last executing test programs: 2m35.132645853s ago: executing program 3 (id=985): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f0000002200)=[{{&(0x7f00000004c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/8, 0x8}, {&(0x7f0000000780)=""/197, 0xc5}], 0x2}, 0x4}, {{&(0x7f00000005c0)=@l2tp, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000880)=""/253, 0xfd}, {&(0x7f0000000980)=""/168, 0xa8}, {&(0x7f0000000a40)=""/43, 0x2b}], 0x3, &(0x7f0000000ac0)=""/118, 0x76}, 0xffffffff}, {{&(0x7f0000000b40), 0x80, &(0x7f0000000d80)=[{&(0x7f0000000bc0)=""/73, 0x49}, {&(0x7f0000000c40)=""/100, 0x64}, {&(0x7f0000000cc0)=""/62, 0x3e}, {&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000000d00)=""/82, 0x52}], 0x5, &(0x7f0000000e00)=""/254, 0xfe}, 0xb96}, {{&(0x7f0000000f00), 0x80, &(0x7f00000010c0)=[{&(0x7f0000000f80)=""/196, 0xc4}, {&(0x7f0000001080)}], 0x2, &(0x7f0000002180)=""/108, 0x6c}, 0x8f}], 0x4, 0x2160, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) execve(0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000640)=ANY=[@ANYBLOB="1201010200000010f3044d074000010203010902240001010330050904000801030101000921ff00010122b00b09058103100002ba071d08f82aa233bff40b390532dcb12836d812c85a5508fe1d34273bef8c075fa586d539519ce9576259f75faefaf0eedbde4be3ec5925b5ba500ac90d8122f06dc03afce30e3bf434f93d3c81f80801f85b2850da8e3defa5821e9c93e481c11e2c76e29561e2b27b4f6f988de3cc92f994051b2aed9bebeae0bd7217e8afdc68bf6bd521b771b96f91a4958c4822296d90ce4c97f16702bcd23be384a532bb6876929fe894b25db8083964057943d1d8b4c71eb71ff2bf8c03a9a79246a60cab511268dbd3c25dfbd33063020e1eef8411"], 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@bridge_getneigh={0x20, 0x1e, 0xd01, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0xa001, 0x45001}}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0xc008ae88, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000000000091000040"]) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) setsockopt$inet_int(r6, 0x0, 0x19, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWRULE={0x84, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x58, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x1c, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}, @NFTA_IMMEDIATE_DREG={0x8}]}}}, {0x18, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0xac}}, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'macvlan0\x00'}) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_RATE_GET(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x3c, 0x0, 0xa679d07be9d27db9, 0x70bd26, 0x25dfdbfe, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) r12 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340), 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000001000000b7080000000000007b8af8ff00000000b508000000000000638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018240000", @ANYRES32=r12, @ANYBLOB="0000000002000000b703000008000000850000006900000095"], &(0x7f0000000080)='GPL\x00', 0x4}, 0x90) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000240)=ANY=[@ANYRESDEC=0x0], 0x3c}}, 0x0) 2m31.839907811s ago: executing program 3 (id=1004): socket$packet(0x11, 0x3, 0x300) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$xdp(0x2c, 0x3, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x129a02, 0xe8) socket$netlink(0x10, 0x3, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0x308280, 0x1b9) socket$nl_sock_diag(0x10, 0x3, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2d, 0x2, 0x0) r0 = socket(0x10, 0x3, 0x0) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000180)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x24e, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x6, 0x40, 0x1, [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x3, 0x1, 0x2, 0xaa, {0x9, 0x21, 0xff00, 0xa, 0x1, {0x22, 0xfa4}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x7f, 0x3, 0x3a}}}}}]}}]}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB="6400000010000304000000000000000000000006", @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}}, 0x0) 2m30.240623202s ago: executing program 3 (id=1008): socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x4, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000005000000850000072e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(0xffffffffffffffff, 0xfffffffc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x2000000) 2m28.180061383s ago: executing program 3 (id=1018): socket$packet(0x11, 0x3, 0x300) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$xdp(0x2c, 0x3, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x129a02, 0xe8) socket$netlink(0x10, 0x3, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0x308280, 0x1b9) socket$nl_sock_diag(0x10, 0x3, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2d, 0x2, 0x0) r0 = socket(0x10, 0x3, 0x0) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000180)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x24e, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x6, 0x40, 0x1, [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x3, 0x1, 0x2, 0xaa, {0x9, 0x21, 0xff00, 0xa, 0x1, {0x22, 0xfa4}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x7f, 0x3, 0x3a}}}}}]}}]}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}}, 0x0) 2m26.76721407s ago: executing program 3 (id=1027): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x0, @dev={0xfe, 0x80, '\x00', 0x20}, 0x9}, 0x1c, &(0x7f0000000100)=[{0x0}, {&(0x7f0000000ec0)="ad", 0x1}], 0x2, &(0x7f00000020c0)=ANY=[@ANYBLOB="38020000000000002900000036000000004300000000000004013f040100c910ff010000000000000000000000000001c910fc0000000000000000000000000000000001000740000000000e07010101000000010011000200000000000000000000000000000001000000010000002000000000000000ffffffff00000000ffffffffffffff7f06aeb07c1c192077cc9e7c45705803ad5588ca8b194d23f748fe792cfa3d32221f25d73b8ffe64a4ddda6efcfb7483b588194d29c7a04395d8500965a9a1d07879040c44db1d5d6f618d2ab920f0bf168ddc9acc6a51edd1230760d4ae8bf30f5f82a78e8114849ee8e37364560400000035bfa8197ef2ba99103ee5f5aae28ec5c8e2675db11530f5c466d55f2244d479dc653c854406155eada3eaeb90d39149b8d13bab75a9bd1452c8c76284b9ddfbeff41344e64f1771d78a706e1c5a6d63f1c954e24a1e73f75c26e9f09ec9b606cc3470f11c4842db651926bd2263a4a0a8fe80de8b2f9cb176e51819d5f4d10a5d1f0488d5e46953fbfd750f6137fbebe89a8d462158a87f9622355104b4f68d7a6d3ad85c373ea52a25afad37ffb743a5c361158087904b09fcc806d032bac00ee0e0251fc032446e45a3e12417ff4703526ffc45f71567857777927903799e0ba453334186009d22e38099c67b5350c7e82136bba947a18fb61d36fcba1f9efe3d79485d06252702833dc8ee417f40bb9064878fb89dd75a49135e5df148c4ad1e1d5626b44c8112d822f4c9a05e693fd5ae5595627f8684016b37a2bf6d0040030000000000002900000037000000006500000000000000fb1a63687c244e6df3aecb13d6eb957495b669cc032f6d0a11a5e16eed9937b046c9dc1a61dcf9754b767df4735c3f8c37b4d5cd15a99c5a19cc62c921ad4e90d6e3695e85000000a53600d5031b5735acafb556e22279975f958ad437c76573e544506e58455772eb11493af933099a5dc7e9e0c8b907e68e23e59d7b94bc774309e2047132758b60955301f277a9032b0bc47e660b243e9e2126733f13ab99055a0999068ada35a38d105a5efe6c7115774effe28695ecae3944413b7764eefde26ed571d857b2cb2dd1b2a4a84c1fec0799cf90f57f7a6d35e2b60cd425b9372ae4a27f453e5d7da2eacd3b98cdb10cec9152d5829c2511eb0f9600a0cd280f3d08849b6cd43d25e3dcd62f7c7dee6123a2682daf4aa9a856b31e9204c5c2b80b84dbeec05d93a64a550f1ebc326488cd620c6fe1aa266a0ce5b24be03b5037786e037cc85ed61f362e081fb694e12e54fcb9eb0f86d6d91fd159023a073278f84d6ada8f9aa25ec223d268f3291b25392c941740932bd1a82f40a8fc586db23d2f6240ce883e3c1dc1e0d07fc3aa73a9ac82a1538d129c9e66cb6a8100abe95bc4064581e8c01ce65ba3ea751db5d8c0a1173fe62b2fd2d415042a97ade4d274a466b6d997eed6bf5d7a305ead804c36b9e1c314b26676ed83412417610d3cf4d07e5b24cf3de9c790ae93850e0f8bba047b710cf340c78a80cef5f6665a647681ff5f7b6ecce8ab65e26406b6a6e0e72ff8501c545bffc00f034dc3a5b251390ae68bb61d936dc9a24e6f66c72e7911c51c716dfd4304566fb32e6c2745d232f990d0bbe0ddf9dc58398dda292c07b16da766a37c60bd9993b4f21e641036a8afa2ccdb47d7990d5a007faccb2f86664179f2e229723bce870aec3f7f4e529c92add713590ce6c0ea1a0499fb76d32636cfd18b6b39fb48f1a6d46f6ae8f45c47ee8260f9531070d170ab92739be0bdf5b76f8a9b93a5e550dfecab79d2e46085a67024b6be883c79ade2873458fda5a7f4eb62b05634356ee3b45723f4cff19c654ad441ff5b8792df7f18d841c351e195151b1b3532e742a6525c86efdb29653f35ce8e0a41c8c6d39f39531e13aeb1172893eeedd83b6afb939f8e6abc5482696aa48918"], 0x590}}], 0x1, 0x8008801) 2m25.567909204s ago: executing program 3 (id=1030): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x0, 0xa0, &(0x7f0000000240)={0xa1, 0x0, 0x8, 0x8042}, 0x8, 0x3, 0x0, 0x0, 0x2000, 0x9, 0x0}) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000004c0), 0x8001) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc058534f, &(0x7f0000000500)={{0xf}, 0x1, 0x0, 0xcc, {0x8, 0x80}, 0xe, 0x6}) r4 = socket$unix(0x1, 0x1, 0x0) bind$unix(r4, &(0x7f00000000c0)=@abs={0x1}, 0x6e) listen(r4, 0xfffffffd) shutdown(r4, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) connect$unix(r4, &(0x7f00000008c0)=@abs={0x1}, 0x6e) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000009c0)={@ifindex, 0xffffffffffffffff, 0xb, 0x24}, 0x20) ioctl$DRM_IOCTL_MODE_GETPLANE(r6, 0xc02064b6, &(0x7f00000001c0)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r6, 0xc02064b9, &(0x7f0000000580)={&(0x7f0000000280)=[0x0, 0x0], &(0x7f0000000300), 0x2, r8}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000380)={0x201, 0x1, &(0x7f00000000c0)=[r5], &(0x7f0000000040)=[0x2], &(0x7f0000000240)=[r9, r10], &(0x7f0000000340)}) r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r11, 0xffffffffffffffff, 0x0) 2m10.43245172s ago: executing program 32 (id=1030): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x0, 0xa0, &(0x7f0000000240)={0xa1, 0x0, 0x8, 0x8042}, 0x8, 0x3, 0x0, 0x0, 0x2000, 0x9, 0x0}) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000004c0), 0x8001) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc058534f, &(0x7f0000000500)={{0xf}, 0x1, 0x0, 0xcc, {0x8, 0x80}, 0xe, 0x6}) r4 = socket$unix(0x1, 0x1, 0x0) bind$unix(r4, &(0x7f00000000c0)=@abs={0x1}, 0x6e) listen(r4, 0xfffffffd) shutdown(r4, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) connect$unix(r4, &(0x7f00000008c0)=@abs={0x1}, 0x6e) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000009c0)={@ifindex, 0xffffffffffffffff, 0xb, 0x24}, 0x20) ioctl$DRM_IOCTL_MODE_GETPLANE(r6, 0xc02064b6, &(0x7f00000001c0)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r6, 0xc02064b9, &(0x7f0000000580)={&(0x7f0000000280)=[0x0, 0x0], &(0x7f0000000300), 0x2, r8}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000380)={0x201, 0x1, &(0x7f00000000c0)=[r5], &(0x7f0000000040)=[0x2], &(0x7f0000000240)=[r9, r10], &(0x7f0000000340)}) r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r11, 0xffffffffffffffff, 0x0) 9.80071295s ago: executing program 5 (id=1506): socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000040)='gid_map\x00') openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x400, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000100)={0x15, 0xffffffffffffffda, 0x0, {0x3}}, 0x18) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01090000000000000f478e"]) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0x2, 0x4002004c4, 0xffe, 0x0, 0x0, 0x0, 0x900f, 0x0, 0xd57b, 0x0, 0x7], 0xeeee8000, 0x2113c0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) keyctl$search(0xa, 0x0, 0x0, 0x0, 0xfffffffffffffff9) socket$inet(0x2, 0x2, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a00010000000000fbdbdf250a808000000000000000000008"], 0x24}}, 0x0) r6 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) write$UHID_CREATE(r6, &(0x7f0000000080)={0x0, {'syz1\x00', 'syz0\x00', 'syz0\x00', &(0x7f0000000040)=""/15, 0xf, 0xa0, 0x6, 0x3, 0x5, 0x1635}}, 0x120) 9.752271331s ago: executing program 1 (id=1507): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={0x0, 0x0, 0x1a, 0x0, 0x1}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='uid_map\x00') r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0xffff030c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r6, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xc, 0x0, 0x3}, 0x0) fsopen(&(0x7f0000000380)='pipefs\x00', 0x0) ioctl$DRM_IOCTL_SET_VERSION(r2, 0xc0106407, &(0x7f0000000140)={0x9, 0xad, 0x8, 0x7}) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r7, 0x8946, 0x0) bind$rds(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x180000f, 0x13, r4, 0x1000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c00000004060101000000000000000013000000050001"], 0x1c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a32000000002c0003800800014000000000180003801400010076657468315f00005f626f6e64000000080002400000000064000000160a0101000b"], 0x104}, 0x1, 0x0, 0x0, 0x11}, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) 9.351477894s ago: executing program 1 (id=1510): r0 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x8, 0x0, &(0x7f00000023c0)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 9.178699727s ago: executing program 1 (id=1512): r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) socket$alg(0x26, 0x5, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$video(&(0x7f0000000440), 0xe0, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) syz_open_dev$tty20(0xc, 0x4, 0x0) syz_io_uring_setup(0x10d, &(0x7f0000000200)={0x0, 0x9e74, 0x0, 0x4}, &(0x7f0000000340), &(0x7f0000000280)) syz_open_dev$vim2m(&(0x7f0000000040), 0x1, 0x2) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x12, r3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000340)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000780)="aa1d484e243103000000f7c08bfcd111fbdf23ea32db0e8f21d5bc27bd8063067a0689fff2a41cfbf0e9d85e447511703d", 0x31}], 0x2) 9.100985193s ago: executing program 1 (id=1513): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x5, 0x0) ioctl$VIDIOC_TRY_DECODER_CMD(r0, 0xc038563b, &(0x7f0000000080)={0x0, 0x1, @start={0x80}}) syz_emit_ethernet(0x4e, &(0x7f00000002c0)={@local, @broadcast, @void, {@ipv4={0x800, @tipc={{0x5, 0x4, 0x0, 0x3c, 0x40, 0x67, 0x0, 0x3, 0x6, 0x0, @rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x1, 0x0}}, @payload_mcast={{{{{{0x2c, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x2, 0x5, 0x0, 0x1, 0x1, 0x0, 0x1, 0x800, 0x1, 0x1, 0x4e21, 0x4e23}, 0x1}, 0x1}, 0x1}}}}}}}, 0x0) r1 = socket$inet6(0xa, 0x3, 0xff) sendmmsg(r1, &(0x7f0000008440)=[{{&(0x7f0000000000)=@un=@file={0x0, './file0\x00'}, 0x80, 0x0}}], 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000000)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x29, 0x0, "c1691cd5c149c83ef9c0562f0137d8050c417fb95aa9cbac0f0bb111869f875966ac6e308212ae93ff8344b02d56c6cdeb2bbb06ee4a2c95c8e8cc407d732993201e901495b453ab6411b5bc551b3679"}, 0xd8) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000880)={0x48, 0x14, 0x1, 0x0, 0x0, {0x2, 0x88}, [@INET_DIAG_REQ_BYTECODE={0x31, 0x1, "2348e26ff5ed7a6f13e2f0ba71e4eefe4f0dc16485869ebc476d7b477af40d9fec9269267f239cff01157f591f"}]}, 0x48}}, 0x4000) syz_extract_tcp_res$synack(&(0x7f0000000100), 0x1, 0x0) 8.669096022s ago: executing program 1 (id=1515): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) (async) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a70000000060a010400000000000000000200000044000480400001800e000100627974656f726465720000002c000280080001400000000108000240000000000800044000000002080003400000000008000540000000af0900010073797a30000000000900020073797a3200000000140000001100010000000004000000000000000a83802872fe595ed37176cbf432a19b895ec7c7c0505a93d5086dc39dd462d0913b5a0773a8dd0e5653b0"], 0x98}}, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x8, 0x0, 0x3}, 0x0) r3 = socket(0x1d, 0x2, 0x6) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) getsockopt$SO_COOKIE(r3, 0x1, 0x39, &(0x7f0000000140), &(0x7f0000000300)=0x8) sendmmsg$sock(r3, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="1f", 0x206c}], 0x1}}], 0x206c, 0x0) sendmsg$can_j1939(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)="f4e78d4837b4c64b7bce30d85066e820619c9624346344714b2b454ea8f4eef1584fbfa34491c5c24c7b75198d6f0f7b69933483ee784106987e85d5f2a77f21d1c0cb9eb183e1a76d856e5ebd44bf761e52cefa49f6232ab391b4625ed815a87d9eed921d95eaf0cfb3eb3a921c34394f5fe05b9effc5", 0x77}, 0x1, 0x0, 0x0, 0x20048000}, 0x810) (async) r4 = socket(0x400000000010, 0x3, 0x0) (async) r5 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) (async) poll(&(0x7f0000000200), 0x51, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@private0, 0x8000000, 0x0, 0xff, 0x1}, 0x20) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000000)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x2, 0x9}, 0x20) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000180)={@private2, 0x8, 0x0, 0x1, 0xa, 0x7f, 0x7}, 0x20) (async) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000200)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0xf0f041, 0x0, '\x00', @value=0x100}}) (async) r6 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x3c1, 0x3, 0x380, 0x0, 0x12, 0x60a, 0x1c0, 0x202, 0x2b0, 0x2e8, 0x2e8, 0x2b0, 0x2c0, 0x4, 0x0, {[{{@ipv6={@private0, @ipv4={'\x00', '\xff\xff', @multicast2}, [], [], 'veth1_to_bond\x00', 'geneve1\x00'}, 0x0, 0x190, 0x1c0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "000000000000000617ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e6726401fe4b124e0f7323a587d2a1fcf07000000eca0a7b66c60c527bac2b5", 0x2, 0x3}}, @common=@inet=@socket2={{0x28}, 0x2}]}, @common=@unspec=@CONNMARK={0x30}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0xfffffffffffffecd) (async) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b7020000b96871dfbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a9a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c048d46362ea0d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337dbcf3456ff6cd0d6b98a258e3509a7d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f009db49c6b8b19613e4d792cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19, 0x0, 0xffffffffffffffff, 0x54}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r7, 0x0, 0x7, 0x0, &(0x7f0000000280)="61df718305a359", 0x0, 0xe697, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 8.53979738s ago: executing program 5 (id=1516): r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f0000000140)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) r3 = socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket(0x40000000015, 0x5, 0x0) bind$inet(r4, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r4, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) ioctl$SIOCGETMIFCNT_IN6(r4, 0x89e0, 0x0) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000240)=@multiplanar_overlay={0x1, 0x2, 0x4, 0x400, 0xc8f, {0x0, 0xea60}, {0x5, 0xd, 0x6, 0x8, 0x9, 0x4d}, 0x1000, 0x3, {0x0}, 0x6, 0x0, r5}) syz_pidfd_open(0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) r6 = getpid() r7 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0) syz_usb_control_io$cdc_ecm(r7, 0x0, 0x0) r8 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x402) writev(r8, &(0x7f0000004280)=[{&(0x7f00000000c0)="2898a4", 0x3}], 0x1) syz_pidfd_open(r6, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x48100) openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) 7.004601523s ago: executing program 0 (id=1518): openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x815, 0x81, 0xffffffff}) socket$netlink(0x10, 0x3, 0xf) r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x30, 0xffffffffffffffff, 0x0) bind$tipc(r0, &(0x7f00000000c0)=@name={0x1e, 0x2, 0x2, {{0x2, 0x2}, 0x3}}, 0x10) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x6, 0x0, 0x5, 0x9, 0x9, 0x0, 0x3}, 0x0) r3 = syz_open_dev$media(&(0x7f0000000000), 0x4, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r3, 0xc0487c04, &(0x7f0000001e80)={0x0, 0x3, 0x0, &(0x7f0000001b80)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000000140)=0xfffffdfb) unshare(0x18010f00) socket$inet6(0xa, 0x80001, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/mcfilter6\x00') r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000400)=""/72, 0x48}], 0x1, 0x1, 0xfffffffc) syz_open_dev$usbfs(0x0, 0x76, 0x101301) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) 5.951852221s ago: executing program 2 (id=1519): r0 = socket(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22042, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_to_batadv\x00', 0x0}) sendmsg$xdp(r0, &(0x7f0000000300)={&(0x7f00000000c0)={0x2c, 0x12, r1, 0xd}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000240)="af27a76262b3ede9052136e7f0df0181b6e7388b17d081bd837bd0a8e65a4094954c39a88c0353211182c00cfe55a7c4ad61c1338edb64ff10fb381c93587bde519b7f1ba0c495707a26e7d3ff8e7450d55f92d57803d9ca2e58114e8202e88ef507d2b68ed9fcae3325062c02f15524d0e776ae", 0x74}], 0x1, 0x0, 0x0, 0x800}, 0x20008000) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x1000, 0x0) ioctl$KVM_CHECK_EXTENSION(r4, 0xae03, 0xd7) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r5 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000140)=0x2000) mmap$dsp(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x100000f, 0x11, r5, 0x0) r6 = landlock_create_ruleset(&(0x7f0000000340)={0x7e64, 0x3, 0x2}, 0x18, 0x0) landlock_restrict_self(r6, 0x0) r7 = mq_open(&(0x7f0000000180)=' \x01\x9c\x147\xb3\xcf\xfc\xc3\xa2W)\xebs\x93\xa7\xc7!Q\x8f\xf6\xec\xa5fs\xf5l{T\x87r\xd2)r\xa7\xd6\bO\x9a\x98\xf52:\"\xf4\x12\xc0T+\xcd\x9fv|\x8d\xd5\xb2Dvc\x8e\x93\xd8\xd6\xa0\xc56\xd2x\xe3c:\x00\x00\x00\x00\x00\x00\x00\x00\x97\x97\x9c \xdc\xaavt\x18\xcen\xe4\x03\x84;7\xfb\x84r\xf4\xe7\xc9\b\x987\xaa\x85\xfb\x05%\xa8\xe5b\x81\x8e}\xe1r\xf7s2\x82\xe57&b', 0x41, 0x80, 0x0) mmap(&(0x7f000074f000/0x1000)=nil, 0x1000, 0xb635773f04ebbeee, 0x11, r7, 0x15b77000) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000200)=0x6) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f00000001c0)=0x9) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x25c25000) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) 5.49898515s ago: executing program 1 (id=1520): close(0xffffffffffffffff) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty, 0x4000006}, 0x1c) listen(r0, 0x6) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x200, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) futex(0xffffffffffffffff, 0xd, 0x2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={0x0}, 0x18) mlock(&(0x7f0000ffa000/0x4000)=nil, 0x4000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_open_dev$usbfs(&(0x7f0000000100), 0x775, 0x8000) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x44, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x4}]}, 0x44}}, 0x4010) r4 = dup(r2) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) ioctl$USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000240)=@urb_type_control={0x2, {0x8}, 0x0, 0x44, &(0x7f00000001c0)={0x107fa479aa130881, 0x11, 0x4, 0xa6b, 0x6}, 0x8, 0x5, 0x6, 0x0, 0x6, 0x7, &(0x7f0000000200)="3898a8802684597248757934155c0bda0fd7"}) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r6, r5, &(0x7f0000002080)=0x3a, 0x23b) r7 = accept(0xffffffffffffffff, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[], 0xfffffdef}}, 0x800) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x181603, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r8, 0x40085112, &(0x7f0000000140)=@e={0xff, 0xa, 0xa, 0x2, @SEQ_CONTROLLER=0xfe, 0x8, 0x7, 0x4}) recvfrom(r1, &(0x7f0000000180)=""/60, 0x3c, 0x100, 0x0, 0x0) 5.03775212s ago: executing program 4 (id=1521): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c00000010004b0400000000000000007a000000", @ANYRES32=r2, @ANYBLOB="ffa10000000000000a000100aaaa"], 0x2c}}, 0x0) 4.999896986s ago: executing program 0 (id=1522): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9, 0x1009, 0x10000007}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9, 0x1009, 0x10000007}) fsopen(&(0x7f0000000280)='cifs\x00', 0x0) (async) r2 = fsopen(&(0x7f0000000280)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000200)='source', &(0x7f0000000000)='\\\\\xe9\x838\x9d<\f\x91\a\xd4$\xae\x01\x91&6n \xf2<\xd6\xcf\x15\xd3\xd7\x1d\xa7=\xef\xca\n@\x06\xa3\xfe%\x11\xc9\xc5\xc4\x96\xb7b\xa0\xbbL}\xcc\'(;\xdc\x8b\x18rBl{\x82\\\xbeA\x17\n\f\xcd=\'\x11\x1b\b>Z\x8e\xb1\xc3j$v\xef,\x06\x00\x00\x00\x00\x00\x00\xc7\x0f\xaa\x01\x00\x00\x00;\xd5\xcd4g+\xbd\xd1\xe0R\x9d\x18\x19a:\xa2\xdf\xbe\x8b\x89\x81\x00\x00', 0x0) (async) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000200)='source', &(0x7f0000000000)='\\\\\xe9\x838\x9d<\f\x91\a\xd4$\xae\x01\x91&6n \xf2<\xd6\xcf\x15\xd3\xd7\x1d\xa7=\xef\xca\n@\x06\xa3\xfe%\x11\xc9\xc5\xc4\x96\xb7b\xa0\xbbL}\xcc\'(;\xdc\x8b\x18rBl{\x82\\\xbeA\x17\n\f\xcd=\'\x11\x1b\b>Z\x8e\xb1\xc3j$v\xef,\x06\x00\x00\x00\x00\x00\x00\xc7\x0f\xaa\x01\x00\x00\x00;\xd5\xcd4g+\xbd\xd1\xe0R\x9d\x18\x19a:\xa2\xdf\xbe\x8b\x89\x81\x00\x00', 0x0) r3 = socket(0x1e, 0x80000, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@gettaction={0x28, 0x5a, 0x1, 0x470bd2c, 0x0, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x6}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}]}, 0x28}}, 0xd4) ioctl$DRM_IOCTL_AUTH_MAGIC(r1, 0x40046411, &(0x7f00000000c0)=0xa09b) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) utimensat(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x0, 0x100) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x1, 0x6576, 0x9}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x1, 0x6576, 0x9, 0x0, 0x0}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40000000, 0x0, &(0x7f0000006680)) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r5, 0x0, 0x0) (async) r6 = accept(r5, 0x0, 0x0) sendmmsg$alg(r6, &(0x7f0000000740)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000001c0)="564004c6852da7a299e4c397614090d1a6e12edf1767f157", 0xfcdc}], 0x1, &(0x7f0000000480)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r6, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b4c0)=""/5, 0x5}], 0x1}, 0x0) syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0x5865, 0x10, 0x2, 0x24d}, &(0x7f00000006c0), &(0x7f00000001c0)) (async) r7 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0x5865, 0x10, 0x2, 0x24d}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f00000002c0)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) (async) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r7, 0x100847c0, 0x0, 0x1, 0x0, 0x0) (async) io_uring_enter(r7, 0x100847c0, 0x0, 0x1, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0xfffffffffffffffe) (async) prctl$PR_SET_IO_FLUSHER(0x43, 0xfffffffffffffffe) brk(0x689d80000000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x10) umount2(0x0, 0x1) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000180)={r4}) 4.332095562s ago: executing program 0 (id=1523): r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) socket$alg(0x26, 0x5, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$video(&(0x7f0000000440), 0xe0, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) syz_open_dev$tty20(0xc, 0x4, 0x0) syz_io_uring_setup(0x10d, &(0x7f0000000200)={0x0, 0x9e74, 0x0, 0x4}, &(0x7f0000000340), &(0x7f0000000280)) syz_open_dev$vim2m(&(0x7f0000000040), 0x1, 0x2) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x12, r3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000340)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000780)="aa1d484e243103000000f7c08bfcd111fbdf23ea32db0e8f21d5bc27bd8063067a0689fff2a41cfbf0e9d85e447511703d", 0x31}], 0x2) 4.222174582s ago: executing program 4 (id=1524): sched_setattr(0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000014935d1071040c03e9ba010203010902120001000000000904"], 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYRES8=r0], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\"\n', @ANYRESDEC=0x0], 0x0}, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {&(0x7f00000001c0)="66f7", 0x2}, {&(0x7f0000000300)='l3', 0x2}], 0x3, 0x0, 0x0, 0x4002800}], 0x1, 0x800) 3.976571304s ago: executing program 0 (id=1525): sched_setattr(0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {&(0x7f00000001c0)="66f7", 0x3}, {&(0x7f0000000300)='l3', 0x7fffef80}], 0x3}], 0x1, 0x0) 3.920171912s ago: executing program 5 (id=1526): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = open(&(0x7f0000000280)='.