745][T21744] __x64_sys_openat+0x138/0x170 [ 1049.680598][T21744] do_syscall_64+0xfa/0x3b0 [ 1049.685084][T21744] ? lockdep_hardirqs_on+0x9c/0x150 [ 1049.690277][T21744] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1049.696339][T21744] ? clear_bhb_loop+0x60/0xb0 [ 1049.700997][T21744] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1049.706869][T21744] RIP: 0033:0x7f45874a7407 [ 1049.711273][T21744] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1049.730950][T21744] RSP: 002b:00007ffe8c8794f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1049.739353][T21744] RAX: ffffffffffffffda RBX: 00007f4587b74880 RCX: 00007f45874a7407 [ 1049.747326][T21744] RDX: 0000000000000000 RSI: 00007ffe8c879f1b RDI: ffffffffffffff9c [ 1049.755290][T21744] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1049.763251][T21744] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1049.771207][T21744] R13: 00007ffe8c879740 R14: 00007f4587c79000 R15: 000055fd475fb4d8 [ 1049.779168][T21744] [ 1049.782494][T21744] Kernel Offset: disabled [ 1049.786799][T21744] Rebooting in 86400 seconds..