last executing test programs: 6m31.271390631s ago: executing program 3 (id=4154): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r0, 0x0, 0x0, 0x0) close(r1) r2 = socket$inet(0xa, 0x801, 0x84) getsockopt$MRT(r2, 0x0, 0xd0, 0x0, 0x0) mkdir(&(0x7f0000000540)='./file0\x00', 0x108) ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, &(0x7f00000002c0)) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r3, &(0x7f0000000100), 0x14) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000200)={'tunl0\x00', &(0x7f0000000180)={'sit0\x00', 0x0, 0x7800, 0x8000, 0x80000004, 0x2, {{0x5, 0x4, 0x3, 0x0, 0x14, 0x64, 0x0, 0x4, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback}}}}) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000100)=0xa, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'geneve0\x00', 0x0}) sendto$packet(r6, &(0x7f0000000180)="0b036800e0ff64000200475400f6a13bb10000000800894f4820", 0x1fffe, 0x0, &(0x7f0000000140)={0x11, 0x0, r7}, 0x14) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f0000000600)={'aio_iiro_16\x00', [0x4f27, 0xb, 0x2, 0x10, 0x5, 0x6, 0x8, 0x7, 0xa, 0x100, 0x7, 0x1, 0x1, 0x1fffe, 0x6, 0x101, 0x3, 0x80000000, 0x3, 0x40000003, 0x8c, 0xcaa7, 0x0, 0xffffffff, 0xb, 0xe69, 0x3c, 0xc, 0x10000006, 0x0, 0xfffffff8]}) read(r4, 0x0, 0x0) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='romfs\x00', 0x0, 0x0) 6m31.173664002s ago: executing program 3 (id=4155): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="e0ff86dd0000120000000000000060fc030000102c00fe8000000000a7cb44000000000000000000aaff020000001b00000000000000000001"], 0x46) 6m30.983684795s ago: executing program 3 (id=4156): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x12}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "fc0300", 0x10, 0x2c, 0x0, @local, @mcast2, {[@routing={0x3c, 0x0, 0x0, 0x3, 0xf5}], @echo_request={0x80, 0x0, 0x0, 0x8, 0x401}}}}}, 0x46) 6m30.899969956s ago: executing program 3 (id=4157): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0xf648a000) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f0000000200)='.\x02\x00', 0x0) madvise(&(0x7f0000a86000/0x1000)=nil, 0x1000, 0x12) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000340)={0xa4, 0x0, &(0x7f0000000600)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/67, 0x43, 0x0, 0x18}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/227, 0xe3, 0x2, 0xe}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}, @register_looper, @register_looper, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000001c0), 0x0, 0x1, 0x13}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f00000004c0)=""/172, 0xac, 0x0, 0x1a}}, &(0x7f0000000240)={0x0, 0x28, 0x40}}}, @increfs={0x40046304, 0x1}, @exit_looper, @increfs={0x40046304, 0x1}], 0x1000, 0x0, &(0x7f0000001180)="76648cf2141cd1b2b97767147b5be70278f6e2211a72f1855e286f9dcb5f1e61399d18c0714eb4a3bf083a775ff2bdf1f4c9e9c9769b2f2c5bab217a07afa8788248f652351c6fe35edaf5a1588c2364449f6f984184fd9e9bf887818627f9ad38ca432d10760d8609f4bc483f369c01ec5b8bc805b358a11f623e2e70d4de8eaeb86d5cdff2f8796754d09c2d2b63c2724576b3a645380b4da6661b56d4e6fa672b8ee6784bdef47f557e8d3bc4f71740c6cc313d4f80deee3a68f5c50e3a71508569931f6152585b94c2a4bf6499c9ed0c1c4b8cbd8c1996d1e816be0ee249c48ccd715ed59de3981d4cf31508f06154e3a2bb965a2a868d693d938fda042211f4d53f2eb7afd1deaa82a784c6a1af97f9bc597c84de0b6fc4a69f1f5f4a5f4e6820b9577cd1635afff819a747f03e5600d4413891e5662cc34d1b37667c17e67bec96353525545330a5128c359a19d5463f8b6f7eed48ca42375e2299e710a0ce139d6c6e17bc4610d8a291f616880f968025783b56a34f57cf8ebeffc63c1815bb11ac48eaa242f8079638b4a6668f857057ad8d275a4540e6944b444a2ecfd6b61f557c5eb8eb379c7e962645948908d2db74cb1f599c9d99519c8fd2b0998ba43901e341bf849d53ab0d0817e77cc0346e543811d518b09dfa47c1174f6e77813af9fef0aa677a1d088b956521c025f4c1486368bdfd547e724c6b1f06b3a34bccf0d7ee93a7b68a9040111ff6e229d0bd7378636bbf20257e76f8f1190da30319395cef4e55dfe3d5ee783b2075343312aa95b392a44a80a5410e24a32781be29af62fedf4ca4234c84201cafab5aa30ed8d7c7d48e42dfb46529c0117e623853a84131a7c03156b2ba0a9b600682ef2d105ef376e4b5aea302af5750262856f2742dde16ab89ce2f817cf0bb0601df31addb75464d64720e45e02c29af86d8a6731c7185343ae13f216fa98fce3f6ff7a4521afab073b823a590d47e5ecd36e3528252294d59e6d9883990bf0c2453aaec5a856121c2cbc380eb97c59fe91c13604db2792ae94dca26ab848994e52b287f320a3e50ce9574dd7290cd4d4e0b6c0d2658e7137be2b937448360cc80d5891b71b6dcce10ac509f7b836f7b4bbcef1ec6d0bfff81c4e4e20fc2df262aee8fd6c67586203ef5a2e3d0c100ad42a592e848784baff03d95ae31707887ca3c5483d9e88b488938b32689422da48199d1c688a9a67e10e9637a07d8570b3abcb5d8874da06c66d176110569eac8273c47aae2c14e75ddce55ebf2edae50fa6a8f835a930ad9f8a50695fd94d737f2971467d230c876f276ff43e0fa0270ee11482461653bc86c9904d8097f495ee1dddb66bb0e600a88154919bc19e414def3ae1ea925a1811de8a5d84e75a9d5c736fff3d7fcc75a285803772751264a1040caa187a7f8b9107e990f70d953604a0481a4ddeaf676ed4d2c9a230619d5202a80382c80f484accc7f4809f41deb71b9d66d5d313b7a22bcb958b662ff2fafba11282f9be9709d7b0ca6fa5e3057a764e88ec770dd003e47813749f28225a204edf6500675a02d628a01cd37231bd3962d2c726d9042d31a79c4457f2457743e0d4a2af368c6a38f605c6c21e6fb0e53f511c7d5a3804f3bbfee4d26df1efc3ae7dd5e746599f6820f640f96152f0f2319f1823adfaffd442a26b1ad3f31db0170ec2fa6be0b56a6dc2904f27864a841b9895609256d1e1e540e736986cc4d0fed395932f315b92b17f9700c3f0d6bd068dcfcbfd02b504c6921c80a7cabb4f9e3db681d4a2bcc379ee4a45000ac23b6b4e7120ddc339b4fa008b800a793cf42a9d3bed79a692f10f2bc6fa165e70c037d028a56ce4e6b8554b8d9c801413e1ba631f2bf53fe45e53da4f07b02e94cc31b5edaa8c6d3bd68a2b72a84f31583d0e41a9806c1ab96b224f3c8163fd1310f11144e3719f182e699ce852d04a3f15cb19fe34e3ca1ee23b9f447b5fb7014635dd31ae9f3ea8a8771701e4c4710ea9d2abb864df6e175f11f90b04ed321c38f232f56a92355d68b3141d4881ddf6b63a7f3da0d8369e8b06bb368df51c1cbacc7f895d525cef5ba21e4025cfdb3205e1940d7f7758c3e94305a785e32ae0995bacffba8a8d1e40e170ae71e5d3a77fa54c36f0799c9d056e267b59f416e42c861b60b31943ca2cc7b7edea6c0eebe6bdb154d4ed548cc9f28a988025e8970aba965e21fe2227f7929aed653b544daba2127282cd7eb36105da32e829dc9773e0e7d2dba197b56495d64f617c612291664a305d361d651567713907ee43e1a0474c1048f7caff8c24c47fae2ec5ffcb1473e9443bcc5bd012fa3c3a219755cc7ca0fd01ec85e5da87c705747e5ab2b258c8c6f04599166962d6cce4fa3ef75d22cf22c634e3429f729688232737626b1857435cc4a51b8608dfe78f7a4f175999019606a5056846174b1338d37c600d8f6f1ecfe9bc85d55168e05e9580b071670e1167a77c5c8fd837e81577c2fe9f072184460419e54f47226a1fc4e6c5e91ecd7fd4fb6960dfa7c9315f5d11c6fb3b5905cc93ceae37ef67f70570b693078f5311e72bbf46721ae9c130eceac985de40397d5359b4e97729abb1560201542971ee6f8572738a03226adaa2e51c35a19779b77e6e6b3f52d01b4f6c3e9c9defe77b0e106fd26f15f30133811b381c3d833999ef9acbfeb7fbce95fc9f86379b4d2946291274a12ba096cc5e4589102f9bcce231c0e439a4d6ceb5930316e4683673535d717f9084d58f0c26426bf59edc5f8ee0fe4e64eeaf27fc204a58537c5d4ac4ebdcd38522f132c7d9b954d273974689c0b3f7a3e55bc662efe4b2a5dac11dbe0e92650cfc535da4cfa42a931d2f62f0c5cecb7e78d33cc54793fbe0c20c8c268b6182a853546aebfdcbad00584c6e581b99e4679aee57367b79cc937ac4a65829832a40562f8dc6e0a2cc74ab9cc2894fffa88987c26fa46bdd741532de0ab3fa71aaa65a159b91850d81b6a05072680c1277e1a07e8c5ef18701a241124a82fb488b22e730ca875e58255a4f34bc5862ad39c4e9be73271c2825f2a28ba537cc17825e99a550f9ea4a3b385a0dcfe6c4dc738a8b5e88b0a8e5b969f802777e79f7357a1fe4383b26b5948d2e9893a970c296e701bded6d5007e2b341bf154759e07a63395e5d46c220057cd76591768147acf68f6f3b546f2f75d1836099331fa69e8f6aead034bd92a71b6ea1b1635714fbc7e3c94847d3b6f15d624ff5a7d4185e4e150106640caa0f1448055940cb96f79b783ae3e52b05153611fe53135d83d00bb2ae173aa2db775c0299849014bf687bb9368e234791142382bcf479f59c7f70c16fd7e7675a6c8b46b7140edddfb0e1d8c43560785ae6907410357dc16cf22faae1cdd970b8824cfb46deee51a9707a9aee464b4de16fa4bd612be817b91f44bebaff6011e5bdf442dc09088180f0f9784556b70bfb9e64aa387d5569386686ace6392b95c51b6af171b9e5dcd526985a3b33a479b3438464a9a6b4094331bcda02f17e88981420367b5904d215ef226ef7e449e65857a0b9f0abca9905f8d897162b89a9e83fa56d4042db03f3e0335639a06337d4770f51d1f51ee4d6a570ad62c56e9a4fbc8029b1ded696128d3cfd3d0d26ae550d8b6182ca451d9f2c1a9cab02bd9e8fe798cd587813d75527c5678910f71f5571521d2057832279bc64df06db4dc762343152e5bdca38c10af853fe252f8b634b2e87c2dd9f705088043643a0232c155b3edce2684107b5d49d0e021839533d5bfd01a1aef8617bf9c6aa28a526fe0a660b317fea7bd7b042a7072e5f5b3d85fae0d24d8ff37a2c375b1f03d6ebb48db23eb52c907977d12a070529452ab2a7675c7d4c04b53e68081dc924b2820c9f1d92c910f2195133182b7b5d3a0d96ae8ab6bbeba3152c646478c7bff1de842190a1be89e760a71c9074271fc6c46f534237b7d4ceccc2397e00279e64c718dc51a5a7e57b65d17bbda73e9ad025768d02fe4f4ef928b71085b69b4a83df56a3c1d4e103095b9cca85ab79c80f61ed14516af9668b87ca65d492a037bdde89b670eff3ce83ae981e31a02e175eaf04b8cf9671489d81e2870f10095a5231d98a779333e113993667fc004f2a28db28315b6d3d2ff5b5c4e7c1873b153cbb14ca996e968641b3b7d9f7a30d284becc8123de8c835f9e01857310406df05c6b5aa013197f64c6dd33b0e001f54745f369b1e364eea9a61e67a00c4e8c302b5e344f462a35c2a665ebee292fc1f7000736c43caf3f4f909c27077c6d66abd4be344a2cd82b4e434a62d6decce2e76fdda22864aea2bdf50a90d934d6a604b6c898ace33b961caab91f8c1d83b5b42ee8a6c50b64f5ea974a9033897ba200968bd8aad39799843db4e9642e4be8f846a27ae448bd58ccd926185932cb19551a94a2cc9beab4c318f8bba992acc409af5b300c5c2b1e8ed78753d9eef12f385e8fec148e958401f33a46fc40c5d16810096d715e9260e363138527288bb51d7c75b0fda28b5b543cd1afcad29005c1c5c10862ca68eee19742d643ec6b9d876035f0c4380de85f022b1234f84f23bfe913a00d899046595ccbe5b3f4453cf77907481d9fb18b73b9227bb070ed6f10c55f34f41f61442549bd258859cbb91366e1ad977754aee60d0ca15178ee525c5fad1ee25850b12a86e50dd788cf0950a2b8b8c614b678aa55721c3049876af9b0e13e0d74b7fbe26f903aa069afcfded4f8d980f29d741780ab7b12ea3e4f42da017383159251cbd603fb31f1aa4b06e188bc85ff315ccfd64aef209ca4c8869c10c8c6471937a08f3c8f9bac0c93117b3d204b67da83d4ebee432e4cd79e318fc65f1bf98285178d6542a265f46d0e5d7b458bbf6ec2f59c2fbcdfdfc40bab3b4dbbc6ac38f414d1e22ef8f4d50ce3a960281661075128ca1826f046cee18778acc1ea2c4c96c07e2b9c04348ef546dc82ba1940c7a180ecc24ba5b8e7e8caa9fd1cfff172b1e7d0089e932422403bc21208cadd87c55f60c65da0b82b5078e0e7048b24fab34ce79280b192e6dfafc7b94e32fcd7b57707b996eed97d164f440c6a9b2b035f1ec8bc12297fd6b79658e4308538aa7aa1475b7f63cf2aa7cfe50bbc162f31ed05b4a7b3f78051e923010e4b9f5c40e0951538dadafdd391bbe384b02033a2ee51da662323f643a87f4e34bdac01de35e15aaec9ad1f61c0c1f922032caf5dc51b1e7c22ccaaeed835bd687133b29207c3cc77c971ed4eedb3b1d85f8e48183a9c1cb589eeaaf9192640de1a56b161fc0d0c8d8cc1a4b9dfbc3eda6d85427f9528b01ef215e176073f1764c1507fb14e8afbc427dcc905f7054f4af319aca1ab059472ea73306d04643f5afabf8b4cc7eeb87fd2712429e305fdca74d333cb695ca2370a490b55b3b0aed0ac3d990c5ab577f9c67801b5a6c8c268c6d7c242301143ed6d8b3315748f568d29094db6761941436c8316eee77df68dd84fe67ccfc35f6ce3d82f883e0db093a3346add17fa1155f92be6d3ad48d120f1a4ef0e6b677b231062a9072433739c4ac5d6ab4d44c4f6976dab613c58608d423164fcc0a572944e335dee4095bad3a2f5c9247445c69a8f0d0af931b23630ec86c5045ddec7c8a9ba1b3954cf3c6d5e5fbfa5e710e60bd62692727fb53709a46170e8028c499c2938cd38cb5af95e25d55fc5548117f34d3fec80a89706767fbad304c8dcef3d668dd03614558195d5b2876f9647345051c9373c1840b2fb20"}) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x1970024, &(0x7f0000000100)=ANY=[@ANYBLOB='mode=0']) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 6m30.838298971s ago: executing program 3 (id=4158): syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r0 = syz_usb_connect$printer(0x1, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xf, 0xc0, 0x58, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x7, 0x1, 0x3, 0x4, "", {{{0x9, 0x5, 0x1, 0x2, 0x200, 0x7, 0xd5, 0x80}}, [{{0x9, 0x5, 0x82, 0x2, 0x10, 0x0, 0x8, 0x63}}]}}}]}}]}}, &(0x7f0000000200)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x201, 0x72, 0x5, 0x4, 0x8, 0x8}, 0xea, &(0x7f0000000380)={0x5, 0xf, 0xea, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0xa7, "adda2d793f08b133dee1013243b15f91"}, @ssp_cap={0x10, 0x10, 0xa, 0xff, 0x1, 0x6, 0xf, 0xe, [0xc000]}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x4, 0xd6, 0x5, 0xff0d}, @generic={0x90, 0x10, 0xa, "e99d6d92ce3e92ee42789a2b0b437c98f660ed677c77ce7cc0bf11ce398378dd34a7094e979e97e0345170a0e28d79024c03119d40cd360455cae876547d4a91f69dc7b4feeec21d309657f6ec0c24e62e2a54cce48e04d33dd4db8a76d252783dc8247d29300e153a9ff8944341e15b6524ee1596406ce669471755792475e1eb245845a02275d0ea29a5d3bc"}, @ssp_cap={0x24, 0x10, 0xa, 0xc, 0x6, 0xf, 0xf00, 0x81, [0xff002e, 0xc0, 0x17, 0xff00, 0xff003f, 0xffff30]}, @ptm_cap={0x3}]}, 0x1, [{0xa6, &(0x7f0000000580)=@string={0xa6, 0x3, "e03b5890717c8765b18061dea2659fcc66618599dcf5bd2ece70afad624eab884b0f10fa1d0d9349b1d355f80b350e82dd7fda2c36159491bf025ff4f538c573be45fcc1bf8063ced1e9fc04b7701f2c87c4e2df7d2b416e4e63c1f26c3db6c5607ee10439b931b0cb2198f7c1041f3206a2ceed4ee7f56f024b50550c3f2f007f41867c75f7839fb4fe77547ff6df6c135ca82128d4aa8db069baa2076b9c4a4fd42a83"}}]}) syz_usb_control_io$printer(r0, &(0x7f0000000240)={0x14, &(0x7f0000000640)={0x20, 0x9, 0x85, {0x85, 0x7, "d91d70bc688a5984c36e19fe87048c4384ae4aed25096c05ec8d149506eb64cfb73474189a35ae0a4ca9a9da62d36dfaa698ffe74c421d67e5a6ce1f10fa2e3400352d9ec2e1f2d5d2153ff0933687c5910b3741193ed8482a16673b26acda4b9b54f9266f86a7fbf0afd5dbc4acbe576f395250042c61ef52cb51069875f4f24fa502"}}, &(0x7f0000000700)={0x0, 0x3, 0x96, @string={0x96, 0x3, "b8e19062ebf0f26ee2884907973e5312da29fbe1cd0b35ac5ef131f948e5a22402ee6b1ab2255718564db2cbfcb85359a4333d2efba2c34b886a3444ffcc9eca53b7d09d83023ebf88d8fd7c4e9c591ddd70ceb545dc475e6dd71cfe906df147abdd5bd57ad9b87fcb9699d550e9cd5c3880d853a76857762a17c5f1ba34dd3fd1d954bd4c3a4d40c61c5f5117cdae479a5aae86"}}}, &(0x7f0000000a80)={0x34, &(0x7f00000007c0)={0x0, 0x31, 0xbc, "8daf8a66f1140aa2745534c374fa0aae85c2bfe57406bb2245c9ed987955732f6db4f32fada439fb44b42708d7490e9594a6810453a5299220c70f0d99866733a4a0186114e9ff2537614a7a42d848f7f0e42e09b6a023787685622abab376b5b827648592a7fba24d2f3ecc0e1bd568d212dd159b8f871ff215f3a25f7cd129bb6554723e87bd11107293d8ea4a41f1694ff0b48f1b154625bd61795f07ffe2f0424d2918af57953a3e893d0b02ad4d3136abcab918d25048da5c70"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000480)={0x0, 0x8, 0x1}, &(0x7f0000000980)={0x20, 0x0, 0x95, {0x93, "47dd117433a23eb5f704faee1afa5bc8bc27842298feba58e1228827f6395de87b38fd72d87c22aa9b2243afc967b0a7230dde47199c35025ae8cf424dfc4a144f070d325ee958ab8ec6be9753dd10d7cbdf9654fe5aec428014a6aec087c002b4ce0597dea4b5a277df7e576b011cb2615b0c7daf922e86919629d8dd0eec187a9e73f4483aa703c5e4a1339a50fc80284d25"}}, &(0x7f00000008c0)={0x20, 0x1, 0x1, 0x10}, &(0x7f0000000a40)={0x20, 0x0, 0x1, 0xc0}}) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000d0918108ac051582588f0000000109022d00010000000009040000030b08000009058d67c8"], 0x0) syz_usb_ep_write(r1, 0x8d, 0x0, 0x0) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r2, 0x6c3ca000) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) recvmmsg(r4, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000004c0)=""/168, 0xa8}, {&(0x7f0000000900)=""/106, 0x6a}, {&(0x7f00000000c0)=""/26, 0x1a}], 0x3}, 0x2000000}], 0x2, 0x101, 0x0) select(0x2a, 0x0, &(0x7f0000000340), &(0x7f0000001900), &(0x7f0000000440)) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 6m27.687235527s ago: executing program 3 (id=4175): dup2(0xffffffffffffffff, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) (async) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000480)=@req={0x7fffffff, 0x3, 0x10000, 0x9}, 0x10) write$P9_RVERSION(r1, &(0x7f0000002a80)=ANY=[@ANYBLOB="1504000065ffff00100000080039503c303006c1e5d647eaaa5da89d9636bc3cb64561bcf4825353f2ea57d239e3bccc9300ddffa383f8e975984f96564a5a2568739a82c66caba3cc58dc88fab6965c9e52cfcd521617bb83793ca02dbd47f8673d914b630e36b8e575f07ee53d8f5b604fc0f66287915a655c1f97499c085bd2c1344ee7310a48ed8878a7027e04094e954e6570d677b116d769f6dbb672f308d4c84836b98f6801a1d476a9839ab11b68b5629fc500dec773834e44086e3494"], 0x15) (async) r3 = dup(r1) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000240)={0x48, r5, 0x1, 0x0, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x4d}, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'nicvf0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}]]}, 0x48}, 0x1, 0x0, 0x0, 0x8050}, 0x240048c0) (async) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r7, 0x29, 0x50, &(0x7f00000000c0), &(0x7f0000000100)=0x47) (async) write$FUSE_BMAP(r3, &(0x7f00000002c0)={0x18}, 0x18) (async) write$FUSE_DIRENT(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x58) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESDEC=r1]) chdir(&(0x7f0000000100)='./file0\x00') read$FUSE(r0, &(0x7f0000000300)={0x2020}, 0x2020) (async) mknod$loop(&(0x7f0000002500)='./file0\x00', 0x200, 0x0) (async) recvmmsg(r2, &(0x7f0000002980)=[{{&(0x7f0000000100)=@tipc=@name, 0x80, &(0x7f0000000340)=[{&(0x7f0000002a40)=""/19, 0x13}, {&(0x7f0000000180)=""/60, 0x3c}, {&(0x7f00000001c0)=""/147, 0x93}, {&(0x7f0000000280)=""/118, 0x76}, {&(0x7f0000000300)=""/11, 0xb}], 0x5}, 0x7}, {{&(0x7f00000003c0)=@caif=@dgm, 0x80, &(0x7f0000002840)=[{&(0x7f0000000440)=""/131, 0x83}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f0000002b80)=""/249, 0xf9}, {&(0x7f0000001600)=""/4096, 0x1000}, {&(0x7f0000002600)=""/136, 0x88}, {&(0x7f00000026c0)=""/42, 0x2a}, {&(0x7f0000002700)=""/160, 0xa0}, {&(0x7f00000027c0)=""/125, 0x7d}], 0x8, &(0x7f00000028c0)=""/130, 0x82}, 0x8}], 0x2, 0x2, &(0x7f0000002a00)) (async) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200000, 0x200000, 0x7}) r8 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r8, 0x8b2c, &(0x7f0000000040)) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='squashfs\x00', 0x200002, 0x0) 6m12.597518618s ago: executing program 32 (id=4175): dup2(0xffffffffffffffff, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) (async) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000480)=@req={0x7fffffff, 0x3, 0x10000, 0x9}, 0x10) write$P9_RVERSION(r1, &(0x7f0000002a80)=ANY=[@ANYBLOB="1504000065ffff00100000080039503c303006c1e5d647eaaa5da89d9636bc3cb64561bcf4825353f2ea57d239e3bccc9300ddffa383f8e975984f96564a5a2568739a82c66caba3cc58dc88fab6965c9e52cfcd521617bb83793ca02dbd47f8673d914b630e36b8e575f07ee53d8f5b604fc0f66287915a655c1f97499c085bd2c1344ee7310a48ed8878a7027e04094e954e6570d677b116d769f6dbb672f308d4c84836b98f6801a1d476a9839ab11b68b5629fc500dec773834e44086e3494"], 0x15) (async) r3 = dup(r1) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000240)={0x48, r5, 0x1, 0x0, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x4d}, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'nicvf0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}]]}, 0x48}, 0x1, 0x0, 0x0, 0x8050}, 0x240048c0) (async) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r7, 0x29, 0x50, &(0x7f00000000c0), &(0x7f0000000100)=0x47) (async) write$FUSE_BMAP(r3, &(0x7f00000002c0)={0x18}, 0x18) (async) write$FUSE_DIRENT(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x58) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESDEC=r1]) chdir(&(0x7f0000000100)='./file0\x00') read$FUSE(r0, &(0x7f0000000300)={0x2020}, 0x2020) (async) mknod$loop(&(0x7f0000002500)='./file0\x00', 0x200, 0x0) (async) recvmmsg(r2, &(0x7f0000002980)=[{{&(0x7f0000000100)=@tipc=@name, 0x80, &(0x7f0000000340)=[{&(0x7f0000002a40)=""/19, 0x13}, {&(0x7f0000000180)=""/60, 0x3c}, {&(0x7f00000001c0)=""/147, 0x93}, {&(0x7f0000000280)=""/118, 0x76}, {&(0x7f0000000300)=""/11, 0xb}], 0x5}, 0x7}, {{&(0x7f00000003c0)=@caif=@dgm, 0x80, &(0x7f0000002840)=[{&(0x7f0000000440)=""/131, 0x83}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f0000002b80)=""/249, 0xf9}, {&(0x7f0000001600)=""/4096, 0x1000}, {&(0x7f0000002600)=""/136, 0x88}, {&(0x7f00000026c0)=""/42, 0x2a}, {&(0x7f0000002700)=""/160, 0xa0}, {&(0x7f00000027c0)=""/125, 0x7d}], 0x8, &(0x7f00000028c0)=""/130, 0x82}, 0x8}], 0x2, 0x2, &(0x7f0000002a00)) (async) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200000, 0x200000, 0x7}) r8 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r8, 0x8b2c, &(0x7f0000000040)) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='squashfs\x00', 0x200002, 0x0) 1m38.879531487s ago: executing program 0 (id=6073): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)={0x20, 0x140d, 0x1, 0x70bd28, 0x4, "", [@RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r1, 0x8ee4a000) memfd_create(&(0x7f0000000000)='\xfb\"a&\x8fe\x11\x8c\xd64\xf9 \x00\x00\x00\x00\x00\x12\x1a\'<\xf5\xbeV\x12\xaal\xfa\xf0o\xd8\xb1,\xbd>M\xe3\x98?\xd9\x96\xab\xc7\x06F\x9b\xab\xc8\x1e\x89]\x13bZ\x8d /#k\x95\x9eLV(\x8a\x0e\x93\x93Vc]mP\xbativ\xce\xa4K\xfb\xf2\xe0\xbf\x9d\xa1\xa2\xcd\xb39\xb4\x17a9\x1c\x82\x1aLT\xd0\xb9\x1a\xafB\x95\xb4\xcf\x91X\x8c\x87\xc2\xa1\x1b\xfe\xe7\xbc\xf7\xeb\xdeL\x1d\x98Zq\xcc%\x98\xb0Yc\xec\xb7\xb5m(9\xde\xd3\xefB\xd4\xee\xb5\xee\xe0\xaa\xdd\x00\xb1jOB\xdas\xe3\xb47}%)\xb9\xbf{\xce\x94^\xec\xdf\xbcW\xe0I\x0e\xa4\x1e}\x06\vK\xed\x11\x880\x0e\x9c\xaeVU\x88\xb0\x842kgA]\x1e\x88\xecif\xee\xba\x8b\xc6\"\xcej\x84\x06\x8a\x99\x80\xd7\xcf\x96\xed\x89\x1e6\x93+\xec#\x1d2\xb8\x80Z\xf7\x06\xbe\xc9[L\xc5\xc9\xb5\xd6{\xee\xce\x17\x89\xa6r\xc5j\xec\x1b\xaa\x996\x14e\xcf\x8axQ\x8fXeT\'0.\x85\xa2\xc8\xb3c\t\xe8\x1a\x89\xecL\xcf\xd8\xb5\xfb\xbc\tX\x88\xbe\xf4@[\xb2\xd5\x8c\xb9\x0e\x17\x8b\xce\xd09\xd2\xfb\x9e\xef\xabR\x88\x17\x9et\xf7\x9c\x01\x91\xacH\xdb\xf9\xcb\x7fh\x83>\x8e\xe1=\xedR\xc9\xe68h\x19\xafLD\x94\x93\xebT\x15\x817\x9d#\xea\xd2\xa8\xfb^\x8c\x87#\x10', 0x7) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) 1m37.967355864s ago: executing program 0 (id=6076): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="000086dd00001200000000e0ff0060fc030000102c00fe8000000000a7cb44000000000000000000aaff020000001b00000000000000000001"], 0x46) 1m37.806356655s ago: executing program 0 (id=6077): prctl$PR_SCHED_CORE(0x4d, 0x1, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0xf648a000) r1 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000201c1b100c00000000000109022d00010000600009040080020300000009210604000122050009058103"], 0x0) close(0xffffffffffffffff) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x80) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) mlock(&(0x7f00003ba000/0x3000)=nil, 0x3000) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000ec0)="d80000001d0081044e81f782db44b904021d080500000000040000a1180002000000000000000e1208000f0100810401a8001600060001400300000803600cfab94dcf5c0461c16f94007134cf6ee08000a0e408e8d8ef075c11503c6baace801bcb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd6bc09000000000000002483916ddf50b8b351f55551715b52facb", 0x9b}, {&(0x7f00000006c0)="54f6d4d87eb3f1c0c5", 0x9}, {&(0x7f0000000080)="027a64c0072ebbb1512b328dda11b4efd4ba07fc642b7e012bea071dbbdea51e41958755533ccce04d3e635cbe848495e723490d", 0x34}], 0x3, 0x0, 0x0, 0x7400}, 0xd0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) prctl$PR_SCHED_CORE(0x4d, 0x1, 0x0, 0x0, 0x0) (async) timer_create(0x0, 0x0, 0x0) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x60a00, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0xf648a000) (async) syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000201c1b100c00000000000109022d00010000600009040080020300000009210604000122050009058103"], 0x0) (async) close(0xffffffffffffffff) (async) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) mkdirat(0xffffffffffffff9c, 0x0, 0x80) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) (async) mlock(&(0x7f00003ba000/0x3000)=nil, 0x3000) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) socket$kcm(0x10, 0x2, 0x0) (async) sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000ec0)="d80000001d0081044e81f782db44b904021d080500000000040000a1180002000000000000000e1208000f0100810401a8001600060001400300000803600cfab94dcf5c0461c16f94007134cf6ee08000a0e408e8d8ef075c11503c6baace801bcb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd6bc09000000000000002483916ddf50b8b351f55551715b52facb", 0x9b}, {&(0x7f00000006c0)="54f6d4d87eb3f1c0c5", 0x9}, {&(0x7f0000000080)="027a64c0072ebbb1512b328dda11b4efd4ba07fc642b7e012bea071dbbdea51e41958755533ccce04d3e635cbe848495e723490d", 0x34}], 0x3, 0x0, 0x0, 0x7400}, 0xd0) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) 1m34.769843981s ago: executing program 0 (id=6102): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r1, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xd0}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000012c0)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x20) connect$unix(r3, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) 1m34.607308028s ago: executing program 0 (id=6103): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x5) (async, rerun: 64) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x40, r4, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0102}}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r2, 0x942e, 0x0) (async) sendmsg$netlink(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f00000000c0)={0x24, 0x2e, 0x31f, 0x0, 0x0, "", [@generic="7ec709148ba31668197712fa40d4cf815a"]}, 0x24}], 0x1, 0x0, 0x0, 0x4004000}, 0x0) syz_open_dev$sndctrl(&(0x7f0000000080), 0x8, 0x600001) (async) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) r6 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r6, &(0x7f0000000180)='memory.swap.current\x00', 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0x3) r7 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000040)=0x7e) (async) r8 = fsopen(&(0x7f0000000000)='configfs\x00', 0x1) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$UHID_INPUT(r9, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125b2ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb03bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2033aae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b85b7b26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1111c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c669bb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b2967cbfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d6748c2ce5bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4658098549646bd63175adf77b5cdcf102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4baea02fa76fb4830aebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f8426a9049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21abfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e0068607000000fb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9fb4000000f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002afea6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b46e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae66444a8f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0xdd52d6c}}, 0x1006) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r9, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) (async, rerun: 64) r10 = fsmount(r8, 0x0, 0x5) (rerun: 64) fchdir(r10) (async) open(&(0x7f00000000c0)='.