last executing test programs: 4m47.64728263s ago: executing program 2 (id=949): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) socket$netlink(0x10, 0x3, 0xa) open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x21, &(0x7f00000005c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000b00)=ANY=[], 0x48) 4m44.699586814s ago: executing program 2 (id=957): r0 = open(&(0x7f0000000780)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x7800007, 0x12, r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = syz_open_dev$vbi(&(0x7f00000000c0), 0x0, 0x2) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x10, 0x803, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002e40)=@newchain={0x1910, 0x64, 0x100, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x10, 0xffff}, {0xfff3, 0xc}, {0x4, 0xfff2}}, [@filter_kind_options=@f_fw={{0x7}, {0x660, 0x2, [@TCA_FW_ACT={0x65c, 0x4, [@m_ife={0x1b0, 0xf, 0x0, 0x0, {{0x8}, {0xc4, 0x2, 0x0, 0x1, [@TCA_IFE_METALST={0x3c, 0x6, [@IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_PRIO={0x8, 0x3, @val=0x1e891f66}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x5}, @IFE_META_PRIO={0x8, 0x3, @val=0x5}, @IFE_META_PRIO={0x8, 0x3, @val=0x5}, @IFE_META_SKBMARK={0x8, 0x1, @val=0xb8e}, @IFE_META_TCINDEX={0x6, 0x5, @val=0xd4c}, @IFE_META_TCINDEX={0x4, 0x5, @void}]}, @TCA_IFE_SMAC={0xa, 0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, @TCA_IFE_SMAC={0xa, 0x4, @remote}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_SKBMARK={0x8, 0x1, @val=0x3}]}, @TCA_IFE_METALST={0x48, 0x6, [@IFE_META_PRIO={0x8, 0x3, @val=0x333c86ef}, @IFE_META_TCINDEX={0x6, 0x5, @val=0xc}, @IFE_META_TCINDEX={0x6, 0x5, @val=0x9}, @IFE_META_TCINDEX={0x6, 0x5, @val=0x1}, @IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_SKBMARK={0x4, 0x1, @void}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x2}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x5}, @IFE_META_PRIO={0x8, 0x3, @val=0x800}]}, @TCA_IFE_DMAC={0xa, 0x3, @random="a4456ad83057"}, @TCA_IFE_SMAC={0xa, 0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}]}, {0xc6, 0x6, "b9d011dc8242e8ba670ba2d0664382af8657f9464cec368e5d6874fb7bbfc20bb7b9f735aaff475ec0de913f30742fd4873eae4915cc188326ddf8c4aae6b9fe27c923d5690b498d1dbe95556a0cd458217823b36e4f183fe0ce19b4b6ecb8cb1a49f4923b53cd2d47df33a1b3e7d58eb8a3ce6a56fb980f96942f35d4849327f829c30da261e540dbe49862210d70f25d181d1d0057ac64a6e1f4b891acfb2095b145ef40cf5a1468a96a26ff86832580388418119b61af2327f1fb0a9ba23e699a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_sample={0xec, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0xfffffffe, 0x4, 0x3, 0x7, 0x2}}]}, {0x9d, 0x6, "e87c1ebfac90184c5f4cf69df6127721a265ffe40ae8525b783be13e319cab1c7fcf7a51722c6163f06c708ad4e466763683bac16880a011f5e30911166a87d96df853d21b557aaf8245ae1e069bd08f443eb09507f0f9123133f86f675c95f821e1a4b935bd829af633814b9d10a52f55fc5d4efb615a28ec2973083639c20cb5829cf8eb5addf7de1081a3bc3045eaac08b96ada0af25612"}, {0xc, 0x7, {0x1, 0x32f2d9dba6de38a3}}, {0xc}}}, @m_pedit={0x1f4, 0x20, 0x0, 0x0, {{0xa}, {0x100, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0xfc, 0x5, 0x0, 0x1, [{0x44, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}, {0x3c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x3}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x3}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}]}, {0x54, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}, {0x24, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x3}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}]}]}, {0xc9, 0x6, "54450923096775d69c456f163b3937ed91a5c6dc5e936df6708e77bc22aae6fb43733eb02cb59d264867d232b2ca2a70385944d39a59c552e71ec05ea4e4699d091e7756dbe976c0ed2f7d472bc312bb69928b96f75546e63ddc44dce7fe5683fa1077374e6abd8934874b4e4c225ad3987b2c25264150d5e54f9bf4d9f6e1ea5fd982cc6a43277b2b73aae9074c4a4419da7248d029c221defecd4de2366b392890f7a841fa7424e49469a2c28aad883f6c544275a6b2b568c163d9dd6bfe5322ae6b0ccb"}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}, @m_vlan={0x8c, 0x1b, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x5}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x3}]}, {0x46, 0x6, "f0576bafb933708025e1f1302f1dfe09f778f26e95d496f3d6d30e014542a951fc135d2c2bf615e03ce7f6f33c16128c4a004b34273a05899c9a5225c73e49faa219"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_mirred={0x13c, 0x3, 0x0, 0x0, {{0xb}, {0x84, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0xe, 0x2, 0x7846428d79fe6bc1, 0x4, 0x2}, 0x3, r7}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x7ff, 0xe, 0x3, 0x10000, 0x8}, 0x2, r7}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x9, 0x8, 0x10000000, 0x3, 0x400}, 0x1, r7}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xf, 0x7, 0x8, 0x2, 0x3}, 0x4, r7}}]}, {0x90, 0x6, "369922cd84c43678fe5fc6f502bd0d916797763a9ed7a5d91ee5d5ced7e1900a6e3d8fb0dc26e10969610175368b48e078e38b725db43c557d9c809842248edc3376e86800584ec4feed5346050e1f249c836768348a0450d954136a17541345bf2bb6aaa6bc594c3f0ecbbd3f6d1f3942f5852c6c0eed87808d3a58965b58b2cb8d9023fdd88fcf7d3b1f80"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x7, 0x7}}, @TCA_RATE={0x6, 0x5, {0x8, 0x5a}}, @filter_kind_options=@f_flower={{0xb}, {0x4}}, @filter_kind_options=@f_u32={{0x8}, {0x125c, 0x2, [@TCA_U32_SEL={0x74, 0x5, {0x5, 0x1, 0x0, 0xfffd, 0xc, 0x4, 0x0, 0x1000, [{0x8, 0x800, 0x3, 0x5}, {0x200, 0x8001, 0x0, 0x6588}, {0x10001, 0x7, 0x3, 0x2}, {0x5, 0xfff, 0x8, 0x5}, {0x3, 0x8, 0xe3d, 0x40}, {0x2, 0xffff, 0x2, 0x7}]}}, @TCA_U32_MARK={0x10, 0xa, {0x80000000, 0xad2}}, @TCA_U32_ACT={0x11d4, 0x7, [@m_nat={0xf4, 0x11, 0x0, 0x0, {{0x8}, {0xcc, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x6, 0xebc8, 0x8e1bdd7e2f36419b, 0x0, 0x7f}, @private=0xa010101, @multicast2, 0x0, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x2, 0xa, 0x0, 0x0, 0x5}, @multicast2, @broadcast, 0xffffff00, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x8f3, 0x6, 0x6, 0x1000, 0x6}, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x400, 0x5, 0x1, 0x7ff, 0x5}, @dev={0xac, 0x14, 0x14, 0x36}, @remote, 0xff000000}}, @TCA_NAT_PARMS={0x28, 0x1, {{0xadfc, 0x6, 0x3, 0x6, 0x28}, @empty, @loopback, 0xffffffff}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_connmark={0x10dc, 0x12, 0x0, 0x0, {{0xd}, {0xac, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3, 0x8001, 0x20000000, 0x1, 0x44261d38}, 0x145}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8001, 0x6, 0x4, 0x3, 0xe}, 0xac}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xc, 0x10, 0x1, 0x9, 0xfffffa2e}, 0x78bc}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4, 0x9, 0x8, 0x4, 0xc}, 0x4000}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x2, 0x2, 0x7d43a172, 0x8}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfff, 0x8, 0x5, 0x5, 0x5}, 0x8000}}]}, {0x1004, 0x6, "2a8028d3e87cbb57e1ab7952a99ff663da08d4597b4084b5c7684599dee5c35c487b9f42deb69a98f1d9af3ec3211543147a5d662e1dfc0b604e632ee44ee5e1e52b28cb85dc612101429b7df564da933fd86204506dfd62723564101bb2e58be1ae68b22205787f63f215fa39ace2e13fde2f3379bf3e07eb4c437811ba550729a27c8d6cf2be96fad592c2cc97e04de4280e9df693c115b8e50f1bcaf1064a4b1cae8ec5f93ac4fb111241ce1a4ed2448d35ef53b7f80acc7c31a4aaa67d79ca802fc3c350feadee5f3c228377bc8ea7a3ddf5bf305ef50ded02c914a9829fce4b90991126e90375f0e031378dfacc6ee234cb2fe617e07b69497bcaa65cfdca5e28f21333a46c5305abd3859d1163664d566c5b9929e6d5415b7845c8b85a7be07fbf8d978c0cd5a210232e020344dc27ca7185280da51b11410cfac44407d994ae36d669b6565f8f120f18b1ed695663744ced1632dc06b918e83857fab829b9473b653dd1a9d413e73cbb0502eccd86e511388ba1e3d0de9cf3845a3f56e9270df6223c0ee65fddafd18dde28f2a996ed032bcea7e94c59706e9decd55594f63ddc4f5f368f97bc282d7784afeda4e0ab8431c9493b61472bc6b8cc0dae3dd1796c155cfc1b8c99b27918e7dafead194f3613d187e7bef9dd9d4f6fd442aeecd3fc6dadd7c5cf240b45d34cd72dcb7c141731901080fcc669a69e254b4ac370779415fdb75999daf7d247dc5f4a19035e62070a71b89c5b5ae1c0ed56be99b6e051867d47e600b52a719d2dca936df2bd6b3615eceed05df50e9daf2b6328ffc90681c6df0be60958bc1dbb5d8e4e1fb11841a798d940a105c378b7b917ea7e375dc8a86d14877f0cc1882ebad5c0fe13c37be9f2991119acc6217e624b686dc9c3c8d32392bd801d5f149a9d54d1468d3b141e476e34c20c941f73bf0d1ed26172e08cf0a92ce7d765d2777f152df6fb8d494dc1a8c5fccd44e05d0f919b0c92ce89a949ad2d764264729bae4c8d6c04f22c5463e868cf12c4336dee03a02aa6bb29d16882bd50bba93430bcb96abc8ac98f2ec28fabdf3fd636d9972249790ada116b550b910e0838c0edf790d7f95fca4c0d0883d5ca7ea278c45629cb48c721b306b76017d97edd597c7bfe6176aba081e57254d3037f3f1a1fcc99dffd8cce92201961deb18f2d9b987b9a465ccaf8ed98a75b75308422627ab927ec7712c44ce514ecdfeb748b608a1b1f6540eb92f6f18f4356e2f8528a408835b640bda05b07f6c83c223ddbc824c33e7233de4eebd5783ea3fe8c172359a176e87f7d64a5ca75a7fe47d224450cdd1571921e4f891368f66344d00fbdcd2fa9ce753160cb1bf696bbad39884ae249dd18801ecb592a8d198cca69c6bfb2f197749b62272f3b3ac3c518a09fa25c6098998e2ed18ad1bbb4db2dbf59950a8550afa898d929c5be5a4cd40cb75be6c73b02f5fd3ba35ba7b753bdd5c104cd9b3561516575274829941d8843968952c304421a7fdaf33aed7559f476cd4c2dbf29ea3572194d58aa4279df49528cf14c9715f415bd5fa2a1152848572e52e7e23f0bbdf1e0f6a4f140356c02cbffc2c5d22b4bd91acfbe9eb04739cc3578b649b4d54692710f3dd790f98053957f55d4f62873acf4b647f5c7253130db8af488ec3d3c396015cbe15f47fbbaaad381e7ef969a97bf0b3da3b548030a4bdcfe24c894a9efe7f7f727f0766f06583e77a2f0a7e139ad49beb507b068745a07ac2eb24be144e69e7dbc4a9aa9297e615c06c2de02d6764577a96f85d2acc013616a7e6bfb010e5e7a7ae79bb29391d0141fb347aa36e226ea6e84561918ed146b77634895c386e5ed08d52e9521485cb21a29a1664492c98a3192642f4c77047856642ee9d6a8ac5cbcaac6149daafd09e72ae674ff024810e85621b9b67f2c2313961120ce2629b5ae32243080181b4a77ba386a883deefe28c70bb40e7b9055eb901bf36d8c21871eb589c51725b2f4b4aa2a81e613568292ab9479c06db54beeb3f3b4423e14cfa9d478b45ecc73068fce49083427f8bd265690cc1e1d248ca8d466a95ee4a5202a82a1bd8e6bd5f71d8a087f3be6d9873b7ed26ec19199c6ad5830648294b53f86f129ee433d7fcaeaa1e52a302fbb17bb604927c14dd702d3ef415c667c41bb1ea7b757f7f1cdf076dc118a4a8a22c770dd2c6bc2505f00bdee28780a01fe1d8129318fa162cf5e4990e366611db07207949f975ce1fb4e4a8ec4038d73cd034df7aa05cfeed46511f0f25cbb6079671198d8856d33b5835996d27e4e28c7076a352a2e711165f35e168b0e5c7282d06c01effaf284e6b77fd80c9de0af85179246504f4b98ce545a2eab9ace61c70efc77aaff936453711e9fe09d9a346c01c50c8bddcb4c5f02e304a70972a1e0b5e5d11ccfe2b1b356459a8c3ae82bcceafd5cc393981ddfe95fd41f40c42ea243d071bc6df207221eabf3d09bf14b24b11735fe260440e66dbdd6ccdc5839dbab07ab235ac9ce3108b728dd1f8a46fb9d77035b04d194cebef26a89d91b72bae47066abc1a2d4f0f2b80b85017241814ab7e74d33c400c802f064d0612654bfb3243191a6eaa90efe119472284dff9a6cbda13ec816bd3d011129909b7ad3ea7773d3c956c5e2503fe47debf36b1adaf44fad4b6b173e47d536a04008617413368bc14e421c857ddd56a7ac4f95425f8aa69a9711424e3700e0203e5130a93ab7a9f7769cc7501124b9881781427abd84b9c38c48aa906d3a9b0413e09fe3445558e7c6415cf76f7399f42576309c578fe80a029ce8fefb2a107d051477d629f4b10910d10e2973cb7a7ac78dcce5b5c1f85937d393a5fbd6c9d675b7ae48ceb75dabaebf94ba8cd521b18a0e1a6d09847f7f6081263cd4c1d700301246820321f307cf7a21f62077925914e8bec092e46711243a2d78cc0e7cc18bc1e74bc9bdc88a550fc45dc7765b21c953f6db9446a54e1fd5e36a73f99ff6bea258091756cd06c8ff16edc011f15385f717bb8e081f2a2ac04893d2c71bf608357e8de14bd27c180dbb773e05c35f194b0a5f92945fbd51f0a4ece4c66e3a0e0d6d45b4661e4532f4f33d9c818fa524ccc4fead88ae54fc458b9bb52315abe5d3e2bce2ce1c9149fa7b5f14c7d16d83610867eaaf8b82153753c2eace89240381e8b26dc391d804f421ceb57a031d1be5c3fdeebc3b02585c6add7dcdfa251495ee93f4b238a359ca37e7171976aa7310eb1b4a93c3e888790bf3bd70dac9bafdb0fb22ee569c4f4332d992195b633a193d126c017eb79a689801e0804bb299d81661036255247f17414f9778024d5c7c0c0cfce0f2c7b05a4fabcb844c27fe218cd2879bf2c8a8e9a315722a217d1548e953a68f59280a9993e4abb27c7b2ca16ad1a0fe6fcaeccd9438858bd2a0f77a7700d899321fafdd0d83792f6a94c140a0ca13b7c6f1633b9ab3eaf55ae0625b0d07b272075c0e48b2303fadaa20409f9faf75215b77abc227dcda9aa1009f51edbcb1327b67fc6139c3344a681276e4d61c9d7571dac432bdd0a04076367498c4473d135e28ea464358cf959b426e4c8ffeb498b3b19f20ac7c02365612a7570fac17ae76c5eb045ba522b21d8a8a12f33071a27a8929e5717b665664ff3feb99078a0bf8583937412e03a3976077b1f066071e0a8f89a9910ccd5afa123f65bdcb22fcbc8df713bc3c26604e77040bc5dbc3598ca0864415dc80ec36d636188e9557061b524acf2577d6492b528f5ccbec759a9629a32c8fb45b3e0b9063eb61fcb60810930519466147014c5e61dfc540bda023882e743bd5f9d45133e8b71c3510b805e6c647a60dac89ec1982ba64245e7f78cf5c2435724231002f18585b2db8944b8638f355faa3f690a9361ddfce0883ae9475b8d878c8f8aa825e804468b1fd33c2ca691ea1960e7b8443e1de78ad5c58911cdd84e0d95e3bbf0e334a3c8662ecb0f62bbb619f17e23ce58914f27b343fbfc066646f6cf320a0eb937adee0fc2490c17da75b4af07a6781279d06cb1be3fd4d5a05f6a807c0b2453bafde23432063ebf3870fdac7800fa72ef9b27e5b9f16572ffad3559c0bc287f0270f6e8642151a9137d24c5ab6f0d3e714b184ada36a967da8b89131ad656ccd6f38edf35131913b2e7034a6f0a4697a4c655f0c2c90ab4668ddd9494ea9da6eebc221b067d4e37e1f075a46fc4f557489a3d10281aecf6a5c1838ce0602626b0e0bb4b7a88269ef08e125bfac2dd0822afb2c285f3754cd2cda8676968823ad1eb7683ba35e72833c52a7338d6bc2ff4a572077ef97fe651d0897f1eedddf50e991eab5b966d9cf0ec48e847f7c5fade2c05de1da97731e0796fc4118828dd246c524f79c3c21f92999bad5069685c2b0175451d6e9c27e4d489cc026ef00456edb192a44cd4390b3d48c44492fffd5396377d6f4bf839770894630d92866b7db1160f4208a1bb2d51d86732695d57b2198b1e8106cfa8b0d9e28b15af5dc6cee9ebc7d06dca1d7abac5b299225175c347756f882dada2347fbca2eb9300a27466e621c9924a367838e3e27c053b49f49ae1bad51ed18f85b9ff3901c3268e40ae1aaec55cc7df5e133626320965f2d5883a54be14caff9a4641f304f0f19327ee0043dbc64509a2e73dcd2d4f867e8eedb578bc3d2d3ad583526f8677522df345b10255eb5dea573ca91840a7198447547106384158b0f4151f58eb497d4badb9b55a967128bc819aa8c8cea4ea06ca14e49d38b12f5fa71f29264576417c92b61158714a153e020e35617446ad0debe1c3771bb61abc8708c33c70457624912c0c66387ebea3ff90fa1286cbeb27ba95645a0b4e1f17f224111a61412294f590195d679d1e9a2e7578fa319db1c7a73baba9f7a5336a7ce54b31cdcd860c63b57ba775c6dce623222c34b3e605f03d9c4c90233f0539e3bd92a49ea4843dbafb8355ec26b7f50caa8faa981f0197c958f8e4d56eb4a26ad73650fc98c63ce654677f77c7387dd69d80b10d5b98a6598deed30cd67abb87707bc2a7baf6753aa0f8cbf5fa751f2b4b27b2248bce9ac83065d92d42d1f3bbdab9898876cdda74f29ffb9e6ee0594f16610a1bc8519ffb508c3b4e0bbdfb7a39f2123140dfbbe240989ed31fe95314c19251fcf1a6362214bd9041e130671e8b8d444f524bab96fa9d1f0d89530b98cfe11b3436305450970a1a0fbfa0af2d6f551b9aafa91f841ce4de2ddd5db1a19dc17173d9ad5d967ad536bbf3b5036ea8417b69219218b558ce4fe6dbee4e97c5a99fc4bdbad9a2ab22eae36e0053eeb78539c73a5173a143ab8ea8d4ea328bbc14c51debfc3647460a146cabdf78ceef259549f5d5d081b510c9529f8c3f6d2089cf734e0e99846bc3ff9d15796cfd83407c440dfe0d0d3fafa865470ce2e47b52f7d7d304fb102c6bdddad789fac92a8429855b0a0f48d2df2b35f5222016f200fb92fe699352af574e00595e7a9f910975fb1d5b798e0ba467f1931560e2b7f72f51c7cf6ea9a7c954dbf05acee6772128c94f2f998bd317137bafdb8793b7a3cdfb68e693001800c560564a5710a818dc54a181de1e05e1909b386c3239d63813b074a6732478ba1d9f4d2cf4c0cab416e7b5563003b7c35680d131b701a419c5c2063f8e0a88cfea05f19865576af229d53ad24bf5af016b69a2120fe4e8ca1c05b2520c1915ada6ccb7ecec56acc686163080e1c6609361a18b360dee37e957330bbd7d0c2d5f187e9609f914a852578d095"}, {0xc, 0x7, {0x34ff81334085e19f, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x1910}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x24, 0x2c, 0x800, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, r7, {0x5, 0x4}, {0xf}, {0xffff, 0xf}}}, 0x24}}, 0x20000855) ioctl$VIDIOC_ENUMINPUT(r3, 0xc050561a, &(0x7f0000000100)={0x0, "c809d4afa542f9b2daa2b389d2d1c77de75414201c4e196822169726f9dbbeea", 0x3, 0x5, 0x5, 0x40, 0x0, 0x8}) bind$tipc(r2, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) r8 = socket$tipc(0x1e, 0x5, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) bind$tipc(r8, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, &(0x7f00000001c0)}) setuid(0x0) setsockopt$TIPC_GROUP_JOIN(r8, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x8, 0xf, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r3, @ANYRES64=r7, @ANYRESHEX=0x0], &(0x7f00000000c0)='GPL\x00', 0x2, 0xffb, &(0x7f0000001e40)=""/4091, 0x41100, 0x56}, 0x94) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) execve(0x0, 0x0, 0x0) 4m43.400346544s ago: executing program 2 (id=960): socket$nl_route(0x10, 0x3, 0x0) (async) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f00000002c0)) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="ad56b6c5910fae9d6dcd3292ea54c7b6ef", 0x11) (async, rerun: 32) r1 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 32) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000009b02"]) (async) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000740)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000001696f351b2bb22aae8b1336361c32049981664ace22a6c737f7ef9d58db22786325a31ffd9836649c665c8dd6c55b9e27f60e0dc25d8f45d039c2e15f6fc2172691ed086ab338696474c2542b84735587bfa5b1b0db221f14c4e18cf666c0c4b3fe7bb3f3178f51ad70e7fe099da233e378ebfa8418cd05dcd9cfb70fc3408ce703a63079dc3359d8bf54b4c51b3671bed064c5ed9e2d2ee50620af2", @ANYRES32=0x0, @ANYBLOB="0000000020000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r3, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) (async) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x44, 0x0, 0x1, 0x70bd2e, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_TX={0x5, 0x18, 0x1}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES={0x8, 0x3, 0x1000}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES_IRQ={0x8, 0x5, 0xfffffffd}]}, 0x44}}, 0x0) (async) syz_clone3(&(0x7f0000000140)={0x4000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x2}, 0x7a) (async) r7 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000040)={'vxcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000080)={0x1d, r8, 0x2, {0x2, 0x0, 0x2}}, 0x18) (async) sendmsg$kcm(r7, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000005c0)=[{0x0}, {&(0x7f00000004c0)="8ae4f5dbfc58", 0x6}], 0x2}, 0x48005) (async, rerun: 64) r9 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r10 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000340), 0xf2, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r10, r10, r10}, &(0x7f0000000300)=""/37, 0x25, &(0x7f0000000180)={&(0x7f0000000080)={'hmac(sha1-avx2)\x00'}}) (async) r11 = socket(0x1, 0x803, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="400000001000030425bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="b7050000009f020000004b845915b6ebbb1efa480000000000000000000227c41a0937078aaf", @ANYRES32=r12, @ANYBLOB], 0x40}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) (async, rerun: 64) syz_io_uring_setup(0xbc3, 0x0, 0x0, 0x0) (async, rerun: 64) syz_io_uring_submit(0x0, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) 4m43.274922984s ago: executing program 2 (id=961): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x26020480) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x80000, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r2, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfebc) sendto$inet6(r2, 