last executing test programs: 10.671188715s ago: executing program 0 (id=1255): write$FUSE_NOTIFY_INVAL_ENTRY(0xffffffffffffffff, 0x0, 0x42) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x4000}, 0x10) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) setsockopt$ARPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x1058, [{0x11}, {0x0, 0x100000000000000}]}, 0x68) recvfrom(r2, &(0x7f0000000140)=""/104, 0x68, 0x12020, 0x0, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r3, 0x10f, 0x86) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r4, 0x0, 0x10, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000000200)}, 0x840) 9.284419962s ago: executing program 0 (id=1256): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x2) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000080)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000300)=[0x0], &(0x7f0000000140), 0x1, r2}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b405000000400004611018000000000066050000020000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000280)={0x401, 0x1, &(0x7f0000000440)=[r2], &(0x7f0000000600)=[0x2], &(0x7f0000000040)=[r3, r3], &(0x7f0000000580)}) 8.666166092s ago: executing program 0 (id=1260): r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010", @ANYRES8=0x0, @ANYBLOB="fe88"], 0x48}}, 0x0) pipe(&(0x7f0000000580)) (async) pipe(&(0x7f0000000580)={0xffffffffffffffff}) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) splice(r1, 0x0, r2, 0x0, 0x7fff, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) socket$inet_sctp(0x2, 0x1, 0x84) (async) r6 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0500e900000000000000060000813a000008000300", @ANYRES32=r5, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000200)) (async) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000240)={'vcan0\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000240)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000003c0)=0x14) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000003c0)=0x14) r10 = socket(0x2a, 0x2, 0x0) getsockname$packet(r10, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=@newtfilter={0x58, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0xfffa, 0x7}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x28, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_TTL={0x5, 0x4b, 0xb}, @TCA_FLOWER_KEY_CT_LABELS_MASK={0x14, 0x62, "32d64da4d022fb407fa19ac76c30330d"}]}}]}, 0x58}}, 0x24004000) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=@newtfilter={0x58, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0xfffa, 0x7}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x28, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_TTL={0x5, 0x4b, 0xb}, @TCA_FLOWER_KEY_CT_LABELS_MASK={0x14, 0x62, "32d64da4d022fb407fa19ac76c30330d"}]}}]}, 0x58}}, 0x24004000) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000500)={'team0\x00', 0x0}) r13 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001940)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r12, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004c000}, 0x10) socket$nl_route(0x10, 0x3, 0x0) (async) r14 = socket$nl_route(0x10, 0x3, 0x0) r15 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000440)={'hsr0\x00', 0x0}) sendmsg$nl_route(r14, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="9c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000080000006c00128009000100766c616e000000005c0002800400038006000100000000004c0004800c00010248f90adcaff898f10c00010003000000018000000c000100220b0000010000000c00010004000000010000000c00010000000000040000000c000100800000000000000008000500", @ANYRES32=r16], 0x9c}, 0x1, 0xba01}, 0x810) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000000b00)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000b40)=ANY=[@ANYBLOB="0806000000c3baef5f92219b7501b6e12ea7b50bed0d0105e9b01f14a865d34aea73840b9785883c31be9cc554910af3e792c299a22c9199e1f7c9a8fe918c12b6f1ed080a480ea0f2bab4085c972abddd4674186ada0730ae4ef7f009fa517b72fb1869d52aee7e728051fd9c172a69b0f8cd7e7be3d454e09e97f2e98e6ca5e54ef357ff167f83449d13e13c1cd6dc64a36852473102b4cec4c3ab5441b2a89d3c4f6b681e87a46b47eb277e832dd09c5af239", @ANYRES16=0x0, @ANYBLOB="000428bd7000fedbdf250300000008000100", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="4c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000019000400686173685f746f5f706f72745f6d617070696e67000000", @ANYRES32=r7, @ANYBLOB="180202803c000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000b00040072616e646f6d000038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400060000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r8, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004000600000040000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000e00040062726f61646361737400000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b0000000800040009000000080007000000000038000100240001006d636173745f72656a6f696e5f636f756e74000000000000000000000000000005000300030000000800040045a1000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000700000008000100", @ANYRES32, @ANYBLOB="ec0002803800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r9, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000050003000300000008000400aa23000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000300000040000100240001006d6f646500"/135, @ANYRES32=r11, @ANYBLOB="7c00028040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b00000008000400f1ffffff08000600", @ANYRES32=r12, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400ff07000008000100", @ANYRES32=r16, @ANYBLOB="7001028038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000500030003000000080004000180000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32, @ANYBLOB="080007000000000040000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000f000400726f756e64726f62696e000038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000500030003000000080004000080000038000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000050003000300000008000400f4ffffff44000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000110004006163746976656261636b757000000000"], 0x608}, 0x1, 0x0, 0x0, 0x60000005}, 0x4) r17 = getuid() setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000280)={{{@in=@local, @in=@dev={0xac, 0x14, 0x14, 0xa}, 0x4e23, 0x0, 0x4e23, 0x1ff, 0x2, 0x80, 0x80, 0x0, r7, r17}, {0xffffffffffffa104, 0x8, 0xfffffffffffff000, 0xb50, 0x5, 0x2, 0x7, 0x3}, {0xff, 0x5, 0x1000, 0x7}, 0x4, 0x6e6bba, 0x3, 0x1, 0x2, 0x3}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x4d5, 0x352b615625f0cdf1}, 0xa, @in6=@mcast2, 0x0, 0x1, 0x0, 0x9, 0x62d5, 0x4, 0x5}}, 0xe8) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) syz_usb_connect$uac1(0x5, 0x84, &(0x7f00000014c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x72, 0x3, 0x1, 0x1, 0x70, 0x4, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x1, 0x1}, [@mixer_unit={0xa, 0x24, 0x4, 0x2, 0x6, "df1657d9c2"}, @feature_unit={0x9, 0x24, 0x6, 0x3, 0x4, 0x1, [0x7], 0x4}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x1, 0x5, 0x4, {0x7, 0x25, 0x1, 0x0, 0x0, 0xfff0}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x63, 0x10, 0xba, {0x7, 0x25, 0x1, 0x0, 0x7, 0x9}}}}}}}]}}, &(0x7f0000001880)={0x0, 0x0, 0x0, 0x0}) 7.173769948s ago: executing program 4 (id=1263): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x2, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000040)={0xe, 0x1, 0x2, "093d4a3b5b7bc69a21cfb7f5eaac46dbe89b13471a0488a6679f9a2102249341", 0x50313459}) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xb29}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_SELECT={0x5, 0x16, 0x2}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 7.021122486s ago: executing program 2 (id=1265): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0x1, 0x1) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000001c0)={0x0, r1}) close(0x3) ioctl$sock_proto_private(0xffffffffffffffff, 0x89e2, &(0x7f0000000140)="3a599d8b0487c1fbae33c9afc8e2e9e05af0a94c6762d4d0f61f7ae257419b52a13528") r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x749}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="600000000206050000000000000000000000000005000100070000000900020073797a00686173683a69702c706f72742c69700005000500020000000500de34abe1925f00"/96], 0x60}}, 0x8000) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) madvise(&(0x7f00008d7000/0x1000)=nil, 0x1000, 0x4) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000040)=@req3={0x7ff, 0xd, 0x1ff, 0xe, 0x1, 0x800, 0x9}, 0x1c) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x42032, 0xffffffffffffffff, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = dup(r5) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, &(0x7f0000000300)="f36dc744240015000000c34424020e000000c7442406000000000f0114240f01dfb9b8020000b8494d0000ba000000000f30c4c37d044a08040fff090f8e43d399ad66baf80cb802028e8cef66bafc0c66b8010066efc4c1e956c80fc77cc187", 0x60}], 0x1, 0x51, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f00000002c0)=[@text32={0x20, 0x0, 0xfffffffffffffd69}], 0x1, 0x6fcef00345e8684, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r7, 0x4008ae90, &(0x7f0000000200)={0x1, 0x0, [{0x80000007, 0x800, 0x0, 0x53, 0x1, 0xffff, 0x5}]}) ioctl$KVM_RUN(r7, 0xae80, 0x0) readv(r2, &(0x7f0000000240)=[{&(0x7f0000000000)=""/60, 0x3c}], 0x1) 6.919813633s ago: executing program 4 (id=1266): r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000002c0)={0x18, &(0x7f0000000300)={0x0, 0xe}, 0x0, 0x0, 0x0, 0x0}) (async) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0xec25, 0x0, 0x0, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x6007, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r1, 0x47ba, 0x0, 0x0, 0x0, 0x0) (async) close(0xffffffffffffffff) (async, rerun: 32) r4 = syz_open_dev$dri(&(0x7f0000000f00), 0x1, 0x0) (rerun: 32) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r4, 0xc02064b9, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0xeeeeeeee}) (async, rerun: 32) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x10, 0x0, 0x7fff7ffc}]}) (rerun: 32) close_range(r5, 0xffffffffffffffff, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, &(0x7f0000000080)={0x20, 0xd, 0x67, {0x67, 0x38, "659b8e52bef6d7516d93ebd67c4e9dab7b55ba2c407b4253ed5e856188620e6506187cea6eceadc2ece1cce0bc04ffdc2925727427be08f113af491e5f87a06641124b52a8e424b2444f01fde2f4dd603ba4d7e79d5755cbd6e7b02ce896a496b1ab6b3cd3"}}, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000380)={0x1c, &(0x7f0000000240)={0x40, 0x6, 0x14, "4c88c79bef64c722ae9bc0675053118e9e515e42"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x5}}) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) (async, rerun: 64) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) (rerun: 64) 6.919213919s ago: executing program 1 (id=1267): write$FUSE_NOTIFY_INVAL_ENTRY(0xffffffffffffffff, 0x0, 0x42) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x4000}, 0x10) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) setsockopt$ARPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x1058, [{0x11}, {0x0, 0x100000000000000}]}, 0x68) recvfrom(r2, &(0x7f0000000140)=""/104, 0x68, 0x12020, 0x0, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r3, 0x10f, 0x86) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x3c}}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r4, 0x0, 0x10, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000000200)}, 0x840) 5.963485603s ago: executing program 2 (id=1268): syz_usb_connect$uac1(0x7, 0x71, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001000000406b1d010140000102030109025f0003010380f4090400726638405af79751180000010100000a24010f000302010209"], 0x0) (async) r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902"], 0x0) syz_usb_connect$uac1(0x0, 0xb1, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106b1d010140010102030109029f0003010000000904000000010100000a24010000000201020d24060000030800000031ce21c798329740594c137d0000000c24020201010608000010000c24020000000300000000000924060006010000000924030000000005000924060500"], 0x0) (async) syz_usb_disconnect(r0) (async) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000001000)=ANY=[], 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000001c0)=0x20000008) (async) syz_usb_control_io(r0, &(0x7f0000001380)={0x2c, 0x0, &(0x7f0000001180)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000007c0)={0x14, 0x0, &(0x7f0000000780)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) (async) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000440)={0x20, 0x8, 0x1, "d7"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000340)={0x0, 0x11, 0x1, "f5"}, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.954442822s ago: executing program 4 (id=1269): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000340)="54368cc990bcf64cf44814565fefa540846d224e81aabfd95899d9dff248a6e37f264112e90857594eaafa279d02cd2ee673b172e54ce5104b3e14df43a14ab70cea42ffbf3930ae40842d3342f4d622c95d5d7bdc469d89fe0838a70fa8bac84c9f810c6e9c9c030e8ba6e5973a7772a6e693c4c85327afb590975ba8195ac1e9d1ffb8ab7dbed04bfef1fd0430a12b35d03b1e7d49e0efc930360c74a05227282fa504df0ae4f253234d688946169435c2404d8def7c16349ed0daa7010f563850dba2885bc346fd3690fda470453e1946629cd5060f664f445bcf52bbf2834b", 0xe1, 0x20048915, 0x0, 0x0) r2 = syz_io_uring_setup(0x4af0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0}, &(0x7f0000002000), &(0x7f0000ffd000)) io_uring_register$IORING_UNREGISTER_EVENTFD(r2, 0x5, 0x2000000, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) syz_open_dev$vbi(&(0x7f0000000000), 0x2, 0x2) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r3 = syz_io_uring_setup(0x231, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0x0, 0x0, 0x0, r2}, &(0x7f0000000000)=0x0, &(0x7f0000000640)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffff86}) r6 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_ALLOW_SUSPEND(r6, 0x5522) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_uring_enter(r3, 0x7a98, 0x0, 0x0, 0x0, 0x0) r7 = syz_open_dev$media(&(0x7f00000006c0), 0x4007, 0x0) r8 = socket$inet(0x2, 0x2, 0x73) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f00000000c0)={'veth0_macvtap\x00', &(0x7f00000001c0)=@ethtool_gstrings={0x1b, 0x1, 0x5f, "8dc42774bf9178c36a1a03221971383bf0079c0f246f52ea7f858abba35892ed4b36ae97d623b6749bd609f57bc5ad6a3f5823f26f3c4a3b3d1cd45f1c51aa684894baec33062fd66df76f4fc783f5bd5c6d7012c859fe9c24be3fadd2efbd"}}) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="05000000020000009b2d", @ANYRES32, @ANYBLOB="0400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0100000004000000000000000000000000000000000000000000000010996c2bc86523eb02007f2a1c5050886f086c4d91bca4eb3a8680657e1495c084056e8633a5b63f9aa08745cd27978618cdfcd780bfba962478c934a9369b7a7b48e657"], 0x48) ioctl$MEDIA_IOC_REQUEST_ALLOC(r7, 0x80047c05, &(0x7f0000000940)) r9 = syz_open_dev$radio(&(0x7f0000000140), 0x3, 0x2) ioctl$VIDIOC_TRY_FMT(r9, 0xc0d05640, &(0x7f0000000540)={0x3, @win={{0x2, 0xf1, 0x31b9, 0x63e1}, 0x5, 0x91d1, &(0x7f0000000480)={{0x9, 0x9, 0x6, 0x6}, &(0x7f0000000440)={{0x8, 0x1, 0x18b, 0x5}, &(0x7f0000000240)={{0x9, 0x100, 0x7, 0x12}}}}, 0x7, &(0x7f00000004c0)="9c1810ad138b8a431ad21e7bc383663c28a9d940764f1c81e75a237b53cbd6d585abcae6e336236af7640960c9805b25cd5d051e3b92410d9c5d57c19ed0f0ee498d1c2e3f5d6c67073b2377224d991b1e85b2ef375fe8c6dfc37b188142c779108cf2ffa168b5bdb8db41490c", 0x12}}) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x17, 0x0, 0x0) syz_open_dev$vim2m(0x0, 0x7, 0x2) membarrier(0x10, 0x0) 5.488921384s ago: executing program 0 (id=1271): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000055c0)={'erspan0\x00', 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_io_uring_setup(0x62ce, &(0x7f0000000780)={0x0, 0x0, 0x10100, 0x0, 0x2a6, 0x0, r3}, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) setsockopt$inet6_int(r4, 0x29, 0x33, &(0x7f0000000040)=0x7, 0x4) bind$inet6(r4, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r4, &(0x7f0000000600)=[{{&(0x7f0000000140)=@nfc_llcp, 0x0, &(0x7f0000000780)=[{&(0x7f0000000340)=""/180}, {&(0x7f0000000280)=""/122}, {&(0x7f0000000400)=""/165}, {&(0x7f00000004c0)=""/142}, {&(0x7f0000000640)=""/70}, {&(0x7f00000006c0)=""/179}], 0x0, &(0x7f0000000580)=""/70, 0x11}}], 0x40000000000029d, 0x2, 0x0) setsockopt$inet6_int(r4, 0x29, 0x42, &(0x7f0000000100)=0x2, 0x4) r7 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r7, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 5.123719471s ago: executing program 0 (id=1273): connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000480), 0x4) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x0) io_setup(0x1, &(0x7f0000000b80)=0x0) io_submit(r4, 0x1, &(0x7f0000001d00)=[0x0]) timer_settime(0x0, 0x1, 0x0, 0x0) r5 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x84c0, 0x0, 0xffffffff, 0x121}, &(0x7f0000000100)=0x0, &(0x7f00000003c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r3, 0xc018937c, &(0x7f0000000200)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) syz_io_uring_setup(0x42b1, &(0x7f0000000240)={0x0, 0x4ad1, 0x2, 0x3, 0x2a8, 0x0, r8}, &(0x7f0000000300)=0x0, &(0x7f0000000340)) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f00000004c0)={&(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9}) syz_io_uring_submit(r10, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x5a, 0x0, @fd_index=0x9, 0x0, 0x0, 0x0, {0x60cb}, 0x0, {0x0, r9}}) io_uring_enter(r5, 0x47f6, 0x0, 0x0, 0x0, 0x0) r11 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r11, 0x1, r2, &(0x7f0000000180)={0x1}) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x25b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x24, 0x10, 0x4, [{{0x9, 0x4, 0x0, 0xf, 0x5, 0x3, 0x0, 0x2, 0x95, {0x9, 0x21, 0xfffc, 0x0, 0x1, {0x22, 0x16f}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x1, 0x0, 0xd}}}}}]}}]}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0x3}]}, 0x3c}}, 0x0) write$tcp_mem(r1, &(0x7f0000000040)={0x9, 0x20, 0x0, 0x20, 0x6}, 0x48) ptrace(0x10, r0) r12 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r13 = dup(r12) mmap(&(0x7f00009ac000/0x4000)=nil, 0x4000, 0x1000006, 0x28011, r13, 0x0) write(r12, &(0x7f0000000540)="b5", 0x1) fadvise64(r13, 0x18, 0x3, 0x4) syz_clone(0x24008a00, &(0x7f00000000c0)="0eee4490ca9cf1869162841fe68febbed010d51e5fc85f6aa78c56f6a963cab4cd1312ffc18b55f5e22dcf1b40bb7c4eaa3154284543ab08104c5f7ebbcb4e7d682f378d064557eef8dba0d9", 0x4c, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="94f0bb4faeba6555b3d1f21fbabe556de13301ce06a6ac4b530aed8797cef091e1") ptrace$peeksig(0x4212, r0, &(0x7f0000000440)={0x5}, &(0x7f0000000480)) 4.783596349s ago: executing program 3 (id=1274): syz_clone(0x8000100, 0x0, 0x0, &(0x7f00000010c0), 0x0, &(0x7f0000001140)="8c7d6ce015a250438cbc1d52041b77f25ad358917121e78fd98d") r0 = syz_io_uring_setup(0x239, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0x0, 0xa0}, &(0x7f0000000300)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_SYMLINKAT={0x26, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)='./file0\x00'}) io_uring_enter(r0, 0x2def, 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$loop(&(0x7f00000003c0), 0x436a, 0x163302) sendfile(r3, r3, 0x0, 0x24002de8) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000300), 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="7c00000000000000000000000700000044140001ac1414aa00000000ac1414000000000000441c0003e0000001000000007f000001000000000000000000000000442c000000000000000000000000000000000000000000000000000000000000000000000000000000000000440c0001000000000000000000000000000000a400000000000000000000000700000044280000000000000000000000000000000000000000000000000000000000000000000000000000071700e0000002ac1414bb00000000e0000002ac1414bb018616000000000010c986d78e6c4b9394b247217b87cb00830b00000000007f000001861f0000000000020010421487f84baabcbcfb42a4d90bab000748c68c4c31001089ca45d9612e5b5c11f12bc78a41000000000000006c000000000000000000000007000000441c0003ffffffff000000000000000000000000e00000010000000044340001ac1414bb0000000000000000000000000000000000000000ac1414aa00000000ac1414aa00000000ac1e000100000000830b007f000001e000000200000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="ac1414aa00000000000000001400000000000000000000000200000000000000000000001c000000000000000000000008000000", @ANYRES64=r3, @ANYBLOB="7f0000017f000001000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="7f000001ac141400000000001c00000000000000000000004700000044aa00210a2101"], 0x230}, 0x0) socket$kcm(0x10, 0x3, 0x10) ioctl$SNDRV_TIMER_IOCTL_TRIGGER(0xffffffffffffffff, 0x54a6) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$vim2m_VIDIOC_TRY_FMT(0xffffffffffffffff, 0xc0d05640, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sendmsg(r4, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x400d1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) faccessat(0xffffffffffffffff, 0x0, 0x0) munlockall() munlockall() madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f0000000480)={0x60, 0x0, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x7, &(0x7f0000000040), 0x0, 0x1, 0x0, 0x2, 0x0, 0x2}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000740)="28e152e51b1afc18096e90f8e1fcb1ca2dc420755c272a5990b7326e33084247a59e35d2c4a5819583a639b376d79d2a01b0789c987debeed6ac6933c50938ab1128ec6ee939898b0a3aa1a5db889997a9eee2ee815d31e472060d0d127258c00890aff138cd55073a3880ab55ae6834705dbfdf2cda342e57cfa9a92ad7c309d1050518b440e706598759c86a8288252138c8ed0540ab4a5c4730e0aaf613d32286d178e68286492bccc69606abd21b057fb96a998e658bf6af7c9390cca90bee2a136815ac8283211f4f0102b7230048fb0f6df2d5d3400aa2975ce15126", 0xdf}], 0x1}, 0x2404089c) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB]) 4.48058018s ago: executing program 1 (id=1275): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) bind$can_raw(r0, &(0x7f00000000c0), 0x10) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={0x0, 0x0, 0x800, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, &(0x7f0000000000)={0x0, 0xa, 0x80800}) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000100)=[{{0x1, 0x1}, {0x0, 0x0, 0x0, 0x1}}, {{0x0, 0x1, 0x1}, {0x0, 0x0, 0x1, 0x1}}, {{0x1, 0x1}, {0x3, 0x1}}, {{0x1}}, {{0x1, 0x1, 0x1}, {0x3, 0x1, 0x1}}, {{0x4, 0x0, 0x1}, {0x4, 0x1}}], 0x30) 4.267748351s ago: executing program 1 (id=1276): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030010000000000000010000010900010073797a310000000054000000030a01800000000000000000010000000900030073797a31000000000900010073797a3100000000280004800800014000000005080002401b2fd2c5140003006970366772653000000000000000000028000000000a05000000000000000000010000080900010073797a310000000008000240000001"], 0xc4}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r3, &(0x7f0000001d80)='.