last executing test programs: 25m16.09065016s ago: executing program 2 (id=6): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000011c0)=ANY=[@ANYBLOB="12010001090003206d0414c340000000000109022400010000a00009040000010301010009210008000122030009", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, &(0x7f0000001180)=ANY=[@ANYBLOB="00020c0000"], 0x0, 0x0, 0x0}, 0x0) 25m13.756679666s ago: executing program 2 (id=8): r0 = add_key$user(&(0x7f0000000440), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000240)="8b", 0x1, 0xfffffffffffffffb) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = add_key$user(&(0x7f0000002300), &(0x7f0000002340)={'syz', 0x3}, &(0x7f0000000100)="370c099069effa43de3e1404db09b4ce1ef77bde4b371532dd16447c1b13403656c86711f6e750026f23029a50d44299c7bf5c78dc5efae2d041016160e8bef7b30c05e298aa9572540dd950307987eef2115e1bcf512bea3410ca5a9e9f827e4b13490dbbd4fc5a45e0738b959acafd2c12863045265bcbc2c9426ac3f614746b436fe86a72dc642dd67d970604a69b4f22cd0076beedc18056ab4bea4c825b69a7a77adcd5488684872b1bb9eb84586549e11b080468668e8fd0e52ce070", 0xbf, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000000)={r0, r4, r0}, &(0x7f00000005c0)=""/208, 0xd0, &(0x7f0000000580)={&(0x7f0000000340)={'md5\x00'}}) 25m11.359111137s ago: executing program 2 (id=10): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x48c00, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = add_key$fscrypt_provisioning(&(0x7f0000000000), &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000400)=ANY=[@ANYBLOB="0500000000000000353913278ed4d4448683d74781d0907a9b1a059c5965be78270718c019f418b4e56d814b4ca3a757fd904b0031cd85a202f6a74a1873fce863f427902852edff7b7e7a1a90312aa28411abe2b4bfa643524ab863f8bee1163d8511cce4da"], 0xb, 0xfffffffffffffffa) keyctl$instantiate_iov(0x14, r1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x7000000) r3 = socket$pptp(0x18, 0x1, 0x2) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, 0x0, 0x0) bind$pptp(r3, &(0x7f0000000000)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r3, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, 0x0) socket(0x22, 0x2, 0x4) ioctl$BTRFS_IOC_DEV_INFO(0xffffffffffffffff, 0xd000941e, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) mount$fuseblk(&(0x7f0000002440), &(0x7f0000000000)='./file0\x00', &(0x7f00000003c0), 0x200c40c, &(0x7f0000002340)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x2000}}) 25m4.956482608s ago: executing program 2 (id=16): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) connect$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) 24m55.944596245s ago: executing program 2 (id=25): syz_usb_connect(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) r0 = io_uring_setup(0x6d62, &(0x7f00000000c0)={0x0, 0x5d21, 0x0, 0x0, 0x26a}) mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x10000000) syz_io_uring_setup(0x10a, &(0x7f0000000140)={0x0, 0x5803, 0x0, 0x0, 0xfffffdfc}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0) listen(0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a00000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r4, @ANYRES32=r3], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r4, &(0x7f00000047c0), &(0x7f0000004880)=@udp}, 0x20) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000040)=0x7f, 0x4) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000000)=0x9, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x3, 0x0, 0x0}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x18) 24m50.766291227s ago: executing program 2 (id=35): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) writev(r2, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\a\x00\x00B\x00'], 0xfe33) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(0xffffffffffffffff, 0x0, 0x90) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000500)={0x0, 0xb390}, &(0x7f0000000540)=0x8) syz_open_procfs(0xffffffffffffffff, 0x0) timer_create(0x3, 0x0, &(0x7f00000000c0)) r3 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r3, 0x80045505, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(r3, 0x80045505, &(0x7f0000000000)=0x1) 24m32.778680174s ago: executing program 32 (id=35): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) writev(r2, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\a\x00\x00B\x00'], 0xfe33) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(0xffffffffffffffff, 0x0, 0x90) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000500)={0x0, 0xb390}, &(0x7f0000000540)=0x8) syz_open_procfs(0xffffffffffffffff, 0x0) timer_create(0x3, 0x0, &(0x7f00000000c0)) r3 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r3, 0x80045505, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(r3, 0x80045505, &(0x7f0000000000)=0x1) 23m33.716679543s ago: executing program 1 (id=125): bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x7, 0x0, 0x0) syz_emit_vhci(&(0x7f00000000c0)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x1, 0x0, 0x4}}, 0x9) preadv(0xffffffffffffffff, &(0x7f0000004ec0), 0x0, 0x8000, 0x0) socket$inet6(0xa, 0x3, 0xff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0xfffffffd) r3 = accept4(r2, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xc, 0x0, &(0x7f0000000000)) recvmmsg(r3, &(0x7f0000001000), 0x581, 0x4000001f, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f00000002c0)={0x3, 0x1, 0x2, 0xff, 0xa4, 0x0, 0x1, 0x0, 0x5, 0xa, 0x81, 0x0, 0x2, 0x20}, 0xe) r4 = bpf$ITER_CREATE(0x21, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={'veth0_to_hsr\x00', {0x2, 0x4e21, @empty}}) writev(0xffffffffffffffff, 0x0, 0x0) fsetxattr$trusted_overlay_redirect(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x3, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_rsp={{0x15, 0x5, 0xa}, {0x4, 0x2, 0x5, 0x1, 0x1}}}}, 0x17) 23m29.222276821s ago: executing program 1 (id=132): bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x7, 0x0, 0x0) syz_emit_vhci(&(0x7f00000000c0)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x1, 0x0, 0x4}}, 0x9) preadv(0xffffffffffffffff, &(0x7f0000004ec0), 0x0, 0x8000, 0x0) socket$inet6(0xa, 0x3, 0xff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0xfffffffd) r3 = accept4(r2, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xc, 0x0, &(0x7f0000000000)) recvmmsg(r3, &(0x7f0000001000), 0x581, 0x4000001f, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, 0x0, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r2, 0x0, 0x82, &(0x7f0000000240)={'nat\x00', 0x0, 0x0, 0x0, [0x0, 0x1ff, 0x7f, 0x81, 0x4, 0xde1]}, 0x0) bpf$ITER_CREATE(0x21, 0x0, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={'veth0_to_hsr\x00', {0x2, 0x4e21, @empty}}) r4 = socket$netlink(0x10, 0x3, 0x0) writev(r4, 0x0, 0x0) fsetxattr$trusted_overlay_redirect(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x3, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_rsp={{0x15, 0x5, 0xa}, {0x4, 0x2, 0x5, 0x1, 0x1}}}}, 0x17) 23m28.306613947s ago: executing program 1 (id=136): bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x7, 0x0, 0x0) syz_emit_vhci(&(0x7f00000000c0)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x1, 0x0, 0x4}}, 0x9) socket$inet6(0xa, 0x3, 0xff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0xfffffffd) r3 = accept4(r2, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xc, 0x0, &(0x7f0000000000)) recvmmsg(r3, &(0x7f0000001000), 0x581, 0x4000001f, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f00000002c0)={0x3, 0x1, 0x2, 0xff, 0xa4, 0x0, 0x1, 0x0, 0x5, 0xa, 0x81, 0x0, 0x2, 0x20}, 0xe) r4 = bpf$ITER_CREATE(0x21, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={'veth0_to_hsr\x00', {0x2, 0x4e21, @empty}}) writev(0xffffffffffffffff, 0x0, 0x0) fsetxattr$trusted_overlay_redirect(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x3, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_rsp={{0x15, 0x5, 0xa}, {0x4, 0x2, 0x5, 0x1, 0x1}}}}, 0x17) 23m18.677270219s ago: executing program 1 (id=147): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0x3) ioctl$TCFLSH(r2, 0x80047437, 0x10004000000006) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="98000000", @ANYRES16=r1, @ANYBLOB="010025bd7000000000003900000008000300", @ANYRES32=r3, @ANYBLOB="7c005a800c000080050006000000"], 0x98}, 0x1, 0x0, 0x0, 0x4000801}, 0x10) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x14, 0x2c, 0x107, 0x70bd2b, 0x25dfdbff, {0x7, 0x7c}}, 0x14}}, 0xc010) r6 = accept$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs, &(0x7f0000000140)=0x6e) connect$unix(r6, &(0x7f00000002c0)=@file={0x1, './file0\x00'}, 0x6e) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) syz_usb_ep_write(r4, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r4, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r4, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') 23m11.14902962s ago: executing program 1 (id=149): syz_usb_connect(0x2, 0x4a, &(0x7f0000000000)=ANY=[], 0x0) 23m7.285539674s ago: executing program 1 (id=157): sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, 0x0, 0x20008800) add_key$user(0x0, 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) r0 = socket$rxrpc(0x21, 0x2, 0xa) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x11) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bind$rxrpc(r0, &(0x7f0000000000)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0x100, @mcast1, 0xffffffff}}, 0x24) r3 = syz_io_uring_setup(0x10a, &(0x7f0000000140)={0x0, 0x5883, 0x0, 0x0, 0xfffffdfc}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x3, 0x0, 0x0}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) 22m51.808582617s ago: executing program 33 (id=157): sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, 0x0, 0x20008800) add_key$user(0x0, 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) r0 = socket$rxrpc(0x21, 0x2, 0xa) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x11) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bind$rxrpc(r0, &(0x7f0000000000)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0x100, @mcast1, 0xffffffff}}, 0x24) r3 = syz_io_uring_setup(0x10a, &(0x7f0000000140)={0x0, 0x5883, 0x0, 0x0, 0xfffffdfc}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x3, 0x0, 0x0}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) 14m36.470462708s ago: executing program 0 (id=1322): syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, 0x0}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x36900, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000100)={0x0, 0xaaa, 0x0, 0x0}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cb, 0x0, 0xa1d, 0x68ff, 0x5, 0x0, 0x3, 0xa], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 14m35.331175416s ago: executing program 0 (id=1326): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=@newlink={0x54, 0x10, 0x1, 0x70bd27, 0xa5dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x64e10, 0x16201}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0x1c, 0x5, 0x0, 0x1, [@IFLA_BRPORT_PRIORITY={0x6, 0x2, 0x1}, @IFLA_BRPORT_MULTICAST_ROUTER={0x5}, @IFLA_BRPORT_BACKUP_PORT={0x8}]}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x404c000}, 0x2) 14m34.867488747s ago: executing program 0 (id=1331): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x5}) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000000000000002"]) eventfd2(0x0, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000100)=ANY=[]) 14m34.524306134s ago: executing program 0 (id=1333): socket$inet6(0xa, 0x3, 0x5) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x5, 0xb, &(0x7f0000000540)=ANY=[@ANYRES32=0x0, @ANYRESOCT, @ANYRESOCT, @ANYRES16, @ANYRES32=0x0, @ANYRES8=r0], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)=ANY=[@ANYBLOB='P\x00', @ANYRES16=r2, @ANYBLOB="010000000000fbfbdf25270000000e0001006e655f64657673696d0000000f0002006e657464657673696d3000001c0053"], 0x50}, 0x1, 0x0, 0x0, 0x24040011}, 0x0) 14m33.757272353s ago: executing program 0 (id=1335): syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}]}, &(0x7f00000002c0)=0x10) socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0xf0b, 0xfffffffe, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff3, 0x6}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x14, 0x2, [@TCA_PIE_BYTEMODE={0x8}, @TCA_PIE_BYTEMODE={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40400c4}, 0x0) r7 = accept4(r2, 0x0, 0x0, 0x0) sendmmsg$alg(r7, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3", 0x8}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x1, 0x0) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x20000253) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x1, 0x100001, 0x5, 0x5, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, 0x0, &(0x7f0000000040), 0xffffff01, r8}, 0x38) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r8, &(0x7f0000000340), &(0x7f0000000000)=""/27}, 0x20) 14m30.68943414s ago: executing program 0 (id=1347): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe8000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fec000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000fed000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) fsopen(&(0x7f0000000040)='ubifs\x00', 0x1) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff5000/0x1000)=nil, 0x1000, &(0x7f0000002d80)='\x00') r0 = socket(0x15, 0x4, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000003bc0)={&(0x7f00000015c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000003b80)={&(0x7f0000003640)=ANY=[@ANYBLOB="140000002900010027bd6000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000180)=0x1, 0x4) r4 = landlock_create_ruleset(&(0x7f0000000140)={0x40a1, 0x3, 0x3}, 0x18, 0x2) landlock_restrict_self(r4, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket$kcm(0x29, 0x2, 0x0) close(r5) r6 = socket$kcm(0x2b, 0x1, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/tcp\x00') close(r6) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000001340), 0x101200, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r7, 0xc01064c1, &(0x7f00000013c0)) ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) 14m15.616640899s ago: executing program 34 (id=1347): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe8000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fec000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000fed000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) fsopen(&(0x7f0000000040)='ubifs\x00', 0x1) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff5000/0x1000)=nil, 0x1000, &(0x7f0000002d80)='\x00') r0 = socket(0x15, 0x4, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000003bc0)={&(0x7f00000015c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000003b80)={&(0x7f0000003640)=ANY=[@ANYBLOB="140000002900010027bd6000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000180)=0x1, 0x4) r4 = landlock_create_ruleset(&(0x7f0000000140)={0x40a1, 0x3, 0x3}, 0x18, 0x2) landlock_restrict_self(r4, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket$kcm(0x29, 0x2, 0x0) close(r5) r6 = socket$kcm(0x2b, 0x1, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/tcp\x00') close(r6) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000001340), 0x101200, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r7, 0xc01064c1, &(0x7f00000013c0)) ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) 11.760538836s ago: executing program 5 (id=3232): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffa}}, @hoplimit={{0x14}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @rthdr_2292={{0x38, 0x29, 0x39, {0x3a, 0x4, 0x2, 0x70, 0x0, [@mcast1, @mcast2]}}}], 0x98}}], 0x1, 0x810) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000700)="ec76b3b81f8baf", 0x7}], 0x2}}], 0x1, 0x404c041) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) openat$incfs(r2, &(0x7f00000002c0)='.pending_reads\x00', 0x80, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000780)={0xa0, 0xfffffffffffffff5, 0x0, {{0x2, 0x0, 0xffffffffffffffff, 0x7, 0x8000, 0x5, {0x5, 0x924, 0xf74, 0x9, 0xd5fe, 0x9, 0x8, 0x0, 0x0, 0x6000, 0x5ae9, r3, 0x0, 0x1ff, 0x3}}, {0x0, 0x2}}}, 0xa0) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 11.634768145s ago: executing program 5 (id=3233): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)}}], 0x1, 0x810) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000700)="ec76b3b8", 0x4}], 0x1}}], 0x1, 0x404c041) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b000000080003", @ANYRES32=r4, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 11.485769946s ago: executing program 5 (id=3235): socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0x2b, 0x1, 0x0) syz_io_uring_setup(0x6dbf, &(0x7f0000000200)={0x0, 0xa439, 0x80, 0x2, 0x1f1}, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000180), 0xfea7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="00008000", @ANYRES16, @ANYBLOB="2d01620000000900509072fb60cb080003"], 0x2c}}, 0x4000) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r5, @ANYBLOB="ff830500000700ffffff", @ANYRES8=r0], 0x4}}, 0x20008000) sendfile(r4, r3, 0x0, 0x100000002) 11.177849036s ago: executing program 5 (id=3238): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @rthdr_2292={{0x38, 0x29, 0x39, {0x3a, 0x4, 0x2, 0x70, 0x0, [@mcast1, @mcast2]}}}], 0x68}}], 0x1, 0x810) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000700)="ec76b3b81f8baf00b118df1ac0", 0xd}], 0x2}}], 0x1, 0x404c041) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) quotactl$Q_SETQUOTA(0xffffffff80000802, 0x0, r3, &(0x7f0000000080)={0x2002, 0x6, 0x0, 0x6, 0x8000000000000001, 0xfffffffffffffffe, 0x6, 0xfffffffffffffffe, 0xffffb291}) openat$incfs(r2, &(0x7f00000002c0)='.pending_reads\x00', 0x80, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000780)={0xa0, 0xfffffffffffffff5, 0x0, {{0x2, 0x0, 0xffffffffffffffff, 0x7, 0x8000, 0x5, {0x5, 0x924, 0xf74, 0x9, 0xd5fe, 0x9, 0x8, 0x0, 0x0, 0x6000, 0x5ae9, r3, 0x0, 0x1ff, 0x3}}, {0x0, 0x2}}}, 0xa0) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 10.556195838s ago: executing program 5 (id=3243): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffa}}, @hoplimit={{0x14}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @rthdr_2292={{0x38, 0x29, 0x39, {0x3a, 0x4, 0x2, 0x70, 0x0, [@mcast1, @mcast2]}}}], 0x98}}], 0x1, 0x810) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000030c0)=ANY=[], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0x10, 0x0, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847fe", 0x0, 0x71, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = accept4(r0, 0x0, 0x0, 0x800) quotactl$Q_SETQUOTA(0xffffffff80000802, 0x0, 0x0, &(0x7f0000000080)={0x2002, 0x6, 0x0, 0x6, 0x8000000000000001, 0xfffffffffffffffe, 0x6, 0xfffffffffffffffe, 0xffffb291}) openat$incfs(0xffffffffffffffff, &(0x7f00000002c0)='.pending_reads\x00', 0x80, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000780)={0xa0, 0xfffffffffffffff5, 0x0, {{0x2, 0x0, 0xffffffffffffffff, 0x7, 0x8000, 0x5, {0x5, 0x924, 0xf74, 0x9, 0xd5fe, 0x9, 0x8, 0x0, 0x0, 0x6000, 0x5ae9, 0x0, 0x0, 0x1ff, 0x3}}, {0x0, 0x2}}}, 0xa0) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 9.263108779s ago: executing program 5 (id=3247): openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) mprotect(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x80001a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x303, &(0x7f0000000380)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@mpls_mc={0x8848, {[], @ipv6=@udp={0x3, 0x6, "f40104", 0x2cd, 0x11, 0x1, @dev={0xfe, 0x80, '\x00', 0x24}, @dev={0xfe, 0x80, '\x00', 0x19}, {[@hopopts={0x2f, 0x1e, '\x00', [@pad1, @hao={0xc9, 0x10, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @padn={0x1, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @generic={0x8, 0xd7, "329607021b1f7cb6cebab45335e8d3cf96e28651b19637b5a2a0781b88a1ab897b9b09feb29e28aa8a33cf6d4e0809ecee7656a74116b038d12e606516cd83a01f0a14c538e6d92d95d377cedcb08eb273111e0614b1f186a04de4a9ef1a9f817826a05bb8bc3ea805363ac5ff91286af3e4254d2eeac6a7d1a3697c439bcdb21d61532f1fd43c2a2fece380683daefb207c852c1065865d3b79c655e6aa86a0cc6649db80648a677fe37d82cce63e7aed5180d8cd08c8eafc08b5c232d8d6c399beab91d0a13a336c6b23b4d839bc65814c7b7a6f036e"}]}, @dstopts={0x2f, 0x5, '\x00', [@calipso={0x7, 0x28, {0x0, 0x8, 0x1, 0x4, [0x4, 0xfff, 0x7, 0x5]}}]}, @srh={0x37, 0x14, 0x4, 0xa, 0x7, 0x48, 0xf2f, [@loopback, @mcast1, @mcast2, @private0, @loopback, @dev={0xfe, 0x80, '\x00', 0x31}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @local, @ipv4={'\x00', '\xff\xff', @remote}, @empty]}, @fragment={0x6, 0x0, 0x8, 0x1, 0x0, 0xc, 