0x0, 0x0, 0x200c8004, &(0x7f0000000280)={0xa, 0x4e22, 0x0, @mcast2}, 0x1c) sendto$inet6(r2, &(0x7f00000009c0)="c7cfcaaa22e10542fca5c0195350f15147657e0bfc59d383a47190db88690e6fedc3040ab5809ae02a54cd429cc3338c5afa0c9dce3f91950d1f567f358ac21154159130e88cbb6c43197813b2f23f3e442f80877490b393408142ebcfea6821f543e5ee9e27032e2b75d78f1b79f5a6bb6f0645e267770ef7e8f3a92148091217450ce8581e54223eeb6486205a209bf1fe854d211c03f8c3140fc3979d824082990d119473d20e94f253c9621fac339560ae46cb24b88bf2d01559bb658e343257b90f233b81bc5c398be3bbddb23a1e", 0xffd6, 0xc001, 0x0, 0xffffffffffffff0c) sendmsg$inet6(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000340)="2f6c62fdf406a1a0175bd356c35c10e4d1be87033978d275293527325d1cd47e250c", 0x22}], 0x1}, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0xfc, 0x2, 0x4}) ioctl$vim2m_VIDIOC_EXPBUF(r4, 0xc0405668, &(0x7f0000000200)={0x8cf7e7d1ad16c9e0, 0x0, 0x2, 0x80000}) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) 4m42.100456061s ago: executing program 2 (id=966): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa004}, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) lseek(r2, 0x851, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0x6, 0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) quotactl_fd$Q_GETFMT(r3, 0xffffffff80000401, 0xee00, &(0x7f00000001c0)) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x616a}, 0x1c) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x8010000000000084) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902"], 0x0) socket(0x10, 0x3, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) 4m41.748949256s ago: executing program 2 (id=967): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) socket$netlink(0x10, 0x3, 0xa) open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x21, &(0x7f00000005c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000b00)=ANY=[@ANYBLOB="0600000004000000be7000005c00000000000000", @ANYRES32, @ANYBLOB="000000000000000000e2ff000000000000000000", @ANYRES32=0x0, @ANYRES32], 0x48) 4m40.966502516s ago: executing program 32 (id=967): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) socket$netlink(0x10, 0x3, 0xa) open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x21, &(0x7f00000005c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000b00)=ANY=[@ANYBLOB="0600000004000000be7000005c00000000000000", @ANYRES32, @ANYBLOB="000000000000000000e2ff000000000000000000", @ANYRES32=0x0, @ANYRES32], 0x48) 2m41.764524849s ago: executing program 1 (id=1357): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = socket$netlink(0x10, 0x3, 0x8000000004) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x3, 0x0, [{0xb56, 0x0, 0x101}, {0x0, 0x0, 0x1c3}, {0x27a, 0x0, 0x2}]}) writev(r3, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e22f000000058000b480400945f64009400050038925a01000000000000008000f0fffeffe809000000fff5dd0000001000010006080800418e00000a04fcff", 0x58}], 0x1) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r5 = syz_io_uring_setup(0x22f, &(0x7f0000000080)={0x0, 0x1, 0x10100, 0x3}, &(0x7f0000000300)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r6, r7, &(0x7f00000009c0)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x76, 0x0, r4, 0x0, r0}) io_uring_enter(r5, 0x7a98, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x1, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="18120000020000000000000004c4000095000000e000000042e4d13bed63e7a52ade23d7d0e7e1867af60aeded2fb2f919305dad4bebd736b825f176a818cc5ce902bf47c77e35a8c61e31f3c63cb4673241878a6ccb5421b9639b1c0455feb67381ea8faa708c5355960c553edd585c1cbf3e962c1a0521ad572e35dc88"], &(0x7f0000000200)='GPL\x00', 0x5, 0xb7, &(0x7f0000000140)=""/184, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) 2m40.936428959s ago: executing program 1 (id=1359): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="0100000000000000c401"]) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x900, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000180)={0x63c0, 0x0, 0x1}, 0x18, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r4, 0xf4240, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_STATISTICS(r5, 0x11b, 0x8, 0x0, &(0x7f00000001c0)) ioctl$FBIOPUTCMAP(r3, 0x4605, &(0x7f00000003c0)={0xfffffffa, 0x1, &(0x7f00000002c0)=[0x299], &(0x7f0000000300), &(0x7f0000000340), 0x0}) 2m40.713567555s ago: executing program 1 (id=1360): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x2, 0xff, 0x71, 0x20, 0x9c4, 0x11, 0xb01c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x4, 0x10, 0x0, [{{0x9, 0x4, 0x7e, 0x10, 0x2, 0x26, 0xd5, 0x18, 0x8, [], [{{0x9, 0x5, 0x6, 0x2, 0x3ff}}, {{0x9, 0x5, 0x82, 0x2, 0x8}}]}}]}}]}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async, rerun: 64) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a0b040000000000000000020000002c0004802800018007000100637400001c0002800800014000000002080002400000002005000300000000000900010073797a30000000000900020073797a32"], 0x80}}, 0x0) (async, rerun: 64) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0003f4000000f403"], 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000004c0)={0x14, 0x0, &(0x7f0000000e00)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) (async, rerun: 64) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000040)={0x40, 0x2, 0xc, {0xc, 0x21, "f027b882a8e1cdc1f670"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) (rerun: 64) unshare(0x2c020400) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r2) sendmsg$TIPC_NL_MON_SET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x38, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffffffff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0xffffff19, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x0, 0x2, 0x140}]}]}, 0x38}}, 0x0) (async) r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000f40)='ns/mnt\x00') setns(r4, 0x20000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x40, 0x0) (async) map_shadow_stack(&(0x7f000088f000/0x3000)=nil, 0x3000, 0x1) (async) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x8, 0x2) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) 2m39.67905352s ago: executing program 1 (id=1364): r0 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x8, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000b4321f00000000000a00631818000000", @ANYRES32, @ANYBLOB="0000000000000100b706000014020100b7030000000600188500000008000000bf0900000000000055090100000000007b00000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x9, 0x1000, &(0x7f0000001e40)=""/4096, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) 2m39.473320717s ago: executing program 1 (id=1365): r0 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) mount$fuse(0x0, 0x0, 0x0, 0xa02002, &(0x7f00000004c0)=ANY=[@ANYBLOB="66643dc6953bd340e3272b71d8f75d2e259bf1b1641dbb07e599bb12e499abcbe83cb20c3beb0dfa38c10e940b6828039ec26a486cc445322e0a22037201a9aafdefaad479199cd361137641824dfeb422ab103c6a236f4c9ae516aaf718425b7cbf0a21a98a672989ebb66211460e26e8d8f0a8338d62ea54b8dbc1492deefab8989d8802bb1b8c5d61349a79922cad342e87ed63595e043a81fa36feb0f49bca508854", @ANYRESDEC, @ANYBLOB="40ef35a971d35097635122028eb919802534a9e95b3ca94bf84415370e72798ba993e10be6a82eee4caa011b2c213a3a032f32435692c0ba1dc1f06b1de6bc83e6d684a1f35cf6", @ANYRESOCT]) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000400)=ANY=[], 0x1df) landlock_create_ruleset(&(0x7f0000000040)={0x4300, 0x2}, 0x18, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000000000000000000000000000000000000000000300", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 2m39.192475357s ago: executing program 1 (id=1366): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000fc0), 0xa01) r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x1054c3b7, 0x40801) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000140)={'\x00', 0xfff8, 0x7f, 0x10000, 0x0, 0x6}) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x7ff, 0x15555555, 0xc, 0xfffffffffffffffd, 0x59c, 0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000380)={{0x3, 0x10}, 'port0\x00', 0x42, 0x6, 0x3, 0x10001, 0x4, 0xb3b, 0x5, 0x0, 0x3, 0x9}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000020000000900010073797a300000000020000000000c01080000000000000000020000000900010073797a310000000014000000020a01020000000000000000000000002c000000180a01"], 0xa8}}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x4008031, 0xffffffffffffffff, 0x5b76f000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) pipe(&(0x7f00000000c0)) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$bt_hci(r3, 0x84, 0xd, &(0x7f0000003140)=""/4111, &(0x7f0000000080)=0x100f) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000413f5f201d0670c16fce0102030109021b0001000018000904"], 0x0) 2m37.692138567s ago: executing program 5 (id=1374): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000040)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0x300, 0x300, 0x0, 0x300, 0x1a0, 0x578, 0x578, 0x578, 0x578, 0x578, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'veth1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@private1, @loopback, [], [], 'tunl0\x00', 'bridge_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x300}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x1, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) r1 = socket$inet(0x2, 0x5, 0x5e9) shutdown(r1, 0x0) recvmmsg(r0, &(0x7f000001a800)=[{{&(0x7f0000019080)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f000001a480), 0x0, &(0x7f0000019240)=""/4096, 0x1000}}, {{&(0x7f000001a240)=@sco={0x1f, @fixed}, 0x80, &(0x7f000001a540)=[{&(0x7f0000019200)=""/1, 0x1}], 0x1, &(0x7f000001a340)=""/129, 0x81}, 0xac}, {{&(0x7f000001a400)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, 0x80, &(0x7f000001a740)=[{&(0x7f000001a300)=""/5, 0x5}, {&(0x7f000001a4c0)=""/67, 0x43}, {&(0x7f000001a8c0)=""/97, 0x61}, {&(0x7f000001a5c0)=""/129, 0x81}, {&(0x7f0000019200)}, {&(0x7f000001a680)=""/150, 0x96}], 0x6}, 0xd82}], 0x3, 0x20, 0x0) set_mempolicy(0x2, 0x0, 0xf5) r2 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r6 = syz_open_dev$sndctrl(&(0x7f0000000580), 0x2, 0x141240) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x64, 0x4, 0x3b0, 0xffffffff, 0x128, 0x210, 0x210, 0xffffffff, 0xffffffff, 0x2e0, 0x2e0, 0x2e0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x100, 0x128, 0x0, {}, [@common=@inet=@socket1={{0x28, 'socket\x00', 0x3}}, @common=@ah={{0x30}, {[], 0x0, 0x0, 0x5}}]}, @REJECT={0x28}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, [], [], 'wlan0\x00', 'wg0\x00'}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, [], [], 'wg2\x00', 'ip6_vti0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x410) r7 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r7, 0x10f, 0x81, &(0x7f0000000480), 0x4) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f000001a580)=ANY=[@ANYRES16=r6, @ANYRES32=r2], 0x7c}, 0x1, 0x0, 0x0, 0x10800}, 0x20048853) sendmsg$NFT_BATCH(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[], 0x74}}, 0x0) recvmmsg(r7, 0x0, 0x0, 0x40002102, 0x0) socket(0x37, 0xf, 0xe) syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r9 = io_uring_setup(0xab1, &(0x7f0000000080)={0x0, 0xdf4, 0x10000, 0x7, 0x84}) io_uring_register$IORING_REGISTER_BUFFERS(r9, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) 2m36.554201005s ago: executing program 5 (id=1375): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3e616dc4010203010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r1, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000001200)='./file0\x00', &(0x7f0000002100), 0x2, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r2, &(0x7f0000006300)={0x2020}, 0x2020) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) r3 = memfd_create(&(0x7f0000000400)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\x90\xf5\xbb\x1c\xac\xc7\xad\xdc\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bC\xd8\x1c\xe8\x9bYSp\xa5\xfd\ny\xdfS\xdbU\xf80\xa88\tl\xb5b\x83\x97+o:\xfc\x83\x18\xe46\x8a\x029\x19\x8fjC\xce\xa7S\x81\xd5\xda\x84\xdf\xe3A_\x05XCk\x1d\x1cC\x97r\x93\xd6t\x81b\xc7x\xab\xa2\xf0\av\x88\x01\x92\xeaF\xa9!\xfc\x1c\xbf7q\xcf\xed&\x96\xa6\x1c_\xff\xb4\x00X\x1b\xedw\xc1', 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xa, 0x11, r3, 0xe7e47000) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) unshare(0x22020600) r4 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000100)='/proc/asound/card1/oss_mixer\x00', 0x200000, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000fc0)={0x14, &(0x7f0000000e80)={0x20, 0x3, 0xc6, {0xc6, 0xc, "14e63a2871c073c32803f9eb32cdca15f8474db6bb0d19176e7626bb757cf2d19c5634e2f7810dee094be482f3baa26774789723149dbcb4c99e0352dc25af0fd6e4a939ac641990fc26256e58d1adc2c189255551042ed38c698da1fbfb02b883eca107ff96a4af42d1acd750ff12354dcd0f988ee72c86f0ec24815dc69f5fc3bd8b44299d716c4af8b1f84b96af455a06135d0558abf754036985a49c1be364f36133a6cceec9d69a3eb3b6a0b998282b66677c1f65fee4118a56e084b29f292f2272"}}, &(0x7f0000000f80)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000012c0)={0x44, &(0x7f0000001000)=ANY=[@ANYBLOB="4001e8000000d6fac91c2228255667ac4d43490b1ca43d9e7cdcedec301fb34832824eabc15daa7a14899f580dacd040622a27158cef83d0c49d3ad6df874bbf3aa863ef0dd180457cd9fb7d1e4bd35585bb537945369a689a7bda8ed0b3405760ad1539f6ec8adcf1ffcc9b81d7ae12815fa68b66ed63ec120376bd5ac08a1b5c1643a976a8a6ff3600003f0d6aa2b7cf315f24ec24f2b71214ddc0fcc4cf87c4bf84107f0b15ec56c4c412111ec7c8db348ce9391ac100b48a17fd068c06d5225cf59b5c7ad3a79a3176b49ca987dddf4579f9d18502ff61e03bc0a089328f73899beec1fedb94cd07a499"], &(0x7f0000001100)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000001140)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000001180)={0x20, 0x80, 0x1c, {0x9, 0x7, 0x800, 0x3, 0x0, 0x1000, 0x3, 0x9, 0xf, 0xb, 0x9, 0x3ff}}, &(0x7f00000011c0)={0x20, 0x85, 0x4, 0x7}, &(0x7f0000001200)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000001240)={0x20, 0x87, 0x2, 0x8}, &(0x7f0000001280)={0x20, 0x89, 0x2}}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff6000/0x9000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, 0x0, 0x0, r4}, 0x68) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) r6 = accept$alg(r5, 0x0, 0x0) sendmmsg$alg(r6, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x240001d1}], 0x1, 0x45) recvmmsg(r6, &(0x7f0000002380)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f00000001c0)=""/63, 0x3f}], 0x4f}, 0x1}], 0x1, 0x2143, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000280)={0x0, 0x0, 0x1, "12"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_connect$cdc_ecm(0x2, 0xcc, &(0x7f0000000640)=ANY=[@ANYBLOB="12010003020000ff2505a1a44000010203010902ba0001018190050904000f0302060009082406007fdd339c4fdd4a900870230051b9f10524000107000000fbff03000108241c050054ff034324135127936a639ad4410c7766961d86200bade68d0d070a4e390747bfb1c3672fec1b06aa48bea1bd7d7427f5a3c0a2002d0163f3d8cb533d4c60f3ead02e71457806241a050001072414d0000500242413521774a16cf3562e94a02a5fe178ffafce8e4d3834ff061a52f9127cdd5c5d77c30905820240000106020905030210000f1d95"], &(0x7f00000005c0)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x201, 0xe, 0x7f, 0x81, 0x8}, 0xbc, &(0x7f0000000180)=ANY=[@ANYBLOB="050fbc00060a10030006001009b10003100b501003f7bf0502a1179f0d392eb8d99383c50d0e0ba5bef46596e6036b1ae5c3d2964b1dee4cbef848586e6412e1dc5bbae446fb096a863cf852ff2d8bddb3738abe53f5daec431cd021a490320329c296e862e10903b2713f100a334d3a51b8ca1cf67280401c4a164caf277d7b8ff05e164faea38367d12fb1b85b4427b5a7a9aecd62c3a717ddc09cd7514912fc27db8594c7dd33090b10010c1200041603000210100ae9810bd022"], 0x7, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x41d}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x42c}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x813}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x500a}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x4001}}, {0xe7, &(0x7f0000000440)=@string={0xe7, 0x3, "7efe71a0791c81d77e4fef692b12c5ebf276239a99926aa8a9b2c676802e950f45b7a5e2a3798be53191515b942a9fa31068206de04d205896097fff861e04e472f5ae21fa9941c96bc172c378028380884b6a831d936ed840e2bedc791cfaf66224254ea4d8adff05c9b5d4ab12c03a8efa552a2090c221778341a020bf88ce0fbc0ca7673df2f9f5b9956c2a8df46825db59bf386bd1e8974a0057600f63872647c31ba391fc0408a9a330ab8a1bc7d4065e9367e2c499fd4e943a6e867f4a6b85bd748bf520874d9711f2755dd2df9f546beeb81d1f8e4f3343fc6c44f4e1cc2add1a71"}}, {0x5e, &(0x7f0000000540)=@string={0x5e, 0x3, "f8d8548b60e8af5d469f720335944458d3772c7ab03d19d6f6c3969eb21687b39398c636cd164c1ed6250e015930341504bf6c151b2eee03d3767054d8fa689899916db9d57d4a7a45215e07eed5f580816a52165e739acf6d220ff7"}}]}) syz_usb_control_io(r0, 0x0, 0x0) 2m33.222981829s ago: executing program 5 (id=1385): r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000000), &(0x7f00000002c0)=0x4) (async) syz_emit_ethernet(0x7a, &(0x7f0000000200)=ANY=[@ANYRES8=r0, @ANYRESDEC=r0], 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000003e0007010000000000000000017c00000400fc800c000180060006006558000008000280040006"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) (async) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f00000012c0)={0x2, {{0x2, 0x0, @multicast2}}, 0x0, 0x3, [{{0x2, 0x2, @broadcast}}, {{0x2, 0x0, @loopback}}, {{0x2, 0x0, @loopback}}]}, 0x210) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0xb, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x81}, 0x10) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/bus/input/handlers\x00', 0x0, 0x0) (async) r3 = socket$nl_audit(0x10, 0x3, 0x9) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0x1, &(0x7f0000000280)=0x4, 0x4) 2m32.88582461s ago: executing program 5 (id=1386): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x10b500, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x5f0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x3000, 0x10000}) ioctl$KVM_IOEVENTFD(r1, 0x40a0ae49, &(0x7f00000014c0)={0x0, 0x5000, 0xfb7f0000, r2}) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000000)={0x1, 0x0, [{0xb, 0x1, 0x1, 0x0, @adapter={0xfffffffffffffeff, 0x33, 0x9, 0x76bf1407, 0x7a05d4b3}}]}) 2m32.11251068s ago: executing program 5 (id=1388): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000001a0001000000000000000a0080202000", @ANYRES32=0x0, @ANYBLOB="00000000080003000000000014"], 0x38}}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="7f454c4600000006010000000000000002003e000000000003000000000000004000deffffffffff970100000000000000010000000038"], 0x78) close(r1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) 2m31.820560368s ago: executing program 5 (id=1390): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000fc0), 0xa01) r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x1054c3b7, 