\x00', 0x8000, &(0x7f0000001dc0)={0x1, 0x70, 0x20000}, 0x20) sendmmsg$inet(r1, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000006c0)="0d18687da3e7f33aed145cf8ff2d1e5a18c0d5f9856f4824f41040f6987d0b531da10713ed151bc4867681f28e033aef683334d03864ed30590dd4ea64a20ecbbc1346c9f42510d91eec0632885b7da95ca85f4b1435c5c1e993a85257df5f19bdfc5e038a16e6a8aef907e347081fdb93cee93217e11f19cde423e6138bd1b79ee615527ccaf8049959ac6e32af46d777ccb8c26ca925f69590df13a81aee3213e80ba5cacf1f930b3cc49093d11594ef13325790b55efbdc2dd99ed1", 0xbd}, {&(0x7f00000002c0)="9c812b37fa6bd3963cbc009f0a922658be630ec6041ed353d314e58721edf306c382ac611fe34479cb9e2585745ff3c61da74b060400000000000000178176dc533f123b66d04d51fb7421cdc9fed78e3e1c18fb67c1f75e", 0x58}, {&(0x7f0000000180)="3f82090ccda4f8ce11f43ea8b51b08afd200c6075794cdd2e0021e30a0f6267447162a2085457cf687e74d142e85e9c4ac6e", 0x32}], 0x3}}, {{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000c40)="5c5eafd3ae55a73702d6befaee97f47f4be65587e1fca708cee084691e4587d887a5eaab43ac5edc4886496910cd7a153cd84b93208c7b1a625b3ea990092389b19dab4f61e30ee60a4d7e51ffc9a5accbe20844356dd0ce192542d5e58d80657b3b5fb7a3d393", 0x67}, {&(0x7f0000000800)="104b0b7073fbd7f77a847bdbfdf6da474f700bf113b18d16d8380f42e296b49f1326c7d0d97be798e205654b8a885df6ee57ec7b690491c55ca484b54170549c7a72b8a579005ffcb0b309dae34571b17126534a763ca881f12d750072abc05a7cb8f0e32fc3ec3ed14c3322630ae8e710fb68299cbb5accee8813185c77248ddec7b5688599f1bfccbec448bc6ce5c139c2095da22c9d7edf7bfa1392c76ab0dddf4db130420df295ea16aa3e841d50dc813025315eea3990c2de68e835c4fec57e2dd70f47b58472c2f915de1a58a32d021d9a26", 0xd5}, {&(0x7f0000000900)="5c3eb8799e8565193cf737e01055d298a4193e91d6dd89384d12d1da97e7e88852e279071ca7a9b536c7911d618feb48b66f1e17e130b7c2f27b77e2053065d05a00ae7bd353283ee3dcaf244ff26600e520af5091696d833f34518e53327718e7e3298de86f15e6a778f6008b96661a10be65c0a44b21b4c8724f61f6ca10d927a31e0c9f", 0x85}, {&(0x7f0000000500)="4c56c5661eb2897219a486044736a64f1a175ba083d2b3ef32bff4a0", 0x1c}, {&(0x7f00000009c0)="8e6487afea5aec79e9dd3278cbb24985e6724be49d1ae08bb9913a5a6d6d6c26d88eb3edece901ad9bfd123a88c27d6e6ea618a42a970bcac49fc3bf5b87b58ba3d1a7dc24d12855a6c54a36b5089658d9482bd0a9a1b9b0d4de13e864e592216f04f31decfaa9", 0x67}, {&(0x7f0000000a40)="71918a5d581601244a3d864d7c74a12529e10637660163c939c6e23c3e3bc3bcfc79d3e47b9d80fc8fc812a2ae2adf778cf426ff4d090e8ad2d1144acb5a392c984f3190aafff8b0f1c5852274bab67df6ce8641ebef383c1503c3c19e1e8b133206cc193d38b8ebf8f76678b320950e8741221069da77cd76e5ff56fce3f0eee2b1922024929b3128ed46411f05a167211c3adf5dea2ab84c4e8c7a20cd114dcc56307f6e4e44cc4d82bcc8", 0xac}, {&(0x7f0000000340)="2876a27ebfc4f1fc0466f3a791274633de5b2c6716219bebc16803453419b80818d51c9d56c0039d1bc7a796e12dd80936102f29a4819c4d4c6fda582cd913925b1395531530b9fcaa87e3f5857e30144116e71830e00e418240c814ccb9f590aac1787ef9d04b6db912a9bcb35ead768afd5615ab9a7c4d8cd358d10267955165545fe1bdf5e19eab823184d284613c95eb766da572a15dc327123d406dbf512c2f68b2d0a115f2", 0xa8}], 0x7}}], 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r1, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x11) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug', 0x0, 0x0) fcntl$notify(r4, 0x402, 0x8) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c1200002d00010026bd7000fcdbdf25040000000c0016800800bf00ffffff7f0c129b808233725f6a2e"], 0x122c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) 4.236501009s ago: executing program 4 (id=1277): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000500)=ANY=[@ANYRES32=r0, @ANYRESOCT=0x0, @ANYRESOCT=r2, @ANYRESOCT, @ANYRESOCT=r2]) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket(0x400000000010, 0x3, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x20000800}, 0x8d0) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) r4 = syz_io_uring_setup(0x10d3, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x3, 0x34f, 0x0, r3}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_SEND={0x1a, 0x42, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000280)="fff960beb234ed39df4a6c6995daf097d8ce10d3879ed7bebeecc8892f070355f48e9c6089e0e491e05fa9bc2215d83e5f6654f1a6f98d8ad458e7df367fe9ec75d3e10056784590594739d750bfc40ab152955f696996dd04499b49eae83dbc661006d907ac560e4852e71440bdb16aa4dbc6b20b7170a8e9b9508b8f062be0c98a353b8a4263c981cc5af4e738506b4d6c9a78cf6ec1cfa97164e64ce0bdbdf2f98567a49882635c71a1955bac5d4568694f234638c9bd5d438c07607c55d1d734f0252e9fd0020bced1970330476c11e58d5d5b7b85a7d7ffaddf5ec381", 0xdf, 0x4000, 0x1}) io_uring_enter(r4, 0x47bc, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @ioapic={0x100000, 0xfffffffb, 0xfff, 0x49, 0x0, [{0x8, 0x6, 0x8e, '\x00', 0x6}, {0x0, 0xa, 0x5, '\x00', 0x4}, {0x1, 0x7, 0x1, '\x00', 0x2}, {0xc7, 0x3, 0x5}, {0x0, 0x5, 0x13}, {0x8, 0x49, 0x7f, '\x00', 0x10}, {0xf6, 0xfe, 0x8, '\x00', 0x38}, {0x6, 0xfe, 0x4, '\x00', 0x5}, {0x3, 0x4, 0xa}, {0x60, 0x4, 0x6, '\x00', 0x5}, {0x5, 0x8, 0x8}, {0x5, 0xb7, 0x7, '\x00', 0x74}, {0x6, 0xf, 0x0, '\x00', 0xd5}, {0x9, 0x80, 0x7f, '\x00', 0x5}, {0x5c, 0x1f, 0x9, '\x00', 0x7f}, {0x8, 0x40, 0x7}, {0x7f, 0xc, 0xf3, '\x00', 0xfe}, {0x0, 0x1, 0x3, '\x00', 0xff}, {0xb3, 0x6, 0x7f, '\x00', 0x4}, {0x1, 0x9, 0x6, '\x00', 0xd}, {0x1, 0x2, 0x1, '\x00', 0x4}, {0x7, 0x4f, 0xf9, '\x00', 0x40}, {0x4, 0x8, 0xe0, '\x00', 0x40}, {0x54, 0x6, 0x98, '\x00', 0xf}]}}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) socket$inet_tcp(0x2, 0x1, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) move_pages(0x0, 0x1, &(0x7f0000000040)=[&(0x7f0000ffc000/0x1000)=nil], &(0x7f0000002640), &(0x7f0000000000), 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4040aea0, &(0x7f0000000100)=@arm64={0x8, 0x36, 0x7, '\x00', 0x7}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xc, 0x0, 0x180, 0x7, 0x2a9, 0xf1, 0x0, 0x8000000000000, 0x5, 0x26a, 0x8, 0x0, 0x0, 0x0, 0xbd9], 0x1, 0x3c4210}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.880611042s ago: executing program 2 (id=1278): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000080)={0x0, 0x5b, &(0x7f0000000140)={&(0x7f0000000040)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x14d, 0x4000}]}, 0x24}, 0x1, 0x0, 0x0, 0x90}, 0x20004004) 3.72365567s ago: executing program 1 (id=1279): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="1808"], 0x0, 0x4}, 0x94) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f00000003c0)="a72d11a15c048c0a7d63aebc5cea1f815108f6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa4", 0x3f}], 0x1}, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f0000001ff0)={0x1d, r2}, 0x10) sendmsg$can_raw(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000ff0)={&(0x7f0000000580)=@canfd={{0x1}, 0xf6, 0x0, 0x0, 0x0, "0327e1b22b5fcef7739c699f5ff986ca08990039576a7d5cb2bdac3fa80acf584ecb5fee496e6866856b76b5ee00000000000000004e2f9663a918fa1efd9b0b"}, 0x48}, 0xee, 0x0, 0x0, 0x40041}, 0x0) r3 = fsopen(&(0x7f00000000c0)='ntfs3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000240)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00222200000096231306e53f070c0000002a9000070100f3ff83000058007a159385e582"], 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000040)={'ip6_vti0\x00', &(0x7f0000000280)={'ip6tnl0\x00', r2, 0x4, 0x3, 0x54, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @multicast1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x700, 0x80, 0x973}}) socket$inet6(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = fcntl$getown(r5, 0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) chdir(&(0x7f0000000480)='./cgroup\x00') mkdir(&(0x7f0000000000)='./control\x00', 0x0) open(&(0x7f0000022ff6)='./control\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x73, 0x86, 0x40, 0x20, 0xc72, 0x14, 0x39ac, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0xa, [{{0x9, 0x4, 0x1d, 0xf3, 0x0, 0x71, 0x6c, 0x75}}]}}]}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYRESDEC=r3], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}}, 0x0) 3.559086767s ago: executing program 2 (id=1280): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r4 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, r4, 0xfffffffffffffffd, 0xfffffffffffffffe, 0x1) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r5 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000001040)={0x38, 0x3, 0x8, 0x5, 0x0, 0x0, {0x5, 0x0, 0x2000}, [@CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @sctp=[@CTA_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT={0x8, 0x7, 0x1, 0x0, 0xe}, @CTA_TIMEOUT_SCTP_HEARTBEAT_SENT={0x8, 0x8, 0x1, 0x0, 0xf93}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x5278}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x40850) write$binfmt_register(r5, &(0x7f0000000140)={0x3a, 'syz2', 0x3a, 'M', 0x3a, 0x4, 0x3a, ']$', 0x3a, 'syz', 0x3a, './file0', 0x3a, [0x43, 0x4f, 0x50, 0x46, 0x50, 0x43, 0x43]}, 0x33) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='net/igmp\x00') read$FUSE(r7, &(0x7f00000001c0)={0x2020}, 0x2020) getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c0000001000370410000000ffdbdf2500000000", @ANYRES32=r8, @ANYBLOB="83550500010000001c0012800b00010067656e65766500000c00028005000c0001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x8000) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x80) socket$inet_smc(0x2b, 0x1, 0x0) 3.302871713s ago: executing program 4 (id=1281): r0 = request_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)=']}*$}*&\x00', 0xfffffffffffffffc) r1 = add_key(&(0x7f00000000c0)='dns_resolver\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)="3f0c0705908137ec", 0x8, 0xfffffffffffffffa) r2 = add_key$keyring(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0x0) keyctl$KEYCTL_MOVE(0x1e, r0, r1, r2, 0x1) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x480000, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000280)={'macvlan1\x00', @remote}) r5 = socket$alg(0x26, 0x5, 0x0) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000300)={0x5, &(0x7f00000002c0)=[{0x0, 0x4a, 0x9, 0x420}, {0x1000, 0xb6, 0x8, 0x8}, {0x8, 0xa, 0x3, 0x1}, {0x5, 0x8, 0x6c, 0x7}, {0x1, 0xe0, 0x5, 0x4}]}, 0x10) ioctl$VHOST_VDPA_GET_AS_NUM(r3, 0x8004af7a, &(0x7f0000000340)) ioctl$VHOST_GET_VRING_ENDIAN(r3, 0x4008af14, &(0x7f0000000380)={0x3, 0x3}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000003c0)={0x0, @rand_addr, @initdev}, &(0x7f0000000400)=0xc) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000440)={0x1d, r6}, 0x10, &(0x7f0000000500)={&(0x7f0000000480)={0x4, 0x289, 0x7, {0x77359400}, {0x0, 0xea60}, {0x1, 0x0, 0x1, 0x1}, 0x1, @can={{0x0, 0x0, 0x1, 0x1}, 0x1, 0x1, 0x0, 0x0, "844cfd7572fe64fc"}}, 0x48}, 0x1, 0x0, 0x0, 0x400c055}, 0x40) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$TIPC_NL_NAME_TABLE_GET(r3, &(0x7f00000007c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000780)={&(0x7f0000000600)={0x168, r7, 0x20, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0x10, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_LINK={0x144, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd6}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xad3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x600}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x29}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x40}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x50}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}]}]}, 0x168}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) r8 = socket(0x22, 0x6, 0x7fffffff) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000880)={0x1, 0x0, [{0x6000, 0x76, &(0x7f0000000800)=""/118}]}) unshare(0x400) keyctl$search(0xa, 0x0, &(0x7f00000008c0)='id_resolver\x00', &(0x7f0000000900)={'syz', 0x3}, r2) socket$kcm(0x29, 0x0, 0x0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000940)={0x1}) r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000c80)={&(0x7f0000000ac0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x78, 0x78, 0x3, [@typedef={0xb, 0x0, 0x0, 0x8, 0x1}, @type_tag={0x5, 0x0, 0x0, 0x12, 0x2}, @enum64={0xa, 0x6, 0x0, 0x13, 0x0, 0x0, [{0x7, 0x8, 0x1db}, {0xf, 0x2, 0x2}, {0xb, 0x3, 0x5}, {0x4, 0x4, 0xf77e}, {0x8, 0x82, 0x400}, {0x2, 0x10000, 0xf8000000}]}, @type_tag={0x6, 0x0, 0x0, 0x12, 0x3}]}, {0x0, [0x5f]}}, &(0x7f0000000b80)=""/239, 0x93, 0xef, 0x1, 0x2, 0x10000}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d40)={0x11, 0x5, &(0x7f0000000980)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x65}, [@jmp={0x5, 0x0, 0x4, 0xa, 0x1, 0xfffffffffffffffe, 0x4}, @exit]}, &(0x7f00000009c0)='syzkaller\x00', 0xfff, 0x93, &(0x7f0000000a00)=""/147, 0x40f00, 0x22, '\x00', r6, 0x0, r9, 0x8, &(0x7f0000000cc0)={0x8, 0x1}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000d00)=[{0x0, 0x3, 0x1, 0x2}, {0x2, 0x4, 0x4, 0x7}, {0x1, 0x2, 0x2, 0x8}]}, 0x94) bind$can_raw(r8, &(0x7f0000000e00)={0x1d, r6}, 0x10) r10 = request_key(&(0x7f0000000e40)='blacklist\x00', &(0x7f0000000e80)={'syz', 0x0}, &(0x7f0000000ec0)='\xaa\xaa\xaa\xaa\xaa', r2) keyctl$reject(0x13, r10, 0x4, 0xa6, r2) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000f00)={0x2, 0x4}, 0x4) r11 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x2) syz_open_dev$vim2m(&(0x7f0000000f40), 0x48, 0x2) 2.891701788s ago: executing program 4 (id=1282): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) socket$unix(0x1, 0x1, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_REJECT_TYPE={0x8}, @NFTA_REJECT_ICMP_CODE={0x5}]}}}, {0x20, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_RT_KEY={0x8}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xf8}}, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f00000001c0)={{}, 'syz1\x00'}) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x5) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r6, {0x2, 0x0, @multicast2}, 0x2}}, 0x26) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r9, &(0x7f00000005c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @remote}, 0x2, 0x4, 0x3, 0x3}}, 0x2e) sendmsg$L2TP_CMD_TUNNEL_GET(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r8, 0x325, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) ioctl$UI_DEV_SETUP(r4, 0x5501, 0x0) write$uinput_user_dev(r4, &(0x7f0000000900)={'syz1\x00', {}, 0x37b4, [0xfeff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0xfff, 0x8, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x3, 0x0, 0x20, 0x3, 0x200, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20004], [0x0, 0x0, 0x7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfffffffc, 0x1, 0x8b0, 0x0, 0xfffffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20000000, 0x40000000, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0xfffffffc, 0x0, 0x8c, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x0, 0xfffffffe, 0x8, 0x0, 0x5, 0x0, 0x80, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffc], [0x0, 0x4, 0x0, 0x0, 0xfffffeff, 0x1, 0x0, 0x0, 0x0, 0xb78, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x10000, 0x3, 0x0, 0x520, 0xfffffffc, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0xfffffffc, 0xaf, 0x0, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x110, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000005, 0x0, 0x4, 0x2], [0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x1, 0x1, 0x7fff, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0x1, 0x0, 0x3, 0x4, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x3, 0x3, 0xfffffffd, 0x53591b27, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7, 0x0, 0x0, 0x0, 0x80000000, 0x1000000]}, 0x45c) syz_usb_connect$uac1(0x2, 0xdc, &(0x7f0000000040)=ANY=[@ANYRES16=r4, @ANYRESHEX=r1, @ANYRES64=r0, @ANYRESHEX=r2], 0x0) socket$netlink(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) (async) socket$unix(0x1, 0x1, 0x0) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_REJECT_TYPE={0x8}, @NFTA_REJECT_ICMP_CODE={0x5}]}}}, {0x20, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_RT_KEY={0x8}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xf8}}, 0x0) (async) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) (async) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f00000001c0)={{}, 'syz1\x00'}) (async) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x5) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r6, {0x2, 0x0, @multicast2}, 0x2}}, 0x26) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) connect$pppl2tp(r9, &(0x7f00000005c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @remote}, 0x2, 0x4, 0x3, 0x3}}, 0x2e) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r8, 0x325, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) (async) ioctl$UI_DEV_SETUP(r4, 0x5501, 0x0) (async) write$uinput_user_dev(r4, &(0x7f0000000900)={'syz1\x00', {}, 0x37b4, [0xfeff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0xfff, 0x8, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x3, 0x0, 0x20, 0x3, 0x200, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20004], [0x0, 0x0, 0x7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfffffffc, 0x1, 0x8b0, 0x0, 0xfffffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20000000, 0x40000000, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0xfffffffc, 0x0, 0x8c, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x0, 0xfffffffe, 0x8, 0x0, 0x5, 0x0, 0x80, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffc], [0x0, 0x4, 0x0, 0x0, 0xfffffeff, 0x1, 0x0, 0x0, 0x0, 0xb78, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x10000, 0x3, 0x0, 0x520, 0xfffffffc, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0xfffffffc, 0xaf, 0x0, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x110, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000005, 0x0, 0x4, 0x2], [0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x1, 0x1, 0x7fff, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0x1, 0x0, 0x3, 0x4, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x3, 0x3, 0xfffffffd, 0x53591b27, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7, 0x0, 0x0, 0x0, 0x80000000, 0x1000000]}, 0x45c) (async) syz_usb_connect$uac1(0x2, 0xdc, &(0x7f0000000040)=ANY=[@ANYRES16=r4, @ANYRESHEX=r1, @ANYRES64=r0, @ANYRESHEX=r2], 0x0) (async) 2.886772266s ago: executing program 3 (id=1283): unshare(0x62040200) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='net/rt_cache\x00') lseek(r0, 0x1000000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) pipe(0x0) socket$inet6(0xa, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$SMC_PNETID_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000940)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x8042, 0x0) fallocate(r2, 0x0, 0x5, 0x3) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r3) sendmsg$ETHTOOL_MSG_TSINFO_GET(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002dbd7000fedbdf252c00"], 0x2c}, 0x1, 0x0, 0x0, 0x20048881}, 0x2000c800) r5 = syz_open_dev$usbfs(0x0, 0x76, 0x101a01) ioctl$USBDEVFS_RELEASE_PORT(r5, 0x80045519, &(0x7f00000003c0)=0xc7a) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r6 = socket(0x10, 0x803, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket$unix(0x1, 0x1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r10 = socket(0x400000000010, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0xb, 0xfff3}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x3, 0x3}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xb380, 0x4, 0x0, 0xd87, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x11}, 0x40004) 1.712006752s ago: executing program 0 (id=1284): socket(0x10, 0x3, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0xfffffffffffffffe}, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x7, 0x240) r2 = io_uring_setup(0x1581, &(0x7f0000000380)={0x0, 0x1b6f, 0x40, 0x0, 0x3bd}) r3 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r3, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r4) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x14, r5, 0x3e8c4ddb697c9f8f, 0x2, 0x0, {0x4}}, 0x14}}, 0x2000c090) close_range(r2, r3, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ac1000/0x3000)=nil, 0x3000, 0x2000000, 0x5d031, 0xffffffffffffffff, 0x0) r6 = syz_open_dev$dri(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r6, 0x100000000) socket(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1a, 0x1, 0x8, 0x8}, 0x50) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000140)={@cgroup, 0xffffffffffffffff, 0x2c, 0x2020}, 0x20) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r8, r9, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x10, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) add_key$keyring(&(0x7f0000000340), &(0x7f0000000380), 0x0, 0x0, 0xffffffffffffffff) 1.063805314s ago: executing program 3 (id=1285): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x6) fchdir(r2) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) getdents64(r3, &(0x7f0000000040)=""/53, 0x2457a0be381e3a04) getdents(r3, 0x0, 0x58) removexattr(0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r5, @ANYBLOB="08002600940900000800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r8, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) connect$inet(r7, &(0x7f0000000480)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x13}}, 0xffffffffffffff78) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, &(0x7f0000000040)={0x1, @multicast2, 0x0, 0x0, 'none\x00', 0x15, 0x88, 0xc000068}, 0x2c) setsockopt$inet_tcp_int(r7, 0x6, 0x1b, &(0x7f0000000180)=0x1, 0x4) socket$netlink(0x10, 0x3, 0x8) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c0000000b602b572768e8b6e8af2c6c710fe0390a090642abff9e3bd0b4", @ANYRES16=r10, @ANYBLOB="01002fbd7000fcffffff8900000008000300", @ANYRES32=r11, @ANYBLOB="20001d801c000080060005004a000000050009000100000005000a0001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000008) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) mkdirat(0xffffffffffffff9c, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000003900)=ANY=[], &(0x7f0000000380)='GPL\x00'}, 0x94) 776.99699ms ago: executing program 3 (id=1286): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) bind$can_raw(r0, &(0x7f00000000c0), 0x10) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000000)=[{{0x2, 0x1, 0x0, 0x1}, {0x3}}, {{0x2}, {0x3, 0x1, 0x1}}, {{0x2, 0x0, 0x0, 0x1}, {0x1, 0x0, 0x1}}], 0x18) 623.260404ms ago: executing program 2 (id=1287): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) (async) r0 = socket$key(0xf, 0x3, 0x2) recvmmsg(r0, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) (async) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007bd, &(0x7f0000000140)={0x2, 0x0, @local}, 0x1) (async) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="0208000002"], 0x10}}, 0x0) r2 = syz_io_uring_setup(0x17af, &(0x7f0000000500)={0x0, 0xbc4a, 0x13290, 0x0, 0x1e1}, &(0x7f0000000300)=0x0, &(0x7f0000000340)=0x0) (async) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x202002, 0x0) (async, rerun: 32) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000480)={0xffffffffffffffff, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6, &(0x7f0000000180)=[0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe6, &(0x7f0000000200)=[{}, {}], 0x10, 0x10, &(0x7f0000000240), &(0x7f0000000280), 0x8, 0x1d, 0x8, 0x8, &(0x7f00000002c0)}}, 0x10) (async, rerun: 32) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) (async) r7 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x6, 0x3, 0x1, {0x400000000001, 0x180, 0x20ff, 0x6, 0x8c, 0xd615, 0x9, 0x0, 0xfffffffe, 0x8000, 0x0, 0x0, 0x0, 0x5, 0x1}}, {0x0, 0x13}}}, 0xa0) (async, rerun: 32) write$binfmt_misc(r8, &(0x7f0000000040), 0xe09) (async, rerun: 32) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f00000002c0)={r8, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f00000004c0)={{0x1, 0x1, 0x18, r2, {0x3}}, './file0\x00'}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x7, &(0x7f0000000080)=@raw=[@cb_func={0x18, 0x4, 0x4, 0x0, 0xfffffffffffffffb}, @ldst={0x0, 0x0, 0x1, 0x7, 0x9, 0xfffffffffffffff0, 0x10}, @exit, @map_fd={0x18, 0x5, 0x1, 0x0, r5}, @func={0x85, 0x0, 0x1, 0x0, 0x5}], &(0x7f00000000c0)='syzkaller\x00', 0x8, 0x13, &(0x7f0000000100)=""/19, 0x41000, 0x8, '\x00', r6, 0x25, r9, 0x8, &(0x7f0000000580)={0x4, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000005c0)=[{0x3, 0x3, 0x6, 0xb}, {0x4, 0x2, 0x1}, {0x1, 0x2, 0x3, 0x3}, {0x2, 0x3, 0xf, 0x3}], 0x10, 0x8}, 0x94) (async) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r2}) (async) io_uring_enter(r2, 0x1, 0x2, 0x29, 0x0, 0x0) 507.90528ms ago: executing program 3 (id=1288): r0 = userfaultfd(0x80400) fremovexattr(r0, &(0x7f0000000000)=@random={'trusted.', '[).