last executing test programs: 8.200332509s ago: executing program 0 (id=579): openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x49, &(0x7f0000000000)=0x20000006, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r4, &(0x7f0000000500)={0xa, 0xffff, 0x0, @mcast1, 0x9}, 0x1c) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000200), 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002800500010000000000080007"], 0x98}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[], 0x98}, 0x1, 0x0, 0x0, 0x20040800}, 0x0) pipe2(&(0x7f0000000000), 0x4000) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000840), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000880)=ANY=[@ANYBLOB="2c020000", @ANYRES16=r7, @ANYBLOB="010000000000000000000100000024000300a05ca84f6c9c8e3853e2fd7a70ae0fb20fa152600cb00845174f08076f8d7843e40108804400208024000100000000000100000000000000fdffff01000000000000000000000000000000001400040003000000ac1414bb00000000000000000600050000000000000100802400020073e591ec06154031d3954ac0e16752e72640f08b5281a8461d17d26d12f2bbb6060005000021000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39228c00098028000080060001000a0000001400020020010000000000000000000002000001050003000000000088000080060001000a000000140002002001000000f800000000000000000002050003000000001003800080060001008c0e000008000200ac1414aa05000300000000001c000080060001000200000008000200ac1414bb0500030000000000200004000e00000000000000fe800000000000000000000000000000000000009c0000802400020073961633df6dc9cb418b15afd0bae7b90f1e6cfed8bb423cf9285c474163154908000a00010000002400010000000000000000000000000000000000000000000000000000000000000000004800098028000080060001000a00000014000200fe8000000000000000000000000000bb05000300000000001c000080060001000200000008000200000000000500030000000000080005000100000008000100", @ANYRES32=r8], 0x22c}}, 0x0) 7.586704648s ago: executing program 3 (id=584): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x6, 0x0, 0x4a, 0x7fff7ffc}, {0x400, 0x7, 0x80, 0x7}]}) sync() r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap$binder(&(0x7f000000d000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x8000000000000) sendmsg$kcm(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="97814f0d9f65bfaa49fa0634a9327e143d663c2af80748d63d3720f974f78ec03616f00393d0745715b5fa7620e395fc0a3d568af0958c325b069db7ab79cf5851cea4f5e5d0b39c607ed7f17db56fcc6d16894bb2b5b1b72becb9f787a966b158499360e5600a0540169759cf0564c54d117deaa4a5b3bb0869013c7b9ffb0f85bd0111041f4a45f043ec84ac200074a6d6ef54c13824f0f7d4c677116096fb231f95c7c59ae623a83d54f6886b90568a706e257dbab3417f839bf1462e2c65fb2aca386e21879b1d0546ab95ea1a0f11a1a996dc7f10e85c4ea27ba8147de0a07cebb23885f898a2e3d46ef8e1b618cab716809d080e0af4", 0xf9}, {&(0x7f00000001c0)="afc31110bee7cbc8c6f1a9f789c9f68ac53e3ebf4f55ac7e91357bfe8652dcce2f946eda98dafad61d6972854ae1c059e0afb6af1c84680adb14ae0ac7b4f5b2a12a5b43e2228278d3d0ce3ac9180aaddf74ae753762249c2900b4df1057c289c6eccce70b5014281ce546de0ea966f0c39a143a21584d3125b494478d711809a3fd9c2711413101bb55197269be23db367b3698ecc8fb9b174f4c65902c59989ebb4dfc967f89acfdb193aedd2c8edf44d280db977938474b67dedbf29c8dc2861977f78a400af67a2f072158c172e8e9a6ad6bec193024c3017ef4c7ec", 0xde}, {&(0x7f00000002c0)="9b094a259b2becd7656a6ffc6c76d71d4943d6c3beccf1c3b36c0a1f37fc9d3fbf48ae2827da697806610c864858c3d7d915622fcde5695648a2f659dcd252f49f27096333b192563200eb10485fb0037af51fd153df90691524fcb74411a6de9da1e39a34bc1e831f0aa228bcbfba4cd269818ebf90ba3f760c4740ebd563ad096d46f78670c301e8aafdd9168c6cbc44010a4e487a0d2f64bc83162ea2dbe8525b4b50115be102990ca9fc87e738ed39f9a66567cc2197488875790676ce5506d4876791bee06c", 0xc8}, {&(0x7f00000003c0)="e3671dd64e0e87ba1220cb3b62ae68bf9a96241689ab84d8242ada1ea7566c1ef28af65cc7ebdec408082bae9b2deb0f8a5afeee87e4b53228ed2b35430d476f38b3705c14c810b02014f0ed25fc566243c2e48838b44567f55885928baad71448742e8408cf15d31f964d58242b48e19021399ef2033e118cf906548bdee3bffca087673c0faf38aa0cc98d11661b5d39b3c308c5805b969bbc05181661aec6df8bb20a8795b66b9ab0b559", 0xac}], 0x4, &(0x7f0000000480)=[{0x98, 0x10c, 0xc5, "56ace96e961037769aa2ebc8bd9ba30501f97de7314fb5e5bb012a1e9ae4491e9877a2ea0664d688838b9e0177cfb91c36f6b1a3d35df2398963497cdcc9e7e09ff26682518d83b45542037b0bea8b2de8e020aafd03a6f0e3c31bf5930b2748e721a88d77680187e8b09ee5a530725cffd23c9dfa8f0a9399596413ef063a09e604b5a054ceae36"}, {0x98, 0x10d, 0x9, "9072d79b914b0f1761c5a730aac1ed9eb9aa338fd2a2295bb88fdce02ea0d1f96986cab0d536b59d7fc79f14298cc7882b4ca1a3030a22459f6e2a2bbd1eca560ad2aaabad9450034659d4d4d6f9a0f37cd517cab08be05208571f5568adc9cb826bcdfedc29f2c9d044de93751a2d60889eb04631ba724893c012f64ec4df9f4edfc872e3"}, {0x70, 0x29, 0x4, "34fa69f879af65e936f64af0edc3d988ad9b9fa14a767d67212c819cab8cd89f560053cb901dac865cccca0b9b59a21f16feadc33d62e6615eaf4972925a4f2fd18a1e83149012ad28c42544dc8535784cdd2ca3a50bdc6f3a0ce9"}, {0xe8, 0x44, 0x4, "530a7857d25ba12e8c2a195b447c8b3a3e45e433ba04f40e713c563eb9689a1d9f1cd7c7fbe6239c067844cab3e82bd4df90b406ba4c482866887954a732fea07b44cfa83fd828f4733bd7fba1f19207fad1971756f262d79d790a5e1c09a81814f67ae8c4c31e9c4ade19d9ae39c395976f4c77dbfa3973a396b4412c6032c2dfa46374e0cd3e58a96a2ed27fd0ac7686a44c0cfca24fbd820edc68f94bc57ae9029f38bada47c24f57a3ab3cb72b69928de5acf2dbefe95c627f2dfd8005fdd7971c4d60e6fe3080fe2dc22b8c29e43ff4"}], 0x288}, 0x40800) 7.04005617s ago: executing program 4 (id=587): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000006c0)='kfree\x00', r0}, 0x18) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="020300030d00000000070000000000000300090050000000e9255bb992464e73a02100000000000003000600000000000200000000080000000000000000000002000100000000000000000d0000000003000500000000000200"], 0x68}, 0x1, 0x7}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x60}, 0x1, 0x0, 0x0, 0x24040089}, 0x20008000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) socket$inet(0x2, 0x4000000000000001, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="5c0000000206050000000000000000000000000105000100070000000900020073797a32000000001400078008000600000000000800134000000000050005000a0000000500fe000000000010000300686173683a69702c6d616300"], 0x5c}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000008da4b70800000400396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000240000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000100)='kfree\x00', r3, 0x0, 0x8000000000}, 0x18) socket$xdp(0x2c, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000ff00000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000640)='console\x00', r5}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000040)={'macsec0\x00', @random="06517dc2e6ea"}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) socket(0x28, 0x5, 0x0) 7.031199799s ago: executing program 3 (id=588): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f00000004c0), 0x0, 0x20c02) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r1, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r1, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) bind$tipc(r1, 0x0, 0x0) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000040)="aefdda9d240303005a90f57f07703aeff0f64eb9ee07962c220a2e11b44e65d76641cb010852f426072a", 0x2a}], 0x1) read(r0, &(0x7f0000002400)=""/4091, 0xfffffff6) unshare(0x800) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4044881) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x4000, 0x0) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000240)={'veth0\x00'}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f0000000140)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @remote}, {0x2, 0x0, @private}, 0xd0}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000080)={{0x1, 0x1, 0x18, r3, {0x3}}, './file0\x00'}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) io_uring_register$IORING_REGISTER_FILES_UPDATE(r4, 0x6, &(0x7f0000000100)={0x10000, 0x0, &(0x7f00000000c0)=[r6, r3, r3, r0]}, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8}}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r8 = syz_open_dev$vim2m(&(0x7f0000000040), 0x1000001, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r8, 0xc008561c, &(0x7f0000000000)={0x980912}) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@setlink={0x48, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4280}, [@IFLA_PHYS_PORT_ID={0x1f, 0x22, "1d8929ff735f44269b82c1454740e9a78b5c77d68287ba8ba528a4"}, @IFLA_MASTER={0x8, 0x3a}]}, 0x48}}, 0x0) 6.902905719s ago: executing program 4 (id=589): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890b, &(0x7f0000000080)={@loopback={0xfec0ffff00000000}, @private1, @local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x280}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r4 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000080)={0x8}, 0x10) write(r4, &(0x7f00000003c0)="1847ef36e9673700004dac009b8a140500003b9b301f000000ecffff1ffcc63c8e5226c2c6ad573fe93bdaaa7cfe7afc09b4c6ddc6c784c729f71248219e2b72f908b03c9fc6cb661b095a37921a93461321be39a3bf370bb63d2cf46f4b6fc2f12c1cefb7619686f2db566df379143cb156618d53d347c12e45601d2324be068b74c43ee54100f4f751caf486e9181856be99d3537f978f27f4f61790036d7ede94cc1dcc93f4e55831f352d86bfb7ceb80a4b783bde313c981677b3a27561156359df745c24372321c502c22ee7572eb199ee8c34f4eccc046e78a956e342ca670b4c5fe87ceca39baf2593f", 0xed) socket$kcm(0x10, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x3a) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f0b2ad1eb9769d74e4f1feff374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724190000006f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0ed9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627820d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b4047979379dc15c9056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221f05e6ca8c705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f12fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab778c50a3337a78675f38a568612aa25d61ce4e2c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008435f39381c2a77c001caae53db7316fa6d48d032ab6831ebb813c85855c7a9ad8140a4b29422fc20d4e75c848984a2e217ec9c2833b8fa9106ee1be2c05103a36fc1126f1aa5284ba7179843b08ecadc199b9038cf6b9ee4e1f321a6a32e03bd987ddfada1f69756651b73a7ed0f7e467081193b28448692686ac80d81a89f9c29e276800"/2574], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r6 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r6, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) r7 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r7, 0x89e0, &(0x7f0000000040)={r6, r5}) sendmsg$kcm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000200)="1f", 0x1}], 0x1}, 0x40) ioctl$sock_kcm_SIOCKCMUNATTACH(r7, 0x89e1, &(0x7f0000000340)={r6}) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x3, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000240)={0x3ff, 0x0, 0x0, 0x7, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000c00)=ANY=[@ANYBLOB="bf16000000000000b70700000100000048700000e4ff0000bc701000000000009500faff000000008aa1210b29017b83c8e96e6405f798585fb5030b3388b0409a814343f1ae341b74efa745a12f5c0685e5261482e31e0cacc902c97e6145ef48004d26342c94f56a39359ba56724e4535d80ffbd6848d53382c26211a2b975eb4a9d08501c000c00000000000097e50f118c4a3b05489d1d1245cb774879b0070000000000008cca1a363b2b28add613658171122dc01e0a77d7c44b009fdac91fc827f5797532750d4d4639f11089feb3f25b4695c6dac2cabfa04e2c16fa741b0665bb33be6f0e742213d0bf5528a601b5934b867f39f7d776ac06a434949b4455b7c6c678de4d9740d8dff6169c664b55ce550fb4e686ae169d9f7abbeb08e02799374ae0081858bdf144d8c7fb67dcec5e43a0e8099e543116b1b7d144b5613845cca4388344d82de45f0c1b7d041db040fd777791232d5db32d14bc1c3d000000000000000000000016a1049b6f094e504c28d7daa2f61b2a7c14d2343b4308b36e6b141371c958406e212b3accb45f87aef8bd5e2181fd7826b9e5cb2f6a63f113491239dca17e4fb33e670daf1cd7a99015ae9e1ca32b4e64dc38b55d525bd10971b0898be9d6e6154dfc99b20622b604b87ba03524c2fed51056d672b1b966657de5c86ab09195fba55af17663fecf1b5c5a76cf07615c7ee54c361449e275371a8c4243b9060ecdeecfb1603b061a8a62159830049061800953f7d00c43c95068c62c2ca1ad7fea9de97216dbc9c8e36a5607608e77d1d7d72b78b4f1eab8e40000000000000000adc90eb850f42f44e4b48c9cc39412c0ce6c9f4b95936ec36efc8dfbc54eb44affe1cd0f14d124df0c29c51b5628646b8155a1859358aa08f71fd2d9b2c4288a0d8870e8767173c65476e1a4f000c580f61d73f5be35ca1aa1235cf3096526dedec1199479b1b5adfaf2b6e05b7f90c9098ed4accddabd802ac5dc1b436e00"/738], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffcf8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) socket$inet6(0xa, 0x2, 0xffffffff) 6.506019473s ago: executing program 2 (id=590): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4000) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$unix(r0, &(0x7f0000000540), 0x0, 0x4040880) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000140), 0x8) sendto$inet6(r2, &(0x7f0000847fff), 0x0, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x14, 0x29, 0xb, 0x70bd27, 0x0, {0x5}}, 0x14}}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000540), 0x400, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080)={0x40000014}) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'tunl0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x6, 0x0, 0x0, 0xffffff81}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x40}}, 0x20008000) socket$packet(0x11, 0x3, 0x300) mq_open(&(0x7f0000000580)='exthdr\x00', 0x2, 0x189, &(0x7f00000005c0)={0x49335f85, 0x7, 0x8, 0x46}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0x0, 0xac14140c}, 0xff000000}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8bcd", 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) 6.412331955s ago: executing program 1 (id=591): syz_emit_ethernet(0x52, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004c000078ac1414000a0101004414050300000000000000000a010101000000008903ce0702"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x40}}, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000100)='0.::/', 0x0) r0 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000080)="bc5d", 0x2, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0xe0fe00000000) 5.907079488s ago: executing program 4 (id=592): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890b, &(0x7f0000000080)={@loopback={0xfec0ffff00000000}, @private1, @local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x280}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r4 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000080)={0x8}, 0x10) write(r4, &(0x7f00000003c0)="1847ef36e9673700004dac009b8a140500003b9b301f000000ecffff1ffcc63c8e5226c2c6ad573fe93bdaaa7cfe7afc09b4c6ddc6c784c729f71248219e2b72f908b03c9fc6cb661b095a37921a93461321be39a3bf370bb63d2cf46f4b6fc2f12c1cefb7619686f2db566df379143cb156618d53d347c12e45601d2324be068b74c43ee54100f4f751caf486e9181856be99d3537f978f27f4f61790036d7ede94cc1dcc93f4e55831f352d86bfb7ceb80a4b783bde313c981677b3a27561156359df745c24372321c502c22ee7572eb199ee8c34f4eccc046e78a956e342ca670b4c5fe87ceca39baf2593f", 0xed) socket$kcm(0x10, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x3a) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f0b2ad1eb9769d74e4f1feff374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724190000006f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0ed9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627820d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b4047979379dc15c9056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221f05e6ca8c705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f12fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab778c50a3337a78675f38a568612aa25d61ce4e2c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008435f39381c2a77c001caae53db7316fa6d48d032ab6831ebb813c85855c7a9ad8140a4b29422fc20d4e75c848984a2e217ec9c2833b8fa9106ee1be2c05103a36fc1126f1aa5284ba7179843b08ecadc199b9038cf6b9ee4e1f321a6a32e03bd987ddfada1f69756651b73a7ed0f7e467081193b28448692686ac80d81a89f9c29e276800"/2574], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r6 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r6, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) r7 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r7, 0x89e0, &(0x7f0000000040)={r6, r5}) sendmsg$kcm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000200)="1f", 0x1}], 0x1}, 0x40) ioctl$sock_kcm_SIOCKCMUNATTACH(r7, 0x89e1, &(0x7f0000000340)={r6}) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x3, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000240)={0x3ff, 0x0, 0x0, 0x7, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000c00)=ANY=[@ANYBLOB="bf16000000000000b70700000100000048700000e4ff0000bc701000000000009500faff000000008aa1210b29017b83c8e96e6405f798585fb5030b3388b0409a814343f1ae341b74efa745a12f5c0685e5261482e31e0cacc902c97e6145ef48004d26342c94f56a39359ba56724e4535d80ffbd6848d53382c26211a2b975eb4a9d08501c000c00000000000097e50f118c4a3b05489d1d1245cb774879b0070000000000008cca1a363b2b28add613658171122dc01e0a77d7c44b009fdac91fc827f5797532750d4d4639f11089feb3f25b4695c6dac2cabfa04e2c16fa741b0665bb33be6f0e742213d0bf5528a601b5934b867f39f7d776ac06a434949b4455b7c6c678de4d9740d8dff6169c664b55ce550fb4e686ae169d9f7abbeb08e02799374ae0081858bdf144d8c7fb67dcec5e43a0e8099e543116b1b7d144b5613845cca4388344d82de45f0c1b7d041db040fd777791232d5db32d14bc1c3d000000000000000000000016a1049b6f094e504c28d7daa2f61b2a7c14d2343b4308b36e6b141371c958406e212b3accb45f87aef8bd5e2181fd7826b9e5cb2f6a63f113491239dca17e4fb33e670daf1cd7a99015ae9e1ca32b4e64dc38b55d525bd10971b0898be9d6e6154dfc99b20622b604b87ba03524c2fed51056d672b1b966657de5c86ab09195fba55af17663fecf1b5c5a76cf07615c7ee54c361449e275371a8c4243b9060ecdeecfb1603b061a8a62159830049061800953f7d00c43c95068c62c2ca1ad7fea9de97216dbc9c8e36a5607608e77d1d7d72b78b4f1eab8e40000000000000000adc90eb850f42f44e4b48c9cc39412c0ce6c9f4b95936ec36efc8dfbc54eb44affe1cd0f14d124df0c29c51b5628646b8155a1859358aa08f71fd2d9b2c4288a0d8870e8767173c65476e1a4f000c580f61d73f5be35ca1aa1235cf3096526dedec1199479b1b5adfaf2b6e05b7f90c9098ed4accddabd802ac5dc1b436e00"/738], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffcf8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) socket$inet6(0xa, 0x2, 0xffffffff) 5.652746168s ago: executing program 1 (id=593): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x73, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r0, 0xc040563d, &(0x7f0000000200)={0x0, 0x0, 0x101, 0x2, {0x2b5b, 0x5, 0x7, 0xc}}) 5.476327059s ago: executing program 3 (id=594): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f00000002c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg$can_raw(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000ac0)=""/4096, 0x1000}], 0x1}, 0x40) syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1) 5.46257106s ago: executing program 0 (id=595): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0xc000) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000080)={0x7, 0x9, 0x9, {0x7, 0xa}, {0x2, 0xd}, @period={0x5b, 0x5, 0x100, 0x7, 0xb, {0x6e, 0x0, 0xd1ee, 0x400}, 0x1, &(0x7f0000000040)=[0x99]}}) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x650040, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x1d, &(0x7f0000000100)=0x6, 0x4) getsockopt$bt_hci(r1, 0x0, 0x2, &(0x7f0000000140)=""/254, &(0x7f0000000240)=0xfe) r2 = add_key$user(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x2}, &(0x7f0000000300)="07841d7db97dd4c709dec08c111a73782310f9434e9d2ea9d93be103b5ab46a3cb32dc72f54f4eedefa07a6eb6889e1a2c1beb8b79ebe341ff0cd8bb7b93d8c1c167ba4b", 0x44, 0xfffffffffffffffb) keyctl$dh_compute(0x17, &(0x7f0000000380)={r2}, &(0x7f00000003c0)=""/193, 0xc1, &(0x7f0000000600)={&(0x7f00000004c0)={'blake2b-160-generic\x00'}, &(0x7f0000000500)="979d9303fdbdf15448c23bc7e91778f33030f574b0946a2ef56a4ae1996f7e20f562554f7e7c0014bd61ac67df7933b10b0e673e62b156b420558aaa6b49e688ca1a7e72266b1a5dbe1ef9a0dd7f76ba6ccf9f9bef0f9ecf497aa3be05f1053d4a7fc1723517caf96c9a28411540fb5720940f7aa72b624796bd9f73f5e9e55adba350af30ac14d52af4479caf979d6bb05b43342977de33c4f42852605076d8b680e6d579110023b975c4379768b7fe41fd5c2e96a49f78b5d12a431937a437dd41bc9c1ee2a145b9290a8e4028a439e4207c0c7834844594a1e3978160d5ea95674994b1159252094673e20a1aeea23531cd82a7461b", 0xf7}) unshare(0x20040000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, &(0x7f0000000680)={0x4845, r1}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000840)={'vcan0\x00', 0x0}) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000900)={0xffffffffffffffff, 0xf}, 0xc) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000940)={0x1b, 0x0, 0x0, 0x6, 0x0, 0x1, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x451464fb, 0x0, @void, @value, @void, @value}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x18, 0x12, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0xfffffffd}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@map_idx={0x18, 0x0, 0x5, 0x0, 0x2}, @ldst={0x3, 0x3, 0x2, 0xa, 0x4, 0xfffffffffffffffe, 0x8}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000780)='syzkaller\x00', 0x2, 0x56, &(0x7f00000007c0)=""/86, 0x40e00, 0x4, '\x00', r3, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000880)={0x1, 0x2}, 0x8, 0x10, &(0x7f00000008c0)={0x0, 0x6, 0x15b9, 0x4}, 0x10, 0x0, 0x0, 0x3, &(0x7f00000009c0)=[r4, r5], &(0x7f0000000a00)=[{0x0, 0x5, 0xd, 0x3}, {0x1, 0x2, 0x8, 0x6}, {0x2, 0x2, 0x1, 0x6}], 0x10, 0x0, @void, @value}, 0x94) sendto(r1, &(0x7f0000000b00)="b9a1b23d81d8b12315022b9c24e34ca5f6e2b50b649cb572204076bbc8cc4741215f5a78fa7ab1b58ec042e17722e21e26d8a57c388e7a01e087fdc70ff5806400", 0x41, 0x4008854, &(0x7f0000000b80)=@l2tp6={0xa, 0x0, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffff8, 0x1}, 0x80) r6 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000c00), 0x2, 0x0) r7 = getuid() quotactl_fd$Q_QUOTAOFF(r4, 0xffffffff80000300, r7, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000c40)='status\x00') r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000cc0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r8, &(0x7f0000000d80)={&(0x7f0000000c80), 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x24, r9, 0x20, 0x70bd25, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0x800}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x8044040}, 0x24004010) ioctl$VIDIOC_ENUMAUDIO(r6, 0xc0345641, &(0x7f0000000dc0)={0x34, "976a3ed268b1dbfb7695fe97e33c34448d57734e4b4c35d7c436e1b4b81f336b", 0x1, 0xba4ccfc85a626ff9}) sendmsg$nl_route_sched_retired(r8, &(0x7f0000000f80)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000f40)={&(0x7f0000000ec0)=@newchain={0x5c, 0x64, 0x10, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xd, 0x3}, {0xe}, {0x6, 0x4}}, [@f_rsvp={{0x9}, {0x2c, 0x2, [@TCA_RSVP_SRC={0x8, 0x3, @local}, @TCA_RSVP_PINFO={0x20, 0x4, {{0xe, 0x5, 0x5}, {0x7, 0x87, 0x2f4d2108}, 0xc, 0x7, 