0x40801) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000140)={'\x00', 0xfff8, 0x0, 0x10000, 0x0, 0x6}) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x7ff, 0x530, 0xc, 0xfffffffffffffffd, 0x59c, 0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000380)={{0x3, 0x10}, 'port0\x00', 0x42, 0x6, 0x3, 0x10001, 0x4, 0xb3b, 0x5, 0x0, 0x3, 0x9}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYRES64=r2], 0xa8}}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x1c9382, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f00000001c0)=0x1) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x4008031, 0xffffffffffffffff, 0x5b76f000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) readahead(0xffffffffffffffff, 0x0, 0xfffffffffffffffd) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f00000004c0)={0x7, 0x7f, 0x1}, 0x7) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x81, @local, 0xfffffffc}, 0x1c) pipe(&(0x7f00000000c0)) r7 = socket$inet6_sctp(0xa, 0x0, 0x84) getsockopt$bt_hci(r7, 0x84, 0xd, &(0x7f0000003140)=""/4111, &(0x7f0000000080)=0x100f) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xff, 0x3, &(0x7f0000000200)) syz_io_uring_setup(0x1069c9, &(0x7f0000000540)={0x0, 0x3387, 0x34, 0x1, 0x217}, &(0x7f0000000340)=0x0, &(0x7f0000000500)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0xc0, &(0x7f0000000480)=0xb, 0x0, 0x4) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000413f5f201d0670c16fce0102030109021b0001000018000904"], 0x0) 2m23.212738808s ago: executing program 33 (id=1366): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000fc0), 0xa01) r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x1054c3b7, 0x40801) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000140)={'\x00', 0xfff8, 0x7f, 0x10000, 0x0, 0x6}) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x7ff, 0x15555555, 0xc, 0xfffffffffffffffd, 0x59c, 0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000380)={{0x3, 0x10}, 'port0\x00', 0x42, 0x6, 0x3, 0x10001, 0x4, 0xb3b, 0x5, 0x0, 0x3, 0x9}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000020000000900010073797a300000000020000000000c01080000000000000000020000000900010073797a310000000014000000020a01020000000000000000000000002c000000180a01"], 0xa8}}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x4008031, 0xffffffffffffffff, 0x5b76f000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) pipe(&(0x7f00000000c0)) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$bt_hci(r3, 0x84, 0xd, &(0x7f0000003140)=""/4111, &(0x7f0000000080)=0x100f) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000413f5f201d0670c16fce0102030109021b0001000018000904"], 0x0) 2m16.167077452s ago: executing program 34 (id=1390): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000fc0), 0xa01) r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x1054c3b7, 0x40801) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000140)={'\x00', 0xfff8, 0x0, 0x10000, 0x0, 0x6}) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x7ff, 0x530, 0xc, 0xfffffffffffffffd, 0x59c, 0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000380)={{0x3, 0x10}, 'port0\x00', 0x42, 0x6, 0x3, 0x10001, 0x4, 0xb3b, 0x5, 0x0, 0x3, 0x9}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYRES64=r2], 0xa8}}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x1c9382, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f00000001c0)=0x1) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x4008031, 0xffffffffffffffff, 0x5b76f000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) readahead(0xffffffffffffffff, 0x0, 0xfffffffffffffffd) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f00000004c0)={0x7, 0x7f, 0x1}, 0x7) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x81, @local, 0xfffffffc}, 0x1c) pipe(&(0x7f00000000c0)) r7 = socket$inet6_sctp(0xa, 0x0, 0x84) getsockopt$bt_hci(r7, 0x84, 0xd, &(0x7f0000003140)=""/4111, &(0x7f0000000080)=0x100f) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xff, 0x3, &(0x7f0000000200)) syz_io_uring_setup(0x1069c9, &(0x7f0000000540)={0x0, 0x3387, 0x34, 0x1, 0x217}, &(0x7f0000000340)=0x0, &(0x7f0000000500)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0xc0, &(0x7f0000000480)=0xb, 0x0, 0x4) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000413f5f201d0670c16fce0102030109021b0001000018000904"], 0x0) 2m15.409782364s ago: executing program 4 (id=1418): bind$alg(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getpid() r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000280)=""/239, 0xef) read$char_usb(r1, 0x0, 0x0) write$char_usb(r1, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) clock_settime(0x7, 0x0) syz_usb_disconnect(r0) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x2d3e, 0x0, 0x0, 0x0, 0x0) 2m12.924245893s ago: executing program 4 (id=1423): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES64, @ANYBLOB="0100440600905700000008000000000200000008000300130a5f3656b858b70ef473b8c32ebbee5af98b", @ANYRES32=r1, @ANYBLOB="0c00990000000000000000000800a102ffff0026006b0300007abd961ac3dfbb05cc61180cdf07b4f33d7a7cc0ad259d1101833ca76200401cd081f45cd4136226b432c7c28c840712c807a3f91b4dc5575e2395dabae4ab2edfb39734852fa4cbbe93d9880d18b05f55180d9a2612f9811c72890274b873e6cdaf5164dfdd2929441b39ee0c4381c065ff69a40ab96c949b6e450000000076395ebfbc2d7aa17f42f72fb8c2de90000000", @ANYRESOCT], 0x40}, 0x1, 0x0, 0x0, 0x50}, 0x0) 2m12.60044548s ago: executing program 4 (id=1425): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000900)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000f0000001c0007800c000400002e0000000000000c0003002d"], 0x30}}, 0x0) 2m12.130568121s ago: executing program 4 (id=1426): r0 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x8, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000b4321f00000000000a00631818000000", @ANYRES32, @ANYBLOB="0000000000000100b706000014020100b7030000000600188500000008000000bf0900000000000055090100000000007b00000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x9, 0x1000, &(0x7f0000001e40)=""/4096, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) 2m11.681342779s ago: executing program 4 (id=1427): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff0001, 0xffffffff, 0x1}}) r2 = dup(r0) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = socket(0x40000000015, 0x5, 0x0) bind$inet(r3, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) getsockname$packet(r3, 0x0, &(0x7f0000000300)) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000240)={'ip_vti0\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x1, 0x7, 0xa, 0xd5, {{0x36, 0x4, 0x0, 0x0, 0xd8, 0x66, 0x0, 0x0, 0x2f, 0x0, @private=0xa010102, @local, {[@cipso={0x86, 0x36, 0x3, [{0x0, 0x12, "16c1751d86d9f45f15a45bd1eb287c1e"}, {0x7, 0xf, "901f36c88fdcbfa17b997ace63"}, {0x0, 0xf, "58497216a618ff066c24740473"}]}, @rr={0x7, 0xf, 0x56, [@loopback, @remote, @multicast2]}, @lsrr={0x83, 0x2b, 0x2e, [@loopback, @multicast2, @broadcast, @broadcast, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x18}, @remote, @rand_addr=0x64010100, @multicast1]}, @generic={0x86, 0xa, "57711a7c39c465a4"}, @generic={0x7, 0xe, "4a1603253ce6878bcabba492"}, @generic={0x86, 0x5, "b14a09"}, @timestamp_addr={0x44, 0x34, 0xab, 0x1, 0x0, [{@rand_addr=0x64010102, 0x1c000}, {@private=0xa010101, 0x200}, {@multicast2, 0x4}, {@multicast2, 0x5}, {@empty, 0x2}, {@private=0xa010102, 0xffffffff}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000580)={'ip6tnl0\x00', &(0x7f00000002c0)={'syztnl2\x00', r4, 0x29, 0xff, 0xbe, 0x61, 0x8, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, 0x1, 0x8, 0x6ca38921, 0x7}}) r5 = syz_usb_connect(0x0, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ec13b2106d04d308280b0102030109022900010000000009046900000e01000008240501020205050764f7edb276"], 0x0) syz_usb_control_io(r5, &(0x7f0000002780)={0x2c, 0x0, &(0x7f0000002400)=ANY=[@ANYBLOB="000302aadc274d03"], 0x0, 0x0, 0x0}, 0x0) r6 = syz_io_uring_setup(0x23b, &(0x7f00000000c0)={0x0, 0x1ffffe, 0x20, 0x40000, 0xfffffffd, 0x0, r2}, &(0x7f0000000180)=0x0, &(0x7f0000000200)=0x0) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r9, 0x0, 0xf, &(0x7f0000000280)=0xa, 0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000001c0)={0x4, 0x4, 0x8000}) bind$inet(r9, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ioctl$KVM_HYPERV_EVENTFD(r11, 0x4018aebd, &(0x7f0000004c80)={0x2, r12}) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x1d, &(0x7f00000005c0)=0x9, 0x4) syz_io_uring_submit(r7, r8, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x230}}) io_uring_enter(r6, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r13 = inotify_init() readv(r13, &(0x7f0000000140)=[{&(0x7f0000000340)=""/263, 0x107}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) 2m8.26201743s ago: executing program 4 (id=1431): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000fc0), 0xa01) r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x1054c3b7, 0x40801) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000140)={'\x00', 0xfff8, 0x7f, 0x10000, 0x0, 0x6}) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x7ff, 0x530, 0xc, 0xfffffffffffffffd, 0x59c, 0xffffffffffffffff}) (fail_nth: 9) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000380)={{0x3, 0x10}, 'port0\x00', 0x42, 0x6, 0x3, 0x10001, 0x4, 0xb3b, 0x5, 0x0, 0x3, 0x9}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000020000000900010073797a300000000020000000000c01080000000000000000020000000900010073797a310000000014000000020a01020000000000000000000000002c000000180a01"], 0xa8}}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x4008031, 0xffffffffffffffff, 0x5b76f000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) pipe(&(0x7f00000000c0)) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$bt_hci(r3, 0x84, 0xd, &(0x7f0000003140)=""/4111, &(0x7f0000000080)=0x100f) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000413f5f201d0670c16fce0102030109021b0001000018000904"], 0x0) 1m53.099991349s ago: executing program 35 (id=1431): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000fc0), 0xa01) r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x1054c3b7, 0x40801) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000140)={'\x00', 0xfff8, 0x7f, 0x10000, 0x0, 0x6}) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x7ff, 0x530, 0xc, 0xfffffffffffffffd, 0x59c, 0xffffffffffffffff}) (fail_nth: 9) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000380)={{0x3, 0x10}, 'port0\x00', 0x42, 0x6, 0x3, 0x10001, 0x4, 0xb3b, 0x5, 0x0, 0x3, 0x9}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000020000000900010073797a300000000020000000000c01080000000000000000020000000900010073797a310000000014000000020a01020000000000000000000000002c000000180a01"], 0xa8}}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x4008031, 0xffffffffffffffff, 0x5b76f000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) pipe(&(0x7f00000000c0)) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$bt_hci(r3, 0x84, 0xd, &(0x7f0000003140)=""/4111, &(0x7f0000000080)=0x100f) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000413f5f201d0670c16fce0102030109021b0001000018000904"], 0x0) 17.362434389s ago: executing program 8 (id=1750): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf2, 0x30, 0x39, 0x20, 0x2c42, 0x1202, 0x8540, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc, 0x2, 0x2, 0xc1, 0x7f, 0xc, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000c80)={0x34, &(0x7f0000000480)={0x40, 0xb, 0x1, "e4"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000180)={0x40, 0x12, 0x1, "b4"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000000)={0x40, 0xb, 0x24, {0x24, 0x8, "79491b13db2cfc369627327f1d1855983236dc30f7133ecca936575174ea26a04cc5"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x380a}}}, &(0x7f0000000400)={0x44, &(0x7f0000000280)={0x20, 0x15, 0x95, "756b7d9e6f31ebef9f9c9b48520e29289869a10bb2996ec2a4326025aea326be95d17a95f4489b1c30b47e37fe77349cfdc40148579f5f59c7d1cd54e27116aede180d4154682e6fbd9d86c00659553f3d120902a66155f48f020724d172d0e028bc04a726c8824775a30ffe3bb1b99358a586fd1ecd2083bc74d453cbb5afde3c8676916a69591e79548f5d00ad0c48a59e537443"}, &(0x7f0000000100)={0x0, 0xa, 0x1, 0x78}, &(0x7f0000000140)={0x0, 0x8, 0x1, 0x8}, &(0x7f00000001c0)={0x20, 0x81, 0x2, "a0ba"}, &(0x7f0000000200)={0x20, 0x82, 0x2, "8e28"}, &(0x7f0000000340)={0x20, 0x83, 0x3, "4d1f1f"}, &(0x7f0000000380)={0x20, 0x84, 0x1, 'E'}, &(0x7f00000003c0)={0x20, 0x85, 0x3, "afb8d1"}}) syz_usb_control_io(r0, 0x0, &(0x7f0000000700)={0x84, &(0x7f0000000240)={0x20, 0x8, 0x1, "b4"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14.283590738s ago: executing program 0 (id=1759): socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r3 = socket$inet(0x2, 0x2, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) writev(r5, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000000)="2ac3c2d5fa4423c5ad1ddee97879c38bf8", 0x11}], 0x1}, 0x840) writev(r5, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'macvtap0\x00'}) setsockopt$inet_msfilter(r6, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) setsockopt$inet_mreqsrc(r4, 0x0, 0xe, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) setsockopt$inet_mreqsrc(r3, 0x0, 0x27, &(0x7f0000000440)={@multicast2, @loopback, @private=0xa010100}, 0xc) pwritev(r2, &(0x7f0000000940)=[{&(0x7f0000000240)="01000000", 0x4}, {&(0x7f0000000280)="f697079a161cfb7702711e629acda76933ddd0c20574eb4d4d28f9", 0x1b}, {&(0x7f00000001c0)="c27d037369597e0a4e6d", 0xa}], 0x3, 0xfff, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x10001, 0x0, 0xb49, 0x9, 0x6, 0x0, 0x3}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, 0x0, 0x0) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x8, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000a0000180000000001000000b7080000000010007baa00fe00000000b5080200000000007b8af0ff00000000bf8100000000000007010000a8d5b100bfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7050000080000008500000008000000950000000000"], &(0x7f0000000300)='GPL\x00', 0x9, 0xff7, &(0x7f0000001e00)=""/4087}, 0x94) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r8 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$FBIOBLANK(r8, 0x4611, 0x0) 13.954831131s ago: executing program 8 (id=1760): r0 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) mount$fuse(0x0, 0x0, 0x0, 0xa02002, &(0x7f00000004c0)=ANY=[@ANYBLOB="66643dc6953bd340e3272b71d8f75d2e259bf1b1641dbb07e599bb12e499abcbe83cb20c3beb0dfa38c10e940b6828039ec26a486cc445322e0a22037201a9aafdefaad479199cd361137641824dfeb422ab103c6a236f4c9ae516aaf718425b7cbf0a21a98a672989ebb66211460e26e8d8f0a8338d62ea54b8dbc1492deefab8989d8802bb1b8c5d61349a79922cad342e87ed63595e043a81fa36feb0f49bca508854", @ANYRESDEC, @ANYBLOB="40ef35a971d35097635122028eb919802534a9e95b3ca94bf84415370e72798ba993e10be6a82eee4caa011b2c213a3a032f32435692c0ba1dc1f06b1de6bc83e6d684a1f35cf6", @ANYRESOCT]) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000400)=ANY=[], 0x1df) landlock_create_ruleset(&(0x7f0000000040)={0x4300, 0x2}, 0x18, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 13.300389063s ago: executing program 8 (id=1762): r0 = io_uring_setup(0x218a, &(0x7f0000000240)={0x0, 0xad5e, 0x2, 0x4, 0x221}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000000), 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r3) syz_genetlink_get_family_id$nl80211(&(0x7f0000001080), r3) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 13.299942243s ago: executing program 0 (id=1763): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_ACTIVATE(r1, 0x4b4a, 0x10000000000004) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x2, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x6e21, @local}, 0x10) sendmmsg(r0, &(0x7f0000002cc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[], 0xc}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000002800)=ANY=[@ANYBLOB="10000000000000008d01000000100000010000000001"], 0x20}}], 0x2, 0x8001) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x80240) ioctl$EVIOCGKEYCODE(r3, 0x80084504, &(0x7f0000000100)=""/115) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000080000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000021440011800a0001006d617463680000003400028008000240000000001c0003000afe6cbf96caa5debdad61b67ddb2fb68fcf19f7807076430a00010071756f7461"], 0xc8}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) 12.925912958s ago: executing program 0 (id=1764): userfaultfd(0x80001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'md5-generic\x00'}, 0x5a) r1 = accept4(r0, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000040)="cb", 0xfffffdef) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) 12.241758905s ago: executing program 8 (id=1766): socket(0x9, 0x3, 0x6) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee6, 0x0, 0x1, 0xbfdffff9}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) r3 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000000100)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0}) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000200)={&(0x7f0000000040)=[{0x4, 0x5201, 0x2, &(0x7f0000000300)='/G'}], 0x1}) r5 = socket$pppoe(0x18, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x3f, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2b, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2b, 0x0, 0x0) syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0) unshare(0x40000000) sendmmsg(r5, &(0x7f0000001340)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000500)="ab", 0x1}], 0x1}}], 0x1, 0x24048884) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) io_uring_enter(r0, 0x47f6, 0x0, 0x40, 0x0, 0x0) socket$kcm(0xf, 0x3, 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x28801, 0x0) 10.133759483s ago: executing program 0 (id=1771): syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mremap(&(0x7f00003ef000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000940)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r3 = accept$alg(r2, 0x0, 0x0) sendmsg$alg(r3, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r3, &(0x7f0000000600), 0xfec8) recvmmsg(r3, &(0x7f00000008c0)=[{{&(0x7f00000000c0)=@pptp={0x18, 0x2, {0x0, @initdev}}, 0x80, &(0x7f00000005c0)=[{&(0x7f00000001c0)=""/200, 0x6}, {&(0x7f0000000140)=""/9, 0xa}, {&(0x7f0000000300)=""/225, 0x2}, {&(0x7f0000000400)=""/41, 0xfeb2}, {&(0x7f0000000440)=""/123, 0x7b}, {&(0x7f00000004c0)=""/203, 0xcb}], 0x6, &(0x7f0000000640)=""/123, 0x7b, 0x2000000}}, {{&(0x7f00000006c0), 0x80, &(0x7f0000000840), 0x0, &(0x7f0000000880)=""/24, 0xffffffffffffffe0}}], 0x2, 0xcb, &(0x7f0000008000)={0x0, 0x989680}) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet(r5, &(0x7f0000000d00)=[{{&(0x7f0000000040)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000080)='e', 0x1}], 0x1}}, {{&(0x7f0000000880)={0x2, 