0x64}, @srh={0x29, 0x4, 0x4, 0x2, 0x40, 0x10, 0x3, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2]}, @dstopts={0x1, 0x0, '\x00', [@jumbo={0xc2, 0x4, 0x5}]}, @routing={0x1d, 0xc, 0x2, 0x10, 0x0, [@local, @empty, @mcast2, @ipv4={'\x00', '\xff\xff', @empty}, @remote, @empty]}], {0x4e24, 0x4e22, 0x45, 0x0, @gue={{0x1, 0x0, 0x0, 0x9b, 0x0, @void}, "0d89fe8afe72250bf45e87ce7e83074a15c8c99419053eb97d1b4dca17eb2bc140e3574df10f056ff64a3c6830ee4a27cf96db2d5b9a2da70d"}}}}}}}}, &(0x7f0000000000)={0x0, 0x3, [0xa90, 0xa13, 0x4a9, 0xffd]}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) exit(0x100000001) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0xd, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x7, 0x0, 0x0, 0x41000}, 0x94) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x58) 8.239313467s ago: executing program 7 (id=3259): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000800"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000440)='blkio.bfq.io_serviced_recursive\x00', 0x0, 0x0) preadv2(r6, &(0x7f0000000040)=[{&(0x7f0000000100)=""/65, 0x41}], 0x1, 0x2, 0x0, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELOBJ={0x34, 0x14, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x2}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0xa}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x1}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}]}]}], {0x14}}, 0xbc}}, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000040)='syscall\x00') r9 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {'wfdno', 0x3d, r8}}) 6.820285745s ago: executing program 7 (id=3265): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffa}}, @hoplimit={{0x14}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}], 0x60}}], 0x1, 0x810) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000700)="ec76b3b81f8baf00b118df1ac0", 0xd}], 0x2}}], 0x1, 0x404c041) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000030c0)=ANY=[@ANYBLOB], &(0x7f0000000340)='syzkaller\x00'}, 0x94) r1 = accept4(r0, 0x0, 0x0, 0x800) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000780)={0xa0, 0xfffffffffffffff5, 0x0, {{0x2, 0x0, 0xffffffffffffffff, 0x7, 0x8000, 0x5, {0x5, 0x924, 0xf74, 0x9, 0xd5fe, 0x9, 0x8, 0x0, 0x0, 0x6000, 0x5ae9, 0x0, 0x0, 0x1ff, 0x3}}, {0x0, 0x2}}}, 0xa0) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 6.48553763s ago: executing program 7 (id=3267): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_TABLE(r0, 0x29, 0xcf, &(0x7f0000000100)=0xffffffff, 0x4) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/address_bits', 0x395180, 0x149) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r4, 0xc1205531, &(0x7f0000000540)={0x1, 0x1, 0x0, 0x5, '\x00', '\x00', '\x00', 0x0, 0x0, 0x9, 0x0, "b6855a32474ffa64f778ddcf29c94337"}) r5 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) r6 = add_key$keyring(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0, r5) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, &(0x7f0000000600)='.dead\x00', &(0x7f0000000640)=@keyring={'key_or_keyring:', r5}) connect$netrom(r1, &(0x7f0000000300)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) sendto$netrom(r1, 0x0, 0x0, 0x40, &(0x7f0000000000)={{0x6, @null}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @null, @default]}, 0x48) 6.347075995s ago: executing program 4 (id=3268): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f00000000c0), 0x2, 0x0) r2 = openat$cgroup_procs(r0, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000180), 0x12) write$cgroup_freezer_state(r1, &(0x7f0000000200)='THAWED\x00', 0x7) (fail_nth: 1) 5.618918094s ago: executing program 4 (id=3271): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000800"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000440)='blkio.bfq.io_serviced_recursive\x00', 0x0, 0x0) preadv2(r6, &(0x7f0000000040)=[{&(0x7f0000000100)=""/65, 0x41}], 0x1, 0x2, 0x0, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELOBJ={0x34, 0x14, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x2}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0xa}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x1}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}]}]}], {0x14}}, 0xbc}}, 0x0) syz_emit_ethernet(0x46, &(0x7f00000004c0)=ANY=[@ANYBLOB="0180c200000000000800000086dd6005010000101100fe8000000000000700000000000000bbfe8000000000000000000000000000aa00030e220010907802030000000000000dc2ce44e72a42b97d4b6bfe869956403c6b7fbb2728554ea9075fb01b2ec908eac2613602c12ae9d7be177660eebe99d1c4e5e4809ffe52"], 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000040)='syscall\x00') r9 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {'wfdno', 0x3d, r8}}) 3.74932574s ago: executing program 4 (id=3277): syz_usb_connect(0x2, 0x35, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000545e0d209904b76b2f680102030109022300010000c0050904970001ff70790008244201210126ff0905850308"], 0x0) r0 = socket(0x15, 0x5, 0x0) r1 = socket$l2tp(0x2, 0x2, 0x73) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000019180), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000191c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(r0, &(0x7f0000019300)={&(0x7f0000019140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000192c0)={&(0x7f0000019200)={0x88, r2, 0x2, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x271, 0x19}}}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x69}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x4a}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x57}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x7f}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x3f}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x1a}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x1e}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x59}]}, 0x88}, 0x1, 0x0, 0x0, 0x80}, 0x4042810) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=@newlink={0x50, 0x10, 0x1, 0x1070bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8380}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_VFINFO_LIST={0x1c, 0x16, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x8, 0xe955}}]}]}]}, 0x50}}, 0x0) connect(r1, &(0x7f00000000c0)=@in={0x2, 0x4e23, @loopback}, 0x80) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000000c0)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_ctinfo={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18, 0x3, {0x0, 0x1, 0xffffffffffffffff, 0x100}}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x440c0}, 0x8000) socketpair(0x2a, 0x2, 0x84d, &(0x7f0000000080)) getsockopt(r5, 0x2000c, 0x7, &(0x7f0000000140)=""/102385, &(0x7f0000000040)=0x18ff1) 3.310481955s ago: executing program 3 (id=3280): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffa}}, @hoplimit={{0x14}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @rthdr_2292={{0x38, 0x29, 0x39, {0x3a, 0x4, 0x2, 0x70, 0x0, [@mcast1, @mcast2]}}}], 0x98}}], 0x1, 0x810) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000700)="ec76b3b81f8baf00b118df1ac0", 0xd}], 0x2}}], 0x1, 0x404c041) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000030c0)=ANY=[], 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0x10, 0x0, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847fe", 0x0, 0x71, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) quotactl$Q_SETQUOTA(0xffffffff80000802, 0x0, 0x0, &(0x7f0000000080)={0x2002, 0x6, 0x0, 0x6, 0x8000000000000001, 0xfffffffffffffffe, 0x6, 0xfffffffffffffffe, 0xffffb291}) openat$incfs(0xffffffffffffffff, &(0x7f00000002c0)='.pending_reads\x00', 0x80, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 3.011387158s ago: executing program 3 (id=3282): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xffffffffffffff2c}, 0x68) io_uring_setup(0x1c8e, &(0x7f0000000040)={0x0, 0xc8df, 0xc000, 0xa, 0x20002f3}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) syz_open_dev$usbfs(&(0x7f0000000000), 0x205, 0x44680) 1.962176261s ago: executing program 3 (id=3283): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffa}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @rthdr_2292={{0x38, 0x29, 0x39, {0x3a, 0x4, 0x2, 0x70, 0x0, [@mcast1, @mcast2]}}}], 0x80}}], 0x1, 0x810) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000700)="ec76b3b81f8baf00b118df1ac0", 0xd}], 0x2}}], 0x1, 0x404c041) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x20, 0x0, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847fe8847001211fd632f77fbac14141dac14", 0x0, 0x71, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) quotactl$Q_SETQUOTA(0xffffffff80000802, 0x0, r2, &(0x7f0000000080)={0x2002, 0x6, 0x0, 0x6, 0x8000000000000001, 0xfffffffffffffffe, 0x6, 0xfffffffffffffffe, 0xffffb291}) openat$incfs(r1, &(0x7f00000002c0)='.pending_reads\x00', 0x80, 0x0) sendmmsg$alg(r0, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 1.463709408s ago: executing program 3 (id=3286): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue1\x00', 0xff}) (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue1\x00', 0xff}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$mice(0xffffffffffffff9c, &(0x7f0000000180), 0x0) (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000180), 0x0) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) (async) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000180)={0xd2, @time={0x95}}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002b2000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') ioctl$IOMMU_TEST_OP_ACCESS_RW(r3, 0x3ba0, &(0x7f0000000500)={0x48, 0x8, r4, 0x0, 0x1, 0x0, 0x0, 0x1}) socket(0x28, 0x5, 0x28) (async) socket(0x28, 0x5, 0x28) setns(r1, 0x2000000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x1ff) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x1ff) 1.092623629s ago: executing program 7 (id=3288): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x88800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x51, {"0f20e035000082000f22e0f044835a000eb801000000c0725a0066b8a0000f00d8400f01c2c74424000000000066baf80cb81cc8f482ef66bafc0ced8ee00f011c24450f01df4d0fc7580d"}}], 0x69}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000"]) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000001c0)=[@enable_nested={0x12c, 0x18}], 0x18}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000001c0)={[0xfffffffffffffffb, 0x6, 0x0, 0x4, 0x10003, 0x0, 0x400200cc4, 0x5, 0x7d, 0x0, 0x0, 0x0, 0x2, 0x1, 0xb9, 0x8d], 0xeeee8000, 0x2011c0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.091981372s ago: executing program 6 (id=3289): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000240)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x8}}}}}, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000200)={@random="5b1a033f2511", @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0xfd, 0x11, 0x0, @empty=0x7f000000, @empty=0xe0000001}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x0, 0x0, "fdcdae25a7a296872a8a5290e48e30acf8afc7e67d70a62c979cefa10a0028bd", "ae0025aef0ad02b7e6b000", {"35f3c07e0500a2ab3d58ac1500", "63081fe8fe001a08ed082ad7121d696f"}}}}}}}, 0x0) (fail_nth: 1) 962.540031ms ago: executing program 6 (id=3290): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000700)="ec76b3b81f8baf00b118df1ac0", 0xd}], 0x2}}], 0x1, 0x404c041) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000030c0)=ANY=[@ANYBLOB], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0x20, 0x0, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847fe8847001211fd632f77fbac14141dac14", 0x0, 0x71, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = accept4(r0, 0x0, 0x0, 0x800) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000780)={0xa0, 0xfffffffffffffff5, 0x0, {{0x2, 0x0, 0xffffffffffffffff, 0x7, 0x8000, 0x5, {0x5, 0x924, 0xf74, 0x9, 0xd5fe, 0x9, 0x8, 0x0, 0x0, 0x6000, 0x5ae9, r4, 0x0, 0x1ff, 0x3}}, {0x0, 0x2}}}, 0xa0) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 961.396193ms ago: executing program 4 (id=3291): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffa}}, @hoplimit={{0x14}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @rthdr_2292={{0x28, 0x29, 0x39, {0x3a, 0x2, 0x2, 0x70, 0x0, [@mcast1]}}}], 0x88}}], 0x1, 0x810) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000700)="ec76b3b81f8baf00b118df1ac0", 0xd}], 0x2}}], 0x1, 0x404c041) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000030c0)=ANY=[], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0x20, 0x0, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847fe8847001211fd632f77fbac14141dac14", 0x0, 0x71, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = accept4(r0, 0x0, 0x0, 0x800) quotactl$Q_SETQUOTA(0xffffffff80000802, 0x0, 0x0, &(0x7f0000000080)={0x2002, 0x6, 0x0, 0x6, 0x8000000000000001, 0xfffffffffffffffe, 0x6, 0xfffffffffffffffe, 0xffffb291}) openat$incfs(0xffffffffffffffff, &(0x7f00000002c0)='.pending_reads\x00', 0x80, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000780)={0xa0, 0xfffffffffffffff5, 0x0, {{0x2, 0x0, 0xffffffffffffffff, 0x7, 0x8000, 0x5, {0x5, 0x924, 0xf74, 0x9, 0xd5fe, 0x9, 0x8, 0x0, 0x0, 0x6000, 0x5ae9, 0x0, 0x0, 0x1ff, 0x3}}, {0x0, 0x2}}}, 0xa0) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 785.471313ms ago: executing program 6 (id=3292): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xffffffffffffff2c}, 0x68) io_uring_setup(0x1c8e, &(0x7f0000000040)={0x0, 0xc8df, 0xc000, 0xa, 0x20002f3}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) syz_open_dev$usbfs(&(0x7f0000000000), 0x205, 0x44680) 741.07172ms ago: executing program 6 (id=3293): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffa}}, @hoplimit={{0x14}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @rthdr_2292={{0x38, 0x29, 0x39, {0x3a, 0x4, 0x2, 0x70, 0x0, [@mcast1, @mcast2]}}}], 0x98}}], 0x1, 0x810) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000700)="ec76b3b81f8baf", 0x7}], 0x2}}], 0x1, 0x404c041) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000780)={0xa0, 0xfffffffffffffff5, 0x0, {{0x2, 0x0, 0xffffffffffffffff, 0x7, 0x8000, 0x5, {0x5, 0x924, 0xf74, 0x9, 0xd5fe, 0x9, 0x8, 0x0, 0x0, 0x6000, 0x5ae9, r3, 0x0, 0x1ff, 0x3}}, {0x0, 0x2}}}, 0xa0) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 654.057173ms ago: executing program 6 (id=3294): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, 0x0}, 0x94) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000400)={{}, 0x1000000, 0x8000000, 0x401, {}, 0x1}) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) mount(0x0, &(0x7f0000000000)='./cgroup\x00', 0x0, 0x8000, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r1, &(0x7f0000004980), 0x0, 0x20008000) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x1, 0x0, 0x0) connect$nfc_llcp(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r3, 0x8955, 0x0) 588.794694ms ago: executing program 7 (id=3295): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) r3 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r4], 0x1c}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000340)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r5, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r7 = openat$cgroup_devices(r6, &(0x7f0000000080)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r7, &(0x7f0000000100)={'c', ' *:* ', 'w\x00'}, 0x8) close(r3) 533.473606ms ago: executing program 6 (id=3296): r0 = socket$inet6(0xa, 0x3, 0xff) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@newlink={0x44, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_FWD_MASK={0x6}, @IFLA_BR_VLAN_STATS_PER_PORT={0x5, 0x2d, 0x1}]}}}]}, 0x44}}, 0x0) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000002e40)=ANY=[@ANYBLOB="00020201"], 0x18) (async) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000002e40)=ANY=[@ANYBLOB="00020201"], 0x18) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r2 = dup(r0) write$FUSE_NOTIFY_STORE(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="2800000025748724431d2aefc4706ffe168d66ed04000000000000000000000001"], 0x28) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf2, 0x30, 0x39, 0x20, 0x2c42, 0x1202, 0x8540, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc, 0x2, 0x2, 0xc1, 0x7f, 0xc, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) 472.723676ms ago: executing program 4 (id=3297): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)}}], 0x1, 0x810) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000700)="ec76b3b81f8baf00b118df1ac0", 0xd}], 0x2}}], 0x1, 0x404c041) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0x20, 0x0, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847fe8847001211fd632f77fbac14141dac14", 0x0, 0x71, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = accept4(r0, 0x0, 0x0, 0x800) quotactl$Q_SETQUOTA(0xffffffff80000802, 0x0, 0x0, &(0x7f0000000080)={0x2002, 0x6, 0x0, 0x6, 0x8000000000000001, 0xfffffffffffffffe, 0x6, 0xfffffffffffffffe, 0xffffb291}) openat$incfs(0xffffffffffffffff, &(0x7f00000002c0)='.pending_reads\x00', 0x80, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000780)={0xa0, 0xfffffffffffffff5, 0x0, {{0x2, 0x0, 0xffffffffffffffff, 0x7, 0x8000, 0x5, {0x5, 0x924, 0xf74, 0x9, 0xd5fe, 0x9, 0x8, 0x0, 0x0, 0x6000, 0x5ae9, 0x0, 0x0, 0x1ff, 0x3}}, {0x0, 0x2}}}, 0xa0) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 295.09407ms ago: executing program 3 (id=3298): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="06000000040000000600000008"], 0x50) socket$netlink(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r2, r2, &(0x7f0000000000)=0x2eb4, 0x2000007ff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYBLOB='\b\x00\n'], 0x54}, 0x1, 0x0, 0x0, 0x40814}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x400}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r3, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df33c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 100.102049ms ago: executing program 3 (id=3299): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffa}}, @hoplimit={{0x14}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @rthdr_2292={{0x28, 0x29, 0x39, {0x3a, 0x2, 0x2, 0x70, 0x0, [@mcast1]}}}], 0x88}}], 0x1, 0x810) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000700)="ec76b3b81f8baf00b118df1ac0", 0xd}], 0x2}}], 0x1, 0x404c041) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000030c0)=ANY=[@ANYBLOB], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0x20, 0x0, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847fe8847001211fd632f77fbac14141dac14", 0x0, 0x71, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = accept4(r0, 0x0, 0x0, 0x800) quotactl$Q_SETQUOTA(0xffffffff80000802, 0x0, 0x0, &(0x7f0000000080)={0x2002, 0x6, 0x0, 0x6, 0x8000000000000001, 0xfffffffffffffffe, 0x6, 0xfffffffffffffffe, 0xffffb291}) openat$incfs(0xffffffffffffffff, &(0x7f00000002c0)='.pending_reads\x00', 0x80, 0x0) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 20.437482ms ago: executing program 7 (id=3300): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @rthdr_2292={{0x38, 0x29, 0x39, {0x3a, 0x4, 0x2, 0x70, 0x0, [@mcast1, @mcast2]}}}], 0x68}}], 0x1, 0x810) r0 = socket$alg(0x26, 0x5, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000700)="ec76b3b81f8baf00b118df1ac0", 0xd}], 0x2}}], 0x1, 0x404c041) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x20, 0x0, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847fe8847001211fd632f77fbac14141dac14", 0x0, 0x71, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) quotactl$Q_SETQUOTA(0xffffffff80000802, 0x0, r3, &(0x7f0000000080)={0x2002, 0x6, 0x0, 0x6, 0x8000000000000001, 0xfffffffffffffffe, 0x6, 0xfffffffffffffffe, 0xffffb291}) openat$incfs(r2, &(0x7f00000002c0)='.pending_reads\x00', 0x80, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000780)={0xa0, 0xfffffffffffffff5, 0x0, {{0x2, 0x0, 0xffffffffffffffff, 0x7, 0x8000, 0x5, {0x5, 0x924, 0xf74, 0x9, 0xd5fe, 0x9, 0x8, 0x0, 0x0, 0x6000, 0x5ae9, r3, 0x0, 0x1ff, 0x3}}, {0x0, 0x2}}}, 0xa0) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 0s ago: executing program 4 (id=3301): r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000b80)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)=ANY=[@ANYBLOB="8000000010000304000000000004000000000300", @ANYRES32=0x0, @ANYBLOB="032e000000000000500012800e0001006970366772657461700000003c000280060011004e22000014000700feff"], 0x80}}, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r1, 0x0, 0x0, 0x800) sendmsg$TIPC_NL_LINK_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)=ANY=[], 0xa8}, 0x1, 0x0, 0x0, 0x4004}, 