0x5}}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40040) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_GET(r10, &(0x7f00000010c0)={&(0x7f0000000fc0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001080)={&(0x7f0000001000)={0x60, 0x0, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @private=0xa010102}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @multicast2}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @broadcast}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e24}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @initdev={0xac, 0x1e, 0x0, 0x0}}, @FOU_ATTR_PEER_V4={0x8, 0x8, @multicast2}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @private0}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x4001) read$alg(r8, &(0x7f0000001100)=""/22, 0x16) r11 = openat$mice(0xffffffffffffff9c, &(0x7f00000011c0), 0x4400) syz_mount_image$fuse(&(0x7f0000001140), &(0x7f0000001180)='./file0\x00', 0x800000, &(0x7f0000001380)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, r7}, 0x2c, {}, 0x2c, {[{@default_permissions}], [{@fowner_eq}, {@smackfsfloor}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}]}}, 0x0, 0x0, &(0x7f0000001480)="b106c69db28d2150c106b95fe621f8fa1124afb59cc455a7678a69fb1c6b14baa1e868702bb81d8b55f59941b1973c84fea02c975376a70237c4f1039df92e70c37ebee29559607f9b683098e6d87174aee9595f1b57b4cd68d89913d64a2a120edd37915b934b7ecf803e43c4cfac69c2e5e7f8affce35ba21f525d4ae69fbde1350cecea5710dcf6f0d0bf8eb2b85ab94d74") 5.438397863s ago: executing program 3 (id=596): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000040)=[{&(0x7f00000000c0)='c', 0x1}], 0x1, 0x2) syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100, 0x0, 0x0, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r5, 0x6, &(0x7f0000002000)={0x1, 0x0, 0x0, 0x1}) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r6, &(0x7f0000000540), 0x10000000000002be, 0x0, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000600)={@in={{0x2, 0x4e25, @local}}, 0x0, 0x0, 0x35, 0x0, "679f672c00b69e65b0934066fc7c34060100c09e33bd50116312e2b00fee650af69b2150ccaa762a3db7ad752fe616e085e991c0436e5e7111238865d27b4e82dcc94700ddd1878b088736009d15f9fa"}, 0xd8) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x20, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x8880) r7 = syz_open_dev$tty20(0xc, 0x4, 0x0) r8 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1, 0x0) poll(&(0x7f0000000040)=[{r8}], 0x1, 0x0) ioctl$TCFLSH(r7, 0x5608, 0x0) 5.264780668s ago: executing program 1 (id=597): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="d8000000100081044e81f782db44b904021d21000b000000e8fe55a1180015000600142603600e1209000d00e803f6ffa70016000a00034006000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8eb52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930df61d9d322fe7c9f8775730d16a4683f5aeb4edb1495503bccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece093870aed47037734730ffd8eb42a9ecbee5de6ccd40dd6e4edef", 0xd8}], 0x1}, 0x0) 5.025130542s ago: executing program 0 (id=598): socket$rds(0x15, 0x5, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) r0 = syz_io_uring_setup(0x19ee, &(0x7f0000000080)={0x0, 0x557d, 0x400, 0x0, 0x113}, &(0x7f0000000100), &(0x7f0000000180)) syz_io_uring_setup(0x6c80, &(0x7f0000000280)={0x0, 0x45886, 0x4000, 0x0, 0x8, 0x0, r0}, 0x0, 0x0) socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) syz_open_procfs(0x0, &(0x7f0000000040)='net/raw6\x00') syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') socket$nl_generic(0x10, 0x3, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000340)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_audit(0x10, 0x3, 0x9) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000140)=ANY=[@ANYRES32, @ANYRES32, @ANYRES64=r1], 0x20) 4.791298384s ago: executing program 1 (id=599): r0 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) pipe2$watch_queue(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r1, 0x5761, &(0x7f0000000840)=ANY=[@ANYBLOB="06"]) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0x0) add_key$keyring(&(0x7f0000000300), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0xffffffffffffff57, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3d, 0x2, {{0x6, 0x20009, 0x80, 0x0, 0xffffffff, 0x91b1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000400}, 0x0) 4.695788584s ago: executing program 0 (id=600): syz_open_dev$sg(&(0x7f00000004c0), 0x0, 0x20c02) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x1, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sigaltstack(0x0, 0x0) r0 = socket(0x28, 0x1, 0x3e) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8924, &(0x7f00000000c0)={'dummy0\x00', 0x2000}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f00000001c0), 0x2, 0x0) sendfile(r3, r3, 0x0, 0x6) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, &(0x7f0000000040)=0x54) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$nl_rdma(0x10, 0x3, 0x14) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 4.332153647s ago: executing program 4 (id=601): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r2 = socket(0x2, 0x3, 0x6) r3 = socket(0x10, 0x3, 0x0) rt_sigpending(&(0x7f00000000c0), 0x8) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/cgroup', 0x70000, 0x0) openat$cgroup_ro(r4, &(0x7f0000000140)='blkio.bfq.io_queued_recursive\x00', 0x275a, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x20, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x3}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x20000000) ftruncate(0xffffffffffffffff, 0x200004) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000080000020ac0100", @ANYRES32, @ANYBLOB="be0f000000000000000000005e00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB], 0x50) socket$inet(0x2, 0xa, 0x4) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0x20, &(0x7f0000000140)=0x2, 0x4) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(0xffffffffffffffff, 0x3ba0, &(0x7f0000000800)={0x48, 0x3, 0x0, 0x0, 0x1004000, 0x0, &(0x7f00000001c0)}) io_uring_register$IORING_REGISTER_IOWQ_AFF(0xffffffffffffffff, 0x11, &(0x7f0000000240), 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e20, @loopback}, @in6={0xa, 0x0, 0x0, @remote, 0x7ff}], 0x2c) sendto$inet6(r7, &(0x7f0000000000)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) recvmmsg(r7, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f00000000c0), 0x1, &(0x7f00000003c0)=""/21, 0x21}, 0x1ff}], 0x73d, 0x40000040, 0x0) 4.251083154s ago: executing program 1 (id=602): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890b, &(0x7f0000000080)={@loopback={0xfec0ffff00000000}, @private1, @local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x280}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r4 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000080)={0x8}, 0x10) write(r4, &(0x7f00000003c0)="1847ef36e9673700004dac009b8a140500003b9b301f000000ecffff1ffcc63c8e5226c2c6ad573fe93bdaaa7cfe7afc09b4c6ddc6c784c729f71248219e2b72f908b03c9fc6cb661b095a37921a93461321be39a3bf370bb63d2cf46f4b6fc2f12c1cefb7619686f2db566df379143cb156618d53d347c12e45601d2324be068b74c43ee54100f4f751caf486e9181856be99d3537f978f27f4f61790036d7ede94cc1dcc93f4e55831f352d86bfb7ceb80a4b783bde313c981677b3a27561156359df745c24372321c502c22ee7572eb199ee8c34f4eccc046e78a956e342ca670b4c5fe87ceca39baf2593f", 0xed) socket$kcm(0x10, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x3a) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f0b2ad1eb9769d74e4f1feff374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724190000006f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0ed9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627820d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b4047979379dc15c9056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221f05e6ca8c705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f12fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab778c50a3337a78675f38a568612aa25d61ce4e2c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008435f39381c2a77c001caae53db7316fa6d48d032ab6831ebb813c85855c7a9ad8140a4b29422fc20d4e75c848984a2e217ec9c2833b8fa9106ee1be2c05103a36fc1126f1aa5284ba7179843b08ecadc199b9038cf6b9ee4e1f321a6a32e03bd987ddfada1f69756651b73a7ed0f7e467081193b28448692686ac80d81a89f9c29e276800"/2574], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r6 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r6, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) r7 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r7, 0x89e0, &(0x7f0000000040)={r6, r5}) sendmsg$kcm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000200)="1f", 0x1}], 0x1}, 0x40) ioctl$sock_kcm_SIOCKCMUNATTACH(r7, 0x89e1, &(0x7f0000000340)={r6}) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x3, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000240)={0x3ff, 0x0, 0x0, 0x7, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000c00)=ANY=[@ANYBLOB="bf16000000000000b70700000100000048700000e4ff0000bc701000000000009500faff000000008aa1210b29017b83c8e96e6405f798585fb5030b3388b0409a814343f1ae341b74efa745a12f5c0685e5261482e31e0cacc902c97e6145ef48004d26342c94f56a39359ba56724e4535d80ffbd6848d53382c26211a2b975eb4a9d08501c000c00000000000097e50f118c4a3b05489d1d1245cb774879b0070000000000008cca1a363b2b28add613658171122dc01e0a77d7c44b009fdac91fc827f5797532750d4d4639f11089feb3f25b4695c6dac2cabfa04e2c16fa741b0665bb33be6f0e742213d0bf5528a601b5934b867f39f7d776ac06a434949b4455b7c6c678de4d9740d8dff6169c664b55ce550fb4e686ae169d9f7abbeb08e02799374ae0081858bdf144d8c7fb67dcec5e43a0e8099e543116b1b7d144b5613845cca4388344d82de45f0c1b7d041db040fd777791232d5db32d14bc1c3d000000000000000000000016a1049b6f094e504c28d7daa2f61b2a7c14d2343b4308b36e6b141371c958406e212b3accb45f87aef8bd5e2181fd7826b9e5cb2f6a63f113491239dca17e4fb33e670daf1cd7a99015ae9e1ca32b4e64dc38b55d525bd10971b0898be9d6e6154dfc99b20622b604b87ba03524c2fed51056d672b1b966657de5c86ab09195fba55af17663fecf1b5c5a76cf07615c7ee54c361449e275371a8c4243b9060ecdeecfb1603b061a8a62159830049061800953f7d00c43c95068c62c2ca1ad7fea9de97216dbc9c8e36a5607608e77d1d7d72b78b4f1eab8e40000000000000000adc90eb850f42f44e4b48c9cc39412c0ce6c9f4b95936ec36efc8dfbc54eb44affe1cd0f14d124df0c29c51b5628646b8155a1859358aa08f71fd2d9b2c4288a0d8870e8767173c65476e1a4f000c580f61d73f5be35ca1aa1235cf3096526dedec1199479b1b5adfaf2b6e05b7f90c9098ed4accddabd802ac5dc1b436e00"/738], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffcf8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) socket$inet6(0xa, 0x2, 0xffffffff) 4.196441261s ago: executing program 2 (id=603): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x20, 0x3, 0x3, 0x301, 0x0, 0x0, {0x5}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0x0, 0x9}}]}, 0x20}, 0x1, 0x4000, 0x0, 0x20004000}, 0x4) 4.167136929s ago: executing program 3 (id=604): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/fib_trie\x00') r1 = syz_io_uring_setup(0x22f, &(0x7f0000000080)={0x0, 0x1, 0x10100, 0x3, 0x20000}, &(0x7f0000000300)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r3, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) io_uring_enter(r1, 0x7a98, 0x0, 0x0, 0x0, 0x0) preadv(r0, &(0x7f0000000b00)=[{&(0x7f0000000300)=""/30, 0x1e}], 0x1, 0x80000001, 0x3) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_open_dev$usbmon(&(0x7f0000000280), 0x80000000000000, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) pselect6(0x40, &(0x7f0000000600)={0x6, 0x0, 0x0, 0x40, 0x2, 0xd, 0x0, 0x7}, 0x0, &(0x7f0000000680)={0x7ff, 0x101, 0x9, 0x7, 0x7, 0x0, 0x5, 0x27}, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) 3.888569595s ago: executing program 3 (id=605): r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) pread64(r0, &(0x7f0000000000)=""/30, 0x2a, 0x5) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) syz_usb_connect(0x3, 0x36, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000000050005000200000c12000300686173683a6e65742c706f7274"], 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000090601020000000000000000020000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff0500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) close_range(r1, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) close(r4) execveat(0xffffffffffffffff, &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0, 0x400) link(0x0, &(0x7f0000000bc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r5 = fsopen(&(0x7f0000000580)='overlay\x00', 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f0000000000)=0x3) ioctl$PPPIOCSPASS(r6, 0x40107447, &(0x7f0000000080)={0x2, &(0x7f0000000100)=[{0x50, 0xff, 0x0, 0xffeffffd}, {0x6, 0x60, 0x0, 0x8}]}) write$ppp(r6, &(0x7f0000000300)="5af9", 0x2) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) 3.777576769s ago: executing program 2 (id=606): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000300)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343e", 0xc4}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4004}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2, 0x0, 0x0, 0xf00}, 0x0) 3.412425797s ago: executing program 2 (id=607): socket$inet6_udp(0xa, 0x2, 0x0) fsopen(&(0x7f0000000140)='ocfs2\x00', 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$inet6(0xa, 0x80803, 0x87) syz_emit_ethernet(0x5e, &(0x7f00000004c0)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb86dd603000bb00282b00fe800000000000000000000000000000fe8000000000000000000000000000aa87"], 0x0) 3.324089786s ago: executing program 1 (id=608): syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100000cb768405e0483020b9901e4020109021b000100000000090400fb015c291d00090509"], 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000007, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000ede000/0x2000)=nil, 0x2000, 0x0, 0x85, 0x4000) socket(0x3, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00001f0000), 0x1000002, 0x0) syz_io_uring_complete(0x0) sendfile(r3, r3, 0x0, 0x7) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0xf, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'team0\x00'}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000040)={0xc}) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000007329c5ad5fdcaa41844dd311efe5696c1af48007f19196a2455c2214c4425908c2e485061828a480", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0xb, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x7, 0x1, 0xb, 0x6, 0x8, 0x10}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r4}, {}, {0x15, 0x0, 0x0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2c, '\x00', 0x0, @cgroup_skb=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="300000002100050100000000000000000200000000000000020000000c000c4000000000"], 0x30}}, 0x0) r5 = syz_open_dev$sndpcmp(&(0x7f0000000140), 0x3, 0x800) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS_OLD(r5, 0xc1004111, &(0x7f00000004c0)={0x2, [0x0, 0x5, 0x10], [{0x2, 0x0, 0x0, 0x0, 0x1, 0x1}, {0x40, 0x100, 0x0, 0x1}, {0x5, 0x80000001, 0x0, 0x0, 0x0, 0x1}, {0x4, 0x80000000, 0x1, 0x0, 0x1, 0x1}, {0x6, 0x10000, 0x1, 0x1, 0x0, 0x1}, {0x2, 0x5, 0x1, 0x0, 0x1}, {0x6, 0x9, 0x1, 0x0, 0x1}, {0x7ff, 0x62, 0x0, 0x0, 0x1, 0x1}, {0x7, 0x1000, 0x0, 0x0, 0x0, 0x1}, {0x7, 0x3, 0x0, 0x1, 0x1, 0x1}, {0x3, 0x9, 0x1, 0x0, 0x1, 0x1}, {0x6, 0x7, 0x1, 0x1, 0x1}], 0x4}) fsopen(&(0x7f0000000180)='hfs\x00', 0x1) r6 = socket(0x40000000015, 0x5, 0x0) connect$inet(r6, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r6, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) 3.019258413s ago: executing program 2 (id=609): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r4, 0x5452, &(0x7f0000000040)=0x8001) r5 = getpgid(0x0) fcntl$setownex(r4, 0xf, &(0x7f0000000140)={0x2, r5}) fcntl$setsig(r4, 0xa, 0x1c) sendmmsg$unix(r3, &(0x7f0000006c40)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="11", 0x1}], 0x1}}], 0x1, 0x40015) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, 0x0, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r6 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) close(r6) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000180), 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x8e79f0352167ea94) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000180)=ANY=[@ANYRES32=r7], 0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000001540)={'ip6tnl0\x00', &(0x7f00000014c0)={'ip6_vti0\x00', 0x0, 0x4, 0xbf, 0x5, 0x7fff, 0xec, @loopback, @mcast1, 0x7800, 0x10, 0x3, 0x7}}) sendmmsg$inet6(r6, &(0x7f0000002b00)=[{{&(0x7f0000000040)={0xa, 0x4e24, 0x8, @mcast2, 0x1}, 0x1c, &(0x7f0000000c80)=[{&(0x7f0000000280)}, {&(0x7f0000000340)="c9342d1d47082384d21cc3da4221c21499cb9aff7504719532dec43f8b8a84d2e8d0047f5cd83617cc6f05a97de17af09048ec10ab852cd5f9cb11d6c7c0f073b8c467", 0x43}, {&(0x7f00000003c0)="48f04544a9ef3f888441f89a07f9c71720db4e91739b000e6ff3f4a0eab33988a8043e21841140c983f578dc1e118ce44ffc02da651a646148b35cd4c76e6eda0a10efd8c727bc4d1cf236b89c4e38b3e12c2d8a8abce222413866f9e3735da47d08d6400d66f2892b4d1f2a0cfd1dfbd7bbbf439427848b716a890a2a0592a3b931fdfdf3614d8a4256f37775e30b71cfda0af9ff982a062d96048c8438ddfdd00eb65876779d5782", 0xa9}, {&(0x7f0000000480)}, {&(0x7f0000000500)="85c7efc81cfe3579630caec22ed9b8ec57fe2e228e335454462c696f02187faeae988e79405b602fe1d02b4aa8eaab", 0x2f}, {&(0x7f0000000a80)="4af71c22bb6b7b683325255a22de452a6fb517d0f3154578ebd9820a371ef2c8ea8b01ecd628d57c26a4b152b19281c6ccc57fb55abeac3ceae1cec44005ac624156f4506bfba05f8fee4a31700ecfcf4ddec8763eb6", 0x56}, {&(0x7f0000000b00)="618051fe2a21aacc71926f8b325226c8f890939494ee277ad16bacc8eef2e4ca7a618a69b7c76826a082", 0x2a}, {&(0x7f0000000b40)="40b74ec1069cf843761604de2efc53e5542d8dcf4cb47e5c13135ace45e9da2c61bc6730c423fe5cabeff48dc2c107ddd857337c0fa5a7fe8cdb632bd70b9e304a1113b8943cfabba0a186b1fa6a56e6349cb76be4d65ca30ff8eba1d1523d3d4fd08442728486577333942365321986b8f4f4d5004fb22ef466af5828d0358a4d0cc4987bf3d64804cf23f21b867d522ff4169912e64565eda479d1e15ba5c96e1d82cbfb7d639cb72914852dcec2dc75eebcd12e0023f561cdd3eea94e5f96f0236a77", 0xc4}, {&(0x7f0000000c40)="317381207846e3d8bf701cd39a2e72e835e9b140112a9a8ac3f6aaa934", 0x1d}], 0x9}}, {{0x0, 0x0, &(0x7f0000000f80)}}, {{&(0x7f0000001000)={0xa, 0x4e24, 0x4, @private2, 0x6b83}, 0x1c, &(0x7f00000010c0)=[{&(0x7f0000001040)="a147efe8a0d0b944eb03f958963b040471dd9bef93c74f297069f33ad403376107fbf9c1049e7959eb0a24a02f8e2db0b7c3085462ffa6f4b9f38e253bbd2d19ab74018983b72510df68bf3eaaefc55369c29bf3fab420414d078b330b8d181efa51045315", 0x65}], 0x1, &(0x7f0000001100)=[@flowinfo={{0x14, 0x29, 0xb, 0x3}}, @rthdr_2292={{0x98, 0x29, 0x39, {0x5e, 0x10, 0x3, 0x0, 0x0, [@ipv4={'\x00', '\xff\xff', @local}, @private2={0xfc, 0x2, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x32}, @empty, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, @loopback]}}}, @hopopts_2292={{0x18, 0x29, 0x36, {0x3c}}}], 0xc8}}, {{&(0x7f0000001240)={0xa, 0x4e24, 0xed6, @mcast2}, 0x1c, &(0x7f0000001380)=[{&(0x7f0000001280)}], 0x1}}, {{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000001400)="80ee76db3229670cbadf82b0479a23090f77ec04af88a2a6459635227bfcb85cf5805929ec89ad5abcf0aeb7dee6f81e67b1aaf662048091c8c77f467ee572fad6352f23fd8debe398aa3e5889ab30760ea288423fa45e68df91398b57bf45bcc8400c513a1a19e4831ab005", 0x6c}], 0x1, &(0x7f0000001580)=ANY=[@ANYBLOB="24000000000000002900000032000000fe8000000000000000000000000000aa", @ANYRES32=r8, @ANYBLOB="0000000068000000000000002900000037000000000900000000000005020008034496f4273bd8186195c889dc2d4a18a09eecf30dc1d5f637f6adc8297423cd7ca647615b0e5b02434fda43ff0a2b232d53eafeeb2868906a1871bae5b16148165b4b3657d5000100000000a80000000000000029000000370000003311000000000000041a391c306e1b4341b9afcbf176d44ea962aef7f65fdb387f271f55010100c000c910fe8000000000000000000000000000bb075800000002149baa5609000000000000000104000000000000a7f4ffffffffffff010000000000000005000000000000000100008000000000030000000000000001f0ffffffffffff7f000000000000000000400000000000000029000000360000002c04000000000000071800000003043b06000600000000000000040000000000000000010001"], 0x178}}, {{&(0x7f0000001700)={0xa, 0x4e20, 0x3241726e, @mcast2, 0xa7}, 