\x00', 0x40000, 0x43) getdents(r1, &(0x7f0000000140)=""/48, 0x30) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000001a40)=[@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x12}}, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x3d}}], 0x20) sendto$inet(r0, &(0x7f0000000300)="fa", 0x1, 0x44054, &(0x7f0000000100)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x14}}, 0x10) 3.745610666s ago: executing program 5 (id=1527): r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0x88, 0x0, &(0x7f00000004c0)=[@enter_looper, @dead_binder_done, @dead_binder_done, @free_buffer, @acquire_done, @transaction_sg={0x40486311, {0x0, 0xfffc, 0x0, 0x0, 0x30, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000400)={@ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/215, 0xd7, 0x0, 0x1e}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x2c}, @fd}, &(0x7f0000000140)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 3.399935284s ago: executing program 2 (id=1528): socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x4, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000005000000850000182e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(0xffffffffffffffff, 0xfffffffc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x2000000) 3.315152249s ago: executing program 5 (id=1529): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty, 0x4000006}, 0x1c) listen(r1, 0x6) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$SIOCGSTAMP(r1, 0x8906, 0x0) r3 = socket(0x10, 0x3, 0x0) setsockopt$sock_int(r3, 0x1, 0x35, &(0x7f0000000500)=0x5, 0x4) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x10}, 0x4014) recvfrom(r2, &(0x7f0000000180)=""/60, 0x3c, 0x100, 0x0, 0x0) 2.902414311s ago: executing program 0 (id=1530): ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000002f40)=""/4098, 0x1002) openat$fb0(0xffffffffffffff9c, 0x0, 0x2100c0, 0x0) r2 = getpid() r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000680), r3) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000000)={0x0, 0xa7, &(0x7f0000000640)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="170900000000e4ffffff0100000008000a0004000000080019088affffff060002000100000008001800e000000205000700000000000800090002000000e2cff80d0444eccc12407a77dcf55a1f282b460260be8b1294de9bc1272930102a7600ca6e26a446e43a99372111e250"], 0x44}}, 0x4000) fcntl$lock(r3, 0x25, &(0x7f0000000040)={0x1, 0x3, 0xee3, 0x7}) ioctl$TCSETAW(0xffffffffffffffff, 0x5407, &(0x7f0000000100)={0xa, 0x7, 0x3, 0x6, 0x1b}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0xc000) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000140)={0x56, 0xe, 0x0, {0x8, 0x8}, {0x5, 0xa5}, @ramp={0x4130, 0x7ff, {0x9cc, 0x2, 0x3, 0x8}}}) prlimit64(r2, 0x0, &(0x7f0000000000), 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f00000006c0)={0x1644, 0x4, 0x4, 0x501, 0x70bd2c, 0x25dfdbfc, {0x5, 0x0, 0x5}, [@nested={0xf6, 0x94, 0x0, 0x1, [@nested={0x4, 0xa6}, @nested={0x4, 0x14d}, @generic="9fcfa0a61426a79d656079374289970b96d4831be82c93af00990aca99fb9913df8fd2c9753130b92836c0e0f1785677a76fbac844bc6420e54b080cf3ed47b01e0d8a32bddbeb7f94740cfa4fdfd3020bff7e460837d678f11abdf99fd3c226585678588f8f7ca243825f4f8d59100966d2887fb13a8b381bd32643d79d9a63ed1341334036a4585306649add1e9e3ce9406b363d965219a8ac97ded3704adadf82164a08c7f84e667b8e419125570986f53ee9273128bf9abda5701be2e0b36c086afcf91dd9ec500a83313e131cc567bf351c18847e2c71eb50fb0d19975b2936a02dae2a836f9a64"]}, @nested={0x117, 0x11, 0x0, 0x1, [@nested={0x4, 0xd3}, @nested={0x4, 0x97}, @typed={0x29, 0x37, 0x0, 0x0, @binary="7335d104befe2d1fd3e3a7ab04b7b475c3736cc0c46e6c78a68e3055022e443ea6010ff0b0"}, @generic="66313579e9b294863653d356aa014cb47c77289658d4bb879129860723a70cf250feb7aa2fc820cd2c937992d049ccedb22ebc377afe7a0cceffdde931b1ce2e5ef77ff9c41a5c522ca43e0a2f474b254c6775b91ca85c8512d312af9f19707a20071002df83ddd81857d1716a79c738cbaaf5c7f1db0e851c420b04165b1aff2d840251a57e5a2ee5503b70c454c0ac7d2d829cc74eebaba7cb865b76a736edf2be0639ee152bea77027867d87fe75f876122847167187972f4a8f7c52982d26321e0b00f38ae87d53a0bdc5967281616ece40764dd7c6fd3873f", @nested={0x4, 0xf5}]}, @generic="da6be8c8356db16eca32bca150f4314a99a8ae738f6ae23550cc122c08e5f0b263b0fd882f4937bc503abd52889f8d78404049d0ec5a919ed034be3435bed4b31e12b97b8f0d382a4a5a30622b97c58e12a5afd99eb62860edf1a2343bedbf773360d92189f6a3b3e31aa965655f1f9185ba4e54d55809426039b11c687f62b2e5b2ab19eec1283fe77ad09e9ad1b72b9398c2cf3f915b39726a355d6ed4aa9c1c0e7d2da27edfbe8e89c0518172bdeed5d3b16702dfbd6327f51a554f4585e9249860e7a2232f55595296c2c2c94a72c342b701fda98f281bd2d7e3a6ba041a00004c1fc1bb8b530870a9f654f8f11deb90c67093120f09be", @generic="00a1119b5c4890ee613c3f2d76cac2997477f3be9036941e69631bdbf239cd2020d89e98cf6b91e703bf6e357007ea402f664f615a2d4a1168c98eb72db425719eb2ebef2db0c858d7160bd7c4446a9039f4bd02d2f2f5602693c5ec9f0dcd9d22ef053107b934e02ea1e56d9e93f2b225eb3e7bd4b263b488bb2c1c9d96ae309cb832763b860702d14c80a09b35f438ae920669d68dbe9e69ec78d36faf9b9dca2d4a4afbdd65b0826e4d93b370e5412b6eb193cecedcab8c9afed883a8e6137d25b0c71d1c1ed6b46955777fd0529f68235734893e08da07aa333234dc306eda1a9abcdd3c0a", @generic="9f571af6e15dffe9c609305b1a4b4d46bdddf886cbd8dca53362e13f5072eec095acd00cde5f8fcb276d12037e7de12042781c8cf5ad1076f05b960f1df4a6ca85a04d595146931581955ef9ed644b259f1f45a9b672166a712cbbc255602754ae951b0b30954525f26f185cdce87f810faa287167e576deed976dbaba2bced8028f1f5baf1e92543a9fd9b62dc34a10d73539b1bffa97169ea12bd13b93fdc0777c565ae837d02a3173b68557f35d62eb51d45a6a2af78345257c8f094eaca217c32d9f12c63590bc5defabb60367aacf3a8456a5202febe5e5f3a7f066a1304de2f22c0e4b729db736826c71f42fbeabb6b030ecbb1fcad63de73557f79c30e91bad047bcb4092462e549f0c4a8128e112c24f544f31a985e317ae89bdc92c054b66b8d84c4a9993083592a75252ab24bda2eb622ea414b44c0672ea21a111769bcbb34eb8765ae9b39e4d111b9e35f3a072253df801972f8196aa19af1fd678a890ee9f0a6a08875cbd8133e873375e6c89cff2303756c14eb7a94b3e24beaf8574ea0bdb5c699c7ecd01d9248eeab4f5c9ec7ccff630ec0a0a6b9d3083b946473d24f2ee60e677f8ce75e3a35c8c77a5317ccc86e9bc195e237fde2f0a6939af953eeaa31eb585181772f030e2718eb7d0fb3c34b63bc1c416248be4a54c176dcd7608ca0c6d66ba98575b7821cd4ceb78a15daa04a514f2bc896f4241b05e47eba4699b4d2634accaa6d3c1e4150358cb48a245f98bdc410bba508fb9cebc9582a79180bde33c54b2f45a1557c70588f44ccc5672fb61b12554695cbba722a38df48bca51fc483e8a0e4df2cbd544aa78fc2229d31017c6f0a93ddec33d8d0d9754823ce2c7a05fddb1f566f5ddb4712f5bc77baf9d6a689c0df321a909e32f79682f81fb5ec4d45136272c5f6736cb126a981b524cc5328eeaf67fef148a014f1a320fe478c64b03f8cfe85622d98bf1f3960859d11333bb24d60af80b2292b0611211acdb2b32ba00675db019136121fd2460810c4cf2d3d29dbf08e401ae138019ce88f1da9b7a43e8d6f57c82511e8c70a0e1aa0f928bd4ea5938994aa34661d92ed43518cb77147dcda42c0133a155cf611e934bb03bd3f47f63fbd831f8dd0fd7d5b5e8ccedc1beb739880840ec28c8c06ba3c930fba25afc45a5aaf8b503983ff32931e31d9648981a675ed2d47aafab9527393073e206ea22b4f0f1aff3c762bb193e6c66fdf4be07a4504f5deba3b4e568abb70e666ebf93fb291a2a07a7121543a69ffa446046cccdc7851adb96d495b0aaca473c57c83ed503027e60230e763b0064809f0694b5e3b5fd268c1334a613f95cf61ca8efbfcfcb697a90fd0110e02ed0b4ee0c4a415677ab62a39249686e2ae3db053f8c1b5f9f884c2cd981ca1e8b1af4acf72ca9bcd9ca9a8f4f10ff75fbe50718746b903bc4bf75107bd08658a3de086e7747e6b03f7c2012e8c2eaee933c4a55438736dedc97728bf9ed16a3ab63222c04d6f1f2b2a92c3511c513977afef079a6630351f6d5b6f5f2d42ed25d6187571b7bca9290229a13ad9ce4081bee6d8dd98a4878ae49773e16fdd2c9d404d646a4eaff260dbb3a5239c0ed975b4a26b68cad8dc33ad2f7ee6b619822bc5dac687cc68799831d67f65d190d76f4ccf463a01cedef70547aa6a6e8d0deee35d9952e239e82807bfea089f61f8e01f00dbe7ec9d243f14c51a9c8f5fc4773d70deb839ecc7340fac4410cad9e7a48cbdea80fb5542585f11492248da82d427c1902329ef3522bb1f3e4482bce8f501905ea2ce64134be28e5cd9f3389c6c1ffded700cb8e69c6b5b20c19d4a29a8c5e02de796f520842f0dd3324959e16204d3db2b3f3a14a40fe9497ec7bf963967e35c0eb0cbbf2a0c52946039ab7ed33f442d8509be086a215622795d47e3d64e93671b053151536d784734182d1fdd39302ea5a7db74aac509f469f34901e7a10d7cac607e5d7570598492a0f76d563490be46dc536950326fbbfafd7056152b7ff0765c16c31913820ff3551433f5a12633dfbba844cc145cf29513b10090e6218df7f51d88f732f6fc503450f5efa67ed017d856d22934e38f55eae5da7ff813d7cab1799f58e6a026c5421f0451a430f3eeedc821bab9fccab66b93e53f789b871cb7073f654a91216f3bf66cef4d1b90b7fe2caf631e4b4f90146478322b71b86c6c09a59d34046b00d2ab5d16a404d0f29bbc6cab4a4936f7c8d03c8f9fc537c3fce5340d38c2b6d18b699847d8a2b2ded95c895bd3b5578570310b2d33a0cb643e0d7a5451826def81b2c211c6c58adb89604549157e96c362c70643a1ee94672905c93e11edb9834b6d83c819d3cdca1b7fa9880843aaa0f3da7f0d453c2b24870172d6bba1bee93ddaa63c3d90e1b822f54fd542b4bce9b1a5a5f2dc79f3cc7443333963984e5262304e40de4a8bcca7e77e54aad81a986f0dc6ba9201d79af0a48a7f58a3da457f6d01905abeab94333b01c13f5605f866298e5110fa6b05bdccbf3702546739336982d89d11fe79469f2f372524a9c0d134d68bf018f37d45125bb43838e7deefd8dba5a30a39f249233da539882535eaba5fe9c48e85dc57de14bbbc836b7fd25ba464513fe861a32207ef1c6717498e646ea9e837557132ec987bda308f5ace0c9d2b1b1110d81d14a9d5bf8243fb39bb6b9801e4bd21d0a9f46446e8a0e01d44291b277d09c3a13db9c9275b5c8132e196ebab75e28e85caa9a5ea9cb3e45c62bdae5162c124e28f7ba43cee2b0c2121b0e4cf94bbf6f98448ad4d89e8d506d172df230b2faba7e8ee0833580241ab7417ff4e5af6fc4af56ceeae3f7acb8fcc640b4b4048a3fe69f4bcef04aec7c5c5823d105b24f7bb064415534f596b1c9a1f2f7744ca26bdf288d393f4f97aea340a78fa1b19e386cf86623e2184de11d7248d0ad030cbc4274b8097c78ec2b4ca58c3c97ad4eb6be88c1455504d6754ff1bf41ac87d63a47988ceb88739d713c78b2d0fd84caf68e29752804dd6534ffb53abb578ff43add25fb6b729c093bf464ec89cd38d8cd1c2a1ddea1a9316a686c20f9cd2e748de3d553ebd7de079b059d3c8d06f4106b8d54ae29bde3ce7eacb397f9e6e44bbdb1f168d5b42222415579fe15f2cd6ff325cd3cd269acdaccef34387ba5a7035573ecd5e2be44d4b9c1d2524bdc76258b161270fe5fcdb4daf2f3c31c30c25026be48d653258d07e960ed9a9377674dfb57140a06e9dedeca26bf1cfce020357fcfadb96da10290b00b29cfba97b113e79e12bec7bd2575bbb3884e8c385d7b1daf524313a58b9f3ebe881b68ed27b31604ea6a434721cfe3fb66aa372751f18267db9bb7a6b58b380d3403cee85ce2b2053b09b131fb07d40a690184efe41933e9819cc773a0ea798268743c4a8f64466099687efaf08b07c8aebe1d2c6c5c6b01f67eb560f507dd0f660969e22af3f26e2f901c228fdc2c564be24f8b8c0e428b0c46749a317cb5c496511b6e3ef87a8738af0bdda9ce030b272aaf27ff4e413dc32835f6a95f7582a8b456c677c50ef4b930446ccc46a9fc5284ca1c79b03866b2a4e5b427e1e2f461ae7a7a59aaadd158a6801e63d3cd143ad2b1c08ab575f21157d9e899a0f0e6350c16489f8fcdc45a82910c2e53fec8391b006d916b92757f96f348e13f2dfd327c343ba7222b737e3d270b51449b04fe3dd06d78669ab650b85a8d339d2c3b1e37afea77cca1e6a830d0ac3c6755d9002b781b8ac8c2db93744900c9a9ab15b1f9a3358e1d852c4fa57ee0c08107ebca382240574ba7bb18a3e4f7e61bd8ac54eb55ca7b231bf3c33cd3ba376a56cecea7b5f1b8643b8bfa1a1990bf0019a5091ce0d355839c6c00354a5100657b6aff52a9aa6278d69f82a422a8e7e4c267f7b1f7e7ffcd6a6c5ba1cade2713c8e2a3a181853b04a9e348a4082373684b4738df8bbe2ce43e8c14db61c983a58d958c5a945fc5165b9e392e5aa241a528471250c57e2f7ddb432fe3c085c3658f241eb0b1be4cf502b99a3c40d6e1e714d01a84f876921c81a4e57df5c1fcbc3220c04eadf68ccee0734ad162b5123aa5899f92b437ba73beaec157a2396bfec4ec581b18cf1ff69c4ea016d1d23ded737ea9bac3292f7267d5995b326e76845d33643d3201b0abcdd870634a0a7fff3f9006322649f36e5091255bea05c7ca173e568c12a7bbfd8af68f7ae289456f778bd19d9012d46b6a7694ac4c1497930b82a78e0cc5ec896c1e08c8a8ea3c79e7e4df3b9c380ea9d86f08019e1233eeac712615de64446ace61ea1102bfe505222feb0d84ac782d73d87464c79700a0bf972a876b17cc6f704ad289769345386a24e7a7c9d358409e944e440c037144b05071c277c4cc70bb9e6c64da6ae539e838d8757728835aeabceadea90d1d8ae36655e5a17227cb823448cb321ca2dfb194cf3bc806a1399f3919cbefc588e04fdf5c50523eed3066cf069a403cda5ce4f9f96e64b75fedbaf7d1322200263bb5ac9aa9285494c1e8e66b8da314aea3828faf9878da23dc1f4b15976e9b4f1b043ecdd6a09eb08e24a04a80e91ea3f4063676067689735de4332660271ff09b4978b749b81bda9646feebddac15be43a9bc7c4ac39ae272b6bbc387a9696c4464b21c017cf483b564f113ecf9852e0c9b015d7cdf5988605e919ebecc3a2a3cd3f1d7a1fe3c11b3b86ef38df586981946c9b40a5bc19a69db71801ddb77f8c0a26a7690522c4b2edf203870ecf4e734aca80269aa769237dc17403643027dae1b8bd95afab32d2c3e3361f2021d7669d21c46e0a3ce5666589710a994b5c230753dee649b8e1dfdd8d967746e316bb127622f21ce81bcc87396b3c62003a16a8003aaaa2cb0ad61a75434110903e83a0bd0319220ba701665cd64604ea0d0e1c443dd5d8f05a8034f6a1d774c81d6f4a5a3d0820e5a126e3de5f8edb9541c67e05e528ed5968010ac854af832640c6419f2337a73e88d416ce05a1d4c23991b760df9ae4b7445af4a261e0d922968acd46be5424a7062d347894dfdf2c04f454af18d6f239b571356ee0c804712a9a1c7a58e67b3d2a87c2a4d1a3fa28d1aa39ced57c0cf474b0788e43a280817f0e0a482a613c860d5249ee822d78320e394a6d2bde0ceefe16099c72843f62907a0dd07985d0673e1a005b397288902be3500fca3b1f8703dc7b12b20863dd9ed2c555ce5b737f3cfbb91261d7477e0751c019924a7e69bf27866dffa8d31063d8aa2597821d3b00b971e9133dd1f268ecca160b5d2044886f34bae99967cf17f8175947ea663313e483d69350d3dd46225d401f422c0fb8a783d4380382994b00160d9cdb64635833a077db76cf958a0c210b39c5bce08a97527d76dfd31fbc71cab26a672886f5065fb60be8da9e2446ceaa24185e0fafe8674920a361b95b4557cc1f704f996f83c467d4e339f38adf21a7eef47828d69ef7a162ac75460d0c35f18371b5ab2ba01c24b6be391745b5593c18422074c163a15b1d51b5cb12c7e95034f9d3a564f40f23785f47d2065da91b4a8979a18269a0ef9408daf221b04ffb507fe7393d919383148fbfd359a9096cbed37e38322aedcc9960a685f1522c40302cf1e78d3cf8fa6163e8faeb459157cb372d500dd49ca7f8435fa958f60e8e84159a15baede8a5b572e4b3f21f5bf64f81a35802e1721a5dda43ea98589870423c3a47dc3fe0ff10aa03ccbfe31040a84fa66f4972a8f3b8fc070e193ab924246bc163e1e0e438b38bb", @generic="8b5f8883357731729fcf18d70b0e7fd7e910ba2450e0f3683b6c6c7fc38a37fd95b4ce50cd9a79a6a4c190768197ac9cc6e54df8622f0fcfd5cfd43377eaee7c47d159c6838fa0610528e059fe0cfa2030c07803ce9269205dc362aec7dcacf7776f237372399169a62ffeb8cd0626c22d80201b5b69439451e72938e21acac5b7f15675d746be9a62fd73595013ee163f123cdfb698b9a7c097fea11a2b4bf3bbf582e4d0beffd96d97b8ea0d67964f9260aedabae5b6a1e2fc62a70d38b8ca905d8b9a39c9de235f09aae29508396b7652a41c2f0d043cbf3d3f19", @nested={0x24, 0x93, 0x0, 0x1, [@typed={0x11, 0x6, 0x0, 0x0, @str='@:]-[]@-!@@)\x00'}, @nested={0x4, 0x84}, @nested={0x4, 0x97}, @typed={0x4, 0x142}]}, @typed={0xc, 0xd, 0x0, 0x0, @u64=0x3}, @nested={0x133, 0xe5, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @fd=r1}, @generic="ca5d9102733867286d0931ceb0237d315805b419dcac6f689de9d3320f6712f08d43ea8d25d02971cf8900c05cae6956ebc46f43a901965fe603aef3bd726c1afdcb58c989bf441f1e270e40cba51cad672ecd71e046094574d30c50b0db3def573054bdca45648a0dcca3f75b9051a6e0caa3ca02423fdc00b22fb31889d44a82b499d7898b257bca82326785d1f5480eea5bd26b1d3eef", @generic="bb573440f813437760951d4da1b6a7b37bbcc5150b6ef4ce1243b718f8656895cd9c55e6a964be65fa2db00fc8816210697b97898de173576c3d68f37cec8b994944e9b1396e506ee301efc03ebf0589e8c783e5f86f684f3d6ab0f1ac44806580d5743df27c83b73b77c5f652ddd732cd5d026f9123025b27b6428834c3e7b0d68f409affc905", @nested={0x4, 0x72}, @nested={0x4, 0x79}]}]}, 0x1644}, 0x1, 0x0, 0x0, 0x1f539967905282a2}, 0x1) 2.035293343s ago: executing program 4 (id=1531): memfd_create(&(0x7f0000000000)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9\xbe\\', 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, 0x0, &(0x7f0000000100)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040)='T', 0x1, 0x8910, 0x0, 0x0) socket$inet(0x2, 0x3, 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r3) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="1709000000000000000001000000050007000000000008000900fffffffe060002000000000008000a000100000008001800ac1414aa08001900e000000214001b0017"], 0x58}}, 0x0) 1.95217789s ago: executing program 5 (id=1532): openat$kvm(0x0, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x815, 0x81, 0xffffffff}) socket$netlink(0x10, 0x3, 0xf) r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x30, 0xffffffffffffffff, 0x0) bind$tipc(r0, &(0x7f00000000c0)=@name={0x1e, 0x2, 0x2, {{0x2, 0x2}, 0x3}}, 0x10) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x6, 0x0, 0x5, 0x9, 0x9, 0x0, 0x3}, 0x0) r3 = syz_open_dev$media(&(0x7f0000000000), 0x4, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r3, 0xc0487c04, &(0x7f0000001e80)={0x0, 0x3, 0x0, &(0x7f0000001b80)=[{}, {}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000000140)=0xfffffdfb) unshare(0x18010f00) socket$inet6(0xa, 0x80001, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/mcfilter6\x00') r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000400)=""/72, 0x48}], 0x1, 0x1, 0xfffffffc) syz_open_dev$usbfs(0x0, 0x76, 0x101301) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) 1.492985794s ago: executing program 2 (id=1533): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r1 = socket(0x400000000010, 0x3, 0x0) (async) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x7}}}]}, 0x38}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r5, 0x29, 0x33, &(0x7f0000000040)=0x54, 0x56) (async) setsockopt$inet6_int(r5, 0x29, 0x42, &(0x7f0000000000)=0xf, 0x4) (async) getsockopt$inet6_buf(r5, 0x29, 0x6, 0xffffffffffffffff, &(0x7f00000001c0)) (async) sendmsg$netlink(r4, &(0x7f0000001f80)={0x0, 0x0, &(0x7f0000001f00)=[{&(0x7f0000002840)=ANY=[@ANYBLOB="140100002700010000000000000000000101008024d4e3455c7216da3484447f8a081f930884b55764ca84de3d0e7bc8d6f29cd84ba9408cf2351604f1724e10a8fcc3988de886d82375980e92a1ba2f8410b06773cbbf6293af17222761aa1289e6a8f1d888f4809cdccfe1c8695630dcb6bad9b53d1d97f2f820a715ce709fcaa40a70dc4c98ebbe761c0eec46d4f50508215e72fc781a471b1a7c769a074f2d6388253cfdd4b0e37a788fbb7296ae39bb35439c66437fa3347adfaca46f74fbc95f1b070287096cc9bdc953ea637c118a68a8ddc23aa44e8aa8ca5dac063a052d0000008bb982eb4ec7e08b552a2807c00bbfbbb5369dd1e04690a1267e29e89d27673db50050419e278e6130000000000000"], 0x114}], 0x1}, 0x0) (async, rerun: 32) r6 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r7) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x34, r8, 0x3e8c4ddb697c9f8f, 0x70bd25, 0x0, {0x4}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}]}]}, 0x34}}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) (async) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000000000000001200000008000800000000000800090000000000180001801400020076657468305f746f5f626f6e640000000800070000000000080006"], 0x4c}}, 0x0) (async) r11 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r12 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x4c, 0x10, 0x503, 0x12000000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x188c0}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_MACADDR_MODE={0x8}]}}}, @IFLA_LINK={0x8, 0x5, r13}]}, 0x4c}}, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000500)={'team0\x00', 0x0}) sendmsg$ETHTOOL_MSG_COALESCE_GET(r7, &(0x7f0000000800)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000600)={0x1d0, r10, 0xd318efffa7082289, 0x70bd29, 0x25dfdbfe, {}, [@HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'hsr0\x00'}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}]}]}, 0x1d0}, 0x1, 0x0, 0x0, 0x850}, 0x9010) (async) sendmsg$nl_route(r6, 0x0, 0x8044) (async, rerun: 32) preadv2(r6, &(0x7f0000000180)=[{&(0x7f0000000280)=""/216, 0xd8}, {&(0x7f0000000380)=""/253, 0xfd}], 0x2, 0x80000001, 0x7, 0x6e8576bbf6b5ed57) (rerun: 32) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@newtfilter={0x50, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0xfff2, 0x3}, {}, {0xfff3, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_KEY_ENC_IPV4_SRC={0x8, 0x1b, @loopback}, @TCA_FLOWER_KEY_ENC_IPV6_SRC={0x14, 0x1f, @dev={0xfe, 0x80, '\x00', 0x32}}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x50}, 0x0) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000140), 0x74eef9fd, &(0x7f0000ffa000/0x3000)=nil, 0x0) 1.118788233s ago: executing program 2 (id=1534): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) io_uring_enter(0xffffffffffffffff, 0x6927, 0xfa50, 0x40, &(0x7f0000000700)={[0x80]}, 0x8) ioctl$KVM_CAP_SPLIT_IRQCHIP(r0, 0x4068aea3, &(0x7f0000000040)) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x5, 0xf2, 0x0, &(0x7f0000000000), 0x4004000) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000380)={@in={{0x2, 0x4e20, @loopback}}, 0x0, 0x0, 0x49, 0x0, "012fdd90c46483b13de94bc700022eb76eab66bf16657b7754ec9f3d5818a5bbd020fa3068af5bb2fffedeacfab26318efa2ec16f6a9bdcfe9c0a30eca37f5b9b23edc3aa8912ec22f0fb8afdb31449f"}, 0xd8) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f00000002c0)={[0x8aba, 0x4, 0x1004, 0x804, 0x4, 0xc, 0x120000, 0xff, 0xffffffffffffffff, 0x9, 0xffff, 0x4, 0x0, 0x105, 0x400000000000006, 0x9], 0x8000000, 0x141200}) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4400ae8f, &(0x7f0000000100)=@x86={0x40, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xa, 0x8, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfc, 0x80, '\x00', 0x0, 0x5}) pipe2$watch_queue(&(0x7f00000006c0), 0x80) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_ethernet(0xbe, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x9c, 0x0, @wg}}}}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002b80)=@delchain={0x614, 0x65, 0x20, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xe, 0x2}, {0x0, 0xe}, {0x6, 0xa}}, [@filter_kind_options=@f_flow={{0x9}, {0x5e4, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x8065738cbab9bcb1}, @TCA_FLOW_EMATCHES={0x170, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x120, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0x68, 0x2, 0x0, 0x0, {{0x4, 0x0, 0x7}, "645809825d93df900fa8fae387fbed6313a639f20b0238ccdd4da9fde2f0be34e659ba729925eff5ebd76dec200e0c6b209649b549944fb335b53ad7e5b0f72af98dbb05ee1778a3e952122289a807cd7b48f87fa52a56b8fa"}}, @TCF_EM_NBYTE={0x14, 0x3, 0x0, 0x0, {{0x7, 0x2, 0x4}, {0x4, 0x1, 0x6, "eb"}}}, @TCF_EM_CONTAINER={0x88, 0x3, 0x0, 0x0, {{0x4, 0x0, 0xb}, "17b31b88cd50d147badf2a1a38c77df97be64641cc7318b2ce8ccdad6a96b06c832c85fddaca6ed96ea16ef202d71b42b21893487cead96a7ed371addafba26ca026c638c16771ecfe003896b993b75dc4111355a036c11ea5ca4b1fab502e611260caea6dd386e39e886b9878b03b39dc015359b12cc7be6f8e"}}, @TCF_EM_NBYTE={0x18, 0x2, 0x0, 0x0, {{0x4b2a}, {0x8, 0x5, 0x2, "aeb25e3e76"}}}]}, @TCA_EMATCH_TREE_LIST={0x44, 0x2, 0x0, 0x1, [@TCF_EM_IPSET={0x10, 0x2, 0x0, 0x0, {{0xffd3, 0x8, 0x8}, {0x3, 0x6}}}, @TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0xf0a, 0x3, 0x6c0}, {0x5, 0x0, 0x3, 0x7ff}}}, @TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0xf, 0x7, 0x7f}, {{0x4, 0x1, 0x0, 0x1}, {0x1, 0x1}}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}]}, @TCA_FLOW_XOR={0x8, 0x7, 0xffffff7b}, @TCA_FLOW_PERTURB={0x8}, @TCA_FLOW_DIVISOR={0x8, 0x8, 0x7fff}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_ACT={0x448, 0x9, 0x0, 0x1, [@m_gact={0x140, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x9d, 0x1}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0x2680, 0xffffffffffffffff}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0x1abe}}]}, {0xed, 0x6, "f2984ea5ae0b0909ca5198b5e56548da1af4efe458d68e8346a5ad6fa8d75b3efbcec03667694b23e57efb5dea177c9fec912eda500f92ad241d4a3e1eb9b05c2461a1e89e99a22f43eb3b64257b78512c9df802c3ea23ede5e978e8db3be47630f9b48cdfcee2130369da2ce7473e6324d4fc0342cb38a9e544eb6f4e0148acb294b877f68eb4b6b13e38196c311c9ebb06d7a5ee9ead5689128fa35472611715963d35fb43d3014ff74e144932866ca97f5c001aab6053dd7ce7d38a407074614c2a21063cc49a687085d3ab9d042fcc913d8377863381be46ad8fade1f71945e9d5053fd5d1123d"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ct={0x94, 