0x20000000) recvmsg$can_bcm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000000)=""/10, 0xa}, {&(0x7f0000000080)=""/177, 0xb1}], 0x2, 0x0, 0xffffffffffffff34}, 0x0) r4 = syz_open_dev$video4linux(&(0x7f00000000c0), 0x92e2, 0x40400) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r4, 0xc040564a, &(0x7f0000000000)={0x0, 0x0, 0x3014, 0xfffffffd, 0xa, 0x0, 0x9, 0x1}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=0x0, @ANYBLOB="1400000010890700220012800b000100697036677265dfff0f000280060003008000000004001200"], 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) signalfd4(r0, 0x0, 0x0, 0x80000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) kernel console output (not intermixed with test programs): Number: syz [ 1312.017444][ T5932] smsc95xx v2.0.0 [ 1312.027190][ T5935] xr_serial ttyUSB0: Failed to set reg 0x60: -71 [ 1312.027300][ T5935] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 1312.096841][ T5935] usb 6-1: USB disconnect, device number 51 [ 1312.132219][ T5935] xr_serial 6-1:150.204: device disconnected [ 1312.303331][ T8093] xr_serial 8-1:150.204: skipping garbage [ 1312.303364][ T8093] xr_serial 8-1:150.204: xr_serial converter detected [ 1312.305089][ T8093] xr_serial ttyUSB0: Failed to set reg 0x60: -71 [ 1312.305122][ T8093] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 1312.347970][ T8093] usb 8-1: USB disconnect, device number 2 [ 1312.379702][ T8093] xr_serial 8-1:150.204: device disconnected [ 1312.400583][ T5932] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 1312.400612][ T5932] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1313.229704][ T5932] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 1313.230018][ T5932] smsc95xx 7-1:0.67: probe with driver smsc95xx failed with error -71 [ 1313.268960][ T5932] usb 7-1: USB disconnect, device number 32 [ 1313.458694][ C0] vkms_vblank_simulate: vblank timer overrun [ 1313.576565][T14867] netlink: 44 bytes leftover after parsing attributes in process `syz.7.2324'. [ 1313.902752][ C0] vkms_vblank_simulate: vblank timer overrun [ 1314.890110][ C0] vkms_vblank_simulate: vblank timer overrun [ 1314.894478][T14876] netlink: 'syz.6.2326': attribute type 16 has an invalid length. [ 1314.894490][T14876] netlink: 'syz.6.2326': attribute type 17 has an invalid length. [ 1314.928881][ T7909] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 1314.961864][T14876] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1315.314237][ T7909] usb 4-1: config index 0 descriptor too short (expected 44306, got 18) [ 1315.314262][ T7909] usb 4-1: config 0 has too many interfaces: 140, using maximum allowed: 32 [ 1315.314281][ T7909] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 140 [ 1315.314298][ T7909] usb 4-1: config 0 has no interface number 0 [ 1315.314343][ T7909] usb 4-1: New USB device found, idVendor=24cf, idProduct=59e4, bcdDevice= 9.22 [ 1315.314364][ T7909] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1315.322117][ T7909] usb 4-1: config 0 descriptor?? [ 1315.327189][ T7909] usb-storage 4-1:0.33: USB Mass Storage device detected [ 1315.876112][ C0] vkms_vblank_simulate: vblank timer overrun [ 1316.398201][ C0] vkms_vblank_simulate: vblank timer overrun [ 1317.030391][T14889] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1317.077095][ T7909] usb 4-1: USB disconnect, device number 74 [ 1319.147916][T14915] netlink: 988 bytes leftover after parsing attributes in process `syz.5.2337'. [ 1321.191062][T14932] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2338'. [ 1324.536064][T14950] netlink: 'syz.3.2343': attribute type 16 has an invalid length. [ 1324.536078][T14950] netlink: 'syz.3.2343': attribute type 17 has an invalid length. [ 1324.587031][T14950] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1325.329987][ T7909] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 1326.260019][ T7909] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1326.260042][ T7909] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 1326.260055][ T7909] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1326.260065][ T7909] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 1326.262267][ T7909] usb 8-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1326.262283][ T7909] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1326.262293][ T7909] usb 8-1: Product: syz [ 1326.262300][ T7909] usb 8-1: Manufacturer: syz [ 1326.262307][ T7909] usb 8-1: SerialNumber: syz [ 1326.372444][ T7909] usb 8-1: config 0 descriptor?? [ 1326.393884][ T7909] ums-isd200 8-1:0.0: USB Mass Storage device detected [ 1326.598324][ T7909] scsi host1: usb-storage 8-1:0.0 [ 1326.619672][ T7909] usb 8-1: USB disconnect, device number 3 [ 1328.211622][T14978] netlink: 44 bytes leftover after parsing attributes in process `syz.6.2353'. [ 1330.089568][ T7909] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 1330.478932][ T5795] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 1330.559491][ T7909] usb 5-1: Using ep0 maxpacket: 8 [ 1330.594539][ T7909] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 1330.594558][ T7909] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1330.594568][ T7909] usb 5-1: Product: syz [ 1330.594575][ T7909] usb 5-1: Manufacturer: syz [ 1330.594582][ T7909] usb 5-1: SerialNumber: syz [ 1330.602008][ T7909] usb 5-1: config 0 descriptor?? [ 1330.658867][ T5795] usb 4-1: Using ep0 maxpacket: 8 [ 1330.662699][ T5795] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1330.700638][ T5795] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 1330.700720][ T5795] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1330.700739][ T5795] usb 4-1: Product: syz [ 1330.700751][ T5795] usb 4-1: Manufacturer: syz [ 1330.700762][ T5795] usb 4-1: SerialNumber: syz [ 1330.706858][ T5795] usb 4-1: config 0 descriptor?? [ 1330.749153][ T8093] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 1330.812480][ T7909] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1330.813513][ T7909] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1330.815589][ T7909] usb 5-1: USB disconnect, device number 58 [ 1331.012411][ T8093] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1331.012429][ T8093] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 1331.012440][ T8093] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1331.012451][ T8093] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 1331.015476][ T8093] usb 8-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1331.015492][ T8093] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1331.015501][ T8093] usb 8-1: Product: syz [ 1331.015507][ T8093] usb 8-1: Manufacturer: syz [ 1331.015514][ T8093] usb 8-1: SerialNumber: syz [ 1331.018632][ T8093] usb 8-1: config 0 descriptor?? [ 1331.134879][ T8093] ums-isd200 8-1:0.0: USB Mass Storage device detected [ 1331.290087][ T8093] scsi host1: usb-storage 8-1:0.0 [ 1331.371472][ T8093] usb 8-1: USB disconnect, device number 4 [ 1334.867969][ T5795] usb 4-1: USB disconnect, device number 75 [ 1338.829136][ C0] vkms_vblank_simulate: vblank timer overrun [ 1339.418891][ T5935] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 1339.568902][ T5935] usb 6-1: Using ep0 maxpacket: 32 [ 1339.571635][ T5935] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 1339.571649][ T5935] usb 6-1: config 0 has no interface number 0 [ 1339.571676][ T5935] usb 6-1: config 0 interface 51 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1339.571686][ T5935] usb 6-1: config 0 interface 51 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1339.577902][ T5935] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1339.577918][ T5935] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1339.577928][ T5935] usb 6-1: Product: syz [ 1339.577934][ T5935] usb 6-1: Manufacturer: syz [ 1339.577941][ T5935] usb 6-1: SerialNumber: syz [ 1339.666431][ T5935] usb 6-1: config 0 descriptor?? [ 1339.697136][ T5935] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1340.033600][ T5935] usb 6-1: qt2_setup_urbs - submit read urb failed -90 [ 1340.033780][ T5935] quatech2 6-1:0.51: probe with driver quatech2 failed with error -90 [ 1340.272405][ T5935] usb 6-1: USB disconnect, device number 52 [ 1341.749244][ T8093] usb 6-1: new full-speed USB device number 53 using dummy_hcd [ 1341.858566][ C0] vkms_vblank_simulate: vblank timer overrun [ 1341.933440][ C0] vkms_vblank_simulate: vblank timer overrun [ 1342.055877][T15097] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2387'. [ 1342.064092][ C0] vkms_vblank_simulate: vblank timer overrun [ 1342.637377][ C0] vkms_vblank_simulate: vblank timer overrun [ 1342.839641][ T8093] usb 6-1: config 150 has an invalid interface number: 204 but max is 2 [ 1342.839667][ T8093] usb 6-1: config 150 has an invalid descriptor of length 0, skipping remainder of the config [ 1342.839684][ T8093] usb 6-1: config 150 has 1 interface, different from the descriptor's value: 3 [ 1342.839701][ T8093] usb 6-1: config 150 has no interface number 0 [ 1342.839731][ T8093] usb 6-1: config 150 interface 204 has no altsetting 0 [ 1342.844513][ T8093] usb 6-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 1342.844539][ T8093] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1342.844624][ T8093] usb 6-1: Product: syz [ 1342.844632][ T8093] usb 6-1: Manufacturer: syz [ 1342.844639][ T8093] usb 6-1: SerialNumber: syz [ 1342.926541][ C0] vkms_vblank_simulate: vblank timer overrun [ 1343.587391][ C0] vkms_vblank_simulate: vblank timer overrun [ 1343.650482][ T8093] xr_serial 6-1:150.204: skipping garbage [ 1343.657939][ T8093] usb 6-1: USB disconnect, device number 53 [ 1343.769676][ T44] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 1344.041249][ T44] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1344.041277][ T44] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 1344.041298][ T44] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1344.041317][ T44] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 1344.116290][ T44] usb 4-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1344.116317][ T44] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1344.116333][ T44] usb 4-1: Product: syz [ 1344.116339][ T44] usb 4-1: Manufacturer: syz [ 1344.116346][ T44] usb 4-1: SerialNumber: syz [ 1344.167758][ T44] usb 4-1: config 0 descriptor?? [ 1344.190800][ T44] ums-isd200 4-1:0.0: USB Mass Storage device detected [ 1344.481261][ T44] scsi host1: usb-storage 4-1:0.0 [ 1344.544206][ T44] usb 4-1: USB disconnect, device number 76 [ 1345.718977][ T44] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 1345.739128][ T5932] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 1345.748962][ T7909] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 1345.869245][ T44] usb 5-1: Using ep0 maxpacket: 8 [ 1345.873847][ T44] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1345.878211][ T44] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 1345.878237][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1345.878255][ T44] usb 5-1: Product: syz [ 1345.878267][ T44] usb 5-1: Manufacturer: syz [ 1345.878280][ T44] usb 5-1: SerialNumber: syz [ 1345.886138][ T44] usb 5-1: config 0 descriptor?? [ 1345.900784][ T7909] usb 7-1: config index 0 descriptor too short (expected 44306, got 18) [ 1345.900808][ T7909] usb 7-1: config 0 has too many interfaces: 140, using maximum allowed: 32 [ 1345.900827][ T7909] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 140 [ 1345.900853][ T7909] usb 7-1: config 0 has no interface number 0 [ 1345.900898][ T7909] usb 7-1: New USB device found, idVendor=24cf, idProduct=59e4, bcdDevice= 9.22 [ 1345.900919][ T7909] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1345.906095][ T7909] usb 7-1: config 0 descriptor?? [ 1345.910343][ T7909] usb-storage 7-1:0.33: USB Mass Storage device detected [ 1345.937074][ T5932] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1345.937092][ T5932] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 1345.937104][ T5932] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1345.937114][ T5932] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 1346.033344][ T5932] usb 6-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1346.033370][ T5932] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1346.033387][ T5932] usb 6-1: Product: syz [ 1346.033398][ T5932] usb 6-1: Manufacturer: syz [ 1346.033409][ T5932] usb 6-1: SerialNumber: syz [ 1346.071367][ T5932] usb 6-1: config 0 descriptor?? [ 1346.086756][ T5932] ums-isd200 6-1:0.0: USB Mass Storage device detected [ 1346.294634][ T5932] scsi host2: usb-storage 6-1:0.0 [ 1346.310983][ T5932] usb 6-1: USB disconnect, device number 54 [ 1349.344018][ T5935] usb 5-1: USB disconnect, device number 59 [ 1350.778957][ T5935] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 1350.779125][ T44] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 1350.935483][ T5935] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1350.935501][ T5935] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 1350.935521][ T5935] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1350.935531][ T5935] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 1350.979667][ T44] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1350.979693][ T44] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 1350.979715][ T44] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1350.979733][ T44] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 1350.980561][ T5935] usb 6-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1350.980584][ T5935] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1350.980602][ T5935] usb 6-1: Product: syz [ 1350.980614][ T5935] usb 6-1: Manufacturer: syz [ 1350.980627][ T5935] usb 6-1: SerialNumber: syz [ 1350.986591][ T44] usb 8-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1350.986615][ T44] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1350.986632][ T44] usb 8-1: Product: syz [ 1350.986645][ T44] usb 8-1: Manufacturer: syz [ 1350.986657][ T44] usb 8-1: SerialNumber: syz [ 1351.094671][ T5935] usb 6-1: config 0 descriptor?? [ 1351.113742][ T5935] ums-isd200 6-1:0.0: USB Mass Storage device detected [ 1351.115701][ T44] usb 8-1: config 0 descriptor?? [ 1351.134860][ T44] ums-isd200 8-1:0.0: USB Mass Storage device detected [ 1351.311042][ T5935] scsi host1: usb-storage 6-1:0.0 [ 1351.356183][ T44] scsi host2: usb-storage 8-1:0.0 [ 1351.366949][ T5935] usb 6-1: USB disconnect, device number 55 [ 1351.632056][ T5932] usb 7-1: USB disconnect, device number 33 [ 1351.676583][ T44] usb 8-1: USB disconnect, device number 5 [ 1353.206891][ T5935] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 1354.505040][ T5935] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1354.505069][ T5935] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 1354.505090][ T5935] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1354.505110][ T5935] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 1354.550894][ T5935] usb 7-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1354.550921][ T5935] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1354.550939][ T5935] usb 7-1: Product: syz [ 1354.550952][ T5935] usb 7-1: Manufacturer: syz [ 1354.550965][ T5935] usb 7-1: SerialNumber: syz [ 1354.672822][ T5935] usb 7-1: config 0 descriptor?? [ 1354.675627][ T5935] ums-isd200 7-1:0.0: USB Mass Storage device detected [ 1354.887126][ T61] Bluetooth: hci4: unexpected event for opcode 0x0403 [ 1354.920699][ T5935] scsi host1: usb-storage 7-1:0.0 [ 1354.950431][ T5935] usb 7-1: USB disconnect, device number 34 [ 1356.158936][ T5981] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 1356.513360][ T5981] usb 5-1: config index 0 descriptor too short (expected 44306, got 18) [ 1356.513523][ T5981] usb 5-1: config 0 has too many interfaces: 140, using maximum allowed: 32 [ 1356.513604][ T5981] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 140 [ 1356.513693][ T5981] usb 5-1: config 0 has no interface number 0 [ 1356.514463][ T5981] usb 5-1: New USB device found, idVendor=24cf, idProduct=59e4, bcdDevice= 9.22 [ 1356.514545][ T5981] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1357.290918][ T5981] usb 5-1: config 0 descriptor?? [ 1357.326519][ T5981] usb-storage 5-1:0.33: USB Mass Storage device detected [ 1362.209060][ T7909] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1362.388906][ T7909] usb 4-1: Using ep0 maxpacket: 8 [ 1362.396082][ T7909] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 1362.396110][ T7909] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1362.396129][ T7909] usb 4-1: Product: syz [ 1362.396142][ T7909] usb 4-1: Manufacturer: syz [ 1362.396156][ T7909] usb 4-1: SerialNumber: syz [ 1362.421252][ T7909] usb 4-1: config 0 descriptor?? [ 1362.608974][ T44] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 1362.773876][ T7909] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1362.778955][ T5814] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 1362.788891][ T44] usb 6-1: Using ep0 maxpacket: 32 [ 1362.802865][ T44] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 1362.802890][ T44] usb 6-1: config 0 has no interface number 0 [ 1362.805585][ T44] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1362.805601][ T44] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1362.805611][ T44] usb 6-1: Product: syz [ 1362.805656][ T44] usb 6-1: Manufacturer: syz [ 1362.805663][ T44] usb 6-1: SerialNumber: syz [ 1362.819197][ T44] usb 6-1: config 0 descriptor?? [ 1362.865465][ T44] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1362.943256][ T5814] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1362.943346][ T5814] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 1362.943370][ T5814] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1362.943396][ T5814] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 1363.168130][ T5814] usb 7-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1363.168231][ T5814] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1363.168249][ T5814] usb 7-1: Product: syz [ 1363.168262][ T5814] usb 7-1: Manufacturer: syz [ 1363.168273][ T5814] usb 7-1: SerialNumber: syz [ 1364.062388][ T7909] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1364.109061][ T5814] usb 7-1: config 0 descriptor?? [ 1364.124359][ T7909] usb 4-1: USB disconnect, device number 77 [ 1364.167525][ T5814] ums-isd200 7-1:0.0: USB Mass Storage device detected [ 1364.235159][ T44] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1364.317968][ T44] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1364.331882][ T61] Bluetooth: hci4: unexpected event for opcode 0x0403 [ 1364.354007][ T5814] scsi host1: usb-storage 7-1:0.0 [ 1364.373002][ T5981] usb 5-1: USB disconnect, device number 60 [ 1364.668476][ C1] usb 6-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1364.678893][ T5932] usb 6-1: USB disconnect, device number 56 [ 1365.019552][ T5932] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1365.151597][ T5932] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1365.265336][ T5932] quatech2 6-1:0.51: device disconnected [ 1365.535693][ T5814] usb 7-1: USB disconnect, device number 35 [ 1366.216960][T15285] overlayfs: missing 'lowerdir' [ 1368.742337][ T5932] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1368.898885][ T5932] usb 4-1: Using ep0 maxpacket: 32 [ 1368.906874][ T5932] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 1368.906901][ T5932] usb 4-1: config 0 has no interface number 0 [ 1368.933338][ T5932] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1368.933367][ T5932] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1368.933386][ T5932] usb 4-1: Product: syz [ 1368.933398][ T5932] usb 4-1: Manufacturer: syz [ 1368.933411][ T5932] usb 4-1: SerialNumber: syz [ 1369.077422][ T5932] usb 4-1: config 0 descriptor?? [ 1369.093637][ T5932] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1370.050609][ T5932] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1370.073938][ T5932] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1370.210522][ C0] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1370.227177][ T5932] usb 4-1: USB disconnect, device number 78 [ 1370.292914][ T5932] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1370.342172][ T5932] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1370.342842][ T5932] quatech2 4-1:0.51: device disconnected [ 1370.828106][T15327] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2452'. [ 1371.979046][ T1323] ieee802154 phy0 wpan0: encryption