0x1c, &(0x7f0000002740)=[{&(0x7f0000001740)="2bccce3426f1abe9a692c7d010644d7c4a160b6c55ec2ee184649b5d6a001143c554bf60dc3e93cd41c6f4fb5fdbca5b2401f46f62ffcdced46e3ebb60a72644d17c95fbbe2e11f9cb6483ab8043d46cd3c11f444695ba0ba7494e6da9c669aa73271be9cc6bbe6ee2648ac121cd64ec701964c354aedc5abadaa83f7b380406c22d51e12c4f181ad455f60aa5483eb039727a1b0c663e9c0201e6dd24134b202b05f54e08c54f9b86c76c3280139dc9cff5e528e3a9082fe245cc720e80b77cd8590e658ba13c7b823f22dfaa1b1117769af2c178fcb478cc824dba5744234f8e37ee329127f71a9d14a1e12e3c3b2b05dba7f4ba0cb94848637c91af4d436304405dfeeea035561f98dab1a4c6473d8e27f1a456171c7b0db0c3f50821c92a860789dbc01b5b672795246051bd376364ac693f5050bdee573c8622218743e9260a8d4db5f5074b8017265daee4b20e896870bd379647728e94ee5fd9cb5b750bbfb52c061b8bf201551177e1cc94e651bb8877f7286d02bebca789cb4df1923f5a184febbd3f46732b958df1dd811a610e63a9b6dec40455f948b75cf5afec6d018094552897adb846439f8df005c1f57aae57fdffbbae77bf479351d64e93b19592380fbd0ab9eb9813aaba24952deed38c3f16f5cb9b0f8863d95593d53d13ab335f2adfcf93601cbb7d6cce31cfbc310f3d738a247d472b364c9e65d1a6b96e7a9334a9e2aedaa05819c6117597ab015bc6348cf97e434bb7df1044105a402b061f65f94573b7828305d73953b9f998589bbf338cc1c132c56d81411448fe45c8188ef331d549446a8915cc98d11cfb77fb91da44212c60f2a18baa48deda589d96aee280ed045564fec42647a68b162c0a1834fd0f569cb27c78f20f593a101b65b68bf6afc8b3b8076596a8159333c97a4fb98b13b4b1e7f53517225397f70921d7c8d78f68d8a5c9fb316183ae8c45c7290f333ff607b3ed66f79a78e811637ac3bb6e9e1201806961b6c2bead1559e6e6eb17c49494d88fe3bf2a585a40b4b98e2f0fa0f00593082294430eaf8ec63fc5697cd29547fae091b8ee5dd4b2801702c226aa45b35db7603c2ea19c9f975d3d3dd8c5f3a61267997d8d4ef0b967e76871087bbd662b61fb215b86f433ed7e1b197111f5043ddb49fa89e2f0e8cbe9c2b64d29d66314f3a9bd6d1924a5398225483c7939c6d619d759309d1179f9659cc73063b906119668d3e7d605cbfdf3aeca5e8d9dc84b6c1f8e51cead14f2ec26739b24a57afd033aaf567406a3506cb674794deb4ed5d98fa880ce2020817f6f56040c2adb0f96dae826abbb07b441b81e3a652356387e9556a66d4263b84be3b5013594087f94bafaddec3471885ba330bd2d5bba8b4cb652480118c56444a426318bf02a22c96c65d98c66bde96b975333659939bdf0fdd280b10f30221b685d163519d8e787d09679e4d7830a7d17be709d6a8d47af8daecfdf372ed7a61a47f7c45d0651cd8c2fab7b217df87edc340c1703214081f5d05f6f312792175eebacd22eb081a9a97bca4614ff263e74e73494550cb0b3587b6326889e396e2c08f6161a92df9c2b4cf0db9e6c3f2ef1954574af71e622da792d28020beb62ecf33e151021cd22a572484a6706b0b120b2355d566ae87e454ef854b9cebcdf60e749c39256d8eba628799cc9971c125ab377306c1d7d9a4022c60004599e6223380c3fbb8855fda5ddfd32836e6dd180e0c558d24684f886ca5418fc50d63ee699e085e013c2f1e25f68dc35e23fb4fe2f3ae63dd72057e18eb8708370dfc0336ee39b3e3e03b8215f552e3e54f74c2a9b9d0c3dccc64d7e6b0e62f53afecd38865d839feaf6a8664f6d7cf59015be92320b8b583596348cb78705bbd63687adebd4fc1d9729621538de0ffdf7675880dbbe41192890126198d89ff8941729009a927a48b2c310ef871c00c51ffb76ac05cdeabd2dfa791ab89ae1950653a7a0f91002dbdad3e14435ff225bef8a077c5e05341a4dfc171d2f55383332ef73686ddc0bc16a5d913cb2681dfaf351e2289c6182896870af45d6c68a15c3fdb8d98a1731377eb3e66d28f9cbcc014d4c2d82c6a90706f4748cf7acaa47765b94451c046ad3cf4abea7dd3e5abc4dbc8db260e7ccd4b6ed5299622d88fcb662ae0a023c65c24c6efa40073a747838b198df6ed407f276bd980fc8cd9891f6a0da012cd13115bd6080485c5743d47d96a1fef5b3b93e2b37adfbaf5185425ad5b9e4c4bdfbb67bfe03996643edc3a541cddae0516e35db87273596eaee3f1f12cfb59611d71a00b061a8db7caf2202112fe87138fc078f6250bebf67532e9dc516bea3c92af10efa86a8c534bb5e8d842fdbac1114231b5cc8b2a3a53149ed07e9f3283034e49cf6a592e77569385a70645a9c013118711db60d9fd9f0bb34617deb1eb37c1468049bfb36b265f755f2ef4e1effc6a21da18d5f9b50fcd7b86439406c97d6cad4289ae7d44213b0f7277b467a7a5bd4bb4e8f0da031f729792c1c75fc237922aca1947b13fef72019c9bc628233a98240e6ae1d06073fcd169ad5d0ebad8f8f477463760cfa5006ffc821bbc785a37899b5e74a9c745393aabc7d3ade7b93cd011c190c638b8667810ed3e91eaafad3d6d2e09251d6c75da365753cbe7c8fac3893a8878bc42843376c3d6b53a34fa4e04e2fccb73e71ea20cf49b545f4d8e7fd38c8a02b3c5ce4445b5748c92f22608742863d2fcbf0929415311bb0a92fac4d7e710190b2a228b04588c4b26a4a5d75ae583d6a876dfd508371feed164ae4db810d3d29a09f0fb7ab0d82b80970a90ee11f539617476b4bfd92e95f21daa175ffe5c35fbdacec61bfe09846a0b223c6ec46ca3c0d7545a06a8fe822863bc5314d8a4275bd2cea7a5b54b9d67eade1925ce76b419e14bb1dd2a34779b36a27352654d716d2d4411a62c8579794b49684bc015a22b641c762930e3dbf315872c2585cc488f631a050386fdd21ab5049ba53b67c3aec883dca3018d625836d4641d013e7cdc64f000f3b44e310c56e066ad1a2715423561fe4116e6a3c84b80c0560968b23fa12ef81c2cd3f68fe33031eab3378f1b17eb6b9fe3f1b05c5e59d5f8adcec811d8f95d362f0116d1edf0a3375b307eb7ff2c13b80fb1fd68a844a0ed75734b91aaa700e7f6be237e91dd9462c40cca47dce3cd5cd69b14ce3fa7fa39589e4875276d5ef7bd93efb7444f5fd3eb18968900799f34ab309c87b854e1a6c7e2d3fa646cfb604c52cea549eace3e75a2a1b6579614cf846736c529315e62e581d1da7966aad0d20c246405587c8c386ef2813aa8ca554a334ee6d5f89bf1fa4d59c366739eededa88b71a0613c15266fdf6801faacd6dad6b019acdfdeb4ecfc97b310ca10686929a09ce06ae2df0ed19ef0c94659be40c2f90a054b67ace48ae6ba52a56e705cc35efdffd52c1ecab3200778dbdabfefdacbbfccc342038b796037819ffc48de75ec60099bb703f1c2ec3497a32fa499fae8efccb189edcfc3ecc13c2292d79eb4ec2252e65983da30f732b05cb405834b0d70fd11b120fcd6c08006113972c1632e06f4381c12ad3b9b077e40beb21978ae82b2092746e3f423c0bb9b8df7b0f657312d8fafc73aae9b5ada396522803b24335387a2ef02583cabb75310c5a7bff7cddfba2f70581ee356413e1673ff780e321e1cb86ae87e6add4ff0c4c85ecead4a090267505e9e1e3127c07a37ec7fd0ff3e037604b95dbbb236b9a06222684eaae7c6059d2ba11688fed2a73aacd0c4e73f63cd582c804ecc34dafc8633ba3c44536d8737b296a65ad6c8ceaf5438c664852c0ab1eb133293118ddf51bdc1e580b468788d6b4f2838bb5e330dd630de23447da8c8326eaf413498a6d3f2caf73fc0236e9404d51622333a63b9be427d37b3133c62fc8c60a851a868d0e989daf0b13efc64587be1d86b71a11d7481bf8c50ca20c9e1654d63f0db86ddb3304a8c735530727762bc12eccf538da9be6eff85de6d254a763035f1db216be0a3b9b610f7fa76ebcc90099f74aff750bc8e2765c9f3780e90941ab3a035d417ef2f42817df093838f076b46ef356ff8fb56559eeab92f333288729e2320c68aab151ad9fc31fba76b1413484b7934d9593d77ec4628eb1f0d7b8fef99a37946c144ca3fbbf005b72f1179650f2036c982a1124cef5f71751c6a1cde65b6ac47efba76c5b1313111ba7b349dce54aa387deb9250931d557a02f248f2dbc6ac2786cdce8e274cb7a9d15f68878e46e7a6fbd50c8b37d0431efb9f68c791aac07d1d407d0cef2207162c93e9843c6858aba53997c3f33287edc8b3736867ca7f9360f1c91817de129ccda9e517107010c8ac10073dfd3300366423f8357fa6e23285e0b1d5ef52475641a8e092b5d0b4a6fe24a6c7d218f74dac4ca62ac8f7715a8eb3726f81ec90a3a9a8125b62524f4cb661d15ba8b4d497a75fb306c4d6f666403c83d54eb1e3ddce8d62bc0355b101beee78927ceb4453e406cb66590120f4c1271d320bb6710a0253ccbe061da2e144f362e6f826e87421fc517a29c78f0566dcba24a44fbe1f934d81dd58ad931c18dee87a4bc5fa8edd6ca1fe4e2077127728c36866204906809bf11baa06638cfc6e0d224b7f7937e89d944374148a91e330386a126f92e9c556663196310ef94381c59917910d1a48bfa567638e161a9125fdf03c80adc715f16ed1ab65a0a061844636c0e000713c0ede8dbdf472ebcfebe03a9c9147d55c965722a9396524bfcd93d512425ec3c6ea0a990b86ba3e81eee5d5c43661633f84b827cbe66bf31a0b144c804bce05f10d98ede240157f9742d5368c1b3c4743ba3c825a5270a4c54fb25242640c6a0e048f3ddd6f3664bb74ff609ce3c710e3fda640164051dd72f88cd72573c5119e1d076ce3da3582109774d0d79baa678b9d3340af99c08a6bbc7ba4ddd382e09815ebb50e1f284e3123b8e4bc477d65a2f0b4ed777309d04fef051981514f5672107b9acf134d24d1c6adb9224136984962029363bade0d32f57d27c993e4af43d224cbe84278fea3ba5786da48b2c7958d5d63cc1db693f63386811d920ab0c95ef43a98478d277e30026d837889e1d094866cd4959b6ec0cc77180aefa04364c55df8dd69a672652cca72f719587b57a07e36f154326f7829a2e9184c243a16a2fd1fe24b79ccf4d3233c1a92e88bafd614b96e0308c18fae70d2699c51a07b4bffbc393c9506858725a1b489ca5e02fea7351e82162489624cc1798421736d9a186f3787aae090f5581ec3b6176eb9b07879cf3326fbf3e1e31d95bc2341c74e940817960010b6ef81ca56b1a1517dfac1ef0abf20e73ca9c625cff0ab516c7e671dee9877daf76d1100dff26b51aa3ece81b86204922834bda5e00ac55884aaec3c6af2b044e9ed1a216777a387fcd5bf7d698b6e91dd8c24934cd4d78024378b9b9433203dbcc99bfcb166988b4cca7a9e410bd489957b525decfcb0727f64e80a815f278eaef9368987adc97599daf6f429dc62f9f43ac5d2140423a13b0d07d1c5176ed3957629df69c6134a2b8574987582fbeb513b09e41c1b14149a8e53c2add0fed8bd6fd91d63b161ae36d26e98e59e6144d4295c37e4035d81481d97a2cbc8c098137f480107eaf760f", 0xfbc}], 0x1}}, {{&(0x7f0000002780)={0xa, 0x4e20, 0x1, @dev={0xfe, 0x80, '\x00', 0x29}, 0x8}, 0x1c, &(0x7f0000002a40)=[{&(0x7f00000027c0)}, {&(0x7f0000002940)}, {&(0x7f0000002a00)="54f985118a12f7be37d44dbd83d60682aab5cab9cad3d574e5bd555a1c", 0x1d}], 0x3, &(0x7f0000002a80)=[@hopopts_2292={{0x28, 0x29, 0x36, {0x84, 0x1, '\x00', [@jumbo={0xc2, 0x4, 0x6}, @ra={0x5, 0x2, 0xe78}]}}}, @tclass={{0x14, 0x29, 0x43, 0xd2}}, @flowinfo={{0x14, 0x29, 0xb, 0xa}}], 0x58}}], 0x7, 0x24004001) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x8, 0x3, 0x4d8, 0x340, 0x11, 0x148, 0x0, 0x0, 0x440, 0x2a8, 0x2a8, 0x440, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x2000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x21, 0x0, [{}, {}, {0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x4}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x7}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0xf}]}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xd0, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x3}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x538) 2.632555726s ago: executing program 0 (id=610): r0 = socket(0x10, 0x80003, 0x0) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904000a000000fe0000000000000008000f00fd000000", 0x85) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'sit0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r0) 2.246959857s ago: executing program 0 (id=611): r0 = openat$hwrng(0xffffff9c, &(0x7f0000000000), 0x80800, 0x0) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000080)) unshare(0x6a040000) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000080)={0x0, "4fcb813dd28b42bee2b094a3de6dbfd30a74457bcd1cfd5feffe5c019f45d57f", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r6, 0xc0303e03, &(0x7f0000000180)={"000000149c0286e08ffad43c40fc0a000000ab65a29e23546aad0281b3aff5eb", r6, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r7, 0xc0383e04, &(0x7f0000000000)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r8, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB='8\x00\x00', @ANYRES16=r9, @ANYBLOB="0106000000000000000009000000240004801300010062726f6164636173742d6c696e6b00000c0007"], 0x38}}, 0x0) r10 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_CON2FBMAP(r10, 0x4610, &(0x7f0000000000)={0x9}) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet6_mreq(r11, 0x29, 0x18, 0x0, &(0x7f0000000640)) write$uinput_user_dev(r4, &(0x7f0000000500)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x55f8, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x200000]}, 0x45c) ioctl$UI_DEV_SETUP(r4, 0x5501, 0x0) ioctl$UI_GET_SYSNAME(r4, 0x8040552c, &(0x7f0000006480)) open_tree(0xffffffffffffff9c, 0x0, 0x89901) 1.559924496s ago: executing program 4 (id=612): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f0000000000)={0x0, 0x1200, &(0x7f00000005c0)={&(0x7f0000000200)={0x6c, r1, 0x1, 0xfff5, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x13}, 0xf8}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast1}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}}, 0x4000004) 1.080104985s ago: executing program 4 (id=613): r0 = socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect(0x0, 0x3f, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r3) syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r3) recvmmsg(r3, &(0x7f00000086c0)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000001b40)=""/153, 0x99}, {&(0x7f0000001c00)=""/4092, 0xffc}], 0x2}, 0x12}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000380)=""/188, 0xbc}, {&(0x7f00000001c0)=""/37, 0x25}, {0x0}, {&(0x7f0000000640)=""/60, 0x3c}, {&(0x7f0000000840)=""/249, 0xf9}], 0x5}, 0x80000000}], 0x3, 0x10122, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r4, 0xaf01, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, 0x0, &(0x7f0000000200)) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x800, 0xfffffffe, 0x0, 0x0, 0x3}, &(0x7f00000001c0)=0x9c) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) bpf$PROG_LOAD(0x5, 0x0, 0x0) connect$can_bcm(r0, &(0x7f0000000040), 0x10) sendmsg$can_bcm(r0, 0x0, 0x4048884) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'sit0\x00'}) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000004980)=@newsa={0xf0, 0x10, 0x1, 0x1, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@local, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x80, 0x0, 0x6f, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x14, 0x6c}, @in=@empty=0x14, {0x3, 0x800000000, 0x0, 0xfffffff7ffffffff, 0x0, 0x0, 0x1000000000000000}, {0x0, 0x2f}, {}, 0x80000000, 0x0, 0x2, 0x1, 0x6, 0x28}}, 0xf0}, 0x1, 0x0, 0x0, 0x4004050}, 0x0) 0s ago: executing program 2 (id=614): openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) (async) r1 = socket(0x400000000010, 0x3, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x40, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x4ca31, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600a00, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) prctl$PR_SET_MM_MAP(0x41, 0x3, 0x0, 0x0) mprotect(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0xf) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00'}) prctl$PR_SET_SECCOMP(0x4e, 0x1, 0x0) (async) prctl$PR_SET_SECCOMP(0x4e, 0x1, 0x0) io_uring_setup(0x6501, &(0x7f0000001300)={0x0, 0x83be, 0x1046, 0x3, 0x1}) (async) r5 = io_uring_setup(0x6501, &(0x7f0000001300)={0x0, 0x83be, 0x1046, 0x3, 0x1}) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="120100009080e140fc044a500243010203010902120001000000000904"], 0x0) syz_usb_control_io(r7, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000680)=ANY=[@ANYBLOB="400e0100b40001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r7, 0x0, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) syz_usb_connect(0x4, 0x2d, &(0x7f0000000080)=ANY=[], 0x0) socket$rds(0x15, 0x5, 0x0) (async) r8 = socket$rds(0x15, 0x5, 0x0) bind$rds(r8, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) (async) bind$rds(r8, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r8, &(0x7f0000000100)={&(0x7f0000000040)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f00000016c0)=[@rdma_args={0x48, 0x114, 0x1, {{0x0, 0x2}, {&(0x7f0000000580)=""/154, 0x9a}, &(0x7f00000011c0), 0x0, 0x60, 0xffffffff00000005}}], 0x48, 0x80}, 0x0) (async) sendmsg$rds(r8, &(0x7f0000000100)={&(0x7f0000000040)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f00000016c0)=[@rdma_args={0x48, 0x114, 0x1, {{0x0, 0x2}, {&(0x7f0000000580)=""/154, 0x9a}, &(0x7f00000011c0), 0x0, 0x60, 0xffffffff00000005}}], 0x48, 0x80}, 0x0) preadv2(r5, &(0x7f0000000500), 0x0, 0x4, 0x80000001, 0x0) io_setup(0x6d, &(0x7f00000000c0)) (async) io_setup(0x6d, &(0x7f00000000c0)=0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x14, &(0x7f0000000000)={0x0, 0xea60}, 0x10) (async) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x14, &(0x7f0000000000)={0x0, 0xea60}, 0x10) io_submit(r9, 0x2, &(0x7f0000000240)=[0x0, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x0, 0x5, r6, 0x0, 0x0, 0x0, 0x0, 0x2}]) (async) io_submit(r9, 0x2, &(0x7f0000000240)=[0x0, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x0, 0x5, r6, 0x0, 0x0, 0x0, 0x0, 0x2}]) syz_clone(0x648e7000, 0x0, 0x0, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): time_get+0x3e/0x1f0 [ 134.793167][ T6475] ? __lock_acquire+0xab9/0xd20 [ 134.793195][ T6475] ? madvise_lock+0xda/0x200 [ 134.793224][ T6475] do_madvise+0x174/0x220 [ 134.793243][ T6475] ? __pfx_do_madvise+0x10/0x10 [ 134.793255][ T6475] ? __irq_exit_rcu+0xca/0x1f0 [ 134.793293][ T6475] __x64_sys_madvise+0xa7/0xc0 [ 134.793309][ T6475] do_syscall_64+0xfa/0x3b0 [ 134.793324][ T6475] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.793338][ T6475] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 134.793353][ T6475] ? clear_bhb_loop+0x60/0xb0 [ 134.793371][ T6475] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.793391][ T6475] RIP: 0033:0x7f455b58e929 [ 134.793404][ T6475] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 134.793417][ T6475] RSP: 002b:00007f455c3ed038 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 134.793432][ T6475] RAX: ffffffffffffffda RBX: 00007f455b7b5fa0 RCX: 00007f455b58e929 [ 134.793443][ T6475] RDX: 0000000000000017 RSI: 0000000000800000 RDI: 00002000000ec000 [ 134.793452][ T6475] RBP: 00007f455c3ed090 R08: 0000000000000000 R09: 0000000000000000 [ 134.793461][ T6475] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 134.793469][ T6475] R13: 0000000000000000 R14: 00007f455b7b5fa0 R15: 00007f455b8dfa28 [ 134.793491][ T6475] [ 135.164301][ T6476] syz.2.163 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 135.290683][ T43] usb 4-1: USB disconnect, device number 3 [ 136.237530][ T6494] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 137.058820][ T6508] netlink: del zone limit has 4 unknown bytes [ 137.325657][ T6515] veth1_macvtap: left promiscuous mode [ 137.342066][ T6517] input: syz1 as /devices/virtual/input/input11 [ 137.352318][ T6515] macsec0: entered promiscuous mode [ 137.598529][ T6528] binder: 6526:6528 ioctl 400c620e 200000000280 returned -22 [ 137.722363][ T6524] geneve2: entered promiscuous mode [ 137.727695][ T6524] geneve2: entered allmulticast mode [ 137.747412][ T6530] vivid-001: disconnect [ 137.909795][ T6527] overlayfs: missing 'lowerdir' [ 137.993929][ T6533] netlink: 24 bytes leftover after parsing attributes in process `syz.2.182'. [ 138.076643][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.083524][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.367861][ T6520] vivid-001: reconnect [ 138.763845][ T6541] blktrace: Concurrent blktraces are not allowed on sg0 [ 139.351412][ T6551] netlink: 8 bytes leftover after parsing attributes in process `syz.3.188'. [ 139.433597][ T43] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 139.451752][ T6559] netlink: 8 bytes leftover after parsing attributes in process `syz.2.191'. [ 139.570195][ T43] usb 5-1: device descriptor read/64, error -71 [ 139.740129][ T5902] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 139.831793][ T43] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 139.910803][ T5902] usb 1-1: Using ep0 maxpacket: 8 [ 139.937229][ T5902] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 139.974444][ T5902] usb 1-1: New USB device found, idVendor=05ac, idProduct=8246, bcdDevice= 0.00 [ 140.000104][ T43] usb 5-1: device descriptor read/64, error -71 [ 140.013984][ T5902] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 140.063630][ T5902] usb 1-1: config 0 descriptor?? [ 140.097408][ T5902] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 140.145189][ T43] usb usb5-port1: attempt power cycle [ 140.269128][ T6576] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 140.286477][ T6576] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 140.320591][ T6576] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 140.351937][ T6576] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 140.530331][ T43] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 140.593696][ T43] usb 5-1: device descriptor read/8, error -71 [ 140.880042][ T43] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 140.944191][ T43] usb 5-1: device descriptor read/8, error -71 [ 141.123288][ T43] usb usb5-port1: unable to enumerate USB device [ 142.020047][ T980] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 142.260055][ T980] usb 4-1: Using ep0 maxpacket: 8 [ 142.327347][ T980] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 142.405978][ T980] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 142.537520][ T5888] usb 1-1: USB disconnect, device number 5 [ 142.603173][ T980] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.650766][ T6605] netlink: 'syz.0.206': attribute type 29 has an invalid length. [ 142.663577][ T6605] netlink: 'syz.0.206': attribute type 29 has an invalid length. [ 142.687741][ T6605] netlink: 500 bytes leftover after parsing attributes in process `syz.0.206'. [ 142.718878][ T980] usb 4-1: config 0 descriptor?? [ 142.818795][ T6606] ipvlan2: entered promiscuous mode [ 143.341294][ T980] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 143.381245][ T6618] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 143.430096][ T5888] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 143.626594][ T5888] usb 5-1: config 0 has no interfaces? [ 143.644007][ T5888] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 143.653603][ T5888] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.663234][ T5888] usb 5-1: Product: syz [ 143.668472][ T5888] usb 5-1: Manufacturer: syz [ 143.685674][ T5888] usb 5-1: SerialNumber: syz [ 143.701445][ T5888] usb 5-1: config 0 descriptor?? [ 144.102674][ T980] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 144.103241][ T6614] delete_channel: no stack [ 144.309973][ T980] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 145.950002][ T980] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 146.012530][ T24] usb 4-1: USB disconnect, device number 4 [ 146.015536][ T980] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 146.162662][ T980] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 146.220262][ T980] usb 3-1: SerialNumber: syz [ 146.344944][ T6644] syz.0.214 uses obsolete (PF_INET,SOCK_PACKET) [ 146.355386][ T980] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 146.394461][ T980] usb-storage 3-1:1.0: USB Mass Storage device detected [ 146.552483][ T980] usb-storage 3-1:1.0: Quirks match for vid 0525 pid a4a5: 10000 [ 146.648548][ T980] scsi host1: usb-storage 3-1:1.0 [ 147.142089][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 147.142108][ T30] audit: type=1326 audit(1749863374.167:381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6656 comm="syz.1.217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f25bdb8e929 code=0x7ffc0000 [ 147.236179][ T30] audit: type=1326 audit(1749863374.197:382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6656 comm="syz.1.217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f25bdb8e929 code=0x7ffc0000 [ 147.258400][ C0] vkms_vblank_simulate: vblank timer overrun [ 147.272468][ T30] audit: type=1326 audit(1749863374.207:383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6656 comm="syz.1.217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f25bdb8e929 code=0x7ffc0000 [ 147.337263][ T6659] netlink: 'syz.3.218': attribute type 13 has an invalid length. [ 147.345243][ T30] audit: type=1326 audit(1749863374.207:384): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6656 comm="syz.1.217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f25bdb8e929 code=0x7ffc0000 [ 147.348313][ T6659] netlink: 152 bytes leftover after parsing attributes in process `syz.3.218'. [ 147.378689][ T30] audit: type=1326 audit(1749863374.207:385): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6656 comm="syz.1.217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f25bdb8e929 code=0x7ffc0000 [ 147.422061][ T980] usb 5-1: USB disconnect, device number 11 [ 147.434103][ T6659] : renamed from syz_tun (while UP) [ 147.463224][ T6659] : refused to change device tx_queue_len [ 147.469243][ T6659] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 147.567018][ T9] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 147.733758][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 147.761206][ T9] usb 1-1: config 0 has an invalid interface number: 3 but max is 0 [ 147.779647][ T9] usb 1-1: config 0 has no interface number 0 [ 147.816898][ T9] usb 1-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 147.832971][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.842016][ T9] usb 1-1: Product: syz [ 147.846407][ T9] usb 1-1: Manufacturer: syz [ 147.854388][ T9] usb 1-1: SerialNumber: syz [ 147.873514][ T9] usb 1-1: config 0 descriptor?? [ 148.030267][ T6674] nvme_fabrics: unknown parameter or missing value 'V' in ctrl creation request [ 148.051037][ T6674] nvme_fabrics: unknown parameter or missing value ' ' in ctrl creation request [ 148.293480][ T9] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 148.363934][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 148.413751][ T9] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 148.447315][ T9] usb 1-1: media controller created [ 148.606874][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 148.736950][ T9] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 148.769654][ T9] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 148.945773][ T9] usb 1-1: USB disconnect, device number 6 [ 149.118955][ T9] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 149.265721][ T5888] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 149.435197][ T6687] FAULT_INJECTION: forcing a failure. [ 149.435197][ T6687] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 149.472248][ T5888] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 149.488077][ T5888] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 149.512021][ T5888] usb 5-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 149.547459][ T6687] CPU: 0 UID: 0 PID: 6687 Comm: syz.2.228 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) [ 149.547482][ T6687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 149.547491][ T6687] Call Trace: [ 149.547499][ T6687] [ 149.547505][ T6687] dump_stack_lvl+0x189/0x250 [ 149.547535][ T6687] ? __pfx____ratelimit+0x10/0x10 [ 149.547560][ T6687] ? __pfx_dump_stack_lvl+0x10/0x10 [ 149.547584][ T6687] ? __pfx__printk+0x10/0x10 [ 149.547600][ T6687] ? __might_fault+0xb0/0x130 [ 149.547623][ T6687] should_fail_ex+0x414/0x560 [ 149.547647][ T6687] _copy_from_iter+0x1db/0x16f0 [ 149.547678][ T6687] ? policy_nodemask+0x27c/0x720 [ 149.547693][ T6687] ? __pfx__copy_from_iter+0x10/0x10 [ 149.547721][ T6687] ? set_page_refcounted+0xa0/0x1e0 [ 149.547736][ T6687] ? page_copy_sane+0x4e/0x280 [ 149.547761][ T6687] copy_page_from_iter+0xdd/0x170 [ 149.547788][ T6687] tun_get_user+0x1c4d/0x3ce0 [ 149.547815][ T6687] ? tun_get_user+0x693/0x3ce0 [ 149.547848][ T6687] ? aa_file_perm+0x11f/0xed0 [ 149.547869][ T6687] ? __pfx_tun_get_user+0x10/0x10 [ 149.547892][ T6687] ? aa_file_perm+0x11f/0xed0 [ 149.547912][ T6687] ? aa_file_perm+0x3e7/0xed0 [ 149.547942][ T6687] ? ref_tracker_alloc+0x318/0x460 [ 149.547962][ T6687] ? __lock_acquire+0xab9/0xd20 [ 149.547985][ T6687] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 149.548010][ T6687] ? tun_get+0x1c/0x2f0 [ 149.548037][ T6687] ? tun_get+0x1c/0x2f0 [ 149.548060][ T6687] ? tun_get+0x1c/0x2f0 [ 149.548086][ T6687] tun_chr_write_iter+0x113/0x200 [ 149.548111][ T6687] vfs_write+0x548/0xa90 [ 149.548139][ T6687] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 149.548163][ T6687] ? __pfx_vfs_write+0x10/0x10 [ 149.548194][ T6687] ? __fget_files+0x2a/0x420 [ 149.548218][ T6687] ksys_write+0x145/0x250 [ 149.548234][ T6687] ? __pfx_ksys_write+0x10/0x10 [ 149.548251][ T6687] ? do_syscall_64+0xbe/0x3b0 [ 149.548277][ T6687] do_syscall_64+0xfa/0x3b0 [ 149.548291][ T6687] ? lockdep_hardirqs_on+0x9c/0x150 [ 149.548314][ T6687] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.548329][ T6687] ? clear_bhb_loop+0x60/0xb0 [ 149.548347][ T6687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.548362][ T6687] RIP: 0033:0x7f455b58d3df [ 149.548376][ T6687] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 149.548389][ T6687] RSP: 002b:00007f455c3ed000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 149.548405][ T6687] RAX: ffffffffffffffda RBX: 00007f455b7b5fa0 RCX: 00007f455b58d3df [ 149.548416][ T6687] RDX: 0000000000000032 RSI: 00002000000002c0 RDI: 00000000000000c8 [ 149.548425][ T6687] RBP: 00007f455c3ed090 R08: 0000000000000000 R09: 0000000000000000 [ 149.548434][ T6687] R10: 0000000000000032 R11: 0000000000000293 R12: 0000000000000001 [ 149.548443][ T6687] R13: 0000000000000001 R14: 00007f455b7b5fa0 R15: 00007f455b8dfa28 [ 149.548465][ T6687] [ 149.854957][ T5888] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 149.864122][ T5888] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.886439][ T5888] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 149.894938][ T5888] usb 5-1: invalid MIDI out EP 0 [ 150.000063][ T5888] snd-usb-audio 5-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 150.263874][ T24] usb 3-1: USB disconnect, device number 6 [ 150.305532][ T5837] udevd[5837]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 150.387641][ T6696] netlink: 'syz.0.231': attribute type 13 has an invalid length. [ 150.417502][ T6696] netlink: 152 bytes leftover after parsing attributes in process `syz.0.231'. [ 150.513004][ T6696] : renamed from syz_tun (while UP) [ 150.588846][ T6696] : refused to change device tx_queue_len [ 150.603156][ T6696] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 151.561990][ T6707] netlink: 12 bytes leftover after parsing attributes in process `syz.0.235'. [ 151.586805][ T6707] input: syz0 as /devices/virtual/input/input14 [ 152.220847][ T980] usb 5-1: USB disconnect, device number 12 [ 154.397898][ T30] audit: type=1800 audit(1749863381.417:386): pid=6733 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.243" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 154.498331][ T6739] netlink: 8 bytes leftover after parsing attributes in process `syz.0.240'. [ 154.531217][ T6739] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.540349][ T6739] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.549100][ T6739] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.653856][ T6738] netlink: 20 bytes leftover after parsing attributes in process `syz.3.243'. [ 154.663646][ T6739] vxlan0: entered promiscuous mode [ 154.677929][ T6739] vxlan0: entered allmulticast mode [ 154.712396][ T5948] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 154.847939][ T6738] netlink: 124 bytes leftover after parsing attributes in process `syz.3.243'. [ 155.023036][ T5948] usb 3-1: config 0 has no interfaces? [ 155.072668][ T6748] FAULT_INJECTION: forcing a failure. [ 155.072668][ T6748] name failslab, interval 1, probability 0, space 0, times 0 [ 155.176378][ T6748] CPU: 0 UID: 0 PID: 6748 Comm: syz.1.245 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) [ 155.176412][ T6748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 155.176425][ T6748] Call Trace: [ 155.176434][ T6748] [ 155.176444][ T6748] dump_stack_lvl+0x189/0x250 [ 155.176492][ T6748] ? __pfx____ratelimit+0x10/0x10 [ 155.176526][ T6748] ? __pfx_dump_stack_lvl+0x10/0x10 [ 155.176559][ T6748] ? __pfx__printk+0x10/0x10 [ 155.176588][ T6748] ? __pfx___might_resched+0x10/0x10 [ 155.176620][ T6748] ? fs_reclaim_acquire+0x7d/0x100 [ 155.176650][ T6748] should_fail_ex+0x414/0x560 [ 155.176689][ T6748] should_failslab+0xa8/0x100 [ 155.176719][ T6748] kmem_cache_alloc_noprof+0x73/0x3c0 [ 155.176760][ T6748] ? alloc_empty_file+0x55/0x1d0 [ 155.176792][ T6748] alloc_empty_file+0x55/0x1d0 [ 155.176826][ T6748] path_openat+0x107/0x3830 [ 155.176856][ T6748] ? arch_stack_walk+0xfc/0x150 [ 155.176912][ T6748] ? kasan_save_track+0x4f/0x80 [ 155.176942][ T6748] ? kasan_save_track+0x3e/0x80 [ 155.176972][ T6748] ? __kasan_slab_alloc+0x6c/0x80 [ 155.176991][ T6748] ? getname_flags+0xb8/0x540 [ 155.177015][ T6748] ? __pfx_path_openat+0x10/0x10 [ 155.177048][ T6748] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.177092][ T6748] do_filp_open+0x1fa/0x410 [ 155.177121][ T6748] ? __lock_acquire+0xab9/0xd20 [ 155.177153][ T6748] ? __pfx_do_filp_open+0x10/0x10 [ 155.177217][ T6748] ? _raw_spin_unlock+0x28/0x50 [ 155.177247][ T6748] ? alloc_fd+0x64c/0x6c0 [ 155.177281][ T6748] do_sys_openat2+0x121/0x1c0 [ 155.177313][ T6748] ? __pfx_do_sys_openat2+0x10/0x10 [ 155.177343][ T6748] ? ksys_write+0x22a/0x250 [ 155.177365][ T6748] ? __pfx_ksys_write+0x10/0x10 [ 155.177389][ T6748] __x64_sys_openat+0x138/0x170 [ 155.177423][ T6748] do_syscall_64+0xfa/0x3b0 [ 155.177443][ T6748] ? lockdep_hardirqs_on+0x9c/0x150 [ 155.177476][ T6748] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.177497][ T6748] ? clear_bhb_loop+0x60/0xb0 [ 155.177523][ T6748] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.177544][ T6748] RIP: 0033:0x7f25bdb8e929 [ 155.177563][ T6748] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 155.177581][ T6748] RSP: 002b:00007f25be9f2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 155.177603][ T6748] RAX: ffffffffffffffda RBX: 00007f25bddb6080 RCX: 00007f25bdb8e929 [ 155.177619][ T6748] RDX: 0000000000040000 RSI: 0000200000000140 RDI: ffffffffffffff9c [ 155.177634][ T6748] RBP: 00007f25be9f2090 R08: 0000000000000000 R09: 0000000000000000 [ 155.177648][ T6748] R10: 00000000000000c2 R11: 0000000000000246 R12: 0000000000000001 [ 155.177660][ T6748] R13: 0000000000000001 R14: 00007f25bddb6080 R15: 00007f25bdedfa28 [ 155.177693][ T6748] [ 155.469242][ T5948] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 155.591928][ T5948] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.870105][ T5948] usb 3-1: Product: syz [ 155.874374][ T5948] usb 3-1: Manufacturer: syz [ 155.926971][ T5948] usb 3-1: SerialNumber: syz [ 156.117478][ T6760] netlink: 'syz.1.248': attribute type 13 has an invalid length. [ 156.142057][ T6760] netlink: 152 bytes leftover after parsing attributes in process `syz.1.248'. [ 156.153321][ T6760] : refused to change device tx_queue_len [ 156.159173][ T6760] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 156.204451][ T6757] input: syz0 as /devices/virtual/input/input15 [ 156.221122][ T5948] usb 3-1: config 0 descriptor?? [ 156.310157][ T6752] netlink: 12 bytes leftover after parsing attributes in process `syz.3.246'. [ 156.619087][ T6737] delete_channel: no stack [ 156.652544][ T6752] bridge_slave_1: left allmulticast mode [ 156.658294][ T6752] bridge_slave_1: left promiscuous mode [ 156.702756][ T6752] bridge0: port 2(bridge_slave_1) entered disabled state [ 156.781671][ T6752] bridge_slave_0: left allmulticast mode [ 156.793760][ T6752] bridge_slave_0: left promiscuous mode [ 156.812025][ T6752] bridge0: port 1(bridge_slave_0) entered disabled state [ 157.737260][ T5888] usb 3-1: USB disconnect, device number 7 [ 158.376571][ T6781] veth1_macvtap: left promiscuous mode [ 158.383944][ T6781] macsec0: entered promiscuous mode [ 158.490012][ T5888] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 158.706336][ T5888] usb 5-1: config 0 has no interfaces? [ 158.718905][ T5888] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 158.736045][ T5888] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.749182][ T5888] usb 5-1: Product: syz [ 158.753993][ T5888] usb 5-1: Manufacturer: syz [ 158.763247][ T5888] usb 5-1: SerialNumber: syz [ 158.769985][ T24] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 158.769985][ T980] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 158.812412][ T5888] usb 5-1: config 0 descriptor?? [ 158.920065][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 158.939065][ T24] usb 1-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 158.966791][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.981497][ T980] usb 4-1: Using ep0 maxpacket: 8 [ 158.991157][ T980] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 159.005534][ T980] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 159.015973][ T24] usb 1-1: Product: syz [ 159.016386][ T980] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 159.044012][ T6779] delete_channel: no stack [ 159.056451][ T980] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 159.058049][ T24] usb 1-1: Manufacturer: syz [ 159.072554][ T980] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 159.085269][ T24] usb 1-1: SerialNumber: syz [ 159.085768][ T980] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 159.104601][ T24] usb 1-1: config 0 descriptor?? [ 159.146466][ T24] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 159.456595][ T980] usb 4-1: usb_control_msg returned -32 [ 159.467975][ T980] usbtmc 4-1:16.0: can't read capabilities [ 159.547357][ T980] usb 4-1: USB disconnect, device number 5 [ 160.350966][ T6785] warning: `syz.0.257' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 160.548688][ T6793] mmap: syz.2.259 (6793) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 160.600803][ T24] gspca_sonixj: i2c_w8 err -71 [ 160.654196][ T24] sonixj 1-1:0.0: probe with driver sonixj failed with error -71 [ 160.668818][ T24] usb 1-1: USB disconnect, device number 7 [ 161.056906][ T6805] input: syz0 as /devices/virtual/input/input16 [ 162.124979][ T24] usb 5-1: USB disconnect, device number 13 [ 162.173447][ T5888] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 162.624907][ T5888] usb 3-1: config 0 has no interfaces? [ 162.696539][ T5888] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 162.781459][ T5888] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.853227][ T5888] usb 3-1: Product: syz [ 162.878621][ T5888] usb 3-1: Manufacturer: syz [ 162.911837][ T5888] usb 3-1: SerialNumber: syz [ 162.938937][ T5888] usb 3-1: config 0 descriptor?? [ 163.026825][ T6827] netlink: 'syz.4.270': attribute type 13 has an invalid length. [ 163.111841][ T6827] netlink: 152 bytes leftover after parsing attributes in process `syz.4.270'. [ 163.127738][ T6827] : refused to change device tx_queue_len [ 163.156326][ T6827] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 164.579003][ T6860] overlayfs: missing 'lowerdir' [ 164.720131][ T9] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 165.080391][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 64, changing to 10 [ 165.112358][ T9] usb 4-1: New USB device found, idVendor=0c70, idProduct=f011, bcdDevice= 0.00 [ 165.168596][ T24] usb 3-1: USB disconnect, device number 8 [ 165.235706][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 165.391932][ T9] usb 4-1: config 0 descriptor?? [ 165.771371][ T6868] input: syz0 as /devices/virtual/input/input17 [ 165.842919][ T6859] binder: BINDER_SET_CONTEXT_MGR already set [ 165.849108][ T6859] binder: 6858:6859 ioctl 4018620d 200000000040 returned -16 [ 165.903556][ T6870] netlink: 8 bytes leftover after parsing attributes in process `syz.2.284'. [ 165.965685][ T6859] binder: 6858:6859 ioctl c0306201 0 returned -14 [ 166.043376][ T6867] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 166.077014][ T6859] FAULT_INJECTION: forcing a failure. [ 166.077014][ T6859] name failslab, interval 1, probability 0, space 0, times 0 [ 166.100260][ T6873] binder: 6858:6873 ioctl c020aa00 200000000240 returned -22 [ 166.281385][ T6859] CPU: 1 UID: 0 PID: 6859 Comm: syz.3.282 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) [ 166.281418][ T6859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 166.281428][ T6859] Call Trace: [ 166.281434][ T6859] [ 166.281440][ T6859] dump_stack_lvl+0x189/0x250 [ 166.281470][ T6859] ? __pfx____ratelimit+0x10/0x10 [ 166.281507][ T6859] ? __pfx_dump_stack_lvl+0x10/0x10 [ 166.281539][ T6859] ? __pfx__printk+0x10/0x10 [ 166.281564][ T6859] ? __pfx___might_resched+0x10/0x10 [ 166.281592][ T6859] ? fs_reclaim_acquire+0x7d/0x100 [ 166.281618][ T6859] should_fail_ex+0x414/0x560 [ 166.281652][ T6859] should_failslab+0xa8/0x100 [ 166.281679][ T6859] __kmalloc_noprof+0xcb/0x4f0 [ 166.281697][ T6859] ? tomoyo_encode+0x28b/0x550 [ 166.281732][ T6859] tomoyo_encode+0x28b/0x550 [ 166.281758][ T6859] tomoyo_realpath_from_path+0x58d/0x5d0 [ 166.281794][ T6859] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 166.281827][ T6859] tomoyo_path_number_perm+0x1e8/0x5a0 [ 166.281855][ T6859] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 166.281894][ T6859] ? __lock_acquire+0xab9/0xd20 [ 166.281931][ T6859] ? __fget_files+0x2a/0x420 [ 166.281959][ T6859] ? __fget_files+0x2a/0x420 [ 166.281982][ T6859] ? __fget_files+0x3a0/0x420 [ 166.282003][ T6859] ? __fget_files+0x2a/0x420 [ 166.282029][ T6859] security_file_ioctl+0xcb/0x2d0 [ 166.282052][ T6859] __se_sys_ioctl+0x47/0x170 [ 166.282079][ T6859] do_syscall_64+0xfa/0x3b0 [ 166.282096][ T6859] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.282118][ T6859] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 166.282140][ T6859] ? clear_bhb_loop+0x60/0xb0 [ 166.282165][ T6859] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.282185][ T6859] RIP: 0033:0x7f659b78e929 [ 166.282201][ T6859] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 166.282214][ T6859] RSP: 002b:00007f659c5c5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 166.282230][ T6859] RAX: ffffffffffffffda RBX: 00007f659b9b5fa0 RCX: 00007f659b78e929 [ 166.282241][ T6859] RDX: 0000200000000180 RSI: 00000000c0306201 RDI: 0000000000000007 [ 166.282255][ T6859] RBP: 00007f659c5c5090 R08: 0000000000000000 R09: 0000000000000000 [ 166.282269][ T6859] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 166.282281][ T6859] R13: 0000000000000000 R14: 00007f659b9b5fa0 R15: 00007f659badfa28 [ 166.282313][ T6859] [ 166.282356][ T6859] ERROR: Out of memory at tomoyo_realpath_from_path. [ 166.789521][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 166.812260][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 166.956929][ T9] usb 4-1: USB disconnect, device number 6 [ 169.400105][ T24] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 169.570032][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 169.699885][ T24] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 169.717059][ T24] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 169.729956][ T43] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 169.747746][ T24] usb 5-1: Product: syz [ 169.779722][ T24] usb 5-1: Manufacturer: syz [ 169.787426][ T24] usb 5-1: SerialNumber: syz [ 169.800076][ T24] usb 5-1: config 0 descriptor?? [ 169.913602][ T43] usb 4-1: config 0 has no interfaces? [ 169.930198][ T43] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 169.946638][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 169.955573][ T43] usb 4-1: Product: syz [ 169.964814][ T43] usb 4-1: Manufacturer: syz [ 169.969629][ T43] usb 4-1: SerialNumber: syz [ 169.977009][ T43] usb 4-1: config 0 descriptor?? [ 170.226219][ T6905] delete_channel: no stack [ 170.373223][ T6911] loop2: detected capacity change from 0 to 7 [ 170.383567][ T6911] Dev loop2: unable to read RDB block 7 [ 170.428501][ T6911] loop2: AHDI p1 p2 p3 [ 170.446265][ T6911] loop2: partition table partially beyond EOD, truncated [ 170.465632][ T6911] loop2: p1 start 1601398130 is beyond EOD, truncated [ 170.480374][ T6911] loop2: p2 start 1702059890 is beyond EOD, truncated [ 170.803671][ T6919] netlink: 16 bytes leftover after parsing attributes in process `syz.2.297'. [ 170.976504][ T6914] xt_CT: No such helper "snmp" [ 171.639619][ T6929] input: syz0 as /devices/virtual/input/input18 [ 171.697264][ T6932] netlink: 4 bytes leftover after parsing attributes in process `syz.1.301'. [ 172.100018][ T5888] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 172.277650][ T6932] team0: Port device team_slave_0 removed [ 172.418395][ T5888] usb 3-1: config 0 has no interfaces? [ 172.445956][ T5888] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 172.541253][ T43] usb 5-1: USB disconnect, device number 14 [ 172.592351][ T5888] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.810302][ T6939] netlink: 64 bytes leftover after parsing attributes in process `syz.4.303'. [ 172.819621][ T5888] usb 3-1: Product: syz [ 172.833315][ T5888] usb 3-1: Manufacturer: syz [ 172.879575][ T5888] usb 3-1: SerialNumber: syz [ 172.990242][ T5888] usb 3-1: config 0 descriptor?? [ 173.241760][ T6933] delete_channel: no stack [ 173.887997][ T9] usb 4-1: USB disconnect, device number 7 [ 173.914186][ T6947] overlayfs: missing 'lowerdir' [ 175.187160][ T24] usb 3-1: USB disconnect, device number 9 [ 175.434327][ T6964] ALSA: mixer_oss: invalid OSS volume 'VNE1' [ 175.685050][ T6967] netlink: 'syz.2.309': attribute type 10 has an invalid length. [ 175.754551][ T6967] syz_tun: entered promiscuous mode [ 175.797912][ T6967] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 177.270080][ T24] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 177.440075][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 177.451960][ T24] usb 3-1: unable to get BOS descriptor or descriptor too short [ 177.474546][ T24] usb 3-1: New USB device found, idVendor=0471, idProduct=0302, bcdDevice=bc.45 [ 177.490842][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.533994][ T24] usb 3-1: Product: syz [ 177.538240][ T24] usb 3-1: Manufacturer: syz [ 177.570148][ T24] usb 3-1: SerialNumber: syz [ 178.180018][ T5926] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 178.244044][ T6995] input: syz0 as /devices/virtual/input/input19 [ 178.424085][ T5926] usb 1-1: config 0 has no interfaces? [ 178.432499][ T5926] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 178.466537][ T24] pwc: Philips PCA645VC USB webcam detected. [ 178.490626][ T24] pwc: send_video_command error -71 [ 178.504365][ T5926] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.505810][ T24] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 178.590240][ T5926] usb 1-1: Product: syz [ 178.597565][ T5926] usb 1-1: Manufacturer: syz [ 178.605886][ T24] Philips webcam 3-1:7.0: probe with driver Philips webcam failed with error -71 [ 178.658287][ T5926] usb 1-1: SerialNumber: syz [ 178.692485][ T6999] x_tables: duplicate underflow at hook 1 [ 178.699220][ T5926] usb 1-1: config 0 descriptor?? [ 178.780203][ T24] usb 3-1: USB disconnect, device number 10 [ 178.924434][ T6990] delete_channel: no stack [ 179.043769][ T838] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 179.178583][ T838] dvb_usb_az6027 2-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 179.387411][ T838] usb 2-1: USB disconnect, device number 2 [ 179.600336][ T24] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 179.930466][ T24] usb 5-1: config 0 has no interfaces? [ 179.944599][ T24] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 179.953988][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.962573][ T24] usb 5-1: Product: syz [ 179.974406][ T24] usb 5-1: Manufacturer: syz [ 179.994053][ T24] usb 5-1: SerialNumber: syz [ 180.190316][ T24] usb 5-1: config 0 descriptor?? [ 180.574573][ T7007] delete_channel: no stack [ 180.641134][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 180.805681][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 180.833316][ T9] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 180.909184][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.966261][ T9] usb 2-1: config 0 descriptor?? [ 181.365337][ T9] usbhid 2-1:0.0: can't add hid device: -71 [ 181.375709][ T9] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 181.429004][ T9] usb 2-1: USB disconnect, device number 3 [ 181.875809][ T24] usb 1-1: USB disconnect, device number 8 [ 181.883252][ T9] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 182.050955][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 182.067401][ T9] usb 2-1: too many configurations: 65, using maximum allowed: 8 [ 182.203555][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 182.213889][ T9] usb 2-1: can't read configurations, error -61 [ 182.370044][ T9] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 182.530198][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 182.582704][ T5948] usb 5-1: USB disconnect, device number 15 [ 182.632161][ T9] usb 2-1: too many configurations: 65, using maximum allowed: 8 [ 182.705271][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 182.728692][ T9] usb 2-1: can't read configurations, error -61 [ 182.746843][ T9] usb usb2-port1: attempt power cycle [ 182.779992][ T24] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 182.930116][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 182.940159][ T838] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 182.973609][ T24] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 182.992473][ T24] usb 4-1: config 255 has too many interfaces: 