\x00', 0x0, 0x30) (async, rerun: 64) sendfile(r1, r0, 0x0, 0x7ffff002) (rerun: 64) 1m34.499053213s ago: executing program 0 (id=6105): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2c, &(0x7f0000000000)=0x1000, 0x4) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x800802, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r2}}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081064e81f782db44b904021d080006007c09e8fe55a10a0015400100142603600e120800060000000401a8001600040001", 0x37}], 0x1}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0xfe45) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCGVERSION(r4, 0x80044501, &(0x7f00000001c0)=""/69) r5 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x48000) ioctl$NBD_DO_IT(r5, 0xc0101282) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000100)={0x6, 0x59565955, 0x1, @stepwise={0xffffffaa, 0x1, 0x0, 0x40, 0xd80000, 0x258d}}) fadvise64(r0, 0x92, 0x5, 0x4) r6 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_INSN(r6, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x0, 0x0, 0x0, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r0, 0x5708e000) 1m19.385835216s ago: executing program 33 (id=6105): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2c, &(0x7f0000000000)=0x1000, 0x4) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x800802, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r2}}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081064e81f782db44b904021d080006007c09e8fe55a10a0015400100142603600e120800060000000401a8001600040001", 0x37}], 0x1}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0xfe45) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCGVERSION(r4, 0x80044501, &(0x7f00000001c0)=""/69) r5 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x48000) ioctl$NBD_DO_IT(r5, 0xc0101282) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000100)={0x6, 0x59565955, 0x1, @stepwise={0xffffffaa, 0x1, 0x0, 0x40, 0xd80000, 0x258d}}) fadvise64(r0, 0x92, 0x5, 0x4) r6 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_INSN(r6, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x0, 0x0, 0x0, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r0, 0x5708e000) 7.74931752s ago: executing program 4 (id=6607): syz_open_dev$tty1(0xc, 0x4, 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB], 0x7c}}, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe(0x0) dup(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)={0x4c, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendmsg$IPSET_CMD_TEST(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000906010800000000000000000600000505000100070000003c0007801800148014000240fc0000000000000000000000030000011800018014000240ff01000000000000000000000000000105000300070000000900020073797a31"], 0x64}}, 0x4800) 7.523514422s ago: executing program 4 (id=6608): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r1, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xd0}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000012c0)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x6000000) connect$unix(r3, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) 6.620899139s ago: executing program 4 (id=6609): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000021c0)=ANY=[@ANYBLOB="181600002400e5ff25bd7000fedbdf25051600800c0001"], 0x1618}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x2000) r1 = creat(&(0x7f0000001380)='./file0\x00', 0x4) pwritev2(r1, &(0x7f00000011c0)=[{&(0x7f0000000080)="8779588ae8f1663137682ff7aedbed6eccdae93b0ed5ab7335c521cf069d53a698ac41641f588b335b86c71fe6a4d8ef23943d6e926e83820bff66908f5f17d5787263f5c9e54c2fbe6fa951c3de15028912f1bd4f6fef2b1be0c349bd7081f6b17ca3ede02762df834fc25d22e43697902f92cf3258d2def35e42cb41998ec277f39d452b3c977c37d47d1ae73bfe13c25f7d93745007a7c986c183ed031dfe1fe148d71bf02ad07bd4ef440a84275581b610650b", 0xb5}, {&(0x7f0000000140)="9ebf09cf4d6b8a3a028bdd9c998d535375997ff76e8e54397aeeb558ea6f91bc08f8d5dafffb4be498927c15291a336d564794884b181c8a7ef4ec74d29b21b5b2983cb4d1ca1335dbc19db15a8f8e15b22acfa8ad60603dfd68a0d56d2cb8671368e45e0651039044140e2e3f33516512a90cdc5afc9b955e212a52f5b25580ae14b60052cda3c965ac92a1e2569086db000ef8a22fcab58254a3860f0cc4f0171d7fd8469f8207db928bf7f81ba81a6cd30071e4815c281a973324893425ab2b784253fada9a56c9ce482d16a4a581de6e81724f95cb8642d3cb5bcbfb9da60a805833dda75ae451f8a4a1b05ccd60d7210f8406a1f533f01a9752e4ff5236c2f8bef0e322f3745d551b7f1a80197ed3cacee98bc09fd9b3856d95f3ae409ae41f3cb1389166a9d686c59d6db58011a4728540da935d731517d37b940e43f1ee933d1886bc0d531e429cf5536a6c2fa9de1d8e569e05ad9122a1fc688850d69d01abc3d9112f53fb7d7436b79cda202e631317ea6ca78e2b9678318e324cf2c071f7125d10978cd00e6ef5ecf71cfe4ce078993bafaf640970de65efcacfeb9cc518f19fb7e4522edbdf8c78763dfc5846142eb4340d4ee2c4ce99cca48edee08ea3060e3827f4d45bfc537c15678032f29829f7d2c9bdea073cda9b9a26b18044ff10d1666b44f9a6c89440182a5c15b4d11b12f2a9e3f743b6f411a087e9419b6acdf48797a6b09307787947ded5868555e0d519ba83a3f0254ed8ec5e0ddc15950f831a8316cd50cb99d28a2a776f613923ec37a42808531a3aed755c499866f67243f7927c555defee6cbfdfbfc5ddd7479dae128e0a2fa7a863f9190aeeb2ae6afae1d808386ebe3a89bbdcc56f1cf919512d4aaa42b1d65ea54858e218033d131236514020a8aba24bc1a0a33a54fa432b799a1581bd8241910eacce9789944a634fe48a25a72139f47ddf81156c6ec65100f4e2baceb04cb830dd51643ca51b80b7c55163f0f30ecd1e09a187ed6bfe03a9cd8616ffadf105d2951694e9f2eaf69b9b2e6a7da81f312c2102b28e3da2409c1cee989c2cd8a005094179958d18bb94fa8576823aae0fb9bbf4bd410c4e4e50b0b13ee3b790ac9ef30a4ec8d84fbb6f6f8451ec1d3cf37d6e3c7b5e87e4a54fa0c6ea98ac97956f3035f7c79516cb471cf621adf5cb96bbd6346aa7eafc14382a8296edb0d3eebef6a1b783cebb6a902270e426afc1287d77ecd4bd9c3a2b99ba8c8da604b1e9ca56c0e5acce32aab8d62131084e43132659fd559d4417a76faa6658f32440b18eb38e36776d81ff38cdb9571eb3d6acfd3e55acb418ebe868fc75acc6a489c145537c83c12f47d78154f0602e0468e992510bb577548f882846f1e8dc2281411910c9127effc80e9a369e9484f49ae821d1e2f60d822d99a6ffa59f49e298e90018bec7cb7fdd5925ee4ac97828a54ede0161878ec3414cc9e2dd4a451c07529d989b8360481b867645840d3a3634a6141f25fce6f1cf22842d5a8b8ec7b9d6192fee817b6f594b1193996cb32cedb0bfcb45eac8e3a709752b1339d7a1076b1ea417cfd575de83abdfdb169e65291acc947c270c64a3d42413c6600a7587ae878a54026acd1f54aeb088dc5940d63c1341c5221ed0ba6a4fe1df754b423bb96f70f1634b10880e39eb00c447e291ff904e786c0ebe0a3012c7d8e9ffc617d0c5072c085a1f12ccc17135e36b012e459e0bc2997dda8075212b96a1368caab04275690ff28b66c6d9686699937f6d43e1bc4a1e0dc12a42a9afb75b17c685a995ef696b8b57e57d7e30254dc082d715c8822e2a3591d0de4d07a9197ac4e0d62b30669e2ca944f9111b46cd3d54e9255c3e1f88ee5e4bc454fc5c84ba2b3c073b2ab40eeed1e86bbeb398d734adf8e6f81be17cbf1daff567ff2c36998bcdf3b90145da77e09f3c04faa2967486b0c126126158db23c32f335c1dbfce2f12c80dd6e245ff5b1f1344a865b27e4668051dc406b38a4e736ff5749b2089f0d5466c49398db7359b028646028d6b17d9f68fa3da994d4724c139bc82ed741ad04ff53205fc3bc9289a5382acfe98c1ef9548b2dbeaa4944aac874dffdbe81ceaf89c5ef06e67af85384c435c9eef7aa0d10a3fca07530932d57040c05abed330fcf770f2c18b8ec1630f6206d50fed7283e7ea9c1e8376404e79f3dcebf14a441c684505ef597c6852323d67d81ee2ae732737e6def2bc316c3f020322f0bf95023626519d88b66de5fbf291e17955145dd91d20c2901c6a8e6b6352e1bacc96f8feb6e3acfc9c76d4e4b2c8a45e3edaacf41a89d39eb92d681fe145e7b27bd94e59c295c1a1f6aa3a75b86957f603d527e833d3c837cf7ea4419f34f379381d81350b468122e39a84028ee14f4d76a09511b23401715f3f102e997fda2e7283f79ba673b00e2ccbcfa015d321539e359de471591161df9e4dae19e3b674207076209cb545b8c4e9f85d0f2a581cbe59fe3962800f3e2219d5192bb8a8e02a330f41fca21617dc186cc17005073d4fd3c14a6fdd018095bed42be74b059c26bd378a14f2f73d964301c0aed747ed1f90e2272bdf83cadaf28a7dc8de9e65c892f1e89047d86958830bd4a69c97a15e0376bf81445f5fb3f81695b34ea8a7fffea94d4289ab197699e9bf90b0136491e15f7a2de0183ecd7ac4dc8ecb43693f1406dd5bb8b57de2b23f8365af823b9ca1358d784b8420edbbfe36d13d2483320b11519c42c1991f3a3c57d97668a1721e169d1788059ed2d902832ec57adb1b695996568dace2119b430bd02ff460df33aa0afcff4ed4d25cff2cbed4a15065664374c6b6596d81f2e3f613cc62fddc268d3a264f3f942b33de6df930b348f104c54872ef3845da25a01b1cb823bfba21c2b31c95f05e3c9d5229445e79220d9fc8f44f6c18caa92f1157d7e6e4c78bbc05ea66fe978c8743ca4fbf8abf64d8172c40189a463350133ecdda67cd18059a9d30b3979be29c2ef34c95015b6bd25bfae6b243cfee201708799b885d951982e593e9600d225ac513dc9c7ca25da8ad4aa4801c3a95a61fac014466e92517b23c3ec339ab72af4ff14187879f42d09fd85bdf16d43a8dd2b7f1c8b2b67a978fe42e725ed3de04aea6a0aabb3035376a1dcc80c384a215a7bdb44cd223b9b5c75e741f2a2c651079ba2450b8e270392e8d6c9fbea1457e0cd1b89616caa5268d4e77478fed28eb2533822a07469a1b5e5b9881a872222faf366c4e487d2ae98616787c74619884eb53399bf6e79542b1bc6926cca41c290c3e67fc65b21758ab833a4e61cdf769f6de2b3a8e5b043701dca29facb75c7580a0da7917a67ebdd6508ec127d9694d252d69858248f84b15db99d3c9af77fb08f064519c3eaa3e93a56ac4b3c364adf442f0c4a1258453500df986e19da3655b85c2b3e469c1ed8ad5768303e71587309c75e0e2ccb2b8089bcc859ca204f5ba2398de1e29fd46475e599f3e758833a3676a3f7059b67841dd26b71e784978ed6e3651bd1fc11797e54aad9902511cd9834b7f8f3b62cebca4b92dd5a70e184ffd1fd3d3f37e116fbb05b823de8e017d43a3f5bb99fcb037deebb909290d63277d0df993a8b9b831fc7220864744fb31336531c8239894421c6d0528577233c7f723698f57c7c9ecbbb96875a076782938fc3b9eb6177e9b2049f1a7ce4eea4cedf2f89c8b372ac43c03f2de41e29053ed990a2d609883831fc37efa6cb38eed414922a941021a0ec8f72fc328eb144d3234c3cabf4c4a0688f5d6dc7e6c94bf4b19d7a968b041583b73f81e6d24e630aa444d734841d81acbed11ca363728c5fd77dcaefad24c55394f64207e3f32e906b8993989fb58402e119c6e2d959f3b1c03f39d0673385ed4c787c540d20f8bca0ab2f31ac76f623b6566e82fa870c9dbc7b269b453150afa68f3d847565d0a9184a77216c41deaca9b1b8d5e6b60b86e0b56ac35318c946651498ce82dbc09c727c82ac9e023d5fd7c36a5295cebb9e67f385582d960f3b63c97318e68eceeeb47db4c0091f556595b7809bb1f834ae2cf120643dca5cd1267d8dfd0ba741dcf18fa3f37a696865dbdab64017092c6c03be18858491f9afb9b38df92f09fe126dc400a3f84b3d777efc4d3e052f753b52e9975e217f7cd41d657a4d4e86373ea86a832aea0b21dfbda1faf7ae2a5870a245cf4f2061829a88c15ea33835d552f83f924a746e727ef0c1914987a47224e5855d7e4c78ffeabf2c560d3da8ae12ce1a5182259c445585ba82568a52e944d7eee1cb4085144d8bf694dfdb7d80d3fbcaa7f1b6d5bb0d7800496dc3d1181a270a2d16f5c0c7c4369da9115920fc822ae7bb063ae7269bb1e6fc2d6601b2a4018e4e7ece077091fab1638f646366f05660f73b7519505ade3113f40a6b7e90ebe1bcfca1200b15c127f5698bc9cc7edd78aac02f31483b8cb7101ed33e2f22bc8aca3f8efd892f87d44f3a9fda2c52bf2040521ec8c3b0701c49052c5b89605906c97d109716f90e065644a597b304ff1cc508d61b31817327d26f3be345165e323336ad864ee20edb961920a3692201552bd8c758a38ed2687829ec2709e9f522c3b27c154b01f1ed041ffadc87957112214242fce17f481cf43cd6899d6fb038b0ec863b2ffb9507a164a4fd5d9d99af2375e8d221d32e98aa085257dd6841c6aa45167c395003ba083d50f27183a3ba92ccdc89d3a8de0d80726b4ce2ccc154b82239c0c473043e3b094e5ebe635f20cffae5b42b36f869345e067101137b8cfc4c7cd5b906da0bc59969eb0496eb6303194e8fcca4c789fdec2f9750bd24384c0de8f877ad50258592fa93daa19f3f275831cc5d60f2e226e4f95b68944634787df81e042789f3253f83eb4a3dee1dc6c28c660cbca08ea2083cda35d0062f7102d322ec57ff0114de068dc04695f225ada005fc1accc52bad224d1f6ce029eaa06ab0f85d3260619733da4977bdf5c6cc0da98cc9fe3f2b193f7007da8f086052c1cfd0fee4b26a32c31db845ca33639ae7a80addad900f4f9efd6e0fd358ee43d77b6cbaa48d4be23e27bac5a7e4111ea388fb2a2194f39fe1d3175708f138ef45dc6482c5241ace1b196fa0e722e6edbe7e264a3d9684c56c2793964230ec00800a01b73d8d490fcb9754fcde137ea31237d321072369897a81f52b91187a08da06540342709b470d2c198b94ef4e76e50f8439844c52eb94bd47dc2fedadf56fb25e481256719b48604bcef54d7ffd875868d2689df73f9b028c261f9b0a77e2878bcdd495f82dd209591358a0ff90341b5e791f1f2ff81c35a07cc15021a4ab393573ff1bffcb874e9fde8d308bf9792e7178798b758df2bd3a927e8772e75314928ac04483c0a0f28506e75411366df3414426b711961618240677fd7a0121369a19b933a92ff2f81f7f64ff21b5ac7afa4f131cb728094801aff87b968d23fe8aed0725a4fe6c696888693a437bdc275bacafb960f147b8791fe9980f6d18de69bb51defb29b2c9c53d3565a6c4d2a1dd305fd7859b67990fa6b38868952f4b87d6eb1f50ba7bec0598e633d54692adaf2200d2e30693eff8eae05d017847a9829867bf55914a5310a70cffe893a98ae946b146a4780c4983b74be189fcc3305f42ee2e27511aafa9678922a45907bf3c4357d27227b522b67d5ba4aed898bbc8beae94b22a9bf6d73fabf8b86360f89a286625f0f916ffe2e60305ae74177d55fb6baebaf9793cfb18b0455a0f5d5fd14319725cb", 0x1000}, {&(0x7f0000001140)="28b265856e4595a5b40554b952823e65eba089dab2a171d5156eed4e0cb6d02550fa94faf9c76a4d83caf84a3eb0252cfcfa5cf379436b0b8892c224ee47e6433f790c98d153bad26306f09fc240f0ffe33534d32f71523ac074b611e8a1720c9988623b98e304f6c81bd9bb9c", 0x6d}], 0x3, 0x54409c62, 0xffff, 0xc) (async) r2 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$TIOCL_PASTESEL(r2, 0x541c, &(0x7f0000000000)) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000040)='ext4\x00', 0x80a0, 0x0) (async) readv(r2, &(0x7f0000002700)=[{&(0x7f0000001200)=""/75, 0x4b}, {&(0x7f0000001280)=""/222, 0xde}, {&(0x7f0000001480)=""/4096, 0x1000}, {&(0x7f0000002480)=""/138, 0x8a}, {&(0x7f00000013c0)=""/34, 0x22}, {&(0x7f0000002540)=""/165, 0xa5}, {&(0x7f0000002600)=""/245, 0xf5}], 0x7) (async) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000001400)={0x15, 0x65, 0xffff, 0x1ff, 0x8, '9P2000.L'}, 0x15) 6.119500929s ago: executing program 4 (id=6613): close(0xffffffffffffffff) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r0, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r2 = accept(r0, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xd0}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000012c0)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0xf5) connect$unix(r2, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) 5.169345622s ago: executing program 4 (id=6623): r0 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000040)={'filter\x00', 0x7, 0x4, 0x418, 0x220, 0x110, 0x0, 0x330, 0x330, 0x330, 0x4, &(0x7f0000000000), {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @empty, @empty, @broadcast, 0xf, 0x1}}}, {{@arp={@remote, @dev={0xac, 0x14, 0x14, 0x2e}, 0x80ffff7f, 0xffffffff, 0x1, 0x0, {@empty, {[0x1fe, 0x0, 0xff, 0xff, 0xff, 0xff]}}, {@empty, {[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}}, 0x6, 0x7, 0x8b, 0x68c, 0x81, 0x6, 'wlan0\x00', 'team_slave_0\x00', {}, {}, 0x0, 0x1}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @empty, @multicast2, @remote, 0x4}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @multicast2, @empty, 0x4}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x468) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f00000004c0)={0xdd, {{0x2, 0x4e22, @local}}}, 0x88) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000700)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000006c0)={&(0x7f00000005c0)={0xc8, 0x0, 0x1, 0x201, 0x0, 0x0, {0x7, 0x0, 0x9}, [@CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x1ff}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x1}, @CTA_TUPLE_ORIG={0x54, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @local}}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x24}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @broadcast}}}]}, @CTA_SEQ_ADJ_REPLY={0x2c, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x1}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x5}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x8}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x9}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x6}]}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x1ff}, @CTA_ID={0x8}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x24}]}]}, 0xc8}}, 0x24008884) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) accept4$inet6(r2, &(0x7f0000000740)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000780)=0x1c, 0x1000) mlock(&(0x7f0000ffd000/0x2000)=nil, 0x2000) mlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000007c0)={0x0}, &(0x7f0000000800)=0xc) tkill(r3, 0x1) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000880), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r0, &(0x7f0000000980)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x60, r4, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x1}}]}, 0x60}, 0x1, 0x0, 0x0, 0x80}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg(r1, &(0x7f0000000c80)={&(0x7f00000009c0)=@x25, 0x80, &(0x7f0000000b40)=[{&(0x7f0000000a40)="693a7e5c223d36dbe361d0c5c80f99827b39a38ca87cdc91573913190dac1f899e36f5fd46acf65520d68ce0c40f386fe5a664ca0439b6c8d72e1b0be5c37271081adddefe259cd480e2dde7b293211c3ef7c4bc115be9833e221ba57f7a0a2ca1dd2c7b509d06766f7d43c1d5fbb23b0f2029d5c4dfcdc68d9e6e0615b02dc5499c9e", 0x83}, {&(0x7f0000000b00)="a3", 0x1}], 0x2, &(0x7f0000000b80)=[{0xd8, 0x110, 0xfff, "9654c872c62e10e4d45e3082c73ca700e22a17caf161167280df9a0b68a97cf2b62797a9300aa16bf4d0d76db735c05fab3c9c3021f2f1191172c734de861633993a9c79b48b7eebc5135d8d26c5f381e23af21f3085fa90520757f8ac33691e5dc9d6fb3096460107f5ba80027ff2e3df9f4f72408b08edfd0210d4772ed74f23ca57f9ab7a44f9f5654bf7330bb51541e482f17702103329a0263ef97a946434ee60f2a49edb81cb630e8516b74be10af0a83ef04526a15e0e4094b59933f36070"}], 0xd8}, 0x4004) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(r5, 0x8983, &(0x7f0000000cc0)) syz_usb_connect(0x5, 0x24, &(0x7f0000000d00)={{0x12, 0x1, 0x201, 0xb1, 0xa3, 0x2f, 0xff, 0x1554, 0x5014, 0xd1e2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xfc, 0x1, 0x40, 0x74, [{{0x9, 0x4, 0x72, 0x0, 0x0, 0x6c, 0xd1, 0xc1, 0x9}}]}}]}}, &(0x7f0000000f40)={0xa, &(0x7f0000000d40)={0xa, 0x6, 0x110, 0xb5, 0x8, 0x1, 0x40, 0xc2}, 0xb0, &(0x7f0000000d80)={0x5, 0xf, 0xb0, 0x4, [@generic={0x86, 0x10, 0xb, "b8cbe40d91a83c874be6e25274105d4b91e8b8e1c8a49c905ce84515ee951be2ab905e450e780f747d89b426d90cc7b14f1699e9a6c4a6ccddc0e8f37ab5e079f1f9b97d743e1b6d6a28dd85e0489b7d8b79d80769dcd6ea790a97d300c2b76b435ed9a34b53e228a9b4021597345f0bd9ea4dd114aa64c7932606b9de6c926715cc66"}, @ss_container_id={0x14, 0x10, 0x4, 0xa, "d769ce43d2f28323863983219b272ba5"}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x8, 0xc, 0x6849}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xa, 0x1, 0x1, 0x1}]}, 0x1, [{0xcc, &(0x7f0000000e40)=@string={0xcc, 0x3, "6b8c9c7a3f7d4d8c01ca1335e251877740ecec16391006d224b328495a7a7d64eb68a405b091d72777f5ff2af7aa9c3044d82892a5dde97066329dfc5629df305308b4cc848ce19a4f36a6b11403aee7f1ad78fbc1deaf82bdee7745f97681bf5c80f9ef0f89f25ea2ccc2ef48f846a38b12b977a44a771eb4d9601c16211bab6f8e508e359e07639c13e1d519042d648654a2ea4706315cc682a5f25d638e5e9edca5e97fa260367fb59228e1d41be41715b15982132885acc14c32b7880df16b6cd635359dc1eec827"}}]}) sendmsg$nl_generic(r0, &(0x7f00000010c0)={&(0x7f0000000f80)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001080)={&(0x7f0000000fc0)={0xa0, 0x38, 0x200, 0x70bd2c, 0x25dfdbfe, {0x9}, [@typed={0xc, 0x14a, 0x0, 0x0, @u64=0xb}, @generic="78714f5f109c1fe18453abcf60650c64ee6f7fb7e70ca7e170a620a68d871d636eb681e7ba000373fe2b1d0aa6095e41cac59b2d22e1d8abb1093a55547c50c401dad61ee6c420c9dc45abd518b3c5a390d8747f9d8ceeb225206a9c613b078f0636cd1d73266e9e596ff9c22915a918a59818e8fa2ead54ab159b7418f17b"]}, 0xa0}, 0x1, 0x0, 0x0, 0x80c0}, 0x40) r6 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000001100), 0x88800, 0x0) r7 = openat(r6, &(0x7f0000001140)='./file0\x00', 0x482000, 0x210) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f00000011c0)={'veth0_virt_wifi\x00', &(0x7f0000001180)=@ethtool_eee={0x44, 0x76, 0xec, 0x73a4, 0xc88, 0x4, 0x400, 0x1000, [0x3, 0x5]}}) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(0xffffffffffffffff, &(0x7f00000012c0)={&(0x7f0000001200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001280)={&(0x7f0000001240)={0x2c, 0x2, 0x7, 0x101, 0x0, 0x0, {}, [@NFACCT_NAME={0x9, 0x1, 'syz1\x00'}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20008010}, 0x5) ioctl$KVM_GET_STATS_FD_cpu(r0, 0xaece) bind$inet(r5, &(0x7f0000001300)={0x2, 0x4e24, @local}, 0x10) r8 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_mreqsrc(r8, 0x0, 0x26, &(0x7f0000001340)={@dev, @rand_addr, @initdev}, &(0x7f0000001380)=0xc) recvfrom$inet(r5, &(0x7f00000013c0)=""/95, 0x5f, 0x10101, &(0x7f0000001440)={0x2, 0x4e22, @remote}, 0x10) r9 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$IP_VS_SO_GET_TIMEOUT(r9, 0x0, 0x486, &(0x7f0000001480), &(0x7f00000014c0)=0xc) sendmsg$DEVLINK_CMD_RATE_DEL(r0, &(0x7f0000001740)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f0000001540)={0x19c, r4, 0x200, 0x70bd2a, 0x25dfdbfe, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xbf, 0xa8, @random="c0a78cce5c37eecf1aa9c4c0b0127b2db91c7c882bc06d6759e9db9a030c5fafdeaf81d097459f90a93b02a6658d1b7f499f39e7af68747c69285c26379527d5e07c19b6eb9677f14f9850f28c5eaab8c328b998452a26324b60f68b2796ccc4c53f8a6062c2de22e74fc6e84b911afba5e3e8fe77d15e8291eb21b31018e878bd176973e4f6bbe00adb45a052d01123a0d633bf43cdeea4a676438cf1c95a3b8c83b4e82df2bf9148b369e7dea7fc53f22d2b3e3a39c2e86d2271"}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @handle=@pci={{0x8}, {0x11}}, @handle=@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_RATE_NODE_NAME={0x60, 0xa8, @random="9768827a6f21a4d17f6853405a76df83208db30ac99c13b2e46a2d3df02e660eba4a1170510c69475e10bf1502ba857dd4275936508101f71470f2e771e935e7763cfa1707530e66c85bbb668b4cd97fee72d79392ae9fc5e56462f5"}]}, 0x19c}, 0x1, 0x0, 0x0, 0x40004004}, 0x880) 3.503487288s ago: executing program 1 (id=6629): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f00000000c0)="5c00030013006bcc9e3be35c6e17aa31066b876c1d0000007ea6e763160af36504001ac0080010000500020002000000ef64bc24eab556a705251e618294ff0051f60a9553adac000e4509c5bbcd72c6c953ec3ded4d8217961381fd", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x10) 3.473347484s ago: executing program 1 (id=6630): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x200a}) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x1ff, 0x101100) r2 = dup(r1) ioctl$MEDIA_IOC_ENUM_ENTITIES(r2, 0xc1007c01, &(0x7f0000000540)) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010102cab4c508720c14008a570102030109022400010b00e0090904f405021df45208090503030000050881090502"], &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, 0x0}) r4 = dup3(r3, r0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0x54, 0x0, &(0x7f0000000340)=[@decrefs, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f00000004c0)={@flat=@weak_binder={0x77622a85, 0xb, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x1115}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r6, 0x6c3ca000) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 2.094282668s ago: executing program 4 (id=6635): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) (async) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000480), 0x1000000, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r1 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat$loop(r1, &(0x7f0000001600)='./file1\x00', 0x0, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') getcwd(&(0x7f00000001c0)=""/97, 0x61) (async) getcwd(&(0x7f00000001c0)=""/97, 0x61) open(&(0x7f0000000440)='./file1\x00', 0x0, 0x73) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0xc4042, 0x1ff) (async) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0xc4042, 0x1ff) syz_usb_connect(0x5, 0x59, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000ec1bb2106c04e01401000102030109028f11010000000009046900000e010000182402010202f25d16876185782d8918b263b57fcb8a1c611b"], 0x0) (async) r2 = syz_usb_connect(0x5, 0x59, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000ec1bb2106c04e01401000102030109028f11010000000009046900000e010000182402010202f25d16876185782d8918b263b57fcb8a1c611b"], 0x0) syz_usb_control_io$uac1(r2, &(0x7f0000000880)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x52, @lang_id={0x4, 0x3, 0x200a}}}, 0x0) (async) syz_usb_control_io$uac1(r2, &(0x7f0000000880)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x52, @lang_id={0x4, 0x3, 0x200a}}}, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='squashfs\x00', 0x200002, 0x0) 1.826963738s ago: executing program 1 (id=6636): syz_open_dev$tty1(0xc, 0x4, 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB], 0x7c}}, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe(0x0) dup(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)={0x4c, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendmsg$IPSET_CMD_TEST(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000906010800000000000000000600000505000100070000003c0007801800148014000240fc00000000000000000000fff50000011800018014000240ff01000000000000000000000000000105000300070000000900020073797a31"], 0x64}}, 0x4800) 1.736364809s ago: executing program 1 (id=6638): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f7, &(0x7f0000000040)={'ip6tnl0\x00', 0x0}) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000f80)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000002d000100000000000000000008000000", @ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0xee00, @ANYBLOB="0c0000800500010031000000ce4f7b8dbf303dc3f774288bb6da81dd616c5d85765af93bbd8efc96bb1ce77de4e54eb7255dfe519198cbea0ce91a01a9acff5fccf6efe3788683968678a38e182b7566a0c32fef40bc42262d218b0194a7174759bdef475eff8c05e67f4ae1a2531f3fd36c59f66b4cb7cb5714edc9c7c249901e17a920ce166608bd735d6d0859a257819547e9ff0dd347947de901a27bcfcf53f7cee2e7153667d00f1a35a2e185e08dc9f7eb3efeafa31eaf098cfdf4a3ad3ee1966aa250e8c499045ce9b887f76f7f9edd050000000000"], 0x2c}], 0x1}, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/vlan/config\x00') madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) sendfile(r1, r1, 0x0, 0x7ffff000) 1.262300371s ago: executing program 5 (id=6641): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x8900, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0xc048aeca, 0xffffffffffffffff) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_x25_SIOCADDRT(r4, 0x890b, &(0x7f0000000000)={@null, 0xa, 'syzkaller0\x00'}) recvmsg(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) (async) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r6 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c000000120001000395000000000000020900004001"], 0x4c}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r0, 0x93771000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r0, 0x93771000) 867.563986ms ago: executing program 5 (id=6643): r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x800004, 0x4000010, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x40, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000002c0), 0x404001, 0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000300)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x6}) io_setup(0x7, &(0x7f0000000080)=0x0) waitid(0x2, 0xffffffffffffffff, 0x0, 0x4000000b, 0x0) io_pgetevents(r3, 0x3, 0x3, &(0x7f00000000c0)=[{}, {}, {}], 0x0, 0x0) syz_io_uring_setup(0x66e, &(0x7f0000000240)={0x0, 0x0, 0x10100}, &(0x7f0000000380)=0x0, &(0x7f0000000200)) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000007, 0x12, r1, 0x10000000) futex_waitv(&(0x7f0000001740)=[{0xf, 0x0, 0x6}], 0x1, 0x0, 0x0, 0x1) syz_io_uring_submit(r4, r5, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x2000, @fd, 0x0, 0x0, 0x0, 0x3}) syz_io_uring_submit(r0, r5, &(0x7f0000000280)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x8, 0x0, 0x34, 0x3, &(0x7f0000000180)="da9bb17e4c9ec2fb87f1555f96621b0f45fb63f841c5f7b2a5013dfbe4183cb3975f367c6a71ffc78dacf86628ba8220d3f610a6cbdf9a9d4d6a59f4462c4da70597a732c74dcbe57715237b5842c584a8a9cf7ad82b83f24d98820df88e97fab1b7c52e267a7fee52111cafddf1c368ab857f2420eea22276a3ed27b74110761270fb9a4d7a9e690c91e2205372dc64fc71b7871c14c6055d78548f925e39a6bb17bed297f8972dc84784a686bae633d29d8595ee2843df73084591fdcc09712ca64bc658f7577c5b2c7ae7ae1d8845", 0x9, 0x0, 0x0, {0x1}}) mount(&(0x7f0000000100)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='ext2\x00', 0x200000, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) syz_open_procfs$namespace(r6, &(0x7f0000000140)='ns/pid_for_children\x00') 825.838335ms ago: executing program 2 (id=6644): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0xffffffff}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x15}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}]}], {0x14}}, 0xd4}}, 0x0) 794.973986ms ago: executing program 1 (id=6645): r0 = syz_open_dev$vim2m(0x0, 0x0, 0x2) r1 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, 0x0, &(0x7f0000000040)=0xffffffffffffff67) (async) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, 0x0) (async) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r2, 0x8e62b000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/cgroup.procs\x00', 0x2, 0x0) write$binfmt_format(r3, &(0x7f0000000040)='-1\x00', 0x3) (async) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) splice(r4, &(0x7f0000000180)=0x1, r3, &(0x7f00000001c0), 0x800, 0x4) r5 = getpgid(0x0) sendmsg$unix(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@cred={{0x1c, 0x1, 0x2, {r5}}}], 0x20}, 0x0) ptrace$poke(0x4, r5, &(0x7f0000000040), 0x9) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x1c3042, 0x0) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x9) r7 = socket$inet_sctp(0x2, 0x5, 0x84) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r8, &(0x7f0000000500)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @private2}, 0x1c) shutdown(r8, 0x1) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) (async) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r9, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r8, 0x84, 0x18, &(0x7f0000000040)={r10, 0x8}, &(0x7f0000000240)=0x8) (async) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x66, &(0x7f0000000080)={r10, 0x7}, &(0x7f00000000c0)=0x8) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) r11 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x40002, 0x0) mmap$dsp(&(0x7f0000343000/0x2000)=nil, 0x2000, 0x1, 0x100010, r11, 0x0) (async) readv(r6, 0x0, 0x0) 699.551461ms ago: executing program 2 (id=6646): syz_open_dev$tty1(0xc, 0x4, 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB], 0x7c}}, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe(0x0) dup(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)={0x4c, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendmsg$IPSET_CMD_TEST(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000906010800000000000000000600000505000100070000003c0007801800148014000240fc00000000000000000000eff90000011800018014000240ff01000000000000000000000000000105000300070000000900020073797a31"], 0x64}}, 0x4800) 558.496862ms ago: executing program 2 (id=6647): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="000086dd0000120000000000000060fc030000102c12fe8000000000a7cb44000000000000000000aaff020000001b00000000000000000001"], 0x46) 517.011384ms ago: executing program 1 (id=6648): r0 = syz_open_dev$video(&(0x7f0000003d00), 0x9, 0x0) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f0000000000)=0x1) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi5\x00', 0x4000c0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup/file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2000) socket$inet6(0xa, 0x3, 0x4) getegid() r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x76bd23, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r5, 0x401054d6, 0x0) fchown(r1, r2, r3) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) r6 = userfaultfd(0x1) r7 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000040)={0x9, 0xffffffff, 0x4e, 0x567}, 0x13) sendmsg$nl_generic(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)={0x2c, 0x16, 0xa01, 0x0, 0x25dfdbfb, {0xa}, [@nested={0x18, 0xca, 0x0, 0x1, [@nested={0x14, 0x6, 0x0, 0x1, [@typed={0xd, 0xe4, 0x0, 0x0, @binary="b1fc2d971a289f852a"}]}]}]}, 0x2c}}, 0x40) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x4) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8b04, &(0x7f0000000140)={'wlan1\x00'}) r9 = gettid() tkill(r9, 0x11) setsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f00000001c0)={r9, r2, r3}, 0xc) ioctl$UFFDIO_COPY(r6, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) r10 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r10, 0x0, 0x8, 0x0, &(0x7f0000000680)) 419.443917ms ago: executing program 5 (id=6649): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x40) close(0x4) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000380)={0x0, 0x4, 0x68a}) ioctl$BTRFS_IOC_GET_DEV_STATS(r1, 0xc4089434, &(0x7f0000000780)={0x0, 0x354d, 0x1, [0x1, 0x9, 0x7, 0x6, 0xfff], [0x3, 0x1, 0x4, 0x5, 0xd6, 0x200000, 0x39f, 0x3, 0x8000000000000001, 0x5, 0x18a0, 0x27, 0x120000000, 0xc, 0x9, 0x82, 0x5, 0x3, 0x9, 0x9, 0x3, 0xfffffffffffffff8, 0x2, 0x5, 0x8, 0x8000, 0x7f, 0x74c0c7ac, 0x8, 0x1, 0x3, 0x9, 0xfffffffffffffff7, 0x9, 0x3, 0xee93, 0xe, 0x0, 0xcd, 0x1, 0x0, 0x6, 0xa6, 0xdbe, 0x5, 0xffffffffffffff9b, 0x5, 0x8, 0x40, 0x9, 0xaa4, 0x64d3, 0x3, 0x4, 0x7, 0x1, 0x2f2, 0x277d, 0x8001, 0x0, 0x401, 0xfffffffffffffffe, 0x8, 0x1ff, 0xb4, 0x52fd, 0xf, 0x8000, 0x8, 0x8, 0x3, 0x4, 0x6, 0xc45, 0x2, 0x3, 0x5, 0x7, 0x8, 0x2, 0x4, 0x5, 0xf, 0x0, 0x5, 0x6, 0x600000, 0x2, 0x81, 0xfbcf, 0x5, 0x6, 0x8000, 0xffff, 0xfffffffffffffff4, 0xffffffffffffffff, 0x8687, 0x2, 0x6, 0x3, 0x7, 0xf4, 0x6, 0x1, 0x400, 0x7, 0x2, 0xffffffffffffffff, 0x7ff, 0x7, 0x9, 0x2, 0x1ee, 0x1, 0x7fffffffffffffff, 0xa, 0x5, 0xae5, 0xb, 0x6844]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f0000000bc0)={0x0, 0xfffffffffffffffb, 0x1000000000000000}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f00000031c0)={0x0, 0x6, {0x1000, @usage=0x9, r2, 0xe0, 0x9, 0xc5d, 0xffffffffffff8000, 0xffffffff, 0x20, @struct={0x80000000, 0x3ff}, 0x7fe549b0, 0x9, [0x4bd, 0x8001, 0x6ca8, 0xf, 0xb, 0x5]}, {0x7, @struct={0x10001, 0x5}, r3, 0x7fffffffffffffff, 0x80000000, 0x3, 0x2, 0x5, 0x13, @usage=0x101, 0x28, 0x7, [0xf83a, 0x87, 0x1000, 0x1, 0x0, 0x1ff]}, {0xfffffffffffffffc, @struct={0x5, 0xe}, r4, 0x0, 0x400, 0x2, 0xb, 0x4, 0x0, @struct={0x6, 0x7}, 0xf0, 0xfffffff9, [0x1, 0x1, 0x6, 0xe, 0x6, 0x5]}, {0xdb7, 0x3, 0xf}}) read$FUSE(r1, &(0x7f0000001180)={0x2020}, 0x2020) r5 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = syz_open_dev$vim2m(&(0x7f0000000040), 0xf74, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f0000000100)={0x1, @pix_mp={0x0, 0x0, 0x38415261}}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, &(0x7f00000000c0)) sendfile(r5, r1, 0x0, 0x7ffff000) 359.313224ms ago: executing program 5 (id=6650): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f00000000c0)="5c00000313006bcc9e3be35c6e17aa31066b876c1d0000007ea6e763160af36504001ac0080010000500020002000000ef64bc24eab556a705251e618294ff0051f60a9553adac000e4509c5bbcd72c6c953ec3ded4d8217961381fd", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x10) 358.867497ms ago: executing program 2 (id=6651): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007f9, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmmsg$inet(r0, &(0x7f0000000500)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000001c0)='t', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000004080)=[{&(0x7f0000000a00)='R', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000000e00)="174dbbc4cb440e66b35d7806d5d0fd6202b490652f26aaf1216beeb537d5665c2268fea65d415252fa850f143fa5ccef495735ec2d6f9769a5869a149ab97877cef8e410fce906f7c4a609c5186492f03ab3ab56cffa8ef4d2337f4a7029c1adc31517557fae5abed00ebc2a3e3bcef4b82e05aec92550fc8ed146da40335055f1312d3954880c9f0c6974282b64764729ccbd5402e751511ea4902d77d8349b1952281a536805e27bb31df49587d23ab5ee13a84238f8a138931badf4cb17c6ff8107159e605e4daba2e3c99764b2db85dc8fe6fbc658f882ad56605508177f3141af4cc6b01fe20c5a7e", 0xeb}, {&(0x7f0000000700)="75fa", 0x2}, {&(0x7f0000000f00)="dccba3d357820841deb7a91d662fc5addabec7d63648c75e172ca244e88e045c1f7965611b2fd952040760c9b1c789556ff82c609dd6ff540b9338ea20919fc69ec1f8f233b76f120e8c4b47b21f0b2738d73f5c5d000b2b7fed46aa04b5a3d0f771e9261d70f8f4c26ff029a40ff04c98786260277f8ed6bf5d43d87b68ea922ba984966c16a5796cf829d9b9aa1c6e3f655a946f4e689ee393d67b768c03bf3483f7baa3afac58d6e5df78a886de84c6281aa1d9bda705795b3190062dbe3bd3afd32c65107004d747774be50638870a1848d16132497a023048ed983d24", 0xdf}, {&(0x7f0000001000)="9f285c6be7891ac4ba5aecbe8d8d727fc4e347dd771bfdd867ca16fb5cc4079164f9ce7aab941259170f588736b3ecb502c76dd9e80f2cee15fd936c7d5d2bcc9fca173c5452fc101072c8ca24525e13ccbf967d739bb4bdbdd13c144fe521af81bc8716778d71b11ef64f9c402191f5cc00dbed68c27e8afbcf74d6378af09e594c972cf022793bb211ee131b562e7077bff71ad2faa952d51f504e0012b7862d9a36", 0xa3}, {&(0x7f0000000740)="7bb1b846728bcb9b6b6a1a90b1b13f60ec8f4a8fd9126834052932dcf541703603c75951f28804b2883bab306a9c76a5dc315c6c01ca8c", 0x37}, {&(0x7f0000000bc0)="331cddd7782485f980a0b5608326015a4851286f470762f792859fe7903303b4", 0x20}], 0x6}}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)='n', 0x1}], 0x1}}], 0x4, 0x4) 269.655408ms ago: executing program 2 (id=6652): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r1, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xd0}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000012c0)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x15000000) connect$unix(r3, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) 175.611251ms ago: executing program 5 (id=6653): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0x6c3ca000) (async) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) mlock(&(0x7f0000a03000/0x4000)=nil, 0x4000) (async) r1 = getpid() syz_open_procfs(r1, &(0x7f0000000000)='status\x00') (async) mmap(&(0x7f000005b000/0x4000)=nil, 0x4000, 0x1000000, 0x810, 0xffffffffffffffff, 0x0) 102.824242ms ago: executing program 5 (id=6654): ioctl$BLKSSZGET(0xffffffffffffffff, 0x1268, &(0x7f0000000040)) r0 = socket$kcm(0x10, 0x400000002, 0x0) recvmsg$kcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000034c0)=""/4092, 0xffc}, {&(0x7f0000001cc0)=""/202, 0xca}, {&(0x7f00000044c0)=""/4091, 0xffb}, {&(0x7f00000000c0)=""/111, 0x6f}, {&(0x7f0000000280)=""/82, 0x52}, {&(0x7f0000000440)=""/60, 0x3c}, {&(0x7f0000000180)=""/204, 0xcc}, {&(0x7f0000001dc0)=""/143, 0x8f}, {&(0x7f0000000b80)=""/4096, 0x1000}], 0x9}, 0x40016002) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="1c0000005e007f029ea69801d76ab0a272a2a788bab6c95f79725074", 0xd5}], 0x1}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='fdinfo/4\x00') read$FUSE(r1, &(0x7f00000054c0)={0x2020}, 0xfffffffffffffd80) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0xbc45b7125706b9b4, 0x0) sendmsg$NLBL_CALIPSO_C_LIST(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0004fd2cc0401859694c03000000"], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) openat$mixer(0xffffffffffffff9c, &(0x7f0000001bc0), 0x421082, 0x0) r5 = dup(r4) write$FUSE_BMAP(r5, &(0x7f0000000100)={0x18, 0x0, 0x0, {0x40}}, 0x18) write$FUSE_DIRENTPLUS(r5, &(0x7f0000002100)=ANY=[@ANYBLOB="b0000000000000001659ec0889419429aa5db97288b0f8a87ea8e66d9a8b"], 0xb0) write$FUSE_DIRENTPLUS(r5, &(0x7f0000000140)=ANY=[@ANYBLOB="10"], 0x10) write$FUSE_DIRENTPLUS(r5, &(0x7f0000000280)=ANY=[@ANYBLOB="a8"], 0xa8) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) write$FUSE_ENTRY(r5, &(0x7f0000000440)={0x90, 0x0, 0x0, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3}}}, 0x90) mount$9p_fd(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000500)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@posixacl}]}}) ioctl$BTRFS_IOC_DEV_REPLACE(r2, 0xca289435, &(0x7f00000000c0)={0x1, 0x4, @start={0x0, 0x1, "62e377aa39f0758341bccfb96a884aad5e587d1a48fac2cefa789381f039acda2818cf30618b0d899f29aa569b4bceec268ae52ce95d50fd67a36a8d7575c22926ab446bec8eebf43b304b6e3163cedb816912bdd17cc93b330420fc46b6e8dd58905e100e9c49abd4c5d62c15ee5567cbc5f7c02f7b5edb70329ff969115f5102a73d4b8bb34e93c9f89b4b8348c60f07dabb25b31ef7da657db2b2919e07878a7d5c7e6b753a45ab59c5bcb286cbcfc8ff179872ab797ab085b023b84fb76f9aba2fbede4408a341db3353866d2042a7009fdb3afcecb781bd0c6927ca9aad654cf3bb04ca5f1efd0ff00d980aa3a74f0cb217a6f303e0951a825d3b3dfbd14a15d148e94d5de0990a659b3ac283758cd8208e0eff41ca18afa0163b45d91d5f51a116b9995451f99cb80fc94849c559557e7cd7d86827598f045406509a0e792a89ce5afdd60c3d155fe0c741fdc620f61baca08586c7ea0652d454393e527121481431afe61c5c7185299ac5d3a71d47d9c77d0442b14a53854d0fc44b2d7fd3320027701319c07b5151155e584c22943031a7062451f877b02a1c9119d2ae4ee0abed40172d486f69b23b64215cd6b196cbddc1c7de5c40539c3bbd3c76aacafcfbdb989a39e04516d313b6cc5d43959104b0b1c39e1c0b0ede9d5a77d85967e377d08d5243ec21897ed9a3314df7d5d449bfcabec96b019d584d80ac4888fabb37caaa4680148c056f34aff60f08dce8fdd662a8e2f3a91421acc319b42361e30d5a4a68c09555ddb20ea11fb218b360e35cebd215dc40408c9f431eff16f4cacc362ed5c916fec89c76cf97fa45e04980fb34960f298a6523f2b1aa60a998a1549c1509c784bac0bc5d9fe69cabef3c900ef37de194f0f3756346a0fcc0ec773b528b8ee1daf4aa2198ddb171b764ff1b5e776d7bbc2b09c7c7d8877ef866001cc092fb5f8243e5e28deb6d9b3bc10cb127b77c4a32696baf69244179ed35c2a568276d9ba3326d698b9024073ba28a2c7739730a6b7f3e80e57207cf0481e11cb7ff448c97b7569127646a7eb2158d9695c868b8c09ed31b1de02bbccb545340befa10692331be50de18507548a0932ee34424f606c4afbebeeb1f90ca379bc642df06e9be26fc9b8ecd05c0b4c23c1e094701e97da2be057ca94f85fe0b6e64aebb0acf24cc4ed89642ea6e0bc90c71bf3a0f6be3985b04da71a1e10f172932cd59152f198f26a0e675273738ca26af54dde0217725d0fc0237bc46ed4c06f62a6244777d4cffbcbeac0bf9513f684f13bbb3e771de48b07132eb2b9c403259183484ab901c0bd008c59ea8751412a1a14659e566d4183a1ccc3edebd84d53d600dd3d9bcb79305743ccb5ec0c6fc3fa9aad8b7ef297f7c2ed6bda3da6ea2b19c8b523485bdd154de3dbf296435b28822dc513d0448e17323413618cd", "d7adf5b12829510f803e3d016d621f310285d86caa77cef90d1b8ffa3f449b6fc67d7d053c1c98c2748a4863265b3c4b77067d22f5cd059af606a65f28973a0cac5c8bee0a072197a9aef7475ad3552e2e6c8475d1c2259b58438b7369c700d61c06bb24f7e90790b4d081aabef714ff95763c08d92eb1d363ff2a4b981cd781f9bc9e767654d7df9e21e9d4f94d3062e1fc7821b8bdd99f00dcac21ee1c0b9f7ee984c9e5397bbe80092d310be5c12e8eaf43ae35f63ffd82b32548401768aeb7aa0ede9f279176d90268e9cefa14e431deee68c9af2cf64c15398c4b38024fcb388cb3ab994b175adf487408da8901290a070f5f8f84992c65bcb7906451721a1d3bd381e92a6f5e90dd72dad944e83253f8271a94d9ba34c2b72a372f0788586f217c9e17e0598a3222cb9dca7013a83a88e9857b9d7d357b5a4de40777f44bbc9314da4b5e2cfe61855974b52ecfd414144c8cde233e77d46ac29bad1313293fd6a8a7901304b4a8b8d313fcf6e41b41fdc1e8a6a7c67bd3614be259be57de9b60fa2fd6ca3fa169bfde0dd43be0c9fba61c18345a5488eda6e8e068b2de1eeccc9dee06966fe2eb4bb8eafa8dcbd98e546862413d563022eb3d4834188f88a3df5d3d5c962573aaea5e1267c6bd8c97cc8603702493ae96485635d4f03f4776556cb5c86ceba3570e8acbb387150b7e1ffd91f34abc4a460ae4b53a34a236aeb5972b6b5f8c5eca0d32cba205f3b97403a2a79923463b9d6f9bf6af17a4f5062cb4dfae9a4ef7002078f1346fb132312610a61e940f3047d5fd39407c0d9efb6f0ea757cf7bbaf4a5be82968f9ad09cf9975cbcbf826e357a53ec3530057dcac63d75deeea47cb5d6d825bbde159901ab801f758a211f43a3f718af6bbd62994739de80691b51c43687a61ea5365e5cbe55c73470c14647c9e87648e1e73d54e9b1243acc03037f3400bc3597e14ba2629e6013a1efb36e5fb47febd1a9d294b24b516ad1f126b1cca9345d34ad05c4abb88cef2ffa249df5837be9e9c0792a0d42dbdb4fc2b4986b42a46637d23cc0970d2a8e686dc84f78fda6d65205fe904805370db2cac5787716ca7669c2527a5deb8d6b69e23f84124e493451bd9ec852a3c93910fd49a4863e950b944983e46ef5640ba4e663308c6cb0f3833be9bfe4d2aaf135efee78bcddd8c341a617a60bcf9d2bf0fbe076ac3523d409aab80c707a80872b1e134ba8542d301d635975f1e1d24f98226634df0d082c433785bb7e499800cf1453420e41c288c214f7ea82ccb57bfd9e97ab111b8f1d13f1f2f17198a026616f22cba13d9da417b5fc52a07690477844d76d42d0adcf49c020214b092e741756976b4272b075d0ecebcf559af2f9304cc588fdae03f3b5134965beda8e572ed164e47c0357b6cab2bc204626773530d7af5b804caa564455be"}, [0x3fa, 0xd6be, 0x2818fccc, 0x80000001, 0x7ff, 0x1ff, 0x8, 0x7, 0xfff, 0x2, 0x4, 0xd1, 0x4, 0x3, 0xe84, 0x100000001, 0x7fffffffffffffff, 0x7fffffff, 0xa, 0x4000000000, 0x0, 0x0, 0x8, 0x5, 0x7f, 0xbd1, 0x9, 0x8, 0x4, 0x7, 0x0, 0x80, 0xed7, 0x0, 0x6, 0x7e1, 0x5, 0x0, 0x17ec, 0x0, 0x1, 0x3, 0x1, 0x9a, 0x140, 0xdf5, 0x8000000000000001, 0x9, 0x92, 0x1, 0x6e5, 0xfffffffffffffffb, 0x2, 0x3, 0x4, 0x1, 0x0, 0x7, 0xc0, 0x1, 0xfffffffffffffff9, 0x0, 0x9, 0x81]}) read$FUSE(r2, &(0x7f00000031c0)={0x2020}, 0x2020) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r2, 0xc0709411, &(0x7f0000000b00)={{0x0, 0x9, 0x7fae000000, 0x5, 0x8, 0x4, 0x7fffffff, 0x4, 0x8, 0x1000, 0x2477, 0x7, 0xe2, 0x125, 0x9db}, 0x20, [0x0, 0x0, 0x0, 0x0]}) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f00000001c0)={'tunl0\x00', &(0x7f0000000140)={'gretap0\x00', 0x0, 0x8, 0x7, 0xfffffff8, 0xfffffff3, {{0x5, 0x4, 0x2, 0x5, 0x14, 0x67, 0x0, 0x8, 0x29, 0x0, @multicast2, @rand_addr=0x64010100}}}}) ioctl$BTRFS_IOC_TREE_SEARCH(r2, 0xd0009411, &(0x7f0000000bc0)={{r6, 0xca, 0xffffffffffffffff, 0x5, 0xf, 0xbd, 0x3, 0xa, 0x5, 0x0, 0x7, 0x9, 0x149a, 0x3, 0x7fffffffffffffff}}) syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) syz_open_dev$video4linux(&(0x7f0000000000), 0x2004, 0x0) 0s ago: executing program 2 (id=6655): r0 = fsopen(&(0x7f0000000080)='cgroup\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r1 = socket(0xf, 0x800, 0xe) connect$rose(r1, &(0x7f00000000c0)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, 0x5, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @bcast, @default]}, 0x40) arch_prctl$ARCH_SHSTK_LOCK(0x5003, 0x1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha256\x00'}, 0x58) r3 = accept(r2, 0x0, 0x0) close(r3) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x462402, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r4, 0x2000) socket$can_bcm(0x1d, 0x2, 0x2) kernel console output (not intermixed with test programs): r0>, priority 0 [ 1046.307120][T22857] tipc: Disabling bearer [ 1046.499750][T21571] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1046.632775][T22872] tmpfs: Bad value for 'mpol' [ 1046.733001][T22878] Unsupported ieee802154 address type: 0 [ 1047.900719][T22901] tipc: Enabled bearer , priority 0 [ 1047.935928][T22900] tipc: Disabling bearer [ 1047.962654][T22905] netlink: 'syz.4.5824': attribute type 10 has an invalid length. [ 1048.137612][T22911] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5826'. [ 1048.232919][T22908] /dev/rnullb0: Can't open blockdev [ 1048.327363][T18015] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 1048.529387][T18015] usb 1-1: Using ep0 maxpacket: 8 [ 1048.569475][T18015] usb 1-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=44.b2 [ 1048.590734][T18015] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1048.626775][T18015] usb 1-1: Product: syz [ 1048.635777][T18015] usb 1-1: Manufacturer: syz [ 1048.653334][T18015] usb 