@\x00'}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_DMA(r2, 0xc0406429, &(0x7f00000001c0)={r3, 0xa, &(0x7f00000000c0)=[0x7, 0xffffffff, 0xffffffff, 0x891, 0xb, 0x8, 0x100, 0xd, 0x2, 0x67], &(0x7f0000000100)=[0x7, 0xfffffffe, 0xd87e], 0x30, 0x1, 0x4, &(0x7f0000000140)=[0xc], &(0x7f0000000180)=[0x8]}) syz_usbip_server_init(0x1) (async) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000200)={'\x00', 0x2, 0x2, 0x5, 0x7, 0x100000000, 0x0}) sched_setattr(r4, &(0x7f0000000280)={0x38, 0x3, 0x20, 0xe, 0x2, 0x5, 0x9, 0x7, 0x2, 0x3}, 0x0) clock_gettime(0x0, &(0x7f0000001700)={0x0, 0x0}) recvmmsg(r2, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000002c0)=""/243, 0xf3}], 0x1, &(0x7f0000000400)=""/61, 0x3d}, 0xffffff00}, {{&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @initdev}}, 0x80, &(0x7f0000000640)=[{&(0x7f00000004c0)=""/216, 0xd8}, {&(0x7f00000005c0)=""/51, 0x33}, {&(0x7f0000000600)=""/1, 0x1}], 0x3, &(0x7f0000000680)=""/4096, 0x1000}, 0x3f800000}], 0x2, 0x0, &(0x7f0000001740)={r5, r6+10000000}) mknod$loop(&(0x7f0000001780)='./file0\x00', 0x1, 0x0) (async) r7 = openat$autofs(0xffffffffffffff9c, &(0x7f00000017c0), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r7, 0xc0189375, &(0x7f0000001800)={{0x1, 0x1, 0x18, r2}, '\x00'}) (async, rerun: 64) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4040aea0, &(0x7f0000001840)=@x86={0xa, 0x3, 0x40, 0x0, 0x5, 0x5, 0x9, 0x0, 0x6, 0x13, 0x8, 0x2, 0x0, 0x2, 0x0, 0x7, 0x40, 0x9a, 0xc, '\x00', 0xe2, 0x3}) (rerun: 64) pivot_root(&(0x7f0000001880)='./file0\x00', &(0x7f00000018c0)='./file0\x00') (async) r9 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_mreq(r9, 0x0, 0x24, &(0x7f0000001900)={@private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x8) (async) close(r9) socket$inet6_udplite(0xa, 0x2, 0x88) (async, rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f0000001980)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000001940)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) (rerun: 32) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r8, &(0x7f00000019c0)={0x4, 0x8, 0xfa00, {r10}}, 0x10) (async) r11 = openat$vsock(0xffffffffffffff9c, &(0x7f0000001a00), 0x105440, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r11, 0xc008561c, &(0x7f0000001a40)={0x1, 0x4d6}) (async, rerun: 64) socket$kcm(0x29, 0x2, 0x0) (async, rerun: 64) mknodat$null(r2, &(0x7f0000001a80)='./file0\x00', 0x2000, 0x103) syz_emit_ethernet(0x46, &(0x7f0000001ac0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}, @void, {@ipv4={0x800, @generic={{0xa, 0x4, 0x2, 0x9, 0x38, 0x66, 0x0, 0x6, 0x16, 0x0, @empty, @local, {[@end, @timestamp_addr={0x44, 0xc, 0xf0, 0x1, 0x3, [{@multicast2, 0x2}]}, @end, @ra={0x94, 0x4, 0x1}]}}, "c1bd12ed3f35588a7d7036509605b816"}}}}, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r11, 0x4048ae9b, &(0x7f0000001b40)={0x20001, 0x0, [0x96a, 0x10, 0xc7b, 0xffffffffffff3996, 0x2, 0x9, 0x7]}) (async) r12 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001bc0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x5, '\x00', 0x0, r1, 0x3, 0x2, 0x5}, 0x50) ioctl$AUTOFS_DEV_IOCTL_FAIL(r1, 0xc0189377, &(0x7f0000001c40)={{0x1, 0x1, 0x18, r12, {0xfffffb6d, 0x4}}, './file0\x00'}) (async, rerun: 32) ioctl$SIOCGIFHWADDR(r8, 0x8927, &(0x7f0000001c80)={'geneve1\x00'}) (rerun: 32) 507.447931ms ago: executing program 1 (id=1289): r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0xa0004, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) r2 = syz_open_dev$media(&(0x7f0000000040), 0x3, 0x82502) ioctl$MEDIA_IOC_REQUEST_ALLOC(r2, 0x80047c05, &(0x7f0000000480)=0xffffffffffffffff) close(r3) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000000)=0x840, 0x4) ioctl$MEDIA_REQUEST_IOC_REINIT(r3, 0x7c81, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x6, 0x80010, r1, 0x0) 454.536419ms ago: executing program 2 (id=1290): socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80040, 0x61) r0 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x0, 0x0) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fcntl$setsig(0xffffffffffffffff, 0xa, 0x33) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0x20000014}) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$pppl2tp(0x18, 0x1, 0x1) socket(0x10, 0x80003, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newqdisc={0xcc, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0x9}, {0x8}}, [@TCA_STAB={0xa8, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x56, 0x6, 0x2, 0x46, 0x1, 0x9, 0x7, 0x2}}, {0x8, 0x2, [0x6, 0x7f]}}, {{0x1c, 0x1, {0xa4, 0x6, 0xfff, 0x9, 0x1, 0x103, 0x8001, 0x4}}, {0xc, 0x2, [0xb, 0x6, 0xda, 0x8]}}, {{0x1c, 0x1, {0x37, 0x82, 0x8, 0xdc1, 0x2, 0xfff, 0x37, 0x1}}, {0x6, 0x2, [0x8]}}, {{0x1c, 0x1, {0xc3, 0x7, 0xffac, 0x8, 0x0, 0x9000000, 0x1, 0x9}}, {0x16, 0x2, [0x6, 0x5, 0x1, 0x2, 0x7, 0x0, 0x9, 0xe73, 0x8]}}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) socket$netlink(0x10, 0x3, 0xc) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x10010, r4, 0x837d6000) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r7, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r7, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x4}}, 0x10) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x3c1, 0x3, 0x2b8, 0x0, 0xc8, 0x8, 0x1c0, 0x5803, 0x408, 0x2e8, 0x2e8, 0x408, 0x2e8, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @empty, [], [], 'vlan0\x00', 'geneve1\x00'}, 0x0, 0xa8, 0xd8, 0x0, {0x0, 0x2000000000000}}, @common=@unspec=@CONNMARK={0x30}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x318) connect$inet(r7, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r7, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet_int(r7, 0x0, 0x8, &(0x7f0000000180)=0x8, 0x4) recvmmsg(r7, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) setsockopt$inet_int(r4, 0x0, 0xd49c1258661b2438, &(0x7f00000000c0)=0x7fff, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r8, &(0x7f0000000300)=@abs, 0x6e) 311.680116ms ago: executing program 1 (id=1291): r0 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x1, 0xbfdffffc}, &(0x7f0000000280)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x17, 0xa, 0x1, 0x2, 0x0, 0x1}, 0x50) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_OPENAT2={0x1c, 0x8, 0x0, 0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x1f6, 0x8}, 0x0, 0x18, 0x0, 0x31713}) (async) io_uring_enter(r0, 0x47f6, 0x0, 0x5, 0x0, 0x0) (async) ioctl$int_in(0xffffffffffffffff, 0x5421, 0x0) (async, rerun: 64) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 32) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (rerun: 32) sendmsg(r4, 0x0, 0x0) (async, rerun: 64) io_uring_setup(0x1530, 0x0) (async, rerun: 64) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/fs/bpf', 0x0, 0x0) getdents(r5, &(0x7f0000000000)=""/113, 0x71) (async) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x951a, 0x3010, 0x1}, &(0x7f0000000040)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) (async) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r9, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r9, 0x3b88, &(0x7f0000000200)={0xc, r10}) (async) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r9, 0x3b71, &(0x7f0000000280)={0x20, 0x0, 0x0, 0x1c, 0x1c}) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r9, 0x3b72, &(0x7f0000000300)={0x18, 0x0, 0x1c, 0x1c}) syz_io_uring_submit(r7, r8, &(0x7f0000000200)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r6, 0x0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1000000000000000010000000100000010000000000000001101000003000000380000000000000008010000000001006d3432753e5af69823ed17a35303d5acdde73654a41b20ec8d526d62c68c2627102834ce5acdc90090"], 0xe8}, 0x0, 0x24040092}) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r11 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r11, 0x10e, 0xc, &(0x7f0000000280)={0xffffffff}, 0x10) 0s ago: executing program 3 (id=1292): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0xf, 0x101800) ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f00000003c0)=@multiplanar_mmap={0x4, 0x9, 0x4, 0x40, 0x7, {0x0, 0x2710}, {0x3, 0x2, 0x7, 0x5, 0x81, 0x9, "1bfe0d1e"}, 0x5, 0x1, {0x0}}) ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000080)={0x5, 0xfffffffe}) kernel console output (not intermixed with test programs): 5.369731][ T5940] usb 5-1: config 201 interface 48 altsetting 0 has a duplicate endpoint with address 0xA, skipping [ 315.380721][ T5940] usb 5-1: config 201 interface 48 altsetting 0 has a duplicate endpoint with address 0x9, skipping [ 315.391780][ T5940] usb 5-1: config 201 interface 48 altsetting 0 has a duplicate endpoint with address 0x7, skipping [ 315.402870][ T5940] usb 5-1: config 201 interface 48 altsetting 0 endpoint 0xD has invalid maxpacket 1024, setting to 64 [ 315.414191][ T5940] usb 5-1: config 201 interface 15 has no altsetting 0 [ 315.421226][ T5940] usb 5-1: config 201 interface 84 has no altsetting 0 [ 315.431076][ T5940] usb 5-1: New USB device found, idVendor=19d2, idProduct=000a, bcdDevice=8f.1b [ 315.440570][ T5940] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.449407][ T5940] usb 5-1: Product: ì¡ä…¨æ”°ê„­è´«ä—•é©ë£œâ«ì ã‹¡á´…댠긣⮡鶿ꖢ愱妩螶䟞ѳ㭵树뇅茴쪩࠙٤襌敾餩㒗î£î†‰ä°²â¼°â„˜ï”²á•¼å‡…ï—⾾ሴᔤച괿൯꟟î£ê·›î²¤ï·è£µê„¡îµâ†¹ç‹“ㄙ鬌袰ਦ즖޷篱娡咂⥖⎎쬺쓎屾엱뽅å˜èƒŠé³ƒê¯‡é³»â‰¶æ£ã¼ë¸“ﭟﺪ儧薰씡âµê©¤ê°ƒï¸¯ã­µçŒ«ç´á‘鶀ê…ኘ魈殘鹡샆땄㠶섥 [ 315.492396][ T5940] usb 5-1: Manufacturer: щ [ 315.501619][ T5940] usb 5-1: SerialNumber: è‘Ꮆ啄å­ç« å„´ï³Žã¬ªç ½èªï¬·å²‚۰맻蛮뫶㡰ì™å¨“ê³®íŽí“šè‡‹ä‡²ä€§ï·ŽéŠ†á«›ëƒŽãŸ½å¯¢ï¦°á˜šà¦µà°žá‘’ì¬ã¼˜â»‰ã¯å ±ä¿¼î§ë±•ì¥žä”°æŒµí“ƒì†‰ë½±å¥“î‰î‰¿éŠà°ºæ£³ï·³ê¹µå™‹æ·µé–¢è´„⽧ힹê춘셊á’뾃ʟ嬹↎é°â¼“徺瑡঻宥褻챇閫䵋唆ç³â§œè¿¿à –⥹‚ [ 315.572840][ T8787] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 315.584888][ T8787] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 315.723301][ T8803] TCP: TCP_TX_DELAY enabled [ 315.819831][ T8787] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 315.835794][ T8787] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 315.884338][ T5941] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 316.044158][ T5941] usb 4-1: Using ep0 maxpacket: 8 [ 316.049881][ T5940] option 5-1:201.15: GSM modem (1-port) converter detected [ 316.063687][ T5941] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 316.081205][ T5941] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.092110][ T5941] usb 4-1: Product: syz [ 316.098111][ T5941] usb 4-1: Manufacturer: syz [ 316.103504][ T5941] usb 4-1: SerialNumber: syz [ 316.123566][ T5941] usb 4-1: config 0 descriptor?? [ 316.141387][ T5940] option 5-1:201.48: GSM modem (1-port) converter detected [ 316.168595][ T5940] usb 5-1: USB disconnect, device number 49 [ 316.215135][ T5940] option 5-1:201.15: device disconnected [ 316.280813][ T5940] option 5-1:201.48: device disconnected [ 316.340815][ T5941] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 316.927969][ T8816] syz.2.686 (8816): attempted to duplicate a private mapping with mremap. This is not supported. [ 317.107093][ T5955] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 317.264173][ T5955] usb 5-1: Using ep0 maxpacket: 8 [ 317.282909][ T5955] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 317.293639][ T5955] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.307506][ T5955] usb 5-1: Product: syz [ 317.312001][ T5955] usb 5-1: Manufacturer: syz [ 317.318376][ T5955] usb 5-1: SerialNumber: syz [ 317.339375][ T5955] usb 5-1: config 0 descriptor?? [ 317.508328][ T5953] usb 3-1: dvb_usb_v2: Did not find the firmware file 'dvb-usb-terratec-h7-az6007.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 317.594234][ T5953] dvb_usb_az6007 3-1:0.0: probe with driver dvb_usb_az6007 failed with error -110 [ 317.598412][ T5955] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 317.641854][ T5953] usb 3-1: USB disconnect, device number 41 [ 318.209124][ T5941] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 318.225389][ T5941] usb 4-1: USB disconnect, device number 53 [ 318.370255][ T8838] netlink: 348 bytes leftover after parsing attributes in process `syz.2.690'. [ 320.194700][ T5953] usb 4-1: new full-speed USB device number 54 using dummy_hcd [ 320.253590][ T5955] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 320.277606][ T5955] usb 5-1: USB disconnect, device number 50 [ 320.367548][ T5953] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 320.387229][ T5953] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 320.403030][ T5953] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 320.431575][ T5953] usb 4-1: New USB device found, idVendor=0525, idProduct=86a1, bcdDevice= 0.40 [ 320.451941][ T5953] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.463082][ T5953] usb 4-1: Product: syz [ 320.469728][ T5953] usb 4-1: Manufacturer: syz [ 320.476924][ T5953] usb 4-1: SerialNumber: syz [ 320.482535][ T8855] netlink: 68 bytes leftover after parsing attributes in process `syz.4.696'. [ 321.828760][ T5953] cdc_ncm 4-1:1.0: bind() failure [ 321.864452][ T5953] cdc_ncm 4-1:1.1: probe with driver cdc_ncm failed with error -71 [ 322.111863][ T5953] cdc_mbim 4-1:1.1: probe with driver cdc_mbim failed with error -71 [ 322.152391][ T5953] usbtest 4-1:1.1: probe with driver usbtest failed with error -71 [ 322.176799][ T5953] usb 4-1: USB disconnect, device number 54 [ 322.571574][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 322.578898][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 322.645211][ T8892] netlink: 'syz.3.705': attribute type 4 has an invalid length. [ 323.134002][ T5969] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 323.304025][ T5969] usb 4-1: Using ep0 maxpacket: 8 [ 323.322410][ T5969] usb 4-1: unable to get BOS descriptor or descriptor too short [ 323.345433][ T5969] usb 4-1: config 4 interface 0 has no altsetting 0 [ 323.381977][ T5969] usb 4-1: string descriptor 0 read error: -22 [ 323.394141][ T5969] usb 4-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 323.414652][ T5969] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.450594][ T5969] usb 4-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 323.487067][ T5969] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 323.504497][ T5969] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 323.512011][ T5969] usb 4-1: media controller created [ 323.585897][ T5969] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 323.730761][ T8907] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 323.740145][ T8907] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 323.792192][ T8907] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 323.808480][ T8907] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 324.588800][ T8921] kvm: vcpu 2: requested 128 ns lapic timer period limited to 200000 ns [ 324.598688][ T8921] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 324.644619][ T5969] zl10353_read_register: readreg error (reg=127, ret==0) [ 324.645555][ T8897] usb 4-1: dvb_usb_au6610: wlen=0, aborting [ 325.935341][ T8950] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 325.969269][ T8952] netlink: 20 bytes leftover after parsing attributes in process `syz.0.719'. [ 325.990960][ T8950] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 327.991647][ T8967] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.002251][ T8967] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 329.244284][ T5840] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 329.547341][ T5840] usb 5-1: unable to get BOS descriptor or descriptor too short [ 329.589066][ T5840] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 329.626133][ T5840] usb 5-1: can't read configurations, error -71 [ 329.892024][ T8988] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 329.942476][ T8988] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 331.273226][ T9000] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 331.285135][ T9000] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 331.309555][ T9000] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 331.800884][ T9007] netlink: 'syz.2.735': attribute type 1 has an invalid length. [ 331.916094][ T9014] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 331.939109][ T9008] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 331.948456][ T9014] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 331.971901][ T9012] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 331.993321][ T9012] bond1 (unregistering): Released all slaves [ 332.205816][ T9017] loop8: detected capacity change from 0 to 7 [ 332.216762][ T9017] Dev loop8: unable to read RDB block 7 [ 332.222825][ T9017] loop8: unable to read partition table [ 332.229689][ T9017] loop8: partition table beyond EOD, truncated [ 332.239075][ T9017] loop_reread_partitions: partition scan of loop8 (þ被xü^>à– ) failed (rc=-5) [ 332.350202][ T9019] netlink: 112 bytes leftover after parsing attributes in process `syz.2.738'. [ 332.669188][ T9025] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 332.675794][ T9025] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 332.754012][ T9025] vhci_hcd vhci_hcd.0: Device attached [ 333.032904][ T9025] netlink: 14 bytes leftover after parsing attributes in process `syz.1.741'. [ 333.046748][ T5953] vhci_hcd: vhci_device speed not set [ 333.184034][ T5953] usb 35-1: new full-speed USB device number 2 using vhci_hcd [ 333.384345][ T5955] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 333.647255][ T9026] vhci_hcd: connection reset by peer [ 333.648763][ T5955] usb 5-1: Using ep0 maxpacket: 16 [ 333.658712][ T36] vhci_hcd: stop threads [ 333.663602][ T36] vhci_hcd: release socket [ 333.668966][ T36] vhci_hcd: disconnect device [ 333.959906][ T5955] usb 5-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice=2a.35 [ 334.007035][ T5955] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.027837][ T5955] usb 5-1: Product: syz [ 334.032171][ T5955] usb 5-1: Manufacturer: syz [ 334.044573][ T5955] usb 5-1: SerialNumber: syz [ 334.086215][ T5955] usb 5-1: config 0 descriptor?? [ 334.840808][ T5955] as10x_usb: device has been detected [ 334.977529][ T5955] dvbdev: DVB: registering new adapter (Sky IT Digital Key (green led)) [ 335.034550][ T5955] usb 5-1: DVB: registering adapter 1 frontend 0 (Sky IT Digital Key (green led))... [ 335.048723][ T9032] random: crng reseeded on system resumption [ 335.175866][ T5955] as10x_usb: error during firmware upload part1 [ 335.213231][ T5955] Registered device Sky IT Digital Key (green led) [ 336.221893][ T9063] netlink: 16 bytes leftover after parsing attributes in process `syz.0.748'. [ 336.258150][ T9063] netlink: 'syz.0.748': attribute type 10 has an invalid length. [ 336.267511][ T9063] veth1_vlan: entered allmulticast mode [ 336.289133][ T9063] team0: Device veth1_vlan failed to register rx_handler [ 336.583186][ T5840] usb 5-1: USB disconnect, device number 53 [ 336.738148][ T5840] Unregistered device Sky IT Digital Key (green led) [ 336.752671][ T5840] as10x_usb: device has been disconnected [ 336.936883][ T9065] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 337.081852][ T9072] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.124942][ T9072] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.158674][ T9072] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.198033][ T9072] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.229158][ T9074] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.244788][ T9072] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.280906][ T9074] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.312332][ T9072] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.612954][ T9077] xt_TCPMSS: Only works on TCP SYN packets [ 337.648319][ T9080] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.677596][ T9080] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.945656][ T5940] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 338.017290][ T9088] sch_tbf: peakrate 64 is lower than or equals to rate 2147483649 ! [ 338.124213][ T5940] usb 5-1: Using ep0 maxpacket: 32 [ 338.132196][ T5940] usb 5-1: config 1 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 338.154322][ T5940] usb 5-1: config 1 interface 0 has no altsetting 0 [ 338.176945][ T5940] usb 5-1: New USB device found, idVendor=07c0, idProduct=1125, bcdDevice= 0.40 [ 338.193978][ T5940] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 338.213528][ T5940] usb 5-1: Product: syz [ 338.218326][ T5940] usb 5-1: Manufacturer: syz [ 338.243644][ T5940] usb 5-1: SerialNumber: syz [ 338.324574][ T5953] vhci_hcd: vhci_device speed not set [ 338.468596][ T9082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 