255, using maximum allowed: 32 [ 183.072244][ T24] usb 4-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 183.113470][ T838] usb 1-1: Using ep0 maxpacket: 16 [ 183.118813][ T9] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 183.150772][ T838] usb 1-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 183.163534][ T838] usb 1-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 183.174992][ T838] usb 1-1: Product: syz [ 183.179281][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 183.184724][ T24] usb 4-1: config 255 has 0 interfaces, different from the descriptor's value: 255 [ 183.195110][ T9] usb 2-1: too many configurations: 65, using maximum allowed: 8 [ 183.205866][ T838] usb 1-1: Manufacturer: syz [ 183.210857][ T838] usb 1-1: SerialNumber: syz [ 183.217368][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 183.228859][ T9] usb 2-1: can't read configurations, error -61 [ 183.243290][ T838] usb 1-1: config 0 descriptor?? [ 183.288131][ T24] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 183.325170][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.362046][ T9] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 183.396134][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 183.403549][ T9] usb 2-1: too many configurations: 65, using maximum allowed: 8 [ 183.597210][ T838] usb 4-1: USB disconnect, device number 8 [ 183.675814][ T5926] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 183.768207][ T7051] FAULT_INJECTION: forcing a failure. [ 183.768207][ T7051] name failslab, interval 1, probability 0, space 0, times 0 [ 183.829955][ T9] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 183.873020][ T7051] CPU: 1 UID: 0 PID: 7051 Comm: syz.3.333 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) [ 183.873043][ T7051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 183.873052][ T7051] Call Trace: [ 183.873058][ T7051] [ 183.873064][ T7051] dump_stack_lvl+0x189/0x250 [ 183.873101][ T7051] ? __pfx____ratelimit+0x10/0x10 [ 183.873125][ T7051] ? __pfx_dump_stack_lvl+0x10/0x10 [ 183.873152][ T7051] ? __pfx__printk+0x10/0x10 [ 183.873178][ T7051] should_fail_ex+0x414/0x560 [ 183.873202][ T7051] should_failslab+0xa8/0x100 [ 183.873219][ T7051] kmem_cache_alloc_noprof+0x73/0x3c0 [ 183.873243][ T7051] ? skb_clone+0x212/0x3a0 [ 183.873267][ T7051] skb_clone+0x212/0x3a0 [ 183.873290][ T7051] __netlink_deliver_tap+0x404/0x850 [ 183.873318][ T7051] ? netlink_deliver_tap+0x2e/0x1b0 [ 183.873337][ T7051] netlink_deliver_tap+0x19c/0x1b0 [ 183.873356][ T7051] netlink_sendskb+0x68/0x140 [ 183.873373][ T7051] netlink_rcv_skb+0x28c/0x470 [ 183.873391][ T7051] ? __pfx_sock_diag_rcv_msg+0x10/0x10 [ 183.873408][ T7051] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 183.873459][ T7051] ? netlink_deliver_tap+0x2e/0x1b0 [ 183.873477][ T7051] ? netlink_deliver_tap+0x2e/0x1b0 [ 183.873500][ T7051] netlink_unicast+0x75b/0x8d0 [ 183.873524][ T7051] netlink_sendmsg+0x805/0xb30 [ 183.873550][ T7051] ? __pfx_netlink_sendmsg+0x10/0x10 [ 183.873572][ T7051] ? aa_sock_msg_perm+0x94/0x160 [ 183.873593][ T7051] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 183.873613][ T7051] ? __pfx_netlink_sendmsg+0x10/0x10 [ 183.873632][ T7051] __sock_sendmsg+0x219/0x270 [ 183.873649][ T7051] ____sys_sendmsg+0x505/0x830 [ 183.873675][ T7051] ? __pfx_____sys_sendmsg+0x10/0x10 [ 183.873702][ T7051] ? import_iovec+0x74/0xa0 [ 183.873721][ T7051] ___sys_sendmsg+0x21f/0x2a0 [ 183.873743][ T7051] ? __pfx____sys_sendmsg+0x10/0x10 [ 183.873790][ T7051] ? __fget_files+0x2a/0x420 [ 183.873806][ T7051] ? __fget_files+0x3a0/0x420 [ 183.873830][ T7051] __x64_sys_sendmsg+0x19b/0x260 [ 183.873853][ T7051] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 183.873880][ T7051] ? __pfx_ksys_write+0x10/0x10 [ 183.873892][ T7051] ? rcu_is_watching+0x15/0xb0 [ 183.873920][ T7051] ? do_syscall_64+0xbe/0x3b0 [ 183.873937][ T7051] do_syscall_64+0xfa/0x3b0 [ 183.873950][ T7051] ? lockdep_hardirqs_on+0x9c/0x150 [ 183.873973][ T7051] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.873988][ T7051] ? clear_bhb_loop+0x60/0xb0 [ 183.874006][ T7051] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.874021][ T7051] RIP: 0033:0x7f659b78e929 [ 183.874037][ T7051] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 183.874050][ T7051] RSP: 002b:00007f659c5c5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 183.874071][ T7051] RAX: ffffffffffffffda RBX: 00007f659b9b5fa0 RCX: 00007f659b78e929 [ 183.874082][ T7051] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 183.874092][ T7051] RBP: 00007f659c5c5090 R08: 0000000000000000 R09: 0000000000000000 [ 183.874101][ T7051] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 183.874109][ T7051] R13: 0000000000000000 R14: 00007f659b9b5fa0 R15: 00007f659badfa28 [ 183.874131][ T7051] [ 184.203042][ T9] usb 2-1: can't read configurations, error -71 [ 184.331570][ T9] usb usb2-port1: unable to enumerate USB device [ 184.495218][ T7058] fuse: Bad value for 'fd' [ 184.626092][ T7060] input: syz0 as /devices/virtual/input/input20 [ 184.643220][ T5926] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 184.674602][ T5926] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 184.872440][ T5926] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 184.904186][ T5926] usb 5-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 185.086824][ T5926] usb 5-1: New USB device found, idVendor=0125, idProduct=a4a1, bcdDevice= 0.40 [ 185.153117][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.167652][ T5926] usb 5-1: Product: syz [ 185.232920][ T5926] usb 5-1: Manufacturer: syz [ 185.375690][ T5926] usb 5-1: SerialNumber: syz [ 185.410515][ T5926] cdc_ncm 5-1:1.0: skipping garbage [ 185.764757][ T7074] xt_TCPMSS: Only works on TCP SYN packets [ 185.790221][ T7074] openvswitch: netlink: IP tunnel TTL not specified. [ 185.829401][ T7074] binder: 7073:7074 ioctl 5000943f 200000000340 returned -22 [ 185.922534][ T7075] binder: 7073:7075 ioctl c018620c 200000000040 returned -22 [ 186.109087][ T24] usb 1-1: USB disconnect, device number 9 [ 187.064789][ T7090] FAULT_INJECTION: forcing a failure. [ 187.064789][ T7090] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 187.116141][ T7090] CPU: 1 UID: 0 PID: 7090 Comm: syz.2.341 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) [ 187.116180][ T7090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 187.116191][ T7090] Call Trace: [ 187.116199][ T7090] [ 187.116210][ T7090] dump_stack_lvl+0x189/0x250 [ 187.116240][ T7090] ? __pfx____ratelimit+0x10/0x10 [ 187.116264][ T7090] ? __pfx_dump_stack_lvl+0x10/0x10 [ 187.116299][ T7090] ? __pfx__printk+0x10/0x10 [ 187.116323][ T7090] ? __might_fault+0xb0/0x130 [ 187.116354][ T7090] should_fail_ex+0x414/0x560 [ 187.116383][ T7090] _copy_from_user+0x2d/0xb0 [ 187.116399][ T7090] video_usercopy+0x354/0x14f0 [ 187.116430][ T7090] ? __pfx___video_do_ioctl+0x10/0x10 [ 187.116454][ T7090] ? __pfx_video_usercopy+0x10/0x10 [ 187.116500][ T7090] ? __fget_files+0x2a/0x420 [ 187.116525][ T7090] ? __fget_files+0x2a/0x420 [ 187.116540][ T7090] ? __fget_files+0x3a0/0x420 [ 187.116559][ T7090] v4l2_ioctl+0x18a/0x1e0 [ 187.116575][ T7090] ? __pfx_v4l2_ioctl+0x10/0x10 [ 187.116598][ T7090] __se_sys_ioctl+0xf9/0x170 [ 187.116634][ T7090] do_syscall_64+0xfa/0x3b0 [ 187.116653][ T7090] ? lockdep_hardirqs_on+0x9c/0x150 [ 187.116681][ T7090] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.116695][ T7090] ? clear_bhb_loop+0x60/0xb0 [ 187.116713][ T7090] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.116727][ T7090] RIP: 0033:0x7f455b58e929 [ 187.116746][ T7090] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 187.116764][ T7090] RSP: 002b:00007f455c3ed038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 187.116785][ T7090] RAX: ffffffffffffffda RBX: 00007f455b7b5fa0 RCX: 00007f455b58e929 [ 187.116799][ T7090] RDX: 00002000000000c0 RSI: 00000000c0405602 RDI: 0000000000000003 [ 187.116812][ T7090] RBP: 00007f455c3ed090 R08: 0000000000000000 R09: 0000000000000000 [ 187.116826][ T7090] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 187.116834][ T7090] R13: 0000000000000000 R14: 00007f455b7b5fa0 R15: 00007f455b8dfa28 [ 187.116856][ T7090] [ 187.129951][ T5926] cdc_ncm 5-1:1.0: bind() failure [ 187.489955][ T10] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 187.537430][ T5926] cdc_ncm 5-1:1.1: probe with driver cdc_ncm failed with error -71 [ 187.672426][ T10] usb 1-1: config 0 has no interfaces? [ 187.698021][ T5926] cdc_mbim 5-1:1.1: probe with driver cdc_mbim failed with error -71 [ 187.762570][ T10] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 187.793751][ T5926] usbtest 5-1:1.1: probe with driver usbtest failed with error -71 [ 187.802160][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.840016][ T5926] usb 5-1: USB disconnect, device number 16 [ 187.853076][ T10] usb 1-1: Product: syz [ 187.872016][ T10] usb 1-1: Manufacturer: syz [ 187.893105][ T10] usb 1-1: SerialNumber: syz [ 187.916703][ T10] usb 1-1: config 0 descriptor?? [ 187.930315][ T24] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 188.110519][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 188.123120][ T24] usb 4-1: config 9 has an invalid interface number: 21 but max is 0 [ 188.131503][ T24] usb 4-1: config 9 has no interface number 0 [ 188.153854][ T24] usb 4-1: config 9 interface 21 altsetting 127 has an invalid descriptor for endpoint zero, skipping [ 188.190587][ T7091] delete_channel: no stack [ 188.200135][ T5926] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 188.248083][ T24] usb 4-1: config 9 interface 21 altsetting 127 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 188.294175][ T24] usb 4-1: config 9 interface 21 altsetting 127 has an invalid descriptor for endpoint zero, skipping [ 188.314953][ T24] usb 4-1: config 9 interface 21 altsetting 127 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 188.354410][ T24] usb 4-1: config 9 interface 21 altsetting 127 endpoint 0x7 has an invalid bInterval 244, changing to 7 [ 188.370380][ T5926] usb 5-1: Using ep0 maxpacket: 8 [ 188.372386][ T24] usb 4-1: config 9 interface 21 has no altsetting 0 [ 188.391618][ T24] usb 4-1: New USB device found, idVendor=046d, idProduct=08b8, bcdDevice=38.3f [ 188.393296][ T5926] usb 5-1: config 8 has an invalid interface number: 123 but max is 3 [ 188.409436][ T5926] usb 5-1: config 8 has an invalid interface association descriptor of length 2, skipping [ 188.421425][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.429724][ T5926] usb 5-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 188.429743][ T24] usb 4-1: Product: ځ馁▁僠截〒湚ꁤ㮪휻్紶푃光뉧錦◬䄋猹乒筀娯ᢟⷮ퇒㍰볤ൽ梁퀏往ﳃ߃범㓇焇⧾쇤鐁둖ﮗ⢞ࡰ承鵗᪈䴨鮋퉡졳 [ 188.440276][ T5926] usb 5-1: config 8 has 1 interface, different from the descriptor's value: 4 [ 188.548763][ T24] usb 4-1: Manufacturer:  [ 188.555199][ T24] usb 4-1: SerialNumber: и [ 188.598057][ T5926] usb 5-1: config 8 has no interface number 0 [ 188.698737][ T5926] usb 5-1: config 8 interface 123 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 188.750022][ T5926] usb 5-1: config 8 interface 123 has no altsetting 0 [ 188.771322][ T5926] usb 5-1: New USB device found, idVendor=1e2d, idProduct=004c, bcdDevice= e.9b [ 188.781964][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.790446][ T5926] usb 5-1: Product: 稈츼䮓⬮篯ㆮ꟣Ἓ餘碯삓詓蝰䐏䌤妁霎ᚤ衂핖潇鎐섡『㡲㞏푐籽鵄ા璩揟ꏩ펟엮慄႒䨸꼫邪鞛达蟘嗸ẋꐌ氚푯튯縺銤ꛆ䅽⯲ꘔ嵂ថ䎞頕㌋臘镽䑰䫙㦼⒆镮納狫ꚣ⪘땫帜ﯱ㑓躁ﾹ苗䖷䟑琤쟻毣쟹屦ꬖ谸㐭짮ꂦ力찣뵞ﺬ飱骒謁怦틎ߴ鶕唤隣㏛ [ 188.824855][ C0] vkms_vblank_simulate: vblank timer overrun [ 188.918451][ T5926] usb 5-1: Manufacturer: ằ [ 188.930517][ T5926] usb 5-1: SerialNumber: Д [ 189.179177][ T10] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 189.203403][ T5926] option 5-1:8.123: GSM modem (1-port) converter detected [ 189.229605][ T5926] usb 5-1: USB disconnect, device number 17 [ 189.247933][ T5926] option 5-1:8.123: device disconnected [ 189.374128][ T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 189.385634][ T10] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 189.397504][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 189.418857][ T10] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 189.429034][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 189.438773][ T10] usb 3-1: Product: syz [ 189.444775][ T10] usb 3-1: Manufacturer: syz [ 189.449689][ T10] usb 3-1: SerialNumber: syz [ 189.747141][ T10] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 11 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 189.966466][ T7119] netlink: 'syz.4.348': attribute type 1 has an invalid length. [ 190.028135][ T7115] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 190.113970][ T10] usb 3-1: USB disconnect, device number 11 [ 190.135343][ T5926] usb 1-1: USB disconnect, device number 10 [ 190.158631][ T10] usblp0: removed [ 190.218360][ T7123] FAULT_INJECTION: forcing a failure. [ 190.218360][ T7123] name failslab, interval 1, probability 0, space 0, times 0 [ 190.236560][ T7123] CPU: 0 UID: 0 PID: 7123 Comm: syz.0.349 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) [ 190.236592][ T7123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 190.236605][ T7123] Call Trace: [ 190.236613][ T7123] [ 190.236623][ T7123] dump_stack_lvl+0x189/0x250 [ 190.236661][ T7123] ? __pfx____ratelimit+0x10/0x10 [ 190.236694][ T7123] ? __pfx_dump_stack_lvl+0x10/0x10 [ 190.236728][ T7123] ? __pfx__printk+0x10/0x10 [ 190.236754][ T7123] ? __lock_acquire+0xab9/0xd20 [ 190.236793][ T7123] should_fail_ex+0x414/0x560 [ 190.236830][ T7123] should_failslab+0xa8/0x100 [ 190.236855][ T7123] kmem_cache_alloc_noprof+0x73/0x3c0 [ 190.236888][ T7123] ? dst_alloc+0x105/0x170 [ 190.236922][ T7123] dst_alloc+0x105/0x170 [ 190.236956][ T7123] ip_route_output_key_hash_rcu+0x1482/0x23a0 [ 190.237000][ T7123] ? ip_route_output_key_hash+0xde/0x2e0 [ 190.237035][ T7123] ip_route_output_key_hash+0x1b9/0x2e0 [ 190.237071][ T7123] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 190.237123][ T7123] tcp_v4_connect+0x73a/0x19d0 [ 190.237201][ T7123] ? __pfx_tcp_v4_connect+0x10/0x10 [ 190.237236][ T7123] __inet_stream_connect+0x295/0xf10 [ 190.237269][ T7123] ? __local_bh_enable_ip+0x12d/0x1c0 [ 190.237301][ T7123] ? __pfx___inet_stream_connect+0x10/0x10 [ 190.237324][ T7123] ? __local_bh_enable_ip+0x12d/0x1c0 [ 190.237355][ T7123] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 190.237397][ T7123] inet_stream_connect+0x66/0xa0 [ 190.237422][ T7123] __sys_connect+0x313/0x440 [ 190.237446][ T7123] ? __fget_files+0x3a0/0x420 [ 190.237470][ T7123] ? __pfx___sys_connect+0x10/0x10 [ 190.237508][ T7123] ? __pfx_ksys_write+0x10/0x10 [ 190.237525][ T7123] ? rcu_is_watching+0x15/0xb0 [ 190.237576][ T7123] __x64_sys_connect+0x7a/0x90 [ 190.237599][ T7123] do_syscall_64+0xfa/0x3b0 [ 190.237618][ T7123] ? lockdep_hardirqs_on+0x9c/0x150 [ 190.237648][ T7123] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 190.237668][ T7123] ? clear_bhb_loop+0x60/0xb0 [ 190.237692][ T7123] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 190.237710][ T7123] RIP: 0033:0x7f377918e929 [ 190.237728][ T7123] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 190.237744][ T7123] RSP: 002b:00007f3779ff1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 190.237765][ T7123] RAX: ffffffffffffffda RBX: 00007f37793b5fa0 RCX: 00007f377918e929 [ 190.237780][ T7123] RDX: 0000000000000010 RSI: 0000200000000080 RDI: 0000000000000004 [ 190.237810][ T7123] RBP: 00007f3779ff1090 R08: 0000000000000000 R09: 0000000000000000 [ 190.237823][ T7123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 190.237835][ T7123] R13: 0000000000000000 R14: 00007f37793b5fa0 R15: 00007f37794dfa28 [ 190.237867][ T7123] [ 190.512153][ C0] vkms_vblank_simulate: vblank timer overrun [ 190.520908][ T5948] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 190.720176][ T5948] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 190.943848][ T5948] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 190.954446][ T5948] usb 5-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 190.965452][ T24] usb 4-1: USB disconnect, device number 9 [ 191.076311][ T5948] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.142122][ T5948] usb 5-1: config 0 descriptor?? [ 191.158516][ T7130] ip6gre1: entered promiscuous mode [ 191.164766][ T7130] ip6gre1: entered allmulticast mode [ 191.390344][ T5902] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 191.562071][ T5902] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 191.616209][ T5948] hid-steam 0003:28DE:1142.0001: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.4-1/input0 [ 191.629910][ T5902] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 191.641980][ T5902] usb 3-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 191.657914][ T5902] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.711042][ T5948] hid-steam 0003:28DE:1142.0001: Steam wireless receiver connected [ 191.725204][ T5902] usb 3-1: config 0 descriptor?? [ 191.774542][ T5948] hid-steam 0003:28DE:1142.0002: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.4-1/input0 [ 192.246585][ T7152] input: syz0 as /devices/virtual/input/input21 [ 192.298532][ T7151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 192.331196][ T7151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 192.498974][ T838] usb 5-1: USB disconnect, device number 18 [ 192.542650][ T838] hid-steam 0003:28DE:1142.0001: Steam wireless receiver disconnected [ 193.550094][ T5948] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 194.017279][ T5948] usb 5-1: config 0 has no interfaces? [ 194.261889][ T5948] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 194.284162][ T5948] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.302770][ T5948] usb 5-1: Product: syz [ 194.307086][ T5948] usb 5-1: Manufacturer: syz [ 194.322245][ T5948] usb 5-1: SerialNumber: syz [ 194.343259][ T5948] usb 5-1: config 0 descriptor?? [ 194.465800][ T5902] usbhid 3-1:0.0: can't add hid device: -71 [ 194.482319][ T5902] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 194.518463][ T5902] usb 3-1: USB disconnect, device number 12 [ 194.624083][ T7165] delete_channel: no stack [ 195.297500][ T7188] netlink: 4 bytes leftover after parsing attributes in process `syz.0.362'. [ 195.322988][ T7188] netlink: 4 bytes leftover after parsing attributes in process `syz.0.362'. [ 195.369039][ T7185] FAULT_INJECTION: forcing a failure. [ 195.369039][ T7185] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 195.390136][ T7185] CPU: 0 UID: 0 PID: 7185 Comm: syz.3.363 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) [ 195.390170][ T7185] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 195.390183][ T7185] Call Trace: [ 195.390193][ T7185] [ 195.390212][ T7185] dump_stack_lvl+0x189/0x250 [ 195.390252][ T7185] ? __pfx____ratelimit+0x10/0x10 [ 195.390286][ T7185] ? __pfx_dump_stack_lvl+0x10/0x10 [ 195.390320][ T7185] ? __pfx__printk+0x10/0x10 [ 195.390357][ T7185] should_fail_ex+0x414/0x560 [ 195.390392][ T7185] _copy_to_user+0x31/0xb0 [ 195.390418][ T7185] simple_read_from_buffer+0xe1/0x170 [ 195.390446][ T7185] proc_fail_nth_read+0x1df/0x250 [ 195.390484][ T7185] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 195.390515][ T7185] ? rw_verify_area+0x258/0x650 [ 195.390547][ T7185] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 195.390576][ T7185] vfs_read+0x1fd/0x980 [ 195.390615][ T7185] ? __pfx___mutex_lock+0x10/0x10 [ 195.390637][ T7185] ? __pfx_vfs_read+0x10/0x10 [ 195.390673][ T7185] ? __fget_files+0x2a/0x420 [ 195.390702][ T7185] ? __fget_files+0x3a0/0x420 [ 195.390725][ T7185] ? __fget_files+0x2a/0x420 [ 195.390759][ T7185] ksys_read+0x145/0x250 [ 195.390781][ T7185] ? __pfx_ksys_read+0x10/0x10 [ 195.390811][ T7185] ? rcu_is_watching+0x15/0xb0 [ 195.390855][ T7185] ? do_syscall_64+0xbe/0x3b0 [ 195.390881][ T7185] do_syscall_64+0xfa/0x3b0 [ 195.390901][ T7185] ? lockdep_hardirqs_on+0x9c/0x150 [ 195.390933][ T7185] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.390955][ T7185] ? clear_bhb_loop+0x60/0xb0 [ 195.390981][ T7185] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.391002][ T7185] RIP: 0033:0x7f659b78d33c [ 195.391021][ T7185] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 195.391040][ T7185] RSP: 002b:00007f659c583030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 195.391062][ T7185] RAX: ffffffffffffffda RBX: 00007f659b9b6160 RCX: 00007f659b78d33c [ 195.391079][ T7185] RDX: 000000000000000f RSI: 00007f659c5830a0 RDI: 0000000000000004 [ 195.391093][ T7185] RBP: 00007f659c583090 R08: 0000000000000000 R09: 0000000000000000 [ 195.391106][ T7185] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000001 [ 195.391120][ T7185] R13: 0000000000000001 R14: 00007f659b9b6160 R15: 00007f659badfa28 [ 195.391153][ T7185] [ 196.047961][ T7194] netlink: 4 bytes leftover after parsing attributes in process `syz.1.365'. [ 196.668516][ T7200] netlink: 199012 bytes leftover after parsing attributes in process `syz.2.366'. [ 197.214889][ T7203] bond0: entered promiscuous mode [ 197.226959][ T7203] bond_slave_0: entered promiscuous mode [ 197.246672][ T7203] bond_slave_1: entered promiscuous mode [ 197.579772][ T10] usb 5-1: USB disconnect, device number 19 [ 197.776578][ T7222] FAULT_INJECTION: forcing a failure. [ 197.776578][ T7222] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 197.840288][ T7222] CPU: 0 UID: 0 PID: 7222 Comm: syz.4.372 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) [ 197.840319][ T7222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 197.840333][ T7222] Call Trace: [ 197.840342][ T7222] [ 197.840351][ T7222] dump_stack_lvl+0x189/0x250 [ 197.840390][ T7222] ? __pfx____ratelimit+0x10/0x10 [ 197.840423][ T7222] ? __pfx_dump_stack_lvl+0x10/0x10 [ 197.840456][ T7222] ? __pfx__printk+0x10/0x10 [ 197.840492][ T7222] should_fail_ex+0x414/0x560 [ 197.840525][ T7222] _copy_to_user+0x31/0xb0 [ 197.840560][ T7222] simple_read_from_buffer+0xe1/0x170 [ 197.840587][ T7222] proc_fail_nth_read+0x1df/0x250 [ 197.840617][ T7222] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 197.840646][ T7222] ? rw_verify_area+0x258/0x650 [ 197.840678][ T7222] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 197.840705][ T7222] vfs_read+0x1fd/0x980 [ 197.840743][ T7222] ? __pfx___mutex_lock+0x10/0x10 [ 197.840765][ T7222] ? __pfx_vfs_read+0x10/0x10 [ 197.840799][ T7222] ? __fget_files+0x2a/0x420 [ 197.840827][ T7222] ? __fget_files+0x3a0/0x420 [ 197.840850][ T7222] ? __fget_files+0x2a/0x420 [ 197.840883][ T7222] ksys_read+0x145/0x250 [ 197.840925][ T7222] ? __pfx_ksys_read+0x10/0x10 [ 197.840964][ T7222] ? do_syscall_64+0xbe/0x3b0 [ 197.840990][ T7222] do_syscall_64+0xfa/0x3b0 [ 197.841009][ T7222] ? lockdep_hardirqs_on+0x9c/0x150 [ 197.841041][ T7222] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.841062][ T7222] ? clear_bhb_loop+0x60/0xb0 [ 197.841087][ T7222] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.841107][ T7222] RIP: 0033:0x7f3a6998d33c [ 197.841126][ T7222] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 197.841145][ T7222] RSP: 002b:00007f3a677f6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 197.841168][ T7222] RAX: ffffffffffffffda RBX: 00007f3a69bb6080 RCX: 00007f3a6998d33c [ 197.841184][ T7222] RDX: 000000000000000f RSI: 00007f3a677f60a0 RDI: 0000000000000005 [ 197.841197][ T7222] RBP: 00007f3a677f6090 R08: 0000000000000000 R09: 0000000000000000 [ 197.841210][ T7222] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 197.841222][ T7222] R13: 0000000000000001 R14: 00007f3a69bb6080 R15: 00007f3a69cdfa28 [ 197.841254][ T7222] [ 198.167651][ T7220] input: syz0 as /devices/virtual/input/input22 [ 198.577191][ T7233] capability: warning: `syz.4.374' uses deprecated v2 capabilities in a way that may be insecure [ 198.619095][ T7233] input: syz1 as /devices/virtual/input/input23 [ 198.798942][ T7240] FAULT_INJECTION: forcing a failure. [ 198.798942][ T7240] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 198.821082][ T7240] CPU: 1 UID: 0 PID: 7240 Comm: syz.3.377 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) [ 198.821106][ T7240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 198.821116][ T7240] Call Trace: [ 198.821122][ T7240] [ 198.821128][ T7240] dump_stack_lvl+0x189/0x250 [ 198.821157][ T7240] ? __pfx____ratelimit+0x10/0x10 [ 198.821189][ T7240] ? __pfx_dump_stack_lvl+0x10/0x10 [ 198.821213][ T7240] ? __pfx__printk+0x10/0x10 [ 198.821239][ T7240] should_fail_ex+0x414/0x560 [ 198.821264][ T7240] _copy_to_user+0x31/0xb0 [ 198.821282][ T7240] io_recvmsg+0x989/0x13c0 [ 198.821328][ T7240] ? __pfx_io_recvmsg+0x10/0x10 [ 198.821348][ T7240] ? __lock_acquire+0xab9/0xd20 [ 198.821386][ T7240] ? __fget_files+0x2a/0x420 [ 198.821406][ T7240] ? __fget_files+0x2a/0x420 [ 198.821422][ T7240] ? __fget_files+0x3a0/0x420 [ 198.821440][ T7240] __io_issue_sqe+0x17e/0x4b0 [ 198.821459][ T7240] ? io_file_get_normal+0x101/0x2f0 [ 198.821480][ T7240] io_issue_sqe+0x165/0xfd0 [ 198.821505][ T7240] io_submit_sqes+0xa38/0x1c50 [ 198.821546][ T7240] __se_sys_io_uring_enter+0x2df/0x2b20 [ 198.821580][ T7240] ? ksys_write+0x1cb/0x250 [ 198.821596][ T7240] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 198.821615][ T7240] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 198.821630][ T7240] ? __pfx_vfs_write+0x10/0x10 [ 198.821656][ T7240] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 198.821674][ T7240] ? __fget_files+0x3a0/0x420 [ 198.821696][ T7240] ? fput+0xa0/0xd0 [ 198.821716][ T7240] ? ksys_write+0x22a/0x250 [ 198.821731][ T7240] ? __pfx_ksys_write+0x10/0x10 [ 198.821743][ T7240] ? rcu_is_watching+0x15/0xb0 [ 198.821771][ T7240] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 198.821793][ T7240] do_syscall_64+0xfa/0x3b0 [ 198.821807][ T7240] ? lockdep_hardirqs_on+0x9c/0x150 [ 198.821830][ T7240] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.821845][ T7240] ? clear_bhb_loop+0x60/0xb0 [ 198.821864][ T7240] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.821878][ T7240] RIP: 0033:0x7f659b78e929 [ 198.821892][ T7240] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 198.821904][ T7240] RSP: 002b:00007f659c5c5038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 198.821920][ T7240] RAX: ffffffffffffffda RBX: 00007f659b9b5fa0 RCX: 00007f659b78e929 [ 198.821932][ T7240] RDX: 0000000000000000 RSI: 00000000000027e2 RDI: 0000000000000005 [ 198.821940][ T7240] RBP: 00007f659c5c5090 R08: 0000000000000000 R09: 0000000000000000 [ 198.821949][ T7240] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 198.821958][ T7240] R13: 0000000000000000 R14: 00007f659b9b5fa0 R15: 00007f659badfa28 [ 198.821980][ T7240] [ 199.096489][ C1] vkms_vblank_simulate: vblank timer overrun [ 199.301701][ T7242] input: syz0 as /devices/virtual/input/input24 [ 199.331994][ T5948] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 199.501257][ T5948] usb 5-1: device descriptor read/64, error -71 [ 199.514599][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.521162][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 199.834598][ T5948] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 199.989964][ T5948] usb 5-1: device descriptor read/64, error -71 [ 200.131888][ T5948] usb usb5-port1: attempt power cycle [ 200.490116][ T5948] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 200.540437][ T5948] usb 5-1: device descriptor read/8, error -71 [ 200.823005][ T5948] usb 5-1: new full-speed USB device number 23 using dummy_hcd [ 200.891101][ T5948] usb 5-1: device descriptor read/8, error -71 [ 201.040178][ T5948] usb usb5-port1: unable to enumerate USB device [ 201.200191][ T838] usb 4-1: new low-speed USB device number 10 using dummy_hcd [ 201.364612][ T838] usb 4-1: No LPM exit latency info found, disabling LPM. [ 201.375402][ T838] usb 4-1: config 1 interface 0 altsetting 1 endpoint 0x1 is Bulk; changing to Interrupt [ 201.385641][ T838] usb 4-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 201.398647][ T838] usb 4-1: config 1 interface 0 has no altsetting 0 [ 201.779509][ T7286] netlink: 44 bytes leftover after parsing attributes in process `syz.0.389'. [ 201.795538][ T7286] netlink: 8 bytes leftover after parsing attributes in process `syz.0.389'. [ 201.807492][ T7286] netlink: 12 bytes leftover after parsing attributes in process `syz.0.389'. [ 202.012600][ T7295] input: syz0 as /devices/virtual/input/input25 [ 202.570144][ T9] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 202.799944][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 202.853591][ T9] usb 1-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 202.863662][ T9] usb 1-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 202.872039][ T9] usb 1-1: Product: syz [ 202.876290][ T9] usb 1-1: Manufacturer: syz [ 202.881065][ T9] usb 1-1: SerialNumber: syz [ 202.919505][ T9] usb 1-1: config 0 descriptor?? [ 203.346409][ T7303] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 203.971303][ T43] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 204.016080][ T838] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 204.044520][ T838] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.110209][ T838] usb 4-1: Product: 䠊 [ 204.114477][ T838] usb 4-1: Manufacturer: ᐇ [ 204.135363][ T838] usb 4-1: can't set config #1, error -71 [ 204.158576][ T43] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 204.178484][ T43] usb 2-1: config 1 has no interface number 0 [ 204.187147][ T838] usb 4-1: USB disconnect, device number 10 [ 204.195609][ T43] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 204.239013][ T43] usb 2-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 204.315449][ T43] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 204.395897][ T43] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 204.412625][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.429421][ T43] usb 2-1: Product: syz [ 204.456468][ T43] usb 2-1: Manufacturer: syz [ 204.471459][ T43] usb 2-1: SerialNumber: syz [ 205.001216][ T7320] netlink: 'syz.3.398': attribute type 13 has an invalid length. [ 205.017122][ T7320] netlink: 152 bytes leftover after parsing attributes in process `syz.3.398'. [ 205.055177][ T7320] : refused to change device tx_queue_len [ 205.110133][ T7320] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 205.136139][ T30] audit: type=1326 audit(1749863432.157:387): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7321 comm="syz.2.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f455b58e929 code=0x7ffc0000 [ 205.188754][ T30] audit: type=1326 audit(1749863432.157:388): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7321 comm="syz.2.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f455b52ab19 code=0x7ffc0000 [ 205.360255][ T30] audit: type=1326 audit(1749863432.157:389): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7321 comm="syz.2.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f455b52ab19 code=0x7ffc0000 [ 205.429153][ T30] audit: type=1326 audit(1749863432.157:390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7321 comm="syz.2.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f455b52ab19 code=0x7ffc0000 [ 205.536519][ T43] cdc_ncm 2-1:1.1: bind() failure [ 205.574053][ T30] audit: type=1326 audit(1749863432.157:391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7321 comm="syz.2.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f455b52ab19 code=0x7ffc0000 [ 205.604979][ T5926] usb 1-1: USB disconnect, device number 11 [ 205.699896][ T30] audit: type=1326 audit(1749863432.157:392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7321 comm="syz.2.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f455b52ab19 code=0x7ffc0000 [ 205.818277][ T30] audit: type=1326 audit(1749863432.157:393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7321 comm="syz.2.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f455b52ab19 code=0x7ffc0000 [ 205.850338][ T9] usb 2-1: USB disconnect, device number 8 [ 205.969372][ T30] audit: type=1326 audit(1749863432.157:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7321 comm="syz.2.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f455b52ab19 code=0x7ffc0000 [ 206.069943][ T30] audit: type=1326 audit(1749863432.157:395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7321 comm="syz.2.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f455b52ab19 code=0x7ffc0000 [ 206.140223][ T30] audit: type=1326 audit(1749863432.157:396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7321 comm="syz.2.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f455b52ab19 code=0x7ffc0000 [ 206.379937][ T9] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 206.670350][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 206.712970][ T9] usb 5-1: config 0 has an invalid interface number: 13 but max is 0 [ 206.728272][ T9] usb 5-1: config 0 has no interface number 0 [ 206.756436][ T9] usb 5-1: config 0 interface 13 altsetting 112 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 206.836589][ T9] usb 5-1: config 0 interface 13 has no altsetting 0 [ 206.866813][ T9] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 206.899950][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.926677][ T9] usb 5-1: Product: syz [ 206.935972][ T9] usb 5-1: Manufacturer: syz [ 206.953069][ T9] usb 5-1: SerialNumber: syz [ 206.979143][ T9] usb 5-1: config 0 descriptor?? [ 206.981892][ T5948] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 207.130191][ T7343] netlink: 24 bytes leftover after parsing attributes in process `syz.0.407'. [ 207.201813][ T5948] usb 2-1: Using ep0 maxpacket: 8 [ 207.255879][ T5948] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 207.288849][ T5948] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 207.319993][ T5948] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.365143][ T5948] usb 2-1: config 0 descriptor?? [ 207.588078][ T5948] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 207.868527][ T7350] FAULT_INJECTION: forcing a failure. [ 207.868527][ T7350] name failslab, interval 1, probability 0, space 0, times 0 [ 207.900150][ T7350] CPU: 1 UID: 0 PID: 7350 Comm: syz.1.404 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) [ 207.900182][ T7350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 207.900196][ T7350] Call Trace: [ 207.900204][ T7350] [ 207.900214][ T7350] dump_stack_lvl+0x189/0x250 [ 207.900253][ T7350] ? __pfx____ratelimit+0x10/0x10 [ 207.900291][ T7350] ? __pfx_dump_stack_lvl+0x10/0x10 [ 207.900324][ T7350] ? __pfx__printk+0x10/0x10 [ 207.900353][ T7350] ? __pfx___might_resched+0x10/0x10 [ 207.900384][ T7350] ? fs_reclaim_acquire+0x7d/0x100 [ 207.900414][ T7350] should_fail_ex+0x414/0x560 [ 207.900456][ T7350] should_failslab+0xa8/0x100 [ 207.900480][ T7350] kmem_cache_alloc_noprof+0x73/0x3c0 [ 207.900514][ T7350] ? alloc_empty_file+0x55/0x1d0 [ 207.900545][ T7350] alloc_empty_file+0x55/0x1d0 [ 207.900573][ T7350] path_openat+0x107/0x3830 [ 207.900602][ T7350] ? arch_stack_walk+0xfc/0x150 [ 207.900651][ T7350] ? kasan_save_track+0x4f/0x80 [ 207.900681][ T7350] ? kasan_save_track+0x3e/0x80 [ 207.900710][ T7350] ? __kasan_slab_alloc+0x6c/0x80 [ 207.900728][ T7350] ? getname_flags+0xb8/0x540 [ 207.900752][ T7350] ? __pfx_path_openat+0x10/0x10 [ 207.900779][ T7350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.900820][ T7350] do_filp_open+0x1fa/0x410 [ 207.900854][ T7350] ? __lock_acquire+0xab9/0xd20 [ 207.900885][ T7350] ? __pfx_do_filp_open+0x10/0x10 [ 207.900957][ T7350] ? _raw_spin_unlock+0x28/0x50 [ 207.900986][ T7350] ? alloc_fd+0x64c/0x6c0 [ 207.901021][ T7350] do_sys_openat2+0x121/0x1c0 [ 207.901053][ T7350] ? __pfx_do_sys_openat2+0x10/0x10 [ 207.901083][ T7350] ? ksys_write+0x22a/0x250 [ 207.901105][ T7350] ? __pfx_ksys_write+0x10/0x10 [ 207.901129][ T7350] __x64_sys_openat+0x138/0x170 [ 207.901164][ T7350] do_syscall_64+0xfa/0x3b0 [ 207.901184][ T7350] ? lockdep_hardirqs_on+0x9c/0x150 [ 207.901216][ T7350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.901237][ T7350] ? clear_bhb_loop+0x60/0xb0 [ 207.901264][ T7350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.901285][ T7350] RIP: 0033:0x7f25bdb8d290 [ 207.901305][ T7350] Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44 [ 207.901324][ T7350] RSP: 002b:00007f25be9f1b70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 207.901347][ T7350] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f25bdb8d290 [ 207.901363][ T7350] RDX: 0000000000000002 RSI: 00007f25be9f1c10 RDI: 00000000ffffff9c [ 207.901378][ T7350] RBP: 00007f25be9f1c10 R08: 0000000000000000 R09: 00007f25be9f1987 [ 207.901392][ T7350] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 207.901405][ T7350] R13: 0000000000000001 R14: 00007f25bddb6080 R15: 00007f25bdedfa28 [ 207.901444][ T7350] [ 208.201775][ T7329] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.210669][ T7329] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.480237][ T5948] usb 2-1: USB disconnect, device number 9 [ 208.915440][ T7359] netlink: 104 bytes leftover after parsing attributes in process `syz.0.409'. [ 208.970078][ T7361] netlink: 12 bytes leftover after parsing attributes in process `syz.1.410'. [ 209.083303][ T7361] netlink: 'syz.1.410': attribute type 13 has an invalid length. [ 209.103581][ T7361] netlink: 152 bytes leftover after parsing attributes in process `syz.1.410'. [ 209.142222][ T7361] : refused to change device tx_queue_len [ 209.167548][ T7361] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 209.173261][ T9] f81534 5-1:0.13: f81534_get_register: reg: 1003 failed: -71 [ 209.213027][ T9] f81534 5-1:0.13: f81534_find_config_idx: read failed: -71 [ 209.222744][ T9] f81534 5-1:0.13: f81534_calc_num_ports: find idx failed: -71 [ 209.231508][ T9] f81534 5-1:0.13: probe with driver f81534 failed with error -71 [ 209.313545][ T9] usb 5-1: USB disconnect, device number 24 [ 209.362583][ T7368] netlink: 68 bytes leftover after parsing attributes in process `syz.3.411'. [ 209.490321][ T7368] program syz.3.411 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 209.499971][ T7368] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 209.720284][ T5926] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 209.900036][ T5926] usb 2-1: Using ep0 maxpacket: 8 [ 209.907979][ T5926] usb 2-1: config 127 has an invalid interface number: 171 but max is 1 [ 209.917175][ T5926] usb 2-1: config 127 has no interface number 1 [ 209.935369][ T5926] usb 2-1: config 127 interface 171 has no altsetting 0 [ 209.948586][ T5926] usb 2-1: config 127 interface 0 has no altsetting 0 [ 210.064459][ T7377] netlink: 68 bytes leftover after parsing attributes in process `syz.4.414'. [ 210.097078][ T5926] usb 2-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9 [ 210.142547][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.170126][ T5926] usb 2-1: Product: syz [ 210.205071][ T5926] usb 2-1: Manufacturer: syz [ 210.223378][ T5926] usb 2-1: SerialNumber: syz [ 210.471008][ T7370] loop5: detected capacity change from 0 to 1 [ 210.576111][ T7383] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.622501][ T7383] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.801564][ T5926] hub 2-1:127.171: Invalid hub with more than one config or interface [ 210.818690][ T5926] hub 2-1:127.171: probe with driver hub failed with error -22 [ 210.842971][ T5926] xr_serial 2-1:127.171: xr_serial converter detected [ 210.952492][ T5926] xr_serial ttyUSB0: Failed to set reg 0x1a: -71 [ 210.974151][ T5926] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 211.022536][ T10] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 211.515469][ T7394] netlink: 12 bytes leftover after parsing attributes in process `syz.1.419'. [ 211.529330][ T5926] usb 2-1: USB disconnect, device number 10 [ 211.640005][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 211.668916][ T5926] xr_serial 2-1:127.171: device disconnected [ 211.686030][ T7394] bridge0: port 3() entered blocking state [ 211.700208][ T7394] bridge0: port 3() entered disabled state [ 211.727829][ T7394] : entered allmulticast mode [ 211.745411][ T7398] futex_wake_op: syz.1.419 tries to shift op by 32; fix this program [ 211.798552][ T7394] : entered promiscuous mode [ 211.813376][ T7394] bridge0: port 3() entered blocking state [ 211.819768][ T7394] bridge0: port 3() entered forwarding state [ 211.834843][ T7372] Bluetooth: hci0: command 0x0406 tx timeout [ 211.842804][ T7372] Bluetooth: hci1: command 0x0406 tx timeout [ 211.849571][ T5840] Bluetooth: hci3: command 0x0406 tx timeout [ 211.856229][ T7372] Bluetooth: hci4: command 0x0406 tx timeout [ 211.861905][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 211.862706][ T5840] Bluetooth: hci2: command 0x0406 tx timeout [ 211.936861][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 212.108587][ T10] usb 3-1: New USB device found, idVendor=ae6f, idProduct=79f4, bcdDevice=8f.99 [ 212.119025][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.140565][ T10] usb 3-1: Product: syz [ 212.147391][ T10] usb 3-1: Manufacturer: syz [ 212.158482][ T10] usb 3-1: SerialNumber: syz [ 212.406565][ T10] usb 3-1: config 0 descriptor?? [ 212.697669][ T7390] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 212.733054][ T7390] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 212.941337][ T7410] input: syz0 as /devices/virtual/input/input26 [ 213.032588][ T7414] netlink: 'syz.1.423': attribute type 6 has an invalid length. [ 213.042630][ T7414] tipc: Invalid UDP bearer configuration [ 213.042741][ T7414] tipc: Enabling of bearer rejected, failed to enable media [ 214.209929][ T838] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 214.382080][ T838] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 214.401616][ T838] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 214.425576][ T838] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.458776][ T838] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 214.715407][ T5926] usb 3-1: USB disconnect, device number 13 [ 215.179530][ T7422] netlink: 132 bytes leftover after parsing attributes in process `syz.2.426'. [ 215.227419][ T30] kauditd_printk_skb: 74 callbacks suppressed [ 215.227442][ T30] audit: type=1326 audit(1749863442.237:471): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7423 comm="syz.4.428" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3a6998e929 code=0x0 [ 215.511413][ T838] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 215.611344][ T838] stv0680 2-1:4.0: STV(e): camera ping failed!! [ 215.634453][ T838] stv0680 2-1:4.0: last error: 0, command = 0x0 [ 215.895320][ T24] usb 2-1: USB disconnect, device number 11 [ 216.611956][ T7437] fuse: Bad value for 'fd' [ 216.879385][ T7445] netlink: 'syz.3.434': attribute type 2 has an invalid length. [ 217.229954][ T838] usb 2-1: new low-speed USB device number 12 using dummy_hcd [ 217.386308][ T838] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 217.386342][ T838] usb 2-1: config 0 has no interface number 0 [ 217.386388][ T838] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 217.386418][ T838] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 217.386463][ T838] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 217.386489][ T838] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.389785][ T838] usb 2-1: config 0 descriptor?? [ 217.642542][ T7449] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 217.871948][ T7467] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 218.000537][ T9] IPVS: starting estimator thread 0... [ 218.076648][ T838] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 218.098508][ T7465] netlink: 12 bytes leftover after parsing attributes in process `syz.0.439'. [ 218.100129][ T7470] IPVS: using max 28 ests per chain, 67200 per kthread [ 218.350318][ T24] usb 2-1: USB disconnect, device number 12 [ 219.930091][ T838] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 220.094075][ T7488] netlink: 12 bytes leftover after parsing attributes in process `syz.1.447'. [ 220.103444][ T838] usb 5-1: Using ep0 maxpacket: 32 [ 220.118418][ T838] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 220.127831][ T838] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.146149][ T838] usb 5-1: config 0 descriptor?? [ 220.280938][ T7488] futex_wake_op: syz.1.447 tries to shift op by 32; fix this program [ 220.368996][ T838] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 220.379739][ T838] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 220.442624][ T838] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 220.497691][ T838] usb 5-1: media controller created [ 220.778524][ T838] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 220.980109][ T10] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 221.129937][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 221.146328][ T10] usb 2-1: config 1 interface 0 altsetting 127 endpoint 0x2 has an invalid bInterval 157, changing to 11 [ 221.172161][ T10] usb 2-1: config 1 interface 0 has no altsetting 0 [ 221.216164][ T10] usb 2-1: New USB device found, idVendor=0738, idProduct=1713, bcdDevice= 0.40 [ 221.241840][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.292469][ T10] usb 2-1: Product: syz [ 221.333571][ T10] usb 2-1: Manufacturer: syz [ 221.352579][ T10] usb 2-1: SerialNumber: syz [ 221.662321][ T7491] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.719300][ T7491] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.789918][ T5926] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 222.085265][ T5926] usb 4-1: config 0 has no interfaces? [ 222.154587][ T5926] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 222.179318][ T5926] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.197814][ T5926] usb 4-1: Product: syz [ 222.208898][ T5926] usb 4-1: Manufacturer: syz [ 222.218011][ T5926] usb 4-1: SerialNumber: syz [ 222.292351][ T5926] usb 4-1: config 0 descriptor?? [ 222.466557][ T10] usbhid 2-1:1.0: can't add hid device: -71 [ 222.498316][ T10] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 222.554324][ T7499] netlink: 20 bytes leftover after parsing attributes in process `syz.3.450'. [ 222.651231][ T10] usb 2-1: USB disconnect, device number 13 [ 222.819261][ T7508] netlink: 12 bytes leftover after parsing attributes in process `syz.1.453'. [ 222.870285][ T838] az6027: usb out operation failed. (-110) [ 222.915078][ T838] az6027: usb out operation failed. (-32) [ 222.932983][ T838] stb0899_attach: Driver disabled by Kconfig [ 222.954389][ T838] az6027: no front-end attached [ 222.954389][ T838] [ 222.992248][ T838] az6027: usb out operation failed. (-32) [ 223.006693][ T838] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 223.041955][ T838] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input27 [ 223.096910][ T838] dvb-usb: schedule remote query interval to 400 msecs. [ 223.133092][ T838] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 223.659071][ T5948] usb 5-1: USB disconnect, device number 25 [ 223.893240][ T5948] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 225.327548][ T5926] usb 4-1: USB disconnect, device number 11 [ 225.480104][ T5948] usb 1-1: new low-speed USB device number 12 using dummy_hcd [ 225.650023][ T5948] usb 1-1: device descriptor read/64, error -71 [ 225.831486][ T5157] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 225.840185][ T5157] Bluetooth: hci1: Injecting HCI hardware error event [ 225.849397][ T5157] Bluetooth: hci1: hardware error 0x00 [ 225.917440][ T7540] netlink: 4 bytes leftover after parsing attributes in process `syz.2.461'. [ 225.928396][ T7540] netlink: 4 bytes leftover after parsing attributes in process `syz.2.461'. [ 226.039919][ T5948] usb 1-1: new low-speed USB device number 13 using dummy_hcd [ 226.069906][ T30] audit: type=1326 audit(1749863453.087:472): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7541 comm="syz.3.463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f659b78e929 code=0x7ffc0000 [ 226.207267][ T43] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 226.231114][ T5948] usb 1-1: device descriptor read/64, error -71 [ 226.251225][ T43] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 226.279930][ T30] audit: type=1326 audit(1749863453.117:473): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7541 comm="syz.3.463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f659b78e929 code=0x7ffc0000 [ 226.341712][ T5948] usb usb1-port1: attempt power cycle [ 226.435803][ T30] audit: type=1326 audit(1749863453.117:474): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7541 comm="syz.3.463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f659b78e929 code=0x7ffc0000 [ 226.708359][ T30] audit: type=1326 audit(1749863453.117:475): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7541 comm="syz.3.463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f659b78e929 code=0x7ffc0000 [ 226.843996][ T30] audit: type=1326 audit(1749863453.117:476): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7541 comm="syz.3.463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f659b78e929 code=0x7ffc0000 [ 226.910003][ T24] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 226.937029][ T7547] vti0: entered promiscuous mode [ 227.050053][ T30] audit: type=1326 audit(1749863453.127:477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7541 comm="syz.3.463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f659b78e929 code=0x7ffc0000 [ 227.121239][ T24] usb 2-1: New USB device found, idVendor=05a4, idProduct=0290, bcdDevice=dc.1b [ 227.121275][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.127073][ T30] audit: type=1326 audit(1749863453.127:478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7541 comm="syz.3.463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f659b78e929 code=0x7ffc0000 [ 227.127119][ T30] audit: type=1326 audit(1749863453.127:479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7541 comm="syz.3.463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f659b78e929 code=0x7ffc0000 [ 227.127154][ T30] audit: type=1326 audit(1749863453.207:480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7541 comm="syz.3.463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f659b78e929 code=0x7ffc0000 [ 227.127191][ T30] audit: type=1326 audit(1749863453.217:481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7541 comm="syz.3.463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f659b78e929 code=0x7ffc0000 [ 227.137112][ T24] usb 2-1: config 0 descriptor?? [ 227.141585][ T24] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 227.406566][ T7545] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 227.407014][ T7545] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 227.897062][ T7549] tty tty21: ldisc open failed (-12), clearing slot 20 [ 228.010309][ T5157] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 228.223292][ T7563] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.469'. [ 228.319936][ T838] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 228.470679][ T838] usb 5-1: Using ep0 maxpacket: 32 [ 228.486166][ T838] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 228.543834][ T838] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.627051][ T838] usb 5-1: config 0 descriptor?? [ 228.758525][ T7573] netlink: 24 bytes leftover after parsing attributes in process `syz.0.474'. [ 228.904983][ T838] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 228.922564][ T5948] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 229.032469][ T838] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 229.099556][ T838] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 229.107396][ T838] usb 5-1: media controller created [ 229.112714][ T5948] usb 3-1: Using ep0 maxpacket: 16 [ 229.115441][ T5948] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 229.148400][ T5948] usb 3-1: config 0 has no interface number 0 [ 229.178390][ T5948] usb 3-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 229.414699][ T5948] usb 3-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 229.445757][ T5948] usb 3-1: config 0 interface 41 has no altsetting 0 [ 229.459156][ T838] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 229.474384][ T5948] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 229.483809][ T5948] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.503399][ T5948] usb 3-1: Product: syz [ 229.530170][ T5948] usb 3-1: Manufacturer: syz [ 229.540786][ T5948] usb 3-1: SerialNumber: syz [ 229.625239][ T24] usb 2-1: USB disconnect, device number 14 [ 229.631982][ T5948] usb 3-1: config 0 descriptor?? [ 229.646454][ T7571] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 229.655364][ T7571] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 229.930355][ T5948] dm9601 3-1:0.41: probe with driver dm9601 failed with error -71 [ 229.946957][ T5948] sr9700 3-1:0.41: probe with driver sr9700 failed with error -71 [ 229.965330][ T5948] usb 3-1: USB disconnect, device number 14 [ 230.431291][ T7593] netlink: 60 bytes leftover after parsing attributes in process `syz.0.481'. [ 231.115311][ T7599] netlink: 28 bytes leftover after parsing attributes in process `syz.1.482'. [ 231.124473][ T7599] netlink: 28 bytes leftover after parsing attributes in process `syz.1.482'. [ 231.382673][ T838] az6027: usb out operation failed. (-71) [ 231.467875][ T838] az6027: usb out operation failed. (-71) [ 231.474785][ T838] stb0899_attach: Driver disabled by Kconfig [ 231.491407][ T838] az6027: no front-end attached [ 231.491407][ T838] [ 231.518778][ T838] az6027: usb out operation failed. (-71) [ 231.529199][ T838] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 231.557989][ T838] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input28 [ 231.601950][ T838] dvb-usb: schedule remote query interval to 400 msecs. [ 231.704970][ T838] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 231.799374][ T838] usb 5-1: USB disconnect, device number 26 [ 232.119723][ T838] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 232.209914][ T5902] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 232.424902][ T5902] usb 1-1: Using ep0 maxpacket: 32 [ 232.444755][ T5902] usb 1-1: New USB device found, idVendor=1a0a, idProduct=0108, bcdDevice=4d.52 [ 232.454337][ T5902] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.460182][ T838] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 232.479880][ T5902] usb 1-1: Product: syz [ 232.499859][ T5902] usb 1-1: Manufacturer: syz [ 232.526678][ T5902] usb 1-1: SerialNumber: syz [ 232.694151][ T838] usb 5-1: New USB device found, idVendor=05a4, idProduct=0290, bcdDevice=dc.1b [ 232.719117][ T838] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.778535][ T838] usb 5-1: config 0 descriptor?? [ 232.805399][ T838] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 233.022861][ T7617] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.050535][ T7617] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.119180][ T5902] usb_ehset_test 1-1:84.0: probe with driver usb_ehset_test failed with error -32 [ 233.174083][ T5902] usb 1-1: USB disconnect, device number 15 [ 233.429964][ T24] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 233.614212][ T24] usb 2-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 233.632988][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.658437][ T24] usb 2-1: Product: syz [ 233.674447][ T24] usb 2-1: Manufacturer: syz [ 233.879183][ T7630] netlink: 4 bytes leftover after parsing attributes in process `syz.2.492'. [ 233.892929][ T7630] netlink: 4 bytes leftover after parsing attributes in process `syz.2.492'. [ 233.917351][ T24] usb 2-1: SerialNumber: syz [ 233.981777][ T24] usb 2-1: config 0 descriptor?? [ 234.220956][ T7622] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 234.229749][ T7622] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 234.241757][ T24] usb 2-1: f81604_read: reg: 105 failed: -EPIPE [ 234.262895][ T24] f81604 2-1:0.0: Setting termination of CH#0 failed: -EPIPE [ 234.276293][ T24] f81604 2-1:0.0: probe with driver f81604 failed with error -32 [ 234.344097][ T7640] netlink: 4 bytes leftover after parsing attributes in process `syz.0.493'. [ 234.377459][ T7640] netlink: 4 bytes leftover after parsing attributes in process `syz.0.493'. [ 235.204749][ T24] usb 5-1: USB disconnect, device number 27 [ 235.639914][ T838] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 235.832697][ T838] usb 5-1: Using ep0 maxpacket: 16 [ 235.846126][ T7653] IPv6: addrconf: prefix option has invalid lifetime [ 235.888865][ T838] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 235.951343][ T838] usb 5-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 236.012984][ T838] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 236.049367][ T838] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 236.205020][ T838] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 236.230016][ T838] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.244132][ T838] usb 5-1: SerialNumber: syz [ 236.386994][ T9] usb 2-1: USB disconnect, device number 15 [ 236.430109][ T24] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 236.610297][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 236.792544][ T24] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 236.857905][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.949681][ T24] usb 4-1: config 0 descriptor?? [ 237.049912][ T9] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 237.187223][ T838] usb 5-1: 0:2 : does not exist [ 237.251028][ T838] usb 5-1: USB disconnect, device number 28 [ 237.265866][ T24] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 237.321328][ T5850] udevd[5850]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 237.338768][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 237.359079][ T24] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 237.374036][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 237.392187][ T24] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 237.401511][ T9] usb 2-1: New USB device found, idVendor=05ac, idProduct=8246, bcdDevice= 0.00 [ 237.429935][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.456419][ T24] usb 4-1: media controller created [ 237.458915][ T9] usb 2-1: config 0 descriptor?? [ 237.485128][ T9] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 237.607406][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 237.751510][ T7671] xt_TPROXY: Can be used only with -p tcp or -p udp [ 238.176839][ T7677] netlink: 104 bytes leftover after parsing attributes in process `syz.4.501'. [ 239.380110][ T5948] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 239.634088][ T5948] usb 5-1: New USB device found, idVendor=05a4, idProduct=0290, bcdDevice=dc.1b [ 239.648211][ T7689] netlink: 8 bytes leftover after parsing attributes in process `syz.2.502'. [ 239.669881][ T7689] netlink: 8 bytes leftover after parsing attributes in process `syz.2.502'. [ 239.697803][ T5948] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.760170][ T9] usb 2-1: USB disconnect, device number 16 [ 239.779130][ T24] az6027: usb out operation failed. (-110) [ 239.802462][ T24] az6027: usb out operation failed. (-32) [ 239.808277][ T24] stb0899_attach: Driver disabled by Kconfig [ 239.833488][ T5948] usb 5-1: config 0 descriptor?? [ 239.838500][ T24] az6027: no front-end attached [ 239.838500][ T24] [ 239.862746][ T5948] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 239.886007][ T24] az6027: usb out operation failed. (-71) [ 239.994329][ T24] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 240.059324][ T24] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input29 [ 240.085041][ T7687] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 240.106874][ T7687] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 240.148262][ T24] dvb-usb: schedule remote query interval to 400 msecs. [ 240.190342][ T24] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 240.368076][ T24] usb 4-1: USB disconnect, device number 12 [ 240.615011][ T24] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 240.909929][ T5948] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 241.080121][ T5948] usb 2-1: device descriptor read/64, error -71 [ 241.176127][ T30] kauditd_printk_skb: 16 callbacks suppressed [ 241.176152][ T30] audit: type=1326 audit(1749863468.197:498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7713 comm="syz.2.510" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f455b58e929 code=0x0 [ 241.340066][ T5948] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 241.500044][ T5948] usb 2-1: device descriptor read/64, error -71 [ 241.610349][ T5948] usb usb2-port1: attempt power cycle [ 241.759980][ T9] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 241.830533][ T5843] Bluetooth: hci4: command 0x0406 tx timeout [ 241.959914][ T5948] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 241.994832][ T10] usb 5-1: USB disconnect, device number 29 [ 242.036489][ T5948] usb 2-1: device descriptor read/8, error -71 [ 242.140463][ T7726] tipc: Started in network mode [ 242.161957][ T7726] tipc: Node identity fa6ad7b32e77, cluster identity 4711 [ 242.169714][ T7726] tipc: Enabled bearer , priority 0 [ 242.182777][ T7726] syzkaller0: entered promiscuous mode [ 242.198212][ T7726] syzkaller0: entered allmulticast mode [ 242.255060][ T7726] tipc: Resetting bearer [ 242.292202][ T5948] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 242.335244][ T5948] usb 2-1: device descriptor read/8, error -71 [ 242.344137][ T7725] tipc: Resetting bearer [ 242.408726][ T7725] tipc: Disabling bearer [ 242.459300][ T7739] netlink: 'syz.4.518': attribute type 13 has an invalid length. [ 242.467653][ T7739] netlink: 152 bytes leftover after parsing attributes in process `syz.4.518'. [ 242.480949][ T5948] usb usb2-port1: unable to enumerate USB device [ 242.528159][ T7739] : refused to change device tx_queue_len [ 242.544222][ T7739] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 242.768257][ T7746] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 242.919902][ T9] usb 4-1: device descriptor read/64, error -71 [ 243.129922][ T5948] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 243.189942][ T9] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 243.490119][ T5948] usb 1-1: Using ep0 maxpacket: 8 [ 243.595470][ T5948] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 243.612524][ T5948] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 243.630253][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 243.642308][ T9] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 243.704815][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.723167][ T5948] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 243.753581][ T7757] netlink: 28 bytes leftover after parsing attributes in process `syz.2.519'. [ 243.762642][ T7757] netlink: 8 bytes leftover after parsing attributes in process `syz.2.519'. [ 244.008247][ T9] usb 4-1: config 0 descriptor?? [ 244.023603][ T5948] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 244.307533][ T9] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 244.353707][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 244.375328][ T5948] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 244.385295][ T9] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 244.457825][ T9] usb 4-1: media controller created [ 244.619598][ T5948] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 244.628715][ T5948] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 244.728906][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 244.739931][ T5948] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 244.916822][ T5948] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 244.973916][ T5948] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 245.030510][ T5948] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 245.063448][ T5948] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 245.074952][ T5948] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 245.088175][ T5948] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 245.134813][ T5948] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 245.276615][ T5948] usb 1-1: string descriptor 0 read error: -22 [ 245.295466][ T5948] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 245.322579][ T5948] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.400728][ T5948] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 245.707482][ T5948] usb 1-1: USB disconnect, device number 16 [ 245.916523][ T7746] adutux: No device or device unplugged -19 [ 246.025435][ T7746] fuse: Unknown parameter 'MdUϙ6@+rootmode' [ 246.030104][ T9] az6027: usb out operation failed. (-71) [ 246.058221][ T9] az6027: usb out operation failed. (-71) [ 246.072336][ T9] stb0899_attach: Driver disabled by Kconfig [ 246.078910][ T9] az6027: no front-end attached [ 246.078910][ T9] [ 246.093047][ T9] az6027: usb out operation failed. (-71) [ 246.098848][ T9] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 246.210436][ T9] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input30 [ 246.264304][ T9] dvb-usb: schedule remote query interval to 400 msecs. [ 246.269075][ T7765] Failed to get privilege flags for destination (handle=0x2:0x0) [ 246.279382][ T9] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 246.370847][ T9] usb 4-1: USB disconnect, device number 14 [ 246.492695][ T7757] syz.2.519 (7757): drop_caches: 2 [ 246.582126][ T9] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 246.637396][ T7768] netlink: 'syz.3.527': attribute type 1 has an invalid length. [ 246.867198][ T7772] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 247.004789][ T7768] veth3: entered promiscuous mode [ 247.026050][ T7781] netlink: 'syz.2.531': attribute type 13 has an invalid length. [ 247.039225][ T7781] netlink: 152 bytes leftover after parsing attributes in process `syz.2.531'. [ 247.041746][ T7768] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 247.072603][ T7783] loop6: detected capacity change from 0 to 7 [ 247.093169][ T7783] Dev loop6: unable to read RDB block 7 [ 247.110351][ T7781] : renamed from syz_tun (while UP) [ 247.116558][ T7783] loop6: unable to read partition table [ 247.123205][ T7783] loop6: partition table beyond EOD, truncated [ 247.142313][ T7781] : refused to change device tx_queue_len [ 247.159964][ T7783] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 247.159971][ T7781] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 247.320099][ T5902] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 247.549923][ T5902] usb 2-1: Using ep0 maxpacket: 8 [ 247.565801][ T5902] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 247.574280][ T5902] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 247.589362][ T5902] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 247.633705][ T5902] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 247.639405][ T7796] ip6gre1: entered promiscuous mode [ 247.660103][ T7796] ip6gre1: entered allmulticast mode [ 247.660504][ T5902] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 247.735681][ T5902] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 247.776167][ T5902] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.931936][ T9] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 248.042750][ T5902] usb 2-1: usb_control_msg returned -32 [ 248.048504][ T5902] usbtmc 2-1:16.0: can't read capabilities [ 248.114893][ T9] usb 3-1: config 0 has no interfaces? [ 248.127168][ T9] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 248.373949][ T30] audit: type=1326 audit(1749863475.387:499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7792 comm="syz.0.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f377918e929 code=0x7ffc0000 [ 248.396161][ C1] vkms_vblank_simulate: vblank timer overrun [ 248.566951][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.643148][ T30] audit: type=1326 audit(1749863475.397:500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7792 comm="syz.0.