failed: -22 [ 1371.979119][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 1373.031642][ T7909] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 1373.210750][ T7909] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1373.210768][ T7909] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 1373.210780][ T7909] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1373.210789][ T7909] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 1373.212741][ T7909] usb 6-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1373.212756][ T7909] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1373.212766][ T7909] usb 6-1: Product: syz [ 1373.212773][ T7909] usb 6-1: Manufacturer: syz [ 1373.212779][ T7909] usb 6-1: SerialNumber: syz [ 1373.217707][ T7909] usb 6-1: config 0 descriptor?? [ 1373.305424][ T7909] ums-isd200 6-1:0.0: USB Mass Storage device detected [ 1373.749758][ T7909] scsi host1: usb-storage 6-1:0.0 [ 1373.889244][ T7909] usb 6-1: USB disconnect, device number 57 [ 1374.066231][ T61] Bluetooth: hci1: command 0x0406 tx timeout [ 1374.714342][T15360] netlink: 'syz.5.2461': attribute type 16 has an invalid length. [ 1374.714410][T15360] netlink: 'syz.5.2461': attribute type 17 has an invalid length. [ 1375.431680][T15360] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1379.338560][T15399] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1383.248411][ T7909] kernel write not supported for file /sequencer (pid: 7909 comm: kworker/1:3) [ 1385.943647][T15445] netlink: 'syz.3.2484': attribute type 83 has an invalid length. [ 1389.793184][T15483] netlink: 'syz.4.2496': attribute type 83 has an invalid length. [ 1389.882536][T15481] kvm_pr_unimpl_wrmsr: 18 callbacks suppressed [ 1389.882557][T15481] kvm: kvm [15480]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60100000000 [ 1389.886712][T15481] kvm: kvm [15480]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60400000000 [ 1389.912701][T15481] kvm: kvm [15480]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60700000000 [ 1389.916893][T15481] kvm: kvm [15480]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60a00000000 [ 1389.932257][T15481] kvm: kvm [15480]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60d00000000 [ 1389.936551][T15481] kvm: kvm [15480]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x61000000000 [ 1389.959009][ T8093] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 1389.971586][T15481] kvm: kvm [15480]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x61300000000 [ 1390.006336][T15481] kvm: kvm [15480]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x61600000000 [ 1390.018657][T15481] kvm: kvm [15480]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x61900000000 [ 1390.037660][T15481] kvm: kvm [15480]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x61c00000000 [ 1392.018882][ T8093] usb 7-1: Using ep0 maxpacket: 32 [ 1392.177269][ T8093] usb 7-1: device descriptor read/all, error -71 [ 1394.141221][T15518] netlink: 'syz.4.2507': attribute type 83 has an invalid length. [ 1395.565174][T15540] kvm_pr_unimpl_wrmsr: 32 callbacks suppressed [ 1395.565195][T15540] kvm: kvm [15539]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60100000000 [ 1395.587619][T15540] kvm: kvm [15539]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60400000000 [ 1395.595269][T15540] kvm: kvm [15539]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60700000000 [ 1395.627372][T15540] kvm: kvm [15539]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60a00000000 [ 1395.632791][T15540] kvm: kvm [15539]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60d00000000 [ 1395.645195][T15540] kvm: kvm [15539]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x61000000000 [ 1395.659760][T15540] kvm: kvm [15539]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x61300000000 [ 1395.660732][T15544] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1395.664840][T15540] kvm: kvm [15539]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x61600000000 [ 1395.695480][T15540] kvm: kvm [15539]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x61900000000 [ 1395.701470][T15540] kvm: kvm [15539]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x61c00000000 [ 1396.353400][T15556] netlink: 'syz.6.2519': attribute type 83 has an invalid length. [ 1397.152976][T15271] kernel write not supported for file /cpu/0/msr (pid: 15271 comm: kworker/1:0) [ 1400.066907][T15598] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2532'. [ 1403.634770][T15630] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2542'. [ 1404.798941][ T5981] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 1404.941406][ T5932] kernel write not supported for file /sequencer (pid: 5932 comm: kworker/0:6) [ 1404.997152][ T5981] usb 6-1: Using ep0 maxpacket: 16 [ 1405.010555][ T5981] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1405.010579][ T5981] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1405.013844][ T5981] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1405.013869][ T5981] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1405.013887][ T5981] usb 6-1: Product: syz [ 1405.013900][ T5981] usb 6-1: Manufacturer: syz [ 1405.013913][ T5981] usb 6-1: SerialNumber: syz [ 1405.250793][ T5981] usb 6-1: 0:2 : does not exist [ 1405.256129][ T5981] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 1405.313324][ T5981] usb 6-1: USB disconnect, device number 58 [ 1405.987889][ T5814] kernel write not supported for file /cpu/0/msr (pid: 5814 comm: kworker/1:5) [ 1406.279517][ T5932] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 1406.428909][ T5932] usb 5-1: Using ep0 maxpacket: 32 [ 1406.436052][ T5932] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 1406.436068][ T5932] usb 5-1: config 0 has no interface number 0 [ 1406.462224][ T5932] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1406.462252][ T5932] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1406.462268][ T5932] usb 5-1: Product: syz [ 1406.462279][ T5932] usb 5-1: Manufacturer: syz [ 1406.462291][ T5932] usb 5-1: SerialNumber: syz [ 1406.467640][ T5932] usb 5-1: config 0 descriptor?? [ 1406.507002][ T5932] smsc95xx v2.0.0 [ 1406.548887][ T5814] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 1406.728907][ T5814] usb 6-1: Using ep0 maxpacket: 32 [ 1406.731381][ T5814] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 1406.731406][ T5814] usb 6-1: config 0 has no interface number 0 [ 1406.735320][ T5814] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1406.735345][ T5814] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1406.735363][ T5814] usb 6-1: Product: syz [ 1406.735375][ T5814] usb 6-1: Manufacturer: syz [ 1406.735387][ T5814] usb 6-1: SerialNumber: syz [ 1406.777245][ T5814] usb 6-1: config 0 descriptor?? [ 1406.804639][ T5814] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1406.940814][ T5932] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 1406.940843][ T5932] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1407.263434][T15659] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2554'. [ 1408.115987][ T5932] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 1408.116907][ T5932] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -61 [ 1408.193433][ T5814] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1408.260462][ T5814] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1408.308107][ C1] usb 6-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1408.324085][ T5814] usb 6-1: USB disconnect, device number 59 [ 1408.328237][ T5981] usb 5-1: USB disconnect, device number 61 [ 1408.352430][ T5814] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1408.394376][ T5814] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1408.395088][ T5814] quatech2 6-1:0.51: device disconnected [ 1408.409852][T15667] netlink: 'syz.3.2557': attribute type 83 has an invalid length. [ 1409.194397][T15678] netlink: 'syz.3.2560': attribute type 16 has an invalid length. [ 1409.194450][T15678] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2560'. [ 1410.516818][T15691] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2565'. [ 1413.163078][ T61] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1413.329188][ T61] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1413.331815][ T61] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1413.336571][ T61] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1413.337230][ T61] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1413.712616][T15718] netlink: 'syz.7.2574': attribute type 16 has an invalid length. [ 1413.712637][T15718] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2574'. [ 1414.801627][ T5804] bond0: (slave syz_tun): Releasing backup interface [ 1415.507003][T11176] Bluetooth: hci3: command tx timeout [ 1415.858891][ T44] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 1416.008911][ T44] usb 8-1: Using ep0 maxpacket: 16 [ 1416.011741][ T44] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1416.011824][ T44] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1416.015434][ T44] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1416.015460][ T44] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1416.015477][ T44] usb 8-1: Product: syz [ 1416.015489][ T44] usb 8-1: Manufacturer: syz [ 1416.015502][ T44] usb 8-1: SerialNumber: syz [ 1416.272833][ T5932] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 1416.274074][ T44] usb 8-1: 0:2 : does not exist [ 1416.278152][ T44] usb 8-1: 5:0: failed to get current value for ch 0 (-22) [ 1416.299911][ T44] usb 8-1: USB disconnect, device number 6 [ 1416.344427][ T9208] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1416.424843][ T5932] usb 7-1: Using ep0 maxpacket: 16 [ 1416.435538][ T5932] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1416.435561][ T5932] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1416.461410][ T5932] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1416.461445][ T5932] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1416.461464][ T5932] usb 7-1: Product: syz [ 1416.461476][ T5932] usb 7-1: Manufacturer: syz [ 1416.461489][ T5932] usb 7-1: SerialNumber: syz [ 1416.722467][ T5932] usb 7-1: 0:2 : does not exist [ 1416.722555][ T5932] usb 7-1: unit 14 not found! [ 1416.741268][ T5932] usb 7-1: USB disconnect, device number 38 [ 1417.411196][T15756] netlink: 'syz.7.2585': attribute type 16 has an invalid length. [ 1417.411217][T15756] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2585'. [ 1417.855693][T11176] Bluetooth: hci3: command tx timeout [ 1418.249816][ T9208] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1419.704172][ T9208] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1419.889068][T11176] Bluetooth: hci3: command tx timeout [ 1420.506534][ T9208] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1420.578519][T15710] chnl_net:caif_netlink_parms(): no params data found [ 1421.639000][ T8093] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 1421.798886][ T8093] usb 5-1: Using ep0 maxpacket: 16 [ 1421.801135][ T8093] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1421.801150][ T8093] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1421.801731][T15710] bridge0: port 1(bridge_slave_0) entered blocking state [ 1421.801856][T15710] bridge0: port 1(bridge_slave_0) entered disabled state [ 1421.802086][T15710] bridge_slave_0: entered allmulticast mode [ 1421.806804][ T8093] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1421.806830][ T8093] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1421.806844][T15710] bridge_slave_0: entered promiscuous mode [ 1421.806846][ T8093] usb 5-1: Product: syz [ 1421.806858][ T8093] usb 5-1: Manufacturer: syz [ 1421.806870][ T8093] usb 5-1: SerialNumber: syz [ 1421.917433][T15710] bridge0: port 2(bridge_slave_1) entered blocking state [ 1421.917582][T15710] bridge0: port 2(bridge_slave_1) entered disabled state [ 1421.917816][T15710] bridge_slave_1: entered allmulticast mode [ 1421.955379][T15710] bridge_slave_1: entered promiscuous mode [ 1421.970488][T11176] Bluetooth: hci3: command tx timeout [ 1422.120649][ T8093] usb 5-1: 0:2 : does not exist [ 1422.140008][ T8093] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 1422.166205][ T8093] usb 5-1: USB disconnect, device number 62 [ 1422.493424][T15710] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1422.961413][T15710] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1423.110238][ T9208] bridge_slave_1: left allmulticast mode [ 1423.110267][ T9208] bridge_slave_1: left promiscuous mode [ 1423.110502][ T9208] bridge0: port 2(bridge_slave_1) entered disabled state [ 1423.595855][ T9208] bridge_slave_0: left allmulticast mode [ 1423.595885][ T9208] bridge_slave_0: left promiscuous mode [ 1423.596141][ T9208] bridge0: port 1(bridge_slave_0) entered disabled state [ 1424.088933][ T8093] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 1424.238905][ T8093] usb 7-1: Using ep0 maxpacket: 16 [ 1424.241774][ T8093] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1424.241797][ T8093] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1424.244202][ T8093] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1424.244223][ T8093] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1424.244233][ T8093] usb 7-1: Product: syz [ 1424.244240][ T8093] usb 7-1: Manufacturer: syz [ 1424.244246][ T8093] usb 7-1: SerialNumber: syz [ 1424.409006][ T5935] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 1424.461642][ T8093] usb 7-1: 0:2 : does not exist [ 1424.464806][ T8093] usb 7-1: 5:0: failed to get current value for ch 0 (-22) [ 1424.484961][ T8093] usb 7-1: USB disconnect, device number 39 [ 1424.559668][ T5935] usb 5-1: Using ep0 maxpacket: 16 [ 1424.565335][ T5935] usb 5-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 1424.565362][ T5935] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1424.603332][ T5935] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1424.603351][ T5935] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1424.603361][ T5935] usb 5-1: Product: syz [ 1424.603368][ T5935] usb 5-1: Manufacturer: syz [ 1424.603375][ T5935] usb 5-1: SerialNumber: syz [ 1424.817310][ T5935] usb 5-1: 0:2 : does not exist [ 1424.828336][ T5935] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 1424.857716][ T5935] usb 5-1: USB disconnect, device number 63 [ 1426.845358][T15828] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2607'. [ 1429.430854][ T9208] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1429.490958][ T9208] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1429.549969][ T9208] bond0 (unregistering): (slave team0): Releasing backup interface [ 1429.582788][ T9208] bond0 (unregistering): Released all slaves [ 1429.913306][T15710] team0: Port device team_slave_0 added [ 1429.916954][T15710] team0: Port device team_slave_1 added [ 1430.502096][ T44] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 1430.689060][ T44] usb 8-1: Using ep0 maxpacket: 16 [ 1430.926339][ T44] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1430.926362][ T44] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1430.957974][ T44] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1430.958001][ T44] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1430.958020][ T44] usb 8-1: Product: syz [ 1430.958033][ T44] usb 8-1: Manufacturer: syz [ 1430.958046][ T44] usb 8-1: SerialNumber: syz [ 1431.020254][T15849] netlink: 'syz.6.2614': attribute type 83 has an invalid length. [ 1431.235594][ T44] usb 8-1: 0:2 : does not exist [ 1431.249000][ T44] usb 8-1: 5:0: failed to get current value for ch 0 (-22) [ 1431.301449][ T44] usb 8-1: USB disconnect, device number 7 [ 1431.331402][ T5935] kernel write not supported for file /sequencer (pid: 5935 comm: kworker/0:7) [ 1431.379326][T15857] kvm_pr_unimpl_wrmsr: 62 callbacks suppressed [ 1431.379346][T15857] kvm: kvm [15856]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60000000000 [ 1431.393151][T15857] kvm: kvm [15856]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60200000000 [ 1431.405146][T15857] kvm: kvm [15856]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60400000000 [ 1431.652757][T15857] kvm: kvm [15856]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60600000000 [ 1431.655776][T15857] kvm: kvm [15856]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60800000000 [ 1431.720628][T15857] kvm: kvm [15856]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60a00000000 [ 1431.965148][T15857] kvm: kvm [15856]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60c00000000 [ 1431.985463][T15857] kvm: kvm [15856]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x60e00000000 [ 1432.026055][T15857] kvm: kvm [15856]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x61000000000 [ 1432.036632][T15857] kvm: kvm [15856]: vcpu0, guest rIP: 0x134 Unhandled WRMSR(0xc2) = 0x61200000000 [ 1432.399299][T15710] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1432.399318][T15710] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1432.399342][T15710] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1432.405179][T15710] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1432.405194][T15710] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1432.405219][T15710] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1432.508899][ T44] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 1432.679341][ T44] usb 5-1: Using ep0 maxpacket: 16 [ 1432.682562][ T44] usb 5-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 1432.682577][ T44] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1432.684699][ T44] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1432.684726][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1432.684743][ T44] usb 5-1: Product: syz [ 1432.684756][ T44] usb 5-1: Manufacturer: syz [ 1432.684767][ T44] usb 5-1: SerialNumber: syz [ 1432.969042][ T44] usb 5-1: 0:2 : does not exist [ 1432.974574][ T44] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 1433.079366][ T44] usb 5-1: USB disconnect, device number 64 [ 1433.410788][ T1323] ieee802154 phy0 wpan0: encryption failed: -22 [ 1433.410848][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 1433.552980][T15710] hsr_slave_0: entered promiscuous mode [ 1433.554362][T15710] hsr_slave_1: entered promiscuous mode [ 1433.555324][T15710] debugfs: 'hsr0' already exists in 'hsr' [ 1433.555346][T15710] Cannot create hsr debugfs directory [ 1433.779191][ T9208] hsr_slave_0: left promiscuous mode [ 1433.783017][T14120] kernel write not supported for file /sequencer (pid: 14120 comm: kworker/0:4) [ 1433.798337][T15885] netlink: 'syz.7.2626': attribute type 83 has an invalid length. [ 1433.849547][ T9208] hsr_slave_1: left promiscuous mode [ 1433.850754][ T9208] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1433.850785][ T9208] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1433.904320][ T9208] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1433.904359][ T9208] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1434.200275][ T9208] veth1_macvtap: left promiscuous mode [ 1434.200377][ T9208] veth0_macvtap: left promiscuous mode [ 1434.200637][ T9208] veth1_vlan: left promiscuous mode [ 1434.207906][ T9208] veth0_vlan: left promiscuous mode [ 1437.369810][ T9208] team0 (unregistering): Port device team_slave_1 removed [ 1437.619863][ T9208] team0 (unregistering): Port device team_slave_0 removed [ 1440.884549][T15914] netlink: 'syz.4.2636': attribute type 83 has an invalid length. [ 1441.214731][T15919] netlink: 'syz.5.2635': attribute type 16 has an invalid length. [ 1441.214754][T15919] netlink: 'syz.5.2635': attribute type 17 has an invalid length. [ 1441.214766][T15919] netlink: 'syz.5.2635': attribute type 27 has an invalid length. [ 1443.213267][T15924] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2638'. [ 1443.288052][T15946] netlink: 'syz.5.2646': attribute type 83 has an invalid length. [ 1443.634003][ T5814] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 1443.809346][ T5814] usb 6-1: Using ep0 maxpacket: 16 [ 1443.812801][ T5814] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1443.812823][ T5814] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1443.821512][ T5814] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1443.821539][ T5814] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1443.821557][ T5814] usb 6-1: Product: syz [ 1443.821569][ T5814] usb 6-1: Manufacturer: syz [ 1443.821581][ T5814] usb 6-1: SerialNumber: syz [ 1444.045117][T15710] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1444.099620][ T5814] usb 6-1: 0:2 : does not exist [ 1444.121841][ T5814] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 1444.631966][ T5814] usb 6-1: USB disconnect, device number 60 [ 1444.650265][T15710] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1444.694868][T15710] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1444.757030][T15710] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1444.896010][T15710] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1444.913018][T15710] 8021q: adding VLAN 0 to HW filter on device team0 [ 1444.918218][ T8308] bridge0: port 1(bridge_slave_0) entered blocking state [ 1444.918458][ T8308] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1444.954208][ T8589] bridge0: port 2(bridge_slave_1) entered blocking state [ 1444.954333][ T8589] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1445.008935][ T7909] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 1445.019830][ T8093] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 1445.168968][ T8093] usb 8-1: Using ep0 maxpacket: 16 [ 1445.171556][ T8093] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1445.171579][ T8093] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1445.174813][ T8093] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1445.174838][ T8093] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1445.174855][ T8093] usb 8-1: Product: syz [ 1445.174868][ T8093] usb 8-1: Manufacturer: syz [ 1445.174880][ T8093] usb 8-1: SerialNumber: syz [ 1445.378852][ T7909] usb 5-1: Using ep0 maxpacket: 16 [ 1445.381399][ T7909] usb 5-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 1445.381422][ T7909] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1445.384406][ T7909] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1445.384430][ T7909] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1445.384446][ T7909] usb 5-1: Product: syz [ 1445.384459][ T7909] usb 5-1: Manufacturer: syz [ 1445.384471][ T7909] usb 5-1: SerialNumber: syz [ 1445.621657][ T5814] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 1446.100546][ T8093] usb 8-1: 0:2 : does not exist [ 1446.107163][ T8093] usb 8-1: 5:0: failed to get current value for ch 0 (-22) [ 1446.151162][ T8093] usb 8-1: USB disconnect, device number 8 [ 1446.228930][ T5814] usb 7-1: Using ep0 maxpacket: 16 [ 1446.231653][ T5814] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1446.231676][ T5814] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1446.235698][ T5814] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1446.235722][ T5814] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1446.235741][ T5814] usb 7-1: Product: syz [ 1446.235754][ T5814] usb 7-1: Manufacturer: syz [ 1446.235767][ T5814] usb 7-1: SerialNumber: syz [ 1446.366777][ T7909] usb 5-1: 0:2 : does not exist [ 1446.375289][ T7909] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 1446.401666][ T7909] usb 5-1: USB disconnect, device number 65 [ 1446.440924][T15710] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1446.455242][ T5814] usb 7-1: 0:2 : does not exist [ 1446.459378][ T5814] usb 7-1: 5:0: failed to get current value for ch 0 (-22) [ 1446.535231][T15710] veth0_vlan: entered promiscuous mode [ 1446.554729][T15710] veth1_vlan: entered promiscuous mode [ 1446.602742][T15710] veth0_macvtap: entered promiscuous mode [ 1446.620286][T15710] veth1_macvtap: entered promiscuous mode [ 1446.628901][ T5814] usb 7-1: USB disconnect, device number 40 [ 1446.690036][T15710] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1446.723628][T15710] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1446.745667][ T8592] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1446.747244][ T8592] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1446.747285][ T8592] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1446.747318][ T8592] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1447.229240][T15993] netlink: 'syz.7.2657': attribute type 16 has an invalid length. [ 1447.229261][T15993] netlink: 'syz.7.2657': attribute type 17 has an invalid length. [ 1447.920989][T15993] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1448.029062][ T8592] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1448.029082][ T8592] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1448.173912][ T8589] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1448.173933][ T8589] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1448.349254][ T8093] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 1448.528896][ T5935] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 1448.549230][ T8093] usb 7-1: Using ep0 maxpacket: 16 [ 1448.551598][ T8093] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1448.551621][ T8093] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1448.554722][ T8093] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1448.554747][ T8093] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1448.554764][ T8093] usb 7-1: Product: syz [ 1448.554777][ T8093] usb 7-1: Manufacturer: syz [ 1448.554790][ T8093] usb 7-1: SerialNumber: syz [ 1449.882090][ T5935] usb 6-1: Using ep0 maxpacket: 16 [ 1449.892279][ T5935] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1449.892304][ T5935] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1449.920357][ T5935] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1449.920373][ T5935] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1449.920383][ T5935] usb 6-1: Product: syz [ 1449.920389][ T5935] usb 6-1: Manufacturer: syz [ 1449.920396][ T5935] usb 6-1: SerialNumber: syz [ 1449.971291][ T8093] usb 7-1: 0:2 : does not exist [ 1449.975116][ T8093] usb 7-1: 5:0: failed to get current value for ch 0 (-22) [ 1450.016125][ T8093] usb 7-1: USB disconnect, device number 41 [ 1450.167892][ T5935] usb 6-1: 0:2 : does not exist [ 1450.176362][ T5935] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 1450.228271][ T5935] usb 6-1: USB disconnect, device number 61 [ 1452.794406][T16049] netlink: 'syz.4.2681': attribute type 83 has an invalid length. [ 1454.669255][ T5814] usb 7-1: new high-speed USB device number 42 using dummy_hcd [ 1455.008954][ T5814] usb 7-1: Using ep0 maxpacket: 16 [ 1455.011239][ T5814] usb 7-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 1455.011262][ T5814] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1455.014354][ T5814] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1455.014378][ T5814] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1455.014396][ T5814] usb 7-1: Product: syz [ 1455.014409][ T5814] usb 7-1: Manufacturer: syz [ 1455.014421][ T5814] usb 7-1: SerialNumber: syz [ 1455.048892][ T5935] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 1455.198862][ T5935] usb 8-1: Using ep0 maxpacket: 16 [ 1455.201179][ T5935] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1455.201202][ T5935] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1455.204338][ T5935] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1455.204365][ T5935] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1455.204383][ T5935] usb 8-1: Product: syz [ 1455.204394][ T5935] usb 8-1: Manufacturer: syz [ 1455.204407][ T5935] usb 8-1: SerialNumber: syz [ 1455.205061][T16081] netlink: 'syz.3.2692': attribute type 83 has an invalid length. [ 1455.263921][ T5814] usb 7-1: 0:2 : does not exist [ 1455.264023][ T5814] usb 7-1: unit 6 not found! [ 1455.294373][ T5814] usb 7-1: USB disconnect, device number 42 [ 1455.575806][ T5935] usb 8-1: 0:2 : does not exist [ 1455.579657][ T5935] usb 8-1: 5:0: failed to get current value for ch 0 (-22) [ 1455.659204][ T5935] usb 8-1: USB disconnect, device number 9 [ 1457.011337][ T7909] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1458.028862][ T7909] usb 4-1: Using ep0 maxpacket: 16 [ 1458.035047][ T7909] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1458.035072][ T7909] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1458.063266][ T7909] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1458.063293][ T7909] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1458.063311][ T7909] usb 4-1: Product: syz [ 1458.063324][ T7909] usb 4-1: Manufacturer: syz [ 1458.063336][ T7909] usb 4-1: SerialNumber: syz [ 1459.585273][ T7909] usb 4-1: 0:2 : does not exist [ 1459.629775][ T7909] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 1459.666050][ T7909] usb 4-1: USB disconnect, device number 79 [ 1459.771025][T16118] netlink: 'syz.5.2703': attribute type 83 has an invalid length. [ 1460.345577][T16131] netlink: 'syz.6.2707': attribute type 16 has an invalid length. [ 1460.345620][T16131] netlink: 'syz.6.2707': attribute type 17 has an invalid length. [ 1461.018963][T16131] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1461.608933][ T5814] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 1461.790883][ T5814] usb 8-1: Using ep0 maxpacket: 16 [ 1461.793068][ T5814] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1461.793093][ T5814] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1461.795140][ T5814] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1461.795155][ T5814] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1461.795165][ T5814] usb 8-1: Product: syz [ 1461.795172][ T5814] usb 8-1: Manufacturer: syz [ 1461.795179][ T5814] usb 8-1: SerialNumber: syz [ 1463.325839][ T5814] usb 8-1: 0:2 : does not exist [ 1463.387728][ T5814] usb 8-1: 5:0: failed to get current value for ch 0 (-22) [ 1463.449572][ T5814] usb 8-1: USB disconnect, device number 10 [ 1463.546150][T16157] netlink: 'syz.6.2715': attribute type 83 has an invalid length. [ 1464.073718][T16164] netlink: 'syz.5.2716': attribute type 16 has an invalid length. [ 1464.073762][T16164] netlink: 'syz.5.2716': attribute type 17 has an invalid length. [ 1465.008802][T16167] netlink: 'syz.6.2718': attribute type 16 has an invalid length. [ 1465.008823][T16167] netlink: 'syz.6.2718': attribute type 17 has an invalid length. [ 1465.218878][T16164] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1465.356387][T16167] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1466.201303][T16179] netlink: 'syz.6.2722': attribute type 16 has an invalid length. [ 1466.201371][T16179] netlink: 'syz.6.2722': attribute type 17 has an invalid length. [ 1466.809837][ T61] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1466.829642][ T61] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1466.831156][ T61] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1466.832939][ T61] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1466.834190][ T61] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1467.148862][T16179] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1467.271032][T16184] netlink: 'syz.5.2723': attribute type 16 has an invalid length. [ 1467.271052][T16184] netlink: 'syz.5.2723': attribute type 17 has an invalid length. [ 1467.976623][T16184] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1468.699045][T16194] netlink: 'syz.6.2725': attribute type 16 has an invalid length. [ 1468.699066][T16194] netlink: 'syz.6.2725': attribute type 17 has an invalid length. [ 1469.023038][ T61] Bluetooth: hci0: command tx timeout [ 1469.628863][T16194] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1469.816020][T16199] netlink: 'syz.6.2727': attribute type 83 has an invalid length. [ 1470.380826][ T5935] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 1470.758942][ T5935] usb 7-1: Using ep0 maxpacket: 16 [ 1470.761477][ T5935] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1470.761499][ T5935] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1470.764795][ T5935] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1470.764822][ T5935] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1470.764839][ T5935] usb 7-1: Product: syz [ 1470.764852][ T5935] usb 7-1: Manufacturer: syz [ 1470.764864][ T5935] usb 7-1: SerialNumber: syz [ 1471.280584][T16215] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2730'. [ 1471.903584][ T61] Bluetooth: hci0: command tx timeout [ 1471.905313][ T5935] usb 7-1: 0:2 : does not exist [ 1471.910513][ T5935] usb 7-1: 5:0: failed to get current value for ch 0 (-22) [ 1471.960102][ T5935] usb 7-1: USB disconnect, device number 43 [ 1471.999607][ T6693] bond0: (slave syz_tun): Releasing backup interface [ 1472.479257][T16221] netlink: 'syz.5.2733': attribute type 16 has an invalid length. [ 1472.479325][T16221] netlink: 'syz.5.2733': attribute type 17 has an invalid length. [ 1473.209500][T16221] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1473.778063][T16229] netlink: 'syz.5.2737': attribute type 83 has an invalid length. [ 1474.065807][ T61] Bluetooth: hci0: command tx timeout [ 1474.265124][T16238] netlink: 'syz.5.2738': attribute type 16 has an invalid length. [ 1474.265147][T16238] netlink: 'syz.5.2738': attribute type 17 has an invalid length. [ 1475.003659][T16238] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1475.757048][T16252] netlink: 'syz.7.2742': attribute type 16 has an invalid length. [ 1475.757072][T16252] netlink: 'syz.7.2742': attribute type 17 has an invalid length. [ 1476.235112][ T61] Bluetooth: hci0: command tx timeout [ 1476.507091][ T8589] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1476.582666][T16252] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1476.583801][T16178] chnl_net:caif_netlink_parms(): no params data found [ 1477.655172][ T8589] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1479.056961][T16276] 9pnet_fd: Insufficient options for proto=fd [ 1479.265360][ T8589] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1481.253815][T16307] 9pnet_fd: Insufficient options for proto=fd [ 1481.382350][ T8589] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1481.862636][T16312] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2764'. [ 1482.899636][T16178] bridge0: port 1(bridge_slave_0) entered blocking state [ 1482.899792][T16178] bridge0: port 1(bridge_slave_0) entered disabled state [ 1482.900056][T16178] bridge_slave_0: entered allmulticast mode [ 1482.902847][T16178] bridge_slave_0: entered promiscuous mode [ 1482.938348][T16178] bridge0: port 2(bridge_slave_1) entered blocking state [ 1482.938487][T16178] bridge0: port 2(bridge_slave_1) entered disabled state [ 1482.942617][T16178] bridge_slave_1: entered allmulticast mode [ 1482.960133][T16178] bridge_slave_1: entered promiscuous mode [ 1483.002753][ T8093] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 1483.148906][ T8093] usb 8-1: Using ep0 maxpacket: 16 [ 1483.151437][ T8093] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1483.151461][ T8093] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1483.154492][ T8093] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1483.154518][ T8093] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1483.154544][ T8093] usb 8-1: Product: syz [ 1483.154557][ T8093] usb 8-1: Manufacturer: syz [ 1483.154569][ T8093] usb 8-1: SerialNumber: syz [ 1483.655822][T16333] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2770'. [ 1484.368822][ T8093] usb 8-1: 0:2 : does not exist [ 1484.442899][ T8093] usb 8-1: USB disconnect, device number 11 [ 1484.711347][T16178] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1484.869480][T16178] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1485.426465][T16178] team0: Port device team_slave_0 added [ 1485.460106][T16178] team0: Port device team_slave_1 added [ 1485.488966][ T8093] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 1485.648946][ T8093] usb 8-1: Using ep0 maxpacket: 16 [ 1485.650693][ T8093] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1485.650709][ T8093] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1485.652659][ T8093] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1485.652673][ T8093] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1485.652683][ T8093] usb 8-1: Product: syz [ 1485.652691][ T8093] usb 8-1: Manufacturer: syz [ 1485.652697][ T8093] usb 8-1: SerialNumber: syz [ 1485.828884][ T5814] usb 7-1: new high-speed USB device number 44 using dummy_hcd [ 1485.867013][ T8093] usb 8-1: 0:2 : does not exist [ 1485.899992][ T8093] usb 8-1: USB disconnect, device number 12 [ 1485.916901][ T8589] bridge_slave_1: left allmulticast mode [ 1485.916929][ T8589] bridge_slave_1: left promiscuous mode [ 1485.917164][ T8589] bridge0: port 2(bridge_slave_1) entered disabled state [ 1485.978951][ T5814] usb 7-1: Using ep0 maxpacket: 16 [ 1485.983284][ T5814] usb 7-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 1485.983310][ T5814] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1485.985744][ T5814] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1485.985769][ T5814] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1485.985787][ T5814] usb 7-1: Product: syz [ 1485.985798][ T5814] usb 7-1: Manufacturer: syz [ 1485.985811][ T5814] usb 7-1: SerialNumber: syz [ 1486.061325][ T8589] bridge_slave_0: left allmulticast mode [ 1486.061414][ T8589] bridge_slave_0: left promiscuous mode [ 1486.061820][ T8589] bridge0: port 1(bridge_slave_0) entered disabled state [ 1486.873366][ T5814] usb 7-1: 0:2 : does not exist [ 1487.243111][ T5814] usb 7-1: 5:0: failed to get current value for ch 0 (-22) [ 1487.348174][ T5814] usb 7-1: USB disconnect, device number 44 [ 1490.589524][ T8589] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1490.652691][ T8589] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1490.712278][ T8589] bond0 (unregistering): (slave team0): Releasing backup interface [ 1490.736319][ T8589] bond0 (unregistering): Released all slaves [ 1490.760185][T16178] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1490.760203][T16178] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1490.760227][T16178] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1490.809941][T16178] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1490.809958][T16178] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1490.809982][T16178] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1491.609484][ T8093] usb 7-1: new high-speed USB device number 45 using dummy_hcd [ 1492.351040][T16178] hsr_slave_0: entered promiscuous mode [ 1492.352434][T16178] hsr_slave_1: entered promiscuous mode [ 1492.353370][T16178] debugfs: 'hsr0' already exists in 'hsr' [ 1492.353392][T16178] Cannot create hsr debugfs directory [ 1492.481749][ T8093] usb 7-1: Using ep0 maxpacket: 16 [ 1492.485213][ T8093] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1492.485237][ T8093] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1492.488323][ T8093] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1492.488349][ T8093] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1492.488368][ T8093] usb 7-1: Product: syz [ 1492.488381][ T8093] usb 7-1: Manufacturer: syz [ 1492.488394][ T8093] usb 7-1: SerialNumber: syz [ 1492.847306][ T8093] usb 7-1: 0:2 : does not exist [ 1492.857285][ T8093] usb 7-1: 5:0: failed to get current value for ch 0 (-22) [ 1492.913935][ T8093] usb 7-1: USB disconnect, device number 45 [ 1494.096547][ C0] vkms_vblank_simulate: vblank timer overrun [ 1494.138966][ T5814] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 1494.288841][ T5814] usb 7-1: Using ep0 maxpacket: 16 [ 1494.290869][ T5814] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1494.290890][ T5814] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1494.296595][ T5814] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1494.296620][ T5814] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1494.296637][ T5814] usb 7-1: Product: syz [ 1494.296649][ T5814] usb 7-1: Manufacturer: syz [ 1494.296660][ T5814] usb 7-1: SerialNumber: syz [ 1494.419817][ C0] vkms_vblank_simulate: vblank timer overrun [ 1494.571865][ T8589] hsr_slave_0: left promiscuous mode [ 1494.587834][ T5814] usb 7-1: 0:2 : does not exist [ 1494.587938][ T5814] usb 7-1: unit 6 not found! [ 1494.623354][ T5814] usb 7-1: USB disconnect, device number 46 [ 1494.626459][ T8589] hsr_slave_1: left promiscuous mode [ 1494.627607][ T8589] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1494.627631][ T8589] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1494.685347][ T8589] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1494.685375][ T8589] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1494.816839][ T8589] veth1_macvtap: left promiscuous mode [ 