338.500126][ T9082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 338.563873][ T5940] usbhid 5-1:1.0: can't add hid device: -71 [ 338.574495][ T5940] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 338.630104][ T5940] usb 5-1: USB disconnect, device number 54 [ 338.714406][ T9093] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 338.745461][ T9093] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 338.844097][ T977] usb 3-1: new full-speed USB device number 42 using dummy_hcd [ 339.043930][ T977] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 339.064852][ T977] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 339.086397][ T9116] fuse: blksize only supported for fuseblk [ 339.115872][ T977] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 339.133659][ T9093] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 339.155078][ T977] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.183874][ T9093] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 339.230790][ T9093] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 339.249986][ T9093] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 339.431981][ T977] usb 3-1: usb_control_msg returned -32 [ 339.485616][ T977] usbtmc 3-1:16.0: can't read capabilities [ 339.575742][ T9093] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 339.586265][ T9093] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 339.595904][ T9093] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 339.605776][ T9093] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 339.616972][ T977] usb 3-1: USB disconnect, device number 42 [ 339.757208][ T9093] vxlan0: left promiscuous mode [ 339.766357][ T9093] gtp0: left promiscuous mode [ 339.786397][ T9121] netlink: 40 bytes leftover after parsing attributes in process `syz.4.763'. [ 340.223748][ T9149] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 340.230392][ T9149] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 340.409320][ T9149] vhci_hcd vhci_hcd.0: Device attached [ 340.584088][ T5940] vhci_hcd: vhci_device speed not set [ 340.644499][ T5940] usb 39-1: new full-speed USB device number 2 using vhci_hcd [ 340.722893][ T9151] vhci_hcd: connection reset by peer [ 340.754754][ T78] vhci_hcd: stop threads [ 340.774011][ T78] vhci_hcd: release socket [ 340.785089][ T78] vhci_hcd: disconnect device [ 341.372988][ T9166] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 341.385192][ T9166] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 341.410235][ T9166] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 341.432797][ T9166] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 341.461077][ T9166] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 341.491207][ T9169] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 341.523102][ T9166] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 341.549921][ T9169] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 342.024012][ T5953] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 342.173974][ T5953] usb 5-1: Using ep0 maxpacket: 16 [ 342.187899][ T5953] usb 5-1: config 0 has an invalid interface number: 180 but max is 0 [ 342.197207][ T5953] usb 5-1: config 0 has no interface number 0 [ 342.245039][ T5953] usb 5-1: New USB device found, idVendor=0421, idProduct=0114, bcdDevice=11.72 [ 342.254345][ T5953] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 342.262429][ T5953] usb 5-1: Product: syz [ 342.278112][ T5953] usb 5-1: Manufacturer: syz [ 342.301126][ T5953] usb 5-1: SerialNumber: syz [ 342.328818][ T5953] usb 5-1: config 0 descriptor?? [ 342.378013][ T5953] usb 5-1: bad CDC descriptors [ 343.764145][ T6952] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 343.778753][ T5953] usb 5-1: USB disconnect, device number 55 [ 343.950733][ T6952] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 343.961047][ T6952] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.972335][ T6952] usb 3-1: Product: syz [ 343.983135][ T6952] usb 3-1: Manufacturer: syz [ 343.997302][ T6952] usb 3-1: SerialNumber: syz [ 344.026327][ T6952] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 344.087841][ T5953] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 344.308343][ T30] audit: type=1326 audit(1752259999.814:2980): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9206 comm="syz.3.785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 344.484027][ T30] audit: type=1326 audit(1752259999.814:2981): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9206 comm="syz.3.785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 344.506853][ C0] vkms_vblank_simulate: vblank timer overrun [ 344.572110][ T9212] loop2: detected capacity change from 0 to 7 [ 344.585242][ T30] audit: type=1326 audit(1752259999.814:2982): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9206 comm="syz.3.785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 344.607621][ C0] vkms_vblank_simulate: vblank timer overrun [ 344.615047][ T9212] Dev loop2: unable to read RDB block 7 [ 344.621405][ T9212] loop2: unable to read partition table [ 344.721260][ T9212] loop2: partition table beyond EOD, truncated [ 344.746227][ T9216] netlink: 40 bytes leftover after parsing attributes in process `syz.1.787'. [ 344.754029][ T30] audit: type=1326 audit(1752259999.814:2983): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9206 comm="syz.3.785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 344.779314][ T9212] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 344.828358][ T30] audit: type=1326 audit(1752259999.824:2984): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9206 comm="syz.3.785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 344.852199][ T9216] netlink: 12 bytes leftover after parsing attributes in process `syz.1.787'. [ 344.855578][ T9213] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 344.893026][ T9213] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 345.095785][ T30] audit: type=1326 audit(1752259999.824:2985): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9206 comm="syz.3.785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 345.128624][ T5953] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 345.141042][ T5953] ath9k_htc: Failed to initialize the device [ 345.212171][ T5953] usb 3-1: ath9k_htc: USB layer deinitialized [ 345.341519][ T30] audit: type=1326 audit(1752259999.824:2986): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9206 comm="syz.3.785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 345.475664][ T30] audit: type=1326 audit(1752259999.824:2987): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9206 comm="syz.3.785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 345.558580][ T30] audit: type=1326 audit(1752259999.824:2988): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9206 comm="syz.3.785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 345.641523][ T30] audit: type=1326 audit(1752259999.844:2989): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9206 comm="syz.3.785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 345.774187][ T5940] vhci_hcd: vhci_device speed not set [ 346.068884][ T1209] usb 3-1: USB disconnect, device number 43 [ 346.861107][ T9255] netlink: 40 bytes leftover after parsing attributes in process `syz.3.798'. [ 346.954347][ T9261] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 346.964057][ T9261] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 347.344381][ T9268] netlink: 24 bytes leftover after parsing attributes in process `syz.2.802'. [ 347.364530][ T5940] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 347.515966][ T5940] usb 5-1: config 0 has no interfaces? [ 347.527816][ T5940] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 347.541339][ T5940] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.551562][ T5940] usb 5-1: Product: syz [ 347.560290][ T5940] usb 5-1: Manufacturer: syz [ 347.565567][ T5940] usb 5-1: SerialNumber: syz [ 347.573799][ T5940] usb 5-1: config 0 descriptor?? [ 347.604193][ T977] usb 3-1: new full-speed USB device number 44 using dummy_hcd [ 347.766138][ T977] usb 3-1: config 54 has an invalid interface number: 154 but max is 0 [ 347.784106][ T977] usb 3-1: config 54 has no interface number 0 [ 347.806920][ T977] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 0.ec [ 347.824099][ T977] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.836497][ T977] usb 3-1: Product: syz [ 347.840742][ T977] usb 3-1: Manufacturer: syz [ 347.861275][ T977] usb 3-1: SerialNumber: syz [ 347.882285][ T5953] usb 5-1: USB disconnect, device number 56 [ 347.915163][ T9274] netlink: 8 bytes leftover after parsing attributes in process `syz.1.804'. [ 348.128198][ T977] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 348.131589][ T78] usb 3-1: Failed to submit usb control message: -71 [ 348.144265][ T977] usb 3-1: USB disconnect, device number 44 [ 348.183722][ T78] usb 3-1: unable to send the bmi data to the device: -71 [ 348.195673][ T78] usb 3-1: unable to get target info from device [ 348.202104][ T78] usb 3-1: could not get target info (-71) [ 348.218339][ T78] usb 3-1: could not probe fw (-71) [ 348.399593][ T9282] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 348.409554][ T9282] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 349.398618][ T9296] program syz.4.808 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 349.411759][ T9296] netlink: 'syz.4.808': attribute type 10 has an invalid length. [ 349.427672][ T9296] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 349.438604][ T9296] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 349.458566][ T10] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 349.584131][ T9296] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 349.683430][ T9298] netlink: 'syz.0.809': attribute type 7 has an invalid length. [ 349.754012][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 349.776328][ T9299] ip6gretap1: entered allmulticast mode [ 349.801369][ T9298] netlink: 8 bytes leftover after parsing attributes in process `syz.0.809'. [ 349.979067][ T9299] netlink: 'syz.0.809': attribute type 10 has an invalid length. [ 351.114460][ T5953] usb 5-1: new full-speed USB device number 57 using dummy_hcd [ 351.306233][ T5953] usb 5-1: config 0 has an invalid interface number: 106 but max is 0 [ 351.354068][ T5953] usb 5-1: config 0 has no interface number 0 [ 351.367543][ T5953] usb 5-1: config 0 interface 106 has no altsetting 0 [ 351.423702][ T5953] usb 5-1: New USB device found, idVendor=413c, idProduct=8217, bcdDevice=b2.59 [ 351.467191][ T5953] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 351.531441][ T5953] usb 5-1: Product: syz [ 351.552507][ T5953] usb 5-1: Manufacturer: syz [ 351.613709][ T5953] usb 5-1: SerialNumber: syz [ 351.630125][ T5953] usb 5-1: config 0 descriptor?? [ 351.864983][ T9308] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 351.868784][ T5953] usb 5-1: USB disconnect, device number 57 [ 351.927019][ T9308] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 352.041278][ T9312] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 352.052473][ T9312] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 352.069042][ T9312] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 352.078595][ T9312] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 352.558018][ T9316] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 352.567233][ T9316] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 352.681153][ T9318] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 352.690814][ T9318] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 352.790003][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 352.800616][ T10] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 352.808983][ T10] usb 3-1: can't read configurations, error -71 [ 353.344318][ T9320] ptrace attach of "./syz-executor exec"[5868] was attempted by "./syz-executor exec"[9320] [ 353.917098][ T10] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 354.176105][ T10] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 354.206983][ T10] usb 3-1: config 0 interface 0 has no altsetting 0 [ 354.229962][ T10] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 354.249511][ T10] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 354.268930][ T10] usb 3-1: Product: syz [ 354.283451][ T10] usb 3-1: Manufacturer: syz [ 354.303760][ T10] usb 3-1: SerialNumber: syz [ 354.325432][ T10] usb 3-1: config 0 descriptor?? [ 354.364214][ T977] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 354.371524][ T10] usb 3-1: selecting invalid altsetting 0 [ 354.546035][ T977] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 354.577336][ T977] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 354.594721][ T10] usb 3-1: USB disconnect, device number 46 [ 354.632327][ T977] usb 5-1: config 0 descriptor?? [ 354.872197][ T977] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 355.117356][ T977] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 2 [ 355.156868][ T977] [drm] Initialized udl on minor 2 [ 355.273492][ T977] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed [ 355.328912][ T977] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 355.890311][ T6952] usb 5-1: USB disconnect, device number 58 [ 355.896497][ T5953] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 355.911428][ T5953] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 356.399873][ T9377] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 356.464190][ T9377] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 357.483995][ T9103] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 357.927143][ T9395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 358.017930][ T9395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 358.026562][ T9103] usb 5-1: Using ep0 maxpacket: 32 [ 358.056459][ T9395] fuse: Bad value for 'fd' [ 358.072348][ T9103] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 358.131542][ T9103] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 358.393047][ T9103] usb 5-1: New USB device found, idVendor=1e7d, idProduct=255a, bcdDevice= 0.00 [ 358.420288][ T9103] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 358.487480][ T9103] usb 5-1: config 0 descriptor?? [ 358.954594][ T9103] hid-generic 0003:1E7D:255A.000C: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:255a] on usb-dummy_hcd.4-1/input0 [ 359.815969][ T9435] atomic_op ffff888033203998 conn xmit_atomic 0000000000000000 [ 359.846161][ T9435] program syz.2.845 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 359.883408][ T9437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 359.892544][ T9437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 360.227101][ T6952] usb 5-1: USB disconnect, device number 59 [ 360.664944][ T6952] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 360.854451][ T6952] usb 5-1: Using ep0 maxpacket: 8 [ 360.988094][ T6952] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1023 [ 360.991749][ T9456] netlink: 'syz.3.852': attribute type 1 has an invalid length. [ 361.070260][ T9456] bond1: entered promiscuous mode [ 361.075551][ T9456] bond1: entered allmulticast mode [ 361.081188][ T9456] 8021q: adding VLAN 0 to HW filter on device bond1 [ 361.105680][ T9456] bridge1: entered promiscuous mode [ 361.111471][ T9456] bridge1: entered allmulticast mode [ 361.117780][ T9456] bond1: (slave bridge1): Enslaving as a backup interface with an up link [ 361.129648][ T6173] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 361.153357][ T6952] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 64 [ 361.255307][ T6173] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 361.271894][ T6952] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 361.281675][ T6952] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.311416][ T6952] usb 5-1: Product: á°‰ [ 361.320368][ T6952] usb 5-1: Manufacturer: ㉠[ 361.354785][ T6952] usb 5-1: SerialNumber: syz [ 361.643508][ T6952] cdc_ncm 5-1:1.0: bind() failure [ 361.694983][ T6952] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 361.706689][ T6952] cdc_ncm 5-1:1.1: bind() failure [ 361.735826][ T6952] usb 5-1: USB disconnect, device number 60 [ 362.100354][ T9472] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 362.139448][ T9470] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 362.163272][ T9472] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 362.177514][ T9470] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 362.324097][ T9103] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 362.475017][ T9103] usb 3-1: Using ep0 maxpacket: 8 [ 362.485416][ T9103] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 362.495695][ T9103] usb 3-1: config 179 has no interface number 0 [ 362.502241][ T9103] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 362.517875][ T9103] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 362.530535][ T9103] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 362.542775][ T9103] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 362.553189][ T9103] usb 3-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 362.604639][ T1209] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 362.612939][ T9103] usb 3-1: config 179 interface 65 has no altsetting 0 [ 362.620977][ T9103] usb 3-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 362.630797][ T9103] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 362.719747][ T9485] vti0: entered promiscuous mode [ 362.726809][ T9485] vti0: entered allmulticast mode [ 362.754133][ T1209] usb 5-1: Using ep0 maxpacket: 16 [ 362.762654][ T9103] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:179.65/input/input21 [ 362.832062][ T1209] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 362.844616][ T1209] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 362.867114][ T1209] usb 5-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 362.925842][ T9103] usb 3-1: USB disconnect, device number 47 [ 362.973436][ T1209] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.075331][ T1209] usb 5-1: config 0 descriptor?? [ 363.708436][ T9493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 363.825727][ T9493] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 364.008998][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 364.009019][ T30] audit: type=1326 audit(1752260019.524:3005): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9495 comm="syz.2.861" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc34a58e929 code=0x0 [ 364.057952][ T9494] netlink: 32 bytes leftover after parsing attributes in process `syz.0.859'. [ 364.149677][ T30] audit: type=1326 audit(1752260019.524:3006): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9495 comm="syz.2.861" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc34a58e929 code=0x0 [ 364.496978][ T9510] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 364.507365][ T9510] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 364.800606][ T9523] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 364.814705][ T9523] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 364.822784][ T9522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 364.842496][ T9522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 364.890807][ T9523] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 364.948233][ T9523] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 365.043067][ T9530] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 365.049664][ T9530] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 365.058161][ T9530] vhci_hcd vhci_hcd.0: Device attached [ 365.245333][ T5940] vhci_hcd: vhci_device speed not set [ 365.251021][ T9531] vhci_hcd: connection closed [ 365.253155][ T6177] vhci_hcd: stop threads [ 365.263163][ T6177] vhci_hcd: release socket [ 365.273072][ T6177] vhci_hcd: disconnect device [ 365.328167][ T5940] usb 33-1: new full-speed USB device number 2 using vhci_hcd [ 365.346971][ T5940] usb 33-1: enqueue for inactive port 0 [ 365.426739][ T5940] vhci_hcd: vhci_device speed not set [ 365.579530][ T1209] usbhid 5-1:0.0: can't add hid device: -71 [ 365.601542][ T1209] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 365.629187][ T1209] usb 5-1: USB disconnect, device number 61 [ 365.672939][ T9544] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 365.712847][ T9544] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 365.995021][ T30] audit: type=1326 audit(1752260021.514:3007): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9550 comm="syz.1.875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 366.031789][ T30] audit: type=1326 audit(1752260021.534:3008): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9550 comm="syz.1.875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 366.058980][ T30] audit: type=1326 audit(1752260021.534:3009): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9550 comm="syz.1.875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=433 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 366.127880][ T30] audit: type=1326 audit(1752260021.534:3010): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9550 comm="syz.1.875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 366.170333][ T30] audit: type=1326 audit(1752260021.534:3011): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9550 comm="syz.1.875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 366.200040][ T30] audit: type=1326 audit(1752260021.534:3012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9550 comm="syz.1.875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 366.233085][ T30] audit: type=1326 audit(1752260021.534:3013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9550 comm="syz.1.875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 366.320426][ T977] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 366.605575][ T30] audit: type=1326 audit(1752260021.534:3014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9550 comm="syz.1.875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 366.740097][ T977] usb 5-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 366.753566][ T977] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.763111][ T977] usb 5-1: Product: syz [ 366.781296][ T977] usb 5-1: Manufacturer: syz [ 366.788831][ T977] usb 5-1: SerialNumber: syz [ 366.801810][ T977] usb 5-1: config 0 descriptor?? [ 366.829541][ T977] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 366.896710][ T9564] trusted_key: syz.0.877 sent an empty control message without MSG_MORE. [ 366.918288][ T9564] sctp: [Deprecated]: syz.0.877 (pid 