0x1b, 0x0, 0x0, {{0x7}, {0x4}, {0x69, 0x6, "effbbfbb9975b98b391b34602a99202c04f8aff0f475c3649e7f9024793790e685860edfb7d78570905ca6acc9165a1fb42c399f209c0f00a8f4866f081cd17e904ddc3210cc30ec49b70f2b1fb3ead1fe143d5356ac58b602d03fa75b270e66d3b14a3b76"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_skbmod={0x108, 0x1f, 0x0, 0x0, {{0xb}, {0x4}, {0xd9, 0x6, "364a95306a0125f7c7762d651b8604a6d91ec4567f627089ed8d3453859a3d2c79d3d70f085dca8af621c4a5da976ca910f38151f1a68c0e0730e7273e6af4eab8e2ea5df8cb0f6ab249f7561ea8c0dd3e562e5e6a1db3a546a7f7c5f1d0ae94557d9f43b53f0c2e3edaf804191d2d3a1cbdae068d8e342ed2d4e751b25b639e2536238fb6a4824a50b9c6bb62944110874faeed2eb2a6db4dfa6ff7d67302260dd8c80e3c4c3a3a11f1d204106eec615119eaaa73bd0bb3e2d774039d9c7e0d445019a712cc0c16707a7b8505b7c94133ceccee82"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_tunnel_key={0x84, 0x3, 0x0, 0x0, {{0xf}, {0x54, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @broadcast}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @multicast1}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x401, 0x1000002, 0x7, 0xe3f, 0x4}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @remote}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_xt={0xe4, 0xe, 0x0, 0x0, {{0x7}, {0x4}, {0xb9, 0x6, "2a0caebad864038ff40a5d287f3088600ceb92031a440f806744f2c29cd762b34d1c3e200652a37a380abee23790e6050e067b4335afeb4ae4a0dfe9fa72cc1df85464324a30272ee56c17d0913025ba5b385f50249552b3d0baa66c6ffc89df47949c8e52874be2547d84a88eaf65c1a57f44be2ac8409dc80a1286dc54b446bceacb288bceeb018feed674cd3991cf602a4e1e2de9b27bb4036b0ac3e4a6048cdd4ebfc8b92c63ac0f4245eecd529108a46a7eaf"}, {0xc}, {0xc, 0x8, {0x3}}}}]}]}}]}, 0x614}, 0x1, 0x0, 0x0, 0x80}, 0x20000080) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = syz_io_uring_setup(0x4b5, &(0x7f0000010400)={0x0, 0x35c3, 0x1000, 0x8}, &(0x7f0000010080), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000010300)=[{0x0}, {0x0}], 0x2) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r2, 0x10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)=[{0x0}, {&(0x7f0000000340), 0xa002a0}], &(0x7f00000005c0), 0x2}, 0x20) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_DROP_PRIVILEGES(r3, 0x4004551e, &(0x7f0000000000)=0xc980) ioctl$USBDEVFS_CLEAR_HALT(r3, 0xc0105502, &(0x7f0000000340)={0x1, 0x1}) r4 = socket(0x10, 0x5, 0x0) sendto(r4, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/106, 0x6a}, {&(0x7f00000001c0)=""/17, 0x11}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000580)=""/77, 0x4d}], 0x9, &(0x7f0000000600)=""/191, 0xbf, 0xa1}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) 961.625916ms ago: executing program 4 (id=1535): r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) socket$alg(0x26, 0x5, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$video(&(0x7f0000000440), 0xe0, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) syz_open_dev$tty20(0xc, 0x4, 0x0) syz_io_uring_setup(0x10d, &(0x7f0000000200)={0x0, 0x9e74, 0x0, 0x4}, &(0x7f0000000340), &(0x7f0000000280)) syz_open_dev$vim2m(&(0x7f0000000040), 0x1, 0x2) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x12, 0xffffffffffffffff, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000340)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000780)="aa1d484e243103000000f7c08bfcd111fbdf23ea32db0e8f21d5bc27bd8063067a0689fff2a41cfbf0e9d85e447511703d", 0x31}], 0x2) 707.187091ms ago: executing program 0 (id=1536): r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f0000000140)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) r3 = socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket(0x40000000015, 0x5, 0x0) bind$inet(r4, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r4, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) ioctl$SIOCGETMIFCNT_IN6(r4, 0x89e0, 0x0) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000240)=@multiplanar_overlay={0x1, 0x2, 0x4, 0x400, 0xc8f, {0x0, 0xea60}, {0x5, 0xd, 0x6, 0x8, 0x9, 0x4d}, 0x1000, 0x3, {0x0}, 0x6, 0x0, r5}) syz_pidfd_open(0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) r6 = getpid() r7 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0) syz_usb_control_io$cdc_ecm(r7, 0x0, 0x0) r8 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x402) writev(r8, &(0x7f0000004280)=[{&(0x7f00000000c0)="2898a4", 0x3}], 0x1) syz_pidfd_open(r6, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x48100) openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) 706.222224ms ago: executing program 4 (id=1537): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000240)=ANY=[@ANYBLOB="ac01000010003b620000000000000000fe8000000000000000000000000000bbac1414bb00"/64, @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="00000000000000000000000000000000000000002b000000000000000000000019000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000080016"], 0x1ac}}, 0x0) 303.781489ms ago: executing program 4 (id=1538): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4004550c, 0x0) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) (async) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/config', 0x0, 0x0) unshare(0x22020400) (async) mount_setattr(r2, &(0x7f0000000c00)='./file0\x00', 0x1900, &(0x7f0000000c80)={0x86, 0x74, 0x40000, {r2}}, 0x20) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2a100f7f9cbe68e9, &(0x7f0000000080)={0x400, {{0xa, 0x0, 0x1, @mcast1={0xff, 0x7}, 0x1}}, {{0xa, 0x4e20, 0x0, @remote}}}, 0x108) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000ff000003bfa30000000000000703000000feffff620af0fff8ffffff71a4f0ff0000000015040200000000001d400200000000004704000001ed000062030000000000001d440000000000007a0a00fe00ffffffdb03000040000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa5b4e377184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7592566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6cb5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) (async) sendto$inet6(r4, &(0x7f0000000340)="d4d7efad020efa27e4b5b271825ef53d030f992ff58468566c6fc090ac508f876b89a6004f4d6aa59f13c8afda4bfc2137c8a1d584595b77c2a5f6a72a6d627f3408143aae7315bb608e1557b707b38c30f447a288036c", 0x57, 0x10, 0x0, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)=ANY=[@ANYBLOB="300000001a0001002cbd7000fbdbdf251c14"], 0x30}}, 0x0) (async) mmap(&(0x7f000090a000/0x4000)=nil, 0x4000, 0x1000006, 0x100010, 0xffffffffffffffff, 0x71fb9000) (async) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) (async) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}, 0x2}}}, 0x108) (async) close(0xffffffffffffffff) (async) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f00000001c0)={0x60, 0x3, &(0x7f0000026000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0xc, 0x68, 0x0, 0x24}) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x301505, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) fsopen(&(0x7f0000000080)='tmpfs\x00', 0x0) 181.911943ms ago: executing program 2 (id=1539): r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0x88, 0x0, &(0x7f00000004c0)=[@enter_looper, @dead_binder_done, @dead_binder_done, @free_buffer, @acquire_done, @transaction_sg={0x40486311, {0x0, 0x2000000, 0x0, 0x0, 0x30, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000400)={@ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/215, 0xd7, 0x0, 0x1e}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x2c}, @fd}, &(0x7f0000000140)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 0s ago: executing program 2 (id=1540): r0 = socket$inet6(0xa, 0x1, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x1, 0x4, &(0x7f00000010c0)=ANY=[@ANYBLOB="8500000008000000350000008400000085000000070000009500000000000000fed023d1d405000000c7d4012507000000c71adb05d72768b8242dd90d17e4c52505750482b009546a5f3f00573f31b53fd3e52bd87184446d165ae2939bbca322a415a98c885faad395f3e4e0635559362ed862ce7c69ad133037af3a000000000000000000000058c122dff93c54caec3751652d11fd4f66711918d3604b92666d60c88b658fe57bb5d365c5b89625385f230ba21f570635837c7bc74be573bfd68aaaf06d842085f84b96c4709e2c9449f0818f6fc5657572fb3e5bb8ff6f643e52f4964c62a70a011ede8b504c8a30381b8eff01d7615e1789bb4b3b7ef3668a98a785a80aa2d1ab149b9316091fb3025f0716799d8280acb3880a882f28dd3111e02c3b0b2818bf5bb902cc9c1666f5fdd2e43901ca4796f04db25c3df35cdfc17c54936202b45b7a09816aa76e8b9bbe24022007aae367025040e8b2255ced48a4b2db3f280dc6fd2f5374548c499ae74631f3be04e28d601369f9488fb074eb35540df5e053376ea29125d6bb916496b04b8e359c1edef91677414729967cffa736d7789c14e918b77518ee8e5d5aff9148be69267fff35"], &(0x7f0000000140)='GPL\x00', 0x0, 0x99, &(0x7f0000000180)=""/148, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x8b63bfea1a14a3c7}, 0x16) socket$packet(0x11, 0x2, 0x300) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x41, 0x3f, 0x5f, 0x20, 0x61d, 0xc150, 0xce6f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x33, 0x0, 0x1, 0x18, 0x70, 0xfd, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x4}}]}}]}}]}}, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0x12, &(0x7f0000000000)=ANY=[@ANYBLOB="a200004ef3b11f948ef66b0ee0b3d41b1b", @ANYRES8=r2]) r3 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000402505a8a440000102030109021b00010100c00009040000020701010009050102"], 0x0) syz_usb_control_io$printer(r3, 0x0, &(0x7f00000011c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r5 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000), 0x12800, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r5, 0x5387, &(0x7f0000000040)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xc3490000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) fsopen(0x0, 0x0) r6 = dup(r4) syz_fuse_handle_req(r6, &(0x7f0000001200)="04c01d48460aff24f155ec935218a13628b8d8e936933f67923cd3a79254fc1ea30c0b274d8f97fef3f9ca51578ce33ad99f8d7d19e98947f3c33c2a43f67dc5fa2664543ab60e0fea05cfcb4553aad05be501cbc798265592f3a677b68e8e3316a58878ff2268b19e321564bd8d53f8b03081742b8d3d37f27a6515edef2be9420f3daf4bffbcc1810035c0921e05dfbf4af4652f3993bb2bb077733daa2833651b4be130ebcddf3f5d508e8496a539c8e68d0ab9f4182ff900cabe090171689f0f87de0d3b9962b6634555a3825160afb3c2af389a870f57b37236eff1aa42e124dbcba0b243b80c11dc9a2c12ea4b6fbbecf8677a50acae96c6dd58df6b66bc27fc34acae18cbe8182e8f9e4537d06d98d435614801c2e30da694a33feb937c0eeb186664c5f13aa107094ed3e97c71d12f78c609ac6d606f3438c7a3c964c4da8d1c43fe5c5de41ac8802d86207e88c2b876c8eee27e56a004a8836af0d3c01fa8a719284b1d8ee909a379ab8309ee258263542498820f9b805916662890ac24af117cf463ad79c320a8510261b84e8ae03b35b404da6ace48b040163477e184e007026044e501e5bf7ef8ffde5b70ef478bbcb8aaaf6281c63afa5e197f4069cbcd1e25663c652bea54136d3b583840878a38de2997d639db5d3c5090c1495f72788e4f1e0ffc4a0f4fa3e3664003e50ec5e4e738f5e750f6b4b52c3c330bdee94ef4c39ec28d7ad7be1a7524d23dfd9d8d8d3b571d891819457257aeab74937c8e4098d474cb0dd190d1d695633921735786e95dd6312e09ba5d8616994bd82d07379aba0b569e1a12da33df6c000bf52f0ce1c7d1dbafc64e6122fe253fa60aff80c812d3d4423356c124a1198c9808df3a5890dd5962919cf876c92615f94cd0f2ec238b7cdaedd7e5f9a1022f39a1c9fa053b5671b6ed649fcec75bdeb3de1af243c3efe03a9a8e03ebe6905de34fa79f28b5d7d9a85c750c8732f500f86747ad246a48e278e683c74d57cab0c1ddf65a5b5d58b6cb41d8433e567e6776efd28af49faa980bf96e7b4130500b3ec5a1b2220a49bf74bd4df9cb17cb5c4fc73eb1b2c7785238de7a4a5a66051a98e9a2420df398c25838e1bf8cdec4e2c5dbaac9279e0d81ce6ebdc7c4b75d5e3642b428c7a82c273d43c0827b18778714ed130acaa26ae70ec835cc47d2855438d09481884669a11d7b72f2469a9c93fd3fa2de24acb0ea093e649498f26bbe13db6c48818bf5e17ad6d796acb81e2878b16f43ff49cb7e606bdf6fe1f23af8457212da9f5a84fab012b57baf5d65dcbd55e5c75763207139361beac04d501e9729a708d4c21a8fe5e31df9f4bfa6b0058a68d0ea4544c0e34bd6218f90211a835cbc6c46a77ae462d1fceaf0dd03ef60d35aebbd09d61bd77392daa4f6a50848b224878ecf0a79e0bc3984b0b912d4ec45c702f7070c2f7ef3b54cd82787baa4db83f75b6229fa1873d8d964daa66ee66507c8a94958c4adac4b4ffae4170469501488f2be74465c2baa0e578501bcd0afd10346d7a576378de7a3e8bb1c5c96dad2fa42bf8abadec27e62097bde633e86c558204ad4e379db96e81618d79a308acdde364236c8034fb1bb424367fe3aa11c051cf55702b20ba8ad2c0ff1409bcf3758a1d57bf9881ac866857a3e13264daaad94aab12214c3ede95b1b5e70d2ec62c68f283fcf3788973de8e58cf62996a9701aa8965dc33ba4429a0d4b3fb9e5c5c160c89fa6527f434deab6a61b67544fa890d12354d23ab7f68bf20d3d9129ce6026147a8c093b1361a200d558e762a5684b7eb044136fbf246b4116f52394e5f0b8cee1b58cf4003d7ece287f22ec89a861a445a1e19c3a26312f8a684cddc063260100230585ef8aa6794c8df33cda09289d57803fcaa7ec3ea7903f817261f30e90971a338487b3bab4186b23d48b84c1bb11c399590cd8c80e95774de1c9d24bb80d2c1b5b9a23c6dafa9c76db54f57d43c30437c11675739fa29d41efc9e4ad481d9546728e23c6a397062dafd901fb0cbd89c2bee70f390acf77e3bace33f4fd4cce9e86b53383f8af5bb074cb87733f12490e9c1d2f3054a39fd295de2afb108911349ad251fab935c3f12829c40b2c47001232ef254025afeb8d7a2eee0314cbd46787b56654f1cfca9376f125c44786b4c32426d3aef21e6c818f6b792a650e95283168b3e312f11c808c64d036fc8fc400631590cda0e9acdbde58cf4fdb89a873de872b04351eea3ba7c87e6dfd1dd797975f94814b81944018c368d93217383c794f58a6517c7c85487459fb1bbf160de9d060da426ebc47a7cce6e7ebb62a36723371b36e7d7cdd54a9721ca47cbad967aa9507dddf64ec8b6346b3f18a1f30e1cf6efb755c724d12f310bb53be54222d1677dfe2ff2ee0ffaa1cc185c79b4b4020f18a186e0dfea913ef7ec8e0c6a9356fcc4b5b92e0e67d5201c9a9081698bf585f739753de41ef9afb2053133c1ddc48fe61ecf9d0932881ca9a8625cf1bda99759f7f38d5393827c298b437e09854711182b361a1b7f53c804e0317be3c5a610fb93ae948032a008622c1c2d1d1cd7303c02e52aa01454dc598d5a3e14444b0004774bb50002a87e8a073305be22bd4131d1172af140a08ef93e7892612aaf8029456a369f7e5800ee789772aa7fc9ebb99bd47a0106a392c27dcd04b0a0e274f2e03c190a8d04f2d8b2c8d97c6719864a03dd6ca599db8d0741dc8813fc8f1500e536bd2a0c6948be40b72caead8ce0e158bb5dde4af0501a0526df2d8aae0d12bf74d23036c846cd8d34960f55819e800208fbceec77c5fa78bf5fb21445835a746f808bb3a72cf458cae3fd8ae35ccff153594cd0bd348433de859aeabff0ea1f9f2267f6c2a7cd75710e88d02ead2806ef61c90076b1bbfe582d5674e87f409320e1215837cb0c0614c255a598a91635dd9bcdde155fc96abd3f76ca31e6dbcf5f243d32a0a58f1dfd5b6133369f126f76049ca2f198bfd6c4897e398922804ecdc05250530cc36199c4c4a397ea6f5b3c325f9625fab74f51f9f5b0faf82cd8bd9c72c753a6f28b6a1d1ae209ef4ef17af9d6f01a09f0914d401754e9c9c99be281272211c25cd91f460189f5d739b90e7aceb642f6dbdfb43af443a30745f92083a265908001d60687adca90abb1399b495cacf536b578efd80d328cacc567e9c6d10983a99032345ce62cbda5f1386aae4941e8126c1d0acdf21a71c30415b8882a6c11b8f9b02910b87c523dff0a027d3262989ec029ef35c28adf475ebee7cf4c6a4f7e9e4a0ab2c0ad61ad3509b12f59068854559c878e4e5b2b9fd29b63b1bac78dd754fa9e7f1d3b5a2805ab5c6856c54f5a4df17aff090aca809705ecd9981f1f1b23f344ce1ec54aa14db668e93fa62857ecf4dd7d9a7ac4837e1defbc750f9e8816c37c7f16ccf1270b12036db0d7a3bd345cc97e5165f20e569ab68b0c8f7ea40133970b72c4a61baae0b6e3c1d7a10af0d57b8070a11a1f2ca3ffade916b7217f73526eaace3f5ca31a63219a55f8530ddedac738804f839bed42a5c651afdde97e425c4f16c8c6a0a2d48f50bc869aeb6cba58497541be8b37f594bab28a96532349a97b7efb632bbf7396d32abc2bce208f56ab667964ed63ec32a3faa9562bf4cffe8b54295f4957aab6bbc42039e75d99ccc70620bc21948a4cd300338cad2080850921a7eb9135e4a09267fc120b23803969dd3c443794ddc46f297d0ccfcefff3cf37b7f2878667b5ea1ed0db197c109b32f7349b347ea78a317771245e01b733233313eab94ba9bd9a8a5f57f2d402e34958b3ccf66a363090617d22cb31b82ab18805046ddc9f432dfe182e7ac5cd15350be7266a78a1093414d4747c9a9a3024089b896a58d65f341f016e70d17d481f95c65c3550a6e5f8ee0cfaee67ebf5a9327f9e8516e729a5d05ba06f36ce69b128e092529323fbb1727ee363faa2cbe24f4c7b7799b2b44afdb96676075e4ded1e76316c4c4325fc63aace01c4b83d213c123a9e88ad38ef99315edf0bcccd2107f0fec7232e7bc04f6db07c2baa8fe984ac21f48c42d38ecb129fa9a7ee729f8af4bc0159be1f1ca410f5d2344438a5bc0b2b5e4a02002707b83d36bef4c28eae7f06a17f55b410298d7f15243ee14894947994e59e0080c9cbd6c0e58ff59e4ed2e6762cfd64752851a4529153101ea370b97842d29d05dfcbbb144620c1357c089c0a5aa627624d194c11bf93dbda8fad34ecd351e0bf6c7cb1695a1824aaf88c09975a154b5ed2a72831ed40841510ccc17e48be67bd9cab3147a7e63d5bab40d6294ba1e3a914746cd40632412e57449b731986e5c3527d7fb8df7b236cfc5e691f77379bdaf21f38d9c865f90c1c7b294bdf6ddd7bf4b6b8acdc8be0cd60cfae17e12e739a8f671add21681bd3f9cea1919bb28f3846da492d3673f4053b433759ea10fd96196165c2f35159e18aee107b74e08139c8dfdf16519aef9f2f10e89f3a8cb60ac06de421f6ad8016a7fdc86e5c260178406364ccbee0f5f77950c60e1f327100b45668f7416a9927363a642c6add9fcc713a6cc7d2cacced4ae7b84e461731b672ec9b8a1439eff8fd6e902272108036332832b8325ac6c31f2ad1b3945d93582080dab3208d3b67ced345454107afd5ae3a99fc34c099dcc8ddc33bb4795ed92abf76730fd297c550bfbea2b89ecfe1c142ff32a12b774d158dbf042422bb0a97c6ea1a431faf2c0885c8c1f5d67bbaec60900a4710859ed278b089f2b566cb88ff951088d235234cff54c4ff0ac453f62fd641ab8b1944c48c2134c59763f1a72a3e43cff2663351a6cad10cae6beb4f7fd77d11413e7867cc4a5cbeaaecf4e496d1a3ce9ecc2ba159bf614c736c4f3c2f3ceffeb3de880796c4fb9cd7e650e600df90773eca7aa3ab454250e2c13c1353f010e5c40a141bf24bcdea79ea43ed671ca11c0b7078e87635f250563e497ea0234a8ee6b88e7804100f782620a9b3b23d56e713a35b6788bfc74194ee5d13f751b043161b8a3aa5497242a58cd837428d3b5f54ef3d5d7256161e418f2e94e5d3bc93c10813ddfcca1948eff11cfb0d64aec67d05f6fa5a6a825604d227775930342277ca97b8021d12d741255e5204927d5adb25966ba3e6f9386a72f366ba474d06c62dd07413189066e2b3e8d85303ec83ecb970895fff4abbbb6ac67f26e31dcef36f5281bac64218a8896e0a8849afe30a5d5ae3811819ca9c16e1ab9d33be2fbf6c2ceb5f61909fb01dfbb656fc6e580a97c856a93850be1c003d2b2f2e06146b4405cddb053f634e78da9d8916f3624fa595022c6dc0be7bb3b313bc8d6e4bfbaa9f99d105708f0660fea752c219e80efd608c40626c3579ae710d287efc37ed0b1cbc2d96df09b295a2b38cfea32aec4d51c49ed1b44fe261fe12a41a60061c323a2505c09c2d4ff7f21b307ff7e683b9f5826e1f3c29c91634352dc597098d401511dc0dfeeff96cf2b8421c50c16ddf897b0d576e2a8726c388fc00d73df4a7fe742edfab7297339db2dd3d471f9e8b8e8032b5d12f36c4853bc785a507fb39defe4854136d76b6029d6931262d6e2f67e84a8cbc18845365ce9a8290c078992fc3940b0adf21579fd140bdcc8054e2a92c4024609b6404042b9ca897f9714f6c4487ee0df8221da7676972fdf87a9e95ac88ac01edcf39c84a75062834a0b81d515c891c6b9b60a859f5604c0d08175bf9494251f3fb55ad1de442b0ddb68704f7413c0f341bda8471dcb8e63b0267aec8017ff7c1cafea8f6a39dd46724f05954006cbc3e3a264f652f55266b76852aa05b0810e25b9966923e7afeeeaf123209927d87625a72d9e67274bcbaace8b7add1a35f83ce4680fa0a026f76ece81a3eb47faa03b75f6e161627502c1d21f570ca34edecf1c5d8839699c10827a2697b5a5c0eb12053cf9290764c220df2243958caba283f9e3d5bcd9d53ade805d769f56d640d3de2b57a6117dd6bf61f04c3ba9d43654224ce5a188db492be3566bc44d08b435f5cec672f792c84a2e1d8bc33c2a9b952e88cde4a7731e157dd205072cab4ba672d44509424e93281fbabae697653b8728d1c458da3800b693502ab5ad9d20201e71bf41a529acb758eedbe3fa1ea1b345905b39fe2cd517f082589cd40d3364aa59c321da700140cba0285b1c11b27f1fd4a0be28d912216162efbb5db8727535a30c9645862fddc0fae727bfea30100cb8002656ebc99c5c994e544a0ad1219610a0de8ad2d4bb44eacb90078cf8c75b5620230762d6c6e57470b3166523dd4e3d108f39e7044c22d24c79a8675c7d75498ed58377fd9722304004757aaa39532568f782e6eb18d6170e4c15397eb24017ba17b4855c213e49323a3560feaa8efd7ab875fad531e3cc59972260fc217d488a3fcd48117be81d011105720107f5585e60f70a4a000bfb57add3ed3491ddcfbeed334e561dba1cf4fb974458500125e5cf35a33e4fe026142cfcb7546161602a8acb24c0c0ad1c3659c3d9a0c28ebb06f268ddb47e004b4ae35cf2ea27012f0113845dba0dc2a1b5f0ede2ca6989a473f6c3e9a9949620f783e07cf827cf078250c25362984e0f6efae7b32cedb954d6ccb4b99bf017481a6553c627800c267bdabcd14524c0d92bd15bca709b2c51a816756e1a3f188f7a2035258bdd74b861f83e27d1f66f426c74511e8d04ab13b0b6214e21cc239d0e5a396eb78fa163c5081d7954ba9979035646b674f4a922781d8db7472f419655d688142f1a071736e355867d4f587b81ff570d72015d767192a48f69f09e2bb38dbda8f6fbeacb15383631e8cb5e829bad8313c113bc3476cf6b0a0eb70d06589dcfcd987a9de7c76eab7ece21a54cea6235b1ec492f28d3211c936feedd39e073845f6fcf4b5ca0ae6587f331500552778fa8995dfb463943621886dac77c874c55286af33a4efd4e2fc3a03de4c1d6a521019d16988e4827796e0aba8629f369198967727d148ed4f98ad18c726fe4ee73872bd2dad048554abe1110c4e83447e20e498f6fcc0fd1ef88907ba2084bd7d9a79ac081804ea77e6e0491f056692c5e822f9abcab3907a2eaeb7e6571f158640a904e9f424250dbf23499a464090ae23e7dcf4bc9458080647d2ca4b1496c3cacf17e5818a76fcb5ad29f22a4f42966b48be84aec4cf409a1278b21de2f290868e14a2153c3971e2249bfe26cceb1e602c6012a774c2a54c82c4c0040408efdce78277717a03c6880b0b2eeffe30dc332d26a91ba67a06a2e0e570cde4ae6e686666428a9bc97b9b087fe2ca8b32664c439762db9336d92b83540f6bb771e91ad796c181f1e33f26d138163f9eed25d7563ff77c218134c392eb8d6bd83b743ba4bf62d8406f7b2ad08d1d7bd5341e05eae2c01dbe4cdb305cbd4b27ad9222aad77d334e3c3d3bb991c269b998b2c54d1cf69c803d011fae00652a15f5150df8b6fe8ef9277eec13ddb02c67fd7441f8c8b9c751a1cfe212016f572d03665d553daa920f4e0baef9aa496bb1fd17f91c7896636b910e5969d5041e18e184648f4b836fbfba36d432b6d4a282f386897bff883ade65be11073dce338e6c214675af76f23a394dae29bf86de35617c9a22de87f3eaefbf5c3e6d0082d6ffe3b1b363430e0024c0b30d31fad82c06c088edd8251303de1f2c8a17be581c755373925d7f6aaa3889f77a07043474f5947ec2a281654df8ec9b1c08fb9cd4e5b248449be93274be435a7bb280bf1b7310717b28a9752ce336c7ea5de59d72a34e2e979bbaa723b1f46e539df935039c72f4a95a0b2213232f2965bd600e8713fad2ef2e867f8102b497f059b8d7c95c86bd946fdedfc7d67707892c94d71ab6e4bcc4a5e656dbd7067bd3331dbdda71718741fe34a7630c6cf427f16479e07f7aa272b880ae685618e549b2e40984bba77c8788f75e1350245582ea9d3bb1a889d73270e98c5ef3737d3450c814842f1a553e52942396824143e5fc79c1e2cc2537694ab4098e51dc6509585f3ad229965efa61e7e1c2cf756ad575e418bb2ea74707027a3a4f3d5001412615e514f783c390027026df7cedd67a3ed708488dd561564519f2ef41cf74a61727db8b15b1f5657b3504e8eeb4f64b61235ea3c9d178d7e17b3400e65ec1c05a30a018a5099a623f0e864a5a8b2ff1b79d64fc85858ddc302b9d240652460aadc3afad6449c2291f15f2a11247783aebd714aff4d0c26253d2b720274191e8164a10bc5ec4ea97b766041518b236c8907e356b7c942c6ecf2172d3a0381695fa6b1e02a334b7cf694500eb7965b6f5aeed0a0ea9c9a0338607e085924c38333307053935fa82affc483b3e1ee5958ea3a7f517ea8c7f82d8f4a36192313afe3f683bcf0ac531b00fae1faa8cbb463a0d76782c668e25aa8dd1a7abf9a3a811aa18771c41b813468f4d58a00d4e673f1f69a441464e09731704aa502d1b0786011d0c79b527f84fee48f4d29eadfdd1a6aa0ecb7ec77558a8794539a991c22836395f656442cf40fcf47f022012e8e97eb24d257c18abe7e1a9a8ced452053705ec125a90f458205d95699600916e5ef63aa8856fac8e6e12418ab0f46cc32acb9af297b0764beb0bc8ff9a56ff3befcdb3bcb40a7d6c86525e99c6098705c4b1d581d1ee613d7679e1449602c9adc405f8f2320d7613d645d8c61390115610ae76b66685675e100265cfb6fca9d564c81a21bc1de2bf2886431412349ac8c8ac6182669971de6db78067afde96693c52a948ab39bd37fa40be0675c371f5092e170b23d3e315ae91ebe4f7c05f2682bee5da2f9618ea94200b9c5c138a72b80723edd35b9b8c5c173aab3ca170f103ffd30fd89eec9132f3f7d756bf03a75620d18c2861ddc1d7309a3c14af1467381c4ee47e0cab49d1cb3743ac6221641eff53d744a93fb8ae58088915acaadc440e0e24902ff25aad4a4084ab5575478576c1b5be475511f9a3173a6975eaa8244e2a3ecc69395e2d564fd9e5f918bf96207dcc51bd94efab84e8a8f4412988cd6216c207676c3d7da207154ae858c44b97a5a6567bcfaf32ec4889e86b184c31f7c326ab3757c9b1e2c985f7089e81ebaed8c67071088a669e9a583cc46b535946e1ccff0ab5e0ad9f3a5407e7e52c53a760bbebeff17c913f51997fdb7a67a3e63815a4ed7416aba67261873408825999b42f001a18b8e6dc6b39bb41a909266ffc4bd85fcb1e6550baac3d7ddc6f306c3b920aadd0ac90d113925402054db4cca8fde2b687785fa8d83635b847261150835b26262fe1d91f13d750eac950837893a51d82b2a2cfb30268a630b430dd511a87d9c8284238f64f2323495346ee3f858d3485bcadba62e840d40b3802ee5dad9fa30f288a5b21c541fa08e2023e487d93486a697cc1453da77d4646508ea97471530bcf9c8b130b9d15ec56a7ba76303b0602fa2db18476f97e552e3317dcea5ae7217332d58ae263ecf6347e5f9f5b9cc0eded8edcc5285061b3da30152ec8c3ab50483c5a9ed3c066d185b9225c99a2b951f3c7b27a05753981319b162a9c9eab0c4b84290176295e21196d4a63bb604cf2c9414f29f07d7e460a71a587e262d55a3e38d5e5b86a7ad3d718c1d9b4d6cbc7d5daed4ee78965c6070e7bcbc7ccc1c5cc260a3b9dd00684eed9d5072aa2f14f10b411e4bb6feadb6d7167b7566700a90f0eba0a5e4f0a2731c830a050f326c6596b3620cd95e226e0b977cfbbadef025793ee44af0cffe872601f3d421b9c4e58fa45827571a41b6cf0f1921fb24c782307d4d9de535428129a6e9cde149155666ce6db97a6f28b23ec2e8c3bfe825b24f3c0d8bed06f68fd4281421ba6b4107fa0991554c85d05a5caaecd6bbd5a55dd8913b57e2ca19b3c97923bf0d02b179db5de51a42eb8bf95c150d7f2f01e890136b3fb03fdd041dd6382d94147d5f2d60d76e2977d31fcb2f51c233a2be1457d3fefe9822d41d9a953b89744d17d9b3adbc80039b04260002ab03295a0c6cd44771a3ee86754d03daaf4a3e17cba45ec77dc8c9d15141f17386399263acd1a0807907d1e66b193d483d163f33ec6dbc7646f74b68bbce69662346c426b910762fa3c59c32197e774958610cd9e54767aa74cb68ae4c5471e83c0a2986841bc3032196959c66c7d7bf07995473d44ff2ae2bae74284841858efeb8914b7dcc9979f63260ebaf055d2121ba40970844f08df66b92982eb977beba03ed1beb5ecaadac26e675ec14f07e4131c60a427b3d2aede516ceb62f7ebcb4106ad53ebfab418c8e9eeba1b1f5750479102f90318a6b2bb3ae482430e84f5407d2428794935bb9859467463666b029477c00b19ced45a051849f3e11c09ce82815af031b5c7856aabd0a081c819228749d54f02ca94f6f12fa421f8867b43c591429c8905da057952b5fb462d7c61ac2ef9733d966b572180fa9cbcbc058a1bc3d6d888f504ad4a17df316f93ff583bf9430e2376d2403923d328e7aef5e0615ded9f6420ac84d2da968179a410f39afb5589b762705216c4d94491d9eee3a7dffc47e6540de4ed09264cabb5d089904c7c3b7e3624ddc020bbe0d1e10f49d1c751f872ebd2e72415b6197b5e079b18e24a6e0d1ee6e05d37d01b7a3e40097622dead2c4abbb778aca4c11375825a581f2b4eb942679af45080d1453efb85dc838f8554281c778b6a0b53eb405116376c23e848f8f9cec0fd11a37a192119cff0251a60e757f81f7334eb8f2db3abfa73618607cf7ba5e70eda995027996a0a7a39e3c803f148f1f51d8463d5fa0e1d16d9189f6f1340f800cfe7e7f9129894e64aeab8aac64b30b3be3c66660fce1150a54463b3d0dcbd83c821916fceaf8ad19a09cb67edec8f219b38091549ea9452caa7d5409879017fffaa9080ec848cb12612a3bf6a00cf353b8ad8765dc0479b0ec323bdb86d59a394e333321814f5d2a81d32e1206127934253d84676856aaf55a67efd831fadaefa8b5099d1c83db15a9c2a3d40f059b70e4c88f62eb99ebd6013ac473d769ecb2138d96c656dd36cd7080850e1cac1031b813727510729e5f413d45cf77320a4fcf6eb572bf145192ad9d4e3c3cc3d384be2f271fd342620a45cce338626497c6e97d37ae8f4b2a7c74d70cbe8448fc5c8e5a8b787e0fb1d733d0c7eb6ac83e6775092f8cb4a7b413f5261c51aab9a4e85334e52fbb70054e164b99d04db637aa7af587024924f7c50d70a3b493b788e3459f9ba9245f950109cc4506eef0c234383ce84691f7bd6ef53adaf4611cbc76b35d81ce298b3862463b90f069b81c9c1e836ee0069941e7387b8285b028538d50487228a540e38e0db84152169850acc39f2ce36e7d3483ec9d71b8265fa3420743f718d7cc3934b020e9a9f57c532fba01677d9c6899b054667ba3c1a8fc507cceeb9f605aa5fa8453e2d2eb1fb7cf3ed62367132ce7bee76ffa7341b88e6ce6844f2e244e39f8727e8bbd411041d43b611328b7366f4ddc09789fb0ed2ee4d721d65c53113dde6809fd856dca510a70e2", 