1-1: SerialNumber: syz [ 1048.670318][T22922] netlink: 'syz.4.5830': attribute type 10 has an invalid length. [ 1048.681378][T18015] usb 1-1: config 0 descriptor?? [ 1048.907668][T18015] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 1049.306925][T22932] /dev/rnullb0: Can't open blockdev [ 1049.351937][T22933] /dev/rnullb0: Can't open blockdev [ 1049.557386][T22942] FAULT_INJECTION: forcing a failure. [ 1049.557386][T22942] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1049.602535][T22942] CPU: 1 UID: 0 PID: 22942 Comm: syz.4.5837 Not tainted 6.16.0-next-20250804-syzkaller #0 PREEMPT(full) [ 1049.602570][T22942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1049.602581][T22942] Call Trace: [ 1049.602589][T22942] [ 1049.602598][T22942] dump_stack_lvl+0x189/0x250 [ 1049.602629][T22942] ? __pfx____ratelimit+0x10/0x10 [ 1049.602654][T22942] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1049.602679][T22942] ? __pfx__printk+0x10/0x10 [ 1049.602703][T22942] ? __might_fault+0xb0/0x130 [ 1049.602734][T22942] should_fail_ex+0x414/0x560 [ 1049.602762][T22942] copy_fpstate_to_sigframe+0xa8d/0xce0 [ 1049.602789][T22942] ? copy_fpstate_to_sigframe+0x181/0xce0 [ 1049.602816][T22942] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 1049.602851][T22942] ? __lock_acquire+0xab9/0xd20 [ 1049.602878][T22942] ? fpu__alloc_mathframe+0xad/0x130 [ 1049.602900][T22942] get_sigframe+0x58d/0x7d0 [ 1049.602926][T22942] ? __pfx_get_sigframe+0x10/0x10 [ 1049.602951][T22942] ? posixtimer_deliver_signal+0x305/0x410 [ 1049.602991][T22942] x64_setup_rt_frame+0x15b/0xd40 [ 1049.603018][T22942] ? lockdep_hardirqs_on+0x9c/0x150 [ 1049.603044][T22942] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1049.603067][T22942] ? get_signal+0x1151/0x1340 [ 1049.603094][T22942] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 1049.603125][T22942] arch_do_signal_or_restart+0x3d7/0x750 [ 1049.603145][T22942] ? __fget_files+0x3a0/0x420 [ 1049.603171][T22942] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1049.603209][T22942] ? exit_to_user_mode_loop+0x40/0x110 [ 1049.603233][T22942] exit_to_user_mode_loop+0x75/0x110 [ 1049.603360][T22942] do_syscall_64+0x2bd/0x3b0 [ 1049.603392][T22942] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1049.603409][T22942] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1049.603426][T22942] ? clear_bhb_loop+0x60/0xb0 [ 1049.603448][T22942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1049.603466][T22942] RIP: 0033:0x7f087498eb67 [ 1049.603484][T22942] Code: ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 [ 1049.603499][T22942] RSP: 002b:00007f08757f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 [ 1049.603521][T22942] RAX: 0000000000000013 RBX: 00007f0874bb5fa0 RCX: 00007f087498eb69 [ 1049.603534][T22942] RDX: 0000000000000001 RSI: 0000200000001340 RDI: 0000000000000003 [ 1049.603547][T22942] RBP: 00007f08757f5090 R08: 0000000000000000 R09: 0000000000000000 [ 1049.603558][T22942] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1049.603568][T22942] R13: 0000000000000000 R14: 00007f0874bb5fa0 R15: 00007ffff22b9e98 [ 1049.603598][T22942] [ 1050.217487][T18015] gspca_sunplus: reg_w_riv err -110 [ 1050.223871][T18015] sunplus 1-1:0.0: probe with driver sunplus failed with error -110 [ 1050.459244][T22953] /dev/rnullb0: Can't open blockdev [ 1050.465825][T22953] /dev/rnullb0: Can't open blockdev [ 1050.503606][T22953] /dev/rnullb0: Can't open blockdev [ 1050.540627][T22953] /dev/rnullb0: Can't open blockdev [ 1050.562360][T22953] /dev/rnullb0: Can't open blockdev [ 1050.588435][T22953] /dev/rnullb0: Can't open blockdev [ 1050.602753][T22953] /dev/rnullb0: Can't open blockdev [ 1050.618571][T22953] /dev/rnullb0: Can't open blockdev [ 1050.631686][T22953] /dev/rnullb0: Can't open blockdev [ 1050.640649][T22953] /dev/rnullb0: Can't open blockdev [ 1050.649449][T22953] /dev/rnullb0: Can't open blockdev [ 1050.656687][T22953] /dev/rnullb0: Can't open blockdev [ 1050.664094][T22953] /dev/rnullb0: Can't open blockdev [ 1050.681356][T22953] /dev/rnullb0: Can't open blockdev [ 1050.691121][T22953] /dev/rnullb0: Can't open blockdev [ 1050.699676][T22953] /dev/rnullb0: Can't open blockdev [ 1050.709810][T22953] /dev/rnullb0: Can't open blockdev [ 1050.718425][T22953] /dev/rnullb0: Can't open blockdev [ 1050.725625][T22953] /dev/rnullb0: Can't open blockdev [ 1050.787513][T22953] /dev/rnullb0: Can't open blockdev [ 1050.796557][T22957] netlink: 'syz.4.5841': attribute type 10 has an invalid length. [ 1050.806696][T22953] /dev/rnullb0: Can't open blockdev [ 1050.814329][T22953] /dev/rnullb0: Can't open blockdev [ 1050.824449][T22953] /dev/rnullb0: Can't open blockdev [ 1050.831389][T22953] /dev/rnullb0: Can't open blockdev [ 1050.859546][T22953] /dev/rnullb0: Can't open blockdev [ 1050.866666][T22953] /dev/rnullb0: Can't open blockdev [ 1050.884467][T22953] /dev/rnullb0: Can't open blockdev [ 1050.911006][T22953] /dev/rnullb0: Can't open blockdev [ 1050.947787][T22953] /dev/rnullb0: Can't open blockdev [ 1050.962802][T22953] /dev/rnullb0: Can't open blockdev [ 1050.970155][T22953] /dev/rnullb0: Can't open blockdev [ 1050.981128][T22953] /dev/rnullb0: Can't open blockdev [ 1050.989379][T22953] /dev/rnullb0: Can't open blockdev [ 1051.030139][ T5929] usb 1-1: USB disconnect, device number 98 [ 1051.111527][T22964] netlink: 'syz.2.5844': attribute type 10 has an invalid length. [ 1051.293071][T22974] FAULT_INJECTION: forcing a failure. [ 1051.293071][T22974] name failslab, interval 1, probability 0, space 0, times 0 [ 1051.325395][T22974] CPU: 1 UID: 0 PID: 22974 Comm: syz.1.5849 Not tainted 6.16.0-next-20250804-syzkaller #0 PREEMPT(full) [ 1051.325425][T22974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1051.325438][T22974] Call Trace: [ 1051.325457][T22974] [ 1051.325465][T22974] dump_stack_lvl+0x189/0x250 [ 1051.325499][T22974] ? __pfx____ratelimit+0x10/0x10 [ 1051.325525][T22974] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1051.325551][T22974] ? __pfx__printk+0x10/0x10 [ 1051.325581][T22974] ? __pfx___might_resched+0x10/0x10 [ 1051.325615][T22974] ? fs_reclaim_acquire+0x7d/0x100 [ 1051.325648][T22974] should_fail_ex+0x414/0x560 [ 1051.325680][T22974] should_failslab+0xa8/0x100 [ 1051.325704][T22974] __kmalloc_noprof+0xcb/0x4f0 [ 1051.325722][T22974] ? tomoyo_encode+0x28b/0x550 [ 1051.325752][T22974] tomoyo_encode+0x28b/0x550 [ 1051.325783][T22974] tomoyo_realpath_from_path+0x58d/0x5d0 [ 1051.325820][T22974] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1051.325852][T22974] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1051.325877][T22974] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1051.325920][T22974] ? __lock_acquire+0xab9/0xd20 [ 1051.325964][T22974] ? __fget_files+0x2a/0x420 [ 1051.326002][T22974] ? __fget_files+0x2a/0x420 [ 1051.326024][T22974] ? __fget_files+0x3a0/0x420 [ 1051.326046][T22974] ? __fget_files+0x2a/0x420 [ 1051.326075][T22974] security_file_ioctl+0xcb/0x2d0 [ 1051.326100][T22974] __se_sys_ioctl+0x47/0x170 [ 1051.326124][T22974] do_syscall_64+0xfa/0x3b0 [ 1051.326150][T22974] ? lockdep_hardirqs_on+0x9c/0x150 [ 1051.326175][T22974] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1051.326193][T22974] ? clear_bhb_loop+0x60/0xb0 [ 1051.326216][T22974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1051.326233][T22974] RIP: 0033:0x7fd43ef8eb69 [ 1051.326250][T22974] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1051.326266][T22974] RSP: 002b:00007fd43fead038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1051.326288][T22974] RAX: ffffffffffffffda RBX: 00007fd43f1b5fa0 RCX: 00007fd43ef8eb69 [ 1051.326301][T22974] RDX: 0000200000000180 RSI: 00000000c0d05605 RDI: 0000000000000003 [ 1051.326314][T22974] RBP: 00007fd43fead090 R08: 0000000000000000 R09: 0000000000000000 [ 1051.326327][T22974] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1051.326339][T22974] R13: 0000000000000000 R14: 00007fd43f1b5fa0 R15: 00007fffd6bbea48 [ 1051.326369][T22974] [ 1051.326394][T22974] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1051.335816][T22976] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 1051.435771][ T30] audit: type=1326 audit(1754338492.847:239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22979 comm="syz.2.5852" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa44ff8eb69 code=0x0 [ 1051.631889][ T30] audit: type=1326 audit(1754338492.907:240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22979 comm="syz.2.5852" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa44ff8eb69 code=0x0 [ 1051.657849][ T30] audit: type=1326 audit(1754338492.937:241): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22979 comm="syz.2.5852" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa44ff8eb69 code=0x0 [ 1051.682862][ T30] audit: type=1326 audit(1754338492.997:242): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22979 comm="syz.2.5852" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa44ff8eb69 code=0x0 [ 1051.771178][ T30] audit: type=1326 audit(1754338493.227:243): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22979 comm="syz.2.5852" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa44ff8eb69 code=0x0 [ 1052.217444][ T43] usb 2-1: new full-speed USB device number 105 using dummy_hcd [ 1052.241507][T22997] netlink: 'syz.4.5856': attribute type 10 has an invalid length. [ 1052.261583][ T49] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1052.384151][T23003] netlink: 'syz.4.5859': attribute type 10 has an invalid length. [ 1052.409510][ T43] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1052.420594][ T43] usb 2-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1052.433100][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1052.453592][ T43] usb 2-1: config 0 descriptor?? [ 1052.617594][ T5929] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 1052.668659][T22995] TCP: TCP_TX_DELAY enabled [ 1052.710834][T23017] FAULT_INJECTION: forcing a failure. [ 1052.710834][T23017] name failslab, interval 1, probability 0, space 0, times 0 [ 1052.724358][T23017] CPU: 0 UID: 0 PID: 23017 Comm: syz.4.5863 Not tainted 6.16.0-next-20250804-syzkaller #0 PREEMPT(full) [ 1052.724387][T23017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1052.724399][T23017] Call Trace: [ 1052.724409][T23017] [ 1052.724419][T23017] dump_stack_lvl+0x189/0x250 [ 1052.724453][T23017] ? __pfx____ratelimit+0x10/0x10 [ 1052.724481][T23017] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1052.724508][T23017] ? __pfx__printk+0x10/0x10 [ 1052.724543][T23017] ? __pfx___might_resched+0x10/0x10 [ 1052.724566][T23017] ? fs_reclaim_acquire+0x7d/0x100 [ 1052.724595][T23017] should_fail_ex+0x414/0x560 [ 1052.724626][T23017] should_failslab+0xa8/0x100 [ 1052.724650][T23017] __kmalloc_noprof+0xcb/0x4f0 [ 1052.724668][T23017] ? video_usercopy+0x18f/0x14f0 [ 1052.724694][T23017] video_usercopy+0x18f/0x14f0 [ 1052.724724][T23017] ? __pfx___video_do_ioctl+0x10/0x10 [ 1052.724744][T23017] ? __pfx_video_usercopy+0x10/0x10 [ 1052.724777][T23017] ? __fget_files+0x2a/0x420 [ 1052.724806][T23017] ? __fget_files+0x2a/0x420 [ 1052.724829][T23017] ? __fget_files+0x3a0/0x420 [ 1052.724858][T23017] v4l2_ioctl+0x18a/0x1e0 [ 1052.724878][T23017] ? __pfx_v4l2_ioctl+0x10/0x10 [ 1052.724898][T23017] __se_sys_ioctl+0xf9/0x170 [ 1052.724922][T23017] do_syscall_64+0xfa/0x3b0 [ 1052.724947][T23017] ? lockdep_hardirqs_on+0x9c/0x150 [ 1052.724974][T23017] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1052.724993][T23017] ? clear_bhb_loop+0x60/0xb0 [ 1052.725018][T23017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1052.725036][T23017] RIP: 0033:0x7f087498eb69 [ 1052.725055][T23017] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1052.725072][T23017] RSP: 002b:00007f08757f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1052.725095][T23017] RAX: ffffffffffffffda RBX: 00007f0874bb5fa0 RCX: 00007f087498eb69 [ 1052.725109][T23017] RDX: 0000200000000180 RSI: 00000000c0d05605 RDI: 0000000000000003 [ 1052.725123][T23017] RBP: 00007f08757f5090 R08: 0000000000000000 R09: 0000000000000000 [ 1052.725136][T23017] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1052.725149][T23017] R13: 0000000000000000 R14: 00007f0874bb5fa0 R15: 00007ffff22b9e98 [ 1052.725194][T23017] [ 1053.009365][ T5929] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 1053.024825][ T5929] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1053.043674][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1053.068595][ T5961] usb 2-1: USB disconnect, device number 105 [ 1053.075811][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1053.106311][ T5929] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1053.120016][ T5929] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1053.196778][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1053.244221][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1053.275776][ T5929] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1053.286057][ T5929] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1053.304807][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1053.318800][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1053.326570][T23033] netlink: 'syz.4.5869': attribute type 10 has an invalid length. [ 1053.330014][ T5929] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1053.350821][ T5929] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1053.373135][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1053.401057][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1053.411853][T23036] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1053.423803][ T5929] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1053.433173][ T5929] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1053.446166][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1053.467054][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1053.478983][ T5929] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1053.487928][ T5929] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1053.500735][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1053.513918][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1053.580209][ T5929] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1053.600732][ T5929] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1053.615597][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1053.627835][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1053.640992][ T5929] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1053.650157][T23044] FAULT_INJECTION: forcing a failure. [ 1053.650157][T23044] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1053.665060][T23044] CPU: 1 UID: 0 PID: 23044 Comm: syz.4.5874 Not tainted 6.16.0-next-20250804-syzkaller #0 PREEMPT(full) [ 1053.665089][T23044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1053.665108][T23044] Call Trace: [ 1053.665117][T23044] [ 1053.665126][T23044] dump_stack_lvl+0x189/0x250 [ 1053.665160][T23044] ? __pfx____ratelimit+0x10/0x10 [ 1053.665187][T23044] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1053.665213][T23044] ? __pfx__printk+0x10/0x10 [ 1053.665241][T23044] ? __might_fault+0xb0/0x130 [ 1053.665274][T23044] should_fail_ex+0x414/0x560 [ 1053.665305][T23044] _copy_from_user+0x2d/0xb0 [ 1053.665328][T23044] video_usercopy+0x354/0x14f0 [ 1053.665360][T23044] ? __pfx___video_do_ioctl+0x10/0x10 [ 1053.665380][T23044] ? __pfx_video_usercopy+0x10/0x10 [ 1053.665412][T23044] ? __fget_files+0x2a/0x420 [ 1053.665440][T23044] ? __fget_files+0x2a/0x420 [ 1053.665463][T23044] ? __fget_files+0x3a0/0x420 [ 1053.665491][T23044] v4l2_ioctl+0x18a/0x1e0 [ 1053.665512][T23044] ? __pfx_v4l2_ioctl+0x10/0x10 [ 1053.665530][T23044] __se_sys_ioctl+0xf9/0x170 [ 1053.665569][T23044] do_syscall_64+0xfa/0x3b0 [ 1053.665594][T23044] ? lockdep_hardirqs_on+0x9c/0x150 [ 1053.665620][T23044] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1053.665639][T23044] ? clear_bhb_loop+0x60/0xb0 [ 1053.665663][T23044] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1053.665681][T23044] RIP: 0033:0x7f087498eb69 [ 1053.665698][T23044] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1053.665714][T23044] RSP: 002b:00007f08757f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1053.665736][T23044] RAX: ffffffffffffffda RBX: 00007f0874bb5fa0 RCX: 00007f087498eb69 [ 1053.665750][T23044] RDX: 0000200000000180 RSI: 00000000c0d05605 RDI: 0000000000000003 [ 1053.665761][T23044] RBP: 00007f08757f5090 R08: 0000000000000000 R09: 0000000000000000 [ 1053.665774][T23044] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1053.665785][T23044] R13: 0000000000000000 R14: 00007f0874bb5fa0 R15: 00007ffff22b9e98 [ 1053.665814][T23044] [ 1053.905803][ T5929] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1053.916269][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1053.927742][ T5929] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1053.938468][ T5929] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1053.948818][ T5929] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1053.958950][ T5929] usb 1-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1053.968876][ T5929] usb 1-1: Product: syz [ 1053.973512][ T5929] usb 1-1: Manufacturer: syz [ 1053.978956][ T5929] usb 1-1: SerialNumber: syz [ 1053.987121][ T5929] usb 1-1: config 0 descriptor?? [ 1053.996155][ T5929] yurex 1-1:0.0: Could not submitting URB [ 1054.002904][ T5929] yurex 1-1:0.0: probe with driver yurex failed with error -5 [ 1054.006021][T23049] comedi comedi0: pcl816: I/O port conflict (0x2,16) [ 1054.202544][ T5916] usb 1-1: USB disconnect, device number 99 [ 1054.812988][ T30] audit: type=1800 audit(1754338496.277:244): pid=23063 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.5879" name="/" dev="9p" ino=2 res=0 errno=0 [ 1056.217451][T23107] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5895'. [ 1057.325222][T23129] workqueue: Failed to create a rescuer kthread for wq "xfs-buf/rnullb0": -EINTR [ 1057.381146][ T141] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1058.063827][T23146] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5907'. [ 1058.586484][T23155] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5909'. [ 1058.658988][ T5939] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1058.985509][T23163] netlink: 'syz.1.5912': attribute type 11 has an invalid length. [ 1059.120708][T23175] syzkaller0: entered promiscuous mode [ 1059.127021][T23175] syzkaller0: entered allmulticast mode [ 1059.145846][T23175] syzkaller0 (unregistering): left promiscuous mode [ 1059.153757][T23175] syzkaller0 (unregistering): left allmulticast mode [ 1059.529124][T23184] /dev/sg0: Can't lookup blockdev [ 1059.611427][T23188] /dev/sg0: Can't lookup blockdev [ 1059.918803][T23199] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5924'. [ 1059.924043][T23201] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5923'. [ 1060.307602][ T5961] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 1060.467324][ T5961] usb 5-1: Using ep0 maxpacket: 32 [ 1060.479052][ T5961] usb 5-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 1060.491120][ T5961] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1060.505445][ T5961] usb 5-1: config 0 descriptor?? [ 1060.529103][ T5961] gspca_main: sunplus-2.14.0 probing 041e:400b [ 1060.586901][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1061.286068][T23241] netlink: 'syz.2.5939': attribute type 41 has an invalid length. [ 1061.732802][ T5961] gspca_sunplus: reg_w_riv err -110 [ 1061.757576][ T5961] sunplus 5-1:0.0: probe with driver sunplus failed with error -110 [ 1061.858954][T23245] 9pnet_fd: Insufficient options for proto=fd [ 1061.974297][ T5929] usb 5-1: USB disconnect, device number 70 [ 1062.184483][T23263] /dev/rnullb0: Can't lookup blockdev [ 1062.212955][T23266] netlink: 'syz.1.5947': attribute type 10 has an invalid length. [ 1062.260454][ T30] audit: type=1804 audit(1754338503.727:245): pid=23268 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.5948" name="rnullb0" dev="tmpfs" ino=1086 res=1 errno=0 [ 1062.281345][T23270] /dev/rnullb0: Can't open blockdev [ 1062.779330][T23293] netlink: 'syz.2.5957': attribute type 10 has an invalid length. [ 1063.113012][T23307] input: syz1 as /devices/virtual/input/input51 [ 1063.139021][ T5939] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1063.348840][T23317] /dev/rnullb0: Can't open blockdev [ 1063.652654][T23329] netlink: 'syz.1.5971': attribute type 10 has an invalid length. [ 1063.777810][ T5939] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1063.789591][ T5961] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 1063.890037][T23304] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1063.896137][T23304] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 1063.967442][ T5961] usb 5-1: Using ep0 maxpacket: 32 [ 1063.976968][ T5961] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1063.985585][ T5961] usb 5-1: config 0 has no interface number 0 [ 1063.992188][ T5916] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 1064.001256][ T5961] usb 5-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 1064.014403][ T5961] usb 5-1: config 0 interface 1 has no altsetting 0 [ 1064.024797][ T5961] usb 5-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 1064.035048][ T5961] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1064.045774][ T5961] usb 5-1: Product: syz [ 1064.050666][ T5961] usb 5-1: Manufacturer: syz [ 1064.055660][ T5961] usb 5-1: SerialNumber: syz [ 1064.068503][ T5961] usb 5-1: config 0 descriptor?? [ 1064.157530][ T5916] usb 2-1: Using ep0 maxpacket: 8 [ 1064.165685][ T5916] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 1064.174848][ T5916] usb 2-1: config 0 has no interface number 0 [ 1064.182118][ T5916] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1064.193912][ T5916] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1064.206411][ T5916] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1064.221397][ T5916] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1064.235555][ T5916] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1064.245628][ T5916] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1064.262092][ T5916] usb 2-1: config 0 descriptor?? [ 1064.283709][ T5961] cx231xx 5-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 1064.304840][ T5916] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1064.331853][ T5961] cx231xx 5-1:0.1: Failed to read PCB config [ 1064.344410][ T5961] cx231xx 5-1:0.1: probe with driver cx231xx failed with error -71 [ 1064.358677][ T5961] usb 5-1: USB disconnect, device number 71 [ 1064.370771][T21100] udevd[21100]: setting owner of /dev/bus/usb/005/071 to uid=0, gid=0 failed: No such file or directory [ 1064.484543][ T5929] usb 2-1: USB disconnect, device number 106 [ 1064.491451][ C1] ldusb 2-1:0.55: usb_submit_urb failed (-19) [ 1064.528463][ T5929] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 1064.695349][T23354] netlink: 'syz.0.5981': attribute type 10 has an invalid length. [ 1064.698173][ T5961] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 1064.870083][ T5961] usb 5-1: Using ep0 maxpacket: 32 [ 1064.882685][ T5961] usb 5-1: config 0 has an invalid interface number: 230 but max is 0 [ 1064.892097][ T5961] usb 5-1: config 0 has no interface number 0 [ 1064.907599][ T5961] usb 5-1: config 0 interface 230 has no altsetting 0 [ 1064.922106][ T5961] usb 5-1: New USB device found, idVendor=0781, idProduct=0005, bcdDevice= 0.05 [ 1064.936144][ T5961] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1064.950846][ T5961] usb 5-1: Product: syz [ 1064.955972][ T5961] usb 5-1: Manufacturer: syz [ 1064.962639][ T5961] usb 5-1: SerialNumber: syz [ 1064.979319][ T5961] usb 5-1: config 0 descriptor?? [ 1064.999244][ T5961] ums-usbat 5-1:0.230: USB Mass Storage device detected [ 1065.020072][ T5961] ums-usbat 5-1:0.230: Quirks match for vid 0781 pid 0005: 1 [ 1065.187422][ T5954] usb 1-1: new low-speed USB device number 100 using dummy_hcd [ 1065.327835][ T5954] usb 1-1: device descriptor read/64, error -71 [ 1065.576009][ T5961] usb 5-1: USB disconnect, device number 72 [ 1065.577592][ T5954] usb 1-1: new low-speed USB device number 