0x4e23, @rand_addr=0x64010101}, 0x10, &(0x7f0000000a80)=[{&(0x7f00000008c0)='K', 0x1}], 0x1}}], 0x2, 0x4000) shutdown(r5, 0x1) pipe2$watch_queue(&(0x7f0000000180), 0x80) getsockopt$inet_sctp6_SCTP_MAXSEG(r5, 0x84, 0xd, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000100000027bf000200050000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, r6, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000a40)={r6}, 0x4) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15) 8.768504308s ago: executing program 3 (id=1774): ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000180)={0xffffffffffffffff}) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000002280)=0x1de, 0x4) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x80) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r3, &(0x7f0000ccb000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x23}}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001a00)=ANY=[@ANYBLOB="18000000030000000000000026d0000095002b000000000093adff012255f674412d02000000880b5f04596a5e99fce658be2f200c699223886d8be4b50000005ab527ee3697f98125f30e6326996a3cfee33025a30b45bdcf2c69d105e5e55a1d273683623f1a5dc6e3c7e20eb7a98ecf3bd2cf898e924abe26ac296f660e69ba982fd76e00dcff7f0000ca6b78ad833488cfe4109eaf009eddcf21f5c63cde2f00150200000001000000520a0000151d010000000100bf00000000cc587424363da52001a3cdf2000000db74596fd72c002a60c1bc7dc8c38b7d2e13c50424b9dd1145d03ff45f70685c6bd9ff41c69b7de406e89dcbb7677e65a88a8407a9e7f9c0e91028b0856eb1ed9474480737a55ebb0bd701f7fb21135c6172eba7eb8a341f07e5a2d1e88b3cfc22df01e4bac9d97328fa2a82b5e8741e02056d93a433f50479387467824262852c7939db5672d07cdbe8e14abf56497e5d56dbe37551b870b2851c3f0a1a9ebfcba105a6ccdd01b0f04edb256c0200000073f6db43661bd7f0e2536ffbfe5ca31b4083145531458b7d1e341c6b351ebc5223f54d6bec93f4ef088e5d1be2515226988d664709ff03f1aa3dc7f1580ace9bf2afd28d0700000000000000d6eb372713255012e028cb2654d493a0b43bf21375709f348f5eda2967199cc936859a538100070000000000dc10e13ef227f627a40000ad1fa253d33fa74f172d3407ae4e1e347c0c6ef9dd2b6bb700000000000000000c586272c3f4d79bc36315745cb149f3cb385e6add14652003c7cdd3324f07d134d3a6c718bbd1aafe1140cff0be4c6f8df084c5e9734ae30aa9af030025f01ab03a9b1074407136bc506031f0916a39d3057d55183612b39e73ae8e6dc30356886a831836469e2051d937eb85f3f2d5ae2c1dca476b97419a3b76ed62409d004d7fbe362145d19605d760df4c5124ca325d374b371867a79b35c6617fc3327191fbf514573f0e30d1d60be2168fffc2f3dccd599a2cb77f124e22f87673675805494db821f39b50d938d5fd8c6b2a3a324c257bc9110971b749ccd74089ed6b86f81ca3ba47d8f71d290ed1b1a11f7a67125170c88c3b6a50692cc0064fc6bbd312536ac15016c85c6332226401b110da9c786eeca22debc99335587b54c13c3107008fa069af8223b38ced735c2d906551004d8dc10d88738488da01ffa4add56474573c964a270000f2f16625c0c10200000000c7a5ca60fdad159f2e44171f39638410020000004825d081f2d987f05c534187738655d7dc958f2046fa0c1619a6554b82d9c162eb61ca74f1ffdaccf0ea5f06e0fca8b27ff3983ab74fd3d560700a1fab44e77e312b3b129e000302d613916c9bcf9f0000fac73a5b6bfb27f88dba816020be760f7b45e001efada8000000000000fdaf4660402f7b3b79a433e08074ea2462974a00040000eb01352638f56dae0249d15ba8767259658878b7492cfbacde9b57cf4de00788adce638190f3570e0b4c80ef682df22201270955afb6008846557ee3bc09fda6dbb6550d597300eb82a184c96ffde5a30e5433e866665b98ca2002c804c22ff2634b7bfbf5c0d586cda5b45fd00dede1e88a4d41dee7cc76d7a23d06acb1d2d4c58faea84158bb440df2a694f4cdcaa4f65c22efffffffffffdd00000000d503d79986958115ae07b70f991430b7fb475d77b869ee02000000000000000000001ffff0ef89b2a68d2b05c995445d8a7700bcdfbec74fb2dd163e863315e84498dfb52bb93f6c9084659ce777ddac563c8596c2b1d8180289a61faa95a82bf1cfb7f2fd7252e9322abe282c33445d443a67467893b9bf0d1c8130ae6b226900000635376413c29f7c6f7b7e29b9a0c64e68328661f0c06e21f7d7dc22174ea4447a6f60edef3a4168d40200fbc71104512efe8e5d7d934aa289b4bd2b870000000000000000000007000000002000000000009b777883a02f0593dfc4cb4114b9f9cf4ad155110cc6ace2b322ac31bfa27847c799c8009a1ea5b98e525e6383ad7fd9795170e7b11e247603c2ff49a11459c7f606d729d3979676bffb3049166bb84a0f061991bd57c2566c10c282352aba05b6164ef876915a3f2491e4793e590dcc71de10da96366c1e992c0068c940dd4422c9882d3aa0f8a797b8fea6efcfb5276b7679f15559edaa977504cc0b2f777acb907ebf5fc14add71d0bca37405ded69b77ab4a3d7487fd04000000de17e1e13b93669b79556abb722d9c085b189b5fd1f30e8dc813f608830b110001732135e8e7262f290000923bfb6b41ff3792cee2fc37eee739c3e36a4bc80112968ec0d8902eced1fe552018014a463abbbf7ccd6a92a5734e3ebfca9b6e88e031f31de2183652e77c164c646a1cfd3710aa4205d8d4d4f974133ccb1e49feb42664eccd809c0ba8917eda87489e8946d5c8156197bcb66fd5606c63e3389ee9e8552381646365066ef9a36a449c96485c22ad1aa423b7b89efbc6cd54000bb0ea5f4f1e8773144fb6ac9a44d43593d77e66aa7ed7f3d4e7b211590c738888d02b2dbb0b2ba73ec72e1d8d7360a128499dd19e1e7b9b0671f4f58515b45ecb9964f3c4ddb8234391d514f8d996d8d6dd7f8fadfee2d7a0035638ce27c2936cb04b30a0eb0cde0000000000000040000000ec3c12ecee8fc3a40000000000000000e215b00ce2570b930723cbadb4033d1b8aaa2cfb3fb89e4a6e89737fd6232218a9e0c099d1eb59d60b3cca089785642f327139bc4394fb6d547a9b3c22599e780c1da7433fb47615d372e3fffe9703e37d5c87d513165278650738efcc04d27b766cf7f60066edd292f6c8a2174f391ed164bb1816819ceb3e378e776d422bc946cd9501accebeac3a5b31d8abc68ae537cd44a04e6bc21c35a7beab2610c51e593676bf635a20f597f4631b91454d182f826071f5210bd6d93173589929b23801e63c2266fde13b5a04b8d48be057c752bc415a756ea9b4d34156c4f73dd5e5924ef101a5fcdaf37c7ba2c4a9de9b000000000000000000000000000000a73b862e4b63c245616b522345587d0ee65a6902bdd0abd941e8aba37510b222ae544f395edd1b92ad53fc68f08ea00edc5e10d768836169dd296d56b306e8b75778c37571792a6c3d8b02ef378ebd59422cdd008bef6f80a80a68641ea5ed4f1126bb676098c10bf663eb3fb8c839364d28fd046dc64b35f9c3397ce6f4ad357b0000000000090000000088c7a8e2638f650a6f04a6f33a090f59414d6ebcbc687e66d600000000bd0a58ea6d36fc2cf9b9a71c137a2a22adb1006f371d4faf47285fd66fe0389afb96854bb360edcdf11b4ff6dd578bba93e949d240cde9b5836cb46032484dc19c93db7b6e5afa10547c78e76a3111557346e52566df196fd630561bb908fff4d2e19562aabd43742a26a43799f8636fa04ceb40c9e4ca1cfbbc7b949cd245a3ee118fd0d4f639444539af8766028d4ac4d4c548e290199e0dacbb4f6796b39bf32934d941ba2f88e3ebd0cf8e24f99eca86e4ca9b2cd2b54044a7fc4631572a6378a32df288785f146275c1f548e2a0c1016744e05f9de5044373d7650125027547eefe7b2d8c8871bb65395fae99d8456883705bfdfb00001854b2e5efa8aaf25827d659f592b1575281ec125de7fb91cd81d91dcb19f5cdf1e1e2b4a8a1389753a09110538689e38e07fb2dc72bd4fd11d7bc16aac5d85c6101bb722895248e463a5fb45ce0e564e90cb19d5993b471687ae4165e29cf2f58082115f5f8569896eedfd798733223e6d6584997510c374912ab798bd4af4654c01bb2c411bc36468ddd62b4eba5cfc8953526e0e5b1359797956152d0098ce47c62c3fe5a23219389622b7f65bf03527d25c3941b9cf1ffeedf6d99082bb57ea871c12213cc40900f83033bc18c529171fae324c315bc6ce358831d0230412212acfd5fc8d5cb0d028cf568e8bb40e27befe2ff01f7c6674a4d86d900633ea36641e0a781ea0ea7f2d928b8b22e2f97dd13348927375baea6863bef4acf4299096ada5cdd2a0eaafaa760a79d102d1e0c0000000000000000007926653b8d79ce16a432f124786a0bc3c5b7d196822492ae1ccf91aeac16406ad6f9cd3d96d57fceba8360ae49f73351814c9c2972f11064aaf3739d9100f9c0e4d0cb17d50c82e305ba7d62cf1cc6da26e34982a8c74dd8122cf5b5e7c34fd2712a0cef05e4d8ec7dd363219676bd9b19943185b132eb35a695e208dfa5cecdb1d6425c8879063c0f11bd64291a4209ee6dc1d9e9010013f6148c603e6a335e298efd6ab5cccc47a2c568c6afec54f8251bd840752addf200371361c9eedf05ed98585cf6d99e9e56055064bda2d373369761238c278147cd0eb7799f6b9c9fcaa3fd282154994f5b25420c86db9b6401e885de1c615a719a1c83e8fbbb181282dbaf3313a4e4a4877e9f37607e2cd6da0cf6371ec06a75f5a4206b2418ad8897ae149085d63f01f22eca44033234b3930b4d5da756669a1d59d69e7de54abf439988ed7ec33c2d0a901bb0985a24878984d8a4340fa9a356d100926fb5f2ef9976366a61b8cc2bcb1c072b0e9c564852388e1edff10d75b3832792e471cc15b40380f94d834243080158603fbc9134d6983c540525447478984611c0d9666941bfc0a30db47a8828b6e5c51aee2094599b4ce52795750e1764f1657ca8c5633c71287239dddf5c651496f7bbd148c937f083d2e4e0197dbc6ff0649c749707b17399b1d7efad23abb8b40b38704737e15662ae4913a4a001cd3b71c7af75b5ffad9780650c800a40ca80ddc41987919142fd28dbf22db5f4c435415a03455e1d55d1783ccef97d7e4655cf839d06f06e137bbe462a03b3100231914b19739dd57b4f12d026ad0c7fd3"], &(0x7f00002bf000)='GPL\x00', 0x4, 0x436, &(0x7f0000000040)=""/183, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffc95}, 0x48) r5 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000180)={r3, r4}) ioctl$sock_kcm_SIOCKCMCLONE(r5, 0x89e2, &(0x7f00000027c0)={r5}) syz_genetlink_get_family_id$team(&(0x7f0000000280), r6) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r6, 0x89f2, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r6) close_range(r2, 0xffffffffffffffff, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f0000000200)={0x2020, 0x0, 0x0}, 0x2020) open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000002300)={0x50, 0x0, r7, {0x7, 0x9, 0x0, 0x31008003, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0x50) read$FUSE(r1, &(0x7f0000004580)={0x2020}, 0x2020) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ptrace(0x10, 0x1) 8.177684493s ago: executing program 3 (id=1777): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x4c831, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000180)=[{0x0, 0x47, 0x0, 0x0, @tick, {0x40, 0xff}, {0x0, 0x9}, @queue={0xee, {0x7, 0xc9a}}}, {0x0, 0x0, 0x0, 0x0, @time={0x367f, 0xfffffffd}, {}, {0x80}, @time=@time={0x9, 0x1}}], 0x38) read$snapshot(r1, 0x0, 0xffffffbf) read$usbfs(r1, 0x0, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) timer_settime(r2, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) 7.833567544s ago: executing program 3 (id=1778): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=ANY=[@ANYBLOB="3c02000019000100000000000008000000000000000000000000ffff00000000be14144416000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000084010500ff010000000000000000000000000001000004d2330000000a000000000000000000000000000000000000000135000001003b00830000000500000007000000fe8000000000000000000000000000aa000004d63c0000000a000000ff01000000000000000000000000000102350000020007007f0000000000000004000000e0000001000000000000000000000000000004d56c00000002000000000000000000000000000000000000000000000004030300040000000200000003000000fc000000000000000000000000000000000004d33c"], 0x23c}}, 0x4000) 7.648539977s ago: executing program 6 (id=1779): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_MSG_GETCHAIN(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x20, 0x4, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x2000c000}, 0x8000) r2 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x1501) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0xffffffff, 0x41, &(0x7f00000004c0)={0x4b5a9da54893e123, 0xf, 0x4, 0x4000, 0x3}, 0x26, 0x200, 0x8, 0x0, 0x0, 0x6, 0x0}) 7.468068844s ago: executing program 3 (id=1780): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa802, 0x0) socketpair(0x1, 0x1, 0x4, &(0x7f0000000280)) r0 = socket$packet(0x11, 0x2, 0x300) syz_genetlink_get_family_id$team(0x0, 0xffffffffffffffff) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth1\x00'}) ioctl$vim2m_VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f00000000c0)={0x1, @vbi={0x4, 0xd2, 0x50424752, 0x0, [0x80000000]}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000780)=@raw={'raw\x00', 0x3c1, 0x3, 0x398, 0x0, 0x4c, 0x1a, 0x198, 0x73, 0x2c8, 0x258, 0x258, 0x2c8, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @local, [], [], 'wg2\x00', 'macvlan1\x00', {}, {}, 0x11}, 0x0, 0x168, 0x198, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x0, 0x0, 0xc}}, @common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00', @dev, [], [0x0, 0x0, 0xffffff00]}}]}, @common=@inet=@SET2={0x30}}, {{@uncond, 0x0, 0xf8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@icmp6={{0x28}, {0x0, "e1f6"}}]}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f8) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="31042bbd7000fdffffff1600657464657673696d3000000008000005000400000000000500030001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r5 = getpgrp(0x0) syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x101301) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) rt_tgsigqueueinfo(r5, r5, 0x1a, &(0x7f0000000600)={0x2f, 0x1, 0x2}) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r7, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r8 = io_uring_setup(0x191a, &(0x7f0000000380)={0x0, 0x761, 0x21004, 0xfffffffe, 0x80011cb}) io_uring_register$IORING_REGISTER_BUFFERS(r8, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r9 = request_key(&(0x7f0000000240)='rxrpc\x00', &(0x7f0000000400)={'syz', 0x0}, &(0x7f00000005c0)='/dev/infiniband/rdma_cm\x00', 0xffffffffffffffff) add_key$user(&(0x7f00000000c0), &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000500)="7f342fcdc6218238811760f4c15ae14110eb10152999bd31ef44bf8e88b16e16678888be00cc89ae46412acfa44709e3387021832b90a718eb044700d5418a4b8bcc5306c08ba5e141efff1dcdea4b923921d9889800964a2b8cc2970440aa217b39ed633d95afc05ad0a801138ca21fedeb10904ea8b538ee31d8dd", 0x7c, r9) 7.168193291s ago: executing program 8 (id=1781): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = gettid() process_vm_writev(r2, &(0x7f0000000280)=[{&(0x7f0000000200)=""/113, 0x71}, {&(0x7f0000000b40)=""/4096, 0x1000}], 0x2, &(0x7f0000000700)=[{&(0x7f0000000400)=""/159, 0x9f}, {&(0x7f00000002c0)=""/97, 0x61}, {&(0x7f00000004c0)=""/3, 0x3}, {&(0x7f0000000500)=""/129, 0x81}, {&(0x7f0000001b40)=""/4096, 0x1000}], 0x5, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) socket$netlink(0x10, 0x3, 0xa) r3 = open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) r4 = syz_usb_connect$hid(0x3, 0x3f, &(0x7f0000000780)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0x47f, 0xc055, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x74, 0x30, 0x9, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x1, 0x4, {0x9, 0x21, 0x8, 0x5, 0x1, {0x22, 0xc26}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xa, 0x1, 0x7}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x7f, 0xff, 0x1}}]}}}]}}]}}, &(0x7f00000008c0)={0xa, &(0x7f00000007c0)={0xa, 0x6, 0x250, 0x5, 0x82, 0x5d, 0x8, 0xd}, 0x19, &(0x7f0000000800)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x4, "5a34866ad52e6a47fab08a2e31aef48e"}]}, 0x2, [{0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x458}}, {0x4, &(0x7f0000000880)=@lang_id={0x4, 0x3, 0xfcff}}]}) syz_usb_disconnect(r4) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x21, &(0x7f00000005c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000b00)=ANY=[@ANYBLOB="0600000004000000be7000005c0000000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32], 0x48) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc0205647, &(0x7f00000001c0)={0x980000, 0x2, 0x0, r3, 0x0, &(0x7f0000000180)={0x9a090e, 0x7, '\x00', @p_u16=&(0x7f0000000140)=0x5c85}}) 7.080369537s ago: executing program 6 (id=1782): r0 = socket(0x21, 0x2, 0x2) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000040)=0x3, 0x4) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000100)) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) socket$inet6(0x10, 0x80000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = dup(r3) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010100000000b07d0000050000000900010073797a300001000078000000030a01030000000000000000050000000900010073797a30000000000900030073797a320000000008000a4000000003280004800800024000000012080001400000000114000300766c616e3097144ee56812efe7bb13b3"], 0xc0}}, 0x0) bpf$MAP_CREATE(0x1101000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="05000000c0000000001a0000f7", @ANYRES32=0x1, @ANYBLOB='\x00\x00\x00'], 0x48) socket$inet_smc(0x2b, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0, 0x2}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0xffffffffffffffff}, 0x0, 0x0) 5.812390713s ago: executing program 3 (id=1783): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f00000004c0)="3ce2de4d8d957a8de4e490b6cd03b988d4edef164bd3377aa381b5f50b7ca414516489f78cd7208982e9bde22b2b7c1c7606d565477f3db9d2b077283644c0f27ab52a863a42863e06944e40a0b3c5d21c8cbe102e7f726263f28aef1bc12a069063d4c30e8f329fdb36859be727fbef4314161e5fb5f01ae00a2634d5cdecca2089c62e32f4c919886b2b88d237e287318739bec0364caf15889f38a312ef6621c0f21709a4bf2b16274cf933f6ad8fcc9c2024bc1b4713f650e860f93ae93b2361956b3e80c38c5fd29b5c1b5d7ce67edc856a8dc0ba54cee53de9a48c131389426bd06ec7c695add357934fc0321f0d3d7982e4fe5a0039decc491a663afd02facb08dd9695f854c7b031d9af8bd7350897996b5208b23030cc0feb84570730eaf24b9f2ac05d0feb3be07a29f887095f36f3c8f0e77e45509acd14a5be4a1572dd4cd1231087b830fa03e071571d4abd694710ef140469cf6df8a59839aafe046a5bffb97e5247be901789eafd726ba090337a2c49207e6b900c7e982472e6aac70e5d52ca2c1bab47b1f6d00f9601e2281686c21f770ae96e0ffec4b30496d012fa00958f794cdbd721bd155cae87", 0x109e8, 0x805, 0x0, 0x6) recvmmsg(r0, &(0x7f00000031c0)=[{{0x0, 0x1802, &(0x7f0000000a40)=[{&(0x7f00000008c0)=""/135, 0x87}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000980)=""/146, 0x92}, {&(0x7f0000000080)=""/43, 0x2b}, {&(0x7f0000000a80)=""/242, 0xf2}, {&(0x7f0000000b80)=""/143, 0x8f}], 0x4}, 0x2}], 0x400000000000300, 0x22, 0x0) 5.689906698s ago: executing program 6 (id=1784): r0 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) mount$fuse(0x0, 0x0, 0x0, 0xa02002, &(0x7f00000004c0)=ANY=[@ANYBLOB="66643dc6953bd340e3272b71d8f75d2e259bf1b1641dbb07e599bb12e499abcbe83cb20c3beb0dfa38c10e940b6828039ec26a486cc445322e0a22037201a9aafdefaad479199cd361137641824dfeb422ab103c6a236f4c9ae516aaf718425b7cbf0a21a98a672989ebb66211460e26e8d8f0a8338d62ea54b8dbc1492deefab8989d8802bb1b8c5d61349a79922cad342e87ed63595e043a81fa36feb0f49bca508854", @ANYRESDEC, @ANYBLOB="40ef35a971d35097635122028eb919802534a9e95b3ca94bf84415370e72798ba993e10be6a82eee4caa011b2c213a3a032f32435692c0ba1dc1f06b1de6bc83e6d684a1f35cf6", @ANYRESOCT]) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000400)=ANY=[], 0x1df) landlock_create_ruleset(&(0x7f0000000040)={0x4300, 0x2}, 0x18, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000000000000000000000000000000000000000000000000000000001", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 5.364217296s ago: executing program 0 (id=1785): unshare(0x62040200) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000440)={'filter\x00', 0x4, [{}, {}, {}, {}]}, 0x68) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x22}}]}, &(0x7f0000000080)=0x10) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0x2}}, './file0\x00'}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010200000000000b0000070000000900010073797a300000000014000000020a01010000000000000000000000002c000000180a05000000000000000000070000010900010073797a30000000000c0005400000000000000002580000000b0a010100000000000000000700000908000340000000080900010073797a3100000000080003400000017a080004400000000208000c40000010000c000b4000000000000008000900010073797a30"], 0x392c}}, 0x0) ioctl$HDIO_GETGEO(r5, 0x301, &(0x7f00000001c0)) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x27) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @xdp}, 