9564) Use of int in maxseg socket option. [ 366.918288][ T9564] Use struct sctp_assoc_value instead [ 367.159290][ T9548] netlink: 'syz.4.874': attribute type 29 has an invalid length. [ 367.260399][ T977] gspca_sunplus: reg_r err -71 [ 367.268214][ T977] usb 5-1: USB disconnect, device number 62 [ 367.637586][ T9569] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 368.114527][ T9103] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 368.207800][ T9576] netlink: 'syz.4.881': attribute type 27 has an invalid length. [ 368.278269][ T9560] block device autoloading is deprecated and will be removed. [ 368.355807][ T9103] usb 3-1: Using ep0 maxpacket: 16 [ 368.770047][ T9103] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 368.824989][ T9576] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.832816][ T9576] bridge0: port 1(bridge_slave_0) entered disabled state [ 368.844655][ T9103] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 368.920029][ T9103] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice=f1.40 [ 368.930780][ T9103] usb 3-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 368.946607][ T9103] usb 3-1: Product: syz [ 368.950851][ T9103] usb 3-1: Manufacturer: syz [ 369.048939][ T9103] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 369.302885][ T5953] usb 3-1: USB disconnect, device number 48 [ 369.335949][ T9576] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 369.399243][ T9576] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 369.541227][ T9576] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.560261][ T9576] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.570076][ T9576] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.582000][ T9576] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.624701][ T9576] gre2: left promiscuous mode [ 369.630620][ T9576] gre2: left allmulticast mode [ 369.703198][ T9576] veth3: left promiscuous mode [ 369.838614][ T9577] 8021q: adding VLAN 0 to HW filter on device bond0 [ 369.900614][ T9577] 8021q: adding VLAN 0 to HW filter on device team0 [ 369.929414][ T9577] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 372.638760][ T6952] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 372.730219][ T9614] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 372.841600][ T6952] hid-generic 0000:0000:0000.000D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 374.255364][ T9629] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 374.266058][ T9629] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 374.277162][ T9629] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 374.287138][ T9629] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 374.710191][ T9632] netlink: 100 bytes leftover after parsing attributes in process `syz.2.894'. [ 375.615829][ T9640] netlink: 'syz.3.896': attribute type 4 has an invalid length. [ 377.759229][ T9103] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 377.978621][ T9103] usb 3-1: config 0 has an invalid interface number: 168 but max is 0 [ 377.997288][ T9103] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 378.030536][ T9103] usb 3-1: config 0 has no interface number 0 [ 378.058621][ T9103] usb 3-1: config 0 interface 168 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 378.121652][ T9103] usb 3-1: config 0 interface 168 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 378.202967][ T9103] usb 3-1: config 0 interface 168 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 16 [ 378.217511][ T9103] usb 3-1: New USB device found, idVendor=0959, idProduct=2bd0, bcdDevice=48.98 [ 378.237127][ T9103] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 378.265808][ T9103] usb 3-1: config 0 descriptor?? [ 378.462445][ T9103] HFC-S_USB 3-1:0.168: probe with driver HFC-S_USB failed with error -5 [ 378.739586][ T9671] netlink: 48 bytes leftover after parsing attributes in process `syz.3.904'. [ 379.167669][ T9660] ip6t_srh: unknown srh match flags 5040 [ 379.691108][ T9680] tipc: Started in network mode [ 379.708071][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 379.710190][ T9680] tipc: Node identity 96d035bd34b1, cluster identity 4711 [ 379.725049][ T30] audit: type=1326 audit(1752260035.224:3016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9681 comm="syz.3.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 379.854275][ T30] audit: type=1326 audit(1752260035.224:3017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9681 comm="syz.3.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 379.912553][ T9680] tipc: Enabled bearer , priority 0 [ 379.935355][ T9683] syzkaller0: entered promiscuous mode [ 379.941159][ T30] audit: type=1326 audit(1752260035.274:3018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9681 comm="syz.3.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 379.974572][ T9683] syzkaller0: entered allmulticast mode [ 379.989829][ T9685] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 380.021664][ T9685] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 380.045253][ T9680] tipc: Resetting bearer [ 380.065900][ T30] audit: type=1326 audit(1752260035.274:3019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9681 comm="syz.3.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 380.092782][ T9685] IPVS: length: 4096 != 504 [ 380.103243][ T9679] tipc: Resetting bearer [ 380.132468][ T9679] tipc: Disabling bearer [ 380.305418][ T30] audit: type=1326 audit(1752260035.274:3020): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9681 comm="syz.3.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 380.389121][ T977] usb 3-1: USB disconnect, device number 49 [ 380.401403][ T30] audit: type=1326 audit(1752260035.334:3021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9681 comm="syz.3.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 380.554112][ T30] audit: type=1326 audit(1752260035.334:3022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9681 comm="syz.3.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 380.596693][ T30] audit: type=1326 audit(1752260035.334:3023): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9681 comm="syz.3.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 380.640324][ T30] audit: type=1326 audit(1752260035.334:3024): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9681 comm="syz.3.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=285 compat=0 ip=0x7f4a2b58e929 code=0x7ffc0000 [ 380.728434][ T30] audit: type=1326 audit(1752260035.334:3025): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9681 comm="syz.3.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=96 compat=0 ip=0xffffffffff600000 code=0x7ffc0000 [ 381.228876][ T9698] fuse: root generation should be zero [ 381.373448][ T9700] netlink: 209588 bytes leftover after parsing attributes in process `syz.3.911'. [ 381.452561][ T9702] tipc: Enabled bearer , priority 0 [ 381.537699][ T9706] syzkaller0: entered promiscuous mode [ 381.567514][ T9706] syzkaller0: entered allmulticast mode [ 381.578146][ T9709] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 381.592130][ T9702] netlink: 8 bytes leftover after parsing attributes in process `syz.4.914'. [ 381.603171][ T9709] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 381.668306][ T9702] tipc: Resetting bearer [ 381.708344][ T9701] tipc: Resetting bearer [ 381.761163][ T9701] tipc: Disabling bearer [ 381.995338][ T9715] netlink: 211928 bytes leftover after parsing attributes in process `syz.4.919'. [ 382.422170][ T9716] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 382.701171][ T9716] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 382.916581][ T9747] netlink: 'syz.3.927': attribute type 13 has an invalid length. [ 382.932828][ T9747] gretap0: refused to change device tx_queue_len [ 382.942506][ T9747] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 382.964105][ T6952] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 383.138361][ T6952] usb 5-1: Using ep0 maxpacket: 32 [ 383.146471][ T6952] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 383.156456][ T6952] usb 5-1: config 0 has no interface number 0 [ 383.162667][ T6952] usb 5-1: config 0 interface 12 has no altsetting 0 [ 383.174477][ T6952] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 383.184418][ T6952] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.192676][ T6952] usb 5-1: Product: syz [ 383.213667][ T6952] usb 5-1: Manufacturer: syz [ 383.222543][ T6952] usb 5-1: SerialNumber: syz [ 383.229097][ T9752] IPVS: set_ctl: invalid protocol: 47 172.20.20.170:20001 [ 383.244699][ T6952] usb 5-1: config 0 descriptor?? [ 383.815227][ T9768] netlink: 20 bytes leftover after parsing attributes in process `syz.3.931'. [ 383.836112][ T9769] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 383.848004][ T9768] bridge2: entered promiscuous mode [ 383.862462][ T9769] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 384.009212][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 384.016175][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 384.087168][ T9737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 384.099637][ T9737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 384.248912][ T6952] f81534 5-1:0.12: f81534_set_register: reg: 1002 data: 0 failed: -71 [ 384.261334][ T6952] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 384.278764][ T6952] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 384.292830][ T6952] f81534 5-1:0.12: probe with driver f81534 failed with error -71 [ 384.379717][ T6952] usb 5-1: USB disconnect, device number 63 [ 386.525329][ T9805] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 386.532679][ T9805] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 386.545627][ T9805] vhci_hcd vhci_hcd.0: Device attached [ 386.654512][ T9805] netdevsim netdevsim4: Direct firmware load for lf failed with error -2 [ 386.671310][ T9805] netdevsim netdevsim4: Falling back to sysfs fallback for: lf [ 386.834021][ T9103] usb 41-1: new low-speed USB device number 3 using vhci_hcd [ 387.205737][ T9824] netlink: 'syz.1.944': attribute type 10 has an invalid length. [ 387.264564][ T9824] batman_adv: batadv0: Adding interface: wlan1 [ 387.270950][ T9824] batman_adv: batadv0: The MTU of interface wlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 387.327297][ T9824] batman_adv: batadv0: Not using interface wlan1 (retrying later): interface not active [ 387.505696][ T9806] vhci_hcd: connection reset by peer [ 387.539111][ T36] vhci_hcd: stop threads [ 387.543521][ T36] vhci_hcd: release socket [ 387.578720][ T36] vhci_hcd: disconnect device [ 387.684045][ T9833] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 387.754097][ T9833] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.069605][ T9891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.161219][ T9891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.272126][ T9895] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.300550][ T9895] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 391.019094][ T9901] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 391.107200][ T9903] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 391.156835][ T9902] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 391.727942][ T9916] geneve2: entered allmulticast mode [ 391.914120][ T9103] vhci_hcd: vhci_device speed not set [ 392.287838][ T9928] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 392.323080][ T9928] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 392.402442][ T6952] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 392.507506][ T9933] netlink: 16 bytes leftover after parsing attributes in process `syz.4.969'. [ 392.721937][ T6952] usb 3-1: Using ep0 maxpacket: 32 [ 392.761330][ T6952] usb 3-1: config index 0 descriptor too short (expected 18817, got 36) [ 392.804450][ T9937] netlink: 'syz.3.971': attribute type 11 has an invalid length. [ 392.812386][ T6952] usb 3-1: config 36 has too many interfaces: 49, using maximum allowed: 32 [ 392.841495][ T6952] usb 3-1: config 36 has an invalid descriptor of length 244, skipping remainder of the config [ 392.878380][ T6952] usb 3-1: config 36 has 0 interfaces, different from the descriptor's value: 49 [ 392.901947][ T6952] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 393.093998][ T43] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 393.143675][ T6952] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.169108][ T6952] usb 3-1: Product: syz [ 393.187389][ T6952] usb 3-1: Manufacturer: syz [ 393.192085][ T6952] usb 3-1: SerialNumber: syz [ 393.266339][ T43] usb 5-1: config 0 has an invalid interface number: 255 but max is 0 [ 393.294288][ T43] usb 5-1: config 0 has no interface number 0 [ 393.300551][ T43] usb 5-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 393.336824][ T43] usb 5-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 393.371307][ T43] usb 5-1: config 0 interface 255 has no altsetting 0 [ 393.388527][ T43] usb 5-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 393.424221][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 393.469027][ T9945] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.477843][ T43] usb 5-1: config 0 descriptor?? [ 393.505163][ T43] ums-realtek 5-1:0.255: USB Mass Storage device detected [ 393.517984][ T9945] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 393.548753][ T9947] netlink: 'syz.1.974': attribute type 23 has an invalid length. [ 393.865572][ T9951] xt_NFQUEUE: number of total queues is 0 [ 393.933739][ T9938] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 394.005272][ T9938] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 394.068630][ T9103] usb 5-1: USB disconnect, device number 64 [ 394.173366][ T6952] usb 3-1: USB disconnect, device number 50 [ 395.584012][ T6952] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 395.744193][ T6952] usb 3-1: Using ep0 maxpacket: 32 [ 395.760474][ T6952] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 395.787048][ T6952] usb 3-1: New USB device found, idVendor=08ca, idProduct=2060, bcdDevice=c6.58 [ 395.807117][ T6952] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.834122][ T6952] usb 3-1: Product: syz [ 395.838711][ T6952] usb 3-1: Manufacturer: syz [ 395.843641][ T6952] usb 3-1: SerialNumber: syz [ 395.896006][ T6952] usb 3-1: config 0 descriptor?? [ 395.916194][ T6952] gspca_main: sunplus-2.14.0 probing 08ca:2060 [ 396.110595][ T6952] gspca_sunplus: reg_r err -32 [ 396.326774][T10000] netlink: 92 bytes leftover after parsing attributes in process `syz.3.986'. [ 396.462439][T10003] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 396.787657][T10010] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.851047][T10010] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.887166][T10010] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.904161][T10010] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.940957][T10010] geneve2: entered promiscuous mode [ 396.963944][T10010] geneve2: entered allmulticast mode [ 397.104054][ T6952] sunplus 3-1:0.0: probe with driver sunplus failed with error -32 [ 397.633282][T10015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 397.664632][T10015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 398.554997][ T43] usb 3-1: USB disconnect, device number 51 [ 398.595812][T10028] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 398.634635][T10028] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 399.724212][T10038] netlink: 'syz.0.991': attribute type 7 has an invalid length. [ 399.832119][T10040] nvme_fabrics: unknown parameter or missing value '#! ./file0 xfrm0' in ctrl creation request [ 399.894971][T10040] nvme_fabrics: unknown parameter or missing value ':syz1:E:18446744073709551615:\:' in ctrl creation request [ 400.008314][T10038] : entered promiscuous mode [ 400.875590][T10033] syz.0.991 (10033): drop_caches: 2 [ 400.884249][ T6952] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 401.067729][ T6952] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 401.084416][ T6952] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 401.095792][T10064] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 401.112305][ T6952] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 401.112345][ T6952] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 401.112368][ T6952] usb 5-1: SerialNumber: syz [ 401.131402][T10064] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 401.449858][ T6952] usb 5-1: 0:2 : does not exist [ 401.517511][ T6952] usb 5-1: USB disconnect, device number 65 [ 401.562018][T10071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 401.564063][T10071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 401.625458][T10071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 401.626733][T10071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 401.706905][ T5988] udevd[5988]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 402.068447][T10082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 402.068732][T10082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 403.523239][T10077] [U]  [ 404.174024][ T43] usb 5-1: new full-speed USB device number 66 using dummy_hcd [ 404.336449][ T43] usb 5-1: unable to get BOS descriptor or descriptor too short [ 404.365283][ T43] usb 5-1: not running at top speed; connect to a high speed hub [ 404.414689][ T43] usb 5-1: config 1 has an invalid descriptor of length 126, skipping remainder of the config [ 404.444029][ T43] usb 5-1: config 1 interface 0 altsetting 129 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 404.504253][ T43] usb 5-1: config 1 interface 0 has no altsetting 0 [ 404.530242][ T43] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 404.544503][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 404.578378][ T43] usb 5-1: Product: syz [ 404.582621][ T43] usb 5-1: Manufacturer: 줥뫪ﾅ勧ïªë¼•â±¶í‹‘럈欈瀌ⲮԆ漅ê±ë°ì€›ì³˜éš£äꙭᦇ닚ฤ䱺邲ꘃꈹ嵒䴊ç£ï³°â¡¶ã¤šÕ‘z [ 404.627584][ T43] usb 5-1: SerialNumber: syz [ 404.906927][T10104] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 404.977700][ T43] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 405.015445][ T43] usb 5-1: USB disconnect, device number 66 [ 405.060760][T10114] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1018'. [ 405.100993][T10107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 405.115386][T10107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 405.274016][ T5940] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 405.431152][ T5940] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 405.442575][ T5940] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 405.459960][ T5940] usb 3-1: New USB device found, idVendor=1044, idProduct=7a4d, bcdDevice= 0.00 [ 405.470806][ T5940] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.487234][ T5940] usb 3-1: config 0 descriptor?? [ 405.946418][ T5940] waterforce 0003:1044:7A4D.000E: hidraw0: USB HID v0.00 Device [HID 1044:7a4d] on usb-dummy_hcd.2-1/input0 [ 406.003692][T10124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 406.035035][ T5940] waterforce 0003:1044:7A4D.000E: fw version request failed with -38 [ 406.044246][T10124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 406.119181][ T5940] usb 3-1: USB disconnect, device number 52 [ 406.259827][T10122] fido_id[10122]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 409.154785][T10155] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1028'. [ 409.154807][T10156] fuse: Unknown parameter 'àu>Ñ™5¶ð4ñfd<4ȱþI­õÚ" \÷­è¢‹àð‹^ªXlYØlvÀ¼¼f²fM(L»Èk½JzŸ¿ø¥ÿw‡*ÝüéÑ0x0000000000000003' [ 409.177793][T10155] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1028'. [ 409.659997][T10164] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.699626][T10164] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.813083][T10162] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.826939][T10168] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1031'. [ 409.836057][T10162] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.843084][T10162] netlink: 156 bytes leftover after parsing attributes in process `syz.1.1029'. [ 409.935673][T10168] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 409.946371][T10168] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 409.985758][T10168] bridge0: port 3(netdevsim0) entered disabled state [ 410.034734][T10168] bridge_slave_1: left allmulticast mode [ 410.040645][T10168] bridge_slave_1: left promiscuous mode [ 410.065727][T10168] bridge0: port 2(bridge_slave_1) entered disabled state [ 410.132487][T10168] bridge_slave_0: left allmulticast mode [ 410.148791][T10168] bridge_slave_0: left promiscuous mode [ 410.155172][T10168] bridge0: port 1(bridge_slave_0) entered disabled state [ 411.141260][T10201] FAULT_INJECTION: forcing a failure. [ 411.141260][T10201] name failslab, interval 1, probability 0, space 0, times 1 [ 411.204247][T10201] CPU: 0 UID: 0 PID: 10201 Comm: syz.0.1039 Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 411.204280][T10201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 411.204303][T10201] Call Trace: [ 411.204312][T10201] [ 411.204322][T10201] dump_stack_lvl+0x189/0x250 [ 411.204354][T10201] ? __pfx____ratelimit+0x10/0x10 [ 411.204389][T10201] ? __pfx_dump_stack_lvl+0x10/0x10 [ 411.204415][T10201] ? __pfx__printk+0x10/0x10 [ 411.204458][T10201] ? __pfx___might_resched+0x10/0x10 [ 411.204483][T10201] ? fs_reclaim_acquire+0x7d/0x100 [ 411.204519][T10201] should_fail_ex+0x414/0x560 [ 411.204556][T10201] should_failslab+0xa8/0x100 [ 411.204586][T10201] kmem_cache_alloc_noprof+0x73/0x3c0 [ 411.204611][T10201] ? __pmd_alloc+0xc6/0x3b0 [ 411.204639][T10201] __pmd_alloc+0xc6/0x3b0 [ 411.204668][T10201] __handle_mm_fault+0xa63/0x5620 [ 411.204704][T10201] ? mt_find+0x46f/0x5f0 [ 411.204731][T10201] ? __pfx___handle_mm_fault+0x10/0x10 [ 411.204779][T10201] ? find_vma+0xe7/0x160 [ 411.204803][T10201] ? __pfx_find_vma+0x10/0x10 [ 411.204831][T10201] handle_mm_fault+0x40a/0x8e0 [ 411.204867][T10201] do_user_addr_fault+0x764/0x1390 [ 411.204906][T10201] exc_page_fault+0x76/0xf0 [ 411.204943][T10201] asm_exc_page_fault+0x26/0x30 [ 411.204968][T10201] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 411.204996][T10201] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 7d 00 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 411.205015][T10201] RSP: 0018:ffffc9001af0fad8 EFLAGS: 00050202 [ 411.205036][T10201] RAX: 00007ffffffff001 RBX: 0000000000000018 RCX: 0000000000000018 [ 411.205050][T10201] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: ffffc9001af0fb60 [ 411.205064][T10201] RBP: ffffc9001af0fd38 R08: ffffc9001af0fb77 