101 using dummy_hcd [ 1065.897318][ T5954] usb 1-1: device descriptor read/64, error -71 [ 1065.992553][T23381] netlink: 'syz.4.5990': attribute type 10 has an invalid length. [ 1066.207777][ T5954] usb usb1-port1: attempt power cycle [ 1066.293929][T23387] vxfs: WRONG superblock magic 00000000 at 1 [ 1066.318511][T23387] vxfs: WRONG superblock magic 00000000 at 8 [ 1066.332435][T23387] vxfs: can't find superblock. [ 1066.677786][ T5961] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 1066.737910][ T5954] usb 1-1: new low-speed USB device number 102 using dummy_hcd [ 1066.760220][ T5954] usb 1-1: device descriptor read/8, error -71 [ 1066.847534][ T5961] usb 5-1: Using ep0 maxpacket: 8 [ 1066.855331][ T5961] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 1066.864515][ T5961] usb 5-1: config 0 has no interface number 0 [ 1066.871553][ T5961] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1066.883357][ T5961] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1066.895977][ T5961] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1066.909388][ T5961] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1066.923951][ T5961] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1066.940919][ T5961] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1066.958335][ T5961] usb 5-1: config 0 descriptor?? [ 1066.986257][ T5961] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1067.007826][ T5954] usb 1-1: new low-speed USB device number 103 using dummy_hcd [ 1067.098032][ T5954] usb 1-1: device descriptor read/8, error -71 [ 1067.171488][ T5961] usb 5-1: USB disconnect, device number 73 [ 1067.178707][ C0] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 1067.206654][ T5961] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 1067.209867][ T5954] usb usb1-port1: unable to enumerate USB device [ 1068.043104][T23417] /dev/rnullb0: Can't open blockdev [ 1068.114592][T23420] netlink: 'syz.4.6007': attribute type 10 has an invalid length. [ 1068.407395][ T5954] usb 5-1: new full-speed USB device number 74 using dummy_hcd [ 1068.581514][ T5954] usb 5-1: not running at top speed; connect to a high speed hub [ 1068.605823][ T5954] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1068.626473][ T5954] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1068.644953][ T5954] usb 5-1: Product: 幏⃹뷔鴷㖟븳훌ዝ좮䁈锸㾈蟒℞ﶖ룅퍫丵㧟꽕伫륢꣐ᾱ쳪﵍⌼ꮄ涬꬛ಌ鿒᎒늘ꔞ앆㿱ᛓ﫤ㅨ꧑ꨕ贋뿸駜賸킸饊ᬜ᎒臋﷧䫓㣥糁აㄵꖷɽ⑍ퟃ䵑䬷࣐㚇쏚湕襤ꟓ牱⃐麵㸝晨ꐁⴋ튴骑챊ᨼ땛ᔷ軸⡼ⴼ땗蚻킰靧₶귈龪䓡ޔ㟃떓㗌 [ 1068.680019][ C1] vkms_vblank_simulate: vblank timer overrun [ 1068.689676][ T5954] usb 5-1: Manufacturer: ꖭ귄橞竾⦣㬪﫞䪆喅㯞＿犫㩬ഩꓮ䫭㬉똖–ᆝ狐䠗ﲥ໱轆邂ൄや푕嫛௞慕ℷ汛䖑䋩蘐镯뤁则ᨵꏅ⟱ⶕﱁ㎾ᘬ瓔洪넺刉爡재⢪❵⮼庿疴ﶨ댔乾⮇뤲쒟ᆌ鯛徠ꪦ졠舜౞曯鿃⽶ꐚ뎆돤芘쀏셦림釄㿮髂傞鞎跗똂鍋ᄋ냞襽㗰趾㦵㘽쏽쮒︼篫䆟룑⦱滧椖뺶ᵹ๋ꊠ坛蚮 [ 1068.732655][ C1] vkms_vblank_simulate: vblank timer overrun [ 1068.903131][ T141] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1068.942175][T23438] netlink: 'syz.0.6014': attribute type 16 has an invalid length. [ 1068.950967][T23438] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6014'. [ 1068.961543][T23438] bridge0: port 1(bridge_slave_0) entered disabled state [ 1069.538486][ T141] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1069.592711][T23458] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1069.621969][T23460] netlink: 56 bytes leftover after parsing attributes in process `syz.2.6024'. [ 1070.248780][ T5916] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 1070.307084][T23489] /dev/rnullb0: Can't lookup blockdev [ 1070.384389][T23493] ./cgroup: Can't lookup blockdev [ 1070.417320][ T5916] usb 2-1: Using ep0 maxpacket: 8 [ 1070.425721][ T5916] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 1070.434449][ T5916] usb 2-1: config 0 has no interface number 0 [ 1070.442516][ T5916] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1070.454406][ T5916] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1070.468274][ T5916] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1070.480134][ T5916] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1070.494897][ T5916] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1070.504434][ T5916] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1070.534462][ T5916] usb 2-1: config 0 descriptor?? [ 1070.549710][ T5916] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1070.753966][ T5916] usb 2-1: USB disconnect, device number 107 [ 1070.754034][ C0] ldusb 2-1:0.55: usb_submit_urb failed (-19) [ 1070.785899][ T5916] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 1071.242678][ T5954] cdc_ncm 5-1:1.0: bind() failure [ 1071.280777][ T5954] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 1071.294750][ T5954] cdc_ncm 5-1:1.1: bind() failure [ 1071.302543][T23520] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6043'. [ 1071.323244][ T5954] usb 5-1: USB disconnect, device number 74 [ 1071.423313][T23524] netlink: 56 bytes leftover after parsing attributes in process `syz.2.6045'. [ 1071.434076][T23524] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6045'. [ 1071.545787][T23529] nbd: couldn't find a device at index -373156329 [ 1071.976714][T23550] 9pnet_fd: Insufficient options for proto=fd [ 1072.977770][T18015] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1073.085324][T23588] netlink: 'syz.0.6066': attribute type 10 has an invalid length. [ 1073.107470][ T5954] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 1073.117347][T18015] usb 5-1: device descriptor read/64, error -71 [ 1073.277513][ T5954] usb 2-1: Using ep0 maxpacket: 32 [ 1073.306254][T23598] can0: slcan on ttyS3. [ 1073.316738][ T5954] usb 2-1: config 0 has an invalid interface number: 29 but max is 0 [ 1073.336353][ T5954] usb 2-1: config 0 has no interface number 0 [ 1073.353175][ T5954] usb 2-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=e9.e9 [ 1073.374717][T18015] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 1073.379682][ T5954] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1073.404621][ T5954] usb 2-1: Product: syz [ 1073.410192][ T5954] usb 2-1: Manufacturer: syz [ 1073.416649][ T5954] usb 2-1: SerialNumber: syz [ 1073.427854][T23598] can0 (unregistered): slcan off ttyS3. [ 1073.442398][T23598] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6069'. [ 1073.454938][ T5954] usb 2-1: config 0 descriptor?? [ 1073.470562][ T5954] mcba_usb 2-1:0.29: Can't find endpoints [ 1073.528167][T18015] usb 5-1: device descriptor read/64, error -71 [ 1073.657756][T18015] usb usb5-port1: attempt power cycle [ 1073.997571][T18015] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 1074.019899][ T5939] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1074.040680][T18015] usb 5-1: device descriptor read/8, error -71 [ 1074.307486][T18015] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 1074.365483][T18015] usb 5-1: device descriptor read/8, error -71 [ 1074.489453][T18015] usb usb5-port1: unable to enumerate USB device [ 1074.658588][ T5939] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1074.957766][T18015] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 1075.097418][T18015] usb 1-1: device descriptor read/64, error -71 [ 1075.347523][T18015] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 1075.487863][T18015] usb 1-1: device descriptor read/64, error -71 [ 1075.608491][T18015] usb usb1-port1: attempt power cycle [ 1075.944590][ T43] usb 2-1: USB disconnect, device number 108 [ 1075.968008][T18015] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 1076.010559][T18015] usb 1-1: device descriptor read/8, error -71 [ 1076.271195][T18015] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 1076.328102][T18015] usb 1-1: device descriptor read/8, error -71 [ 1076.457765][T18015] usb usb1-port1: unable to enumerate USB device [ 1076.481088][T23652] netlink: 'syz.1.6092': attribute type 13 has an invalid length. [ 1076.500288][T23652] netlink: 14581 bytes leftover after parsing attributes in process `syz.1.6092'. [ 1076.511413][ T43] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 1076.690029][ T43] usb 5-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 1076.702050][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1076.712676][ T43] usb 5-1: Product: syz [ 1076.718000][ T43] usb 5-1: Manufacturer: syz [ 1076.723672][ T43] usb 5-1: SerialNumber: syz [ 1076.735112][ T43] usb 5-1: config 0 descriptor?? [ 1076.747533][ T43] ch341 5-1:0.0: ch341-uart converter detected [ 1076.948010][ T43] usb 5-1: failed to receive control message: -32 [ 1076.967356][ T43] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -32 [ 1077.012067][ T5961] usb 5-1: USB disconnect, device number 79 [ 1077.040775][ T5961] ch341 5-1:0.0: device disconnected [ 1077.185515][T23666] omfs: Invalid superblock (0) [ 1077.345260][T23674] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6099'. [ 1077.618404][ T5961] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 1077.677276][ T5916] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 1077.781726][ T5961] usb 2-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1077.791644][ T5961] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1077.801989][ T5961] usb 2-1: Product: syz [ 1077.806535][ T5961] usb 2-1: Manufacturer: syz [ 1077.812263][ T5961] usb 2-1: SerialNumber: syz [ 1077.825123][ T5961] usb 2-1: config 0 descriptor?? [ 1077.844461][ T5916] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1077.854715][ T5961] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1077.864245][ T5916] usb 5-1: config 8 has an invalid interface number: 43 but max is 0 [ 1077.873651][ T5916] usb 5-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 1077.884502][ T5916] usb 5-1: config 8 has no interface number 0 [ 1077.891634][ T5916] usb 5-1: config 8 interface 43 altsetting 255 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1077.906355][ T5916] usb 5-1: config 8 interface 43 altsetting 255 bulk endpoint 0x4 has invalid maxpacket 0 [ 1077.917892][ T5916] usb 5-1: config 8 interface 43 has no altsetting 0 [ 1077.939585][ T5916] usb 5-1: New USB device found, idVendor=0582, idProduct=935b, bcdDevice=be.6c [ 1077.960584][ T5916] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=33 [ 1077.997010][ T5916] usb 5-1: Product: syz [ 1078.001806][ T5916] usb 5-1: Manufacturer: syz [ 1078.006743][ T5916] usb 5-1: SerialNumber: syz [ 1078.141167][T23699] netlink: 'syz.0.6105': attribute type 21 has an invalid length. [ 1078.331284][T23704] netlink: 'syz.2.6108': attribute type 16 has an invalid length. [ 1078.351764][T23704] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6108'. [ 1078.377305][ T5961] sonixb 2-1:0.0: Error reading register 00: -110 [ 1078.381323][T23704] bridge0: port 1(bridge_slave_0) entered disabled state [ 1079.786775][T21571] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1080.399603][ T1607] usb 2-1: USB disconnect, device number 109 [ 1080.432520][ T1320] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1080.474553][T23720] netlink: 7 bytes leftover after parsing attributes in process `syz.1.6115'. [ 1080.492474][T23720] /dev/rnullb0: Can't open blockdev [ 1080.552091][ T5916] usb 5-1: USB disconnect, device number 80 [ 1080.578089][T23723] /dev/rnullb0: Can't open blockdev [ 1080.585920][ T30] audit: type=1400 audit(1754338778.050:246): apparmor="DENIED" operation="change_hat" class="file" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23722 comm="syz.4.6116" [ 1080.588355][T21100] udevd[21100]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:8.43/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1080.662361][T23725] /dev/rnullb0: Can't open blockdev [ 1080.717425][T23727] netlink: 'syz.4.6118': attribute type 16 has an invalid length. [ 1080.726045][T23727] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6118'. [ 1080.737238][T23727] bridge0: port 1(bridge_slave_0) entered disabled state [ 1080.790380][T23729] syz.1.6119: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1080.815786][T23729] CPU: 0 UID: 0 PID: 23729 Comm: syz.1.6119 Not tainted 6.16.0-next-20250804-syzkaller #0 PREEMPT(full) [ 1080.815819][T23729] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1080.815832][T23729] Call Trace: [ 1080.815842][T23729] [ 1080.815851][T23729] dump_stack_lvl+0x189/0x250 [ 1080.815892][T23729] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1080.815923][T23729] ? __pfx__printk+0x10/0x10 [ 1080.815952][T23729] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1080.815992][T23729] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1080.816020][T23729] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 1080.816048][T23729] warn_alloc+0x214/0x310 [ 1080.816073][T23729] ? stack_depot_save_flags+0x40/0x860 [ 1080.816096][T23729] ? __pfx_warn_alloc+0x10/0x10 [ 1080.816120][T23729] ? kasan_save_track+0x4f/0x80 [ 1080.816157][T23729] ? xskq_create+0x56/0x170 [ 1080.816182][T23729] ? xsk_init_queue+0xb0/0x110 [ 1080.816205][T23729] ? xsk_setsockopt+0x4dc/0x8d0 [ 1080.816228][T23729] ? do_sock_setsockopt+0x17c/0x1b0 [ 1080.816247][T23729] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 1080.816266][T23729] ? do_syscall_64+0xfa/0x3b0 [ 1080.816293][T23729] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1080.816323][T23729] __vmalloc_node_range_noprof+0x125/0x12f0 [ 1080.816379][T23729] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1080.816403][T23729] ? xskq_create+0x56/0x170 [ 1080.816433][T23729] ? __kasan_kmalloc+0x93/0xb0 [ 1080.816457][T23729] vmalloc_user_noprof+0xad/0xf0 [ 1080.816479][T23729] ? xskq_create+0xbf/0x170 [ 1080.816507][T23729] xskq_create+0xbf/0x170 [ 1080.816538][T23729] xsk_init_queue+0xb0/0x110 [ 1080.816568][T23729] xsk_setsockopt+0x4dc/0x8d0 [ 1080.816597][T23729] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1080.816623][T23729] ? __pfx_aa_sk_perm+0x10/0x10 [ 1080.816652][T23729] ? aa_sock_opt_perm+0xff/0x1b0 [ 1080.816683][T23729] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 1080.816709][T23729] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1080.816735][T23729] do_sock_setsockopt+0x17c/0x1b0 [ 1080.816763][T23729] __x64_sys_setsockopt+0x13f/0x1b0 [ 1080.816791][T23729] do_syscall_64+0xfa/0x3b0 [ 1080.816817][T23729] ? lockdep_hardirqs_on+0x9c/0x150 [ 1080.816845][T23729] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1080.816865][T23729] ? clear_bhb_loop+0x60/0xb0 [ 1080.816891][T23729] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1080.816910][T23729] RIP: 0033:0x7fd43ef8eb69 [ 1080.816930][T23729] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1080.816949][T23729] RSP: 002b:00007fd43fead038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1080.816980][T23729] RAX: ffffffffffffffda RBX: 00007fd43f1b5fa0 RCX: 00007fd43ef8eb69 [ 1080.816996][T23729] RDX: 0000000000000006 RSI: 000000000000011b RDI: 000000000000000a [ 1080.817009][T23729] RBP: 00007fd43f011df1 R08: 0000000000000004 R09: 0000000000000000 [ 1080.817022][T23729] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1080.817036][T23729] R13: 0000000000000000 R14: 00007fd43f1b5fa0 R15: 00007fffd6bbea48 [ 1080.817070][T23729] [ 1080.817106][T23729] Mem-Info: [ 1081.149205][T23729] active_anon:8368 inactive_anon:1 isolated_anon:0 [ 1081.149205][T23729] active_file:19134 inactive_file:69812 isolated_file:0 [ 1081.149205][T23729] unevictable:6485 dirty:120 writeback:0 [ 1081.149205][T23729] slab_reclaimable:12331 slab_unreclaimable:101206 [ 1081.149205][T23729] mapped:31091 shmem:1358 pagetables:1511 [ 1081.149205][T23729] sec_pagetables:0 bounce:0 [ 1081.149205][T23729] kernel_misc_reclaimable:0 [ 1081.149205][T23729] free:1267434 free_pcp:14203 free_cma:0 [ 1081.149267][T23729] Node 0 active_anon:33472kB inactive_anon:4kB active_file:76536kB inactive_file:279040kB unevictable:24404kB isolated(anon):0kB isolated(file):0kB mapped:124364kB dirty:480kB writeback:0kB shmem:3896kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11976kB pagetables:5888kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1081.149317][T23729] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:156kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1081.149363][T23729] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1081.149419][T23729] lowmem_reserve[]: 0 2495 2497 2497 2497 [ 1081.149466][T23729] Node 0 DMA32 free:1158160kB boost:0kB min:34216kB low:42768kB high:51320kB reserved_highatomic:0KB free_highatomic:0KB active_anon:33424kB inactive_anon:4kB active_file:76536kB inactive_file:277968kB unevictable:24404kB writepending:480kB present:3129332kB managed:2555840kB mlocked:22892kB bounce:0kB free_pcp:38628kB local_pcp:14056kB free_cma:0kB [ 1081.149527][T23729] lowmem_reserve[]: 0 0 1 1 1 [ 1081.149571][T23729] Node 0 Normal free:4kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1072kB unevictable:0kB writepending:0kB present:1048580kB managed:1132kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 1081.149625][T23729] lowmem_reserve[]: 0 0 0 0 0 [ 1081.149670][T23729] Node 1 Normal free:3896212kB boost:0kB min:55668kB low:69584kB high:83500kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:18176kB local_pcp:11744kB free_cma:0kB [ 1081.149726][T23729] lowmem_reserve[]: 0 0 0 0 0 [ 1081.149784][T23729] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1081.149919][T23729] Node 0 DMA32: 68*4kB (UME) 694*8kB (UE) 733*16kB (UME) 308*32kB (UME) 254*64kB (UME) 189*128kB (UME) 73*256kB (UM) 5*512kB (UME) 2*1024kB (UM) 5*2048kB (ME) 258*4096kB (UM) = 1158160kB [ 1081.150112][T23729] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 1081.150242][T23729] Node 1 Normal: 199*4kB (UE) 65*8kB (UME) 49*16kB (UME) 197*32kB (UME) 55*64kB (UME) 14*128kB (UME) 8*256kB (UME) 3*512kB (ME) 2*1024kB (UM) 1*2048kB (E) 946*4096kB (UM) = 3896212kB [ 1081.150440][T23729] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1081.150458][T23729] Node 0 hugepages_total=4 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 1081.150475][T23729] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1081.150492][T23729] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1081.150510][T23729] 90302 total pagecache pages [ 1081.150519][T23729] 2 pages in swap cache [ 1081.150528][T23729] Free swap = 124988kB [ 1081.150536][T23729] Total swap = 124996kB [ 1081.150552][T23729] 2097051 pages RAM [ 1081.150560][T23729] 0 pages HighMem/MovableOnly [ 1081.150570][T23729] 426193 pages reserved [ 1081.150579][T23729] 0 pages cma reserved [ 1081.244966][ C0] vkms_vblank_simulate: vblank timer overrun [ 1081.282595][ C0] vkms_vblank_simulate: vblank timer overrun [ 1081.316379][ C0] vkms_vblank_simulate: vblank timer overrun [ 1081.513239][ C0] vkms_vblank_simulate: vblank timer overrun [ 1081.865199][ T982] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 1082.104943][ T1607] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 1082.264849][ T1607] usb 2-1: Using ep0 maxpacket: 16 [ 1082.273042][ T1607] usb 2-1: config 0 has an invalid interface number: 5 but max is 0 [ 1082.293173][ T1607] usb 2-1: config 0 has no interface number 0 [ 1082.307826][ T1607] usb 2-1: config 0 interface 5 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1082.341366][ T1607] usb 2-1: config 0 interface 5 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1082.352436][ T1607] usb 2-1: config 0 interface 5 has no altsetting 0 [ 1082.369396][ T1607] usb 2-1: New USB device found, idVendor=05c6, idProduct=900d, bcdDevice=a6.41 [ 1082.379169][ T1607] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1082.387558][ T1607] usb 2-1: Product: syz [ 1082.392099][ T1607] usb 2-1: Manufacturer: syz [ 1082.397447][ T1607] usb 2-1: SerialNumber: syz [ 1082.406220][ T1607] usb 2-1: config 0 descriptor?? [ 1082.413249][T23748] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1082.436804][T23748] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1082.540571][T23767] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6135'. [ 1082.553144][T23767] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6135'. [ 1082.572712][T23767] /dev/rnullb0: Can't lookup blockdev [ 1082.581701][T23767] netlink: 2 bytes leftover after parsing attributes in process `syz.2.6135'. [ 1082.894991][T23780] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1083.044384][ T1607] usb 2-1: USB disconnect, device number 110 [ 1084.172884][T23814] /dev/rnullb0: Can't lookup blockdev [ 1084.362081][T23820] /dev/rnullb0: Can't open blockdev [ 1085.403050][T23854] overlayfs: missing 'lowerdir' [ 1085.410366][T23854] syz.1.6166: attempt to access beyond end of device [ 1085.410366][T23854] nbd1: rw=0, sector=0, nr_sectors = 2 limit=0 [ 1085.548761][ T5939] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1085.563410][T23860] trusted_key: encrypted_key: master key parameter '' is invalid [ 1085.713146][ T982] usb 5-1: new full-speed USB device number 82 using dummy_hcd [ 1085.886470][ T982] usb 5-1: config 0 has an invalid interface number: 227 but max is 0 [ 1085.897748][ T982] usb 5-1: config 0 has no interface number 0 [ 1085.905613][ T982] usb 5-1: config 0 interface 227 altsetting 7 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 1085.918427][ T982] usb 5-1: config 0 interface 227 altsetting 7 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1085.930600][ T982] usb 5-1: config 0 interface 227 has no altsetting 0 [ 1085.941766][ T982] usb 5-1: New USB device found, idVendor=10f0, idProduct=2002, bcdDevice=58.dd [ 1085.952382][ T982] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1085.961342][ T982] usb 5-1: Product: syz [ 1085.966222][ T982] usb 5-1: Manufacturer: syz [ 1085.971559][ T982] usb 5-1: SerialNumber: syz [ 1085.983746][ T982] usb 5-1: config 0 descriptor?? [ 1085.990270][T23852] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1086.000537][T23852] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1086.025759][ T982] usbtouchscreen 5-1:0.227: probe with driver usbtouchscreen failed with error -71 [ 1086.032366][T23870] netlink: 'syz.2.6171': attribute type 10 has an invalid length. [ 1086.048163][T23870] openvswitch: netlink: Flow key attr not present in new flow. [ 1086.174947][ T5939] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1086.221062][T23852] /dev/rnullb0: Can't open blockdev [ 1086.228727][ T5954] usb 5-1: USB disconnect, device number 82 [ 1086.291377][T23880] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1086.792276][T23892] /dev/rnullb0: Can't open blockdev [ 1086.844046][T23896] /dev/rnullb0: Can't open blockdev [ 1086.850188][T23897] /dev/rnullb0: Can't open blockdev [ 1087.413289][T23919] /dev/sg0: Can't lookup blockdev [ 1087.834328][ T30] audit: type=1800 audit(1754338785.304:247): pid=23943 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.6197" name="rnullb0" dev="tmpfs" ino=1086 res=0 errno=0 [ 1088.105173][T23957] /dev/rnullb0: Can't lookup blockdev [ 1088.239080][T23961] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1088.248347][T23963] qrtr: Invalid version 43 [ 1088.378418][T23970] netlink: 'syz.1.6206': attribute type 16 has an invalid length. [ 1088.414857][T23970] netlink: 48 bytes leftover after parsing attributes in process `syz.1.6206'. [ 1088.452895][T23970] bridge0: port 1(bridge_slave_0) entered disabled state [ 1088.882255][ T43] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 1089.051448][ T43] usb 5-1: Using ep0 maxpacket: 8 [ 1089.059344][ T43] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 1089.068743][ T43] usb 5-1: config 0 has no interface number 0 [ 1089.075466][ T43] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1089.087144][ T43] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1089.100692][ T43] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1089.112132][ T43] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1089.125816][ T43] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1089.135479][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1089.147702][ T43] usb 5-1: config 0 descriptor?? [ 1089.165139][ T43] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1089.363723][ T43] usb 5-1: USB disconnect, device number 83 [ 1089.363809][ C1] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 1089.394119][ T43] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 1089.810301][T24014] /dev/rnullb0: Can't open blockdev [ 