0x94) r8 = syz_io_uring_setup(0x24ff, &(0x7f0000000300)={0x0, 0xf36b, 0x10100, 0x0, 0x155}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='>'], 0x38}}, 0x80) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r11, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r11, 0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000000)=@IORING_OP_FALLOCATE={0x11, 0x10, 0x0, @fd_index=0x8, 0x40, 0x0, 0x6, 0x0, 0x1}) io_uring_enter(r8, 0x2d3e, 0x2936, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f00000000c0)={r4, 0xf5bd, 0xb8}, 0x8) r12 = socket$alg(0x26, 0x5, 0x0) bind$alg(r12, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r12, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r13 = accept4(r12, 0x0, 0x0, 0x800) sendmmsg$alg(r13, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f0000000180)={r7, 0x8, 0x6}, 0x8) socket$nl_generic(0x10, 0x3, 0x10) 5.023859566s ago: executing program 6 (id=1786): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000040)) r4 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x21041, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xe) ioctl$TCFLSH(r4, 0x540b, 0x2) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r2, &(0x7f0000000c40)={0x8000203d}) epoll_pwait(r3, &(0x7f0000000140)=[{}], 0x1, 0x80000001, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x7, 0x8, 0x6, 0x3}]}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0x4}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_FLOWS={0x8, 0x5, 0xffffffff}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000200)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb86dd60000008003f50ff298b42e14452e862a1fb303afffa80000000000000000000000000003bfb020000000000000000000000000001870d907800"/88], 0x0) 4.000452802s ago: executing program 7 (id=1787): syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x220008, 0x0, 0x0, 0x0, 0x0) lremovexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)=@known='security.apparmor\x00') r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/diskstats\x00', 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000480)={r0, 0xe0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0], &(0x7f0000000340), 0x0, 0xdb, &(0x7f0000000380)=[{}, {}, {}], 0x18, 0x10, &(0x7f00000003c0), &(0x7f0000000400), 0x8, 0x9b, 0x8, 0x8, &(0x7f0000000440)}}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='map_files\x00') getdents(r2, &(0x7f0000000240)=""/45, 0x2d) getdents(r2, 0xffffffffffffffff, 0x5a) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x11, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@map_fd={0x18, 0x8, 0x1, 0x0, r0}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x4, &(0x7f0000000080)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x8000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.878622453s ago: executing program 7 (id=1788): shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ff8000/0x3000)=nil) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="200000001600010027bd7000fcdbdf250a007500", @ANYRES32=0x0, @ANYBLOB="08000a0004000400"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) semget$private(0x0, 0x6, 0x3b1) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0xfffffffe, 0x0, 0xd, 0x400009, 0x8, 0xa}, 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000001440)={'bond0\x00', &(0x7f0000000000)=@ethtool_link_settings={0x4c, 0x7, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, [0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}) socket$netlink(0x10, 0x3, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000000040)=0x0) ptrace$getregset(0x4204, r6, 0x2, &(0x7f00000000c0)={&(0x7f0000001080)=""/4096, 0x1000}) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010029bd7000000000008900000008000300", @ANYRES32=r8, @ANYBLOB="2026e7715972001d801c00008006000500c000000005000c000200000005000b"], 0x3c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000300)={'vxcan1\x00'}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r11 = socket(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, 0x0) setsockopt$MRT6_ADD_MIF(r11, 0x29, 0xca, &(0x7f0000000080)={0x1, 0x0, 0x0, 0x0, 0x267a4e37}, 0xc) setsockopt$MRT6_FLUSH(r11, 0x29, 0xd4, &(0x7f0000000100)=0x9, 0x4) 3.766936341s ago: executing program 6 (id=1789): socket$nl_route(0x10, 0x3, 0x0) unshare(0x8000000) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000140)=0xec62, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r2, 0xff) syz_emit_ethernet(0x62, &(0x7f00000001c0)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x2c, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0xb, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@syn={0x1e, 0xc, 0xb, 0x1, 0x91, 0x9, 0x80000000}, @timestamp={0x8, 0xa, 0x7fffffff, 0x3}]}}}}}}}}, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) modify_ldt$write(0x1, &(0x7f0000000000)={0xfff}, 0x10) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c0001400000000000000007140000001100"], 0xdc}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x40}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_COUNTERS={0x0, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0x0, 0x1, 0x1, 0x0, 0x3}, @NFTA_COUNTER_PACKETS={0x0, 0x2, 0x1, 0x0, 0x2}, @NFTA_COUNTER_PACKETS={0x0, 0x2, 0x1, 0x0, 0x394c}, @NFTA_COUNTER_PACKETS={0x0, 0x2, 0x1, 0x0, 0x5e}, @NFTA_COUNTER_BYTES={0x0, 0x1, 0x1, 0x0, 0xfffffffffffffc00}, @NFTA_COUNTER_BYTES={0x0, 0x1, 0x1, 0x0, 0xf}, @NFTA_COUNTER_PACKETS={0x0, 0x2, 0x1, 0x0, 0x1ff}, @NFTA_COUNTER_PACKETS={0x0, 0x2, 0x1, 0x0, 0x2}, @NFTA_COUNTER_BYTES={0x0, 0x1, 0x1, 0x0, 0x3ff}, @NFTA_COUNTER_BYTES]}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}}], {0x14, 0x11, 0x1, 0x4}}, 0x88}, 0x1, 0x0, 0x0, 0x2004c899}, 0x0) recvmmsg(r3, 0x0, 0x0, 0x0, 0x0) r5 = timerfd_create(0x0, 0x0) timerfd_settime(r5, 0x1, &(0x7f0000000000)={{0x77359400}, {0x0, 0x989680}}, 0x0) 3.430398424s ago: executing program 3 (id=1790): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) socket$netlink(0x10, 0x3, 0xa) open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x21, &(0x7f00000005c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x20000000000000c0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0600000004000000be7000005c0000000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32], 0x48) 3.084048618s ago: executing program 8 (id=1791): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x1104, &(0x7f0000000300)={0x0, 0x0, 0x80, 0x0, 0x8000021e}, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000380)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x7, 0x0, 0x0, 0x200, 0x0, 0x1}) io_uring_enter(r2, 0x47fa, 0xe0000, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r5, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0, 0x0, 0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001940)=@newtaction={0xe68, 0x30, 0x871a15abc695fa3d, 0xfffffffd, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{}, 0x97}, [{}, {}, {}, {}, {}, {0x448eade7}, {0x0, 0x0, 0x80000000}, {}, {}, {}, {}, {}, {}, {}, {}, {0x6}, {0x0, 0x20000000, 0x0, 0x0, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0xfffffffc, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0xfffffffe}, {}, {0xd5}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {0x4, 0x10}, {}, {0x0, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x4}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, {}, {0x9}, {}, {}, {}, {}, {0x5}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, {}, {0x0, 0x9, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0xb569}, {}, {}, {0x4}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb}], [{0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x7}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) 2.811597122s ago: executing program 7 (id=1792): socket$netlink(0x10, 0x3, 0x1d) set_mempolicy(0x2, 0x0, 0xf5) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') pread64(r2, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_open_dev$sndctrl(&(0x7f0000000580), 0x2, 0x141240) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x64, 0x4, 0x3b0, 0xffffffff, 0x128, 0x210, 0x210, 0xffffffff, 0xffffffff, 0x2e0, 0x2e0, 0x2e0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x100, 0x128, 0x0, {}, [@common=@inet=@socket1={{0x28, 'socket\x00', 0x3}}, @common=@ah={{0x30}, {[], 0x0, 0x0, 0x5}}]}, @REJECT={0x28}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, [], [], 'wlan0\x00', 'wg0\x00'}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, [], [], 'wg2\x00', 'ip6_vti0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x410) r4 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000480), 0x4) recvmmsg(r4, &(0x7f00000029c0)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001d80)=""/166, 0xa6}], 0x1, &(0x7f0000001fc0)=""/67, 0x43}, 0x1}], 0x1, 0x40002122, 0x0) r5 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r5, &(0x7f00000032c0)=[{&(0x7f0000000000)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1}], 0x1, 0x0) sendmmsg$inet_sctp(r5, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)='a', 0x1}], 0x1}], 0x1, 0x0) munmap(&(0x7f0000002000/0x800000)=nil, 0x800000) sendmsg$tipc(r4, &(0x7f0000000200)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x3, {0x1, 0x1, 0x2}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000500)="e8", 0x1}], 0x1}, 0x4800) utimensat(r3, &(0x7f0000000440)='./file0\x00', &(0x7f0000000540)={{0x0, 0xea60}}, 0x100) 2.215385405s ago: executing program 0 (id=1793): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000010c0)=@abs, 0x38) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, 0x0, 0x0) syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) openat$sndseq(0xffffffffffffff9c, 0x0, 0xfd740) r3 = syz_open_dev$sg(&(0x7f0000000000), 0xf3c, 0x181000) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=@ipv4_newrule={0x24, 0x20, 0x301, 0x0, 0x0, {0x2, 0x10, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1001c}, [@FRA_DST={0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0xffffffd9, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000080)={0x53, 0xfffffffffffffffc, 0x6, 0xfc, @buffer={0x20, 0x0, 0x0}, &(0x7f0000000340)="4d0d8d77005b", 0x0, 0x2, 0x10, 0x0, 0x0}) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000001280)={0xb, {'syz0\x00', 'syz1\x00', 'syz1\x00', 0x0, 0x5, 0x24c1c71c, 0x4, 0x2, 0xf3ac}}, 0x118) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x8417f, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4001}, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x2c, &(0x7f0000000000)='/proc/sys/net/\x00\x00v4\x00\x00s/\x92ync_\x00le\xf44.\x00\x00\x00\x00\xd4\xa2\x88\x00\xd1l,'}, 0x30) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r6) r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r7, &(0x7f00000000c0)=""/4096, 0x1000) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000010000304000000000000000100000300", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e00000062000280080040"], 0x3c}}, 0x0) 1.519550018s ago: executing program 7 (id=1794): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x3}, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000003180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x801, 0xf84, 0x3}, 0x1c) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0xffff, @local}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x2d, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r2, &(0x7f0000000000)="35be", 0x2, 0x0, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x2b, [0x8000, 0xc95a, 0xffffdff3, 0x1, 0x80, 0x6, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x800, 0x5, 0x4, 0x7, 0x4, 0x7c5b, 0x1, 0x24, 0x9, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x4, 0x7, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x242, 0xc, 0xe, 0x0, 0x71, 0x7, 0x7, 0x3, 0x2, 0x8005, 0x3f, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x3, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x0, 0x6c9, 0x9, 0xfffffffc, 0x3, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x9, 0x3, 0x3, 0x8000, 0x9, 0x400, 0x401, 0x6, 0x1, 0x8, 0x5, 0x10005, 0x5f31, 0x4, 0x0, 0x2, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0x7, 0x28, 0x1, 0xfe000000, 0xffff, 0x2, 0x7, 0x9, 0x3ff, 0x3, 0x9, 0x1, 0x7, 0x3, 0x9, 0x48c93690, 0x0, 0x2], [0x100007, 0x4, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x4, 0x7fff, 0x0, 0x5, 0x2, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x8, 0x8, 0x86, 0x10000003, 0x1000, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x5, 0x8, 0x4, 0x6d01, 0x5, 0x38, 0x800003, 0x200, 0x80, 0x83, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x9, 0x53cf697b, 0x5, 0x6, 0x2ac8, 0xbf, 0x2, 0x3, 0x7ff, 0xfffffff9, 0x0, 0x1, 0xffff, 0x0, 0x4, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0x25], [0x9, 0x6, 0x3, 0xb, 0x5, 0x934, 0x6, 0x6, 0x0, 0xbdfe, 0xce7, 0x1ff, 0xfffffffe, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x8003, 0xffff, 0x81, 0xff, 0x5, 0x1, 0xfffffffe, 0x14c, 0x60a7, 0xa71d, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0xc8, 0xee1, 0xfffff000, 0xffff, 0x3, 0x7f, 0x3ff, 0x9602, 0x7, 0x2, 0x7, 0x6, 0x1, 0x10080, 0x5, 0x8, 0x30b1d693, 0xa23, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0x2, 0x1, 0x200, 0xffff343e, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 1.040264296s ago: executing program 7 (id=1795): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sched_setscheduler(0x0, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) exit(0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r1, 0x29, 0x19, &(0x7f0000000400)=0xa4, 0x4) syz_emit_ethernet(0x15e, &(0x7f0000001680)=ANY=[@ANYBLOB="e33110495bfdaaaaaaaaaa0086dd60176ecdcb653e01283afffe800000000000000000000000000000ff020000000000000000000000000001890090780000000020010000000000000000000000000000fc01000000000000000040000000000004209595f429ae08a565c9a41d413a70a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5e0135118be22dc6c97e730f7053d6ec34ca11b5c7c3830af6b26868600f042ff"], 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0xfffffff3, @private2={0xfc, 0x2, '\x00', 0x1}, 0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000100), 0xffffffffffffff8b) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_256={{0x304}, "0002002000", "07f217bd74511e465bbbd5de01000000f9044677d4d588363d63af84db44be59", "00f8ff00", "8ce63ecbc640735f"}, 0x38) r3 = socket$rds(0x15, 0x5, 0x0) bind(r3, &(0x7f0000000000)=@generic={0xa, "f7c39f5ee85fae0c91e3ccfb11d200005efe967df06c2913060a14051e3867cc75f0da4c1c0f660ee7cda99d667b56cba361b21d917f1d08beb895ab85c460adc58eea9034c4dda505f16b07d7ab538e5d435d5626c30d8a0ffd818eb88942ddb032a0ee83819d54cecffbac6e4b483814e486948fb090684a73b87fe590"}, 0x80) r4 = syz_open_dev$usbfs(&(0x7f0000000040), 0x40000000200, 0x301) pwrite64(r4, &(0x7f0000000000)="cb4be83ca36f94036949cf0cace5", 0xe, 0x60) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_256={{0x304}, "0000004a650600", "af193cff4810ba5ac120d096eb00000052095b4285514ca312c52e3a08756735", '8\x00', "bc3a20b10f4ad11e"}, 0x38) sendto$inet6(r0, &(0x7f0000000280)='S', 0x1, 0x8000, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f00000bd000), 0x0, 0x20040004) recvmmsg(r5, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000380)={0x0, &(0x7f0000000680)=""/4096, 0x0, 0x0, 0x2}, 0x38) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000540)={r6, 0x0, 0x25, 0x2, @void}, 0x10) syz_io_uring_setup(0x231, &(0x7f0000000300)={0x0, 0xc463, 0x10101, 0x2}, &(0x7f00000001c0), &(0x7f0000000140)) r7 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r7, 0xaf01, 0x0) eventfd(0xffffffff) 935.259979ms ago: executing program 6 (id=1796): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = syz_open_dev$vim2m(&(0x7f0000000680), 0x8, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000280)=0x2) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x1104, &(0x7f0000000300)={0x0, 0x0, 0x80, 0x0, 0x8000021e}, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000380)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x7, 0x0, 0x0, 0x200, 0x0, 0x1}) io_uring_enter(r3, 0x47fa, 0x0, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r6, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0, 0x0, 0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001940)=@newtaction={0xe68, 0x30, 0x871a15abc695fa3d, 0xfffffffd, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{}, 0x97}, [{}, {}, {}, {}, {}, {0x448eade7}, {0x0, 0x0, 0x80000000}, {}, {}, {}, {}, {}, {}, {}, {}, {0x6}, {0x0, 0x20000000, 0x0, 0x0, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0xfffffffc, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0xfffffffe}, {}, {0xd5}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {0x4, 0x10}, {}, {0x0, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x4}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, {}, {0x9}, {}, {}, {}, {}, {0x5}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, {}, {0x0, 0x9, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0xb569}, {}, {}, {0x4}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb}], [{0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x7}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x0) r7 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0xa8, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r8, {0x0, 0xf}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x78, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1], 0x0, [0x5, 0x6, 0x92, 0x0, 0x8, 0x0, 0x9, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x8001]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xfffffff2}]}, {0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x2c2a1f44}]}]}]}}]}, 0xa8}}, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) 0s ago: executing program 7 (id=1797): bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x2}, 0x1c) r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f0000000580)=0x1, 0x4) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r3, &(0x7f0000001900), 0x0, &(0x7f0000001e40), 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a30000000002c0000000340d9bad7b98f56226d697bd2e4e40a01020000000000000000010000000900010073797a30000000000900030073797a310000000060000000060a010400000000000000000100000008000b40000000003800040000000180090001007866726d000000002400028005000300010000000800044000000006080001400000001508000240000000010900010073797a3000000000140000001100010000000000000000000000000a23a8052289698e4724ae23d9e942e05ca50993e6d83221c16eb1eda53fb285857d8abade8d31fafc58eeef540310eb430b2161ce9db2b82639809858a2ec67993797098a949f04bdaf43c9a765eef064191fac10cdbaf7a88bd5526c073d77337ccfc23cb694fdbe21316d66657a16dc7ba6830e287480e334ed6b3d16777a9055f3a87d330a80900127a1d0b679a7586f17e39c59973d71e705a5f9e08180e15e2f2179086ce40a41989c0894d2bd8d771f83ec9943232588"], 0xd4}}, 