R09: 1ffff920035e1f6e [ 411.205079][T10201] R10: dffffc0000000000 R11: fffff520035e1f6f R12: 0000000000000018 [ 411.205094][T10201] R13: dffffc0000000000 R14: ffffc9001af0fb60 R15: 00002000000000c0 [ 411.205130][T10201] _copy_from_user+0x7a/0xb0 [ 411.205157][T10201] do_ip_vs_set_ctl+0x2d3/0xa60 [ 411.205197][T10201] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 411.205227][T10201] ? rcu_is_watching+0x15/0xb0 [ 411.205275][T10201] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 411.205304][T10201] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 411.205325][T10201] ? aa_sk_perm+0x81e/0x950 [ 411.205360][T10201] ? __pfx_aa_sk_perm+0x10/0x10 [ 411.205397][T10201] nf_setsockopt+0x26f/0x290 [ 411.205434][T10201] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 411.205460][T10201] do_sock_setsockopt+0x25a/0x3e0 [ 411.205491][T10201] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 411.205523][T10201] ? __fget_files+0x2a/0x420 [ 411.205562][T10201] __x64_sys_setsockopt+0x18b/0x220 [ 411.205596][T10201] do_syscall_64+0xfa/0x3b0 [ 411.205617][T10201] ? lockdep_hardirqs_on+0x9c/0x150 [ 411.205650][T10201] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.205671][T10201] ? clear_bhb_loop+0x60/0xb0 [ 411.205697][T10201] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.205717][T10201] RIP: 0033:0x7fcf4ad8e929 [ 411.205736][T10201] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 411.205754][T10201] RSP: 002b:00007fcf4bc70038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 411.205774][T10201] RAX: ffffffffffffffda RBX: 00007fcf4afb5fa0 RCX: 00007fcf4ad8e929 [ 411.205790][T10201] RDX: 000000000000048b RSI: 0000000000000000 RDI: 0000000000000003 [ 411.205803][T10201] RBP: 00007fcf4bc70090 R08: 0000000000000018 R09: 0000000000000000 [ 411.205816][T10201] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 411.205830][T10201] R13: 0000000000000000 R14: 00007fcf4afb5fa0 R15: 00007fcf4b0dfa28 [ 411.205864][T10201] [ 412.069996][T10213] veth2: entered promiscuous mode [ 412.075552][T10213] veth2: entered allmulticast mode [ 412.138427][T10217] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 412.145049][T10217] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 412.176362][T10217] vhci_hcd vhci_hcd.0: Device attached [ 412.274869][T10224] trusted_key: encrypted_key: insufficient parameters specified [ 412.354033][ T5940] vhci_hcd: vhci_device speed not set [ 412.397952][T10227] tipc: Enabled bearer , priority 10 [ 412.428282][T10227] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1043'. [ 412.438108][ T5940] usb 37-1: new full-speed USB device number 2 using vhci_hcd [ 412.533977][T10227] tipc: Disabling bearer [ 412.726969][T10234] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 412.814430][T10234] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 412.872085][T10234] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.034413][T10234] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.123627][T10218] vhci_hcd: connection reset by peer [ 413.197457][ T49] vhci_hcd: stop threads [ 413.202065][ T49] vhci_hcd: release socket [ 413.392173][ T49] vhci_hcd: disconnect device [ 413.888976][T10242] FAULT_INJECTION: forcing a failure. [ 413.888976][T10242] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 414.013966][T10242] CPU: 1 UID: 0 PID: 10242 Comm: syz.4.1050 Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 414.014004][T10242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 414.014023][T10242] Call Trace: [ 414.014032][T10242] [ 414.014041][T10242] dump_stack_lvl+0x189/0x250 [ 414.014079][T10242] ? __pfx____ratelimit+0x10/0x10 [ 414.014128][T10242] ? __pfx_dump_stack_lvl+0x10/0x10 [ 414.014161][T10242] ? __pfx__printk+0x10/0x10 [ 414.014192][T10242] ? fs_reclaim_acquire+0x7d/0x100 [ 414.014232][T10242] should_fail_ex+0x414/0x560 [ 414.014270][T10242] prepare_alloc_pages+0x213/0x610 [ 414.014310][T10242] __alloc_frozen_pages_noprof+0x123/0x370 [ 414.014359][T10242] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 414.014396][T10242] ? __lock_acquire+0xab9/0xd20 [ 414.014430][T10242] alloc_pages_mpol+0x232/0x4a0 [ 414.014464][T10242] alloc_pages_noprof+0xa9/0x190 [ 414.014494][T10242] pte_alloc_one+0x21/0x170 [ 414.014521][T10242] __pte_alloc+0x25/0x1a0 [ 414.014556][T10242] __handle_mm_fault+0x4b8a/0x5620 [ 414.014604][T10242] ? __pfx___handle_mm_fault+0x10/0x10 [ 414.014652][T10242] ? find_vma+0xe7/0x160 [ 414.014677][T10242] ? __pfx_find_vma+0x10/0x10 [ 414.014705][T10242] handle_mm_fault+0x40a/0x8e0 [ 414.014741][T10242] do_user_addr_fault+0x764/0x1390 [ 414.014780][T10242] exc_page_fault+0x76/0xf0 [ 414.014817][T10242] asm_exc_page_fault+0x26/0x30 [ 414.014837][T10242] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 414.014866][T10242] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 7d 00 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 414.014885][T10242] RSP: 0018:ffffc9000e987ad8 EFLAGS: 00050202 [ 414.014905][T10242] RAX: 00007ffffffff001 RBX: 0000000000000018 RCX: 0000000000000018 [ 414.014920][T10242] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: ffffc9000e987b60 [ 414.014935][T10242] RBP: ffffc9000e987d38 R08: ffffc9000e987b77 R09: 1ffff92001d30f6e [ 414.014951][T10242] R10: dffffc0000000000 R11: fffff52001d30f6f R12: 0000000000000018 [ 414.014966][T10242] R13: dffffc0000000000 R14: ffffc9000e987b60 R15: 00002000000000c0 [ 414.015009][T10242] _copy_from_user+0x7a/0xb0 [ 414.015037][T10242] do_ip_vs_set_ctl+0x2d3/0xa60 [ 414.015078][T10242] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 414.015108][T10242] ? rcu_is_watching+0x15/0xb0 [ 414.015162][T10242] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 414.015192][T10242] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 414.015213][T10242] ? aa_sk_perm+0x81e/0x950 [ 414.015249][T10242] ? __pfx_aa_sk_perm+0x10/0x10 [ 414.015287][T10242] nf_setsockopt+0x26f/0x290 [ 414.015320][T10242] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 414.015355][T10242] do_sock_setsockopt+0x25a/0x3e0 [ 414.015386][T10242] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 414.015425][T10242] ? __fget_files+0x2a/0x420 [ 414.015463][T10242] __x64_sys_setsockopt+0x18b/0x220 [ 414.015499][T10242] do_syscall_64+0xfa/0x3b0 [ 414.015518][T10242] ? lockdep_hardirqs_on+0x9c/0x150 [ 414.015552][T10242] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.015573][T10242] ? clear_bhb_loop+0x60/0xb0 [ 414.015600][T10242] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.015621][T10242] RIP: 0033:0x7f25df38e929 [ 414.015639][T10242] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 414.015657][T10242] RSP: 002b:00007f25e01aa038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 414.015678][T10242] RAX: ffffffffffffffda RBX: 00007f25df5b5fa0 RCX: 00007f25df38e929 [ 414.015694][T10242] RDX: 000000000000048b RSI: 0000000000000000 RDI: 0000000000000003 [ 414.015707][T10242] RBP: 00007f25e01aa090 R08: 0000000000000018 R09: 0000000000000000 [ 414.015720][T10242] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 414.015733][T10242] R13: 0000000000000000 R14: 00007f25df5b5fa0 R15: 00007f25df6dfa28 [ 414.015766][T10242] [ 414.597234][T10250] cifs: Unknown parameter '¬¹mŸhpZw öÙ¦j™ˆÁ' [ 414.615666][T10250] binder: 10246:10250 ioctl c0306201 200000000080 returned -14 [ 414.627076][T10250] binder: 10246:10250 ioctl c0306201 2000000000c0 returned -14 [ 414.677031][T10247] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1048'. [ 414.686484][T10247] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1048'. [ 414.766636][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 414.766656][ T30] audit: type=1800 audit(1752260070.284:3033): pid=10257 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1053" name="/" dev="fuse" ino=1 res=0 errno=0 [ 415.012357][T10268] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1055'. [ 415.130124][T10274] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.151910][T10274] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.444759][T10284] IPVS: sync thread started: state = MASTER, mcast_ifn = ip6tnl0, syncid = 3, id = 0 [ 416.724445][T10258] Bluetooth: hci4: command 0x0405 tx timeout [ 416.879681][T10297] loop2: detected capacity change from 0 to 14 [ 416.911809][T10297] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 416.926164][T10297] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 417.214311][ T1209] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 417.376113][ T1209] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 417.387930][ T1209] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 417.399084][ T1209] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8D has invalid maxpacket 59391, setting to 1024 [ 417.410566][ T1209] usb 3-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 417.419831][ T1209] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 417.430603][ T1209] usb 3-1: config 0 descriptor?? [ 417.438125][T10300] raw-gadget.5 gadget.2: fail, usb_ep_enable returned -22 [ 417.449872][ T1209] gspca_main: spca561-2.14.0 probing abcd:cdee [ 417.514064][ T5940] vhci_hcd: vhci_device speed not set [ 417.651057][ T1209] spca561 3-1:0.0: probe with driver spca561 failed with error -22 [ 417.673357][ T1209] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 417.692551][ T1209] usb 3-1: MIDIStreaming interface descriptor not found [ 417.805740][ T1209] usb 3-1: USB disconnect, device number 53 [ 417.844897][T10304] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1064'. [ 419.107543][T10329] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.118728][T10329] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.130029][T10329] netlink: 'syz.3.1069': attribute type 30 has an invalid length. [ 419.138307][T10329] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1069'. [ 419.244064][T10334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.275006][T10334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 421.034197][ T1209] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 421.194091][ T1209] usb 3-1: Using ep0 maxpacket: 8 [ 421.208416][ T1209] usb 3-1: unable to get BOS descriptor or descriptor too short [ 421.223039][ T1209] usb 3-1: config 4 interface 0 has no altsetting 0 [ 421.236100][ T1209] usb 3-1: string descriptor 0 read error: -22 [ 421.242755][ T1209] usb 3-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 421.256782][ T1209] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 421.324522][ T1209] usb 3-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 421.351369][ T1209] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 421.390638][ T1209] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 421.421502][ T1209] usb 3-1: media controller created [ 421.500536][ T1209] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 421.960669][ T30] audit: type=1326 audit(1752260077.474:3034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10370 comm="syz.0.1080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf4ad8e929 code=0x7ffc0000 [ 422.055219][ T30] audit: type=1326 audit(1752260077.504:3035): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10370 comm="syz.0.1080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf4ad8e929 code=0x7ffc0000 [ 422.096971][ T30] audit: type=1326 audit(1752260077.504:3036): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10370 comm="syz.0.1080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7fcf4ad8e929 code=0x7ffc0000 [ 422.151621][ T30] audit: type=1326 audit(1752260077.504:3037): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10370 comm="syz.0.1080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf4ad8e929 code=0x7ffc0000 [ 422.183606][ T30] audit: type=1326 audit(1752260077.504:3038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10370 comm="syz.0.1080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf4ad8e929 code=0x7ffc0000 [ 422.397799][ T30] audit: type=1326 audit(1752260077.514:3039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10370 comm="syz.0.1080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fcf4ad8e929 code=0x7ffc0000 [ 422.431094][ T30] audit: type=1326 audit(1752260077.514:3040): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10370 comm="syz.0.1080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf4ad8e929 code=0x7ffc0000 [ 422.454289][ T30] audit: type=1326 audit(1752260077.514:3041): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10370 comm="syz.0.1080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf4ad8e929 code=0x7ffc0000 [ 422.477660][ T30] audit: type=1326 audit(1752260077.514:3042): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10370 comm="syz.0.1080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fcf4ad8e929 code=0x7ffc0000 [ 422.504083][ T30] audit: type=1326 audit(1752260077.514:3043): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10370 comm="syz.0.1080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf4ad8e929 code=0x7ffc0000 [ 422.616770][ T1209] zl10353_read_register: readreg error (reg=127, ret==0) [ 422.847370][T10382] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1083'. [ 422.938110][T10373] pim6reg: entered allmulticast mode [ 422.955920][T10373] pim6reg: left allmulticast mode [ 423.018373][T10383] ptrace attach of "./syz-executor exec"[5868] was attempted by "./syz-executor exec"[10383] [ 423.030247][T10383] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1079'. [ 423.829076][ T43] usb 3-1: USB disconnect, device number 54 [ 424.079551][T10406] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 424.106441][T10406] netlink: 'syz.0.1089': attribute type 1 has an invalid length. [ 424.144177][T10406] netlink: 168864 bytes leftover after parsing attributes in process `syz.0.1089'. [ 424.545483][T10410] netlink: 'syz.0.1090': attribute type 1 has an invalid length. [ 424.558134][T10410] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1090'. [ 425.064264][ T43] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 425.194298][T10428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 425.204859][T10428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 425.238207][T10426] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1095'. [ 425.285290][ T43] usb 3-1: too many configurations: 156, using maximum allowed: 8 [ 425.302525][ T43] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 425.316574][ T43] usb 3-1: can't read configurations, error -61 [ 425.399681][T10431] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 425.413479][T10431] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 425.442337][T10430] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1096'. [ 425.474047][ T43] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 425.474782][T10430] pimreg: entered allmulticast mode [ 425.654873][ T43] usb 3-1: too many configurations: 156, using maximum allowed: 8 [ 425.669406][ T43] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 425.682783][ T43] usb 3-1: can't read configurations, error -61 [ 425.696234][ T43] usb usb3-port1: attempt power cycle [ 425.778743][T10433] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1097'. [ 425.804036][ T977] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 425.824785][ T977] hid-generic 0000:0000:0000.000F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 425.986093][T10436] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1098'. [ 426.033983][ T43] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 426.075146][ T43] usb 3-1: too many configurations: 156, using maximum allowed: 8 [ 426.091992][T10438] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1099'. [ 426.095346][ T43] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 426.118636][ T43] usb 3-1: can't read configurations, error -61 [ 426.204792][T10441] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 426.223712][T10441] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 426.264325][ T43] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 426.286452][ T43] usb 3-1: too many configurations: 156, using maximum allowed: 8 [ 426.305792][ T43] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 426.313440][ T43] usb 3-1: can't read configurations, error -61 [ 426.329202][ T43] usb usb3-port1: unable to enumerate USB device [ 426.424066][ T9103] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 426.584191][ T9103] usb 5-1: Using ep0 maxpacket: 32 [ 426.592234][ T9103] usb 5-1: config 0 interface 0 has no altsetting 0 [ 426.602332][ T9103] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 426.612611][ T9103] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.625997][ T9103] usb 5-1: Product: syz [ 426.630407][ T9103] usb 5-1: Manufacturer: syz [ 426.635427][ T9103] usb 5-1: SerialNumber: syz [ 426.644514][ T9103] usb 5-1: config 0 descriptor?? [ 426.856374][ T9103] gs_usb 5-1:0.0: Couldn't get device config: (err=-32) [ 426.864075][ T9103] gs_usb 5-1:0.0: probe with driver gs_usb failed with error -32 [ 428.052650][T10464] kvm: user requested TSC rate below hardware speed [ 428.324947][ T5940] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 428.524299][ T5940] usb 3-1: device descriptor read/64, error -71 [ 428.774270][ T5940] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 428.924196][ T5940] usb 3-1: device descriptor read/64, error -71 [ 429.044813][ T5940] usb usb3-port1: attempt power cycle [ 429.221099][ T43] usb 5-1: USB disconnect, device number 67 [ 429.249387][T10485] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.300656][T10485] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.394150][ T5940] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 429.444774][ T5940] usb 3-1: device descriptor read/8, error -71 [ 429.662625][ T30] kauditd_printk_skb: 34 callbacks suppressed [ 429.662648][ T30] audit: type=1326 audit(1752260085.114:3078): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10490 comm="syz.1.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 429.753822][ T30] audit: type=1326 audit(1752260085.114:3079): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10490 comm="syz.1.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f910438e52b code=0x7ffc0000 [ 429.764070][ T5940] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 429.800692][ T30] audit: type=1326 audit(1752260085.114:3080): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10490 comm="syz.1.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 429.827859][T10498] FAULT_INJECTION: forcing a failure. [ 429.827859][T10498] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 429.851637][T10498] CPU: 1 UID: 0 PID: 10498 Comm: syz.4.1116 Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 429.851661][T10498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 429.851671][T10498] Call Trace: [ 429.851677][T10498] [ 429.851684][T10498] dump_stack_lvl+0x189/0x250 [ 429.851708][T10498] ? __pfx____ratelimit+0x10/0x10 [ 429.851733][T10498] ? __pfx_dump_stack_lvl+0x10/0x10 [ 429.851751][T10498] ? __pfx__printk+0x10/0x10 [ 429.851781][T10498] should_fail_ex+0x414/0x560 [ 429.851807][T10498] _copy_from_user+0x2d/0xb0 [ 429.851826][T10498] copy_from_sockptr+0x48/0x70 [ 429.851850][T10498] raw_setsockopt+0x596/0x1160 [ 429.851872][T10498] ? __pfx_aa_sk_perm+0x10/0x10 [ 429.851893][T10498] ? __pfx_raw_setsockopt+0x10/0x10 [ 429.851919][T10498] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 429.851941][T10498] ? __pfx_raw_setsockopt+0x10/0x10 [ 429.851962][T10498] do_sock_setsockopt+0x25a/0x3e0 [ 429.851988][T10498] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 429.852010][T10498] ? __fget_files+0x2a/0x420 [ 429.852036][T10498] __x64_sys_setsockopt+0x18b/0x220 [ 429.852060][T10498] do_syscall_64+0xfa/0x3b0 [ 429.852074][T10498] ? lockdep_hardirqs_on+0x9c/0x150 [ 429.852097][T10498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.852112][T10498] ? clear_bhb_loop+0x60/0xb0 [ 429.852130][T10498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.852148][T10498] RIP: 0033:0x7f25df38e929 [ 429.852162][T10498] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 429.852175][T10498] RSP: 002b:00007f25e01aa038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 429.852191][T10498] RAX: ffffffffffffffda RBX: 00007f25df5b5fa0 RCX: 00007f25df38e929 [ 429.852202][T10498] RDX: 0000000000000001 RSI: 0000000000000065 RDI: 0000000000000003 [ 429.852210][T10498] RBP: 00007f25e01aa090 R08: 0000000000000008 R09: 0000000000000000 [ 429.852220][T10498] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000001 [ 429.852229][T10498] R13: 0000000000000000 R14: 00007f25df5b5fa0 R15: 00007f25df6dfa28 [ 429.852251][T10498] [ 430.067020][ T30] audit: type=1326 audit(1752260085.114:3081): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10490 comm="syz.1.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 430.089607][ T30] audit: type=1326 audit(1752260085.114:3082): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10490 comm="syz.1.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 430.116435][ T30] audit: type=1326 audit(1752260085.114:3083): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10490 comm="syz.1.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 430.139286][ T30] audit: type=1326 audit(1752260085.114:3084): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10490 comm="syz.1.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 430.162179][ T30] audit: type=1326 audit(1752260085.114:3085): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10490 comm="syz.1.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f9104390847 code=0x7ffc0000 [ 430.172786][ T5940] usb 3-1: device descriptor read/8, error -71 [ 430.185341][ T30] audit: type=1326 audit(1752260085.114:3086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10490 comm="syz.1.