1090.051331][T18015] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 1090.101250][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.107488][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.118486][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.126254][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.134366][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.140653][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.147217][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.155989][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.166871][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.175678][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.184357][T18015] usb 2-1: device descriptor read/64, error -71 [ 1090.193340][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.199944][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.206603][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.213106][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.219316][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.225617][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.232580][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.238698][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.245458][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.251752][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.258611][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.265205][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.270319][T24019] netlink: 'syz.4.6225': attribute type 10 has an invalid length. [ 1090.272127][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.288110][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.295946][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.306619][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.313800][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.320063][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.326949][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.335630][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.344550][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.351948][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.358415][T24017] /dev/rnullb0: Can't lookup blockdev [ 1090.431699][T18015] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 1090.510240][ T30] audit: type=1326 audit(1754338787.975:248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24027 comm="syz.4.6228" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f087498eb69 code=0x0 [ 1090.570854][T18015] usb 2-1: device descriptor read/64, error -71 [ 1090.612149][T24029] ieee802154 phy1 wpan1: encryption failed: -22 [ 1090.681303][T18015] usb usb2-port1: attempt power cycle [ 1091.030548][T18015] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 1091.053833][T18015] usb 2-1: device descriptor read/8, error -71 [ 1091.211579][ T5939] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1091.292985][ T5939] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1091.307456][T18015] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 1091.331259][T18015] usb 2-1: device descriptor read/8, error -71 [ 1092.255327][T18015] usb usb2-port1: unable to enumerate USB device [ 1092.330150][T24046] netlink: 88 bytes leftover after parsing attributes in process `syz.2.6234'. [ 1092.448776][T24046] /dev/rnullb0: Can't lookup blockdev [ 1092.517821][T24053] /dev/rnullb0: Can't lookup blockdev [ 1092.519090][T24054] /dev/rnullb0: Can't lookup blockdev [ 1092.531024][T18015] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 1092.690119][T18015] usb 5-1: Using ep0 maxpacket: 8 [ 1092.699876][T18015] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 1092.709189][T18015] usb 5-1: config 0 has no interface number 0 [ 1092.715800][T18015] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1092.737341][T18015] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1092.756739][T18015] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1092.768404][T18015] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1092.782488][T18015] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1092.796760][T18015] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1092.808107][T18015] usb 5-1: config 0 descriptor?? [ 1092.828421][T18015] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1093.034941][ T5916] usb 5-1: USB disconnect, device number 84 [ 1093.041396][ C0] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 1093.066472][ T5916] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 1093.364864][ T5184] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1093.378936][ T5184] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1093.392886][ T5184] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1093.406374][ T5184] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1093.417367][ T5184] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1093.444310][ T5878] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1093.454908][ T5878] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1093.463736][ T5878] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1093.483567][ T5878] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1093.493570][ T5878] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1093.670142][T24081] /dev/rnullb0: Can't lookup blockdev [ 1094.129135][T24097] netlink: 'syz.2.6248': attribute type 10 has an invalid length. [ 1094.241012][T24075] chnl_net:caif_netlink_parms(): no params data found [ 1094.358966][T18015] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 1094.428199][T24075] bridge0: port 1(bridge_slave_0) entered blocking state [ 1094.436342][T24075] bridge0: port 1(bridge_slave_0) entered disabled state [ 1094.445529][T24075] bridge_slave_0: entered allmulticast mode [ 1094.455068][T24075] bridge_slave_0: entered promiscuous mode [ 1094.465256][T24075] bridge0: port 2(bridge_slave_1) entered blocking state [ 1094.473573][T24075] bridge0: port 2(bridge_slave_1) entered disabled state [ 1094.481604][T24075] bridge_slave_1: entered allmulticast mode [ 1094.492691][T24075] bridge_slave_1: entered promiscuous mode [ 1094.499431][T18015] usb 5-1: device descriptor read/64, error -71 [ 1094.564124][T24075] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1094.579714][T24075] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1094.604468][T24107] netlink: 'syz.1.6251': attribute type 28 has an invalid length. [ 1094.646433][T24075] team0: Port device team_slave_0 added [ 1094.658344][T24075] team0: Port device team_slave_1 added [ 1094.728263][T24075] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1094.736473][T24075] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1094.767945][T24075] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1094.770097][T18015] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 1094.795485][T24075] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1094.804297][T24075] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1094.838988][T24075] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1094.919095][T24075] hsr_slave_0: entered promiscuous mode [ 1094.928097][T24075] hsr_slave_1: entered promiscuous mode [ 1094.936020][T18015] usb 5-1: device descriptor read/64, error -71 [ 1094.944219][T24075] debugfs: 'hsr0' already exists in 'hsr' [ 1094.950509][T24075] Cannot create hsr debugfs directory [ 1095.058948][T18015] usb usb5-port1: attempt power cycle [ 1095.160995][T24075] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1095.170947][ T5954] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 1095.187587][T24075] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1095.228121][T24075] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1095.242555][T24075] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1095.339542][ T5954] usb 2-1: Using ep0 maxpacket: 8 [ 1095.355541][ T5954] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 1095.378265][ T5954] usb 2-1: config 0 has no interface number 0 [ 1095.384795][ T5954] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1095.400184][T18015] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 1095.415683][ T5954] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1095.446579][T18015] usb 5-1: device descriptor read/8, error -71 [ 1095.456554][T24075] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1095.477433][ T5954] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1095.503453][ T5954] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1095.506340][T24075] 8021q: adding VLAN 0 to HW filter on device team0 [ 1095.528882][ T5878] Bluetooth: hci1: command tx timeout [ 1095.529941][ T5954] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1095.546439][ T5954] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1095.559543][ T5939] bridge0: port 1(bridge_slave_0) entered blocking state [ 1095.567521][ T5939] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1095.597374][ T5954] usb 2-1: config 0 descriptor?? [ 1095.616089][ T141] bridge0: port 2(bridge_slave_1) entered blocking state [ 1095.623719][ T141] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1095.645923][ T5954] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1095.720987][T18015] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1095.760194][T18015] usb 5-1: device descriptor read/8, error -71 [ 1095.820426][ T5954] usb 2-1: USB disconnect, device number 115 [ 1095.827199][ C1] ldusb 2-1:0.55: usb_submit_urb failed (-19) [ 1095.851686][ T5954] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 1095.868668][T18015] usb usb5-port1: unable to enumerate USB device [ 1095.928693][T24075] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1096.177503][T24075] veth0_vlan: entered promiscuous mode [ 1096.216245][T24075] veth1_vlan: entered promiscuous mode [ 1096.237155][T24145] netlink: 'syz.2.6258': attribute type 10 has an invalid length. [ 1096.295149][T24075] veth0_macvtap: entered promiscuous mode [ 1096.311957][T24075] veth1_macvtap: entered promiscuous mode [ 1096.333634][T24075] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1096.360628][T24075] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1096.386555][ T1320] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1096.396365][ T1320] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1096.417279][ T49] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1096.432953][ T1320] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1096.447311][ T1320] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1096.574271][ T1320] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1096.586872][ T1320] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1096.658042][ T141] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1096.667376][ T141] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1096.670440][T24154] binder: 24153:24154 ioctl c018620b 0 returned -14 [ 1096.696227][T24154] binder: 24153:24154 ioctl c020f509 200000000080 returned -22 [ 1097.051167][ T49] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1097.097046][T24171] /dev/rnullb0: Can't open blockdev [ 1097.202951][T24175] netlink: 'syz.4.6267': attribute type 10 has an invalid length. [ 1097.548493][ T1607] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 1097.607613][ T5878] Bluetooth: hci1: command tx timeout [ 1097.717437][ T1607] usb 5-1: Using ep0 maxpacket: 8 [ 1097.726624][ T1607] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 1097.749819][ T1607] usb 5-1: config 0 has no interface number 0 [ 1097.763822][ T1607] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1097.794865][ T1607] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1097.833133][ T1607] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1097.861773][ T1607] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1097.890857][ T1607] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1097.914826][ T1607] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1097.942766][ T1607] usb 5-1: config 0 descriptor?? [ 1097.977052][ T1607] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1098.123687][ T5184] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1098.139342][ T5184] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1098.149033][ T5184] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1098.158032][ T5184] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1098.171985][ T5184] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1098.207230][ T43] usb 5-1: USB disconnect, device number 89 [ 1098.208553][ C0] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 1098.264773][ T43] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 1098.838315][T24203] netlink: 'syz.1.6277': attribute type 10 has an invalid length. [ 1098.849926][ T1320] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1099.054412][ T1320] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1099.164884][ T1320] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1099.223181][T24210] vivid-000: disconnect [ 1099.246386][ T5954] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 1099.298451][ T1320] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1099.324178][T24185] chnl_net:caif_netlink_parms(): no params data found [ 1099.415430][ T5954] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1099.425573][ T5954] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1099.455159][ T5954] usb 2-1: Product: syz [ 1099.465139][ T5954] usb 2-1: Manufacturer: syz [ 1099.491283][ T5954] usb 2-1: SerialNumber: syz [ 1099.537880][ T5954] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1099.576624][ T5929] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1099.686498][ T5878] Bluetooth: hci1: command tx timeout [ 1099.695190][T24185] bridge0: port 1(bridge_slave_0) entered blocking state [ 1099.714930][T24185] bridge0: port 1(bridge_slave_0) entered disabled state [ 1099.724256][T24185] bridge_slave_0: entered allmulticast mode [ 1099.740089][T24185] bridge_slave_0: entered promiscuous mode [ 1099.801556][T24185] bridge0: port 2(bridge_slave_1) entered blocking state [ 1099.822385][T24185] bridge0: port 2(bridge_slave_1) entered disabled state [ 1099.836515][T24185] bridge_slave_1: entered allmulticast mode [ 1099.856976][T24185] bridge_slave_1: entered promiscuous mode [ 1099.987672][T24209] vivid-000: reconnect [ 1100.035355][ T1320] bridge_slave_1: left allmulticast mode [ 1100.049314][ T1320] bridge_slave_1: left promiscuous mode [ 1100.056727][ T1320] bridge0: port 2(bridge_slave_1) entered disabled state [ 1100.089675][ T1320] bridge_slave_0: left promiscuous mode [ 1100.118479][ T1320] bridge0: port 1(bridge_slave_0) entered disabled state [ 1100.157947][T24230] netlink: 'syz.4.6285': attribute type 10 has an invalid length. [ 1100.246910][ T5878] Bluetooth: hci6: command tx timeout [ 1100.582975][ T5916] usb 2-1: USB disconnect, device number 116 [ 1100.649977][ T5929] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1100.657864][ T5929] ath9k_htc: Failed to initialize the device [ 1100.696817][ T5916] usb 2-1: ath9k_htc: USB layer deinitialized [ 1100.765384][T24246] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 1100.779002][T24246] /dev/rnullb0: Can't open blockdev [ 1101.241454][ T1320] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1101.261060][ T1320] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1101.277395][ T1320] bond0 (unregistering): Released all slaves [ 1101.298870][T24225] 8021q: VLANs not supported on caif0 [ 1101.322296][T24185] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1101.386330][T24185] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1101.455575][ T36] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1101.520712][T24256] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6288'. [ 1101.677922][ T1320] : left promiscuous mode [ 1101.766386][ T5878] Bluetooth: hci1: command tx timeout [ 1101.780507][T24256] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1101.811963][T24185] team0: Port device team_slave_0 added [ 1101.892270][T24185] team0: Port device team_slave_1 added [ 1101.927046][ T1320] tipc: Left network mode [ 1102.070779][T24271] F2FS-fs (nullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1102.087985][T24271] F2FS-fs (nullb0): Can't find valid F2FS filesystem in 1th superblock [ 1102.114693][T24185] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1102.118365][T24271] F2FS-fs (nullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1102.134895][T24185] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1102.152584][T24271] F2FS-fs (nullb0): Can't find valid F2FS filesystem in 2th superblock [ 1102.161836][ C1] vkms_vblank_simulate: vblank timer overrun [ 1102.208320][T24185] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1102.262053][T24185] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1102.299718][T24185] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1102.337512][ T5878] Bluetooth: hci6: command tx timeout [ 1102.387949][T24185] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1102.488294][T24285] netlink: 'syz.4.6297': attribute type 10 has an invalid length. [ 1102.672492][T24185] hsr_slave_0: entered promiscuous mode [ 1102.703856][T24185] hsr_slave_1: entered promiscuous mode [ 1102.714294][T24185] debugfs: 'hsr0' already exists in 'hsr' [ 1102.727501][T24185] Cannot create hsr debugfs directory [ 1102.758429][T24291] /dev/rnullb0: Can't open blockdev [ 1102.808388][ T49] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1102.963507][T24303] /dev/rnullb0: Can't open blockdev [ 1103.511874][ T1320] hsr_slave_0: left promiscuous mode [ 1103.524365][ T1607] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 1103.536181][ T1320] hsr_slave_1: left promiscuous mode [ 1103.543180][ T1320] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1103.555690][T24317] netlink: 'syz.1.6307': attribute type 10 has an invalid length. [ 1103.568237][ T1320] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1103.577792][ T1320] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1103.592034][ T1320] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1103.629683][ T1320] veth1_macvtap: left promiscuous mode [ 1103.636765][ T1320] veth0_macvtap: left promiscuous mode [ 1103.642855][ T1320] veth1_vlan: left promiscuous mode [ 1103.649586][ T1320] @: left promiscuous mode [ 1103.715123][ T1607] usb 5-1: Using ep0 maxpacket: 32 [ 1103.723172][ T1607] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 1103.764494][ T1607] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 1103.779157][ T1607] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 1103.789725][ T1607] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1103.820973][ T1607] usb 5-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 1103.844675][ T1607] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1103.854243][ T1607] usb 5-1: Product: syz [ 1103.858743][ T1607] usb 5-1: Manufacturer: syz [ 1103.868030][ T1607] usb 5-1: SerialNumber: syz [ 1103.887288][ T1607] usb 5-1: config 0 descriptor?? [ 1103.982090][ T1320] pimreg3 (unregistering): left allmulticast mode [ 1104.056789][T24324] /dev/rnullb0: Can't open blockdev [ 1104.192343][T24325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1104.286929][T24325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1104.298810][T24325] /dev/rnullb0: Can't open blockdev [ 1104.404346][ T5878] Bluetooth: hci6: command tx timeout [ 1105.073166][ T1320] team0 (unregistering): Port device team_slave_1 removed [ 1105.221582][ T1320] team0 (unregistering): Port device C removed [ 1106.115012][ T5954] usb 5-1: USB disconnect, device number 90 [ 1106.495041][ T5878] Bluetooth: hci6: command tx timeout [ 1107.138484][T24360] 9pnet: Found fid 0 not clunked [ 1107.284151][T24328] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1107.321021][T24364] blktrace: Concurrent blktraces are not allowed on rnullb0 [ 1107.337772][T18015] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 1107.425415][ T5954] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 1107.502329][T18015] usb 5-1: Using ep0 maxpacket: 8 [ 1107.512354][T24369] netlink: 'syz.5.6319': attribute type 10 has an invalid length. [ 1107.523869][T24185] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1107.537594][T18015] usb 5-1: config 0 has an invalid interface number: 52 but max is 0 [ 1107.547864][T18015] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1107.570102][T24185] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1107.571388][T18015] usb 5-1: config 0 has no interface number 0 [ 1107.597218][T24185] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1107.604930][T18015] usb 5-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 1107.624301][ T5954] usb 2-1: config 0 interface 0 altsetting 253 endpoint 0x81 has an invalid bInterval 36, changing to 9 [ 1107.627250][T18015] usb 5-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1107.660916][ T5954] usb 2-1: config 0 interface 0 altsetting 253 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1107.662515][T18015] usb 5-1: config 0 interface 52 has no altsetting 0 [ 1107.689479][T24185] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1107.698553][T18015] usb 5-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 1107.712648][ T5954] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1107.732826][ T5954] usb 2-1: New USB device found, idVendor=0810, idProduct=0002, bcdDevice= 0.00 [ 1107.745062][T18015] usb 5-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 1107.762073][ T5954] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1107.778533][ T5954] usb 2-1: config 0 descriptor?? [ 1107.784421][T18015] usb 5-1: Manufacturer: syz [ 1107.826028][T18015] usb 5-1: config 0 descriptor?? [ 1107.980108][T24185] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1108.021749][T24185] 8021q: adding VLAN 0 to HW filter on device team0 [ 1108.057701][T24357] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1108.075306][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 1108.083360][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1108.089298][T24357] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1108.170239][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 1108.171612][T18015] input: syz as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.52/input/input53 [ 1108.178652][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1108.208553][ T5954] pantherlord 0003:0810:0002.0025: unknown main item tag 0x6 [ 1108.282658][ T5954] pantherlord 0003:0810:0002.0025: hidraw0: USB HID v0.00 Device [HID 0810:0002] on usb-dummy_hcd.1-1/input0 [ 1108.349151][ T5954] pantherlord 0003:0810:0002.0025: Force feedback for PantherLord/GreenAsia devices by Anssi Hannula [ 1108.423481][T24357] /dev/rnullb0: Can't open blockdev [ 1108.485370][ T5954] usb 5-1: USB disconnect, device number 91 [ 1108.485452][ C0] synaptics_usb 5-1:0.52: synusb_irq - usb_submit_urb failed with result: -19 [ 1108.564464][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1108.775958][ T43] usb 2-1: USB disconnect, device number 117 [ 1109.255853][T24185] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1109.426299][T24185] veth0_vlan: entered promiscuous mode [ 1109.475788][T24185] veth1_vlan: entered promiscuous mode [ 1109.590647][T24185] veth0_macvtap: entered promiscuous mode [ 1109.630269][T24185] veth1_macvtap: entered promiscuous mode [ 1109.687642][T24185] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1109.720932][T24185] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1109.744555][ T141] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.756017][ T141] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.770510][ T141] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.780209][ T982] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 1109.810303][ T141] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.948076][ T982] usb 5-1: Using ep0 maxpacket: 32 [ 1109.985124][ T982] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1110.008781][ T982] usb 5-1: config 255 has an invalid interface number: 243 but max is 0 [ 1110.029628][ T982] usb 5-1: config 255 has no