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f377918e929 code=0x7ffc0000 [ 248.661127][ T9] usb 3-1: Product: syz [ 248.665369][ C1] vkms_vblank_simulate: vblank timer overrun [ 248.669509][ T9] usb 3-1: Manufacturer: syz [ 248.701695][ T30] audit: type=1326 audit(1749863475.397:501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7792 comm="syz.0.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=83 compat=0 ip=0x7f377918e929 code=0x7ffc0000 [ 248.728498][ T30] audit: type=1326 audit(1749863475.397:502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7792 comm="syz.0.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f377918e929 code=0x7ffc0000 [ 248.750666][ C1] vkms_vblank_simulate: vblank timer overrun [ 248.838850][ T9] usb 3-1: SerialNumber: syz [ 248.880961][ T9] usb 3-1: config 0 descriptor?? [ 248.893774][ T30] audit: type=1326 audit(1749863475.447:503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7792 comm="syz.0.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f377918e929 code=0x7ffc0000 [ 248.916051][ C1] vkms_vblank_simulate: vblank timer overrun [ 248.977882][ T30] audit: type=1326 audit(1749863475.447:504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7792 comm="syz.0.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=437 compat=0 ip=0x7f377918e929 code=0x7ffc0000 [ 249.000113][ C1] vkms_vblank_simulate: vblank timer overrun [ 249.008788][ T30] audit: type=1326 audit(1749863475.447:505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7792 comm="syz.0.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f377918e929 code=0x7ffc0000 [ 249.031017][ C1] vkms_vblank_simulate: vblank timer overrun [ 249.039115][ T30] audit: type=1326 audit(1749863475.447:506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7792 comm="syz.0.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f377918e929 code=0x7ffc0000 [ 249.062952][ T30] audit: type=1326 audit(1749863475.587:507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7792 comm="syz.0.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f377918e929 code=0x7ffc0000 [ 249.087496][ T30] audit: type=1326 audit(1749863475.587:508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7792 comm="syz.0.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f377918e929 code=0x7ffc0000 [ 249.617395][ T7814] : renamed from pim6reg1 [ 249.908655][ T7820] loop6: detected capacity change from 0 to 7 [ 249.943190][ T7820] Dev loop6: unable to read RDB block 7 [ 249.962448][ T7820] loop6: unable to read partition table [ 249.982038][ T7820] loop6: partition table beyond EOD, truncated [ 250.002369][ T7820] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 250.088898][ T5948] usb 2-1: USB disconnect, device number 21 [ 250.169089][ T7822] FAULT_INJECTION: forcing a failure. [ 250.169089][ T7822] name failslab, interval 1, probability 0, space 0, times 0 [ 250.212255][ T7822] CPU: 0 UID: 0 PID: 7822 Comm: syz.0.541 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) [ 250.212287][ T7822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 250.212300][ T7822] Call Trace: [ 250.212309][ T7822] [ 250.212319][ T7822] dump_stack_lvl+0x189/0x250 [ 250.212360][ T7822] ? __pfx____ratelimit+0x10/0x10 [ 250.212393][ T7822] ? __pfx_dump_stack_lvl+0x10/0x10 [ 250.212427][ T7822] ? __pfx__printk+0x10/0x10 [ 250.212458][ T7822] ? __pfx___might_resched+0x10/0x10 [ 250.212497][ T7822] should_fail_ex+0x414/0x560 [ 250.212532][ T7822] should_failslab+0xa8/0x100 [ 250.212558][ T7822] kmem_cache_alloc_noprof+0x73/0x3c0 [ 250.212592][ T7822] ? alloc_vfsmnt+0x23/0x4e0 [ 250.212628][ T7822] alloc_vfsmnt+0x23/0x4e0 [ 250.212662][ T7822] clone_mnt+0x65/0xc70 [ 250.212696][ T7822] ? do_raw_spin_unlock+0x122/0x240 [ 250.212725][ T7822] copy_tree+0x40f/0x880 [ 250.212752][ T7822] ? copy_mnt_ns+0x178/0x880 [ 250.212778][ T7822] copy_mnt_ns+0x178/0x880 [ 250.212800][ T7822] ? rcu_is_watching+0x15/0xb0 [ 250.212834][ T7822] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 250.212873][ T7822] ? create_new_namespaces+0x31/0x720 [ 250.212908][ T7822] create_new_namespaces+0xd1/0x720 [ 250.212945][ T7822] ? bpf_lsm_capable+0x9/0x20 [ 250.212965][ T7822] ? security_capable+0x7e/0x2e0 [ 250.213008][ T7822] unshare_nsproxy_namespaces+0x11c/0x170 [ 250.213046][ T7822] ksys_unshare+0x4c8/0x8c0 [ 250.213078][ T7822] ? __pfx_ksys_unshare+0x10/0x10 [ 250.213103][ T7822] ? __pfx_ksys_write+0x10/0x10 [ 250.213120][ T7822] ? rcu_is_watching+0x15/0xb0 [ 250.213164][ T7822] __x64_sys_unshare+0x38/0x50 [ 250.213188][ T7822] do_syscall_64+0xfa/0x3b0 [ 250.213208][ T7822] ? lockdep_hardirqs_on+0x9c/0x150 [ 250.213241][ T7822] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 250.213262][ T7822] ? clear_bhb_loop+0x60/0xb0 [ 250.213289][ T7822] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 250.213310][ T7822] RIP: 0033:0x7f377918e929 [ 250.213330][ T7822] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 250.213349][ T7822] RSP: 002b:00007f3779ff1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 250.213372][ T7822] RAX: ffffffffffffffda RBX: 00007f37793b5fa0 RCX: 00007f377918e929 [ 250.213388][ T7822] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020060400 [ 250.213401][ T7822] RBP: 00007f3779ff1090 R08: 0000000000000000 R09: 0000000000000000 [ 250.213415][ T7822] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 250.213427][ T7822] R13: 0000000000000000 R14: 00007f37793b5fa0 R15: 00007f37794dfa28 [ 250.213461][ T7822] [ 250.617771][ T7830] trusted_key: syz.0.544 sent an empty control message without MSG_MORE. [ 250.665084][ T10] usb 3-1: USB disconnect, device number 15 [ 250.985804][ T7842] netlink: 'syz.1.546': attribute type 13 has an invalid length. [ 250.993971][ T7842] netlink: 152 bytes leftover after parsing attributes in process `syz.1.546'. [ 251.008229][ T7842] : refused to change device tx_queue_len [ 251.015289][ T7842] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 251.629924][ T10] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 251.795269][ T10] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 251.810418][ T10] usb 4-1: New USB device found, idVendor=3344, idProduct=22f0, bcdDevice=ef.4d [ 251.912226][ T7859] netlink: 4 bytes leftover after parsing attributes in process `syz.2.551'. [ 251.971833][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 252.001973][ T7857] hsr0: entered promiscuous mode [ 252.028076][ T10] usb 4-1: Product: syz [ 252.077532][ T10] usb 4-1: Manufacturer: syz [ 252.110512][ T10] usb 4-1: SerialNumber: syz [ 252.133213][ T7863] loop6: detected capacity change from 0 to 7 [ 252.192080][ T6061] Dev loop6: unable to read RDB block 7 [ 252.198362][ T6061] loop6: unable to read partition table [ 252.217308][ T7865] netlink: 24 bytes leftover after parsing attributes in process `syz.0.554'. [ 252.232681][ T6061] loop6: partition table beyond EOD, truncated [ 252.265476][ T7863] Dev loop6: unable to read RDB block 7 [ 252.276027][ T7863] loop6: unable to read partition table [ 252.286321][ T7863] loop6: partition table beyond EOD, truncated [ 252.318785][ T7863] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 253.389935][ T30] kauditd_printk_skb: 23 callbacks suppressed [ 253.389956][ T30] audit: type=1800 audit(1749863480.397:532): pid=7888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.559" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 253.475054][ T7891] netlink: 'syz.0.560': attribute type 13 has an invalid length. [ 253.535842][ T7891] netlink: 152 bytes leftover after parsing attributes in process `syz.0.560'. [ 253.612003][ T7891] : refused to change device tx_queue_len [ 253.636308][ T7891] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 253.957500][ T10] usb 4-1: selecting invalid altsetting 1 [ 253.975975][ T10] LME2510(C): Firmware Status: 00 00 00 00 00 00 [ 253.976108][ T10] dvb_usb_lmedm04 4-1:2.0: probe with driver dvb_usb_lmedm04 failed with error -22 [ 254.075653][ T10] usb 4-1: USB disconnect, device number 15 [ 254.316907][ T7906] fuse: Bad value for 'fd' [ 254.339963][ T5902] usb 5-1: new full-speed USB device number 30 using dummy_hcd [ 254.348229][ T7911] netlink: 16 bytes leftover after parsing attributes in process `syz.2.569'. [ 254.361850][ T7911] netlink: 16 bytes leftover after parsing attributes in process `syz.2.569'. [ 254.550814][ T5902] usb 5-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 254.594583][ T5902] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 254.630102][ T5902] usb 5-1: Product: syz [ 254.630199][ T838] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 254.634528][ T5902] usb 5-1: Manufacturer: syz [ 254.659112][ T5902] usb 5-1: SerialNumber: syz [ 254.680662][ T5902] usb 5-1: config 0 descriptor?? [ 254.703304][ T5902] gspca_main: sq930x-2.14.0 probing 2770:930c [ 254.788574][ T7924] netlink: 8 bytes leftover after parsing attributes in process `syz.3.573'. [ 254.933105][ T838] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 254.963169][ T838] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 254.975697][ T838] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10 [ 254.988215][ T838] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 254.998520][ T838] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 255.129019][ T838] usb 2-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 255.199964][ T838] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.230222][ T24] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 255.255904][ T838] usb 2-1: Product: syz [ 255.313848][ T838] usb 2-1: Manufacturer: syz [ 255.355127][ T838] usb 2-1: SerialNumber: syz [ 255.390701][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 255.410968][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 255.438878][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 255.457925][ T24] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 255.468532][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12336, setting to 1024 [ 255.496129][ T24] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 255.537675][ T24] usb 3-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 255.554556][ T838] usb 2-1: config 0 descriptor?? [ 255.578733][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.636463][ T24] usb 3-1: config 0 descriptor?? [ 255.657866][ T838] input: KB Gear Tablet as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input31 [ 255.668741][ T7931] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 255.773551][ T7940] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 255.852429][ T7940] xt_TPROXY: Can be used only with -p tcp or -p udp [ 256.005592][ T838] usb 3-1: USB disconnect, device number 16 [ 256.098907][ T5843] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 256.180049][ T5902] gspca_sq930x: reg_w 0105 0f00 failed -110 [ 256.195028][ T5902] sq930x 5-1:0.0: probe with driver sq930x failed with error -110 [ 256.569572][ T7951] netlink: 4 bytes leftover after parsing attributes in process `syz.0.579'. [ 256.580945][ T7951] netlink: 4 bytes leftover after parsing attributes in process `syz.0.579'. [ 256.929183][ T7961] fuse: Bad value for 'fd' [ 257.402842][ T838] usb 5-1: USB disconnect, device number 30 [ 258.076950][ T838] usb 2-1: USB disconnect, device number 22 [ 258.726210][ T7989] ip6gre1: entered promiscuous mode [ 258.740272][ T7989] ip6gre1: entered allmulticast mode [ 259.427482][ T8004] fuse: Bad value for 'fd' [ 259.545196][ T8006] netlink: 'syz.1.597': attribute type 13 has an invalid length. [ 259.586534][ T8006] netlink: 152 bytes leftover after parsing attributes in process `syz.1.597'. [ 259.620363][ T8006] : refused to change device tx_queue_len [ 259.640485][ T8006] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 259.896632][ T8010] netlink: 28 bytes leftover after parsing attributes in process `syz.1.599'. [ 260.957396][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 260.968461][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 261.398559][ T8040] overlayfs: missing 'lowerdir' [ 261.640014][ T10] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 261.838682][ T10] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 261.857714][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 261.879534][ T10] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 261.890362][ T10] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 261.909357][ T10] usb 2-1: Product: syz [ 261.926213][ T10] usb 2-1: Manufacturer: syz [ 261.935690][ T10] usb 2-1: SerialNumber: syz [ 261.957045][ T10] usb 2-1: config 0 descriptor?? [ 261.976708][ T10] usb 2-1: selecting invalid altsetting 0 [ 262.617317][ T8054] input: syz0 as /devices/virtual/input/input32 [ 263.060322][ T8060] tipc: Started in network mode [ 263.067786][ T8060] tipc: Node identity fe800000000000000000000000000013, cluster identity 4711 [ 263.079595][ T8060] tipc: Enabled bearer , priority 10 [ 263.100047][ T8061] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.388098][ T8061] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.466285][ T8061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.608'. [ 264.204996][ T5902] tipc: Node number set to 4269801491 [ 264.867895][ T8074] ================================================================== [ 264.876041][ T8074] BUG: KASAN: slab-out-of-bounds in _raw_spin_lock+0x2e/0x40 [ 264.883429][ T8074] Read of size 1 at addr ffff888022bd2560 by task syz.2.614/8074 [ 264.891161][ T8074] [ 264.893510][ T8074] CPU: 1 UID: 0 PID: 8074 Comm: syz.2.614 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) [ 264.893528][ T8074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 264.893538][ T8074] Call Trace: [ 264.893546][ T8074] [ 264.893570][ T8074] dump_stack_lvl+0x189/0x250 [ 264.893596][ T8074] ? __kasan_check_byte+0x12/0x40 [ 264.893613][ T8074] ? __pfx_dump_stack_lvl+0x10/0x10 [ 264.893636][ T8074] ? lock_release+0x4b/0x3e0 [ 264.893659][ T8074] ? __virt_addr_valid+0x4a5/0x5c0 [ 264.893675][ T8074] print_report+0xd2/0x2b0 [ 264.893694][ T8074] ? _raw_spin_lock+0x2e/0x40 [ 264.893714][ T8074] kasan_report+0x118/0x150 [ 264.893729][ T8074] ? _raw_spin_lock+0x2e/0x40 [ 264.893752][ T8074] ? __futex_pivot_hash+0x226/0x460 [ 264.893768][ T8074] __kasan_check_byte+0x2a/0x40 [ 264.893782][ T8074] lock_acquire+0x8d/0x360 [ 264.893806][ T8074] ? futex_hash_allocate+0x7eb/0xba0 [ 264.893825][ T8074] _raw_spin_lock+0x2e/0x40 [ 264.893845][ T8074] ? __futex_pivot_hash+0x226/0x460 [ 264.893860][ T8074] __futex_pivot_hash+0x226/0x460 [ 264.893880][ T8074] futex_hash_allocate+0xa6b/0xba0 [ 264.893897][ T8074] ? __pfx_futex_hash_allocate+0x10/0x10 [ 264.893913][ T8074] ? cap_task_prctl+0x1de/0xaa0 [ 264.893931][ T8074] ? static_key_count+0x41/0x70 [ 264.893945][ T8074] ? security_task_prctl+0x163/0x190 [ 264.893967][ T8074] __se_sys_prctl+0x9e8/0x1940 [ 264.893986][ T8074] ? __pfx___se_sys_prctl+0x10/0x10 [ 264.894004][ T8074] ? rcu_is_watching+0x15/0xb0 [ 264.894028][ T8074] ? do_syscall_64+0xbe/0x3b0 [ 264.894042][ T8074] ? __x64_sys_prctl+0x20/0xc0 [ 264.894060][ T8074] do_syscall_64+0xfa/0x3b0 [ 264.894073][ T8074] ? lockdep_hardirqs_on+0x9c/0x150 [ 264.894095][ T8074] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.894110][ T8074] ? clear_bhb_loop+0x60/0xb0 [ 264.894126][ T8074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.894140][ T8074] RIP: 0033:0x7f455b58e929 [ 264.894155][ T8074] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 264.894168][ T8074] RSP: 002b:00007f455c3cc038 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 264.894184][ T8074] RAX: ffffffffffffffda RBX: 00007f455b7b6080 RCX: 00007f455b58e929 [ 264.894195][ T8074] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000004e [ 264.894205][ T8074] RBP: 00007f455b610b39 R08: 0000000000000000 R09: 0000000000000000 [ 264.894214][ T8074] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 264.894223][ T8074] R13: 0000000000000000 R14: 00007f455b7b6080 R15: 00007f455b8dfa28 [ 264.894239][ T8074] [ 264.894244][ T8074] [ 265.153600][ T8074] Allocated by task 8073: [ 265.157946][ T8074] kasan_save_track+0x3e/0x80 [ 265.162649][ T8074] __kasan_kmalloc+0x93/0xb0 [ 265.167331][ T8074] __kvmalloc_node_noprof+0x30d/0x5f0 [ 265.172776][ T8074] futex_hash_allocate+0x3f4/0xba0 [ 265.177928][ T8074] __se_sys_prctl+0x9e8/0x1940 [ 265.182703][ T8074] do_syscall_64+0xfa/0x3b0 [ 265.187224][ T8074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.193134][ T8074] [ 265.195462][ T8074] The buggy address belongs to the object at ffff888022bd2500 [ 265.195462][ T8074] which belongs to the cache kmalloc-cg-64 of size 64 [ 265.209607][ T8074] The buggy address is located 32 bytes to the right of [ 265.209607][ T8074] allocated 64-byte region [ffff888022bd2500, ffff888022bd2540) [ 265.224193][ T8074] [ 265.226522][ T8074] The buggy address belongs to the physical page: [ 265.232933][ T8074] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22bd2 [ 265.241694][ T8074] memcg:ffff88801e2c6601 [ 265.245937][ T8074] anon flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 265.253496][ T8074] page_type: f5(slab) [ 265.257486][ T8074] raw: 00fff00000000000 ffff88801a449c80 0000000000000000 dead000000000001 [ 265.266074][ T8074] raw: 0000000000000000 0000000080200020 00000000f5000000 ffff88801e2c6601 [ 265.274664][ T8074] page dumped because: kasan: bad access detected [ 265.281090][ T8074] page_owner tracks the page as allocated [ 265.286806][ T8074] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5852, tgid 5852 (syz-executor), ts 100228189713, free_ts 100226550961 [ 265.306261][ T8074] post_alloc_hook+0x240/0x2a0 [ 265.311043][ T8074] get_page_from_freelist+0x21e4/0x22c0 [ 265.316605][ T8074] __alloc_frozen_pages_noprof+0x181/0x370 [ 265.322430][ T8074] alloc_pages_mpol+0x232/0x4a0 [ 265.327289][ T8074] allocate_slab+0x8a/0x3b0 [ 265.331824][ T8074] ___slab_alloc+0xbfc/0x1480 [ 265.336514][ T8074] __kmalloc_cache_noprof+0x296/0x3d0 [ 265.341897][ T8074] alloc_fdtable+0xa7/0x2a0 [ 265.346409][ T8074] dup_fd+0x86c/0xb60 [ 265.350399][ T8074] copy_files+0xc9/0x120 [ 265.354650][ T8074] copy_process+0x15b2/0x3c00 [ 265.359334][ T8074] kernel_clone+0x21e/0x870 [ 265.363863][ T8074] __x64_sys_clone+0x18b/0x1e0 [ 265.368635][ T8074] do_syscall_64+0xfa/0x3b0 [ 265.373151][ T8074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.379061][ T8074] page last free pid 5852 tgid 5852 stack trace: [ 265.385402][ T8074] __free_frozen_pages+0xc71/0xe70 [ 265.390524][ T8074] vfree+0x25a/0x400 [ 265.394422][ T8074] __do_replace+0x827/0x980 [ 265.398938][ T8074] do_ip6t_set_ctl+0xa16/0xce0 [ 265.403732][ T8074] nf_setsockopt+0x26f/0x290 [ 265.408338][ T8074] do_sock_setsockopt+0x257/0x3e0 [ 265.413373][ T8074] __x64_sys_setsockopt+0x18b/0x220 [ 265.418584][ T8074] do_syscall_64+0xfa/0x3b0 [ 265.423092][ T8074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.428993][ T8074] [ 265.431324][ T8074] Memory state around the buggy address: [ 265.436962][ T8074] ffff888022bd2400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 265.445030][ T8074] ffff888022bd2480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 265.453098][ T8074] >ffff888022bd2500: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 265.461186][ T8074] ^ [ 265.468386][ T8074] ffff888022bd2580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 265.476460][ T8074] ffff888022bd2600: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 265.484528][ T8074] ================================================================== [ 265.494118][ T8074] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 265.501356][ T8074] CPU: 1 UID: 0 PID: 8074 Comm: syz.2.614 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) [ 265.513255][ T8074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 265.523320][ T8074] Call Trace: [ 265.526604][ T8074] [ 265.529542][ T8074] dump_stack_lvl+0x99/0x250 [ 265.534156][ T8074] ? __asan_memcpy+0x40/0x70 [ 265.538767][ T8074] ? __pfx_dump_stack_lvl+0x10/0x10 [ 265.543992][ T8074] ? __pfx__printk+0x10/0x10 [ 265.548601][ T8074] panic+0x2db/0x790 [ 265.552518][ T8074] ? lockdep_hardirqs_on+0x9c/0x150 [ 265.557732][ T8074] ? __pfx_panic+0x10/0x10 [ 265.562170][ T8074] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 265.568078][ T8074] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 265.573985][ T8074] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 265.580345][ T8074] ? _raw_spin_lock+0x2e/0x40 [ 265.585051][ T8074] check_panic_on_warn+0x89/0xb0 [ 265.590001][ T8074] ? _raw_spin_lock+0x2e/0x40 [ 265.594701][ T8074] end_report+0x78/0x160 [ 265.598956][ T8074] kasan_report+0x129/0x150 [ 265.603468][ T8074] ? _raw_spin_lock+0x2e/0x40 [ 265.608170][ T8074] ? __futex_pivot_hash+0x226/0x460 [ 265.613389][ T8074] __kasan_check_byte+0x2a/0x40 [ 265.618250][ T8074] lock_acquire+0x8d/0x360 [ 265.622687][ T8074] ? futex_hash_allocate+0x7eb/0xba0 [ 265.627989][ T8074] _raw_spin_lock+0x2e/0x40 [ 265.632508][ T8074] ? __futex_pivot_hash+0x226/0x460 [ 265.637714][ T8074] __futex_pivot_hash+0x226/0x460 [ 265.642785][ T8074] futex_hash_allocate+0xa6b/0xba0 [ 265.647924][ T8074] ? __pfx_futex_hash_allocate+0x10/0x10 [ 265.653570][ T8074] ? cap_task_prctl+0x1de/0xaa0 [ 265.658436][ T8074] ? static_key_count+0x41/0x70 [ 265.663294][ T8074] ? security_task_prctl+0x163/0x190 [ 265.668594][ T8074] __se_sys_prctl+0x9e8/0x1940 [ 265.673382][ T8074] ? __pfx___se_sys_prctl+0x10/0x10 [ 265.678593][ T8074] ? rcu_is_watching+0x15/0xb0 [ 265.683382][ T8074] ? do_syscall_64+0xbe/0x3b0 [ 265.688069][ T8074] ? __x64_sys_prctl+0x20/0xc0 [ 265.692850][ T8074] do_syscall_64+0xfa/0x3b0 [ 265.697360][ T8074] ? lockdep_hardirqs_on+0x9c/0x150 [ 265.702586][ T8074] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.708661][ T8074] ? clear_bhb_loop+0x60/0xb0 [ 265.713353][ T8074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.719256][ T8074] RIP: 0033:0x7f455b58e929 [ 265.723699][ T8074] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 265.743450][ T8074] RSP: 002b:00007f455c3cc038 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 265.751883][ T8074] RAX: ffffffffffffffda RBX: 00007f455b7b6080 RCX: 00007f455b58e929 [ 265.759962][ T8074] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000004e [ 265.767952][ T8074] RBP: 00007f455b610b39 R08: 0000000000000000 R09: 0000000000000000 [ 265.775932][ T8074] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 265.783919][ T8074] R13: 0000000000000000 R14: 00007f455b7b6080 R15: 00007f455b8dfa28 [ 265.791912][ T8074] [ 265.795295][ T8074] Kernel Offset: disabled [ 265.799664][ T8074] Rebooting in 86400 seconds..