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f91043907bc code=0x7ffc0000 [ 430.185399][ T30] audit: type=1326 audit(1752260085.114:3087): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10490 comm="syz.1.1114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f91043906f4 code=0x7ffc0000 [ 430.433436][T10500] netlink: 'syz.3.1118': attribute type 10 has an invalid length. [ 430.441906][T10500] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1118'. [ 430.458829][T10500] bridge0: port 4(dummy0) entered blocking state [ 430.468529][T10500] bridge0: port 4(dummy0) entered disabled state [ 430.475909][ T5940] usb usb3-port1: unable to enumerate USB device [ 430.484645][T10500] dummy0: entered allmulticast mode [ 430.502486][T10500] dummy0: entered promiscuous mode [ 430.663566][T10510] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 430.732506][T10511] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 430.909304][T10510] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.948855][T10511] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.949296][T10510] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.961478][T10511] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 431.424913][ T1209] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 431.640233][ T1209] usb 3-1: Using ep0 maxpacket: 8 [ 431.709538][ T1209] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 431.778244][ T1209] usb 3-1: can't read configurations, error -61 [ 431.918352][T10527] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1124'. [ 431.965945][ T1209] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 432.021017][T10527] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1124'. [ 432.066883][T10533] FAULT_INJECTION: forcing a failure. [ 432.066883][T10533] name failslab, interval 1, probability 0, space 0, times 0 [ 432.084031][T10533] CPU: 0 UID: 0 PID: 10533 Comm: syz.0.1127 Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 432.084062][T10533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 432.084075][T10533] Call Trace: [ 432.084083][T10533] [ 432.084091][T10533] dump_stack_lvl+0x189/0x250 [ 432.084121][T10533] ? __pfx____ratelimit+0x10/0x10 [ 432.084155][T10533] ? __pfx_dump_stack_lvl+0x10/0x10 [ 432.084182][T10533] ? __pfx__printk+0x10/0x10 [ 432.084223][T10533] ? __pfx___might_resched+0x10/0x10 [ 432.084248][T10533] ? fs_reclaim_acquire+0x7d/0x100 [ 432.084283][T10533] should_fail_ex+0x414/0x560 [ 432.084321][T10533] should_failslab+0xa8/0x100 [ 432.084351][T10533] kmem_cache_alloc_noprof+0x73/0x3c0 [ 432.084374][T10533] ? can_rx_register+0x16d/0x790 [ 432.084407][T10533] can_rx_register+0x16d/0x790 [ 432.084434][T10533] ? __local_bh_enable_ip+0x12d/0x1c0 [ 432.084456][T10533] ? __pfx_raw_rcv+0x10/0x10 [ 432.084485][T10533] raw_enable_filters+0x98/0x200 [ 432.084511][T10533] raw_setsockopt+0xbd4/0x1160 [ 432.084535][T10533] ? __pfx_aa_sk_perm+0x10/0x10 [ 432.084556][T10533] ? __pfx_raw_setsockopt+0x10/0x10 [ 432.084583][T10533] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 432.084606][T10533] ? __pfx_raw_setsockopt+0x10/0x10 [ 432.084628][T10533] do_sock_setsockopt+0x25a/0x3e0 [ 432.084651][T10533] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 432.084673][T10533] ? __fget_files+0x2a/0x420 [ 432.084702][T10533] __x64_sys_setsockopt+0x18b/0x220 [ 432.084727][T10533] do_syscall_64+0xfa/0x3b0 [ 432.084742][T10533] ? lockdep_hardirqs_on+0x9c/0x150 [ 432.084765][T10533] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.084780][T10533] ? clear_bhb_loop+0x60/0xb0 [ 432.084798][T10533] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.084813][T10533] RIP: 0033:0x7fcf4ad8e929 [ 432.084828][T10533] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 432.084842][T10533] RSP: 002b:00007fcf4bc70038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 432.084857][T10533] RAX: ffffffffffffffda RBX: 00007fcf4afb5fa0 RCX: 00007fcf4ad8e929 [ 432.084868][T10533] RDX: 0000000000000001 RSI: 0000000000000065 RDI: 0000000000000003 [ 432.084877][T10533] RBP: 00007fcf4bc70090 R08: 0000000000000008 R09: 0000000000000000 [ 432.084886][T10533] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000001 [ 432.084897][T10533] R13: 0000000000000000 R14: 00007fcf4afb5fa0 R15: 00007fcf4b0dfa28 [ 432.084921][T10533] [ 432.424132][ T1209] usb 3-1: Using ep0 maxpacket: 8 [ 432.432294][ T1209] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 432.446654][ T1209] usb 3-1: can't read configurations, error -61 [ 432.454711][ T1209] usb usb3-port1: attempt power cycle [ 432.854074][ T1209] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 432.888323][ T1209] usb 3-1: Using ep0 maxpacket: 8 [ 432.917594][ T1209] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 432.936549][ T1209] usb 3-1: can't read configurations, error -61 [ 433.009669][T10557] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 433.039776][T10557] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 433.093970][ T1209] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 433.124802][ T1209] usb 3-1: Using ep0 maxpacket: 8 [ 433.151860][ T1209] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 433.173382][ T1209] usb 3-1: can't read configurations, error -61 [ 433.213744][ T1209] usb usb3-port1: unable to enumerate USB device [ 434.983157][T10591] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 435.006386][T10591] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 435.224538][ T6952] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 435.524293][ T1209] usb 5-1: new low-speed USB device number 68 using dummy_hcd [ 435.674059][ T1209] usb 5-1: Invalid ep0 maxpacket: 16 [ 435.803970][ T1209] usb 5-1: new low-speed USB device number 69 using dummy_hcd [ 435.983968][ T1209] usb 5-1: Invalid ep0 maxpacket: 16 [ 435.989809][ T1209] usb usb5-port1: attempt power cycle [ 436.353978][ T1209] usb 5-1: new low-speed USB device number 70 using dummy_hcd [ 436.374736][ T1209] usb 5-1: Invalid ep0 maxpacket: 16 [ 436.464720][ T6952] usb 3-1: device descriptor read/64, error -71 [ 436.504311][ T1209] usb 5-1: new low-speed USB device number 71 using dummy_hcd [ 436.542763][ T1209] usb 5-1: Invalid ep0 maxpacket: 16 [ 436.543573][T10615] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.550501][ T1209] usb usb5-port1: unable to enumerate USB device [ 436.564288][T10615] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.600552][T10615] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.610658][T10615] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.679010][T10617] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.689783][T10617] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.704082][ T6952] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 436.870398][ T6952] usb 3-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 436.880075][ T6952] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.888658][ T6952] usb 3-1: Product: syz [ 436.893117][ T6952] usb 3-1: Manufacturer: syz [ 436.899324][ T6952] usb 3-1: SerialNumber: syz [ 436.907625][ T6952] usb 3-1: config 0 descriptor?? [ 436.921596][ T6952] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 437.118955][ T6952] gspca_sunplus: reg_r err -71 [ 437.165672][ T6952] usb 3-1: USB disconnect, device number 68 [ 437.532153][T10628] netlink: 'syz.1.1153': attribute type 15 has an invalid length. [ 437.548093][T10628] netlink: 666 bytes leftover after parsing attributes in process `syz.1.1153'. [ 437.921752][T10631] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 437.972082][T10631] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 438.422880][T10640] netlink: 'syz.4.1156': attribute type 29 has an invalid length. [ 438.453651][T10640] netlink: 'syz.4.1156': attribute type 29 has an invalid length. [ 438.467462][T10640] netlink: 500 bytes leftover after parsing attributes in process `syz.4.1156'. [ 438.856318][T10650] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 438.865283][T10650] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1159'. [ 439.067355][T10658] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 440.003803][ T977] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 440.347467][ T977] usb 5-1: config 0 has no interfaces? [ 440.356630][ T977] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 440.365975][ T977] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.399840][ T977] usb 5-1: Product: syz [ 440.408444][ T977] usb 5-1: Manufacturer: syz [ 440.413409][ T977] usb 5-1: SerialNumber: syz [ 440.435621][ T977] usb 5-1: config 0 descriptor?? [ 440.885420][T10677] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1164'. [ 441.874317][ T43] usb 3-1: new low-speed USB device number 69 using dummy_hcd [ 442.024120][ T43] usb 3-1: Invalid ep0 maxpacket: 16 [ 442.213992][ T43] usb 3-1: new low-speed USB device number 70 using dummy_hcd [ 442.347926][T10698] netlink: 'syz.1.1172': attribute type 1 has an invalid length. [ 442.381189][T10698] bond3: entered promiscuous mode [ 442.396744][ T43] usb 3-1: Invalid ep0 maxpacket: 16 [ 442.412918][T10698] 8021q: adding VLAN 0 to HW filter on device bond3 [ 442.445678][ T43] usb usb3-port1: attempt power cycle [ 442.804207][ T43] usb 3-1: new low-speed USB device number 71 using dummy_hcd [ 442.826448][ T43] usb 3-1: Invalid ep0 maxpacket: 16 [ 442.827303][T10708] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1175'. [ 442.841437][T10708] netlink: 1 bytes leftover after parsing attributes in process `syz.1.1175'. [ 442.961767][T10708] netlink: 'syz.1.1175': attribute type 21 has an invalid length. [ 442.964108][ T43] usb 3-1: new low-speed USB device number 72 using dummy_hcd [ 442.970694][T10708] IPv6: NLM_F_CREATE should be specified when creating new route [ 442.990124][T10708] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 442.997639][T10708] IPv6: NLM_F_CREATE should be set when creating new route [ 443.005078][T10708] IPv6: NLM_F_CREATE should be set when creating new route [ 443.007681][ T43] usb 3-1: Invalid ep0 maxpacket: 16 [ 443.012513][T10708] IPv6: NLM_F_CREATE should be set when creating new route [ 443.026488][ T43] usb usb3-port1: unable to enumerate USB device [ 443.117073][T10711] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 443.131023][T10712] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 443.131194][T10711] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 443.149956][T10712] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 443.456236][T10714] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 443.468418][T10714] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 443.630123][ T43] usb 5-1: USB disconnect, device number 72 [ 445.314601][T10734] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 445.321202][T10734] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 445.339140][T10735] vhci_hcd vhci_hcd.0: pdev(0) rhport(1) sockfd(6) [ 445.345822][T10735] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 445.353670][ T43] usb 3-1: new full-speed USB device number 73 using dummy_hcd [ 445.417102][T10735] vhci_hcd vhci_hcd.0: Device attached [ 445.429906][T10734] vhci_hcd vhci_hcd.0: Device attached [ 445.460238][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 445.466983][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 445.529539][ T43] usb 3-1: unable to get BOS descriptor or descriptor too short [ 445.541796][ T43] usb 3-1: not running at top speed; connect to a high speed hub [ 445.553550][T10738] vhci_hcd: connection closed [ 445.553569][ T43] usb 3-1: config 1 has an invalid interface descriptor of length 4, skipping [ 445.570182][ T6178] vhci_hcd: stop threads [ 445.574832][ T6178] vhci_hcd: release socket [ 445.575755][ T43] usb 3-1: config 1 has an invalid descriptor of length 161, skipping remainder of the config [ 445.579594][ T6178] vhci_hcd: disconnect device [ 445.593616][ T43] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 445.654572][T10744] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1183'. [ 445.731577][T10736] vhci_hcd: connection closed [ 445.747925][ T43] usb 3-1: config 1 interface 0 altsetting 2 has an invalid endpoint descriptor of length 2, skipping [ 445.764254][ T6178] vhci_hcd: stop threads [ 445.764276][ T6178] vhci_hcd: release socket [ 445.764376][ T6178] vhci_hcd: disconnect device [ 445.896842][ T43] usb 3-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 446.189826][ T43] usb 3-1: config 1 interface 0 has no altsetting 0 [ 446.209998][ T43] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 446.220491][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 446.229054][ T43] usb 3-1: Product: syz [ 446.234254][ T43] usb 3-1: Manufacturer: syz [ 446.242330][ T43] usb 3-1: SerialNumber: syz [ 448.254119][ T9103] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 448.370112][ T43] usb 3-1: USB disconnect, device number 73 [ 448.495585][ T9103] usb 5-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 448.510447][ T9103] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.525963][ T9103] usb 5-1: Product: syz [ 448.530369][ T9103] usb 5-1: Manufacturer: syz [ 448.538971][ T9103] usb 5-1: SerialNumber: syz [ 448.575030][ T9103] usb 5-1: config 0 descriptor?? [ 448.597064][ T9103] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 449.123345][ T9103] gspca_sunplus: reg_r err -110 [ 449.453361][T10783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 449.670718][T10783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 449.967275][T10801] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 449.986072][T10801] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 450.523547][T10808] input: syz0 as /devices/virtual/input/input24 [ 451.123571][T10821] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 451.140207][T10821] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 451.197823][T10823] sctp: [Deprecated]: syz.2.1205 (pid 10823) Use of int in maxseg socket option. [ 451.197823][T10823] Use struct sctp_assoc_value instead [ 451.227044][T10821] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 451.252498][T10821] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 451.384962][ T1209] usb 5-1: USB disconnect, device number 73 [ 451.554391][ T5940] usb 3-1: new full-speed USB device number 74 using dummy_hcd [ 451.619742][T10836] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 451.631057][T10836] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 451.726635][ T5940] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 451.741701][ T5940] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 451.753829][ T5940] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 451.769222][ T5940] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.785350][ T5940] usb 3-1: config 0 descriptor?? [ 451.805014][ T5940] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 451.817911][ T5940] dvb-usb: bulk message failed: -22 (3/0) [ 451.840663][ T5940] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 451.865760][ T5940] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 451.879995][ T5940] usb 3-1: media controller created [ 451.903470][ T5940] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 451.935882][ T5940] dvb-usb: bulk message failed: -22 (6/0) [ 451.948824][ T1209] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 451.967728][ T5940] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 451.992553][ T5940] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input25 [ 452.020794][ T5940] dvb-usb: schedule remote query interval to 150 msecs. [ 452.043564][ T5940] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 452.154599][ T1209] usb 5-1: Using ep0 maxpacket: 8 [ 452.171431][ T1209] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 452.198785][ T1209] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.206227][T10853] lo: entered promiscuous mode [ 452.208789][ T5940] dvb-usb: bulk message failed: -22 (1/0) [ 452.221186][T10853] tunl0: entered promiscuous mode [ 452.234168][ T1209] usb 5-1: Product: syz [ 452.240661][ T5940] dvb-usb: error while querying for an remote control event. [ 452.241380][T10853] gre0: entered promiscuous mode [ 452.254751][ T1209] usb 5-1: Manufacturer: syz [ 452.264330][ T1209] usb 5-1: SerialNumber: syz [ 452.274982][T10853] gretap0: entered promiscuous mode [ 452.289815][ T1209] usb 5-1: config 0 descriptor?? [ 452.295858][T10853] erspan0: entered promiscuous mode [ 452.312565][T10853] ip_vti0: entered promiscuous mode [ 452.328262][T10853] ip6_vti0: entered promiscuous mode [ 452.344715][T10853] sit0: entered promiscuous mode [ 452.359806][T10853] ip6tnl0: entered promiscuous mode [ 452.367926][T10853] ip6gre0: entered promiscuous mode [ 452.375249][T10853] syz_tun: entered promiscuous mode [ 452.382341][T10853] ip6gretap0: entered promiscuous mode [ 452.391102][T10853] bridge0: port 4(dummy0) entered blocking state [ 452.397757][T10853] bridge0: port 4(dummy0) entered forwarding state [ 452.406125][T10853] bridge0: entered promiscuous mode [ 452.416682][T10853] bond0: entered promiscuous mode [ 452.422022][T10853] bond_slave_0: entered promiscuous mode [ 452.429248][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 452.435890][ T10] dvb-usb: error while querying for an remote control event. [ 452.446140][T10853] bond_slave_1: entered promiscuous mode [ 452.457209][T10853] 8021q: adding VLAN 0 to HW filter on device bond0 [ 452.468264][T10853] 8021q: adding VLAN 0 to HW filter on device team0 [ 452.481430][T10853] nlmon0: entered promiscuous mode [ 452.489276][T10853] caif0: entered promiscuous mode [ 452.495879][T10853] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 452.522484][ T1209] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 452.595018][ T5940] dvb-usb: bulk message failed: -22 (1/0) [ 452.601112][ T5940] dvb-usb: error while querying for an remote control event. [ 452.771070][ T5940] dvb-usb: bulk message failed: -22 (1/0) [ 452.777652][ T5940] dvb-usb: error while querying for an remote control event. [ 452.809638][T10859] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 452.829352][T10859] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 452.944008][ T5940] dvb-usb: bulk message failed: -22 (1/0) [ 452.950281][ T5940] dvb-usb: error while querying for an remote control event. [ 453.126226][ T5940] dvb-usb: bulk message failed: -22 (1/0) [ 453.139065][ T5940] dvb-usb: error while querying for an remote control event. [ 453.304470][ T5940] dvb-usb: bulk message failed: -22 (1/0) [ 453.314777][ T5940] dvb-usb: error while querying for an remote control event. [ 453.476460][ T5940] dvb-usb: bulk message failed: -22 (1/0) [ 453.482977][ T5940] dvb-usb: error while querying for an remote control event. [ 453.644043][ T5940] dvb-usb: bulk message failed: -22 (1/0) [ 453.719553][ T5940] dvb-usb: error while querying for an remote control event. [ 453.882096][T10865] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 453.891994][T10865] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.904592][T10865] random: crng reseeded on system resumption [ 453.910935][ T5940] dvb-usb: bulk message failed: -22 (1/0) [ 453.917892][ T5940] dvb-usb: error while querying for an remote control event. [ 454.084242][ T9103] dvb-usb: bulk message failed: -22 (1/0) [ 454.090292][ T9103] dvb-usb: error while querying for an remote control event. [ 454.274116][ T9103] dvb-usb: bulk message failed: -22 (1/0) [ 454.280002][ T9103] dvb-usb: error while querying for an remote control event. [ 454.316687][T10867] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 454.368508][ T1209] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 454.401556][T10867] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 454.431414][ T1209] usb 5-1: USB disconnect, device number 74 [ 454.440517][T10867] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 454.459634][ T9103] dvb-usb: bulk message failed: -22 (1/0) [ 454.466038][ T9103] dvb-usb: error while querying for an remote control event. [ 454.475169][T10867] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 454.634077][ T9103] dvb-usb: bulk message failed: -22 (1/0) [ 454.639907][ T9103] dvb-usb: error while querying for an remote control event. [ 454.738713][ T6952] usb 3-1: USB disconnect, device number 74 [ 454.769154][ T6952] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 455.280481][T10880] syz.4.1220: attempt to access beyond end of device [ 455.280481][T10880] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 456.743999][ T6952] usb 3-1: new low-speed USB device number 75 using dummy_hcd [ 456.926176][ T6952] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 456.946424][ T6952] usb 3-1: config 0 has no interface number 0 [ 456.952737][ T6952] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 456.990391][ T6952] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 457.005183][ T6952] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 457.016780][ T6952] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 457.039536][ T6952] usb 3-1: config 0 descriptor?? [ 457.050839][T10887] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 457.099717][ T6952] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 457.274985][ T9103] usb 3-1: USB disconnect, device number 75 [ 457.281173][ C0] iowarrior 3-1:0.1: iowarrior_callback - usb_submit_urb failed with result -19 [ 458.589439][ T9103] psmouse serio2: Failed to reset mouse on : -5 [ 458.696647][ T6952] IPVS: starting estimator thread 0... [ 458.713030][T10916] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 458.722126][T10916] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 458.845095][T10915] IPVS: using max 29 ests per chain, 69600 per kthread [ 459.037966][T10925] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 459.050073][T10925] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.753220][T10932] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 459.766350][T10932] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.984167][ T6952] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 460.134074][ T6952] usb 5-1: Using ep0 maxpacket: 32 [ 460.145214][ T6952] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 460.161218][ T6952] usb 5-1: New USB device found, idVendor=0856, idProduct=bc00, bcdDevice=b2.7f [ 460.172006][ T6952] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.184177][ T6952] usb 5-1: Product: syz [ 460.191593][ T6952] usb 5-1: Manufacturer: syz [ 460.210468][ T6952] usb 5-1: SerialNumber: syz [ 460.240022][ T6952] usb 5-1: config 0 descriptor?? [ 460.667440][ T6952] mos7840 5-1:0.0: required endpoints missing [ 460.735179][ T6952] usb 5-1: USB disconnect, device number 75 [ 460.805579][ T977] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 460.975598][ T977] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 129, changing to 11 [ 461.033959][ T977] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 461.071650][ T977] usb 3-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00 [ 461.086751][ T977] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.185762][T10941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 461.200647][ T977] usb 3-1: config 0 descriptor?? [ 461.210037][T10941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 461.238582][T10941] random: crng reseeded on system resumption [ 462.397360][ T977] nintendo 