0x4000040) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$vsock_stream(0x28, 0x1, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000d40)=ANY=[@ANYRESOCT=r5], 0x34}}, 0x0) r6 = socket(0x10, 0x803, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000012c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEAUTHENTICATE(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)={0x24, r8, 0xfc5, 0x0, 0x0, {{0x11}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x8, 0x2a, [@perr={0x84, 0x2}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r11 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r11, 0x0, 0x20000040) kernel console output (not intermixed with test programs): to 10 [ 692.764656][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 692.773732][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 692.853729][ T5904] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 692.892013][ T5904] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 692.965783][ T5904] usb 6-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 693.299237][ T5904] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 693.363804][ T5904] usb 6-1: Product: syz [ 693.374314][ T5904] usb 6-1: Manufacturer: syz [ 693.399798][ T5904] usb 6-1: SerialNumber: syz [ 693.434832][ T5904] usb 6-1: config 0 descriptor?? [ 694.202469][ T5904] radio-si470x 6-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 694.227150][ T5904] radio-si470x 6-1:0.0: probe with driver radio-si470x failed with error -5 [ 695.921274][T11387] loop2: detected capacity change from 0 to 7 [ 695.933330][T11388] netlink: 'syz.1.1294': attribute type 3 has an invalid length. [ 695.948373][T11388] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1294'. [ 695.962421][T11387] loop2: [ 695.972561][T11387] loop2: partition table partially beyond EOD, truncated [ 697.631121][ T5904] usb 6-1: USB disconnect, device number 27 [ 698.517752][T11421] loop2: detected capacity change from 0 to 7 [ 698.545806][T10909] Dev loop2: unable to read RDB block 7 [ 698.573830][T10909] loop2: unable to read partition table [ 698.596043][T11423] fuse: Unknown parameter 'group_i00000000000000000000' [ 698.660679][T10909] loop2: partition table beyond EOD, truncated [ 698.698619][T11421] Dev loop2: unable to read RDB block 7 [ 698.712824][T11421] loop2: unable to read partition table [ 698.746612][T11421] loop2: partition table beyond EOD, truncated [ 698.756563][T11421] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 699.123807][ T5904] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 699.308093][ T5904] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 699.343706][ T5904] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 699.393832][ T5904] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 699.428924][ T5904] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 699.456383][ T5904] usb 2-1: SerialNumber: syz [ 699.637386][T11427] loop2: detected capacity change from 0 to 7 [ 699.695281][ T7232] loop2: [ 699.698353][ T7232] loop2: partition table partially beyond EOD, truncated [ 699.718289][ T5904] usb 2-1: 0:2 : does not exist [ 699.742922][ T5904] usb 2-1: unit 1 not found! [ 699.743909][T11427] loop2: [ 699.758847][T11427] loop2: partition table partially beyond EOD, truncated [ 699.814557][ T5904] usb 2-1: USB disconnect, device number 85 [ 700.056499][T10909] udevd[10909]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 700.126487][T11431] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1308'. [ 700.595061][T11440] loop7: detected capacity change from 0 to 16384 [ 700.803826][T11445] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 700.810456][T11445] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 700.834861][T11440] loop7: detected capacity change from 16384 to 0 [ 700.838308][ C0] I/O error, dev loop7, sector 15792 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 700.841862][ C1] I/O error, dev loop7, sector 2304 op 0x0:(READ) flags 0x80700 phys_seg 8 prio class 0 [ 700.953167][T11445] vhci_hcd vhci_hcd.0: Device attached [ 701.016208][T11446] vhci_hcd: connection closed [ 701.042160][ T3667] vhci_hcd: stop threads [ 701.064453][ T3667] vhci_hcd: release socket [ 701.068941][ T3667] vhci_hcd: disconnect device [ 701.235127][T11457] loop2: detected capacity change from 0 to 7 [ 701.244259][T10909] Dev loop2: unable to read RDB block 7 [ 701.249867][T10909] loop2: unable to read partition table [ 701.264486][T10909] loop2: partition table beyond EOD, truncated [ 701.273825][ T5918] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 701.281815][T11457] Dev loop2: unable to read RDB block 7 [ 701.288148][T11457] loop2: unable to read partition table [ 701.314096][T11457] loop2: partition table beyond EOD, truncated [ 701.320355][T11457] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 701.334397][T11459] atomic_op ffff88807ca5f998 conn xmit_atomic 0000000000000000 [ 701.443986][ T5918] usb 6-1: Using ep0 maxpacket: 32 [ 701.458482][ T5918] usb 6-1: config 0 has no interfaces? [ 701.483809][ T5918] usb 6-1: New USB device found, idVendor=2006, idProduct=0118, bcdDevice= 0.00 [ 701.513630][ T5918] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 701.527224][ T5918] usb 6-1: config 0 descriptor?? [ 701.616737][T11463] loop2: detected capacity change from 0 to 7 [ 701.636135][T10909] loop2: [ 701.639144][T10909] loop2: partition table partially beyond EOD, truncated [ 701.661193][T11463] loop2: [ 701.694028][T11463] loop2: partition table partially beyond EOD, truncated [ 702.133885][ T5904] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 702.183756][ T10] usb 5-1: new full-speed USB device number 89 using dummy_hcd [ 702.264306][ T5904] usb 2-1: device descriptor read/64, error -71 [ 702.267399][ T5918] usb 6-1: USB disconnect, device number 28 [ 702.339439][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 702.352771][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 702.366940][ T10] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 702.376953][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 702.387579][ T10] usb 5-1: Product: syz [ 702.391849][ T10] usb 5-1: Manufacturer: syz [ 702.398986][ T10] usb 5-1: SerialNumber: syz [ 702.408179][T11479] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 702.513742][ T5904] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 702.654687][ T5904] usb 2-1: device descriptor read/64, error -71 [ 702.761247][T11489] fuse: Bad value for 'fd' [ 702.774634][ T5904] usb usb2-port1: attempt power cycle [ 702.884900][T11491] loop2: detected capacity change from 0 to 7 [ 702.898860][ T7232] Dev loop2: unable to read RDB block 7 [ 702.913844][ T7232] loop2: unable to read partition table [ 702.913999][ T5917] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 702.920164][ T7232] loop2: partition table beyond EOD, truncated [ 702.943160][T11491] Dev loop2: unable to read RDB block 7 [ 702.950887][T11491] loop2: unable to read partition table [ 702.962117][T11491] loop2: partition table beyond EOD, truncated [ 702.969059][T11491] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 703.084358][ T5917] usb 4-1: Using ep0 maxpacket: 32 [ 703.091906][ T5917] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 703.105277][ T5917] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 703.123974][ T5904] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 703.125956][ T5917] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 703.159363][ T5904] usb 2-1: device descriptor read/8, error -71 [ 703.168190][ T5917] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 703.189083][ T5917] usb 4-1: config 0 descriptor?? [ 703.403750][ T5904] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 703.443226][ T10] cdc_ncm 5-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 703.450389][ T5904] usb 2-1: device descriptor read/8, error -71 [ 703.461165][ T10] cdc_ncm 5-1:1.0: dwNtbInMaxSize=4 is too small. Using 2048 [ 703.469653][ T10] cdc_ncm 5-1:1.0: setting rx_max = 2048 [ 703.574313][ T5904] usb usb2-port1: unable to enumerate USB device [ 703.603756][ T5918] usb 6-1: new full-speed USB device number 29 using dummy_hcd [ 703.636415][ T5917] savu 0003:1E7D:2D5A.0013: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 703.780264][ T5918] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 703.821326][T11479] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 703.832671][ T5918] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 703.849993][T11479] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 703.861125][ T5918] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 703.897636][ T5918] usb 6-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 703.916306][ T5917] usb 4-1: USB disconnect, device number 105 [ 703.954706][ T5918] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 703.989354][ T5918] usb 6-1: Product: syz [ 704.002212][ T5918] usb 6-1: Manufacturer: syz [ 704.010533][ T5918] usb 6-1: SerialNumber: syz [ 704.024870][ T5918] usb 6-1: config 0 descriptor?? [ 704.033506][T11499] raw-gadget.4 gadget.5: fail, usb_ep_enable returned -22 [ 704.074032][T11499] raw-gadget.4 gadget.5: fail, usb_ep_enable returned -22 [ 704.085247][ T5918] usb 6-1: ucan: probing device on interface #0 [ 704.126670][ T10] cdc_ncm 5-1:1.0: setting tx_max = 36 [ 704.167393][ T10] cdc_ncm 5-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.4-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 704.207832][ T10] usb 5-1: USB disconnect, device number 89 [ 704.225317][ T10] cdc_ncm 5-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.4-1, CDC NCM (NO ZLP) [ 704.257888][T11504] loop2: detected capacity change from 0 to 7 [ 704.278386][T11504] loop2: [ 704.281437][T11504] loop2: partition table partially beyond EOD, truncated [ 704.300243][ T5918] usb 6-1: ucan: could not read protocol version, ret=0 [ 704.318059][ T5918] usb 6-1: ucan: probe failed; try to update the device firmware [ 704.540543][ T5917] usb 6-1: USB disconnect, device number 29 [ 704.619476][T11510] netlink: 'syz.3.1332': attribute type 1 has an invalid length. [ 704.633901][T11510] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 705.117254][T11525] netlink: 232 bytes leftover after parsing attributes in process `syz.3.1337'. [ 705.384532][ T5904] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 705.499500][ T31] audit: type=1326 audit(1751056112.777:747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11533 comm="syz.5.1340" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f082f18e929 code=0x0 [ 705.544308][ T5904] usb 5-1: Using ep0 maxpacket: 16 [ 705.590280][T11535] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 705.600360][ T5904] usb 5-1: too many endpoints for config 0 interface 0 altsetting 109: 65, using maximum allowed: 30 [ 705.612302][ T5904] usb 5-1: config 0 interface 0 altsetting 109 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 705.656658][ T5904] usb 5-1: config 0 interface 0 altsetting 109 has 1 endpoint descriptor, different from the interface descriptor's value: 65 [ 705.701955][ T5904] usb 5-1: config 0 interface 0 has no altsetting 0 [ 705.733790][T11537] loop6: detected capacity change from 0 to 7 [ 705.750187][T10909] Dev loop6: unable to read RDB block 7 [ 705.757906][T10909] loop6: unable to read partition table [ 705.770271][T10909] loop6: partition table beyond EOD, truncated [ 705.786799][T11537] Dev loop6: unable to read RDB block 7 [ 705.798604][ T5904] usb 5-1: New USB device found, idVendor=172f, idProduct=0500, bcdDevice= 0.00 [ 705.817159][T11537] loop6: unable to read partition table [ 705.827269][ T5904] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 705.854313][T11537] loop6: partition table beyond EOD, truncated [ 706.006063][T11537] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 706.031537][ T5904] usb 5-1: config 0 descriptor?? [ 706.521973][ T5904] usbhid 5-1:0.0: can't add hid device: -71 [ 706.529792][ T5904] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 706.575645][ T5904] usb 5-1: USB disconnect, device number 90 [ 706.730424][T11560] bridge0: port 1(bridge_slave_0) entered disabled state [ 706.761873][T11561] netlink: 'syz.3.1347': attribute type 16 has an invalid length. [ 706.773120][T11560] bridge0: port 2(bridge_slave_1) entered disabled state [ 706.818897][T11554] delete_channel: no stack [ 706.824148][T11561] netlink: 'syz.3.1347': attribute type 17 has an invalid length. [ 706.937041][T11564] tmpfs: Unknown parameter 'fd' [ 706.963681][ T979] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 707.124344][ T979] usb 2-1: Using ep0 maxpacket: 16 [ 707.140884][ T979] usb 2-1: New USB device found, idVendor=0582, idProduct=00e6, bcdDevice=4e.06 [ 707.181576][ T979] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 707.190060][ T10] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 707.199196][ T979] usb 2-1: Product: syz [ 707.204820][ T979] usb 2-1: Manufacturer: syz [ 707.209651][ T979] usb 2-1: SerialNumber: syz [ 707.225637][ T979] usb 2-1: config 0 descriptor?? [ 707.356998][ T5944] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 707.367971][T10909] udevd[10909]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 707.384664][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 707.393781][ T10] usb 6-1: config 0 has an invalid interface number: 64 but max is 0 [ 707.402850][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 707.445243][ T10] usb 6-1: config 0 has no interface number 0 [ 707.454856][ T5917] usb 2-1: USB disconnect, device number 90 [ 707.494576][ T10] usb 6-1: New USB device found, idVendor=0bd3, idProduct=0555, bcdDevice= 0.5b [ 707.557078][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 707.602359][ T10] usb 6-1: config 0 descriptor?? [ 707.626765][T11592] loop6: detected capacity change from 0 to 7 [ 707.656254][T11592] Dev loop6: unable to read RDB block 7 [ 707.670513][T11592] loop6: unable to read partition table [ 707.678428][T11592] loop6: partition table beyond EOD, truncated [ 707.690674][T11593] fuse: Unknown parameter '0x00000000000000077UUa:ز^mC)M` $DZא"¥6h' [ 707.702253][T11592] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 708.012160][T11600] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1355'. [ 708.353949][T11603] kvm: kvm [11602]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010015) = 0x200000000020 [ 709.335502][ T5819] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 709.486688][ T5819] usb 4-1: device descriptor read/64, error -71 [ 709.743732][ T5819] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 709.849486][ T5944] usb 6-1: USB disconnect, device number 30 [ 709.883679][ T5819] usb 4-1: device descriptor read/64, error -71 [ 710.020298][ T31] audit: type=1804 audit(1751056117.297:748): pid=11617 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.1361" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="ramfs" ino=34388 res=1 errno=0 [ 710.064459][ T5819] usb usb4-port1: attempt power cycle [ 710.134864][ T10] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 710.295697][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 710.338082][ T5944] usb 6-1: new full-speed USB device number 31 using dummy_hcd [ 710.358411][ T10] usb 2-1: config 0 has an invalid interface number: 126 but max is 0 [ 710.368100][ T10] usb 2-1: config 0 has no interface number 0 [ 710.378347][ T10] usb 2-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 710.394498][ T10] usb 2-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 710.409459][ T10] usb 2-1: config 0 interface 126 has no altsetting 0 [ 710.423739][ T5819] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 710.430461][ T10] usb 2-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 710.440810][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 710.454558][ T5819] usb 4-1: device descriptor read/8, error -71 [ 710.454736][ T10] usb 2-1: Product: syz [ 710.469918][ T10] usb 2-1: Manufacturer: syz [ 710.475085][ T10] usb 2-1: SerialNumber: syz [ 710.486595][ T10] usb 2-1: config 0 descriptor?? [ 710.492687][T11615] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 710.500438][T11615] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 710.511341][ T5944] usb 6-1: unable to get BOS descriptor or descriptor too short [ 710.521100][ T5944] usb 6-1: not running at top speed; connect to a high speed hub [ 710.546994][ T5944] usb 6-1: config 253 has an invalid descriptor of length 97, skipping remainder of the config [ 710.567922][ T5944] usb 6-1: config 253 interface 0 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 710.585022][ T5944] usb 6-1: config 253 interface 0 has no altsetting 0 [ 710.597274][ T5944] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 710.615162][ T5944] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 710.623335][ T5944] usb 6-1: Product: syz [ 710.629789][ T5944] usb 6-1: Manufacturer: syz [ 710.634974][ T5944] usb 6-1: SerialNumber: syz [ 710.703862][ T5819] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 710.734802][ T5819] usb 4-1: device descriptor read/8, error -71 [ 710.829318][ T10] ir_usb 2-1:0.126: IR Dongle converter detected [ 710.849657][ T5819] usb usb4-port1: unable to enumerate USB device [ 710.866359][ T5944] cdc_ether 6-1:253.0: skipping garbage [ 710.879238][ T10] usb 2-1: IRDA class descriptor not found, device not bound [ 710.903984][ T5944] usb 6-1: bad CDC descriptors [ 710.934107][ T5944] usb 6-1: USB disconnect, device number 31 [ 710.950795][ T10] usb 2-1: USB disconnect, device number 91 [ 711.097847][T11631] loop6: detected capacity change from 0 to 7 [ 711.126852][T10909] Dev loop6: unable to read RDB block 7 [ 711.132487][T10909] loop6: unable to read partition table [ 711.147877][T10909] loop6: partition table beyond EOD, truncated [ 711.167278][T11631] Dev loop6: unable to read RDB block 7 [ 711.175407][T11631] loop6: unable to read partition table [ 711.181416][T11631] loop6: partition table beyond EOD, truncated [ 711.189493][T11631] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 711.943817][ T5819] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 711.964246][ T5918] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 712.193733][ T5819] usb 5-1: Using ep0 maxpacket: 32 [ 712.199027][ T5918] usb 2-1: Using ep0 maxpacket: 32 [ 712.218036][ T5819] usb 5-1: config 0 has an invalid interface number: 247 but max is 0 [ 712.254107][ T5819] usb 5-1: config 0 has no interface number 0 [ 712.281396][ T5918] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 712.313722][ T5819] usb 5-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 712.322878][ T5819] usb 5-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 712.351482][ T5819] usb 