interface number 0 [ 1110.039802][ T982] usb 5-1: config 255 interface 243 has no altsetting 0 [ 1110.061749][ T982] usb 5-1: New USB device found, idVendor=5050, idProduct=8004, bcdDevice=80.4a [ 1110.074140][ T141] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1110.089509][ T982] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1110.116369][ T982] usb 5-1: Product: syz [ 1110.118423][ T141] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1110.129941][ T982] usb 5-1: Manufacturer: syz [ 1110.145534][ T982] usb 5-1: SerialNumber: syz [ 1110.285329][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1110.319280][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1110.412354][T24425] netlink: 'syz.5.6327': attribute type 10 has an invalid length. [ 1110.433279][T24426] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1110.465114][T24426] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1110.532783][T24412] netlink: 2384 bytes leftover after parsing attributes in process `syz.4.6325'. [ 1110.583576][ T982] ftdi_sio 5-1:255.243: FTDI USB Serial Device converter detected [ 1110.604306][ T982] ftdi_sio ttyUSB0: unknown device type: 0x804a [ 1110.645444][ T982] usb 5-1: USB disconnect, device number 92 [ 1110.673410][ T982] ftdi_sio 5-1:255.243: device disconnected [ 1110.770810][T24439] ./cgroup: Can't lookup blockdev [ 1110.873115][T24445] netlink: zone id is out of range [ 1110.879759][T24445] netlink: zone id is out of range [ 1110.886941][T24445] netlink: zone id is out of range [ 1110.894238][T24445] netlink: zone id is out of range [ 1110.900095][T24445] netlink: zone id is out of range [ 1110.906940][T24445] netlink: zone id is out of range [ 1110.913030][T24445] netlink: zone id is out of range [ 1110.918902][T24445] netlink: zone id is out of range [ 1110.926050][T24445] netlink: zone id is out of range [ 1110.940049][T24447] binfmt_misc: register: failed to install interpreter file ./cgroup [ 1110.949563][T24445] netlink: zone id is out of range [ 1110.978691][T24445] /dev/rnullb0: Can't open blockdev [ 1111.567155][T24468] netlink: 'syz.4.6337': attribute type 10 has an invalid length. [ 1111.601008][T18015] usb 2-1: new full-speed USB device number 118 using dummy_hcd [ 1111.783256][T18015] usb 2-1: config 0 has an invalid interface number: 214 but max is 0 [ 1111.802813][T18015] usb 2-1: config 0 has no interface number 0 [ 1111.820166][T18015] usb 2-1: config 0 interface 214 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1111.850074][T18015] usb 2-1: config 0 interface 214 has no altsetting 0 [ 1111.871162][T18015] usb 2-1: New USB device found, idVendor=07c9, idProduct=000e, bcdDevice=5d.4f [ 1111.893455][T18015] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1111.903614][T18015] usb 2-1: Product: syz [ 1111.908081][T18015] usb 2-1: Manufacturer: syz [ 1111.925235][T18015] usb 2-1: SerialNumber: syz [ 1111.943709][T18015] usb 2-1: config 0 descriptor?? [ 1111.960814][T24461] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1112.170206][T24458] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1112.327550][T24487] /dev/rnullb0: Can't open blockdev [ 1112.439237][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 1112.489866][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 1112.780028][ T5916] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 1112.943704][ T5916] usb 5-1: Using ep0 maxpacket: 8 [ 1112.971756][ T5916] usb 5-1: New USB device found, idVendor=1a0a, idProduct=0103, bcdDevice=ad.1d [ 1112.987995][ T5916] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1113.012784][ T5916] usb 5-1: Product: syz [ 1113.020826][ T5916] usb 5-1: Manufacturer: syz [ 1113.026109][ T5916] usb 5-1: SerialNumber: syz [ 1113.031930][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 1113.046494][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1113.086911][ T5916] usb 5-1: config 0 descriptor?? [ 1113.134905][ T5916] usb_ehset_test 5-1:0.0: probe with driver usb_ehset_test failed with error -32 [ 1113.176058][T24516] netlink: 'syz.1.6347': attribute type 10 has an invalid length. [ 1113.320621][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 1113.348152][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0006: -71 [ 1113.362926][T24496] /dev/rnullb0: Can't open blockdev [ 1113.378928][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): invalid MAC address, using random [ 1113.387117][ T982] usb 5-1: USB disconnect, device number 93 [ 1113.437895][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0006: -71 [ 1113.469704][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0005: -71 [ 1113.517778][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 1113.545157][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 1113.568926][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 1113.589254][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 1113.619700][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 1113.654545][T24527] /dev/rnullb0: Can't open blockdev [ 1113.666691][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 1113.726444][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 1113.743496][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 1113.786555][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 1113.805336][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 1113.837643][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 1113.858811][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0019: -71 [ 1113.877969][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 1113.895801][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 1113.911499][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 1113.969474][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 1114.003339][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x000e: -71 [ 1114.015918][T24541] /dev/rnullb0: Can't open blockdev [ 1114.042035][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 1114.095424][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 1114.124103][T24538] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6354'. [ 1114.133962][T24538] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6354'. [ 1114.153816][T24547] vxcan1: entered allmulticast mode [ 1114.164757][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 1114.188599][T24547] vxcan1: left allmulticast mode [ 1114.189271][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 1114.230918][T18015] ax88179_178a 2-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 1114.273650][T18015] ax88179_178a 2-1:0.214 eth1: register 'ax88179_178a' at usb-dummy_hcd.1-1, AT-UMC2000 USB 3.0/USB 3.1 Gen 1 to Gigabit Ethernet Adapter, 56:65:b8:87:68:d1 [ 1114.299391][ T982] usb 3-1: new full-speed USB device number 103 using dummy_hcd [ 1114.302149][T18015] usb 2-1: USB disconnect, device number 118 [ 1114.318345][T18015] ax88179_178a 2-1:0.214 eth1: unregister 'ax88179_178a' usb-dummy_hcd.1-1, AT-UMC2000 USB 3.0/USB 3.1 Gen 1 to Gigabit Ethernet Adapter [ 1114.330673][ T66] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1114.489007][ T982] usb 3-1: device descriptor read/64, error -71 [ 1114.517225][T24554] netlink: 'syz.4.6358': attribute type 10 has an invalid length. [ 1114.757959][ T982] usb 3-1: new full-speed USB device number 104 using dummy_hcd [ 1114.804358][ T30] audit: type=1326 audit(1754338812.287:249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24561 comm="syz.5.6361" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f06f0b8eb69 code=0x0 [ 1114.908565][ T982] usb 3-1: device descriptor read/64, error -71 [ 1115.020341][ T982] usb usb3-port1: attempt power cycle [ 1115.368289][ T982] usb 3-1: new full-speed USB device number 105 using dummy_hcd [ 1115.399062][ T982] usb 3-1: device descriptor read/8, error -71 [ 1115.484485][T24585] netlink: 'syz.5.6367': attribute type 10 has an invalid length. [ 1115.498430][T18015] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 1115.648276][ T982] usb 3-1: new full-speed USB device number 106 using dummy_hcd [ 1115.658184][T18015] usb 2-1: device descriptor read/64, error -71 [ 1115.683622][ T982] usb 3-1: device descriptor read/8, error -71 [ 1115.736109][T24590] /dev/rnullb0: Can't open blockdev [ 1115.808834][ T982] usb usb3-port1: unable to enumerate USB device [ 1115.897999][T18015] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 1116.027991][T18015] usb 2-1: device descriptor read/64, error -71 [ 1116.152281][T18015] usb usb2-port1: attempt power cycle [ 1116.510887][T18015] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 1116.538631][T18015] usb 2-1: device descriptor read/8, error -71 [ 1116.780449][T18015] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 1116.808302][T18015] usb 2-1: device descriptor read/8, error -71 [ 1116.918399][T18015] usb usb2-port1: unable to enumerate USB device [ 1117.775689][T24638] net_ratelimit: 162 callbacks suppressed [ 1117.775705][T24638] openvswitch: netlink: IP tunnel dst address not specified [ 1117.795917][T24638] netlink: 'syz.4.6389': attribute type 1 has an invalid length. [ 1117.805284][T24638] netlink: 228 bytes leftover after parsing attributes in process `syz.4.6389'. [ 1118.139871][ T5961] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1118.293922][T24645] /dev/rnullb0: Can't open blockdev [ 1118.301077][ T5961] usb 5-1: Using ep0 maxpacket: 8 [ 1118.313053][ T5961] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 1118.322897][ T5961] usb 5-1: config 0 has no interface number 0 [ 1118.329960][ T5961] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1118.342238][ T5961] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1118.356982][ T5961] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1118.370713][ T5961] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1118.386052][ T5961] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1118.397326][ T5961] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1118.414909][ T5961] usb 5-1: config 0 descriptor?? [ 1118.432758][ T5961] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1118.490281][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88804fabe000: rx timeout, send abort [ 1118.500394][ C0] vxcan1: j1939_xtp_rx_abort_one: 0xffff88804fabe000: 0x0ff02: (3) A timeout occurred and this is the connection abort to close the session. [ 1118.635198][ T5961] usb 5-1: USB disconnect, device number 94 [ 1118.641684][ C0] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 1118.669455][ T5961] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 1118.797690][T24328] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1118.955848][T24660] /dev/rnullb0: Can't open blockdev [ 1119.042549][T24665] /dev/rnullb0: Can't open blockdev [ 1119.747888][T24687] netlink: 80 bytes leftover after parsing attributes in process `syz.2.6410'. [ 1119.791690][T24687] /dev/rnullb0: Can't open blockdev [ 1119.908878][T24697] /dev/rnullb0: Can't open blockdev [ 1120.076818][T24328] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1120.153745][T24703] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1120.269678][T24710] netlink: 57 bytes leftover after parsing attributes in process `syz.1.6419'. [ 1120.419084][ T982] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 1120.605773][ T982] usb 3-1: Using ep0 maxpacket: 8 [ 1120.619049][ T982] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 1120.635964][ T982] usb 3-1: config 0 has no interface number 0 [ 1120.642239][ T982] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1120.689757][ T982] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1120.720325][ T982] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1120.734289][ T982] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1120.750296][ T982] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1120.761356][ T982] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1120.802871][ T982] usb 3-1: config 0 descriptor?? [ 1120.828500][ T982] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1121.040291][ T982] usb 3-1: USB disconnect, device number 107 [ 1121.047177][ C1] ldusb 3-1:0.55: usb_submit_urb failed (-19) [ 1121.065465][ T982] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 1122.017328][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1122.444871][ T43] usb 3-1: new full-speed USB device number 108 using dummy_hcd [ 1122.474880][ T982] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 1122.660389][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1122.684193][ T982] usb 5-1: Using ep0 maxpacket: 8 [ 1122.699942][ T43] usb 3-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 1122.754886][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1122.766597][ T982] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 1122.800996][ T982] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1122.819426][ T43] usb 3-1: config 0 descriptor?? [ 1122.839695][ T982] usb 5-1: Product: syz [ 1122.844976][ T982] usb 5-1: Manufacturer: syz [ 1122.850016][ T982] usb 5-1: SerialNumber: syz [ 1122.861503][ T982] usb 5-1: config 0 descriptor?? [ 1123.126784][ T982] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1123.274010][ T43] smartjoyplus 0003:6666:8804.0026: hidraw0: USB HID v0.00 Device [HID 6666:8804] on usb-dummy_hcd.2-1/input0 [ 1123.295493][ T43] smartjoyplus 0003:6666:8804.0026: no output reports found [ 1123.450573][T24770] /dev/rnullb0: Can't open blockdev [ 1123.458194][ T43] usb 3-1: USB disconnect, device number 108 [ 1123.854904][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1124.283911][ T1607] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 1124.409616][ T982] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 1124.481616][ T5961] usb 5-1: USB disconnect, device number 95 [ 1124.523706][ T1607] usb 2-1: Using ep0 maxpacket: 8 [ 1124.531586][ T1607] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 1124.548066][ T1607] usb 2-1: config 0 has no interface number 0 [ 1124.573657][ T1607] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1124.605853][ T1607] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1124.621459][ T1607] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1124.635425][ T1607] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1124.665459][ T1607] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1124.676040][ T1607] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1124.694538][ T1607] usb 2-1: config 0 descriptor?? [ 1124.718224][ T1607] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1124.807512][ T982] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 1124.915584][ T1607] usb 2-1: USB disconnect, device number 123 [ 1124.915661][ C0] ldusb 2-1:0.55: usb_submit_urb failed (-19) [ 1124.955011][ T1607] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 1124.984770][ T982] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1124.997287][ T982] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1125.009367][ T982] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1125.019102][ T982] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1125.043048][ T982] usb 3-1: config 0 descriptor?? [ 1125.574195][ T982] usbhid 3-1:0.0: can't add hid device: -71 [ 1125.580988][ T982] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1125.609777][ T982] usb 3-1: USB disconnect, device number 109 [ 1126.790301][T24828] /dev/rnullb0: Can't open blockdev [ 1127.118647][T24832] kvm: kvm [24831]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010015) = 0x1 [ 1128.336980][T24836] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1128.343732][T24836] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 1128.510039][T24843] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ44/@qkp [ 1128.510039][T24843] C<+ [ 1128.510071][T24836] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1128.541413][T24836] Bluetooth: hci6: Error when powering off device on rfkill (-4) [ 1128.895308][T24852] /dev/rnullb0: Can't open blockdev [ 1128.993420][ T5961] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 1129.161361][ T5961] usb 5-1: device descriptor read/64, error -71 [ 1129.431600][ T5961] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1129.581162][ T5961] usb 5-1: device descriptor read/64, error -71 [ 1129.672532][T24328] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1129.672606][ T5939] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1129.695950][ T5961] usb usb5-port1: attempt power cycle [ 1129.734874][T24859] /dev/rnullb0: Can't open blockdev [ 1130.068127][ T5961] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 1130.093227][ T5961] usb 5-1: device descriptor read/8, error -71 [ 1130.374112][ T5961] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 1130.423154][ T5961] usb 5-1: device descriptor read/8, error -71 [ 1130.490735][ T5916] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 1130.538368][ T5961] usb usb5-port1: unable to enumerate USB device [ 1130.670725][ T5916] usb 2-1: Using ep0 maxpacket: 32 [ 1130.679189][ T5916] usb 2-1: config 0 has an invalid interface number: 74 but max is 0 [ 1130.694644][ T5916] usb 2-1: config 0 has no interface number 0 [ 1130.709999][ T5916] usb 2-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=8e.fa [ 1130.719879][ T5916] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1130.728951][ T5916] usb 2-1: Product: syz [ 1130.735781][ T5916] usb 2-1: Manufacturer: syz [ 1130.740753][ T5916] usb 2-1: SerialNumber: syz [ 1130.748796][ T5916] usb 2-1: config 0 descriptor?? [ 1131.104298][T24868] /dev/rnullb0: Can't open blockdev [ 1131.865180][T24874] /dev/rnullb0: Can't open blockdev [ 1132.354965][T24888] /dev/rnullb0: Can't open blockdev [ 1133.548981][ T982] usb 2-1: USB disconnect, device number 124 [ 1133.803289][T24891] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 1134.320125][T24911] syzkaller1: entered promiscuous mode [ 1134.326295][T24911] syzkaller1: entered allmulticast mode [ 1134.343010][T24911] netlink: 'syz.2.6490': attribute type 10 has an invalid length. [ 1134.352233][T24911] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6490'. [ 1134.387161][T24911] team0: Failed to send port change of device geneve0 via netlink (err -105) [ 1134.407466][T24911] team0: Failed to send options change via netlink (err -105) [ 1134.416535][T24911] team0: Port device geneve0 added [ 1134.954059][T24916] /dev/rnullb0: Can't open blockdev [ 1135.418879][T24925] /dev/rnullb0: Can't open blockdev [ 1135.429484][ T5939] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1135.449304][ T49] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1136.374651][T24947] netlink: 'syz.5.6500': attribute type 4 has an invalid length. [ 1136.533516][T24950] program syz.5.6501 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1139.377412][T24957] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 1139.550302][ T43] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 1139.596997][ T43] hid-generic 0000:0000:0000.0027: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1139.674982][T24975] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1139.746948][T24975] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1139.833232][T24968] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1139.905337][T24968] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1140.010435][T24979] netlink: 'syz.4.6510': attribute type 2 has an invalid length. [ 1140.265905][ T43] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 1140.364002][T24984] /dev/rnullb0: Can't open blockdev [ 1140.377010][T24986] /dev/rnullb0: Can't open blockdev [ 1141.187551][ T141] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1141.202003][T24328] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1141.311147][ T43] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1141.334916][ T43] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1141.348690][ T43] usb 5-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 1141.361815][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1141.378066][ T43] usb 5-1: config 0 descriptor?? [ 1141.803119][ T43] greenasia 0003:0E8F:0012.0028: unbalanced delimiter at end of report description [ 1141.829309][ T43] greenasia 0003:0E8F:0012.0028: parse failed [ 1141.836127][ T43] greenasia 0003:0E8F:0012.0028: probe with driver greenasia failed with error -22 [ 1142.021120][ T43] usb 5-1: USB disconnect, device number 100 [ 1143.850950][T25010] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 1145.627048][T25022] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ4 [ 1145.774962][T25029] /dev/rnullb0: Can't open blockdev [ 1145.779411][T25031] netlink: 'syz.2.6528': attribute type 1 has an invalid length. [ 1145.803252][T25031] netlink: 'syz.2.6528': attribute type 101 has an invalid length. [ 1145.811755][T25031] netlink: 232 bytes leftover after parsing attributes in process `syz.2.6528'. [ 1146.383594][T25048] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6535'. [ 1146.628809][T25065] /dev/rnullb0: Can't open blockdev [ 1146.963160][ T141] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1146.963420][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1148.455913][T25090] /dev/rnullb0: Can't open blockdev [ 1148.708700][T13589] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 1148.900203][T13589] usb 2-1: Using ep0 maxpacket: 16 [ 1148.909231][T13589] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1148.921997][T13589] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1148.932082][T13589] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1148.943499][T13589] usb 2-1: config 0 descriptor?? [ 1149.394722][T13589] mcp2221 0003:04D8:00DD.0029: item fetching failed at offset 4/5 [ 1149.409986][T13589] mcp2221 0003:04D8:00DD.0029: can't parse reports [ 1149.416981][T13589] mcp2221 0003:04D8:00DD.0029: probe with driver mcp2221 failed with error -22 [ 1149.674881][ T1607] usb 2-1: USB disconnect, device number 125 [ 1151.070470][T13589] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 1151.289332][T13589] usb 2-1: config 0 has an invalid interface number: 64 but max is 0 [ 1151.299627][T13589] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1151.314809][T13589] usb 2-1: config 0 has no interface number 0 [ 1151.325978][T13589] usb 2-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 1151.341374][T13589] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1151.350870][T13589] usb 2-1: Product: syz [ 1151.355950][T13589] usb 2-1: Manufacturer: syz [ 1151.361061][T13589] usb 2-1: SerialNumber: syz [ 1151.369508][T13589] usb 2-1: config 0 descriptor?? [ 1151.379080][T13589] uvcvideo 2-1:0.64: probe with driver uvcvideo failed with error -22 [ 1151.608506][T13589] usb 2-1: USB disconnect, device number 126 [ 1151.749054][T25122] /dev/rnullb0: Can't open blockdev [ 1152.095508][T18015] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 1152.265778][T18015] usb 3-1: config 0 has an invalid interface number: 120 but max is 0 [ 1152.275795][T18015] usb 3-1: config 0 has no interface number 0 [ 1152.282508][T18015] usb 3-1: config 0 interface 120 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 1152.295507][T18015] usb 3-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 1152.319879][T18015] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1152.370383][T18015] usb 3-1: config 0 descriptor?? [ 1152.400880][T18015] input: USB Touchscreen 16e3:f9e9 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.120/input/input56 [ 1152.701695][ T36] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1152.720029][T24328] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1152.997255][T13589] usb 3-1: USB disconnect, device number 110 [ 1153.107450][T25138] netlink: 272 bytes leftover after parsing attributes in process `syz.2.6560'. [ 1153.932009][T13589] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 1154.122899][T13589] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1154.152870][T13589] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1154.164498][T13589] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1154.179401][T13589] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1154.188932][T13589] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1154.203452][T13589] usb 