0x2000, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000880)=@raw={'raw\x00', 0x3c1, 0x3, 0x670, 0x0, 0x8, 0x7f02ae, 0x468, 0x200, 0x5a0, 0x2e8, 0x2e8, 0x5a0, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x340, 0x468, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r1}}, @common=@inet=@iprange={{0x68}, {@ipv4, @ipv4=@remote, @ipv6=@mcast2, @ipv4=@remote}}]}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x7, 'system_u:object_r:bin_t:s0\x00'}}}, {{@uncond, 0x0, 0xd0, 0x138, 0x0, {}, [@common=@mh={{0x28}, {"a27d"}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x13, 0xec, 0x5, 0x400, 'snmp\x00', 'syz0\x00', {0xffffffff8cdbbefa}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6d0) kernel console output (not intermixed with test programs): 3-1: Manufacturer: syz [ 358.384392][ T5949] usb 3-1: SerialNumber: syz [ 358.398853][ T5949] cdc_ncm 3-1:1.0: skipping garbage [ 358.408900][ T5949] cdc_ncm 3-1:1.0: NCM or ECM functional descriptors missing [ 358.416665][ T5949] cdc_ncm 3-1:1.0: bind() failure [ 358.532387][ T9651] netlink: 180 bytes leftover after parsing attributes in process `syz.0.1000'. [ 358.774269][ T5934] usb 4-1: unable to get BOS descriptor or descriptor too short [ 358.799934][ T5934] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 358.816802][ T5934] usb 4-1: can't read configurations, error -71 [ 358.845945][ T5947] usb 2-1: new full-speed USB device number 51 using dummy_hcd [ 359.007091][ T5947] usb 2-1: config 0 has an invalid interface number: 248 but max is 0 [ 359.025308][ T5947] usb 2-1: config 0 has no interface number 0 [ 359.079968][ T5947] usb 2-1: config 0 interface 248 has no altsetting 0 [ 359.102903][ T5947] usb 2-1: New USB device found, idVendor=0582, idProduct=008d, bcdDevice=10.98 [ 359.112415][ T5947] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.122334][ T5947] usb 2-1: Product: syz [ 359.128082][ T5947] usb 2-1: Manufacturer: syz [ 359.141105][ T5947] usb 2-1: SerialNumber: syz [ 359.173142][ T5947] usb 2-1: config 0 descriptor?? [ 359.178907][ T5934] usb 4-1: new full-speed USB device number 60 using dummy_hcd [ 359.346136][ T9661] vlan3: entered promiscuous mode [ 359.405089][ T5947] usb 2-1: USB disconnect, device number 51 [ 359.467201][ T5934] usb 4-1: unable to get BOS descriptor or descriptor too short [ 359.488113][ T5934] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 359.499555][ T5934] usb 4-1: can't read configurations, error -71 [ 359.508069][ T5934] usb usb4-port1: attempt power cycle [ 360.738803][ T5949] usb 3-1: USB disconnect, device number 46 [ 360.765018][ T5934] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 360.947351][ T5934] usb 2-1: Using ep0 maxpacket: 8 [ 361.210079][ T9687] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1012'. [ 361.495786][ T5934] usb 2-1: unable to get BOS descriptor or descriptor too short [ 361.514293][ T5934] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 361.522211][ T5934] usb 2-1: can't read configurations, error -71 [ 361.673096][ T9695] loop4: detected capacity change from 0 to 7 [ 361.682486][ T9695] Dev loop4: unable to read RDB block 7 [ 361.689232][ T9695] loop4: unable to read partition table [ 361.701998][ T9695] loop4: partition table beyond EOD, truncated [ 361.718255][ T9695] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 361.721825][ T9692] : renamed from bridge_slave_0 (while UP) [ 362.545164][ T5949] usb 5-1: new full-speed USB device number 42 using dummy_hcd [ 362.777342][ T5949] usb 5-1: config 0 interface 0 altsetting 249 endpoint 0x81 has invalid wMaxPacketSize 0 [ 362.795444][ T5949] usb 5-1: config 0 interface 0 altsetting 249 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 362.837124][ T5949] usb 5-1: config 0 interface 0 has no altsetting 0 [ 362.886871][ T5949] usb 5-1: New USB device found, idVendor=056a, idProduct=010e, bcdDevice= 0.00 [ 362.915805][ T5927] usb 4-1: new full-speed USB device number 62 using dummy_hcd [ 363.020820][ T5949] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.057844][ T9713] netlink: 'syz.2.1021': attribute type 27 has an invalid length. [ 363.083342][ T5949] usb 5-1: config 0 descriptor?? [ 363.121763][ T9709] vlan3: entered promiscuous mode [ 363.305847][ T5927] usb 4-1: unable to get BOS descriptor or descriptor too short [ 363.319054][ T5927] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 363.390431][ T5927] usb 4-1: can't read configurations, error -71 [ 363.524472][ T5949] wacom 0003:056A:010E.000D: item fetching failed at offset 0/3 [ 363.534558][ T5949] wacom 0003:056A:010E.000D: parse failed [ 363.543914][ T5949] wacom 0003:056A:010E.000D: probe with driver wacom failed with error -22 [ 363.794439][ T9722] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1025'. [ 365.874054][ T9758] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1031'. [ 366.525734][ T5927] usb 5-1: USB disconnect, device number 42 [ 366.650199][ T9768] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1036'. [ 366.683213][ T9768] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1036'. [ 366.879489][ T9770] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1037'. [ 367.371696][ T9780] vivid-000: disconnect [ 367.441850][ T9784] vivid-000: reconnect [ 367.668861][ T9798] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1046'. [ 369.637479][ T5949] IPVS: starting estimator thread 0... [ 369.651688][ T9823] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1053'. [ 369.747186][ T9825] IPVS: using max 23 ests per chain, 55200 per kthread [ 370.074802][ T9828] netlink: 'syz.1.1054': attribute type 3 has an invalid length. [ 370.413192][ T9841] netlink: 180 bytes leftover after parsing attributes in process `syz.4.1058'. [ 371.984985][ T5949] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 372.178253][ T5949] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 372.205993][ T5949] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 372.233024][ T5949] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 372.358521][ T5949] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 372.399225][ T5949] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.447371][ T5949] usb 2-1: config 0 descriptor?? [ 372.959296][ T5949] plantronics 0003:047F:FFFF.000E: reserved main item tag 0xe [ 372.972286][ T5949] plantronics 0003:047F:FFFF.000E: unknown main item tag 0x0 [ 373.111869][ T5949] plantronics 0003:047F:FFFF.000E: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 374.340367][ T9897] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1072'. [ 374.705373][ T5949] usb 2-1: USB disconnect, device number 54 [ 374.775519][ T5867] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 374.799298][ T9911] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1076'. [ 374.852617][ T9911] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1076'. [ 374.955290][ T5867] usb 5-1: Using ep0 maxpacket: 32 [ 374.964547][ T5867] usb 5-1: config 0 has an invalid interface number: 157 but max is 0 [ 374.983123][ T5867] usb 5-1: config 0 has no interface number 0 [ 374.998508][ T5867] usb 5-1: too many endpoints for config 0 interface 157 altsetting 52: 173, using maximum allowed: 30 [ 375.011546][ T5867] usb 5-1: config 0 interface 157 altsetting 52 has 0 endpoint descriptors, different from the interface descriptor's value: 173 [ 375.032139][ T5867] usb 5-1: config 0 interface 157 has no altsetting 0 [ 375.039473][ T5867] usb 5-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 375.074184][ T5867] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 375.090051][ T5867] usb 5-1: config 0 descriptor?? [ 376.579821][ T9939] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1079'. [ 377.492357][ T5867] usb 5-1: string descriptor 0 read error: -71 [ 377.503520][ T5867] gspca_main: sunplus-2.14.0 probing 041e:400b [ 377.517861][ T5867] gspca_sunplus: reg_w_riv err -71 [ 377.531591][ T5867] sunplus 5-1:0.157: probe with driver sunplus failed with error -71 [ 377.613163][ T5867] usb 5-1: USB disconnect, device number 43 [ 378.064982][ T5867] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 378.216178][ T5867] usb 5-1: device descriptor read/64, error -71 [ 378.491666][ T5867] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 378.635002][ T5867] usb 5-1: device descriptor read/64, error -71 [ 378.665156][ T5949] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 378.745272][ T5867] usb usb5-port1: attempt power cycle [ 378.810543][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.819255][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.826063][ T5949] usb 2-1: device descriptor read/64, error -71 [ 379.065141][ T5949] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 379.111116][ T5867] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 379.145705][ T5867] usb 5-1: device descriptor read/8, error -71 [ 379.255054][ T5949] usb 2-1: device descriptor read/64, error -71 [ 379.385105][ T5867] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 379.385367][ T5949] usb usb2-port1: attempt power cycle [ 379.505744][ T5867] usb 5-1: device descriptor read/8, error -71 [ 379.725569][ T5867] usb usb5-port1: unable to enumerate USB device [ 379.745189][ T5949] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 379.787893][ T5949] usb 2-1: device descriptor read/8, error -71 [ 380.115594][ T5949] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 380.149777][ T5949] usb 2-1: device descriptor read/8, error -71 [ 380.274581][ T5949] usb usb2-port1: unable to enumerate USB device [ 381.356087][ T5866] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 381.376741][ T5866] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 381.387016][ T5866] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 381.399292][ T5866] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 381.414429][ T5866] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 381.677401][T10041] loop4: detected capacity change from 0 to 7 [ 381.686711][T10041] Dev loop4: unable to read RDB block 7 [ 381.692329][T10041] loop4: unable to read partition table [ 381.721584][T10041] loop4: partition table beyond EOD, truncated [ 381.742081][T10041] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 382.236744][T10039] chnl_net:caif_netlink_parms(): no params data found [ 382.364969][ T5867] usb 3-1: new full-speed USB device number 47 using dummy_hcd [ 382.450328][T10039] bridge0: port 1(bridge_slave_0) entered blocking state [ 382.466242][T10039] bridge0: port 1(bridge_slave_0) entered disabled state [ 382.478838][T10039] bridge_slave_0: entered allmulticast mode [ 382.492447][T10039] bridge_slave_0: entered promiscuous mode [ 382.513229][ T5867] usb 3-1: device descriptor read/64, error -71 [ 382.514424][T10039] bridge0: port 2(bridge_slave_1) entered blocking state [ 382.527942][T10039] bridge0: port 2(bridge_slave_1) entered disabled state [ 382.541325][T10039] bridge_slave_1: entered allmulticast mode [ 382.552140][T10039] bridge_slave_1: entered promiscuous mode [ 382.620402][T10039] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 382.634027][T10039] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 382.683454][T10039] team0: Port device team_slave_0 added [ 382.693411][T10039] team0: Port device team_slave_1 added [ 382.760700][T10039] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 382.769846][T10039] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 382.775032][ T5867] usb 3-1: new full-speed USB device number 48 using dummy_hcd [ 382.813322][T10039] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 382.841805][T10039] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 382.849324][T10039] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 382.876764][T10039] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 382.945028][ T5867] usb 3-1: device descriptor read/64, error -71 [ 383.052888][T10039] hsr_slave_0: entered promiscuous mode [ 383.067208][ T5867] usb usb3-port1: attempt power cycle [ 383.082095][T10039] hsr_slave_1: entered promiscuous mode [ 383.106353][T10039] debugfs: 'hsr0' already exists in 'hsr' [ 383.112915][T10039] Cannot create hsr debugfs directory [ 383.415248][ T5867] usb 3-1: new full-speed USB device number 49 using dummy_hcd [ 383.444970][ T5863] Bluetooth: hci4: command tx timeout [ 383.458128][ T5867] usb 3-1: device descriptor read/8, error -71 [ 383.725008][ T5867] usb 3-1: new full-speed USB device number 50 using dummy_hcd [ 383.758438][T10039] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 383.759331][ T5867] usb 3-1: device descriptor read/8, error -71 [ 383.794599][T10039] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 383.804949][ T5947] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 383.844728][T10039] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 383.880680][T10039] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 383.959155][ T5867] usb usb3-port1: unable to enumerate USB device [ 383.989936][ T5947] usb 5-1: Using ep0 maxpacket: 8 [ 384.010515][ T5947] usb 5-1: config 252 has 0 interfaces, different from the descriptor's value: 1 [ 384.020281][ T5947] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 384.034429][ T5947] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 384.176697][T10039] 8021q: adding VLAN 0 to HW filter on device bond0 [ 384.214727][T10039] 8021q: adding VLAN 0 to HW filter on device team0 [ 384.231426][ T2992] bridge0: port 1(bridge_slave_0) entered blocking state [ 384.238693][ T2992] bridge0: port 1(bridge_slave_0) entered forwarding state [ 384.275964][ T6263] bridge0: port 2(bridge_slave_1) entered blocking state [ 384.283153][ T6263] bridge0: port 2(bridge_slave_1) entered forwarding state [ 384.477742][T10039] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 384.504995][ T5867] usb 2-1: new full-speed USB device number 59 using dummy_hcd [ 384.552812][T10039] veth0_vlan: entered promiscuous mode [ 384.581619][T10039] veth1_vlan: entered promiscuous mode [ 384.660110][T10039] veth0_macvtap: entered promiscuous mode [ 384.679193][T10087] 8021q: VLANs not supported on vxcan0 [ 384.701406][T10039] veth1_macvtap: entered promiscuous mode [ 384.754292][T10039] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 384.789954][T10039] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 384.833401][ T1143] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 384.849184][ T1143] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 384.860129][ T1143] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 384.873427][ T1143] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 385.213898][ T6539] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 385.262083][ T6539] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 385.497945][ T6539] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 385.521049][ T6539] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 385.535337][ T5863] Bluetooth: hci4: command tx timeout [ 387.066600][ T5867] usb 2-1: unable to get BOS descriptor or descriptor too short [ 387.627023][ T5863] Bluetooth: hci4: command tx timeout [ 387.692373][ T5196] usb 5-1: USB disconnect, device number 48 [ 387.724958][ T5867] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 387.732609][ T5867] usb 2-1: can't read configurations, error -71 [ 388.043004][T10129] netlink: 180 bytes leftover after parsing attributes in process `syz.4.1114'. [ 388.689158][ T30] audit: type=1326 audit(1754797567.541:670): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10136 comm="syz.1.1118" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbd118ebe9 code=0x7ffc0000 [ 388.719460][ T30] audit: type=1326 audit(1754797567.571:671): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10136 comm="syz.1.1118" exe="/root/syz-executor" sig=0 arch=c000003e syscall=443 compat=0 ip=0x7fbbd118ebe9 code=0x7ffc0000 [ 388.807375][ T30] audit: type=1326 audit(1754797567.571:672): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10136 comm="syz.1.1118" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbd118ebe9 code=0x7ffc0000 [ 388.832329][ T30] audit: type=1326 audit(1754797567.571:673): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10136 comm="syz.1.1118" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbd118ebe9 code=0x7ffc0000 [ 389.019617][ T30] audit: type=1326 audit(1754797567.571:674): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10136 comm="syz.1.1118" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7fbbd118ebe9 code=0x7ffc0000 [ 389.168086][ T30] audit: type=1326 audit(1754797567.571:675): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10136 comm="syz.1.1118" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbd118ebe9 code=0x7ffc0000 [ 389.191931][ T5867] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 389.200122][ T30] audit: type=1326 audit(1754797567.571:676): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10136 comm="syz.1.1118" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbd118ebe9 code=0x7ffc0000 [ 389.226546][ T30] audit: type=1326 audit(1754797567.571:677): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10136 comm="syz.1.1118" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fbbd118ebe9 code=0x7ffc0000 [ 389.254705][ T30] audit: type=1326 audit(1754797567.571:678): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10136 comm="syz.1.1118" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbd118ebe9 code=0x7ffc0000 [ 389.282584][ T30] audit: type=1326 audit(1754797567.571:679): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10136 comm="syz.1.1118" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fbbd118ebe9 code=0x7ffc0000 [ 389.517056][ T5867] usb 2-1: config 0 has no interfaces? [ 389.821274][ T5863] Bluetooth: hci4: command tx timeout [ 389.827002][ T5867] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 389.861313][ T5867] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.925285][ T5867] usb 2-1: Product: syz [ 389.946009][ T5867] usb 2-1: Manufacturer: syz [ 390.191756][ T5867] usb 2-1: SerialNumber: syz [ 390.227576][ T5867] usb 2-1: config 0 descriptor?? [ 390.241053][T10151] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1120'. [ 391.035093][ T5949] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 391.205138][ T5949] usb 5-1: Using ep0 maxpacket: 16 [ 392.129236][ T9] usb 2-1: USB disconnect, device number 61 [ 392.324131][ T5949] usb 5-1: config 8 has an invalid interface number: 109 but max is 1 [ 392.375165][ T5949] usb 5-1: config 8 has an invalid interface number: 255 but max is 1 [ 392.385436][ T5949] usb 5-1: config 8 has no interface number 0 [ 392.391948][ T5949] usb 5-1: config 8 has no interface number 1 [ 392.398601][ T5949] usb 5-1: config 8 interface 109 altsetting 6 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 392.409668][ T5949] usb 5-1: config 8 interface 255 altsetting 1 has a duplicate endpoint with address 0x1, skipping [ 392.425667][ T5949] usb 5-1: config 8 interface 255 altsetting 1 bulk endpoint 0x8A has invalid maxpacket 1024 [ 392.437773][ T5949] usb 5-1: config 8 interface 255 altsetting 1 bulk endpoint 0xB has invalid maxpacket 1023 [ 392.448042][ T5949] usb 5-1: config 8 interface 255 altsetting 1 endpoint 0x8 has invalid wMaxPacketSize 0 [ 392.458182][ T5949] usb 5-1: config 8 interface 109 has no altsetting 0 [ 392.465071][ T5949] usb 5-1: config 8 interface 255 has no altsetting 0 [ 392.630505][T10174] mac80211_hwsim hwsim10 è: renamed from wlan1 [ 393.109817][ T9] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 393.435096][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 393.501493][ T9] usb 6-1: config 252 has 0 interfaces, different from the descriptor's value: 1 [ 393.535877][T10168] syzkaller1: entered promiscuous mode [ 393.541810][T10168] syzkaller1: entered allmulticast mode [ 393.547971][ T9] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 393.548005][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 393.877686][T10185] netlink: 180 bytes leftover after parsing attributes in process `syz.2.1126'. [ 393.912453][ T5949] usb 5-1: string descriptor 0 read error: -71 [ 393.930896][ T5949] usb 5-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=b3.c4 [ 393.989918][ T5949] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 394.160927][ T5949] usb 5-1: can't set config #8, error -71 [ 394.196189][ T5949] usb 5-1: USB disconnect, device number 49 [ 396.244587][T10206] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1130'. [ 397.323636][ T24] usb 6-1: USB disconnect, device number 2 [ 398.010864][T10223] FAULT_INJECTION: forcing a failure. [ 398.010864][T10223] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 398.107173][T10223] CPU: 0 UID: 0 PID: 10223 Comm: syz.2.1136 Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 PREEMPT(full) [ 398.107205][T10223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 398.107218][T10223] Call Trace: [ 398.107225][T10223] [ 398.107234][T10223] dump_stack_lvl+0x189/0x250 [ 398.107264][T10223] ? __pfx____ratelimit+0x10/0x10 [ 398.107291][T10223] ? __pfx_dump_stack_lvl+0x10/0x10 [ 398.107315][T10223] ? __pfx__printk+0x10/0x10 [ 398.107349][T10223] ? __might_fault+0xb0/0x130 [ 398.107389][T10223] should_fail_ex+0x414/0x560 [ 398.107420][T10223] strncpy_from_user+0x36/0x290 [ 398.107449][T10223] getname_flags+0xf3/0x540 [ 398.107475][T10223] __x64_sys_rename+0x5d/0x90 [ 398.107504][T10223] do_syscall_64+0xfa/0x3b0 [ 398.107530][T10223] ? lockdep_hardirqs_on+0x9c/0x150 [ 398.107555][T10223] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.107583][T10223] ? clear_bhb_loop+0x60/0xb0 [ 398.107608][T10223] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.107627][T10223] RIP: 0033:0x7fcb0658ebe9 [ 398.107645][T10223] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 398.107664][T10223] RSP: 002b:00007fcb073ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 398.107687][T10223] RAX: ffffffffffffffda RBX: 00007fcb067b6090 RCX: 00007fcb0658ebe9 [ 398.107702][T10223] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000200000000180 [ 398.107715][T10223] RBP: 00007fcb073ff090 R08: 0000000000000000 R09: 0000000000000000 [ 398.107728][T10223] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 398.107740][T10223] R13: 00007fcb067b6128 R14: 00007fcb067b6090 R15: 00007fcb068dfa28 [ 398.107772][T10223] [ 398.113544][T10224] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1137'. [ 398.663634][ T5927] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 398.856745][ T5927] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 398.867334][ T5927] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 398.908142][ T5927] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 398.918090][ T5927] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 399.100582][ T5927] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 399.112909][ T5927] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 399.132797][ T5927] usb 6-1: Manufacturer: syz [ 399.162385][ T5927] usb 6-1: config 0 descriptor?? [ 400.007018][T10254] netlink: 'syz.1.1144': attribute type 27 has an invalid length. [ 400.165549][ T5927] rc_core: IR keymap rc-hauppauge not found [ 400.175794][ T5927] Registered IR keymap rc-empty [ 400.196025][ T5927] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 400.256271][ T5927] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 400.385216][ T5927] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 400.444593][ T30] audit: type=1326 audit(1754797579.281:680): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10229 comm="syz.5.1139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3c898ebe9 code=0x7ffc0000 [ 400.537257][ T30] audit: type=1326 audit(1754797579.281:681): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10229 comm="syz.5.1139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=12 compat=0 ip=0x7fc3c898ebe9 code=0x7ffc0000 [ 400.562452][ T5927] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input29 [ 400.650604][ T5927] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 400.686290][ T30] audit: type=1326 audit(1754797579.281:682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10229 comm="syz.5.1139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3c898ebe9 code=0x7ffc0000 [ 400.766418][ T5927] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 400.795089][ T5927] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 400.830112][ T30] audit: type=1326 audit(1754797579.281:683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10229 comm="syz.5.1139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fc3c898ebe9 code=0x7ffc0000 [ 400.897318][ T5927] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 400.944118][ T5927] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 401.007661][ T5927] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 401.057301][ T5927] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 401.077967][ T30] audit: type=1326 audit(1754797579.281:684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10229 comm="syz.5.1139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3c898ebe9 code=0x7ffc0000 [ 401.105228][ T5927] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 401.220484][ T30] audit: type=1326 audit(1754797579.281:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10229 comm="syz.5.1139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fc3c898ebe9 code=0x7ffc0000 [ 401.325344][ T5927] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 401.365888][ T5927] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 401.389810][ T5927] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 401.407869][ T5927] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 401.468905][ T30] audit: type=1326 audit(1754797579.291:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10229 comm="syz.5.1139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3c898ebe9 code=0x7ffc0000 [ 401.489300][ T5927] usb 6-1: USB disconnect, device number 3 [ 401.744603][ T30] audit: type=1326 audit(1754797579.291:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10229 comm="syz.5.1139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3c898ebe9 code=0x7ffc0000 [ 401.773302][T10272] binder: 10271:10272 unknown command 1074291478 [ 401.788214][T10272] binder: 10271:10272 ioctl c0306201 200000000480 returned -22 [ 402.267012][T10279] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1150'. [ 403.024994][ T30] audit: type=1326 audit(1754797581.851:688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10284 comm="syz.0.1153" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa308b8ebe9 code=0x0 [ 403.555831][T10295] binder: 10294:10295 ioctl c0306201 200000001d40 returned -14 [ 404.140107][T10300] netlink: 161024 bytes leftover after parsing attributes in process `syz.5.1159'. [ 404.180938][T10300] netlink: zone id is out of range [ 404.223701][T10300] netlink: zone id is out of range [ 404.314768][T10300] netlink: zone id is out of range [ 404.335723][T10300] netlink: zone id is out of range [ 404.354951][T10300] netlink: zone id is out of range [ 404.372480][T10300] netlink: zone id is out of range [ 404.389591][T10300] netlink: zone id is out of range [ 404.405764][T10300] netlink: zone id is out of range [ 404.434008][T10300] netlink: zone id is out of range [ 404.474107][T10300] netlink: zone id is out of range [ 404.805174][T10312] loop4: detected capacity change from 0 to 7 [ 404.821446][T10312] Dev loop4: unable to read RDB block 7 [ 404.833500][T10312] loop4: unable to read partition table [ 404.933266][T10312] loop4: partition table beyond EOD, truncated [ 404.958887][T10312] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 405.215589][ T24] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 405.317410][T10330] binder: 10329:10330 unknown command 1074815766 [ 405.325900][T10330] binder: 10329:10330 ioctl c0306201 200000000480 returned -22 [ 405.385394][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 405.450319][ T24] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 405.471989][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.569947][ T24] pvrusb2: Hardware description: Terratec Grabster AV400 [ 405.657972][ T24] pvrusb2: ********** [ 405.672329][ T24] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 405.750855][ T24] pvrusb2: Important functionality might not be entirely working. [ 405.772077][ T24] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 405.844185][ T24] pvrusb2: ********** [ 405.879194][ T2343] pvrusb2: Invalid write control endpoint [ 405.958321][T10340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 406.031827][T10340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 406.147381][ T2343] pvrusb2: Invalid write control endpoint [ 406.165577][ T2343] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 406.175093][ T5956] usb 5-1: new full-speed USB device number 50 using dummy_hcd [ 406.311285][ T2343] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 406.331303][ T2343] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 406.368511][ T2343] pvrusb2: Device being rendered inoperable [ 406.383823][ T2343] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 406.392027][ T2343] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 406.404664][ T2343] pvrusb2: Attached sub-driver cx25840 [ 406.413038][ T2343] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 406.424216][ T5956] usb 5-1: unable to get BOS descriptor or descriptor too short [ 406.432857][ T5956] usb 5-1: not running at top speed; connect to a high speed hub [ 406.441972][ T2343] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 406.453230][ T5956] usb 5-1: config 1 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 406.467558][ T5956] usb 5-1: config 1 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 406.526667][ T5956] usb 5-1: config 1 interface 0 has no altsetting 0 [ 406.586845][ T5956] usb 5-1: New USB device found, idVendor=05ac, idProduct=024e, bcdDevice= 0.40 [ 406.706307][ T5956] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.766225][ T5956] usb 5-1: Product: syz [ 406.779159][ T5956] usb 5-1: Manufacturer: syz [ 406.802047][ T5956] usb 5-1: SerialNumber: syz [ 406.816383][T10341] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 407.040145][ T5956] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input30 [ 407.073429][ T5218] bcm5974 5-1:1.0: could not read from device [ 407.219649][ T5218] bcm5974 5-1:1.0: could not read from device [ 407.288950][ T5956] usb 5-1: USB disconnect, device number 50 [ 407.385519][T10356] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1177'. [ 407.930899][T10369] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1183'. [ 408.081226][ T5956] usb 2-1: USB disconnect, device number 62 [ 408.095487][T10373] FAULT_INJECTION: forcing a failure. [ 408.095487][T10373] name failslab, interval 1, probability 0, space 0, times 0 [ 408.113006][T10373] CPU: 0 UID: 0 PID: 10373 Comm: syz.5.1184 Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 PREEMPT(full) [ 408.113036][T10373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 408.113048][T10373] Call Trace: [ 408.113056][T10373] [ 408.113065][T10373] dump_stack_lvl+0x189/0x250 [ 408.113093][T10373] ? __pfx____ratelimit+0x10/0x10 [ 408.113121][T10373] ? __pfx_dump_stack_lvl+0x10/0x10 [ 408.113143][T10373] ? __pfx__printk+0x10/0x10 [ 408.113176][T10373] ? __pfx___might_resched+0x10/0x10 [ 408.113200][T10373] should_fail_ex+0x414/0x560 [ 408.113232][T10373] should_failslab+0xa8/0x100 [ 408.113262][T10373] kmem_cache_alloc_lru_noprof+0x78/0x3d0 [ 408.113287][T10373] ? __d_alloc+0x36/0x7a0 [ 408.113312][T10373] __d_alloc+0x36/0x7a0 [ 408.113339][T10373] d_alloc+0x4b/0x190 [ 408.113355][T10373] ? lookup_one_qstr_excl+0xc8/0x360 [ 408.113378][T10373] lookup_one_qstr_excl+0xdc/0x360 [ 408.113405][T10373] do_renameat2+0x3dd/0xa80 [ 408.113451][T10373] ? __pfx_do_renameat2+0x10/0x10 [ 408.113489][T10373] ? strncpy_from_user+0x150/0x290 [ 408.113517][T10373] ? getname_flags+0x1e5/0x540 [ 408.113541][T10373] __x64_sys_rename+0x82/0x90 [ 408.113580][T10373] do_syscall_64+0xfa/0x3b0 [ 408.113604][T10373] ? lockdep_hardirqs_on+0x9c/0x150 [ 408.113629][T10373] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.113650][T10373] ? clear_bhb_loop+0x60/0xb0 [ 408.113673][T10373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.113691][T10373] RIP: 0033:0x7fc3c898ebe9 [ 408.113709][T10373] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 408.113726][T10373] RSP: 002b:00007fc3c9713038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 408.113749][T10373] RAX: ffffffffffffffda RBX: 00007fc3c8bb6090 RCX: 00007fc3c898ebe9 [ 408.113764][T10373] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000200000000180 [ 408.113777][T10373] RBP: 00007fc3c9713090 R08: 0000000000000000 R09: 0000000000000000 [ 408.113789][T10373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 408.113801][T10373] R13: 00007fc3c8bb6128 R14: 00007fc3c8bb6090 R15: 00007fc3c8cdfa28 [ 408.113841][T10373] [ 409.337431][T10384] FAULT_INJECTION: forcing a failure. [ 409.337431][T10384] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 409.361208][T10384] CPU: 1 UID: 0 PID: 10384 Comm: syz.4.1188 Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 PREEMPT(full) [ 409.361240][T10384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 409.361252][T10384] Call Trace: [ 409.361261][T10384] [ 409.361269][T10384] dump_stack_lvl+0x189/0x250 [ 409.361309][T10384] ? __pfx____ratelimit+0x10/0x10 [ 409.361337][T10384] ? __pfx_dump_stack_lvl+0x10/0x10 [ 409.361361][T10384] ? __pfx__printk+0x10/0x10 [ 409.361388][T10384] ? __might_fault+0xb0/0x130 [ 409.361428][T10384] should_fail_ex+0x414/0x560 [ 409.361460][T10384] _copy_to_iter+0x3f5/0x16f0 [ 409.361494][T10384] ? __pfx__copy_to_iter+0x10/0x10 [ 409.361511][T10384] ? __skb_try_recv_from_queue+0x2b2/0x730 [ 409.361539][T10384] ? __skb_try_recv_datagram+0x3da/0x4e0 [ 409.361568][T10384] __skb_datagram_iter+0xf8/0x990 [ 409.361592][T10384] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 409.361624][T10384] skb_copy_datagram_iter+0xc5/0x230 [ 409.361650][T10384] netlink_recvmsg+0x2ab/0xa30 [ 409.361688][T10384] ? __pfx_netlink_recvmsg+0x10/0x10 [ 409.361720][T10384] ? aa_sock_msg_perm+0xf1/0x1d0 [ 409.361752][T10384] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 409.361773][T10384] ? security_socket_recvmsg+0x7e/0x2e0 [ 409.361795][T10384] ? __pfx_netlink_recvmsg+0x10/0x10 [ 409.361823][T10384] sock_recvmsg+0x22c/0x270 [ 409.361853][T10384] ____sys_recvmsg+0x1c9/0x460 [ 409.361885][T10384] ? __pfx_____sys_recvmsg+0x10/0x10 [ 409.361924][T10384] ? import_iovec+0x74/0xa0 [ 409.361950][T10384] ___sys_recvmsg+0x1b5/0x510 [ 409.361978][T10384] ? __pfx____sys_recvmsg+0x10/0x10 [ 409.362027][T10384] ? __fget_files+0x3a0/0x420 [ 409.362068][T10384] do_recvmmsg+0x307/0x770 [ 409.362099][T10384] ? __pfx_do_recvmmsg+0x10/0x10 [ 409.362135][T10384] ? _copy_from_user+0x94/0xb0 [ 409.362176][T10384] __x64_sys_recvmmsg+0x1af/0x240 [ 409.362202][T10384] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 409.362220][T10384] ? rcu_is_watching+0x15/0xb0 [ 409.362246][T10384] ? do_syscall_64+0xbe/0x3b0 [ 409.362278][T10384] do_syscall_64+0xfa/0x3b0 [ 409.362311][T10384] ? lockdep_hardirqs_on+0x9c/0x150 [ 409.362336][T10384] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 409.362356][T10384] ? clear_bhb_loop+0x60/0xb0 [ 409.362381][T10384] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 409.362399][T10384] RIP: 0033:0x7fe33798ebe9 [ 409.362416][T10384] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 409.362433][T10384] RSP: 002b:00007fe3387b7038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 409.362457][T10384] RAX: ffffffffffffffda RBX: 00007fe337bb5fa0 RCX: 00007fe33798ebe9 [ 409.362472][T10384] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 409.362484][T10384] RBP: 00007fe3387b7090 R08: 0000200000003700 R09: 0000000000000000 [ 409.362497][T10384] R10: 0000000002040000 R11: 0000000000000246 R12: 0000000000000001 [ 409.362508][T10384] R13: 00007fe337bb6038 R14: 00007fe337bb5fa0 R15: 00007fe337cdfa28 [ 409.362538][T10384] [ 409.805133][ T9] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 409.944964][ T9] usb 6-1: device descriptor read/64, error -71 [ 410.021747][ C0] net_ratelimit: 28 callbacks suppressed [ 410.021770][ C0] IPv4: Oversized IP packet from 172.20.20.24 [ 410.185018][ T9] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 410.345324][ T9] usb 6-1: device descriptor read/64, error -71 [ 410.471510][ T9] usb usb6-port1: attempt power cycle [ 410.715582][T10402] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1193'. [ 410.975500][ T9] usb 6-1: new full-speed USB device number 6 using dummy_hcd [ 411.061002][ T9] usb 6-1: device descriptor read/8, error -71 [ 411.113082][T10404] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 411.152767][T10412] FAULT_INJECTION: forcing a failure. [ 411.152767][T10412] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 411.216958][T10412] CPU: 1 UID: 0 PID: 10412 Comm: syz.4.1196 Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 PREEMPT(full) [ 411.216988][T10412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 411.217000][T10412] Call Trace: [ 411.217008][T10412] [ 411.217017][T10412] dump_stack_lvl+0x189/0x250 [ 411.217046][T10412] ? __pfx____ratelimit+0x10/0x10 [ 411.217072][T10412] ? __pfx_dump_stack_lvl+0x10/0x10 [ 411.217097][T10412] ? __pfx__printk+0x10/0x10 [ 411.217124][T10412] ? __might_fault+0xb0/0x130 [ 411.217164][T10412] should_fail_ex+0x414/0x560 [ 411.217195][T10412] _copy_from_iter+0x1db/0x16f0 [ 411.217226][T10412] ? rcu_is_watching+0x15/0xb0 [ 411.217248][T10412] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 411.217277][T10412] ? __pfx__copy_from_iter+0x10/0x10 [ 411.217308][T10412] ? __build_skb_around+0x257/0x3e0 [ 411.217341][T10412] ? netlink_sendmsg+0x642/0xb30 [ 411.217367][T10412] ? skb_put+0x11b/0x210 [ 411.217399][T10412] netlink_sendmsg+0x6b2/0xb30 [ 411.217438][T10412] ? __pfx_netlink_sendmsg+0x10/0x10 [ 411.217470][T10412] ? aa_sock_msg_perm+0xf1/0x1d0 [ 411.217501][T10412] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 411.217523][T10412] ? __pfx_netlink_sendmsg+0x10/0x10 [ 411.217551][T10412] __sock_sendmsg+0x21c/0x270 [ 411.217579][T10412] ____sys_sendmsg+0x505/0x830 [ 411.217603][T10412] ? __pfx_____sys_sendmsg+0x10/0x10 [ 411.217632][T10412] ? import_iovec+0x74/0xa0 [ 411.217658][T10412] ___sys_sendmsg+0x21f/0x2a0 [ 411.217682][T10412] ? __pfx____sys_sendmsg+0x10/0x10 [ 411.217744][T10412] ? __fget_files+0x2a/0x420 [ 411.217771][T10412] ? __fget_files+0x3a0/0x420 [ 411.217812][T10412] __x64_sys_sendmsg+0x19b/0x260 [ 411.217835][T10412] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 411.217867][T10412] ? __pfx_ksys_write+0x10/0x10 [ 411.217890][T10412] ? rcu_is_watching+0x15/0xb0 [ 411.217915][T10412] ? do_syscall_64+0xbe/0x3b0 [ 411.217947][T10412] do_syscall_64+0xfa/0x3b0 [ 411.217973][T10412] ? lockdep_hardirqs_on+0x9c/0x150 [ 411.217997][T10412] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.218016][T10412] ? clear_bhb_loop+0x60/0xb0 [ 411.218041][T10412] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.218060][T10412] RIP: 0033:0x7fe33798ebe9 [ 411.218078][T10412] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 411.218095][T10412] RSP: 002b:00007fe3387b7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 411.218119][T10412] RAX: ffffffffffffffda RBX: 00007fe337bb5fa0 RCX: 00007fe33798ebe9 [ 411.218134][T10412] RDX: 00000000140cc014 RSI: 0000200000000540 RDI: 0000000000000008 [ 411.218148][T10412] RBP: 00007fe3387b7090 R08: 0000000000000000 R09: 0000000000000000 [ 411.218160][T10412] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 411.218172][T10412] R13: 00007fe337bb6038 R14: 00007fe337bb5fa0 R15: 00007fe337cdfa28 [ 411.218205][T10412] [ 411.561130][ T9] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 411.730433][ T9] usb 6-1: device descriptor read/8, error -71 [ 411.885542][ T9] usb usb6-port1: unable to enumerate USB device [ 412.265108][ T5927] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 412.450359][ T5927] usb 3-1: unable to get BOS descriptor or descriptor too short [ 412.467351][ T5927] usb 3-1: config 6 has no interfaces? [ 412.477703][ T5927] usb 3-1: New USB device found, idVendor=07fa, idProduct=0847, bcdDevice=d5.3e [ 412.496931][ T5927] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.511817][ T30] audit: type=1326 audit(1754797591.361:689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10435 comm="syz.5.1204" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc3c898ebe9 code=0x0 [ 412.544526][ T5927] usb 3-1: Product: syz [ 412.553670][ T5927] usb 3-1: Manufacturer: syz [ 412.572058][ T5927] usb 3-1: SerialNumber: syz [ 412.829325][ T5927] usb 3-1: USB disconnect, device number 51 [ 413.073241][T10442] tipc: Started in network mode [ 413.082675][T10442] tipc: Node identity f6a6eec2140f, cluster identity 4711 [ 413.091193][T10442] tipc: Enabled bearer , priority 0 [ 413.144555][T10441] tipc: Disabling bearer [ 414.318582][T10478] FAULT_INJECTION: forcing a failure. [ 414.318582][T10478] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 414.348707][T10478] CPU: 1 UID: 0 PID: 10478 Comm: syz.2.1217 Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 PREEMPT(full) [ 414.348728][T10478] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 414.348736][T10478] Call Trace: [ 414.348741][T10478] [ 414.348746][T10478] dump_stack_lvl+0x189/0x250 [ 414.348766][T10478] ? __pfx____ratelimit+0x10/0x10 [ 414.348783][T10478] ? __pfx_dump_stack_lvl+0x10/0x10 [ 414.348797][T10478] ? __pfx__printk+0x10/0x10 [ 414.348813][T10478] ? __might_fault+0xb0/0x130 [ 414.348836][T10478] should_fail_ex+0x414/0x560 [ 414.348854][T10478] _copy_to_iter+0x575/0x16f0 [ 414.348873][T10478] ? __pfx__copy_to_iter+0x10/0x10 [ 414.348883][T10478] ? __skb_try_recv_from_queue+0x2b2/0x730 [ 414.348900][T10478] ? __skb_try_recv_datagram+0x3da/0x4e0 [ 414.348917][T10478] __skb_datagram_iter+0xf8/0x990 [ 414.348931][T10478] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 414.348949][T10478] skb_copy_datagram_iter+0xc5/0x230 [ 414.348965][T10478] netlink_recvmsg+0x2ab/0xa30 [ 414.348989][T10478] ? __pfx_netlink_recvmsg+0x10/0x10 [ 414.349011][T10478] ? aa_sock_msg_perm+0xf1/0x1d0 [ 414.349029][T10478] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 414.349042][T10478] ? security_socket_recvmsg+0x7e/0x2e0 [ 414.349055][T10478] ? __pfx_netlink_recvmsg+0x10/0x10 [ 414.349071][T10478] sock_recvmsg+0x22c/0x270 [ 414.349088][T10478] ____sys_recvmsg+0x1c9/0x460 [ 414.349106][T10478] ? __pfx_____sys_recvmsg+0x10/0x10 [ 414.349127][T10478] ? import_iovec+0x74/0xa0 [ 414.349142][T10478] ___sys_recvmsg+0x1b5/0x510 [ 414.349158][T10478] ? __pfx____sys_recvmsg+0x10/0x10 [ 414.349185][T10478] ? __fget_files+0x3a0/0x420 [ 414.349209][T10478] do_recvmmsg+0x307/0x770 [ 414.349227][T10478] ? __pfx_do_recvmmsg+0x10/0x10 [ 414.349247][T10478] ? _copy_from_user+0x94/0xb0 [ 414.349270][T10478] __x64_sys_recvmmsg+0x1af/0x240 [ 414.349292][T10478] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 414.349303][T10478] ? rcu_is_watching+0x15/0xb0 [ 414.349318][T10478] ? do_syscall_64+0xbe/0x3b0 [ 414.349336][T10478] do_syscall_64+0xfa/0x3b0 [ 414.349352][T10478] ? lockdep_hardirqs_on+0x9c/0x150 [ 414.349366][T10478] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.349378][T10478] ? clear_bhb_loop+0x60/0xb0 [ 414.349392][T10478] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.349403][T10478] RIP: 0033:0x7fcb0658ebe9 [ 414.349415][T10478] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 414.349426][T10478] RSP: 002b:00007fcb07420038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 414.349441][T10478] RAX: ffffffffffffffda RBX: 00007fcb067b5fa0 RCX: 00007fcb0658ebe9 [ 414.349450][T10478] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 414.349458][T10478] RBP: 00007fcb07420090 R08: 0000200000003700 R09: 0000000000000000 [ 414.349465][T10478] R10: 0000000002040000 R11: 0000000000000246 R12: 0000000000000001 [ 414.349473][T10478] R13: 00007fcb067b6038 R14: 00007fcb067b5fa0 R15: 00007fcb068dfa28 [ 414.349491][T10478] [ 414.929702][T10481] batadv_slave_0: left promiscuous mode [ 414.938606][T10481] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 415.057416][T10481] vti0: left promiscuous mode [ 415.062265][T10481] vti0: left allmulticast mode [ 415.071514][ T1143] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.090815][ T1143] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.101424][ T1143] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.119512][ T1143] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.927198][ T5866] Bluetooth: hci4: command 0x0405 tx timeout [ 416.088763][T10464] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 416.095032][ T5866] Bluetooth: hci0: command 0x0406 tx timeout [ 416.728739][T10464] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 416.735307][T10464] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 416.741543][T10464] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 416.748106][T10464] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 416.755079][T10464] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 416.766240][T10464] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 417.025255][ T5956] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 417.064253][T10516] FAULT_INJECTION: forcing a failure. [ 417.064253][T10516] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 417.085635][T10516] CPU: 1 UID: 0 PID: 10516 Comm: syz.0.1229 Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 PREEMPT(full) [ 417.085667][T10516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 417.085679][T10516] Call Trace: [ 417.085688][T10516] [ 417.085697][T10516] dump_stack_lvl+0x189/0x250 [ 417.085727][T10516] ? __pfx____ratelimit+0x10/0x10 [ 417.085755][T10516] ? __pfx_dump_stack_lvl+0x10/0x10 [ 417.085778][T10516] ? __pfx__printk+0x10/0x10 [ 417.085808][T10516] ? fs_reclaim_acquire+0x7d/0x100 [ 417.085848][T10516] should_fail_ex+0x414/0x560 [ 417.085880][T10516] prepare_alloc_pages+0x213/0x610 [ 417.085909][T10516] __alloc_frozen_pages_noprof+0x123/0x370 [ 417.085935][T10516] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 417.085967][T10516] ? policy_nodemask+0x27c/0x720 [ 417.085992][T10516] ? __lock_acquire+0xab9/0xd20 [ 417.086035][T10516] alloc_pages_mpol+0x232/0x4a0 [ 417.086069][T10516] vma_alloc_folio_noprof+0xe4/0x200 [ 417.086107][T10516] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 417.086167][T10516] folio_prealloc+0x30/0x180 [ 417.086197][T10516] __handle_mm_fault+0x2ab9/0x5440 [ 417.086242][T10516] ? __pfx___handle_mm_fault+0x10/0x10 [ 417.086292][T10516] ? find_vma+0xe7/0x160 [ 417.086316][T10516] ? __pfx_find_vma+0x10/0x10 [ 417.086344][T10516] handle_mm_fault+0x40a/0x8e0 [ 417.086383][T10516] do_user_addr_fault+0x764/0x1390 [ 417.086434][T10516] exc_page_fault+0x76/0xf0 [ 417.086472][T10516] asm_exc_page_fault+0x26/0x30 [ 417.086490][T10516] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 417.086512][T10516] Code: 0a 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 417.086529][T10516] RSP: 0018:ffffc9000ae974f8 EFLAGS: 00050202 [ 417.086549][T10516] RAX: ffff888021b30001 RBX: ffff888021b303e1 RCX: 0000000000000157 [ 417.086564][T10516] RDX: 0000000000000000 RSI: ffff888021b30421 RDI: 0000200000001000 [ 417.086577][T10516] RBP: ffffc9000ae97650 R08: ffff888021b30577 R09: 1ffff110043660ae [ 417.086601][T10516] R10: dffffc0000000000 R11: ffffed10043660af R12: dffffc0000000000 [ 417.086625][T10516] R13: 0000000000000197 R14: 00007ffffffff000 R15: 0000200000001157 [ 417.086660][T10516] _copy_to_iter+0x5f6/0x16f0 [ 417.086696][T10516] ? __pfx__copy_to_iter+0x10/0x10 [ 417.086712][T10516] ? __skb_try_recv_from_queue+0x2b2/0x730 [ 417.086742][T10516] ? __skb_try_recv_datagram+0x3da/0x4e0 [ 417.086771][T10516] __skb_datagram_iter+0xf8/0x990 [ 417.086794][T10516] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 417.086825][T10516] skb_copy_datagram_iter+0xc5/0x230 [ 417.086863][T10516] netlink_recvmsg+0x2ab/0xa30 [ 417.086902][T10516] ? __pfx_netlink_recvmsg+0x10/0x10 [ 417.086934][T10516] ? aa_sock_msg_perm+0xf1/0x1d0 [ 417.086964][T10516] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 417.086983][T10516] ? security_socket_recvmsg+0x7e/0x2e0 [ 417.087005][T10516] ? __pfx_netlink_recvmsg+0x10/0x10 [ 417.087033][T10516] sock_recvmsg+0x22c/0x270 [ 417.087063][T10516] ____sys_recvmsg+0x1c9/0x460 [ 417.087095][T10516] ? __pfx_____sys_recvmsg+0x10/0x10 [ 417.087132][T10516] ? import_iovec+0x74/0xa0 [ 417.087159][T10516] ___sys_recvmsg+0x1b5/0x510 [ 417.087187][T10516] ? __pfx____sys_recvmsg+0x10/0x10 [ 417.087234][T10516] ? __fget_files+0x3a0/0x420 [ 417.087274][T10516] do_recvmmsg+0x307/0x770 [ 417.087303][T10516] ? __pfx_do_recvmmsg+0x10/0x10 [ 417.087337][T10516] ? _copy_from_user+0x94/0xb0 [ 417.087379][T10516] __x64_sys_recvmmsg+0x1af/0x240 [ 417.087405][T10516] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 417.087425][T10516] ? rcu_is_watching+0x15/0xb0 [ 417.087461][T10516] ? do_syscall_64+0xbe/0x3b0 [ 417.087493][T10516] do_syscall_64+0xfa/0x3b0 [ 417.087518][T10516] ? lockdep_hardirqs_on+0x9c/0x150 [ 417.087543][T10516] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.087563][T10516] ? clear_bhb_loop+0x60/0xb0 [ 417.087588][T10516] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.087607][T10516] RIP: 0033:0x7fa308b8ebe9 [ 417.087625][T10516] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 417.087641][T10516] RSP: 002b:00007fa309952038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 417.087661][T10516] RAX: ffffffffffffffda RBX: 00007fa308db5fa0 RCX: 00007fa308b8ebe9 [ 417.087675][T10516] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 417.087688][T10516] RBP: 00007fa309952090 R08: 0000200000003700 R09: 0000000000000000 [ 417.087701][T10516] R10: 0000000002040000 R11: 0000000000000246 R12: 0000000000000001 [ 417.087714][T10516] R13: 00007fa308db6038 R14: 00007fa308db5fa0 R15: 00007fa308edfa28 [ 417.087747][T10516] [ 417.645074][ T24] usb 3-1: new full-speed USB device number 52 using dummy_hcd [ 418.054146][T10510] vlan4: entered promiscuous mode [ 418.253900][ T5863] Bluetooth: hci2: command 0x0406 tx timeout [ 418.392250][ T24] usb 3-1: unable to get BOS descriptor or descriptor too short [ 418.408210][ T24] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 418.475184][ T5956] usb 6-1: new low-speed USB device number 9 using dummy_hcd [ 418.497410][ T24] usb 3-1: can't read configurations, error -71 [ 418.679076][ T5956] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 418.760551][ T5956] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 418.814936][ T5863] Bluetooth: hci4: command 0x0405 tx timeout [ 418.821031][ T5866] Bluetooth: hci1: command 0x0405 tx timeout [ 418.821091][ T5873] Bluetooth: hci3: command 0x0406 tx timeout [ 418.836170][ T5956] usb 6-1: New USB device found, idVendor=258a, idProduct=0036, bcdDevice= 0.00 [ 418.861495][ T5956] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.887314][ T5956] usb 6-1: config 0 descriptor?? [ 419.413038][ T5956] glorious 0003:258A:0036.000F: item fetching failed at offset 0/2 [ 419.499988][ T5956] glorious 0003:258A:0036.000F: probe with driver glorious failed with error -22 [ 419.803087][ T10] dvb-usb: did not find the firmware file 'dvb-usb-wt220u-zl0353-01.