1494.817068][ T8589] veth0_macvtap: left promiscuous mode [ 1494.817333][ T8589] veth1_vlan: left promiscuous mode [ 1494.817519][ T8589] veth0_vlan: left promiscuous mode [ 1494.846242][ T1323] ieee802154 phy0 wpan0: encryption failed: -22 [ 1494.846334][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 1495.108951][ T5981] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 1495.164186][ C0] vkms_vblank_simulate: vblank timer overrun [ 1495.281019][ T5981] usb 6-1: config index 0 descriptor too short (expected 44306, got 18) [ 1495.281047][ T5981] usb 6-1: config 0 has too many interfaces: 140, using maximum allowed: 32 [ 1495.281065][ T5981] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 140 [ 1495.281084][ T5981] usb 6-1: config 0 has no interface number 0 [ 1495.281131][ T5981] usb 6-1: New USB device found, idVendor=24cf, idProduct=59e4, bcdDevice= 9.22 [ 1495.281152][ T5981] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1495.285083][ T5981] usb 6-1: config 0 descriptor?? [ 1495.292530][ T5981] usb-storage 6-1:0.33: USB Mass Storage device detected [ 1495.392491][ C0] vkms_vblank_simulate: vblank timer overrun [ 1495.443118][ C0] vkms_vblank_simulate: vblank timer overrun [ 1495.478233][ C0] vkms_vblank_simulate: vblank timer overrun [ 1495.697742][ C0] vkms_vblank_simulate: vblank timer overrun [ 1495.900142][ C0] vkms_vblank_simulate: vblank timer overrun [ 1496.737216][ C0] vkms_vblank_simulate: vblank timer overrun [ 1497.078746][ C0] vkms_vblank_simulate: vblank timer overrun [ 1497.166714][ C0] vkms_vblank_simulate: vblank timer overrun [ 1497.206682][ C0] vkms_vblank_simulate: vblank timer overrun [ 1497.265847][ C0] vkms_vblank_simulate: vblank timer overrun [ 1497.398030][ C0] vkms_vblank_simulate: vblank timer overrun [ 1497.450078][ C0] vkms_vblank_simulate: vblank timer overrun [ 1497.519888][ C0] vkms_vblank_simulate: vblank timer overrun [ 1497.581109][ C0] vkms_vblank_simulate: vblank timer overrun [ 1497.648658][ C0] vkms_vblank_simulate: vblank timer overrun [ 1497.716118][ C0] vkms_vblank_simulate: vblank timer overrun [ 1497.769709][ C0] vkms_vblank_simulate: vblank timer overrun [ 1497.955668][T16100] usb 6-1: USB disconnect, device number 62 [ 1498.001933][ C0] vkms_vblank_simulate: vblank timer overrun [ 1498.072603][ C0] vkms_vblank_simulate: vblank timer overrun [ 1498.155435][ C0] vkms_vblank_simulate: vblank timer overrun [ 1498.210232][ C0] vkms_vblank_simulate: vblank timer overrun [ 1498.270434][ C0] vkms_vblank_simulate: vblank timer overrun [ 1498.336491][ C0] vkms_vblank_simulate: vblank timer overrun [ 1498.402116][ C0] vkms_vblank_simulate: vblank timer overrun [ 1498.540185][ C0] vkms_vblank_simulate: vblank timer overrun [ 1498.610027][ C0] vkms_vblank_simulate: vblank timer overrun [ 1498.724146][ C0] vkms_vblank_simulate: vblank timer overrun [ 1499.012915][ T8589] team0 (unregistering): Port device team_slave_1 removed [ 1499.299665][ T8589] team0 (unregistering): Port device team_slave_0 removed [ 1503.428961][T15271] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 1503.611686][T15271] usb 8-1: config index 0 descriptor too short (expected 44306, got 18) [ 1503.611714][T15271] usb 8-1: config 0 has too many interfaces: 140, using maximum allowed: 32 [ 1503.611732][T15271] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 140 [ 1503.611750][T15271] usb 8-1: config 0 has no interface number 0 [ 1503.611801][T15271] usb 8-1: New USB device found, idVendor=24cf, idProduct=59e4, bcdDevice= 9.22 [ 1503.611821][T15271] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1503.616976][T15271] usb 8-1: config 0 descriptor?? [ 1503.629477][T15271] usb-storage 8-1:0.33: USB Mass Storage device detected [ 1503.727633][ T8589] IPVS: stop unused estimator thread 0... [ 1504.325084][T16178] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1504.530216][T16178] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1505.357636][T16178] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1506.960249][T16178] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1507.390735][ T5935] usb 8-1: USB disconnect, device number 13 [ 1509.967010][T16521] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2834'. [ 1510.813193][T16178] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1510.970810][T16178] 8021q: adding VLAN 0 to HW filter on device team0 [ 1511.001690][ T9208] bridge0: port 1(bridge_slave_0) entered blocking state [ 1511.007830][ T9208] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1511.263026][ T8594] bridge0: port 2(bridge_slave_1) entered blocking state [ 1511.263173][ T8594] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1517.493539][T16178] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1522.699020][T16589] netlink: 'syz.7.2848': attribute type 16 has an invalid length. [ 1522.699040][T16589] netlink: 'syz.7.2848': attribute type 17 has an invalid length. [ 1522.963503][T16589] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1524.049107][T16178] veth0_vlan: entered promiscuous mode [ 1524.624418][T16178] veth1_vlan: entered promiscuous mode [ 1527.248898][T15271] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 1527.406186][T15271] usb 8-1: Using ep0 maxpacket: 16 [ 1527.701634][T15271] usb 8-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 1527.701660][T15271] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1527.712233][T15271] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1527.712260][T15271] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1527.712278][T15271] usb 8-1: Product: syz [ 1527.712291][T15271] usb 8-1: Manufacturer: syz [ 1527.712303][T15271] usb 8-1: SerialNumber: syz [ 1527.817728][T16624] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2857'. [ 1527.894457][ T5935] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 1528.238888][ T5935] usb 6-1: Using ep0 maxpacket: 16 [ 1528.241475][ T5935] usb 6-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 1528.241498][ T5935] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1528.246474][ T5935] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1528.246499][ T5935] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1528.246518][ T5935] usb 6-1: Product: syz [ 1528.246530][ T5935] usb 6-1: Manufacturer: syz [ 1528.246543][ T5935] usb 6-1: SerialNumber: syz [ 1528.331507][T11176] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1528.353057][T11176] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1528.354553][T11176] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1528.355710][T11176] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1528.356502][T11176] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1528.552845][T15271] usb 8-1: 0:2 : does not exist [ 1528.589301][T15271] usb 8-1: USB disconnect, device number 14 [ 1528.732605][ T5935] usb 6-1: 0:2 : does not exist [ 1528.752374][ T5935] usb 6-1: USB disconnect, device number 63 [ 1529.963574][T16625] chnl_net:caif_netlink_parms(): no params data found [ 1530.440835][ T61] Bluetooth: hci2: command tx timeout [ 1530.955208][T16662] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2872'. [ 1532.768885][ T61] Bluetooth: hci2: command tx timeout [ 1532.774235][ T5935] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 1532.919034][ T5935] usb 6-1: Using ep0 maxpacket: 16 [ 1532.920631][ T5935] usb 6-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 1532.920645][ T5935] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1532.922879][ T5935] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1532.922894][ T5935] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1532.922903][ T5935] usb 6-1: Product: syz [ 1532.922911][ T5935] usb 6-1: Manufacturer: syz [ 1532.922917][ T5935] usb 6-1: SerialNumber: syz [ 1533.360813][ T5935] usb 6-1: 0:2 : does not exist [ 1533.360923][ T5935] usb 6-1: unit 6 not found! [ 1533.404612][ T5935] usb 6-1: USB disconnect, device number 64 [ 1534.848898][T11176] Bluetooth: hci2: command tx timeout [ 1534.851860][T16625] bridge0: port 1(bridge_slave_0) entered blocking state [ 1534.851990][T16625] bridge0: port 1(bridge_slave_0) entered disabled state [ 1534.852567][T16625] bridge_slave_0: entered allmulticast mode [ 1534.855445][T16625] bridge_slave_0: entered promiscuous mode [ 1534.861956][T16625] bridge0: port 2(bridge_slave_1) entered blocking state [ 1534.862110][T16625] bridge0: port 2(bridge_slave_1) entered disabled state [ 1534.862313][T16625] bridge_slave_1: entered allmulticast mode [ 1534.888468][T16625] bridge_slave_1: entered promiscuous mode [ 1536.930066][T11176] Bluetooth: hci2: command tx timeout [ 1536.990524][T16625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1537.578705][T16625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1537.960647][T11176] Bluetooth: hci3: command 0x0406 tx timeout [ 1538.307328][T16625] team0: Port device team_slave_0 added [ 1538.550973][T16740] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2895'. [ 1539.236672][T14120] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1539.254569][T16625] team0: Port device team_slave_1 added [ 1539.643554][T14120] usb 4-1: Using ep0 maxpacket: 16 [ 1539.645744][T14120] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1539.645758][T14120] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1540.635610][T14120] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1540.635636][T14120] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1540.635652][T14120] usb 4-1: Product: syz [ 1540.635663][T14120] usb 4-1: Manufacturer: syz [ 1540.635675][T14120] usb 4-1: SerialNumber: syz [ 1541.590597][T14120] usb 4-1: 0:2 : does not exist [ 1541.632455][T16625] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1541.632472][T16625] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1541.632497][T16625] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1541.701570][T16625] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1541.701588][T16625] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1541.701970][T16625] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1541.702271][T14120] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 1541.848369][T14120] usb 4-1: USB disconnect, device number 80 [ 1543.475688][T16625] hsr_slave_0: entered promiscuous mode [ 1543.477029][T16625] hsr_slave_1: entered promiscuous mode [ 1543.610978][ T8308] bridge_slave_1: left allmulticast mode [ 1543.611007][ T8308] bridge_slave_1: left promiscuous mode [ 1543.611235][ T8308] bridge0: port 2(bridge_slave_1) entered disabled state [ 1543.702996][ T8308] bridge_slave_0: left allmulticast mode [ 1543.703026][ T8308] bridge_slave_0: left promiscuous mode [ 1543.703315][ T8308] bridge0: port 1(bridge_slave_0) entered disabled state [ 1546.451085][ T8308] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1546.529695][ T8308] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1546.576999][ T8308] bond0 (unregistering): Released all slaves [ 1546.793461][T16904] netlink: 1752 bytes leftover after parsing attributes in process `syz.5.2970'. [ 1548.150192][ T8308] hsr_slave_0: left promiscuous mode [ 1548.188942][ T8308] hsr_slave_1: left promiscuous mode [ 1548.189932][ T8308] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1548.220776][ T8308] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1548.333383][ T8308] veth1_vlan: left promiscuous mode [ 1548.333646][ T8308] veth0_vlan: left promiscuous mode [ 1549.641370][T16965] overlay: Unknown parameter '\' [ 1549.676701][T16965] tmpfs: Unknown parameter 'uota' [ 1550.028186][ T5932] kernel read not supported for file /dsp (pid: 5932 comm: kworker/0:6) [ 1550.228945][ T8093] usb 7-1: new full-speed USB device number 47 using dummy_hcd [ 1550.412069][ T8093] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1550.412695][ T8093] usb 7-1: not running at top speed; connect to a high speed hub [ 1550.414254][ T8093] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1550.414281][ T8093] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1550.418491][ T8093] usb 7-1: string descriptor 0 read error: -22 [ 1550.418611][ T8093] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1550.418633][ T8093] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1550.532330][ T8093] usb 7-1: 0:2 : does not exist [ 1550.789472][ T8093] usb 7-1: 5:0: cannot get min/max values for control 2 (id 5) [ 1550.807147][ T8093] usb 7-1: 5:0: cannot get min/max values for control 3 (id 5) [ 1550.822089][ T8093] usb 7-1: 5:0: failed to get current value for ch 1 (-22) [ 1550.866489][ T8093] usb 7-1: 5:0: cannot get min/max values for control 3 (id 5) [ 1550.892532][ T8093] usb 7-1: 5:0: cannot get min/max values for control 2 (id 5) [ 1550.896917][ T8093] usb 7-1: USB disconnect, device number 47 [ 1551.339617][ T8308] team0 (unregistering): Port device team_slave_1 removed [ 1551.680004][ T8308] team0 (unregistering): Port device team_slave_0 removed [ 1554.631297][T17063] FAULT_INJECTION: forcing a failure. [ 1554.631297][T17063] name failslab, interval 1, probability 0, space 0, times 0 [ 1554.631324][T17063] CPU: 1 UID: 0 PID: 17063 Comm: syz.6.3043 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1554.631336][T17063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1554.631343][T17063] Call Trace: [ 1554.631348][T17063] [ 1554.631353][T17063] dump_stack_lvl+0x189/0x250 [ 1554.631380][T17063] ? __pfx____ratelimit+0x10/0x10 [ 1554.631473][T17063] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1554.631487][T17063] ? __pfx__printk+0x10/0x10 [ 1554.631511][T17063] ? __pfx___might_resched+0x10/0x10 [ 1554.631547][T17063] ? fs_reclaim_acquire+0x7d/0x100 [ 1554.631565][T17063] should_fail_ex+0x46c/0x600 [ 1554.631602][T17063] ? __alloc_skb+0x112/0x2d0 [ 1554.631675][T17063] should_failslab+0xa8/0x100 [ 1554.631690][T17063] ? __alloc_skb+0x112/0x2d0 [ 1554.631699][T17063] kmem_cache_alloc_node_noprof+0x78/0x6e0 [ 1554.631712][T17063] ? ib_device_get_by_netdev+0x84/0x4d0 [ 1554.631764][T17063] ? hsr_netdev_notify+0x29e/0xcf0 [ 1554.631816][T17063] ? __pfx_ib_device_get_by_netdev+0x10/0x10 [ 1554.631835][T17063] __alloc_skb+0x112/0x2d0 [ 1554.631848][T17063] team_nl_send_options_get+0x15e/0x10a0 [ 1554.631933][T17063] ? __pfx_team_nl_send_multicast+0x10/0x10 [ 1554.631950][T17063] ? __pfx_netdev_lower_state_changed+0x10/0x10 [ 1554.631991][T17063] ? __pfx_team_nl_send_options_get+0x10/0x10 [ 1554.632010][T17063] ? netif_carrier_on+0xea/0x130 [ 1554.632051][T17063] ? team_user_linkup_en_option_set+0x2c3/0x3d0 [ 1554.632067][T17063] ? __pfx_team_user_linkup_en_option_set+0x10/0x10 [ 1554.632088][T17063] team_nl_options_set_doit+0xb39/0xde0 [ 1554.632101][T17063] ? __pfx___nla_validate_parse+0x10/0x10 [ 1554.632125][T17063] ? __pfx_team_nl_options_set_doit+0x10/0x10 [ 1554.632149][T17063] ? __nla_parse+0x40/0x60 [ 1554.632165][T17063] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 1554.632216][T17063] genl_family_rcv_msg_doit+0x215/0x300 [ 1554.632233][T17063] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1554.632254][T17063] ? bpf_lsm_capable+0x9/0x20 [ 1554.632273][T17063] ? security_capable+0x7e/0x2e0 [ 1554.632299][T17063] genl_rcv_msg+0x60e/0x790 [ 1554.632316][T17063] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1554.632328][T17063] ? __pfx_team_nl_options_set_doit+0x10/0x10 [ 1554.632343][T17063] ? __lock_acquire+0xab9/0xd20 [ 1554.632361][T17063] netlink_rcv_skb+0x208/0x470 [ 1554.632373][T17063] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1554.632387][T17063] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1554.632406][T17063] ? netlink_deliver_tap+0x2e/0x1b0 [ 1554.632416][T17063] ? netlink_deliver_tap+0x2e/0x1b0 [ 1554.632428][T17063] genl_rcv+0x28/0x40 [ 1554.632440][T17063] netlink_unicast+0x846/0xa10 [ 1554.632455][T17063] ? __pfx_netlink_unicast+0x10/0x10 [ 1554.632465][T17063] ? netlink_sendmsg+0x642/0xb30 [ 1554.632475][T17063] ? skb_put+0x11b/0x210 [ 1554.632487][T17063] netlink_sendmsg+0x805/0xb30 [ 1554.632512][T17063] ? is_bpf_text_address+0x26/0x2b0 [ 1554.632552][T17063] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1554.632567][T17063] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1554.632582][T17063] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1554.632593][T17063] __sock_sendmsg+0x21c/0x270 [ 1554.632649][T17063] ____sys_sendmsg+0x508/0x820 [ 1554.632685][T17063] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1554.632702][T17063] ? import_iovec+0x74/0xa0 [ 1554.632723][T17063] ___sys_sendmsg+0x21f/0x2a0 [ 1554.632737][T17063] ? __pfx____sys_sendmsg+0x10/0x10 [ 1554.632770][T17063] ? __fget_files+0x2a/0x420 [ 1554.632784][T17063] ? __fget_files+0x3a6/0x420 [ 1554.632803][T17063] __x64_sys_sendmsg+0x1a1/0x260 [ 1554.632816][T17063] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1554.632834][T17063] ? __pfx_ksys_write+0x10/0x10 [ 1554.632849][T17063] ? do_syscall_64+0xbe/0xfa0 [ 1554.632865][T17063] do_syscall_64+0xfa/0xfa0 [ 1554.632878][T17063] ? lockdep_hardirqs_on+0x9c/0x150 [ 1554.632893][T17063] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1554.632904][T17063] ? clear_bhb_loop+0x60/0xb0 [ 1554.632916][T17063] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1554.632925][T17063] RIP: 0033:0x7fac5941f749 [ 1554.632936][T17063] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1554.632945][T17063] RSP: 002b:00007fac5767e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1554.632957][T17063] RAX: ffffffffffffffda RBX: 00007fac59675fa0 RCX: 00007fac5941f749 [ 1554.632965][T17063] RDX: 0000000024040014 RSI: 0000200000000240 RDI: 0000000000000004 [ 1554.632971][T17063] RBP: 00007fac5767e090 R08: 0000000000000000 R09: 0000000000000000 [ 1554.632977][T17063] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1554.632983][T17063] R13: 00007fac59676038 R14: 00007fac59675fa0 R15: 00007ffe6bbb8958 [ 1554.633000][T17063] [ 1555.098945][ T7909] usb 6-1: new full-speed USB device number 65 using dummy_hcd [ 1555.254022][ T7909] usb 6-1: config 0 has an invalid interface number: 151 but max is 0 [ 1555.254049][ T7909] usb 6-1: config 0 has no interface number 0 [ 1555.254096][ T7909] usb 6-1: config 0 interface 151 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 1555.258515][ T7909] usb 6-1: New USB device found, idVendor=0499, idProduct=6bb7, bcdDevice=68.2f [ 1555.258542][ T7909] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1555.258559][ T7909] usb 6-1: Product: syz [ 1555.258571][ T7909] usb 6-1: Manufacturer: syz [ 1555.258582][ T7909] usb 6-1: SerialNumber: syz [ 1555.268152][ T7909] usb 6-1: config 0 descriptor?? [ 1555.376711][ T5814] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 1555.387890][ T8093] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 1555.559708][ T5814] usb 8-1: Using ep0 maxpacket: 16 [ 1555.562686][ T5814] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1555.562710][ T5814] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1555.568978][ T8093] usb 4-1: Using ep0 maxpacket: 32 [ 1555.569178][ T5814] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1555.569196][ T5814] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1555.569265][ T5814] usb 8-1: Product: syz [ 1555.569278][ T5814] usb 8-1: Manufacturer: syz [ 1555.569290][ T5814] usb 8-1: SerialNumber: syz [ 1555.571300][ T8093] usb 4-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1555.571325][ T8093] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1555.659125][ T8093] usb 4-1: config 0 descriptor?? [ 1555.674573][ T8093] as10x_usb: device has been detected [ 1555.675476][ T8093] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 1555.731167][ T8093] usb 4-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 1555.744242][T17068] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 1555.744800][T17068] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 1555.872933][ T8093] as10x_usb: error during firmware upload part1 [ 1555.873688][ T8093] Registered device nBox DVB-T Dongle [ 1555.886670][ T8093] usb 4-1: USB disconnect, device number 81 [ 1555.963219][ T8093] Unregistered device nBox DVB-T Dongle [ 1555.968482][ T8093] as10x_usb: device has been disconnected [ 1556.115420][ T7909] usb 6-1: USB disconnect, device number 65 [ 1556.115801][ T5814] usb 8-1: 0:2 : does not exist [ 1556.121684][ T5814] usb 8-1: 5:0: failed to get current value for ch 0 (-22) [ 1556.160492][ T5814] usb 8-1: USB disconnect, device number 15 [ 1556.284288][ T1323] ieee802154 phy0 wpan0: encryption failed: -22 [ 1556.284376][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 1556.429024][ T8093] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 1556.568970][ T8093] usb 4-1: device descriptor read/64, error -71 [ 1556.965825][ T8093] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 1557.344342][ T8093] usb 4-1: device descriptor read/64, error -71 [ 1557.450849][ T8093] usb usb4-port1: attempt power cycle [ 1557.702492][T16625] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1557.745878][T16625] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1557.805840][T16625] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1557.869198][ T8093] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 1557.892872][ T8093] usb 4-1: device descriptor read/8, error -71 [ 1557.893519][T16625] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1557.902276][T17133] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3074'. [ 1557.963004][T17138] Illegal XDP return value 4294967274 on prog (id 381) dev N/A, expect packet loss! [ 1558.128930][ T8093] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 1558.167951][ T8093] usb 4-1: device descriptor read/8, error -71 [ 1558.269387][ T8093] usb usb4-port1: unable to enumerate USB device [ 1558.362318][T16625] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1558.390793][T16625] 8021q: adding VLAN 0 to HW filter on device team0 [ 1558.424917][T15405] bridge0: port 1(bridge_slave_0) entered blocking state [ 1558.425118][T15405] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1558.454500][ T9204] bridge0: port 2(bridge_slave_1) entered blocking state [ 1558.456253][ T9204] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1559.124677][T17177] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3087'. [ 1560.186463][T16625] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1563.636668][T16625] veth0_vlan: entered promiscuous mode [ 1563.664631][T16625] veth1_vlan: entered promiscuous mode [ 1563.763744][T16625] veth0_macvtap: entered promiscuous mode [ 1563.782513][T16625] veth1_macvtap: entered promiscuous mode [ 1563.813506][T16625] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1563.833322][T16625] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1563.852559][T15404] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.852838][T15404] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.852943][T15404] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.852977][T15404] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.858942][T16100] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 1564.275535][T17255] netlink: 'syz.3.3116': attribute type 1 has an invalid length. [ 1564.935494][T16100] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1564.935556][T16100] usb 8-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1564.935579][T16100] usb 8-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1564.959422][T16100] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1564.959449][T16100] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1564.959466][T16100] usb 8-1: Product: syz [ 1564.959479][T16100] usb 8-1: Manufacturer: syz [ 1564.959492][T16100] usb 8-1: SerialNumber: syz [ 1565.115567][T16100] cdc_mbim 8-1:1.0: skipping garbage [ 1565.629601][T17228] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1567.374984][T16100] cdc_mbim 8-1:1.0: failed GET_NTB_PARAMETERS [ 1567.375036][T16100] cdc_mbim 8-1:1.0: bind() failure [ 1567.388640][T16100] cdc_ncm 8-1:1.1: CDC Union missing and no IAD found [ 1567.388671][T16100] cdc_ncm 8-1:1.1: bind() failure [ 1567.408974][T16100] usb 8-1: USB disconnect, device number 16 [ 1567.421775][T17261] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3122'. [ 1567.511417][T15405] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1567.511438][T15405] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1567.700538][ T9207] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1567.700560][ T9207] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1567.708962][ T5955] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 1567.881958][ T5955] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1567.881984][ T5955] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1567.882037][ T5955] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1567.894490][ T5955] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1567.894523][ T5955] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1567.894538][ T5955] usb 4-1: Product: syz [ 1567.894549][ T5955] usb 4-1: Manufacturer: syz [ 1567.894561][ T5955] usb 4-1: SerialNumber: syz [ 1567.905479][ T5955] cdc_ncm 4-1:1.0: skipping garbage [ 1567.905505][ T5955] cdc_ncm 4-1:1.0: invalid descriptor buffer length [ 1567.905519][ T5955] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 1567.905556][ T5955] cdc_ncm 4-1:1.0: bind() failure [ 1568.197681][ T8093] usb 4-1: USB disconnect, device number 86 [ 1568.473518][ C0] vkms_vblank_simulate: vblank timer overrun [ 1568.489040][ T5955] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 1568.781416][T17287] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3131'. [ 1569.365764][ C0] vkms_vblank_simulate: vblank timer overrun [ 1569.429046][ T5955] usb 6-1: config 1 has an invalid interface number: 7 but max is 0 [ 1569.429083][ T5955] usb 6-1: config 1 has no interface number 0 [ 1569.429134][ T5955] usb 6-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 1569.429165][ T5955] usb 6-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 1569.429194][ T5955] usb 6-1: config 1 interface 7 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1569.434053][ T5955] usb 6-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 1569.434085][ T5955] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1569.434108][ T5955] usb 6-1: Product: syz [ 1569.434122][ T5955] usb 6-1: Manufacturer: syz [ 1569.434133][ T5955] usb 6-1: SerialNumber: syz [ 1569.534082][T17276] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1569.653214][ C0] vkms_vblank_simulate: vblank timer overrun [ 1569.822715][T11176] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1569.833751][ T5955] usb 6-1: Error in usbnet_get_endpoints (-71) [ 1569.845739][T11176] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1569.858559][T11176] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1569.871521][T11176] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1569.877871][ T5955] usb 6-1: USB disconnect, device number 66 [ 1569.878666][T11176] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1570.505375][T17300] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3135'. [ 1571.961413][T11176] Bluetooth: hci0: command tx timeout [ 1572.099961][T17288] chnl_net:caif_netlink_parms(): no params data found [ 1573.232039][T17308] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3137'. [ 1573.355106][T17315] sctp: [Deprecated]: syz.3.3140 (pid 17315) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1573.355106][T17315] Use struct sctp_sack_info instead [ 1573.355302][T17316] sctp: [Deprecated]: syz.3.3140 (pid 17316) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1573.355302][T17316] Use struct sctp_sack_info instead [ 1573.420761][ T6995] bond0: (slave syz_tun): Releasing backup interface [ 1573.548873][ T5932] usb 5-1: new low-speed USB device number 66 using dummy_hcd [ 1573.718934][ T5932] usb 5-1: device descriptor read/64, error -71 [ 1573.899065][T14120] usb 6-1: new full-speed USB device number 67 using dummy_hcd [ 1573.967148][ T5932] usb 5-1: new low-speed USB device number 67 using dummy_hcd [ 1574.038999][T11176] Bluetooth: hci0: command tx timeout [ 1574.048979][T14120] usb 6-1: device descriptor read/64, error -71 [ 1574.119089][ T5932] usb 5-1: device descriptor read/64, error -71 [ 1574.220654][ C1] vkms_vblank_simulate: vblank timer overrun [ 1574.231961][ T5932] usb usb5-port1: attempt power cycle [ 1574.263748][T15407] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1574.289007][T14120] usb 6-1: new full-speed USB device number 68 using dummy_hcd [ 1574.313914][T17288] bridge0: port 1(bridge_slave_0) entered blocking state [ 1574.314133][T17288] bridge0: port 1(bridge_slave_0) entered disabled state [ 1574.314366][T17288] bridge_slave_0: entered allmulticast mode [ 1574.317219][T17288] bridge_slave_0: entered promiscuous mode [ 1574.350194][T17288] bridge0: port 2(bridge_slave_1) entered blocking state [ 1574.350399][T17288] bridge0: port 2(bridge_slave_1) entered disabled state [ 1574.350625][T17288] bridge_slave_1: entered allmulticast mode [ 1574.350950][T17337] workqueue: name exceeds WQ_NAME_LEN. Truncating to: 1^!l1*$pOcɔr$G [ 1574.352919][T17288] bridge_slave_1: entered promiscuous mode [ 1574.421292][T14120] usb 6-1: device descriptor read/64, error -71 [ 1574.532140][T14120] usb usb6-port1: attempt power cycle [ 1574.569087][ T5932] usb 5-1: new low-speed USB device number 68 using dummy_hcd [ 1574.595176][ T5932] usb 5-1: device descriptor read/8, error -71 [ 1574.913301][ T5932] usb 5-1: new low-speed USB device number 69 using dummy_hcd [ 1574.936362][ T5932] usb 5-1: device descriptor read/8, error -71 [ 1574.969915][T14120] usb 6-1: new full-speed USB device number 69 using dummy_hcd [ 1574.993293][T14120] usb 6-1: device descriptor read/8, error -71 [ 1575.112562][ T5932] usb usb5-port1: unable to enumerate USB device [ 1575.313553][T14120] usb 6-1: new full-speed USB device number 70 using dummy_hcd [ 1575.368021][T14120] usb 6-1: device descriptor read/8, error -71 [ 1575.570202][T14120] usb usb6-port1: unable to enumerate USB device [ 1576.126386][ C1] vkms_vblank_simulate: vblank timer overrun [ 1576.129396][T11176] Bluetooth: hci0: command tx timeout [ 1576.152571][T15407] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1576.248454][T17288] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1576.347695][T17288] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1576.647608][ C1] vkms_vblank_simulate: vblank timer overrun [ 1576.687624][T15407] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1576.915583][T17288] team0: Port device team_slave_0 added [ 1577.049485][ C1] vkms_vblank_simulate: vblank timer overrun [ 1577.075011][T15407] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1577.128017][T17288] team0: Port device team_slave_1 added [ 1577.286913][T17365] FAULT_INJECTION: forcing a failure. [ 1577.286913][T17365] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 1577.286946][T17365] CPU: 0 UID: 0 PID: 17365 Comm: syz.3.3160 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1577.286966][T17365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1577.286976][T17365] Call Trace: [ 1577.286983][T17365] [ 1577.286992][T17365] dump_stack_lvl+0x189/0x250 [ 1577.287022][T17365] ? __pfx____ratelimit+0x10/0x10 [ 1577.287046][T17365] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1577.287068][T17365] ? __pfx__printk+0x10/0x10 [ 1577.287087][T17365] ? __might_fault+0xb0/0x130 [ 1577.287120][T17365] should_fail_ex+0x46c/0x600 [ 1577.287153][T17365] _copy_from_user+0x2d/0xb0 [ 1577.287174][T17365] ___sys_sendmsg+0x158/0x2a0 [ 1577.287198][T17365] ? __pfx____sys_sendmsg+0x10/0x10 [ 1577.287249][T17365] ? __fget_files+0x2a/0x420 [ 1577.287269][T17365] ? __fget_files+0x3a6/0x420 [ 1577.287301][T17365] __x64_sys_sendmsg+0x1a1/0x260 [ 1577.287325][T17365] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1577.287355][T17365] ? __pfx_ksys_write+0x10/0x10 [ 1577.287379][T17365] ? do_syscall_64+0xbe/0xfa0 [ 1577.287406][T17365] do_syscall_64+0xfa/0xfa0 [ 1577.287427][T17365] ? lockdep_hardirqs_on+0x9c/0x150 [ 1577.287448][T17365] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1577.287465][T17365] ? clear_bhb_loop+0x60/0xb0 [ 1577.287486][T17365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1577.287503][T17365] RIP: 0033:0x7fe8383bf749 [ 1577.287519][T17365] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1577.287535][T17365] RSP: 002b:00007fe83661e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1577.287555][T17365] RAX: ffffffffffffffda RBX: 00007fe838615fa0 RCX: 00007fe8383bf749 [ 1577.287568][T17365] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1577.287580][T17365] RBP: 00007fe83661e090 R08: 0000000000000000 R09: 0000000000000000 [ 1577.287591][T17365] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1577.287602][T17365] R13: 00007fe838616038 R14: 00007fe838615fa0 R15: 00007ffcd6d88568 [ 1577.287632][T17365] [ 1577.556053][ C1] vkms_vblank_simulate: vblank timer overrun [ 1577.716997][ C1] vkms_vblank_simulate: vblank timer overrun [ 1577.863221][T17375] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3159'. [ 1577.864601][ C1] vkms_vblank_simulate: vblank timer overrun [ 1578.039994][ C1] vkms_vblank_simulate: vblank timer overrun [ 1578.272199][ C1] vkms_vblank_simulate: vblank timer overrun [ 1578.295315][T11176] Bluetooth: hci0: command tx timeout [ 1580.180024][T17288] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1580.180042][T17288] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1580.180069][T17288] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1580.182578][T17288] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1580.182592][T17288] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1580.182623][T17288] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1580.672521][T17288] hsr_slave_0: entered promiscuous mode [ 1580.674017][T17288] hsr_slave_1: entered promiscuous mode [ 1580.680002][T17288] debugfs: 'hsr0' already exists in 'hsr' [ 1580.680030][T17288] Cannot create hsr debugfs directory [ 1580.941881][T17411] ieee802154 phy0 wpan0: encryption failed: -22 [ 1581.458694][T17426] openvswitch: netlink: Message has 1 unknown bytes. [ 1581.460807][T17426] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1584.019018][T15407] bridge_slave_1: left allmulticast mode [ 1584.019046][T15407] bridge_slave_1: left promiscuous mode [ 1584.019323][T15407] bridge0: port 2(bridge_slave_1) entered disabled state [ 1584.110542][T15407] bridge_slave_0: left allmulticast mode [ 1584.110572][T15407] bridge_slave_0: left promiscuous mode [ 1584.110836][T15407] bridge0: port 1(bridge_slave_0) entered disabled state [ 1584.114452][T17439] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3184'. [ 1586.689678][T15407] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1586.770148][T15407] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1586.829603][T15407] bond0 (unregistering): (slave team0): Releasing backup interface [ 1586.851822][T15407] bond0 (unregistering): Released all slaves [ 1586.910895][T17439] netlink: 'syz.4.3184': attribute type 1 has an invalid length. [ 1587.164705][T17450] FAULT_INJECTION: forcing a failure. [ 1587.164705][T17450] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1587.164734][T17450] CPU: 1 UID: 0 PID: 17450 Comm: syz.4.3189 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1587.164750][T17450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1587.164759][T17450] Call Trace: [ 1587.164765][T17450] [ 1587.164772][T17450] dump_stack_lvl+0x189/0x250 [ 1587.164800][T17450] ? __pfx____ratelimit+0x10/0x10 [ 1587.164821][T17450] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1587.164839][T17450] ? __pfx__printk+0x10/0x10 [ 1587.164856][T17450] ? __might_fault+0xb0/0x130 [ 1587.164895][T17450] should_fail_ex+0x46c/0x600 [ 1587.164921][T17450] _copy_from_user+0x2d/0xb0 [ 1587.164939][T17450] __sys_bpf+0x1e3/0x860 [ 1587.164992][T17450] ? __pfx___sys_bpf+0x10/0x10 [ 1587.165010][T17450] ? rt_mutex_slowunlock+0x1be/0x2e0 [ 1587.165157][T17450] ? ksys_write+0x230/0x260 [ 1587.165179][T17450] ? __pfx_ksys_write+0x10/0x10 [ 1587.165200][T17450] __x64_sys_bpf+0x7c/0x90 [ 1587.165219][T17450] do_syscall_64+0xfa/0xfa0 [ 1587.165238][T17450] ? lockdep_hardirqs_on+0x9c/0x150 [ 1587.165257][T17450] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1587.165273][T17450] ? clear_bhb_loop+0x60/0xb0 [ 1587.165290][T17450] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1587.165304][T17450] RIP: 0033:0x7f633377f749 [ 1587.165318][T17450] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1587.165331][T17450] RSP: 002b:00007f63319e6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1587.165347][T17450] RAX: ffffffffffffffda RBX: 00007f63339d5fa0 RCX: 00007f633377f749 [ 1587.165359][T17450] RDX: 0000000000000094 RSI: 0000200000000a40 RDI: 0000000000000005 [ 1587.165369][T17450] RBP: 00007f63319e6090 R08: 0000000000000000 R09: 0000000000000000 [ 1587.165379][T17450] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1587.165387][T17450] R13: 00007f63339d6038 R14: 00007f63339d5fa0 R15: 00007ffd79d7e8a8 [ 1587.165412][T17450] [ 1587.925941][T17459] syzkaller0: entered promiscuous mode [ 1587.925969][T17459] syzkaller0: entered allmulticast mode [ 1588.017378][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805d569400: rx timeout, send abort [ 1588.518392][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805f673400: rx timeout, send abort [ 1589.018508][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805f673400: abort rx timeout. Force session deactivation [ 1589.668381][T17491] 9pnet_fd: Insufficient options for proto=fd [ 1590.460117][T15407] hsr_slave_0: left promiscuous mode [ 1590.498963][T15407] hsr_slave_1: left promiscuous mode [ 1590.499752][T15407] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1590.499770][T15407] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1590.518892][ T5981] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 1590.538363][T15407] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1590.538393][T15407] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1590.627231][T15407] veth1_macvtap: left promiscuous mode [ 1590.627299][T15407] veth0_macvtap: left promiscuous mode [ 1590.627446][T15407] veth1_vlan: left promiscuous mode [ 1590.627549][T15407] veth0_vlan: left promiscuous mode [ 1590.659446][ T5981] usb 8-1: device descriptor read/64, error -71 [ 1590.675880][T15271] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 1590.818949][T15271] usb 4-1: device descriptor read/64, error -71 [ 1590.899134][ T5981] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 1591.049440][ T5981] usb 8-1: device descriptor read/64, error -71 [ 1591.059058][T15271] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 1591.159712][ T5981] usb usb8-port1: attempt power cycle [ 1591.209056][T15271] usb 4-1: device descriptor read/64, error -71 [ 1591.320181][T15271] usb usb4-port1: attempt power cycle [ 1591.505011][ T5981] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 1591.519677][ T5981] usb 8-1: device descriptor read/8, error -71 [ 1591.689048][T15271] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 1591.710920][T15271] usb 4-1: device descriptor read/8, error -71 [ 1591.761933][ T5981] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 1591.782100][ T5981] usb 8-1: device descriptor read/8, error -71 [ 1591.893021][ T5981] usb usb8-port1: unable to enumerate USB device [ 1591.949065][T15271] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 1591.969761][T15271] usb 4-1: device descriptor read/8, error -71 [ 1592.113688][T15271] usb usb4-port1: unable to enumerate USB device [ 1593.759534][T15407] team0 (unregistering): Port device team_slave_1 removed [ 1594.119802][T15407] team0 (unregistering): Port device team_slave_0 removed [ 1597.958239][T17288] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1597.993202][T17288] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1598.102534][T17288] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1598.218886][T17288] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1598.459431][ T7909] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 1598.631483][ T7909] usb 4-1: device descriptor read/64, error -71 [ 1598.718304][T17288] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1598.763171][T17288] 8021q: adding VLAN 0 to HW filter on device team0 [ 1598.790878][ T9360] bridge0: port 1(bridge_slave_0) entered blocking state [ 1598.791136][ T9360] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1598.815420][ T9360] bridge0: port 2(bridge_slave_1) entered blocking state [ 1598.815647][ T9360] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1598.868877][ T7909] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 1599.009104][ T7909] usb 4-1: device descriptor read/64, error -71 [ 