2-1: config 0 descriptor?? [ 1154.640170][T13589] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 1154.650805][T13589] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 1154.668283][T13589] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 1154.679342][T13589] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 1154.687734][T13589] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 1154.738228][T13589] plantronics 0003:047F:FFFF.002A: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 1154.793241][T25152] Falling back ldisc for ttyS3. [ 1154.910003][T25148] /dev/rnullb0: Can't open blockdev [ 1155.086334][T18015] usb 2-1: USB disconnect, device number 127 [ 1155.218372][T13589] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 1155.378370][T13589] usb 3-1: Using ep0 maxpacket: 32 [ 1155.415813][T13589] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1155.426589][T13589] usb 3-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 1155.437087][T13589] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1155.455609][T13589] usb 3-1: config 0 descriptor?? [ 1155.714474][T25165] /dev/rnullb0: Can't open blockdev [ 1155.888399][T13589] logitech 0003:046D:C295.002B: unknown main item tag 0x7 [ 1155.927452][T13589] logitech 0003:046D:C295.002B: hidraw0: USB HID v0.00 Device [HID 046d:c295] on usb-dummy_hcd.2-1/input0 [ 1155.940416][T25169] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6570'. [ 1155.950472][T13589] logitech 0003:046D:C295.002B: no inputs found [ 1156.104817][T25160] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1156.115320][T25160] /dev/rnullb0: Can't open blockdev [ 1156.124153][T25172] netlink: 'syz.5.6571': attribute type 1 has an invalid length. [ 1156.153601][T13589] usb 3-1: USB disconnect, device number 111 [ 1156.177458][T25172] nbd: error processing sock list [ 1156.206528][T25172] block nbd0: shutting down sockets [ 1156.213357][T25173] /dev/rnullb0: Can't open blockdev [ 1156.523020][T25184] FAULT_INJECTION: forcing a failure. [ 1156.523020][T25184] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1156.541000][T25184] CPU: 0 UID: 0 PID: 25184 Comm: syz.1.6575 Not tainted 6.16.0-next-20250804-syzkaller #0 PREEMPT(full) [ 1156.541031][T25184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1156.541043][T25184] Call Trace: [ 1156.541051][T25184] [ 1156.541060][T25184] dump_stack_lvl+0x189/0x250 [ 1156.541094][T25184] ? __pfx____ratelimit+0x10/0x10 [ 1156.541120][T25184] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1156.541146][T25184] ? __pfx__printk+0x10/0x10 [ 1156.541172][T25184] ? __might_fault+0xb0/0x130 [ 1156.541216][T25184] should_fail_ex+0x414/0x560 [ 1156.541248][T25184] _copy_from_user+0x2d/0xb0 [ 1156.541272][T25184] ___sys_sendmsg+0x158/0x2a0 [ 1156.541297][T25184] ? __pfx____sys_sendmsg+0x10/0x10 [ 1156.541360][T25184] ? __fget_files+0x2a/0x420 [ 1156.541384][T25184] ? __fget_files+0x3a0/0x420 [ 1156.541421][T25184] __x64_sys_sendmsg+0x19b/0x260 [ 1156.541445][T25184] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1156.541477][T25184] ? __pfx_ksys_write+0x10/0x10 [ 1156.541496][T25184] ? rcu_is_watching+0x15/0xb0 [ 1156.541525][T25184] ? do_syscall_64+0xbe/0x3b0 [ 1156.541553][T25184] do_syscall_64+0xfa/0x3b0 [ 1156.541578][T25184] ? lockdep_hardirqs_on+0x9c/0x150 [ 1156.541604][T25184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1156.541624][T25184] ? clear_bhb_loop+0x60/0xb0 [ 1156.541648][T25184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1156.541667][T25184] RIP: 0033:0x7fd43ef8eb69 [ 1156.541685][T25184] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1156.541703][T25184] RSP: 002b:00007fd43fead038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1156.541725][T25184] RAX: ffffffffffffffda RBX: 00007fd43f1b5fa0 RCX: 00007fd43ef8eb69 [ 1156.541741][T25184] RDX: 0000000000000010 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1156.541753][T25184] RBP: 00007fd43fead090 R08: 0000000000000000 R09: 0000000000000000 [ 1156.541766][T25184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1156.541778][T25184] R13: 0000000000000000 R14: 00007fd43f1b5fa0 R15: 00007fffd6bbea48 [ 1156.541810][T25184] [ 1156.840078][T25188] /dev/rnullb0: Can't open blockdev [ 1156.846435][T25188] /dev/rnullb0: Can't open blockdev [ 1156.852962][T25188] /dev/rnullb0: Can't open blockdev [ 1156.864306][T25188] /dev/rnullb0: Can't open blockdev [ 1156.870639][T25188] /dev/rnullb0: Can't open blockdev [ 1156.877283][T25188] /dev/rnullb0: Can't open blockdev [ 1156.883497][T25188] /dev/rnullb0: Can't open blockdev [ 1156.890615][T25188] /dev/rnullb0: Can't open blockdev [ 1156.896964][T25188] /dev/rnullb0: Can't open blockdev [ 1156.903644][T25188] /dev/rnullb0: Can't open blockdev [ 1156.909871][T25188] /dev/rnullb0: Can't open blockdev [ 1156.916292][T25188] /dev/rnullb0: Can't open blockdev [ 1156.922807][T25188] /dev/rnullb0: Can't open blockdev [ 1156.928453][T25192] netlink: 'syz.5.6578': attribute type 16 has an invalid length. [ 1156.928481][T25192] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6578'. [ 1156.947996][T25188] /dev/rnullb0: Can't open blockdev [ 1156.954415][T25188] /dev/rnullb0: Can't open blockdev [ 1156.960703][T25188] /dev/rnullb0: Can't open blockdev [ 1156.967052][T25188] /dev/rnullb0: Can't open blockdev [ 1156.973385][T25188] /dev/rnullb0: Can't open blockdev [ 1156.973867][T25192] bridge0: port 1(bridge_slave_0) entered disabled state [ 1156.982602][T25188] /dev/rnullb0: Can't open blockdev [ 1156.993044][T25188] /dev/rnullb0: Can't open blockdev [ 1156.999119][T25188] /dev/rnullb0: Can't open blockdev [ 1157.005734][T25188] /dev/rnullb0: Can't open blockdev [ 1157.012504][T25188] /dev/rnullb0: Can't open blockdev [ 1157.019206][T25188] /dev/rnullb0: Can't open blockdev [ 1157.025731][T25188] /dev/rnullb0: Can't open blockdev [ 1157.033673][T25188] /dev/rnullb0: Can't open blockdev [ 1157.041569][T25188] /dev/rnullb0: Can't open blockdev [ 1157.049160][T25188] /dev/rnullb0: Can't open blockdev [ 1157.055508][T25188] /dev/rnullb0: Can't open blockdev [ 1157.063299][T25188] /dev/rnullb0: Can't open blockdev [ 1157.077629][T25188] /dev/rnullb0: Can't open blockdev [ 1157.083866][T25188] /dev/rnullb0: Can't open blockdev [ 1157.091358][T25188] /dev/rnullb0: Can't open blockdev [ 1157.467330][ T982] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 1157.630365][ T982] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1157.642643][ T982] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1157.654909][ T982] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1157.670460][ T982] usb 3-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 1157.680581][ T982] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1157.692876][ T982] usb 3-1: config 0 descriptor?? [ 1157.824593][ T66] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1158.144036][ T982] acrux 0003:1A34:0802.002C: report_id 428543292 is invalid [ 1158.161790][T25208] /dev/rnullb0: Can't open blockdev [ 1158.173010][ T982] acrux 0003:1A34:0802.002C: item 0 4 1 8 parsing failed [ 1158.201049][ T982] acrux 0003:1A34:0802.002C: parse failed [ 1158.210293][ T982] acrux 0003:1A34:0802.002C: probe with driver acrux failed with error -22 [ 1158.282712][T25210] /dev/rnullb0: Can't open blockdev [ 1158.364669][T25199] /dev/rnullb0: Can't open blockdev [ 1158.373637][T18015] usb 3-1: USB disconnect, device number 112 [ 1158.468635][ T36] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1159.019736][T25217] /dev/rnullb0: Can't open blockdev [ 1159.273021][T25221] netlink: 'syz.4.6589': attribute type 16 has an invalid length. [ 1159.281974][T25221] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6589'. [ 1160.211582][T25225] input: syz0 as /devices/virtual/input/input57 [ 1160.306775][T25226] /dev/rnullb0: Can't open blockdev [ 1161.855417][T13589] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1162.035289][T13589] usb 2-1: Using ep0 maxpacket: 16 [ 1162.048466][T13589] usb 2-1: config 1 interface 0 altsetting 3 endpoint 0x1 has invalid maxpacket 2007, setting to 1024 [ 1162.071746][T13589] usb 2-1: config 1 interface 0 altsetting 3 bulk endpoint 0x1 has invalid maxpacket 1024 [ 1162.093089][T13589] usb 2-1: config 1 interface 0 altsetting 3 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1162.138104][T13589] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1162.152537][T13589] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1162.165511][T13589] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1162.174114][T13589] usb 2-1: Product: ♫蔜珥Ꚅ귩ꗿԴ䋸늍鉩ￖﭝᲯ씗ꑹ➽ᔣ㖋癨䠸썱뼚岧俍錊ﴓ瓘ꫢឲ [ 1162.189684][T13589] usb 2-1: Manufacturer: ꋴ顫彫ၧ㴡䇁䨈㿤ፃꔡ⫩캣䲼礩ΰ좗ȏ譿憱ꂶᔊ梊䡼◝㍷봋뵐縠䊊 [ 1162.207506][T13589] usb 2-1: SerialNumber: syz [ 1162.241318][T25239] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1162.265086][T25239] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1162.342977][T25274] netlink: 'syz.5.6604': attribute type 16 has an invalid length. [ 1162.353071][T25274] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6604'. [ 1162.502941][T25240] netlink: 84 bytes leftover after parsing attributes in process `syz.1.6594'. [ 1163.204466][ T1607] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 1163.391558][ T1607] usb 5-1: Using ep0 maxpacket: 16 [ 1163.401141][ T1607] usb 5-1: config 0 has an invalid interface number: 32 but max is 0 [ 1163.410958][ T1607] usb 5-1: config 0 has no interface number 0 [ 1163.424548][ T1607] usb 5-1: config 0 interface 32 altsetting 13 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1163.437691][ T1607] usb 5-1: config 0 interface 32 altsetting 13 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1163.448948][ T1607] usb 5-1: config 0 interface 32 has no altsetting 0 [ 1163.456770][ T1607] usb 5-1: New USB device found, idVendor=1b1c, idProduct=1b34, bcdDevice= 0.00 [ 1163.471666][ T1607] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1163.485621][ T1607] usb 5-1: config 0 descriptor?? [ 1163.581864][ T141] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1163.916366][ T1607] corsair 0003:1B1C:1B34.002D: unknown main item tag 0x0 [ 1163.925516][ T1607] corsair 0003:1B1C:1B34.002D: unknown main item tag 0x0 [ 1163.933067][ T1607] corsair 0003:1B1C:1B34.002D: unknown main item tag 0x0 [ 1163.943376][ T1607] corsair 0003:1B1C:1B34.002D: unknown main item tag 0x0 [ 1163.951625][ T1607] corsair 0003:1B1C:1B34.002D: unknown main item tag 0x0 [ 1163.964460][ T1607] corsair 0003:1B1C:1B34.002D: failed to start in urb: -90 [ 1163.988660][ T1607] corsair 0003:1B1C:1B34.002D: hidraw0: USB HID v0.05 Device [HID 1b1c:1b34] on usb-dummy_hcd.4-1/input32 [ 1164.124169][T25280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1164.133484][T25280] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1164.159211][T18015] usb 5-1: USB disconnect, device number 101 [ 1164.239727][ T49] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1166.122725][T25288] netlink: 'syz.4.6609': attribute type 1 has an invalid length. [ 1166.161631][T13589] usb 2-1: USB disconnect, device number 2 [ 1166.163304][T25288] netlink: 5624 bytes leftover after parsing attributes in process `syz.4.6609'. [ 1167.045115][T25320] /dev/rnullb0: Can't open blockdev [ 1167.156659][T25322] netlink: 'syz.5.6621': attribute type 16 has an invalid length. [ 1167.165890][T25322] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6621'. [ 1167.308523][T25324] vivid-001: disconnect [ 1167.315143][T25324] vivid-001: reconnect [ 1167.439634][T25329] /dev/rnullb0: Can't open blockdev [ 1167.488846][T25331] netlink: 192 bytes leftover after parsing attributes in process `syz.1.6625'. [ 1167.602631][T18015] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 1167.742076][T18015] usb 5-1: device descriptor read/64, error -71 [ 1167.981947][T18015] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 1168.132206][T18015] usb 5-1: device descriptor read/64, error -71 [ 1168.272461][T18015] usb usb5-port1: attempt power cycle [ 1168.618948][T18015] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 1168.654884][T18015] usb 5-1: device descriptor read/8, error -71 [ 1168.911604][T18015] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 1168.952214][T18015] usb 5-1: device descriptor read/8, error -71 [ 1169.064068][T18015] usb usb5-port1: unable to enumerate USB device [ 1169.301550][ T5961] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1169.461475][ T5961] usb 2-1: Using ep0 maxpacket: 8 [ 1169.471315][ T5961] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1169.480974][ T5961] usb 2-1: config 11 has an invalid interface number: 244 but max is 0 [ 1169.499618][ T5961] usb 2-1: config 11 has no interface number 0 [ 1169.511938][ T5961] usb 2-1: config 11 interface 244 altsetting 5 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1169.524836][ T5961] usb 2-1: config 11 interface 244 altsetting 5 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1169.536444][ T5961] usb 2-1: config 11 interface 244 has no altsetting 0 [ 1169.547026][ T5961] usb 2-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=57.8a [ 1169.557236][ T5961] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1169.566045][ T5961] usb 2-1: Product: syz [ 1169.571351][ T5961] usb 2-1: Manufacturer: syz [ 1169.580045][ T5961] usb 2-1: SerialNumber: syz [ 1169.868477][ T5961] peak_usb 2-1:11.244 can0: unable to request usb[type=0 value=1] err=-71 [ 1169.877674][ T5961] peak_usb 2-1:11.244: unable to read PCAN-USB X6 firmware info (err -71) [ 1169.932499][ T5961] peak_usb 2-1:11.244: probe with driver peak_usb failed with error -71 [ 1169.946840][ T5961] usb 2-1: USB disconnect, device number 3 [ 1169.972181][ T5939] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1170.594320][ T30] audit: type=1804 audit(1754338868.095:250): pid=25357 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.6635" name="/newroot/541/bus/file1" dev="overlay" ino=2854 res=1 errno=0 [ 1170.601078][T25357] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1170.646113][ T30] audit: type=1800 audit(1754338868.095:251): pid=25357 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.6635" name="file1" dev="overlay" ino=2854 res=0 errno=0 [ 1170.661739][T25357] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1170.678065][ T30] audit: type=1800 audit(1754338868.105:252): pid=25361 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.6635" name="file1" dev="overlay" ino=2854 res=0 errno=0 [ 1170.830589][ T5961] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 1171.030463][ T5961] usb 5-1: Using ep0 maxpacket: 16 [ 1171.056924][ T5961] usb 5-1: config index 0 descriptor too short (expected 4495, got 71) [ 1171.066468][ T5961] usb 5-1: config 0 has an invalid interface number: 105 but max is 0 [ 1171.086335][ T5961] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1171.098648][ T5961] usb 5-1: config 0 has no interface number 0 [ 1171.118512][ T5961] usb 5-1: New USB device found, idVendor=046c, idProduct=14e0, bcdDevice= 0.01 [ 1171.136907][ T5961] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1171.146101][ T5961] usb 5-1: Product: syz [ 1171.170439][ T5961] usb 5-1: Manufacturer: syz [ 1171.181099][ T5961] usb 5-1: SerialNumber: syz [ 1171.211348][ T5961] usb 5-1: config 0 descriptor?? [ 1171.474621][ T5961] usb 5-1: Found UVC 0.00 device syz (046c:14e0) [ 1171.492481][ T5961] usb 5-1: No valid video chain found. [ 1171.767734][T25388] /dev/rnullb0: Can't open blockdev [ 1172.532041][T25409] ------------[ cut here ]------------ [ 1172.538875][T25409] WARNING: mm/page_alloc.c:5124 at __alloc_frozen_pages_noprof+0x2c8/0x370, CPU#0: syz.5.6654/25409 [ 1172.550731][T25409] Modules linked in: [ 1172.555251][T25409] CPU: 0 UID: 0 PID: 25409 Comm: syz.5.6654 Not tainted 6.16.0-next-20250804-syzkaller #0 PREEMPT(full) [ 1172.567225][T25409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1172.577792][T25409] RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 [ 1172.585204][T25409] Code: 74 10 4c 89 e7 89 54 24 0c e8 c4 1d 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 a4 49 b8 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 1172.606488][T25409] RSP: 0018:ffffc9000b6ff8c0 EFLAGS: 00010246 [ 1172.614090][T25409] RAX: ffffc9000b6ff900 RBX: 0000000000000033 RCX: 0000000000000000 [ 1172.622430][T25409] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000b6ff928 [ 1172.631228][T25409] RBP: ffffc9000b6ff9c0 R08: ffffc9000b6ff927 R09: 0000000000000000 [ 1172.640114][T25409] R10: ffffc9000b6ff900 R11: fffff520016dff25 R12: 0000000000000000 [ 1172.649104][T25409] R13: 1ffff920016dff1c R14: 0000000000040d40 R15: dffffc0000000000 [ 1172.657631][T25409] FS: 00007f06f19826c0(0000) GS:ffff8881257de000(0000) knlGS:0000000000000000 [ 1172.668186][T25409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1172.675893][T25409] CR2: 00007f06f1960f98 CR3: 0000000068bde000 CR4: 00000000003526f0 [ 1172.685143][T25409] Call Trace: [ 1172.688653][T25409] [ 1172.692928][T25409] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1172.700150][T25409] ? kfree+0x18e/0x440 [ 1172.704473][T25409] ? policy_nodemask+0x27c/0x720 [ 1172.709911][T25409] ? p9_client_clunk+0x1b6/0x250 [ 1172.714897][T25409] alloc_pages_mpol+0x232/0x4a0 [ 1172.720050][T25409] ___kmalloc_large_node+0x5f/0x1b0 [ 1172.726666][T25409] __kmalloc_large_node_noprof+0x18/0x90 [ 1172.733530][T25409] __kmalloc_noprof+0x36f/0x4f0 [ 1172.739401][T25409] ? v9fs_fid_get_acl+0x4f/0x100 [ 1172.745198][T25409] ? __pfx_v9fs_cache_inode_get_cookie+0x10/0x10 [ 1172.752277][T25409] v9fs_fid_get_acl+0x4f/0x100 [ 1172.758932][T25409] v9fs_get_acl+0x9a/0x360 [ 1172.763968][T25409] v9fs_inode_from_fid_dotl+0x221/0x2b0 [ 1172.770657][T25409] v9fs_mount+0x6eb/0xa50 [ 1172.775485][T25409] ? __pfx_v9fs_mount+0x10/0x10 [ 1172.781106][T25409] legacy_get_tree+0xfa/0x1a0 [ 1172.786018][T25409] ? __pfx_v9fs_mount+0x10/0x10 [ 1172.791009][T25409] vfs_get_tree+0x8f/0x2b0 [ 1172.795574][T25409] do_new_mount+0x2a2/0x9e0 [ 1172.800409][T25409] ? ns_capable+0x8a/0xf0 [ 1172.805374][T25409] ? __pfx_do_new_mount+0x10/0x10 [ 1172.810936][T25409] ? path_mount+0x61c/0xfe0 [ 1172.815682][T25409] ? user_path_at+0x44/0x60 [ 1172.820558][T25409] __se_sys_mount+0x317/0x410 [ 1172.826006][T25409] ? __pfx___se_sys_mount+0x10/0x10 [ 1172.831500][T25409] ? rcu_is_watching+0x15/0xb0 [ 1172.836526][T25409] ? do_syscall_64+0xbe/0x3b0 [ 1172.841626][T25409] ? __x64_sys_mount+0x20/0xc0 [ 1172.846548][T25409] do_syscall_64+0xfa/0x3b0 [ 1172.851785][T25409] ? lockdep_hardirqs_on+0x9c/0x150 [ 1172.857224][T25409] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1172.863854][T25409] ? clear_bhb_loop+0x60/0xb0 [ 1172.868940][T25409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1172.875395][T25409] RIP: 0033:0x7f06f0b8eb69 [ 1172.880508][T25409] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1172.901439][T25409] RSP: 002b:00007f06f1982038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1172.910761][T25409] RAX: ffffffffffffffda RBX: 00007f06f0db5fa0 RCX: 00007f06f0b8eb69 [ 1172.919925][T25409] RDX: 0000200000000b80 RSI: 00002000000003c0 RDI: 0000000000000000 [ 1172.928313][T25409] RBP: 00007f06f0c11df1 R08: 0000200000000500 R09: 0000000000000000 [ 1172.936589][T25409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1172.945160][T25409] R13: 0000000000000000 R14: 00007f06f0db5fa0 R15: 00007ffd448ba6d8 [ 1172.953718][T25409] [ 1172.956894][T25409] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1172.964300][T25409] CPU: 0 UID: 0 PID: 25409 Comm: syz.5.6654 Not tainted 6.16.0-next-20250804-syzkaller #0 PREEMPT(full) [ 1172.976123][T25409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1172.986982][T25409] Call Trace: [ 1172.990359][T25409] [ 1172.993387][T25409] dump_stack_lvl+0x99/0x250 [ 1172.997991][T25409] ? __asan_memcpy+0x40/0x70 [ 1173.002680][T25409] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1173.008427][T25409] ? __pfx__printk+0x10/0x10 [ 1173.013395][T25409] vpanic+0x281/0x750 [ 1173.017494][T25409] ? __pfx_vpanic+0x10/0x10 [ 1173.022114][T25409] ? is_bpf_text_address+0x292/0x2b0 [ 1173.027766][T25409] ? is_bpf_text_address+0x26/0x2b0 [ 1173.033413][T25409] panic+0xb9/0xc0 [ 1173.038707][T25409] ? __pfx_panic+0x10/0x10 [ 1173.043146][T25409] __warn+0x334/0x4c0 [ 1173.047570][T25409] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 1173.053754][T25409] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 1173.060016][T25409] report_bug+0x2be/0x4f0 [ 1173.064791][T25409] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 1173.071274][T25409] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 1173.077711][T25409] ? __alloc_frozen_pages_noprof+0x2ca/0x370 [ 1173.084483][T25409] handle_bug+0x84/0x160 [ 1173.089104][T25409] exc_invalid_op+0x1a/0x50 [ 1173.094074][T25409] asm_exc_invalid_op+0x1a/0x20 [ 1173.099201][T25409] RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 [ 1173.106841][T25409] Code: 74 10 4c 89 e7 89 54 24 0c e8 c4 1d 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 a4 49 b8 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 1173.127340][T25409] RSP: 0018:ffffc9000b6ff8c0 EFLAGS: 00010246 [ 1173.134624][T25409] RAX: ffffc9000b6ff900 RBX: 0000000000000033 RCX: 0000000000000000 [ 1173.142889][T25409] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000b6ff928 [ 1173.151416][T25409] RBP: ffffc9000b6ff9c0 R08: ffffc9000b6ff927 R09: 0000000000000000 [ 1173.159777][T25409] R10: ffffc9000b6ff900 R11: fffff520016dff25 R12: 0000000000000000 [ 1173.168204][T25409] R13: 1ffff920016dff1c R14: 0000000000040d40 R15: dffffc0000000000 [ 1173.176934][T25409] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1173.183674][T25409] ? kfree+0x18e/0x440 [ 1173.188458][T25409] ? policy_nodemask+0x27c/0x720 [ 1173.194294][T25409] ? p9_client_clunk+0x1b6/0x250 [ 1173.199774][T25409] alloc_pages_mpol+0x232/0x4a0 [ 1173.205701][T25409] ___kmalloc_large_node+0x5f/0x1b0 [ 1173.211920][T25409] __kmalloc_large_node_noprof+0x18/0x90 [ 1173.218123][T25409] __kmalloc_noprof+0x36f/0x4f0 [ 1173.223274][T25409] ? v9fs_fid_get_acl+0x4f/0x100 [ 1173.228787][T25409] ? __pfx_v9fs_cache_inode_get_cookie+0x10/0x10 [ 1173.236081][T25409] v9fs_fid_get_acl+0x4f/0x100 [ 1173.240985][T25409] v9fs_get_acl+0x9a/0x360 [ 1173.245624][T25409] v9fs_inode_from_fid_dotl+0x221/0x2b0 [ 1173.251645][T25409] v9fs_mount+0x6eb/0xa50 [ 1173.256362][T25409] ? __pfx_v9fs_mount+0x10/0x10 [ 1173.262318][T25409] legacy_get_tree+0xfa/0x1a0 [ 1173.267394][T25409] ? __pfx_v9fs_mount+0x10/0x10 [ 1173.272796][T25409] vfs_get_tree+0x8f/0x2b0 [ 1173.278025][T25409] do_new_mount+0x2a2/0x9e0 [ 1173.282727][T25409] ? ns_capable+0x8a/0xf0 [ 1173.287538][T25409] ? __pfx_do_new_mount+0x10/0x10 [ 1173.292944][T25409] ? path_mount+0x61c/0xfe0 [ 1173.298267][T25409] ? user_path_at+0x44/0x60 [ 1173.303287][T25409] __se_sys_mount+0x317/0x410 [ 1173.308425][T25409] ? __pfx___se_sys_mount+0x10/0x10 [ 1173.313771][T25409] ? rcu_is_watching+0x15/0xb0 [ 1173.319016][T25409] ? do_syscall_64+0xbe/0x3b0 [ 1173.324070][T25409] ? __x64_sys_mount+0x20/0xc0 [ 1173.329454][T25409] do_syscall_64+0xfa/0x3b0 [ 1173.334366][T25409] ? lockdep_hardirqs_on+0x9c/0x150 [ 1173.340879][T25409] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1173.347760][T25409] ? clear_bhb_loop+0x60/0xb0 [ 1173.352653][T25409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1173.358671][T25409] RIP: 0033:0x7f06f0b8eb69 [ 1173.363400][T25409] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1173.384425][T25409] RSP: 002b:00007f06f1982038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1173.393128][T25409] RAX: ffffffffffffffda RBX: 00007f06f0db5fa0 RCX: 00007f06f0b8eb69 [ 1173.401371][T25409] RDX: 0000200000000b80 RSI: 00002000000003c0 RDI: 0000000000000000 [ 1173.409888][T25409] RBP: 00007f06f0c11df1 R08: 0000200000000500 R09: 0000000000000000 [ 1173.418102][T25409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1173.426611][T25409] R13: 0000000000000000 R14: 00007f06f0db5fa0 R15: 00007ffd448ba6d8 [ 1173.435451][T25409] [ 1173.439416][T25409] Kernel Offset: disabled [ 1173.444243][T25409] Rebooting in 86400 seconds..