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 419.974738][ T10] dvb-usb: found a 'WideView WT-220U PenType Receiver (based on ZL353)' in cold state, will try to load a firmware [ 420.225166][ T10] usb 1-1: Direct firmware load for dvb-usb-wt220u-zl0353-01.fw failed with error -2 [ 420.336064][T10552] loop4: detected capacity change from 0 to 7 [ 420.374686][ T10] usb 1-1: Falling back to sysfs fallback for: dvb-usb-wt220u-zl0353-01.fw [ 420.375302][T10552] Dev loop4: unable to read RDB block 7 [ 420.400025][T10552] loop4: unable to read partition table [ 420.411971][T10552] loop4: partition table beyond EOD, truncated [ 420.735340][T10552] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 420.915229][ T5873] Bluetooth: hci4: command 0x0405 tx timeout [ 421.694726][T10567] binder: 10566:10567 ioctl 4008744b 2000000002c0 returned -22 [ 421.782328][T10567] binder: 10566:10567 ioctl 2203 200000000100 returned -22 [ 421.821604][T10567] binder: 10566:10567 ioctl c020aa00 200000000000 returned -22 [ 421.872971][T10568] binder: 10566:10568 ioctl 8933 200000000280 returned -22 [ 422.965287][ T5873] Bluetooth: hci4: command 0x0405 tx timeout [ 423.191243][T10528] syz.5.1231 (10528): drop_caches: 2 [ 423.436607][T10595] tipc: Enabled bearer , priority 0 [ 423.469287][T10595] syzkaller0: entered promiscuous mode [ 423.486413][T10595] syzkaller0: entered allmulticast mode [ 423.523149][ T5196] usb 6-1: USB disconnect, device number 9 [ 423.526495][T10595] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 423.633230][T10594] tipc: Resetting bearer [ 423.774032][T10594] tipc: Disabling bearer [ 424.192792][T10609] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1256'. [ 425.285105][ T5863] Bluetooth: hci4: command 0x0405 tx timeout [ 425.375070][ T5956] usb 3-1: new full-speed USB device number 54 using dummy_hcd [ 425.535238][ T5956] usb 3-1: device descriptor read/64, error -71 [ 425.865124][ T24] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 425.876287][ T5956] usb 3-1: new full-speed USB device number 55 using dummy_hcd [ 426.114990][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 426.134959][ T5956] usb 3-1: device descriptor read/64, error -71 [ 426.299005][ T5956] usb usb3-port1: attempt power cycle [ 426.315718][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 426.336474][ T24] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 426.362208][ T24] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 426.462653][ T24] usb 5-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 426.547347][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.574923][ T24] usb 5-1: Product: syz [ 426.579911][ T24] usb 5-1: Manufacturer: syz [ 426.584575][ T24] usb 5-1: SerialNumber: syz [ 426.604685][ T24] usb 5-1: config 0 descriptor?? [ 426.622677][T10629] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 426.654997][ T5956] usb 3-1: new full-speed USB device number 56 using dummy_hcd [ 426.697796][ T24] mcba_usb 5-1:0.0 can0: failed tx_urb -90 [ 426.705571][ T24] mcba_usb 5-1:0.0 can0: Failed to send cmd (169) [ 426.712558][ T5956] usb 3-1: device descriptor read/8, error -71 [ 426.719317][ T24] mcba_usb 5-1:0.0 can0: failed tx_urb -90 [ 426.725957][ T24] mcba_usb 5-1:0.0 can0: Failed to send cmd (169) [ 426.733811][ T24] mcba_usb 5-1:0.0: Microchip CAN BUS Analyzer connected [ 427.164918][ T5956] usb 3-1: new full-speed USB device number 57 using dummy_hcd [ 427.217970][ T5956] usb 3-1: device descriptor read/8, error -71 [ 427.252161][T10635] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1262'. [ 427.264079][T10635] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1262'. [ 427.345063][ T5956] usb usb3-port1: unable to enumerate USB device [ 427.526201][T10645] netlink: 180 bytes leftover after parsing attributes in process `syz.5.1264'. [ 428.017647][ T5956] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 428.059913][T10660] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1268'. [ 428.265396][ T5956] usb 6-1: Using ep0 maxpacket: 8 [ 428.274608][ T5956] usb 6-1: unable to get BOS descriptor or descriptor too short [ 428.408514][ T5956] usb 6-1: config 5 has an invalid descriptor of length 128, skipping remainder of the config [ 428.442906][ T5956] usb 6-1: config 5 has 0 interfaces, different from the descriptor's value: 1 [ 428.495169][ T5956] usb 6-1: New USB device found, idVendor=0e41, idProduct=4159, bcdDevice=6b.5b [ 428.523535][ T5956] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.562173][ T5956] usb 6-1: Product: syz [ 428.569790][ T5956] usb 6-1: Manufacturer: syz [ 428.584653][ T5956] usb 6-1: SerialNumber: syz [ 429.030091][ T5956] usb 6-1: USB disconnect, device number 10 [ 430.020715][ T5956] usb 5-1: USB disconnect, device number 51 [ 430.028302][ T5956] mcba_usb 5-1:0.0 can0: device disconnected [ 430.613566][T10687] ptrace attach of "./syz-executor exec"[5877] was attempted by "./syz-executor exec"[10687] [ 431.495299][T10700] netlink: 180 bytes leftover after parsing attributes in process `syz.4.1276'. [ 432.961704][T10719] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1280'. [ 433.569484][T10714] delete_channel: no stack [ 433.834982][ T9] usb 2-1: new low-speed USB device number 63 using dummy_hcd [ 433.869677][T10729] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1281'. [ 434.045202][ T9] usb 2-1: config 0 has an invalid interface number: 192 but max is 0 [ 434.054923][ T9] usb 2-1: config 0 has no interface number 0 [ 434.071804][ T9] usb 2-1: config 0 interface 192 has no altsetting 0 [ 434.081933][ T9] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 434.102171][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 434.148854][ T9] usb 2-1: config 0 descriptor?? [ 434.422987][ T9] usb 2-1: string descriptor 0 read error: -71 [ 434.430841][ T9] asix 2-1:0.192 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 434.463560][ T9] asix 2-1:0.192: probe with driver asix failed with error -71 [ 434.484147][ T9] usb 2-1: USB disconnect, device number 63 [ 434.582309][T10745] loop6: detected capacity change from 0 to 7 [ 434.596420][T10745] Dev loop6: unable to read RDB block 7 [ 434.603996][T10745] loop6: unable to read partition table [ 434.611121][T10745] loop6: partition table beyond EOD, truncated [ 434.623753][T10745] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 434.997262][T10754] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1289'. [ 436.396801][T10777] FAULT_INJECTION: forcing a failure. [ 436.396801][T10777] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 436.462339][T10777] CPU: 0 UID: 0 PID: 10777 Comm: syz.2.1296 Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 PREEMPT(full) [ 436.462372][T10777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 436.462385][T10777] Call Trace: [ 436.462393][T10777] [ 436.462402][T10777] dump_stack_lvl+0x189/0x250 [ 436.462433][T10777] ? __pfx____ratelimit+0x10/0x10 [ 436.462461][T10777] ? __pfx_dump_stack_lvl+0x10/0x10 [ 436.462485][T10777] ? __pfx__printk+0x10/0x10 [ 436.462529][T10777] should_fail_ex+0x414/0x560 [ 436.462567][T10777] _copy_to_user+0x31/0xb0 [ 436.462593][T10777] move_addr_to_user+0x146/0x200 [ 436.462625][T10777] ____sys_recvmsg+0x228/0x460 [ 436.462657][T10777] ? __pfx_____sys_recvmsg+0x10/0x10 [ 436.462697][T10777] ? import_iovec+0x74/0xa0 [ 436.462724][T10777] ___sys_recvmsg+0x1b5/0x510 [ 436.462750][T10777] ? __pfx____sys_recvmsg+0x10/0x10 [ 436.462799][T10777] ? __fget_files+0x3a0/0x420 [ 436.462842][T10777] do_recvmmsg+0x307/0x770 [ 436.462874][T10777] ? __pfx_do_recvmmsg+0x10/0x10 [ 436.462911][T10777] ? _copy_from_user+0x94/0xb0 [ 436.462952][T10777] __x64_sys_recvmmsg+0x1af/0x240 [ 436.462978][T10777] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 436.462997][T10777] ? rcu_is_watching+0x15/0xb0 [ 436.463024][T10777] ? do_syscall_64+0xbe/0x3b0 [ 436.463056][T10777] do_syscall_64+0xfa/0x3b0 [ 436.463081][T10777] ? lockdep_hardirqs_on+0x9c/0x150 [ 436.463106][T10777] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.463127][T10777] ? clear_bhb_loop+0x60/0xb0 [ 436.463151][T10777] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.463170][T10777] RIP: 0033:0x7fcb0658ebe9 [ 436.463189][T10777] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 436.463207][T10777] RSP: 002b:00007fcb07420038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 436.463230][T10777] RAX: ffffffffffffffda RBX: 00007fcb067b5fa0 RCX: 00007fcb0658ebe9 [ 436.463246][T10777] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 436.463259][T10777] RBP: 00007fcb07420090 R08: 0000200000003700 R09: 0000000000000000 [ 436.463273][T10777] R10: 0000000002040000 R11: 0000000000000246 R12: 0000000000000002 [ 436.463286][T10777] R13: 00007fcb067b6038 R14: 00007fcb067b5fa0 R15: 00007fcb068dfa28 [ 436.463328][T10777] [ 437.370281][T10795] : entered promiscuous mode [ 437.543329][T10799] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1298'. [ 437.573555][T10798] sch_tbf: burst 12 is lower than device syzkaller0 mtu (1514) ! [ 437.596054][T10799] netlink: ct family unspecified [ 437.601926][T10799] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 437.628551][T10797] tipc: Enabled bearer , priority 0 [ 437.695489][T10797] syzkaller0: entered promiscuous mode [ 437.701196][T10797] syzkaller0: entered allmulticast mode [ 437.747458][T10797] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1303'. [ 437.760725][T10797] tipc: Resetting bearer [ 438.516016][T10792] tipc: Resetting bearer [ 438.601735][T10792] tipc: Disabling bearer [ 440.263543][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.270175][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.365411][ T5956] usb 3-1: new low-speed USB device number 58 using dummy_hcd [ 440.396088][ T5948] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 440.549795][ T5956] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 440.561798][ T5956] usb 3-1: config 0 has no interface number 0 [ 440.573045][ T5956] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 440.598992][ T5956] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 440.609989][ T5948] usb 6-1: Using ep0 maxpacket: 8 [ 440.619615][ T5948] usb 6-1: config index 0 descriptor too short (expected 30, got 18) [ 440.634576][ T5956] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 440.658944][ T5948] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 440.673369][ T5948] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.683294][ T5956] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 440.703624][ T5948] usb 6-1: Product: syz [ 440.712447][ T5956] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 440.723573][ T5948] usb 6-1: Manufacturer: syz [ 440.732588][ T5948] usb 6-1: SerialNumber: syz [ 441.001233][ T5956] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 441.015292][ T5956] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 441.026372][ T5948] usb 6-1: config 0 descriptor?? [ 441.032506][ T5956] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.042516][ T5948] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 441.050923][ T5948] usb 6-1: setting power ON [ 441.055664][ T5948] dvb-usb: bulk message failed: -22 (2/0) [ 441.069294][ T5956] usb 3-1: config 0 descriptor?? [ 441.078915][ T5948] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 441.093404][T10834] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 441.100976][T10834] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 441.121493][ T5948] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 441.130582][ T5948] usb 6-1: media controller created [ 441.164688][ T5956] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 441.252360][T10838] dvb-usb: bulk message failed: -22 (3/0) [ 441.259141][T10838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 441.268066][T10838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 441.280233][ T5948] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 441.371484][ T5948] usb 6-1: selecting invalid altsetting 6 [ 441.384201][T10831] ldusb 3-1:0.55: Write buffer overflow, 1 bytes dropped [ 441.399622][ T5948] usb 6-1: digital interface selection failed (-22) [ 441.413723][ T5948] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 441.468759][ T5948] usb 6-1: setting power OFF [ 441.473624][ T5948] dvb-usb: bulk message failed: -22 (2/0) [ 441.480581][ T5948] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 441.500418][ T5948] (NULL device *): no alternate interface [ 441.605753][ T5948] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 441.633566][ T5948] usb 6-1: USB disconnect, device number 11 [ 441.685197][ T9] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 441.879310][ T9] usb 5-1: config 0 has no interfaces? [ 441.946058][ T9] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 441.969145][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 441.999263][ T9] usb 5-1: Product: syz [ 442.016734][ T9] usb 5-1: Manufacturer: syz [ 442.030112][ T9] usb 5-1: SerialNumber: syz [ 442.049075][ T9] usb 5-1: config 0 descriptor?? [ 442.076897][T10850] IPVS: set_ctl: invalid protocol: 41 127.0.0.1:20000 [ 442.449150][T10846] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 442.697361][T10846] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 442.989546][ T9] usb 3-1: USB disconnect, device number 58 [ 443.011716][ T9] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 443.178105][T10863] FAULT_INJECTION: forcing a failure. [ 443.178105][T10863] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 443.195189][T10863] CPU: 0 UID: 0 PID: 10863 Comm: syz.1.1322 Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 PREEMPT(full) [ 443.195220][T10863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 443.195233][T10863] Call Trace: [ 443.195241][T10863] [ 443.195257][T10863] dump_stack_lvl+0x189/0x250 [ 443.195287][T10863] ? __pfx____ratelimit+0x10/0x10 [ 443.195316][T10863] ? __pfx_dump_stack_lvl+0x10/0x10 [ 443.195340][T10863] ? __pfx__printk+0x10/0x10 [ 443.195383][T10863] should_fail_ex+0x414/0x560 [ 443.195415][T10863] _copy_to_user+0x31/0xb0 [ 443.195439][T10863] move_addr_to_user+0x146/0x200 [ 443.195471][T10863] ____sys_recvmsg+0x228/0x460 [ 443.195503][T10863] ? __pfx_____sys_recvmsg+0x10/0x10 [ 443.195542][T10863] ? import_iovec+0x74/0xa0 [ 443.195569][T10863] ___sys_recvmsg+0x1b5/0x510 [ 443.195597][T10863] ? __pfx____sys_recvmsg+0x10/0x10 [ 443.195646][T10863] ? __fget_files+0x3a0/0x420 [ 443.195688][T10863] do_recvmmsg+0x307/0x770 [ 443.195719][T10863] ? __pfx_do_recvmmsg+0x10/0x10 [ 443.195755][T10863] ? _copy_from_user+0x94/0xb0 [ 443.195814][T10863] __x64_sys_recvmmsg+0x1af/0x240 [ 443.195838][T10863] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 443.195858][T10863] ? rcu_is_watching+0x15/0xb0 [ 443.195883][T10863] ? do_syscall_64+0xbe/0x3b0 [ 443.195915][T10863] do_syscall_64+0xfa/0x3b0 [ 443.195939][T10863] ? lockdep_hardirqs_on+0x9c/0x150 [ 443.195964][T10863] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.195984][T10863] ? clear_bhb_loop+0x60/0xb0 [ 443.196007][T10863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.196027][T10863] RIP: 0033:0x7fbbd118ebe9 [ 443.196045][T10863] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 443.196068][T10863] RSP: 002b:00007fbbd1f89038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 443.196091][T10863] RAX: ffffffffffffffda RBX: 00007fbbd13b5fa0 RCX: 00007fbbd118ebe9 [ 443.196104][T10863] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 443.196117][T10863] RBP: 00007fbbd1f89090 R08: 0000200000003700 R09: 0000000000000000 [ 443.196130][T10863] R10: 0000000002040000 R11: 0000000000000246 R12: 0000000000000002 [ 443.196142][T10863] R13: 00007fbbd13b6038 R14: 00007fbbd13b5fa0 R15: 00007fbbd14dfa28 [ 443.196175][T10863] [ 443.435023][ T5956] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 443.605220][ T5956] usb 6-1: Using ep0 maxpacket: 8 [ 443.625705][ T5956] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 443.751805][ T5956] usb 6-1: New USB device found, idVendor=1b1c, idProduct=1b09, bcdDevice= 0.00 [ 443.857959][ T5956] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 443.937201][T10876] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1324'. [ 443.969680][ T5956] usb 6-1: config 0 descriptor?? [ 444.228692][T10880] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 444.250373][ T9] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 444.413713][ T5956] corsair 0003:1B1C:1B09.0010: unbalanced delimiter at end of report description [ 444.434003][ T24] usb 5-1: USB disconnect, device number 52 [ 444.522785][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 444.540193][T10882] CIFS: VFS: Malformed UNC in devname [ 444.788215][ T9] usb 2-1: config 8 has an invalid interface number: 109 but max is 1 [ 444.828922][ T5956] corsair 0003:1B1C:1B09.0010: parse failed [ 444.845053][ T9] usb 2-1: config 8 has an invalid interface number: 255 but max is 1 [ 444.888036][ T5956] corsair 0003:1B1C:1B09.0010: probe with driver corsair failed with error -22 [ 444.892642][ T9] usb 2-1: config 8 has no interface number 0 [ 444.920824][ T9] usb 2-1: config 8 has no interface number 1 [ 444.957218][ T9] usb 2-1: config 8 interface 109 altsetting 6 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 445.030193][ T9] usb 2-1: config 8 interface 255 altsetting 1 has a duplicate endpoint with address 0x1, skipping [ 445.066976][ T9] usb 2-1: config 8 interface 255 altsetting 1 bulk endpoint 0x8A has invalid maxpacket 1024 [ 445.087282][ T9] usb 2-1: config 8 interface 255 altsetting 1 bulk endpoint 0xB has invalid maxpacket 1023 [ 445.108066][ T9] usb 2-1: config 8 interface 255 altsetting 1 endpoint 0x8 has invalid wMaxPacketSize 0 [ 445.135831][ T9] usb 2-1: config 8 interface 109 has no altsetting 0 [ 445.151408][ T9] usb 2-1: config 8 interface 255 has no altsetting 0 [ 445.173313][ T9] usb 2-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=b3.c4 [ 445.183069][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.191282][ T9] usb 2-1: Product: syz [ 445.200080][ T9] usb 2-1: Manufacturer: syz [ 445.212446][ T9] usb 2-1: SerialNumber: syz [ 445.273365][T10887] hsr0: entered promiscuous mode [ 446.531698][ T5196] usb 6-1: USB disconnect, device number 12 [ 447.731498][T10915] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1335'. [ 447.762103][T10915] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1335'. [ 447.798568][ T9] ssu100 2-1:8.109: Quatech SSU-100 USB to Serial Driver converter detected [ 447.808275][ T9] ssu100 2-1:8.109: probe with driver ssu100 failed with error -71 [ 447.867025][ T9] ssu100 2-1:8.255: Quatech SSU-100 USB to Serial Driver converter detected [ 447.881735][T10915] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1335'. [ 447.884039][ T36] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 447.903783][ T9] ssu100 2-1:8.255: probe with driver ssu100 failed with error -71 [ 447.936922][T10915] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1335'. [ 447.950182][ T36] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 447.969312][ T36] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 447.992498][ T36] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 448.013310][ T9] usb 2-1: USB disconnect, device number 64 [ 449.954070][T10940] erspan1: entered promiscuous mode [ 450.081082][T10941] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (13) [ 450.112218][T10947] netlink: 180 bytes leftover after parsing attributes in process `syz.2.1343'. [ 450.525471][ T5956] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 450.629932][T10957] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1346'. [ 450.676895][ T5956] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 450.691123][ T5956] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 450.701482][ T5956] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 450.739172][ T5956] usb 6-1: New USB device found, idVendor=0079, idProduct=0011, bcdDevice= 0.00 [ 450.757049][ T5956] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.776792][ T5956] usb 6-1: config 0 descriptor?? [ 450.904962][ T5196] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 451.054890][ T5196] usb 3-1: Using ep0 maxpacket: 16 [ 451.067409][ T5196] usb 3-1: config 8 has an invalid interface number: 109 but max is 1 [ 451.084769][ T5196] usb 3-1: config 8 has an invalid interface number: 255 but max is 1 [ 451.102782][ T5196] usb 3-1: config 8 has no interface number 0 [ 451.118783][ T5196] usb 3-1: config 8 has no interface number 1 [ 451.127001][ T5196] usb 3-1: config 8 interface 109 altsetting 6 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 451.150067][ T5196] usb 3-1: config 8 interface 255 altsetting 1 has a duplicate endpoint with address 0x1, skipping [ 451.170409][ T5196] usb 3-1: config 8 interface 255 altsetting 1 bulk endpoint 0x8A has invalid maxpacket 1024 [ 451.181714][ T5196] usb 3-1: config 8 interface 255 altsetting 1 bulk endpoint 0xB has invalid maxpacket 1023 [ 451.188055][ T5956] usbhid 6-1:0.0: can't add hid device: -71 [ 451.199700][ T5956] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 451.203773][ T5196] usb 3-1: config 8 interface 255 altsetting 1 endpoint 0x8 has invalid wMaxPacketSize 0 [ 451.229896][ T5196] usb 3-1: config 8 interface 109 has no altsetting 0 [ 451.244344][ T5956] usb 6-1: USB disconnect, device number 13 [ 451.268785][ T5196] usb 3-1: config 8 interface 255 has no altsetting 0 [ 451.280794][ T5196] usb 3-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=b3.c4 [ 451.300626][ T5196] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.311234][ T5196] usb 3-1: Product: syz [ 451.340091][ T5196] usb 3-1: Manufacturer: syz [ 451.344732][ T5196] usb 3-1: SerialNumber: syz [ 452.715393][ T9] usb 6-1: new full-speed USB device number 14 using dummy_hcd [ 452.735052][ T5956] usb 2-1: new full-speed USB device number 65 using dummy_hcd [ 452.900291][T10959] dummy0: entered promiscuous mode [ 452.910580][T10959] vlan2: entered promiscuous mode [ 453.287460][ T5956] usb 2-1: config 0 has an invalid descriptor of length 64, skipping remainder of the config [ 453.298702][ T5956] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 453.339157][ T5956] usb 2-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00 [ 453.453075][ T5867] usb 5-1: new low-speed USB device number 53 using dummy_hcd [ 453.502423][ T5956] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 453.542881][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 453.569633][ T9] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 453.587519][ T9] usb 6-1: can't read configurations, error -71 [ 453.598530][ T5956] usb 2-1: config 0 descriptor?? [ 453.637962][ T5867] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 453.665905][ T5196] ssu100 3-1:8.109: Quatech SSU-100 USB to Serial Driver converter detected [ 453.677979][ T5867] usb 5-1: config 0 has no interface number 0 [ 453.693025][ T5867] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 453.710408][ T5196] ssu100 3-1:8.109: probe with driver ssu100 failed with error -71 [ 453.720470][ T5867] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 453.744221][ T5867] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 453.758717][ T5196] ssu100 3-1:8.255: Quatech SSU-100 USB to Serial Driver converter detected [ 453.774849][ T5867] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 453.803418][ T5196] ssu100 3-1:8.255: probe with driver ssu100 failed with error -71 [ 453.818956][ T5867] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 453.852015][ T5867] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 453.867637][ T5196] usb 3-1: USB disconnect, device number 59 [ 453.905043][ T5867] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 453.905080][ T5867] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 453.908565][ T5867] usb 5-1: config 0 descriptor?? [ 453.910101][T10972] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 453.910257][T10972] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 453.954746][ T5867] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 454.636097][T10971] ldusb 5-1:0.55: Write buffer overflow, 1 bytes dropped [ 455.844426][T10992] netlink: 180 bytes leftover after parsing attributes in process `syz.5.1356'. [ 455.895769][ T9] usb 5-1: USB disconnect, device number 53 [ 456.057924][ T9] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 457.086312][ T9] usb 2-1: USB disconnect, device number 65 [ 457.757509][ T9] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 458.068384][T11024] netlink: 180 bytes leftover after parsing attributes in process `syz.0.1368'. [ 458.205044][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 458.744329][ T30] audit: type=1326 audit(1754797637.591:690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11029 