1599.114299][T17288] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1599.129661][ T7909] usb usb4-port1: attempt power cycle [ 1599.509824][ T7909] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 1599.529794][ T7909] usb 4-1: device descriptor read/8, error -71 [ 1599.578526][T17288] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1599.944144][ T7909] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 1600.035663][ T7909] usb 4-1: device descriptor read/8, error -71 [ 1600.191423][ T7909] usb usb4-port1: unable to enumerate USB device [ 1600.903146][T17571] netlink: 1752 bytes leftover after parsing attributes in process `syz.5.3233'. [ 1601.235718][T17288] veth0_vlan: entered promiscuous mode [ 1601.267741][T17288] veth1_vlan: entered promiscuous mode [ 1601.322060][T17288] veth0_macvtap: entered promiscuous mode [ 1601.419090][T17288] veth1_macvtap: entered promiscuous mode [ 1601.497924][T17288] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1601.551766][T17288] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1601.628659][ T9207] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1601.654520][ T9207] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1601.668914][ T9207] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1601.709119][ T9207] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1602.773891][T17600] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.3244'. [ 1603.203447][ T9207] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1603.203467][ T9207] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1603.300319][ T8594] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1603.300342][ T8594] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1603.483969][T17612] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3248'. [ 1603.493766][T17612] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 1603.705905][T17618] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3132'. [ 1603.927150][T17627] FAULT_INJECTION: forcing a failure. [ 1603.927150][T17627] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1603.927183][T17627] CPU: 0 UID: 0 PID: 17627 Comm: syz.4.3256 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1603.927203][T17627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1603.927214][T17627] Call Trace: [ 1603.927221][T17627] [ 1603.927230][T17627] dump_stack_lvl+0x189/0x250 [ 1603.927259][T17627] ? __pfx____ratelimit+0x10/0x10 [ 1603.927282][T17627] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1603.927305][T17627] ? __pfx__printk+0x10/0x10 [ 1603.927326][T17627] ? __might_fault+0xb0/0x130 [ 1603.927360][T17627] should_fail_ex+0x46c/0x600 [ 1603.927390][T17627] _copy_from_user+0x2d/0xb0 [ 1603.927410][T17627] __sys_bpf+0x1e3/0x860 [ 1603.927436][T17627] ? __pfx___sys_bpf+0x10/0x10 [ 1603.927456][T17627] ? rt_mutex_slowunlock+0x1be/0x2e0 [ 1603.927494][T17627] ? ksys_write+0x230/0x260 [ 1603.927518][T17627] ? __pfx_ksys_write+0x10/0x10 [ 1603.927545][T17627] __x64_sys_bpf+0x7c/0x90 [ 1603.927566][T17627] do_syscall_64+0xfa/0xfa0 [ 1603.927587][T17627] ? lockdep_hardirqs_on+0x9c/0x150 [ 1603.927609][T17627] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1603.927637][T17627] ? clear_bhb_loop+0x60/0xb0 [ 1603.927659][T17627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1603.927676][T17627] RIP: 0033:0x7f633377f749 [ 1603.927694][T17627] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1603.927711][T17627] RSP: 002b:00007f63319e6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1603.927730][T17627] RAX: ffffffffffffffda RBX: 00007f63339d5fa0 RCX: 00007f633377f749 [ 1603.927744][T17627] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 1603.927757][T17627] RBP: 00007f63319e6090 R08: 0000000000000000 R09: 0000000000000000 [ 1603.927769][T17627] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1603.927780][T17627] R13: 00007f63339d6038 R14: 00007f63339d5fa0 R15: 00007ffd79d7e8a8 [ 1603.927812][T17627] [ 1604.290104][ T5932] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 1604.449434][ T5932] usb 4-1: Using ep0 maxpacket: 16 [ 1604.457189][ T5932] usb 4-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 1604.457224][ T5932] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1604.457244][ T5932] usb 4-1: Product: syz [ 1604.457258][ T5932] usb 4-1: Manufacturer: syz [ 1604.457272][ T5932] usb 4-1: SerialNumber: syz [ 1604.542112][ T5932] usb 4-1: config 0 descriptor?? [ 1606.503271][T17625] Bluetooth: MGMT ver 1.23 [ 1606.588896][T17660] FAULT_INJECTION: forcing a failure. [ 1606.588896][T17660] name failslab, interval 1, probability 0, space 0, times 0 [ 1606.588930][T17660] CPU: 0 UID: 0 PID: 17660 Comm: syz.4.3268 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1606.588951][T17660] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1606.588963][T17660] Call Trace: [ 1606.588975][T17660] [ 1606.588983][T17660] dump_stack_lvl+0x189/0x250 [ 1606.589013][T17660] ? __pfx____ratelimit+0x10/0x10 [ 1606.589037][T17660] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1606.589060][T17660] ? __pfx__printk+0x10/0x10 [ 1606.589088][T17660] ? __pfx___might_resched+0x10/0x10 [ 1606.589112][T17660] should_fail_ex+0x46c/0x600 [ 1606.589142][T17660] should_failslab+0xa8/0x100 [ 1606.589168][T17660] __kmalloc_noprof+0xcc/0x7d0 [ 1606.589188][T17660] ? rcu_read_lock_any_held+0xb3/0x120 [ 1606.589243][T17660] ? kernfs_fop_write_iter+0x159/0x540 [ 1606.589266][T17660] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 1606.589290][T17660] kernfs_fop_write_iter+0x159/0x540 [ 1606.589321][T17660] vfs_write+0x5d5/0xb40 [ 1606.589347][T17660] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 1606.589367][T17660] ? __pfx_vfs_write+0x10/0x10 [ 1606.589385][T17660] ? try_to_take_rt_mutex+0x7fd/0xac0 [ 1606.589414][T17660] ? mutex_lock_nested+0x154/0x1d0 [ 1606.589570][T17660] ? fdget_pos+0x253/0x320 [ 1606.589603][T17660] ksys_write+0x14b/0x260 [ 1606.589627][T17660] ? __pfx_ksys_write+0x10/0x10 [ 1606.589651][T17660] ? do_syscall_64+0xbe/0xfa0 [ 1606.589677][T17660] do_syscall_64+0xfa/0xfa0 [ 1606.589694][T17660] ? lockdep_hardirqs_on+0x9c/0x150 [ 1606.589713][T17660] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1606.589731][T17660] ? clear_bhb_loop+0x60/0xb0 [ 1606.589752][T17660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1606.589769][T17660] RIP: 0033:0x7f633377f749 [ 1606.589787][T17660] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1606.589802][T17660] RSP: 002b:00007f63319e6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1606.589824][T17660] RAX: ffffffffffffffda RBX: 00007f63339d5fa0 RCX: 00007f633377f749 [ 1606.589838][T17660] RDX: 0000000000000007 RSI: 0000200000000200 RDI: 0000000000000004 [ 1606.589849][T17660] RBP: 00007f63319e6090 R08: 0000000000000000 R09: 0000000000000000 [ 1606.589861][T17660] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1606.589872][T17660] R13: 00007f63339d6038 R14: 00007f63339d5fa0 R15: 00007ffd79d7e8a8 [ 1606.589906][T17660] [ 1607.236024][ T5932] speedtch 4-1:0.0: speedtch_bind: wrong device class 68 [ 1607.236054][ T5932] speedtch 4-1:0.0: usbatm_usb_probe: bind failed: -19! [ 1607.269764][ T5932] usb 4-1: USB disconnect, device number 95 [ 1608.734041][ T61] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1608.784532][T17685] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1608.786794][T17685] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1608.799435][T17685] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1608.815493][T17685] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1608.899634][ T7137] bond0: (slave syz_tun): Releasing backup interface [ 1609.226188][ T9] usb 5-1: new full-speed USB device number 70 using dummy_hcd [ 1609.401623][ T9] usb 5-1: config 0 has an invalid interface number: 151 but max is 0 [ 1609.401652][ T9] usb 5-1: config 0 has no interface number 0 [ 1609.402186][ T9] usb 5-1: config 0 interface 151 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 1609.865580][ T9] usb 5-1: New USB device found, idVendor=0499, idProduct=6bb7, bcdDevice=68.2f [ 1609.865603][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1609.865704][ T9] usb 5-1: Product: syz [ 1609.865712][ T9] usb 5-1: Manufacturer: syz [ 1609.865720][ T9] usb 5-1: SerialNumber: syz [ 1609.924993][ T9] usb 5-1: config 0 descriptor?? [ 1610.799256][T17690] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 1610.799287][T17690] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 1610.839353][T11176] Bluetooth: hci4: command tx timeout [ 1610.966084][ T9] usb 5-1: USB disconnect, device number 70 [ 1611.379280][T17717] FAULT_INJECTION: forcing a failure. [ 1611.379280][T17717] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1611.379311][T17717] CPU: 1 UID: 0 PID: 17717 Comm: syz.6.3289 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1611.379327][T17717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1611.379336][T17717] Call Trace: [ 1611.379343][T17717] [ 1611.379350][T17717] dump_stack_lvl+0x189/0x250 [ 1611.379377][T17717] ? __pfx____ratelimit+0x10/0x10 [ 1611.379397][T17717] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1611.379415][T17717] ? __pfx__printk+0x10/0x10 [ 1611.379432][T17717] ? __might_fault+0xb0/0x130 [ 1611.379461][T17717] should_fail_ex+0x46c/0x600 [ 1611.379487][T17717] _copy_from_iter+0x1de/0x1790 [ 1611.379512][T17717] ? __lock_acquire+0xab9/0xd20 [ 1611.379531][T17717] ? __pfx__copy_from_iter+0x10/0x10 [ 1611.379553][T17717] ? page_copy_sane+0x4e/0x280 [ 1611.379569][T17717] copy_page_from_iter+0xdd/0x170 [ 1611.379587][T17717] tun_get_user+0x1d7b/0x3ec0 [ 1611.379712][T17717] ? tun_get_user+0x6f6/0x3ec0 [ 1611.379736][T17717] ? __might_fault+0xb0/0x130 [ 1611.379756][T17717] ? __pfx_tun_get_user+0x10/0x10 [ 1611.379771][T17717] ? _parse_integer_limit+0x1ae/0x1f0 [ 1611.379799][T17717] ? __lock_acquire+0xab9/0xd20 [ 1611.379822][T17717] ? ref_tracker_alloc+0x2fe/0x450 [ 1611.379862][T17717] ? __lock_acquire+0xab9/0xd20 [ 1611.379882][T17717] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1611.379907][T17717] ? tun_get+0x1c/0x2f0 [ 1611.379930][T17717] ? tun_get+0x1c/0x2f0 [ 1611.379948][T17717] ? tun_get+0x1c/0x2f0 [ 1611.379972][T17717] tun_chr_write_iter+0x119/0x200 [ 1611.379993][T17717] vfs_write+0x5d5/0xb40 [ 1611.380017][T17717] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 1611.380037][T17717] ? __pfx_vfs_write+0x10/0x10 [ 1611.380064][T17717] ? __fget_files+0x2a/0x420 [ 1611.380103][T17717] ksys_write+0x14b/0x260 [ 1611.380125][T17717] ? __pfx_ksys_write+0x10/0x10 [ 1611.380147][T17717] ? do_syscall_64+0xbe/0xfa0 [ 1611.380172][T17717] do_syscall_64+0xfa/0xfa0 [ 1611.380192][T17717] ? lockdep_hardirqs_on+0x9c/0x150 [ 1611.380213][T17717] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1611.380228][T17717] ? clear_bhb_loop+0x60/0xb0 [ 1611.380245][T17717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1611.380263][T17717] RIP: 0033:0x7fb6dcfee1ff [ 1611.380280][T17717] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 1611.380296][T17717] RSP: 002b:00007fb6db24e000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1611.380322][T17717] RAX: ffffffffffffffda RBX: 00007fb6dd245fa0 RCX: 00007fb6dcfee1ff [ 1611.380335][T17717] RDX: 0000000000000086 RSI: 0000200000000200 RDI: 00000000000000c8 [ 1611.380347][T17717] RBP: 00007fb6db24e090 R08: 0000000000000000 R09: 0000000000000000 [ 1611.380359][T17717] R10: 0000000000000086 R11: 0000000000000293 R12: 0000000000000001 [ 1611.380371][T17717] R13: 00007fb6dd246038 R14: 00007fb6dd245fa0 R15: 00007ffe3c7bf218 [ 1611.380404][T17717] [ 1611.755830][ T8941] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1612.189405][ T8941] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1612.305411][ T5955] usb 7-1: new high-speed USB device number 48 using dummy_hcd [ 1612.457700][T17746] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3301'. [ 1612.457739][T17746] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3301'. [ 1612.498918][ T5955] usb 7-1: Using ep0 maxpacket: 32 [ 1612.503552][ T5955] usb 7-1: config 0 has an invalid interface number: 12 but max is 0 [ 1612.503579][ T5955] usb 7-1: config 0 has no interface number 0 [ 1612.503632][ T5955] usb 7-1: config 0 interface 12 has no altsetting 0 [ 1612.531145][ T5955] usb 7-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1612.531177][ T5955] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1612.531194][ T5955] usb 7-1: Product: syz [ 1612.531208][ T5955] usb 7-1: Manufacturer: syz [ 1612.531221][ T5955] usb 7-1: SerialNumber: syz [ 1612.541120][ T5955] usb 7-1: config 0 descriptor?? [ 1612.570552][T17751] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3301'. [ 1612.713768][ T8941] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1612.770815][T17746] ip6gretap1: entered allmulticast mode [ 1612.793305][ T5955] f81534 7-1:0.12: f81534_set_register: reg: 1002 data: 3 failed: -71 [ 1612.793365][ T5955] f81534 7-1:0.12: f81534_find_config_idx: read failed: -71 [ 1612.793383][ T5955] f81534 7-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1612.793474][ T5955] f81534 7-1:0.12: probe with driver f81534 failed with error -71 [ 1612.842140][ T5955] usb 7-1: USB disconnect, [ 1612.842140][ T5955] usb 7-1: USB disconnect, device number 48 [ 1612.849482][T17748] ------------[ cut here ]------------ [ 1612.849509][T17748] WARNING: CPU: 1 PID: 17748 at kernel/kcov.c:477 kcov_task_exit+0x13c/0x150 [ 1612.849590][T17748] Modules linked in: [ 1612.849609][T17748] CPU: 1 UID: 0 PID: 17748 Comm: syz.7.3300 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1612.849632][T17748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1612.849644][T17748] RIP: 0010:kcov_task_exit+0x13c/0x150 [ 1612.849669][T17748] Code: c7 c7 d0 45 c5 8e 48 c7 c6 c3 27 da 8c 48 c7 c2 89 fd d8 8c 4c 89 f9 e8 72 5d f1 02 4c 39 bb 98 00 00 00 0f 84 ff fe ff ff 90 <0f> 0b 90 4c 89 f7 5b 41 5e 41 5f e9 d4 3e 04 09 0f 1f 40 00 90 90 [ 1612.849686][T17748] RSP: 0018:ffffc9000545fac0 EFLAGS: 00010287 [ 1612.849702][T17748] RAX: 9ed885c596dc2c00 RBX: ffff88805f2af300 RCX: 0000000000000000 [ 1612.849717][T17748] RDX: 0000000000000000 RSI: ffffffff8b3ddfc0 RDI: 00000000ffffffff [ 1612.849730][T17748] RBP: ffffc9000545fc28 R08: 0000000000000000 R09: ffffffff8ac2eb41 [ 1612.849744][T17748] R10: dffffc0000000000 R11: fffffbfff1dac84f R12: 1ffff110047eca6d [ 1612.849759][T17748] R13: 0000000000000000 R14: ffff88805f2af308 R15: ffff8880265c3c00 [ 1612.849773][T17748] FS: 00007f0dbc13e6c0(0000) GS:ffff888126ef6000(0000) knlGS:0000000000000000 [ 1612.849789][T17748] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1612.849802][T17748] CR2: 00007f63319a4d58 CR3: 0000000030a26000 CR4: 00000000003526f0 [ 1612.849821][T17748] Call Trace: [ 1612.849832][T17748] [ 1612.849844][T17748] do_exit+0x105/0x2300 [ 1612.849883][T17748] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1612.850049][T17748] ? __lock_acquire+0xab9/0xd20 [ 1612.850081][T17748] ? __pfx_do_exit+0x10/0x10 [ 1612.850104][T17748] ? rt_mutex_slowunlock+0x493/0x8a0 [ 1612.850127][T17748] ? rt_spin_lock+0x1c1/0x3e0 [ 1612.850155][T17748] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1612.850184][T17748] do_group_exit+0x21c/0x2d0 [ 1612.850203][T17748] ? rt_spin_unlock+0x161/0x200 [ 1612.850228][T17748] get_signal+0x125d/0x1310 [ 1612.850273][T17748] arch_do_signal_or_restart+0xa0/0x790 [ 1612.850314][T17748] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1612.850339][T17748] ? __se_sys_futex+0x36f/0x400 [ 1612.850379][T17748] ? exit_to_user_mode_loop+0x40/0x130 [ 1612.850412][T17748] exit_to_user_mode_loop+0x72/0x130 [ 1612.850436][T17748] do_syscall_64+0x2bd/0xfa0 [ 1612.850460][T17748] ? lockdep_hardirqs_on+0x9c/0x150 [ 1612.850484][T17748] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1612.850504][T17748] ? clear_bhb_loop+0x60/0xb0 [ 1612.850527][T17748] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1612.850546][T17748] RIP: 0033:0x7f0dbdedf749 [ 1612.850563][T17748] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1612.850580][T17748] RSP: 002b:00007f0dbc13e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1612.850600][T17748] RAX: fffffffffffffe00 RBX: 00007f0dbe135fa8 RCX: 00007f0dbdedf749 [ 1612.850617][T17748] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0dbe135fa8 [ 1612.850632][T17748] RBP: 00007f0dbe135fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1612.850646][T17748] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1612.850660][T17748] R13: 00007f0dbe136038 R14: 00007ffd08bd88d0 R15: 00007ffd08bd89b8 [ 1612.850695][T17748] [ 1612.850711][T17748] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1612.850726][T17748] CPU: 1 UID: 0 PID: 17748 Comm: syz.7.3300 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1612.850750][T17748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1612.850762][T17748] Call Trace: [ 1612.850771][T17748] [ 1612.850780][T17748] dump_stack_lvl+0x99/0x250 [ 1612.850808][T17748] ? __asan_memcpy+0x40/0x70 [ 1612.850830][T17748] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1612.850855][T17748] ? __pfx__printk+0x10/0x10 [ 1612.850892][T17748] vpanic+0x237/0x6d0 [ 1612.850918][T17748] ? __pfx_vpanic+0x10/0x10 [ 1612.850954][T17748] panic+0xb9/0xc0 [ 1612.850971][T17748] ? __pfx_panic+0x10/0x10 [ 1612.851089][T17748] __warn+0x31b/0x4b0 [ 1612.851110][T17748] ? kcov_task_exit+0x13c/0x150 [ 1612.851139][T17748] ? kcov_task_exit+0x13c/0x150 [ 1612.851163][T17748] report_bug+0x2be/0x4f0 [ 1612.851273][T17748] ? kcov_task_exit+0x13c/0x150 [ 1612.851297][T17748] ? kcov_task_exit+0x13c/0x150 [ 1612.851320][T17748] ? kcov_task_exit+0x13e/0x150 [ 1612.851344][T17748] handle_bug+0x84/0x160 [ 1612.851364][T17748] exc_invalid_op+0x1a/0x50 [ 1612.851384][T17748] asm_exc_invalid_op+0x1a/0x20 [ 1612.851402][T17748] RIP: 0010:kcov_task_exit+0x13c/0x150 [ 1612.851427][T17748] Code: c7 c7 d0 45 c5 8e 48 c7 c6 c3 27 da 8c 48 c7 c2 89 fd d8 8c 4c 89 f9 e8 72 5d f1 02 4c 39 bb 98 00 00 00 0f 84 ff fe ff ff 90 <0f> 0b 90 4c 89 f7 5b 41 5e 41 5f e9 d4 3e 04 09 0f 1f 40 00 90 90 [ 1612.851445][T17748] RSP: 0018:ffffc9000545fac0 EFLAGS: 00010287 [ 1612.851463][T17748] RAX: 9ed885c596dc2c00 RBX: ffff88805f2af300 RCX: 0000000000000000 [ 1612.851480][T17748] RDX: 0000000000000000 RSI: ffffffff8b3ddfc0 RDI: 00000000ffffffff [ 1612.851493][T17748] RBP: ffffc9000545fc28 R08: 0000000000000000 R09: ffffffff8ac2eb41 [ 1612.851506][T17748] R10: dffffc0000000000 R11: fffffbfff1dac84f R12: 1ffff110047eca6d [ 1612.851522][T17748] R13: 0000000000000000 R14: ffff88805f2af308 R15: ffff8880265c3c00 [ 1612.851543][T17748] ? rt_spin_lock+0x1c1/0x3e0 [ 1612.851576][T17748] do_exit+0x105/0x2300 [ 1612.851602][T17748] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1612.851630][T17748] ? __lock_acquire+0xab9/0xd20 [ 1612.851662][T17748] ? __pfx_do_exit+0x10/0x10 [ 1612.851686][T17748] ? rt_mutex_slowunlock+0x493/0x8a0 [ 1612.851706][T17748] ? rt_spin_lock+0x1c1/0x3e0 [ 1612.851732][T17748] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1612.851761][T17748] do_group_exit+0x21c/0x2d0 [ 1612.851779][T17748] ? rt_spin_unlock+0x161/0x200 [ 1612.851804][T17748] get_signal+0x125d/0x1310 [ 1612.851849][T17748] arch_do_signal_or_restart+0xa0/0x790 [ 1612.851874][T17748] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1612.851895][T17748] ? __se_sys_futex+0x36f/0x400 [ 1612.851943][T17748] ? exit_to_user_mode_loop+0x40/0x130 [ 1612.851985][T17748] exit_to_user_mode_loop+0x72/0x130 [ 1612.852015][T17748] do_syscall_64+0x2bd/0xfa0 [ 1612.852040][T17748] ? lockdep_hardirqs_on+0x9c/0x150 [ 1612.852065][T17748] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1612.852085][T17748] ? clear_bhb_loop+0x60/0xb0 [ 1612.852105][T17748] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1612.852125][T17748] RIP: 0033:0x7f0dbdedf749 [ 1612.852144][T17748] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1612.852161][T17748] RSP: 002b:00007f0dbc13e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1612.852181][T17748] RAX: fffffffffffffe00 RBX: 00007f0dbe135fa8 RCX: 00007f0dbdedf749 [ 1612.852197][T17748] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0dbe135fa8 [ 1612.852210][T17748] RBP: 00007f0dbe135fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1612.852222][T17748] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1612.852234][T17748] R13: 00007f0dbe136038 R14: 00007ffd08bd88d0 R15: 00007ffd08bd89b8 [ 1612.852265][T17748] [ 1612.852667][T17748] Kernel Offset: disabled