0003:057E:200E.0010: unbalanced delimiter at end of report description [ 462.631415][ T977] nintendo 0003:057E:200E.0010: HID parse failed [ 462.701989][ T977] nintendo 0003:057E:200E.0010: probe - fail = -22 [ 462.790214][ T977] nintendo 0003:057E:200E.0010: probe with driver nintendo failed with error -22 [ 462.938985][T10957] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1239'. [ 462.949882][T10957] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1239'. [ 462.984052][ T9103] misc userio: Buffer overflowed, userio client isn't keeping up [ 463.574213][ T10] usb 3-1: USB disconnect, device number 76 [ 464.039544][ T9103] input: PS/2 Generic Mouse as /devices/serio2/input/input26 [ 464.214155][ T6952] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 464.264079][ T9103] psmouse serio2: Failed to enable mouse on [ 464.344570][ T6952] usb 5-1: device descriptor read/64, error -71 [ 464.664017][ T6952] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 464.865308][ T6952] usb 5-1: device descriptor read/64, error -71 [ 465.094052][ T6952] usb usb5-port1: attempt power cycle [ 465.262516][T10990] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 465.275665][T10990] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 465.443956][ T6952] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 465.466769][ T6952] usb 5-1: device descriptor read/8, error -71 [ 465.479645][T10993] lo: entered allmulticast mode [ 465.634466][T10997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 465.646543][T10997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 465.736302][ T6952] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 465.764738][ T6952] usb 5-1: device descriptor read/8, error -71 [ 465.884596][ T6952] usb usb5-port1: unable to enumerate USB device [ 466.054795][ T43] usb 3-1: new low-speed USB device number 77 using dummy_hcd [ 466.299769][ T43] usb 3-1: Invalid ep0 maxpacket: 16 [ 466.434148][ T43] usb 3-1: new low-speed USB device number 78 using dummy_hcd [ 466.604012][ T43] usb 3-1: Invalid ep0 maxpacket: 16 [ 466.630214][ T43] usb usb3-port1: attempt power cycle [ 466.649978][T11009] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 466.659936][T11009] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 466.994041][ T43] usb 3-1: new low-speed USB device number 79 using dummy_hcd [ 467.036597][ T43] usb 3-1: Invalid ep0 maxpacket: 16 [ 467.040175][T11012] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1253'. [ 467.052592][T11012] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1253'. [ 467.194021][ T43] usb 3-1: new low-speed USB device number 80 using dummy_hcd [ 467.234842][ T43] usb 3-1: Invalid ep0 maxpacket: 16 [ 467.240807][ T43] usb usb3-port1: unable to enumerate USB device [ 467.466462][ T10] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 467.686416][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 468.169945][ T10] usb 5-1: config 0 has no interfaces? [ 468.176336][ T10] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 468.215721][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 468.246969][ T10] usb 5-1: config 0 descriptor?? [ 469.260009][T11029] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 469.269788][T11029] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 469.280311][T11029] random: crng reseeded on system resumption [ 469.479226][T11036] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 469.486376][T11036] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 469.505508][ T5940] usb 3-1: new full-speed USB device number 81 using dummy_hcd [ 469.575617][T11036] vhci_hcd vhci_hcd.0: Device attached [ 469.660319][T11042] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1260'. [ 469.717391][T11042] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1260'. [ 469.740453][ T5940] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 469.747195][ T43] vhci_hcd: vhci_device speed not set [ 469.761216][T11044] tipc: Enabling of bearer rejected, failed to enable media [ 469.790221][ T5940] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 469.804937][ T5940] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 469.819195][ T5940] usb 3-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 469.828278][ T5940] usb 3-1: Product: syz [ 469.832881][ T5940] usb 3-1: Manufacturer: syz [ 469.838460][ T43] usb 35-1: new full-speed USB device number 3 using vhci_hcd [ 469.862722][ T5940] hub 3-1:4.0: USB hub found [ 470.064976][T11031] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 470.092110][T11031] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 470.136514][ T5940] hub 3-1:4.0: 6 ports detected [ 470.149813][ T5940] hub 3-1:4.0: insufficient power available to use all downstream ports [ 470.190212][ T10] usb 5-1: USB disconnect, device number 80 [ 470.238808][T11011] delete_channel: no stack [ 470.332731][T11037] vhci_hcd: connection reset by peer [ 470.341490][ T49] vhci_hcd: stop threads [ 470.344532][ T5940] hub 3-1:4.0: hub_hub_status failed (err = -71) [ 470.353724][ T5940] hub 3-1:4.0: config failed, can't get hub status (err -71) [ 470.364719][ T49] vhci_hcd: release socket [ 470.371836][ T49] vhci_hcd: disconnect device [ 470.436644][ T5940] usb 3-1: USB disconnect, device number 81 [ 471.040207][T11053] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 471.052274][T11052] bond0: option ad_select: unable to set because the bond device is up [ 471.066693][T11053] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 471.098370][T11053] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1264'. [ 471.163437][T11059] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1265'. [ 471.637027][ T5940] usb 5-1: new full-speed USB device number 81 using dummy_hcd [ 471.806012][ T5940] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 471.819349][ T5940] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 471.843487][ T5940] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 471.862234][ T5940] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.134141][ T5940] usb 5-1: GET_CAPABILITIES returned 0 [ 472.147407][ T5940] usbtmc 5-1:16.0: can't read capabilities [ 472.215899][ T5940] usb 5-1: USB disconnect, device number 81 [ 472.552739][ T977] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 472.785775][ T977] usb 3-1: config 0 has no interfaces? [ 472.791702][ T977] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 472.837799][ T977] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.890200][ T977] usb 3-1: config 0 descriptor?? [ 473.246508][T11078] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.325393][ T6952] usb 3-1: USB disconnect, device number 82 [ 473.333053][T11092] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.333603][T11078] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.435513][T11092] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.975944][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 473.975966][ T30] audit: type=1326 audit(1752260129.494:3115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11105 comm="syz.1.1276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 473.981724][T11106] netlink: 'syz.1.1276': attribute type 11 has an invalid length. [ 473.982337][ T30] audit: type=1326 audit(1752260129.494:3116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11105 comm="syz.1.1276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 474.103969][ T30] audit: type=1326 audit(1752260129.494:3117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11105 comm="syz.1.1276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=428 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 474.229073][ T30] audit: type=1326 audit(1752260129.494:3118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11105 comm="syz.1.1276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 474.309843][ T30] audit: type=1326 audit(1752260129.494:3119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11105 comm="syz.1.1276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=442 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 474.589804][ T30] audit: type=1326 audit(1752260129.494:3120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11105 comm="syz.1.1276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 474.722924][T11116] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 474.794378][T11116] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 474.827675][ T30] audit: type=1326 audit(1752260129.494:3121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11105 comm="syz.1.1276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 474.895556][ T30] audit: type=1326 audit(1752260129.494:3122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11105 comm="syz.1.1276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 474.956105][ T43] vhci_hcd: vhci_device speed not set [ 474.974714][ T30] audit: type=1326 audit(1752260129.494:3123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11105 comm="syz.1.1276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 475.001856][T11123] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 475.014271][T11123] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 475.079355][ T30] audit: type=1326 audit(1752260129.494:3124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11105 comm="syz.1.1276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f910438e929 code=0x7ffc0000 [ 475.394325][T11130] input: syz1 as /devices/virtual/input/input29 [ 475.674105][ T10] usb 5-1: new full-speed USB device number 82 using dummy_hcd [ 475.864197][ T10] usb 5-1: device descriptor read/64, error -71 [ 476.113949][ T10] usb 5-1: new full-speed USB device number 83 using dummy_hcd [ 476.179222][T11126] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1283'. [ 476.244178][ T10] usb 5-1: device descriptor read/64, error -71 [ 476.354434][ T10] usb usb5-port1: attempt power cycle [ 476.733990][ T10] usb 5-1: new full-speed USB device number 84 using dummy_hcd [ 476.773662][ T10] usb 5-1: device descriptor read/8, error -71 [ 477.124090][ T10] usb 5-1: new full-speed USB device number 85 using dummy_hcd [ 477.163768][ T10] usb 5-1: device descriptor read/8, error -71 [ 477.268736][T11143] IPVS: set_ctl: invalid protocol: 1 224.0.0.2:0 [ 477.315268][ T10] usb usb5-port1: unable to enumerate USB device [ 477.781060][T11157] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 477.787753][T11157] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 477.941155][T11157] vhci_hcd vhci_hcd.0: Device attached [ 478.028118][T11159] vhci_hcd: connection closed [ 478.028451][ T6178] vhci_hcd: stop threads [ 478.039775][ T6178] vhci_hcd: release socket [ 478.089805][ T31] INFO: task kworker/0:7:5969 blocked for more than 143 seconds. [ 478.192938][ T43] usb 39-1: new low-speed USB device number 3 using vhci_hcd [ 478.384984][ T31] Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 [ 478.779241][ T6178] vhci_hcd: disconnect device [ 478.784698][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 478.864755][ T31] task:kworker/0:7 state:D stack:21688 pid:5969 tgid:5969 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 478.921583][ T31] Workqueue: usb_hub_wq hub_event [ 478.942501][ T31] Call Trace: [ 478.954935][ T31] [ 478.961508][ T31] __schedule+0x16f5/0x4d00 [ 478.997095][ T31] ? schedule+0x165/0x360 [ 479.018632][ T31] ? __pfx___schedule+0x10/0x10 [ 479.032932][ T31] ? schedule+0x91/0x360 [ 479.053049][ T31] schedule+0x165/0x360 [ 479.066122][ T31] schedule_timeout+0x9a/0x270 [ 479.079210][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 479.092911][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 479.115581][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 479.130853][ T31] ? wait_for_completion+0x267/0x5d0 [ 479.152108][ T31] wait_for_completion+0x2bf/0x5d0 [ 479.170828][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 479.181457][ T31] i2c_del_adapter+0x581/0x6e0 [ 479.186788][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 479.192478][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 479.202593][ T31] ? dvb_usbv2_exit+0x85a/0x9e0 [ 479.211358][ T31] dvb_usbv2_probe+0x4ae/0x41a0 [ 479.221439][ T31] ? __pfx_dvb_usbv2_probe+0x10/0x10 [ 479.227382][ T31] ? __pm_runtime_set_status+0x785/0xa50 [ 479.233301][ T31] usb_probe_interface+0x641/0xbc0 [ 479.243191][ T31] ? __pfx_usb_probe_interface+0x10/0x10 [ 479.249411][ T31] really_probe+0x26a/0x9a0 [ 479.270197][ T31] __driver_probe_device+0x18c/0x2f0 [ 479.285477][ T31] driver_probe_device+0x4f/0x430 [ 479.306903][ T31] __device_attach_driver+0x2ce/0x530 [ 479.319649][ T31] bus_for_each_drv+0x251/0x2e0 [ 479.349884][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 479.356181][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 479.361871][ T31] __device_attach+0x2b8/0x400 [ 479.367228][ T31] ? __pfx___device_attach+0x10/0x10 [ 479.372602][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 479.378064][ T31] bus_probe_device+0x185/0x260 [ 479.383202][ T31] device_add+0x7b6/0xb50 [ 479.387722][ T31] usb_set_configuration+0x1a87/0x20e0 [ 479.393492][ T31] usb_generic_driver_probe+0x8d/0x150 [ 479.399218][ T31] usb_probe_device+0x1c4/0x390 [ 479.404591][ T31] ? __pfx_usb_probe_device+0x10/0x10 [ 479.410022][ T31] really_probe+0x26a/0x9a0 [ 479.414655][ T31] __driver_probe_device+0x18c/0x2f0 [ 479.420146][ T31] driver_probe_device+0x4f/0x430 [ 479.425317][ T31] __device_attach_driver+0x2ce/0x530 [ 479.430779][ T31] bus_for_each_drv+0x251/0x2e0 [ 479.436125][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 479.442197][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 479.449456][ T31] __device_attach+0x2b8/0x400 [ 479.454607][ T31] ? __pfx___device_attach+0x10/0x10 [ 479.460428][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 479.466089][ T31] bus_probe_device+0x185/0x260 [ 479.471351][ T31] device_add+0x7b6/0xb50 [ 479.475886][ T31] usb_new_device+0xa39/0x16c0 [ 479.480866][ T31] ? __pfx_usb_new_device+0x10/0x10 [ 479.486256][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 479.491871][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 479.497215][ T31] hub_event+0x2941/0x4a00 [ 479.501936][ T31] ? __pfx_hub_event+0x10/0x10 [ 479.507017][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 479.513003][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 479.518338][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 479.524629][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 479.530512][ T31] process_scheduled_works+0xae1/0x17b0 [ 479.536539][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 479.542822][ T31] worker_thread+0x8a0/0xda0 [ 479.547546][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 479.554401][ T31] ? __kthread_parkme+0x7b/0x200 [ 479.559519][ T31] kthread+0x70e/0x8a0 [ 479.563660][ T31] ? __pfx_worker_thread+0x10/0x10 [ 479.569008][ T31] ? __pfx_kthread+0x10/0x10 [ 479.574157][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 479.579620][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 479.585046][ T31] ? __pfx_kthread+0x10/0x10 [ 479.589701][ T31] ret_from_fork+0x3fc/0x770 [ 479.594708][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 479.599901][ T31] ? __switch_to_asm+0x39/0x70 [ 479.604876][ T31] ? __switch_to_asm+0x33/0x70 [ 479.609981][ T31] ? __pfx_kthread+0x10/0x10 [ 479.614824][ T31] ret_from_fork_asm+0x1a/0x30 [ 479.619841][ T31] [ 479.623047][ T31] [ 479.623047][ T31] Showing all locks held in the system: [ 479.641508][ T31] 3 locks held by kworker/0:1/10: [ 479.663938][ T31] #0: ffff8880b8639f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 479.685450][ T31] #1: ffff8880b8623f08 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x39a/0x6d0 [ 479.704009][ T31] #2: ffff8880b8625958 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x1ae/0xf30 [ 479.734583][ T31] 1 lock held by khungtaskd/31: [ 479.741298][ T31] #0: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 479.752268][ T31] 5 locks held by kworker/1:1/43: [ 479.758199][ T31] #0: ffff888022a8c948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 479.770644][ T31] #1: ffffc90000b37bc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 479.783573][ T31] #2: ffff8881453fa198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 [ 479.792859][ T31] #3: ffff8881453fc510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x21a3/0x4a00 [ 479.803328][ T31] #4: ffff88802945d368 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21cb/0x4a00 [ 479.813553][ T31] 2 locks held by getty/5611: [ 479.818446][ T31] #0: ffff8880310ac0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 479.829977][ T31] #1: ffffc9000333b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 479.840558][ T31] 5 locks held by kworker/0:7/5969: [ 479.847056][ T31] #0: ffff888022a8c948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 479.858713][ T31] #1: ffffc9000ac9fbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 479.871286][ T31] #2: ffff8881443dc198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 [ 479.880738][ T31] #3: ffff88807a8c3198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 479.890309][ T31] #4: ffff888024837160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 479.900043][ T31] 2 locks held by kworker/u8:15/6175: [ 479.906012][ T31] #0: ffff8881466ae148 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 479.917540][ T31] #1: ffffc9000b977bc0 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 479.930177][ T31] [ 479.932633][ T31] ============================================= [ 479.932633][ T31] [ 479.964083][ T31] NMI backtrace for cpu 1 [ 479.964107][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 479.964132][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 479.964146][ T31] Call Trace: [ 479.964154][ T31] [ 479.964163][ T31] dump_stack_lvl+0x189/0x250 [ 479.964193][ T31] ? __wake_up_klogd+0xd9/0x110 [ 479.964228][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 479.964253][ T31] ? __pfx__printk+0x10/0x10 [ 479.964296][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 479.964329][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 479.964354][ T31] ? _printk+0xcf/0x120 [ 479.964388][ T31] ? __pfx__printk+0x10/0x10 [ 479.964419][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 479.964442][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 479.964475][ T31] watchdog+0xfee/0x1030 [ 479.964498][ T31] ? watchdog+0x1de/0x1030 [ 479.964526][ T31] kthread+0x70e/0x8a0 [ 479.964559][ T31] ? __pfx_watchdog+0x10/0x10 [ 479.964578][ T31] ? __pfx_kthread+0x10/0x10 [ 479.964609][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 479.964640][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 479.964678][ T31] ? __pfx_kthread+0x10/0x10 [ 479.964709][ T31] ret_from_fork+0x3fc/0x770 [ 479.964735][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 479.964764][ T31] ? __switch_to_asm+0x39/0x70 [ 479.964791][ T31] ? __switch_to_asm+0x33/0x70 [ 479.964818][ T31] ? __pfx_kthread+0x10/0x10 [ 479.964850][ T31] ret_from_fork_asm+0x1a/0x30 [ 479.964896][ T31] [ 479.964904][ T31] Sending NMI from CPU 1 to CPUs 0: [ 480.131335][ C0] NMI backtrace for cpu 0 [ 480.131352][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 480.131373][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 480.131385][ C0] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 480.131420][ C0] Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 93 fd 18 00 f3 0f 1e fa fb f4 c8 dd 02 00 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 480.131436][ C0] RSP: 0018:ffffffff8de07d80 EFLAGS: 000002c6 [ 480.131452][ C0] RAX: ddb51adcdab6bf00 RBX: ffffffff81976c78 RCX: ddb51adcdab6bf00 [ 480.131466][ C0] RDX: 0000000000000001 RSI: ffffffff8d998b43 RDI: ffffffff8be29dc0 [ 480.131478][ C0] RBP: ffffffff8de07ea8 R08: ffff8880b8632f5b R09: 1ffff110170c65eb [ 480.131491][ C0] R10: dffffc0000000000 R11: ffffed10170c65ec R12: ffffffff8fa1f3f0 [ 480.131505][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffffffff1bd2a50 [ 480.131516][ C0] FS: 0000000000000000(0000) GS:ffff888125c1b000(0000) knlGS:0000000000000000 [ 480.131530][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 480.131541][ C0] CR2: 00007f25df57f2d8 CR3: 0000000078e18000 CR4: 00000000003526f0 [ 480.131556][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 480.131567][ C0] DR3: 3a810b1eb6134bdc DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 480.131579][ C0] Call Trace: [ 480.131587][ C0] [ 480.131593][ C0] default_idle+0x13/0x20 [ 480.131613][ C0] default_idle_call+0x74/0xb0 [ 480.131634][ C0] do_idle+0x1e8/0x510 [ 480.131665][ C0] ? __pfx_do_idle+0x10/0x10 [ 480.131695][ C0] cpu_startup_entry+0x44/0x60 [ 480.131716][ C0] rest_init+0x2de/0x300 [ 480.131736][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 480.131757][ C0] start_kernel+0x47d/0x500 [ 480.131785][ C0] x86_64_start_reservations+0x24/0x30 [ 480.131803][ C0] x86_64_start_kernel+0x143/0x1c0 [ 480.131821][ C0] common_startup_64+0x13e/0x147 [ 480.131856][ C0] [ 480.180393][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 480.180423][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc5-syzkaller-00121-gbc9ff192a6c9 #0 PREEMPT(full) [ 480.180456][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 480.180474][ T31] Call Trace: [ 480.180484][ T31] [ 480.180497][ T31] dump_stack_lvl+0x99/0x250 [ 480.180535][ T31] ? __asan_memcpy+0x40/0x70 [ 480.180561][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 480.180594][ T31] ? __pfx__printk+0x10/0x10 [ 480.180642][ T31] panic+0x2db/0x790 [ 480.180677][ T31] ? __pfx_panic+0x10/0x10 [ 480.180705][ T31] ? nmi_backtrace_stall_check+0x433/0x440 [ 480.180742][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 480.180768][ T31] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 480.180811][ T31] watchdog+0x102d/0x1030 [ 480.180838][ T31] ? watchdog+0x1de/0x1030 [ 480.180870][ T31] kthread+0x70e/0x8a0 [ 480.180918][ T31] ? __pfx_watchdog+0x10/0x10 [ 480.180942][ T31] ? __pfx_kthread+0x10/0x10 [ 480.180978][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 480.181015][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 480.181054][ T31] ? __pfx_kthread+0x10/0x10 [ 480.181089][ T31] ret_from_fork+0x3fc/0x770 [ 480.181121][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 480.181153][ T31] ? __switch_to_asm+0x39/0x70 [ 480.181187][ T31] ? __switch_to_asm+0x33/0x70 [ 480.181218][ T31] ? __pfx_kthread+0x10/0x10 [ 480.181255][ T31] ret_from_fork_asm+0x1a/0x30 [ 480.181307][ T31] [ 480.486090][ T31] Kernel Offset: disabled [ 480.490432][ T31] Rebooting in 86400 seconds..