comm="syz.2.1370" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fcb0658ebe9 code=0x0 [ 458.848137][ T5956] usb 6-1: new low-speed USB device number 16 using dummy_hcd [ 459.040066][ T5956] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 459.049039][ T5956] usb 6-1: config 0 has no interface number 0 [ 459.415083][ T5956] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 459.426341][ T5956] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 459.438026][ T5956] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 459.450477][ T5956] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 459.476465][ T5956] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 459.501370][ T5956] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 459.518635][ T5956] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 459.528381][ T5956] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 459.542956][ T5956] usb 6-1: config 0 descriptor?? [ 459.555809][T11026] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 459.575207][T11026] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 459.596381][ T5956] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 459.596980][ T5867] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 459.797038][T11025] ldusb 6-1:0.55: Write buffer overflow, 1 bytes dropped [ 459.807401][ T5867] usb 5-1: Using ep0 maxpacket: 32 [ 459.853532][ T5867] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 459.897925][ T5867] usb 5-1: config 0 has no interface number 0 [ 460.090008][ T5867] usb 5-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 460.139443][ T5867] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.190620][ T5867] usb 5-1: Product: syz [ 460.231290][ T5867] usb 5-1: Manufacturer: syz [ 460.265085][ T5867] usb 5-1: SerialNumber: syz [ 460.309412][ T5867] usb 5-1: config 0 descriptor?? [ 460.551444][ T5867] usb 5-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 460.561589][ T5867] usb 5-1: selecting invalid altsetting 1 [ 460.568101][ T5867] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 460.590003][ T5867] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 460.601201][ T5867] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 460.637362][ T5867] usb 5-1: media controller created [ 460.884277][T11036] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1371'. [ 460.945254][ T5867] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 461.034161][ T5948] usb 6-1: USB disconnect, device number 16 [ 461.115903][ T5948] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 461.226398][ T5867] usb 5-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 461.470229][ T5867] zl10353_read_register: readreg error (reg=127, ret==-71) [ 461.485534][ T5867] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 461.663155][ T5867] usb 5-1: USB disconnect, device number 54 [ 461.907410][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 461.951976][ T9] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 461.984254][ T9] usb 2-1: can't read configurations, error -71 [ 462.273703][T11059] syzkaller1: entered promiscuous mode [ 462.312304][T11059] syzkaller1: entered allmulticast mode [ 462.485596][ T9] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 462.835198][ T5867] usb 6-1: new low-speed USB device number 17 using dummy_hcd [ 462.891495][ T9] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 462.902689][ T9] usb 2-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 462.925428][ T9] usb 2-1: config 220 interface 0 has no altsetting 0 [ 462.949273][ T9] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 462.958710][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.972972][ T9] usb 2-1: Product: syz [ 462.980157][ T9] usb 2-1: Manufacturer: syz [ 462.985320][ T9] usb 2-1: SerialNumber: syz [ 463.076636][ T5867] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 463.089265][ T5867] usb 6-1: config 0 has no interfaces? [ 463.117575][ T5867] usb 6-1: New USB device found, idVendor=12d1, idProduct=42f7, bcdDevice=aa.47 [ 463.237775][ T5867] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 463.268428][ T9] usb 2-1: Found UVC 0.00 device syz (8086:0b07) [ 463.277212][ T9] usb 2-1: No valid video chain found. [ 463.307698][ T5867] usb 6-1: config 0 descriptor?? [ 463.355452][ T9] usb 2-1: USB disconnect, device number 67 [ 463.751700][T11077] overlayfs: missing 'lowerdir' [ 463.836609][ T5956] usb 6-1: USB disconnect, device number 17 [ 463.951493][T11087] binder: 11084:11087 ioctl c00c620f 200000000040 returned -22 [ 464.205496][ T5867] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 464.411744][ T5867] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 464.634940][ T5927] usb 5-1: new low-speed USB device number 55 using dummy_hcd [ 464.636665][ T5867] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 0 [ 464.676867][ T5867] usb 2-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=9e.7f [ 464.691065][ T5867] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.700315][ T5867] usb 2-1: Product: syz [ 464.704634][ T5867] usb 2-1: Manufacturer: syz [ 464.714525][ T5867] usb 2-1: SerialNumber: syz [ 464.750855][ T5867] usb 2-1: config 0 descriptor?? [ 464.762680][ T5867] redrat3 2-1:0.0: Couldn't find all endpoints [ 464.832993][ T5927] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 464.849302][ T5927] usb 5-1: config 0 has no interface number 0 [ 464.868107][ T5927] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 464.895051][ T5927] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 464.955024][ T5927] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 464.981480][ T5867] usb 2-1: USB disconnect, device number 68 [ 465.003087][ T5927] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 465.033933][ T5927] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 465.120727][ T5927] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 465.182170][ T5927] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 465.199003][ T5927] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.220551][ T5927] usb 5-1: config 0 descriptor?? [ 465.234384][T11086] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 465.260303][T11086] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 465.294982][ T5196] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 465.329153][ T5927] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 465.392473][T11101] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 465.404651][T11101] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 465.465119][ T5196] usb 3-1: Using ep0 maxpacket: 8 [ 465.472324][ T5196] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 465.487162][ T5196] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.503184][ T5196] pvrusb2: Hardware description: Terratec Grabster AV400 [ 465.522092][ T5196] pvrusb2: ********** [ 465.531282][ T5196] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 465.537944][T11086] ldusb 5-1:0.55: Write buffer overflow, 1 bytes dropped [ 465.564929][ T5196] pvrusb2: Important functionality might not be entirely working. [ 465.574175][ T5196] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 465.597518][ T5196] pvrusb2: ********** [ 465.708939][ T2343] pvrusb2: Invalid write control endpoint [ 466.188936][ T5927] usb 3-1: USB disconnect, device number 60 [ 466.296408][ T2343] pvrusb2: Invalid write control endpoint [ 466.362771][ T2343] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 466.552064][ T2343] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 466.560285][ T2343] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 466.572763][ T2343] pvrusb2: Device being rendered inoperable [ 466.579711][ T2343] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 466.590778][ T2343] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 466.623046][ T2343] pvrusb2: Attached sub-driver cx25840 [ 466.642392][ T2343] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 466.763246][ T2343] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 467.024709][ C1] ldusb 5-1:0.55: usb_submit_urb failed (-1) [ 467.037117][ T5196] usb 5-1: USB disconnect, device number 55 [ 467.141105][ T5196] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 467.957402][ C0] IPv4: Oversized IP packet from 172.20.20.24 [ 468.233415][T11140] veth1_macvtap: left promiscuous mode [ 468.239388][T11140] macsec0: entered promiscuous mode [ 468.246154][T11140] macsec0: entered allmulticast mode [ 470.243950][T11165] netlink: 'syz.4.1404': attribute type 1 has an invalid length. [ 470.483568][T11168] bond2: entered promiscuous mode [ 470.489001][T11168] bond2: entered allmulticast mode [ 470.495602][T11168] 8021q: adding VLAN 0 to HW filter on device bond2 [ 470.556089][T11165] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1404'. [ 472.104897][ T5948] usb 6-1: new low-speed USB device number 18 using dummy_hcd [ 472.385412][ T5948] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 472.404413][ T5948] usb 6-1: config 0 has no interface number 0 [ 472.417307][ T5948] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 472.540346][ T5948] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 472.813615][ T5948] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 472.895560][T11190] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1412'. [ 472.906192][ T5948] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 472.924968][ T5948] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 472.945114][ T5948] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 472.963164][ T5948] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 472.973045][ T5948] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 473.004426][ T5948] usb 6-1: config 0 descriptor?? [ 473.011660][T11185] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 473.090805][T11185] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 473.205344][ T5948] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 473.441723][T11180] ldusb 6-1:0.55: Write buffer overflow, 1 bytes dropped [ 473.445172][ T30] audit: type=1400 audit(1754797652.261:691): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=2626200D3AFFFFFFF2FFFFFFF2FFFFFFF2FFFFFFF2FFFFFFF2FFFFFF pid=11201 comm="syz.0.1416" [ 473.516598][T11205] netlink: 'syz.0.1416': attribute type 29 has an invalid length. [ 473.631744][T11205] bond0: (slave wlan1): Releasing backup interface [ 474.429237][T11218] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1421'. [ 474.665355][ T5948] usb 6-1: USB disconnect, device number 18 [ 474.686749][ T5948] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 475.181752][T11237] tipc: Enabled bearer , priority 10 [ 475.206893][T11236] tipc: Enabling of bearer rejected, already enabled [ 475.344952][ T5948] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 475.778878][ T5948] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 475.856235][ T5948] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 475.900842][ T5948] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 475.958752][T11252] netlink: 180 bytes leftover after parsing attributes in process `syz.4.1432'. [ 475.973313][ T5948] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.013365][T11234] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 476.027845][ T5948] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 476.126832][ T9] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 476.277095][T11234] fuse: Bad value for 'fd' [ 476.295938][ T5867] tipc: Node number set to 1 [ 476.327347][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 476.365135][ T9] usb 6-1: config 0 has no interfaces? [ 476.449884][ T9] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 476.461324][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.496092][ T9] usb 6-1: config 0 descriptor?? [ 476.566547][ T5867] usb 2-1: USB disconnect, device number 69 [ 476.694395][T11257] netlink: 'syz.2.1431': attribute type 2 has an invalid length. [ 476.742554][T11257] $Hÿ: renamed from bond0 (while UP) [ 477.313909][T11257] $Hÿ: entered promiscuous mode [ 477.322251][T11257] bond_slave_0: entered promiscuous mode [ 477.334145][T11257] bond_slave_1: entered promiscuous mode [ 477.685237][ T5867] usb 5-1: new low-speed USB device number 56 using dummy_hcd [ 478.174996][ T5867] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 478.183256][ T5867] usb 5-1: config 0 has no interface number 0 [ 478.195853][ T5867] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 478.211885][ T5867] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 478.223771][ T5867] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 478.374061][ T9] usb 6-1: string descriptor 0 read error: -71 [ 478.408498][ T9] usb 6-1: USB disconnect, device number 19 [ 478.414555][ T5867] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 478.433406][T11245] delete_channel: no stack [ 478.472387][ T5867] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 478.496160][ T5867] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 478.573809][T11268] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 478.617553][ T5867] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 478.649881][T11270] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 478.657782][ T5867] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 478.948344][ T5867] usb 5-1: config 0 descriptor?? [ 478.970695][T11262] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 478.978792][T11262] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 479.003122][ T5867] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 479.265294][T11260] ldusb 5-1:0.55: Write buffer overflow, 1 bytes dropped [ 479.282223][T11273] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1437'. [ 480.348409][ T24] usb 5-1: USB disconnect, device number 56 [ 480.366274][ T24] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 480.885053][ T5948] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 481.045335][ T5948] usb 5-1: Using ep0 maxpacket: 8 [ 481.055124][ T5948] usb 5-1: config 0 has an invalid interface number: 52 but max is 0 [ 481.063400][ T5948] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 481.222904][ T5948] usb 5-1: config 0 has no interface number 0 [ 481.229803][ T10] dvb-usb: did not find the firmware file 'dvb-usb-wt220u-zl0353-01.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 481.313457][ T10] dvb-usb: found a 'WideView WT-220U PenType Receiver (based on ZL353)' in cold state, will try to load a firmware [ 481.353145][ T5948] usb 5-1: config 0 interface 52 has no altsetting 0 [ 481.362529][ T10] usb 1-1: Direct firmware load for dvb-usb-wt220u-zl0353-01.fw failed with error -2 [ 481.438209][ T5948] usb 5-1: New USB device found, idVendor=06cb, idProduct=0007, bcdDevice= 8.00 [ 481.454854][ T5948] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.465216][ T10] usb 1-1: Falling back to sysfs fallback for: dvb-usb-wt220u-zl0353-01.fw [ 481.521289][ T5948] usb 5-1: config 0 descriptor?? [ 481.962408][T11287] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 481.973099][T11287] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 482.661741][ T5948] usb 6-1: new full-speed USB device number 20 using dummy_hcd [ 482.695503][T11303] block device autoloading is deprecated and will be removed. [ 482.855058][ T5948] usb 6-1: device descriptor read/64, error -71 [ 482.868447][ T5867] usb 5-1: USB disconnect, device number 57 [ 483.109518][ T5948] usb 6-1: new full-speed USB device number 21 using dummy_hcd [ 483.280969][ T5948] usb 6-1: device descriptor read/64, error -71 [ 483.632392][ T5948] usb usb6-port1: attempt power cycle [ 483.737404][T11320] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 483.746909][T11320] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 483.758253][T11320] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 483.766698][T11320] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 483.777258][T11320] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 483.974924][ T5948] usb 6-1: new full-speed USB device number 22 using dummy_hcd [ 484.335171][ T5948] usb 6-1: device descriptor read/8, error -71 [ 484.586954][ T5867] usb 5-1: new low-speed USB device number 58 using dummy_hcd [ 484.694991][ T5948] usb 6-1: new full-speed USB device number 23 using dummy_hcd [ 484.718483][ T5948] usb 6-1: device descriptor read/8, error -71 [ 484.783941][ T5867] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 484.799035][ T5867] usb 5-1: config 0 has no interface number 0 [ 484.815555][ T5867] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 484.836038][ T5948] usb usb6-port1: unable to enumerate USB device [ 484.869343][ T5867] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 484.923472][ T5867] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 484.982280][ T5867] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 485.022918][ T5867] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 485.058317][ T5867] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 485.094724][ T5867] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 485.122203][ T5867] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.170807][ T5867] usb 5-1: config 0 descriptor?? [ 485.195375][T11329] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 485.203049][T11329] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 485.242078][ T5867] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 485.504616][T11328] ldusb 5-1:0.55: Write buffer overflow, 1 bytes dropped [ 485.767051][ T5863] Bluetooth: hci2: command 0x0406 tx timeout [ 485.767059][ T5873] Bluetooth: hci0: command 0x0406 tx timeout [ 485.809873][ T5948] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 485.845241][ T5863] Bluetooth: hci4: command 0x0405 tx timeout [ 485.851442][ T5863] Bluetooth: hci1: command 0x0405 tx timeout [ 485.859654][ T5863] Bluetooth: hci3: command 0x0406 tx timeout [ 486.023814][ T5948] usb 6-1: Using ep0 maxpacket: 32 [ 486.043885][ T5948] usb 6-1: config 0 has an invalid interface number: 29 but max is 0 [ 486.064039][ T5948] usb 6-1: config 0 has no interface number 0 [ 486.091007][ T5948] usb 6-1: config 0 interface 29 has no altsetting 0 [ 486.148258][ T5948] usb 6-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 486.239185][ T5948] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.280881][ T5948] usb 6-1: Product: syz [ 486.324410][ T5948] usb 6-1: Manufacturer: syz [ 486.352293][ T5948] usb 6-1: SerialNumber: syz [ 486.406968][ T5948] usb 6-1: config 0 descriptor?? [ 486.620931][ T5948] peak_usb 6-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 486.822177][ T5948] peak_usb 6-1:0.29 can0: sending command failure: -8 [ 486.837467][ T5948] peak_usb 6-1:0.29 can0: sending command failure: -8 [ 486.908668][ T5948] peak_usb 6-1:0.29 can0: sending command failure: -8 [ 486.947661][ C0] ldusb 5-1:0.55: usb_submit_urb failed (-1) [ 486.968201][ T5956] usb 5-1: USB disconnect, device number 58 [ 486.980623][ T5956] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 487.268928][ T5948] peak_usb 6-1:0.29: probe with driver peak_usb failed with error -8 [ 487.299828][ T5948] usb 6-1: USB disconnect, device number 24 [ 487.389118][T11344] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 487.396045][T11344] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 487.466304][T11344] vhci_hcd vhci_hcd.0: Device attached [ 487.853732][T11361] netlink: 180 bytes leftover after parsing attributes in process `syz.0.1460'. [ 488.077511][ T9] vhci_hcd: vhci_device speed not set [ 488.165277][ T9] usb 35-1: new full-speed USB device number 2 using vhci_hcd [ 488.224472][T11363] ptrace attach of "./syz-executor exec"[5881] was attempted by "\x09   Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ  "[11363] [ 488.262367][ C0] vkms_vblank_simulate: vblank timer overrun [ 488.366729][ T30] audit: type=1800 audit(1754797667.191:692): pid=11363 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1462" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 488.559522][T11372] binder: 11371:11372 ioctl 400c6615 200000000240 returned -22 [ 488.571636][T11372] binder: 11371:11372 ioctl 4018620d 200000000040 returned -22 [ 488.582230][T11372] binder: 11371:11372 ioctl 400454d1 200000000440 returned -22 [ 488.703637][T11372] binder: 11371:11372 ioctl c0306201 2000000003c0 returned -14 [ 488.718834][T11372] binder: 11371:11372 ioctl c0306201 200000000180 returned -14 [ 490.290440][T11348] vhci_hcd: connection reset by peer [ 490.298685][ T6263] vhci_hcd: stop threads [ 490.303947][ T6263] vhci_hcd: release socket [ 490.394621][ T6263] vhci_hcd: disconnect device [ 490.625127][ T5948] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 490.725255][ T5947] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 490.794956][ T5948] usb 3-1: Using ep0 maxpacket: 32 [ 490.802353][ T5948] usb 3-1: config 0 has an invalid interface number: 170 but max is 0 [ 490.828731][ T5948] usb 3-1: config 0 has no interface number 0 [ 490.838094][ T5948] usb 3-1: config 0 interface 170 has no altsetting 0 [ 490.848529][ T5948] usb 3-1: New USB device found, idVendor=0830, idProduct=0003, bcdDevice=c3.a9 [ 490.858103][ T5948] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.868323][ T5948] usb 3-1: Product: syz [ 490.872515][ T5948] usb 3-1: Manufacturer: syz [ 490.878738][ T5948] usb 3-1: SerialNumber: syz [ 490.891880][ T5948] usb 3-1: config 0 descriptor?? [ 490.900714][ T5948] usb 3-1: active config #0 != 1 ?? [ 490.915323][ T5947] usb 2-1: Using ep0 maxpacket: 32 [ 490.926942][ T5947] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 490.936453][ T5947] usb 2-1: config 0 has no interface number 0 [ 490.942698][ T5947] usb 2-1: config 0 interface 184 has no altsetting 0 [ 490.952201][ T5947] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 490.961821][ T5947] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.970874][ T5947] usb 2-1: Product: syz [ 490.975131][ T5947] usb 2-1: Manufacturer: syz [ 490.979758][ T5947] usb 2-1: SerialNumber: syz [ 490.990428][ T5947] usb 2-1: config 0 descriptor?? [ 490.999890][ T5947] smsc75xx v1.0.0 [ 491.105019][ T5867] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 491.254952][ T5867] usb 5-1: Using ep0 maxpacket: 8 [ 491.261929][ T5867] usb 5-1: config 0 has an invalid interface number: 250 but max is 0 [ 491.271253][ T5867] usb 5-1: config 0 has no interface number 0 [ 491.280514][ T5867] usb 5-1: New USB device found, idVendor=a168, idProduct=0614, bcdDevice=1b.10 [ 491.294002][ T5867] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 491.302214][ T5867] usb 5-1: Product: syz [ 491.306443][ T5867] usb 5-1: Manufacturer: syz [ 491.311067][ T5867] usb 5-1: SerialNumber: syz [ 491.320472][ T5867] usb 5-1: config 0 descriptor?? [ 491.330170][ T5867] gspca_main: gspca_sn9c20x-2.14.0 probing a168:0614 [ 491.547868][ T5867] gspca_sn9c20x: Write register 1000 failed -71 [ 491.554404][ T5867] gspca_sn9c20x: Device initialization failed [ 491.575707][ T5867] gspca_sn9c20x 5-1:0.250: probe with driver gspca_sn9c20x failed with error -71 [ 491.593045][ T5867] usb 5-1: USB disconnect, device number 59 [ 491.601881][ T5947] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 491.616543][ T5947] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 493.139488][T11423] openvswitch: netlink: Key type 6416 is out of range max 32 [ 493.274954][ T9] vhci_hcd: vhci_device speed not set [ 493.517840][ T5867] usb 3-1: USB disconnect, device number 61 [ 493.725376][T11433] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1483'. [ 493.741079][T11433] netlink: 'syz.2.1483': attribute type 6 has an invalid length. [ 493.749540][T11433] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1483'. [ 493.913287][ T5947] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -71 [ 493.934596][ T5947] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -71 [ 493.965086][ T5947] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 493.985560][ T5947] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 494.039055][ T5947] usb 2-1: USB disconnect, device number 70 [ 494.497623][ T5947] usb 3-1: new low-speed USB device number 62 using dummy_hcd [ 494.660319][ T5947] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 494.671360][ T5947] usb 3-1: config 0 has no interface number 0 [ 494.680647][ T5947] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 494.694100][ T5947] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 494.708098][ T5947] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 494.723067][ T5947] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 494.740572][ T5947] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 494.751785][ T5947] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 494.771161][ T5947] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 494.781408][ T5947] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.805887][ T5947] usb 3-1: config 0 descriptor?? [ 494.820111][T11441] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 494.828441][T11441] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 494.836243][ T9] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 494.862003][ T5947] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 494.915583][ T5927] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 495.010782][ T9] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 495.023851][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.032408][ T9] usb 5-1: Product: syz [ 495.037188][ T9] usb 5-1: Manufacturer: syz [ 495.041900][ T9] usb 5-1: SerialNumber: syz [ 495.045214][ T5927] usb 2-1: device descriptor read/64, error -71 [ 495.060633][ T9] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 495.115365][T11438] ldusb 3-1:0.55: Write buffer overflow, 1 bytes dropped [ 495.164915][ T5947] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 495.179502][ T5948] usb 3-1: USB disconnect, device number 62 [ 495.222280][ T5948] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 495.309806][ T5927] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 495.454891][ T5927] usb 2-1: device descriptor read/64, error -71 [ 495.565515][ T5927] usb usb2-port1: attempt power cycle [ 495.581799][T11447] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.595775][T11447] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.815280][ T30] audit: type=1326 audit(1754797674.671:693): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11446 comm="syz.4.1488" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe33798ebe9 code=0x0 [ 495.921591][ T5927] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 495.979590][ T5948] usb 5-1: USB disconnect, device number 60 [ 495.995045][ T5956] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 495.997252][T11465] vivid-000: ================= START STATUS ================= [ 496.011542][T11465] vivid-000: Test Pattern: 75% Colorbar [ 496.017627][ T5927] usb 2-1: device descriptor read/8, error -71 [ 496.018687][T11465] vivid-000: Fill Percentage of Frame: 100 [ 496.030194][T11465] vivid-000: Horizontal Movement: No Movement [ 496.041557][T11465] vivid-000: Vertical Movement: No Movement [ 496.051863][T11465] vivid-000: OSD Text Mode: All [ 496.058482][T11465] vivid-000: Show Border: false [ 496.063957][T11465] vivid-000: Show Square: false [ 496.094311][T11465] vivid-000: Sensor Flipped Horizontally: false [ 496.101314][T11465] vivid-000: Sensor Flipped Vertically: false [ 496.111663][T11465] vivid-000: Insert SAV Code in Image: false [ 496.122063][T11465] vivid-000: Insert EAV Code in Image: false [ 496.129227][T11465] vivid-000: Insert Video Guard Band: false [ 496.137641][T11465] vivid-000: Reduced Framerate: false [ 496.143085][T11465] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 496.151615][T11465] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 496.160239][T11465] vivid-000: Enable Capture Cropping: true [ 496.170530][T11465] vivid-000: Enable Capture Composing: true [ 496.177466][T11465] vivid-000: Enable Capture Scaler: true [ 496.183875][T11465] vivid-000: Timestamp Source: End of Frame [ 496.190816][ T5956] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 496.210759][ T5956] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 496.221377][T11465] vivid-000: Colorspace: sRGB [ 496.226924][T11465] vivid-000: Transfer Function: Default [ 496.232533][T11465] vivid-000: Y'CbCr Encoding: Default [ 496.238534][T11465] vivid-000: HSV Encoding: Hue 0-179 [ 496.243886][T11465] vivid-000: Quantization: Default [ 496.249599][T11465] vivid-000: Apply Alpha To Red Only: false [ 496.256379][T11465] vivid-000: Standard Aspect Ratio: 4x3 [ 496.262095][T11465] vivid-000: DV Timings Signal Mode: Current DV Timings inactive [ 496.270735][T11465] vivid-000: DV Timings: 640x480p59 inactive [ 496.277778][T11465] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 496.286110][T11465] vivid-000: Maximum EDID Blocks: 2 [ 496.291390][T11465] vivid-000: Limited RGB Range (16-235): false [ 496.298147][T11465] vivid-000: Rx RGB Quantization Range: Automatic [ 496.304664][T11465] vivid-000: Power Present: 0x00000001 [ 496.310758][T11465] tpg source WxH: 320x180 (R'G'B) [ 496.316329][T11465] tpg field: 1 [ 496.319735][T11465] tpg crop: (0,0)/320x180 [ 496.324110][T11465] tpg compose: (0,0)/320x180 [ 496.328997][T11465] tpg colorspace: 8 [ 496.332843][T11465] tpg transfer function: 0/0 [ 496.337549][T11465] tpg quantization: 0/0 [ 496.341730][T11465] tpg RGB range: 0/2 [ 496.345750][T11465] vivid-000: ================== END STATUS ================== [ 496.396870][ T5956] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 496.428918][ T5947] usb 5-1: Service connection timeout for: 256 [ 496.429354][ T5956] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 8 [ 496.447145][ T5947] ath9k_htc 5-1:1.0: ath9k_htc: Unable to initialize HTC services [ 496.447783][ T5927] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 496.501706][ T5947] ath9k_htc: Failed to initialize the device [ 496.504017][ T5956] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 496.517757][ T5948] usb 5-1: ath9k_htc: USB layer deinitialized [ 496.529047][ T5927] usb 2-1: device descriptor read/8, error -71 [ 496.645805][ T5927] usb usb2-port1: unable to enumerate USB device [ 496.652610][ T5956] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.787455][ T5956] usb 3-1: Product: syz [ 496.814616][ T5956] usb 3-1: Manufacturer: syz [ 496.885295][ T9] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 496.907503][ T5956] usb 3-1: SerialNumber: syz [ 497.086472][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 497.094453][ T9] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 497.105075][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 497.119325][ T9] pvrusb2: Hardware description: Terratec Grabster AV400 [ 497.145001][ T9] pvrusb2: ********** [ 497.153757][ T9] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 497.190269][T11462] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 497.204624][ T9] pvrusb2: Important functionality might not be entirely working. [ 497.226635][ T9] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 497.242901][T11462] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 497.268299][ C1] raw-gadget.3 gadget.2: ignoring, device is not running [ 497.295781][ T5956] cdc_ncm 3-1:1.0: bind() failure [ 497.330105][ T9] pvrusb2: ********** [ 497.335882][ T5956] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 497.343971][ T5956] cdc_ncm 3-1:1.1: bind() failure [ 497.358428][ T2343] pvrusb2: Invalid write control endpoint [ 497.402645][ T5956] usb 3-1: USB disconnect, device number 63 [ 497.773465][ T2343] pvrusb2: Invalid write control endpoint [ 497.798564][ T2343] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 497.813134][ T2343] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 497.874445][ T2343] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 497.951026][ T2343] pvrusb2: Device being rendered inoperable [ 498.023313][ T2343] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 498.048053][ T2343] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 498.080924][ T2343] pvrusb2: Attached sub-driver cx25840 [ 498.112375][ T2343] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 498.161520][ T2343] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 498.595848][T11489] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1502'. [ 499.591349][T11499] fuse: Unknown parameter '' [ 500.084996][ T5927] usb 3-1: new low-speed USB device number 64 using dummy_hcd [ 500.248430][ T5927] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 500.266174][ T5927] usb 3-1: config 0 has no interface number 0 [ 500.273971][ T5927] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 500.349375][ T5927] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 500.425341][ T5927] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 500.484250][ T5927] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 500.518188][ T5927] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 500.537239][ T5927] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 500.551527][ T5927] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 500.561735][ T5927] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 500.582232][ T5927] usb 3-1: config 0 descriptor?? [ 500.601801][T11493] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 500.665200][T11493] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 500.710050][ T5927] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 500.844737][ T5927] usb 6-1: USB disconnect, device number 25 [ 500.939547][T11493] ldusb 3-1:0.55: Write buffer overflow, 1 bytes dropped [ 501.002573][ T5947] usb 3-1: USB disconnect, device number 64 [ 501.057919][ T5947] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 501.289162][ T5947] hid-generic 00A0:0006:0003.0011: unknown main item tag 0x0 [ 501.323928][ T5947] hid-generic 00A0:0006:0003.0011: unknown main item tag 0x0 [ 501.331988][ T5947] hid-generic 00A0:0006:0003.0011: unknown main item tag 0x0 [ 501.341424][ T5947] hid-generic 00A0:0006:0003.0011: unknown main item tag 0x0 [ 501.349331][ T5947] hid-generic 00A0:0006:0003.0011: unknown main item tag 0x0 [ 501.358608][ T5947] hid-generic 00A0:0006:0003.0011: unknown main item tag 0x0 [ 501.386448][ T5947] hid-generic 00A0:0006:0003.0011: unknown main item tag 0x0 [ 501.404622][ T5947] hid-generic 00A0:0006:0003.0011: unknown main item tag 0x0 [ 501.422344][ T5947] hid-generic 00A0:0006:0003.0011: unknown main item tag 0x0 [ 501.454352][ T5947] hid-generic 00A0:0006:0003.0011: unknown main item tag 0x0 [ 501.483518][ T5947] hid-generic 00A0:0006:0003.0011: hidraw0: HID v0.05 Device [syz1] on syz0 [ 501.700992][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.788827][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 503.323754][T11550] vlan2: entered promiscuous mode [ 503.370065][ T5947] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 503.380996][T11550] bridge0: entered promiscuous mode [ 503.392806][T11550] vlan2: entered allmulticast mode [ 503.402870][T11550] bridge0: entered allmulticast mode [ 503.544880][ T5947] usb 6-1: Using ep0 maxpacket: 8 [ 503.561505][ T5947] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 503.679377][ T5947] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.803073][ T5947] pvrusb2: Hardware description: Terratec Grabster AV400 [ 504.075605][ T5947] pvrusb2: ********** [ 504.124916][ T5947] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 504.163478][ T5947] pvrusb2: Important functionality might not be entirely working. [ 504.339451][ T5947] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 504.572155][ T5947] pvrusb2: ********** [ 504.620739][ T2343] pvrusb2: Invalid write control endpoint [ 505.046636][ T2343] pvrusb2: Invalid write control endpoint [ 505.061436][ T2343] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 505.102842][ T2343] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 505.139747][ T2343] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 505.184248][ T2343] pvrusb2: Device being rendered inoperable [ 505.211165][ T2343] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 505.241766][ T2343] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 505.270088][ T2343] pvrusb2: Attached sub-driver cx25840 [ 505.286852][ T2343] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 505.338326][ T2343] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 505.693847][ T30] audit: type=1800 audit(1754797684.541:694): pid=11565 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1519" name=20019C1437B3CFFCC3A25729EB7393A7C721518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C0542BCD9F767C8DD5B24476638E93D8D6A0C536D278E3633A dev="mqueue" ino=24491 res=0 errno=0 [ 505.728788][ T5956] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 505.898916][ T5956] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 505.910533][ T5956] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 505.977011][ T5956] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 506.202951][ T5956] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.246963][T11575] bridge0: entered promiscuous mode [ 506.334236][T11564] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 506.412642][ T5956] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 506.630845][ T5947] usb 6-1: USB disconnect, device number 26 [ 506.845213][ T5867] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 507.034903][ T5867] usb 5-1: Using ep0 maxpacket: 16 [ 507.044936][ T5867] usb 5-1: New USB device found, idVendor=0471, idProduct=030c, bcdDevice=ba.e9 [ 507.080078][ T5867] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.154045][ T5867] usb 5-1: Product: syz [ 507.210870][ T5867] usb 5-1: Manufacturer: syz [ 507.261341][ T5867] usb 5-1: SerialNumber: syz [ 507.316226][ T5867] usb 5-1: config 0 descriptor?? [ 507.367313][ T5867] pwc: Philips PCVC690K (Vesta Pro Scan) USB webcam detected. [ 507.756851][T11579] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 507.857479][T11579] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.993763][ T5867] pwc: send_video_command error -71 [ 508.019890][ T5867] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 508.123263][ T5867] Philips webcam 5-1:0.0: probe with driver Philips webcam failed with error -71 [ 508.176434][ T5867] usb 5-1: USB disconnect, device number 61 [ 509.030096][T11604] netlink: 'syz.4.1531': attribute type 27 has an invalid length. [ 510.075792][T11618] netlink: 180 bytes leftover after parsing attributes in process `syz.4.1537'. [ 510.645113][ T31] INFO: task syz.3.1030:9744 blocked for more than 143 seconds. [ 510.658151][ T31] Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 [ 510.728192][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 510.844942][ T31] task:syz.3.1030 state:D stack:27240 pid:9744 tgid:9743 ppid:5882 task_flags:0x400040 flags:0x00004004 [ 510.965054][ T31] Call Trace: [ 510.999858][ T31] [ 511.005083][ T5867] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 511.017286][ T31] __schedule+0x1798/0x4cc0 [ 511.033019][ T31] ? __pfx___schedule+0x10/0x10 [ 511.048497][ T31] ? schedule+0x91/0x360 [ 511.058710][ T31] schedule+0x165/0x360 [ 511.073479][ T31] schedule_preempt_disabled+0x13/0x30 [ 511.099176][ T31] __mutex_lock+0x7e6/0x1360 [ 511.122748][ T31] ? __mutex_lock+0x5b6/0x1360 [ 511.147028][ T31] ? usbdev_open+0x16e/0x760 [ 511.172502][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 511.178553][ T5867] usb 3-1: Using ep0 maxpacket: 32 [ 511.204005][ T5867] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 511.217826][ T31] ? bus_find_device+0x273/0x2b0 [ 511.230683][ T5867] usb 3-1: config 0 has no interface number 0 [ 511.247362][ T31] ? __pfx_bus_find_device+0x10/0x10 [ 511.262150][ T31] ? __kasan_kmalloc+0x93/0xb0 [ 511.273492][ T5867] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 511.289758][ T31] ? usbdev_open+0xa7/0x760 [ 511.314953][ T5867] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 511.334061][ T31] usbdev_open+0x16e/0x760 [ 511.362691][ T31] ? __pfx_usbdev_open+0x10/0x10 [ 511.383871][ T5867] usb 3-1: Product: syz [ 511.406209][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 511.412101][ T5867] usb 3-1: Manufacturer: syz [ 511.455018][ T31] chrdev_open+0x4cc/0x5e0 [ 511.459738][ T5867] usb 3-1: SerialNumber: syz [ 511.482547][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 511.533158][ T5867] usb 3-1: config 0 descriptor?? [ 511.585134][ T31] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 511.612140][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 511.625331][ T5867] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 511.625366][ T31] do_dentry_open+0x953/0x13f0 [ 511.694896][ T31] vfs_open+0x3b/0x340 [ 511.787552][ T31] ? path_openat+0x2ecd/0x3830 [ 511.809657][ T31] path_openat+0x2ee5/0x3830 [ 511.834396][ T31] ? arch_stack_walk+0xfc/0x150 [ 511.835962][ T5867] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 511.870550][ T31] ? stack_depot_save_flags+0x40/0x860 [ 511.903790][ T31] ? __pfx_path_openat+0x10/0x10 [ 511.928993][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.974740][ T31] do_filp_open+0x1fa/0x410 [ 511.985003][ T31] ? __lock_acquire+0xab9/0xd20 [ 512.000606][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 512.019808][ T5867] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 512.030501][ C0] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 7 [ 512.045614][ T31] ? _raw_spin_unlock+0x28/0x50 [ 512.059792][ T31] ? alloc_fd+0x64c/0x6c0 [ 512.072258][ T31] do_sys_openat2+0x121/0x1c0 [ 512.091585][ T31] ? __se_sys_futex+0x36f/0x400 [ 512.103379][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 512.213306][ T31] ? exc_page_fault+0x76/0xf0 [ 512.235388][T11631] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.255529][T11631] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.316388][ T31] ? __pfx___se_sys_futex+0x10/0x10 [ 512.370614][ T31] __x64_sys_openat+0x138/0x170 [ 512.434692][ T31] do_syscall_64+0xfa/0x3b0 [ 512.503267][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 512.561588][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.613514][ T31] ? clear_bhb_loop+0x60/0xb0 [ 512.665484][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.681764][ T31] RIP: 0033:0x7f38a5f8d550 [ 512.691912][ T31] RSP: 002b:00007f38a6ec9b70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 512.707605][ T31] RAX: ffffffffffffffda RBX: 000000000000a401 RCX: 00007f38a5f8d550 [ 512.722737][ T31] RDX: 000000000000a401 RSI: 00007f38a6ec9c10 RDI: 00000000ffffff9c [ 512.732911][ T31] RBP: 00007f38a6ec9c10 R08: 0000000000000000 R09: 0000000000000000 [ 512.749208][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd [ 512.785423][ T31] R13: 00007f38a61b6038 R14: 00007f38a61b5fa0 R15: 00007f38a62dfa28 [ 512.798741][ T31] [ 512.819035][ T31] [ 512.819035][ T31] Showing all locks held in the system: [ 512.842875][ T31] 6 locks held by kworker/0:1/10: [ 512.863121][ T31] #0: ffff888143af2948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 512.895267][ T31] #1: ffffc900000f7bc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 513.000773][ T31] #2: ffff888144381198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a20 [ 513.051489][ T31] #3: ffff88802746c198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 513.221603][ T31] #4: ffff888021b14160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 513.310614][ T31] #5: ffffffff8dfe0310 (umhelper_sem){++++}-{4:4}, at: usermodehelper_read_trylock+0xf0/0x2b0 [ 513.362780][T11562] syz.1.1520 (11562): drop_caches: 1 [ 513.394472][ T31] 1 lock held by khungtaskd/31: [ 513.422451][ T31] #0: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 513.484256][ T31] 2 locks held by getty/5622: [ 513.520209][ T31] #0: ffff888033d160a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 513.542974][ T5956] usb 2-1: USB disconnect, device number 75 [ 513.613956][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 513.651102][ T31] 4 locks held by udevd/5916: [ 513.663228][ T31] #0: ffff8880597b41c8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe10 [ 513.682996][ C0] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 513.692158][ T5867] usb 3-1: USB disconnect, device number 65 [ 513.699273][ T31] #1: ffff8880541a1888 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x55/0x3c0 [ 513.713609][ T31] #2: ffff888031a50a58 (kn->active#28){++++}-{0:0}, at: kernfs_seq_start+0x75/0x3c0 [ 513.728007][ T5867] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 513.746453][ T31] #3: ffff88802746c198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 513.757243][ T5867] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 513.778238][ T31] 3 locks held by kworker/1:6/5956: [ 513.783494][ T31] #0: ffff888143af2948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 513.796048][ T5867] quatech2 3-1:0.51: device disconnected [ 513.801053][ T31] #1: ffffc9000471fbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 513.814861][ T31] #2: ffff88823be7a998 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a20 [ 513.823839][ T31] 2 locks held by udevd/7109: [ 513.829198][ T31] 1 lock held by syz.3.1030/9744: [ 513.834341][ T31] #0: ffff888144381198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x16e/0x760 [ 513.843750][ T31] 1 lock held by syz.2.1540/11630: [ 513.849868][ T31] #0: ffff888056077a08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 513.860611][ T31] 2 locks held by dhcpcd/11633: [ 513.866120][ T31] #0: ffff88805afe9408 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 513.876647][ T31] #1: ffffffff8e13f978 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 [ 513.889220][ T31] 2 locks held by dhcpcd/11634: [ 513.894119][ T31] #0: ffff888071464258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcd0 [ 513.903998][ T31] #1: ffffffff8e13f978 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 513.920518][ T31] [ 513.923994][ T31] ============================================= [ 513.923994][ T31] [ 513.933778][ T31] NMI backtrace for cpu 1 [ 513.933801][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 PREEMPT(full) [ 513.933825][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 513.933837][ T31] Call Trace: [ 513.933845][ T31] [ 513.933853][ T31] dump_stack_lvl+0x189/0x250 [ 513.933887][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 513.933911][ T31] ? __pfx__printk+0x10/0x10 [ 513.933952][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 513.933977][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 513.934002][ T31] ? __pfx__printk+0x10/0x10 [ 513.934032][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 513.934065][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 513.934091][ T31] watchdog+0xf93/0xfe0 [ 513.934123][ T31] ? watchdog+0x1de/0xfe0 [ 513.934156][ T31] kthread+0x70e/0x8a0 [ 513.934184][ T31] ? __pfx_watchdog+0x10/0x10 [ 513.934209][ T31] ? __pfx_kthread+0x10/0x10 [ 513.934235][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 513.934259][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 513.934282][ T31] ? __pfx_kthread+0x10/0x10 [ 513.934307][ T31] ret_from_fork+0x3fc/0x770 [ 513.934330][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 513.934355][ T31] ? __switch_to_asm+0x39/0x70 [ 513.934378][ T31] ? __switch_to_asm+0x33/0x70 [ 513.934465][ T31] ? __pfx_kthread+0x10/0x10 [ 513.934490][ T31] ret_from_fork_asm+0x1a/0x30 [ 513.934532][ T31] [ 513.934539][ T31] Sending NMI from CPU 1 to CPUs 0: [ 514.087485][ C0] NMI backtrace for cpu 0 [ 514.087503][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 PREEMPT(full) [ 514.087522][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 514.087532][ C0] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 514.087557][ C0] Code: 13 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 f7 0e 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 514.087571][ C0] RSP: 0018:ffffffff8de07d80 EFLAGS: 000002c2 [ 514.087587][ C0] RAX: e6f1bf9958dd7300 RBX: ffffffff81968308 RCX: e6f1bf9958dd7300 [ 514.087598][ C0] RDX: 0000000000000001 RSI: ffffffff8d9b6d63 RDI: ffffffff8be33400 [ 514.087609][ C0] RBP: ffffffff8de07eb8 R08: ffff8880b8632f9b R09: 1ffff110170c65f3 [ 514.087621][ C0] R10: dffffc0000000000 R11: ffffed10170c65f4 R12: ffffffff8fa37e30 [ 514.087632][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffffffff1bd2a20 [ 514.087649][ C0] FS: 0000000000000000(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 [ 514.087662][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 514.087672][ C0] CR2: 0000200000000dc0 CR3: 0000000076ca0000 CR4: 00000000003526f0 [ 514.087688][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 514.087697][ C0] DR3: 000000000000000c DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 514.087707][ C0] Call Trace: [ 514.087713][ C0] [ 514.087719][ C0] default_idle+0x13/0x20 [ 514.087741][ C0] default_idle_call+0x74/0xb0 [ 514.087754][ C0] do_idle+0x1e8/0x510 [ 514.087771][ C0] ? __pfx_do_idle+0x10/0x10 [ 514.087792][ C0] cpu_startup_entry+0x44/0x60 [ 514.087806][ C0] rest_init+0x2de/0x300 [ 514.087821][ C0] start_kernel+0x3a9/0x410 [ 514.087838][ C0] x86_64_start_reservations+0x24/0x30 [ 514.087858][ C0] x86_64_start_kernel+0x143/0x1c0 [ 514.087877][ C0] common_startup_64+0x13e/0x147 [ 514.087903][ C0] [ 514.089611][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 514.289797][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 PREEMPT(full) [ 514.301272][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 514.311511][ T31] Call Trace: [ 514.314794][ T31] [ 514.317733][ T31] dump_stack_lvl+0x99/0x250 [ 514.322332][ T31] ? __asan_memcpy+0x40/0x70 [ 514.326937][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 514.332137][ T31] ? __pfx__printk+0x10/0x10 [ 514.336744][ T31] vpanic+0x281/0x750 [ 514.340737][ T31] ? __pfx_vpanic+0x10/0x10 [ 514.345387][ T31] ? __x2apic_send_IPI_mask+0x1e4/0x260 [ 514.350970][ T31] ? preempt_schedule+0xae/0xc0 [ 514.355829][ T31] ? preempt_schedule_common+0x83/0xd0 [ 514.361526][ T31] panic+0xb9/0xc0 [ 514.365252][ T31] ? __pfx_panic+0x10/0x10 [ 514.369788][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 514.375227][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 514.381691][ T31] watchdog+0xfd2/0xfe0 [ 514.385948][ T31] ? watchdog+0x1de/0xfe0 [ 514.390296][ T31] kthread+0x70e/0x8a0 [ 514.394411][ T31] ? __pfx_watchdog+0x10/0x10 [ 514.399098][ T31] ? __pfx_kthread+0x10/0x10 [ 514.403707][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 514.408911][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 514.414114][ T31] ? __pfx_kthread+0x10/0x10 [ 514.418711][ T31] ret_from_fork+0x3fc/0x770 [ 514.423317][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 514.428442][ T31] ? __switch_to_asm+0x39/0x70 [ 514.433211][ T31] ? __switch_to_asm+0x33/0x70 [ 514.437988][ T31] ? __pfx_kthread+0x10/0x10 [ 514.442588][ T31] ret_from_fork_asm+0x1a/0x30 [ 514.447369][ T31] [ 514.450626][ T31] Kernel Offset: disabled [ 514.454951][ T31] Rebooting in 86400 seconds..