5-1: Product: syz [ 712.374281][ T5819] usb 5-1: Manufacturer: syz [ 712.383156][ T5918] usb 2-1: New USB device found, idVendor=061d, idProduct=c170, bcdDevice=ce.6f [ 712.413282][ T5918] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 712.456121][ T5819] usb 5-1: config 0 descriptor?? [ 712.461786][ T5918] usb 2-1: Product: syz [ 712.469676][ T5918] usb 2-1: Manufacturer: syz [ 712.479385][ T5918] usb 2-1: SerialNumber: syz [ 712.525790][ T5918] usb 2-1: config 0 descriptor?? [ 712.550552][ T5918] quatech2 2-1:0.0: Quatech 2nd gen USB to Serial Driver converter detected [ 713.779277][ T5944] usb 5-1: USB disconnect, device number 91 [ 714.433914][ T10] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 714.593881][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 714.627214][ T10] usb 6-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 714.667552][T11666] loop6: detected capacity change from 0 to 7 [ 714.695909][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 714.696887][T11666] Dev loop6: unable to read RDB block 7 [ 714.718699][ T10] usb 6-1: Product: syz [ 714.730827][ T10] usb 6-1: Manufacturer: syz [ 714.739598][ T10] usb 6-1: SerialNumber: syz [ 714.771161][ T10] usb 6-1: config 0 descriptor?? [ 714.775416][T11666] loop6: unable to read partition table [ 714.806086][T11666] loop6: partition table beyond EOD, truncated [ 714.826429][ T10] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 714.838095][T11666] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 715.213812][ T9840] Bluetooth: hci3: command 0x0406 tx timeout [ 715.403514][T11674] kvm_intel: kvm [11670]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0x1d9) = 0x1 [ 715.513869][ T979] usb 4-1: new low-speed USB device number 111 using dummy_hcd [ 715.554471][ T10] gspca_sonixj: reg_r err -110 [ 715.559417][ T10] sonixj 6-1:0.0: probe with driver sonixj failed with error -110 [ 715.684132][ T979] usb 4-1: device descriptor read/64, error -71 [ 715.943779][ T979] usb 4-1: new low-speed USB device number 112 using dummy_hcd [ 716.083886][ T979] usb 4-1: device descriptor read/64, error -71 [ 716.204228][ T979] usb usb4-port1: attempt power cycle [ 716.227754][T11681] tipc: Started in network mode [ 716.232976][T11681] tipc: Node identity -, cluster identity 4711 [ 716.563708][ T979] usb 4-1: new low-speed USB device number 113 using dummy_hcd [ 716.594464][ T979] usb 4-1: device descriptor read/8, error -71 [ 716.843843][ T979] usb 4-1: new low-speed USB device number 114 using dummy_hcd [ 716.887513][ T979] usb 4-1: device descriptor read/8, error -71 [ 717.014261][ T979] usb usb4-port1: unable to enumerate USB device [ 717.224056][ T56] usb 6-1: USB disconnect, device number 32 [ 717.411191][T11695] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1385'. [ 717.458053][T11695] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 717.495247][T11699] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1384'. [ 717.531270][T11699] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1384'. [ 717.616430][ T5918] usb 2-1: qt2_attach - failed to power on unit: -110 [ 717.645695][ T5918] quatech2 2-1:0.0: probe with driver quatech2 failed with error -110 [ 718.755894][T11712] loop6: detected capacity change from 0 to 7 [ 718.803803][T11712] Dev loop6: unable to read RDB block 7 [ 718.809479][T11712] loop6: unable to read partition table [ 718.834294][T11712] loop6: partition table beyond EOD, truncated [ 718.841425][T11712] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 719.410997][T11729] trusted_key: encrypted_key: keylen parameter is missing [ 720.723998][ T25] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 720.943724][ T25] usb 6-1: Using ep0 maxpacket: 32 [ 720.957599][ T25] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 720.974929][ T25] usb 6-1: New USB device found, idVendor=061d, idProduct=c170, bcdDevice=ce.6f [ 720.992408][ T25] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 721.001169][ T25] usb 6-1: Product: syz [ 721.006462][ T25] usb 6-1: Manufacturer: syz [ 721.011258][ T25] usb 6-1: SerialNumber: syz [ 721.032313][ T25] usb 6-1: config 0 descriptor?? [ 721.043067][ T25] quatech2 6-1:0.0: Quatech 2nd gen USB to Serial Driver converter detected [ 721.063511][T11749] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1397'. [ 721.143836][ T56] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 721.293970][ T56] usb 4-1: Using ep0 maxpacket: 8 [ 721.307176][ T56] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 721.320905][ T56] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 721.332130][ T56] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 721.345752][ T56] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 721.355398][ T56] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 721.368375][ T56] usb 4-1: Product: syz [ 721.372748][ T56] usb 4-1: Manufacturer: syz [ 721.379910][ T56] usb 4-1: SerialNumber: syz [ 721.865905][ T31] audit: type=1326 audit(1751056129.147:749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11743 comm="syz.3.1395" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x0 [ 722.226600][ T56] usb 4-1: 0:2 : does not exist [ 724.084701][ T5944] usb 4-1: USB disconnect, device number 115 [ 724.503698][ T5944] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 724.675108][ T5944] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 724.686206][ T5944] usb 4-1: New USB device found, idVendor=046d, idProduct=c50c, bcdDevice= 0.00 [ 724.695849][ T5944] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 724.714749][ T5944] usb 4-1: config 0 descriptor?? [ 724.930587][T11762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 724.944416][T11762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 724.964521][T11762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 724.978749][T11762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 725.200927][ T5944] logitech 0003:046D:C50C.0014: unbalanced collection at end of report description [ 725.211383][ T5944] logitech 0003:046D:C50C.0014: parse failed [ 725.224150][ T5944] logitech 0003:046D:C50C.0014: probe with driver logitech failed with error -22 [ 725.415750][ T10] usb 4-1: USB disconnect, device number 116 [ 726.103876][ T25] usb 6-1: qt2_attach - failed to power on unit: -110 [ 726.113810][ T25] quatech2 6-1:0.0: probe with driver quatech2 failed with error -110 [ 726.438899][ T10] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 726.643834][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 726.651725][ T10] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 726.723628][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 726.829726][ T10] usb 4-1: config 0 has no interface number 0 [ 726.852860][ T10] usb 4-1: New USB device found, idVendor=046d, idProduct=08d3, bcdDevice= b.28 [ 726.865942][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 726.883686][ T10] usb 4-1: Product: syz [ 726.893796][ T10] usb 4-1: Manufacturer: syz [ 726.904447][ T10] usb 4-1: SerialNumber: syz [ 726.923179][ T10] usb 4-1: config 0 descriptor?? [ 727.194945][ T10] usb 4-1: USB disconnect, device number 117 [ 727.491576][T11774] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1404'. [ 728.712334][T11787] fuse: Bad value for 'group_id' [ 728.727893][T11787] fuse: Bad value for 'group_id' [ 728.986794][T11789] netlink: 80 bytes leftover after parsing attributes in process `syz.4.1408'. [ 729.008080][ T9840] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 729.018620][ T9840] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 729.041668][ T9840] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 729.054328][ T9840] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 729.062406][ T9840] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 729.541433][T11801] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 729.561767][T11801] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 730.044287][ T5918] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 730.367414][T11792] chnl_net:caif_netlink_parms(): no params data found [ 730.893682][ T5918] usb 5-1: device descriptor read/64, error -71 [ 731.043220][T11792] bridge0: port 1(bridge_slave_0) entered blocking state [ 731.054346][T11792] bridge0: port 1(bridge_slave_0) entered disabled state [ 731.093739][T11792] bridge_slave_0: entered allmulticast mode [ 731.134215][ T5150] Bluetooth: hci5: command tx timeout [ 731.143753][ T5918] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 731.154206][T11792] bridge_slave_0: entered promiscuous mode [ 731.213435][T11792] bridge0: port 2(bridge_slave_1) entered blocking state [ 731.348474][T11792] bridge0: port 2(bridge_slave_1) entered disabled state [ 731.369899][T11792] bridge_slave_1: entered allmulticast mode [ 731.404817][ T5918] usb 5-1: Using ep0 maxpacket: 8 [ 731.412777][T11792] bridge_slave_1: entered promiscuous mode [ 731.517670][ T5918] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 731.563752][ T5918] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 731.621774][ T5918] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 731.668584][ T5918] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 731.796670][ T5918] usbtmc 5-1:16.0: bulk endpoints not found [ 731.920179][T11792] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 732.044857][T11832] fuse: Bad value for 'user_id' [ 732.063917][T11792] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 732.090443][T11832] fuse: Bad value for 'user_id' [ 732.346784][T11792] team0: Port device team_slave_0 added [ 732.371685][T11792] team0: Port device team_slave_1 added [ 732.720379][T11836] pim6reg0: tun_chr_ioctl cmd 1074025680 [ 732.728136][T11792] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 732.737771][T11792] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 732.763703][ C0] vkms_vblank_simulate: vblank timer overrun [ 732.867028][T11792] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 732.927627][T11792] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 732.959669][T11792] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 733.060888][T11792] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 733.214043][ T5150] Bluetooth: hci5: command tx timeout [ 733.559935][T11792] hsr_slave_0: entered promiscuous mode [ 733.588592][T11792] hsr_slave_1: entered promiscuous mode [ 733.611764][T11792] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 733.675586][T11792] Cannot create hsr debugfs directory [ 734.951566][ T5918] usb 5-1: USB disconnect, device number 93 [ 735.112795][T11792] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 735.295381][T11792] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 735.301832][ T5150] Bluetooth: hci5: command tx timeout [ 735.338412][T11792] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 735.511169][T11792] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 735.632163][ T5918] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 735.814109][ T5918] usb 5-1: Using ep0 maxpacket: 8 [ 735.835494][ T5918] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 735.843002][ T5918] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 735.940320][ T5918] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 736.033986][ T5918] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 736.098288][ T5918] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 736.169917][ T5918] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 736.200449][ T9840] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 736.211342][T11792] 8021q: adding VLAN 0 to HW filter on device bond0 [ 736.218311][ T9840] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 736.226722][ T5918] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 736.238511][ T5918] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 736.250396][ T9840] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 736.263773][ T5918] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 736.275448][ T5918] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 736.287331][ T9840] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 736.297557][ T5918] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 736.305193][ T9840] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 736.314312][ T5918] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 736.326041][ T5918] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 736.343954][ T5918] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 736.356919][ T5918] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 736.371993][ T5918] usb 5-1: string descriptor 0 read error: -22 [ 736.389460][ T5918] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 736.423680][ T5918] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 736.452448][ T5918] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 736.806015][ T25] usb 5-1: USB disconnect, device number 94 [ 736.843009][T11792] 8021q: adding VLAN 0 to HW filter on device team0 [ 736.941526][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 736.948821][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 737.177367][T10795] bridge0: port 2(bridge_slave_1) entered blocking state [ 737.184639][T10795] bridge0: port 2(bridge_slave_1) entered forwarding state [ 737.374124][ T9840] Bluetooth: hci5: command tx timeout [ 737.976742][T11792] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 738.413915][ T9840] Bluetooth: hci6: command tx timeout [ 738.839510][T11792] veth0_vlan: entered promiscuous mode [ 738.916586][T11792] veth1_vlan: entered promiscuous mode [ 739.023946][T11861] chnl_net:caif_netlink_parms(): no params data found [ 739.229974][T11792] veth0_macvtap: entered promiscuous mode [ 739.355579][T11792] veth1_macvtap: entered promiscuous mode [ 739.443872][ T25] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 739.624732][ T25] usb 5-1: Using ep0 maxpacket: 16 [ 739.685372][ T25] usb 5-1: config 0 has an invalid interface number: 105 but max is 0 [ 739.733361][ T25] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 739.744752][ T25] usb 5-1: config 0 has no interface number 0 [ 739.754474][ T25] usb 5-1: New USB device found, idVendor=046d, idProduct=08d3, bcdDevice= b.28 [ 739.763827][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 739.771902][ T25] usb 5-1: Product: syz [ 739.943405][ T25] usb 5-1: Manufacturer: syz [ 739.957819][T11792] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 739.983855][ T25] usb 5-1: SerialNumber: syz [ 740.018942][T11792] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 740.074898][ T25] usb 5-1: config 0 descriptor?? [ 740.076870][T11861] bridge0: port 1(bridge_slave_0) entered blocking state [ 740.104248][T11861] bridge0: port 1(bridge_slave_0) entered disabled state [ 740.119078][T11861] bridge_slave_0: entered allmulticast mode [ 740.199730][T11861] bridge_slave_0: entered promiscuous mode [ 740.229383][T11861] bridge0: port 2(bridge_slave_1) entered blocking state [ 740.293799][T11861] bridge0: port 2(bridge_slave_1) entered disabled state [ 740.369260][T11861] bridge_slave_1: entered allmulticast mode [ 740.454698][T11861] bridge_slave_1: entered promiscuous mode [ 740.494389][ T9840] Bluetooth: hci6: command tx timeout [ 740.779084][T11792] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 740.998369][T11792] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 741.032665][T11792] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 741.068572][T11792] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 741.154542][T11861] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 741.184729][T11861] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 741.466300][T11861] team0: Port device team_slave_0 added [ 741.686478][T11861] team0: Port device team_slave_1 added [ 741.809499][T11861] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 741.836156][T11861] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 741.906760][T11861] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 741.936230][T11861] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 741.952890][T11861] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 742.069484][T11861] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 742.104684][ T25] usb 5-1: Found UVC 0.00 device syz (046d:08d3) [ 742.124810][ T25] usb 5-1: No valid video chain found. [ 742.200446][ T25] usb 5-1: USB disconnect, device number 95 [ 742.574927][ T9840] Bluetooth: hci6: command tx timeout [ 742.580983][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 742.612800][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 742.994993][T11861] hsr_slave_0: entered promiscuous mode [ 743.001879][T11861] hsr_slave_1: entered promiscuous mode [ 743.042500][T11861] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 743.077435][T11861] Cannot create hsr debugfs directory [ 743.139819][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 743.173721][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 744.654101][ T9840] Bluetooth: hci6: command tx timeout [ 744.666676][T11861] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 744.695182][T11861] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 744.726580][T11861] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 744.760642][T11861] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 745.169560][T11861] 8021q: adding VLAN 0 to HW filter on device bond0 [ 745.266959][T11861] 8021q: adding VLAN 0 to HW filter on device team0 [ 745.301553][T10795] bridge0: port 1(bridge_slave_0) entered blocking state [ 745.304217][T11937] loop2: detected capacity change from 0 to 7 [ 745.308861][T10795] bridge0: port 1(bridge_slave_0) entered forwarding state [ 745.351809][T10795] bridge0: port 2(bridge_slave_1) entered blocking state [ 745.359109][T10795] bridge0: port 2(bridge_slave_1) entered forwarding state [ 745.381715][T11937] Dev loop2: unable to read RDB block 7 [ 745.411789][T11937] loop2: unable to read partition table [ 745.449023][T11937] loop2: partition table beyond EOD, truncated [ 745.504522][T11937] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 745.584016][ T5819] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 745.645053][T11861] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 745.753891][ T5819] usb 7-1: device descriptor read/64, error -71 [ 745.760353][T11861] veth0_vlan: entered promiscuous mode [ 745.794200][T11941] loop2: detected capacity change from 0 to 7 [ 745.819858][T11861] veth1_vlan: entered promiscuous mode [ 745.836580][T11941] loop2: [ 745.839611][T11941] loop2: partition table partially beyond EOD, truncated [ 745.940608][T11861] veth0_macvtap: entered promiscuous mode [ 746.025258][ T5819] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 746.041857][T11861] veth1_macvtap: entered promiscuous mode [ 746.153352][T11861] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 746.204335][ T5819] usb 7-1: device descriptor read/64, error -71 [ 746.217005][T11861] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 746.264745][T11861] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 746.294164][T11861] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 746.314149][ T5819] usb usb7-port1: attempt power cycle [ 746.325206][T11861] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 746.355062][T11861] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 746.369348][T11949] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1442'. [ 746.673673][ T5819] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 746.691633][T10803] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 746.704803][ T5819] usb 7-1: device descriptor read/8, error -71 [ 746.732918][T10803] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 746.836052][T10803] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 746.867406][T10803] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 746.963710][ T5819] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 747.003644][ T5917] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 747.014660][ T5819] usb 7-1: device descriptor read/8, error -71 [ 747.150064][ T5819] usb usb7-port1: unable to enumerate USB device [ 747.191119][ T5917] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 747.217228][ T5917] usb 4-1: config 0 has no interface number 0 [ 747.235349][ T5917] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 747.248871][T11957] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 747.263678][ T5917] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 747.292502][ T5917] usb 4-1: Product: syz [ 747.302624][ T5917] usb 4-1: Manufacturer: syz [ 747.318743][ T5917] usb 4-1: SerialNumber: syz [ 747.339492][ T5917] usb 4-1: config 0 descriptor?? [ 747.570401][ T5917] usb 4-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 747.579559][T11960] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 747.605287][ T5917] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 747.641040][ T5917] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 747.660344][ T5917] usb 4-1: media controller created [ 747.732570][ T5917] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 747.900709][ T5917] i2c i2c-3: ec100: i2c rd failed=-32 reg=33 [ 748.073362][ T31] audit: type=1326 audit(1751056155.347:750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11965 comm="syz.0.1448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f95a1f8e929 code=0x7ffc0000 [ 748.107626][T11966] dlm: no locking on control device [ 748.144088][ T31] audit: type=1326 audit(1751056155.387:751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11965 comm="syz.0.1448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f95a1f8e929 code=0x7ffc0000 [ 748.431699][ T31] audit: type=1326 audit(1751056155.387:752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11965 comm="syz.0.1448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f95a1f8e929 code=0x7ffc0000 [ 748.583718][ T31] audit: type=1326 audit(1751056155.387:753): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11965 comm="syz.0.1448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f95a1f8e929 code=0x7ffc0000 [ 748.743488][ T31] audit: type=1326 audit(1751056155.387:754): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11965 comm="syz.0.1448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f95a1f8e929 code=0x7ffc0000 [ 748.772186][ T31] audit: type=1326 audit(1751056155.387:755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11965 comm="syz.0.1448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f95a1f8e929 code=0x7ffc0000 [ 748.854036][ T31] audit: type=1326 audit(1751056155.387:756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11965 comm="syz.0.1448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f95a1f8e929 code=0x7ffc0000 [ 748.926871][T11973] loop2: detected capacity change from 0 to 7 [ 748.939849][T11973] Dev loop2: unable to read RDB block 7 [ 748.946773][T11973] loop2: unable to read partition table [ 748.952560][ T31] audit: type=1326 audit(1751056155.387:757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11965 comm="syz.0.1448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f95a1f8e929 code=0x7ffc0000 [ 749.019065][T11973] loop2: partition table beyond EOD, truncated [ 749.026230][T11973] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 749.035881][ T31] audit: type=1326 audit(1751056155.387:758): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11965 comm="syz.0.1448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f95a1f8e929 code=0x7ffc0000 [ 749.063636][ T31] audit: type=1326 audit(1751056155.407:759): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11965 comm="syz.0.1448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f95a1f8e929 code=0x7ffc0000 [ 749.323828][T11975] loop2: detected capacity change from 0 to 7 [ 749.354489][T11975] loop2: [ 749.361803][T11975] loop2: partition table partially beyond EOD, truncated [ 749.490988][T11978] netlink: 'syz.6.1451': attribute type 1 has an invalid length. [ 749.597915][T11978] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 750.280112][ T5944] usb 4-1: USB disconnect, device number 118 [ 750.996480][ T5944] usb 4-1: new full-speed USB device number 119 using dummy_hcd [ 751.225890][T11992] syz.6.1453 (11992) used obsolete PPPIOCDETACH ioctl [ 751.328532][ T5944] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 751.347004][ T5944] usb 4-1: config 0 has no interface number 0 [ 751.489390][ T5944] usb 4-1: New USB device found, idVendor=0b48, idProduct=1004, bcdDevice=8c.1e [ 751.550609][ T5944] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 751.581072][ T5944] usb 4-1: config 0 descriptor?? [ 751.618362][ T5944] usb 4-1: selecting invalid altsetting 1 [ 751.631868][ T5944] dvb_ttusb_budget: ttusb_init_controller: error [ 751.650219][ T5944] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 751.824327][T11997] netlink: 'syz.3.1456': attribute type 1 has an invalid length. [ 751.887076][T12007] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 751.915200][T12007] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 751.963275][ T5944] DVB: Unable to find symbol ves1820_attach() [ 752.113978][ T5944] DVB: Unable to find symbol stv0297_attach() [ 752.191197][ T5944] dvb_ttusb_budget: no frontend driver found for device [0b48:1004] [ 752.222778][ T5944] usb 4-1: USB disconnect, device number 119 [ 753.966466][T12018] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1459'. [ 754.101711][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 754.108211][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 754.190115][T12021] loop2: detected capacity change from 0 to 7 [ 754.219845][T12021] Dev loop2: unable to read RDB block 7 [ 754.244427][T12021] loop2: unable to read partition table [ 754.277898][T12021] loop2: partition table beyond EOD, truncated [ 754.333854][T12021] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 755.683661][ T25] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 755.893249][ T25] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 755.944933][ T25] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 755.965169][ T25] usb 7-1: New USB device found, idVendor=17ef, idProduct=60a3, bcdDevice= 0.00 [ 756.023372][ T25] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 756.064665][ T25] usb 7-1: config 0 descriptor?? [ 757.249884][T12046] netlink: 'syz.0.1468': attribute type 15 has an invalid length. [ 757.553971][ T5917] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 757.711769][ T5917] usb 4-1: Using ep0 maxpacket: 32 [ 757.738211][ T5917] usb 4-1: New USB device found, idVendor=0458, idProduct=7005, bcdDevice=1a.51 [ 757.764305][ T5917] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 757.792856][ T5917] usb 4-1: Product: syz [ 757.802822][ T5917] usb 4-1: Manufacturer: syz [ 757.818200][ T5917] usb 4-1: SerialNumber: syz [ 757.847332][ T5917] usb 4-1: config 0 descriptor?? [ 757.893067][ T5917] gspca_main: sn9c2028-2.14.0 probing 0458:7005 [ 758.388198][ T5944] usb 7-1: USB disconnect, device number 6 [ 758.432398][ T5917] gspca_sn9c2028: read1 error -110 [ 758.463782][ T5917] gspca_sn9c2028: read1 error -32 [ 758.482070][ T5917] gspca_sn9c2028: read1 error -32 [ 758.510937][ T5917] sn9c2028 4-1:0.0: probe with driver sn9c2028 failed with error -32 [ 758.530272][ T5150] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 758.541628][ T5150] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 758.550906][ T5150] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 758.559215][ T5150] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 758.569379][ T5150] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 759.795920][T12079] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 759.890265][T12064] chnl_net:caif_netlink_parms(): no params data found [ 760.304124][ T25] usb 4-1: USB disconnect, device number 120 [ 760.701028][ T9840] Bluetooth: hci7: command tx timeout [ 760.963648][ T25] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 761.068431][T12064] bridge0: port 1(bridge_slave_0) entered blocking state [ 761.156960][T12064] bridge0: port 1(bridge_slave_0) entered disabled state [ 761.220189][T12064] bridge_slave_0: entered allmulticast mode [ 761.235368][T12064] bridge_slave_0: entered promiscuous mode [ 761.263682][ T25] usb 4-1: Using ep0 maxpacket: 8 [ 761.274643][T12064] bridge0: port 2(bridge_slave_1) entered blocking state [ 761.300870][T12064] bridge0: port 2(bridge_slave_1) entered disabled state [ 761.324495][T12064] bridge_slave_1: entered allmulticast mode [ 761.341685][T12064] bridge_slave_1: entered promiscuous mode [ 761.352416][ T25] usb 4-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 761.393819][ T25] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 761.433783][ T25] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 761.483199][ T25] usb 4-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 761.541076][ T25] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 761.559106][T12064] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 761.643934][ T25] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 761.657203][T12103] netlink: 100 bytes leftover after parsing attributes in process `syz.0.1481'. [ 761.672697][T12064] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 761.722392][ T25] usbtmc 4-1:16.0: bulk endpoints not found [ 761.954490][T12064] team0: Port device team_slave_0 added [ 762.009742][T12064] team0: Port device team_slave_1 added [ 762.552671][T12064] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 762.601494][T12064] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 762.728896][T12064] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 762.740325][ T9840] Bluetooth: hci7: command tx timeout [ 762.786196][T12064] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 762.793221][T12064] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 762.824664][T12064] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 762.851105][T12114] loop2: detected capacity change from 0 to 7 [ 762.906425][T12112] pim6reg0: tun_chr_ioctl cmd 1074025680 [ 762.932840][T12114] loop2: [ 762.965411][T12114] loop2: partition table partially beyond EOD, truncated [ 763.663408][T12064] hsr_slave_0: entered promiscuous mode [ 763.670793][T12064] hsr_slave_1: entered promiscuous mode [ 763.677551][T12064] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 763.725317][T12064] Cannot create hsr debugfs directory [ 764.569404][ T5918] usb 4-1: USB disconnect, device number 121 [ 764.816382][ T9840] Bluetooth: hci7: command tx timeout [ 765.258623][T12064] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 765.310770][T12064] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 765.368525][T12064] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 765.468096][T12064] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 766.861141][T12163] netdevsim netdevsim6 netdevsim0: entered promiscuous mode [ 766.894167][ T9840] Bluetooth: hci7: command tx timeout [ 766.923163][T12163] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 767.090684][T12064] 8021q: adding VLAN 0 to HW filter on device bond0 [ 767.268537][T12064] 8021q: adding VLAN 0 to HW filter on device team0 [ 767.342388][T10804] bridge0: port 1(bridge_slave_0) entered blocking state [ 767.349655][T10804] bridge0: port 1(bridge_slave_0) entered forwarding state [ 767.461627][T10803] bridge0: port 2(bridge_slave_1) entered blocking state [ 767.469003][T10803] bridge0: port 2(bridge_slave_1) entered forwarding state [ 768.151827][T12064] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 768.469478][ T31] audit: type=1326 audit(1751056175.747:760): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12181 comm="syz.7.1499" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f924c58e929 code=0x7ffc0000 [ 768.693667][ T31] audit: type=1326 audit(1751056175.777:761): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12181 comm="syz.7.1499" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f924c58e929 code=0x7ffc0000 [ 768.982016][ T31] audit: type=1326 audit(1751056175.777:762): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12181 comm="syz.7.1499" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f924c58e929 code=0x7ffc0000 [ 769.108542][ T31] audit: type=1326 audit(1751056175.777:763): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12181 comm="syz.7.1499" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f924c58e929 code=0x7ffc0000 [ 769.221195][T12189] usb usb8: usbfs: process 12189 (syz.0.1500) did not claim interface 0 before use [ 769.711846][T12064] veth0_vlan: entered promiscuous mode [ 769.829162][T12064] veth1_vlan: entered promiscuous mode [ 770.103227][T12064] veth0_macvtap: entered promiscuous mode [ 770.148641][T12064] veth1_macvtap: entered promiscuous mode [ 770.302824][T12064] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 770.395426][T12064] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 770.413782][ T5944] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 770.469023][T12064] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.543780][T12064] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.599396][T12064] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.633741][ T5944] usb 4-1: Using ep0 maxpacket: 8 [ 770.643753][T12064] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.698493][ T5944] usb 4-1: New USB device found, idVendor=040a, idProduct=0002, bcdDevice=de.7b [ 770.795607][ T5944] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 771.039896][ T5944] gspca_main: spca501-2.14.0 probing 040a:0002 [ 771.174727][T10794] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 771.209044][T12205] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.238576][T10794] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 771.322283][T12191] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.339587][T12205] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 771.414615][T12191] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 771.669204][ T5944] gspca_spca501: reg write: error -110 [ 771.693812][ T5944] spca501 4-1:2.0: Reg write failed for 0x00,0xaa,0x00 [ 771.700841][ T5944] spca501 4-1:2.0: probe with driver spca501 failed with error -22 [ 771.742397][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 771.786889][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 773.309094][ T25] usb 4-1: USB disconnect, device number 122 [ 773.444490][ T5917] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 773.633836][ T5917] usb 9-1: Using ep0 maxpacket: 16 [ 773.663241][ T5917] usb 9-1: config 0 has no interfaces? [ 773.707452][ T5917] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 773.751717][ T5917] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 773.810444][ T5917] usb 9-1: Manufacturer: syz [ 773.893154][ T5917] usb 9-1: config 0 descriptor?? [ 774.074917][ T25] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 774.246998][T12217] fuse: Unknown parameter 'o2Vc00000000000000000000' [ 774.283653][ T25] usb 4-1: Using ep0 maxpacket: 16 [ 774.303998][ T25] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 774.344561][ T25] usb 4-1: config 0 has no interface number 0 [ 774.368091][ T25] usb 4-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 774.403698][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 774.450798][T12228] ipip0: entered promiscuous mode [ 774.463473][ T25] usb 4-1: Product: syz [ 774.476506][T12228] ipip0: entered allmulticast mode [ 774.487234][ T25] usb 4-1: Manufacturer: syz [ 774.491928][ T25] usb 4-1: SerialNumber: syz [ 774.524505][ T25] usb 4-1: config 0 descriptor?? [ 774.563648][ T25] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 774.955529][ T5944] usb 9-1: USB disconnect, device number 2 [ 775.173677][ T25] gspca_spca1528: reg_w err -110 [ 775.219974][ T25] spca1528 4-1:0.1: probe with driver spca1528 failed with error -110 [ 775.295201][ T5904] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 775.493949][ T5904] usb 7-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=a0.b5 [ 775.528794][ T5904] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 775.601799][ T5904] usb 7-1: config 0 descriptor?? [ 775.833867][ T5904] asix 7-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 776.052896][ T5904] asix 7-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 776.073237][ T5904] asix 7-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 776.130678][ T5904] asix 7-1:0.0: probe with driver asix failed with error -71 [ 776.176668][ T5904] usb 7-1: USB disconnect, device number 7 [ 776.733448][ T5904] usb 4-1: USB disconnect, device number 123 [ 776.820069][T12249] syz_tun: entered allmulticast mode [ 776.866346][T12249] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1517'. [ 777.046221][T12252] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1518'. [ 777.055854][ T5819] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 777.141851][T12252] openvswitch: netlink: Flow key attr not present in new flow. [ 777.233832][ T5819] usb 7-1: Using ep0 maxpacket: 8 [ 777.273194][ T5819] usb 7-1: New USB device found, idVendor=0bc3, idProduct=0001, bcdDevice=11.85 [ 777.329482][ T5819] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 777.341749][T12256] loop6: detected capacity change from 0 to 7 [ 777.350926][ T5819] usb 7-1: Product: syz [ 777.364537][ T5819] usb 7-1: Manufacturer: syz [ 777.369213][ T5819] usb 7-1: SerialNumber: syz [ 777.389775][T12256] Dev loop6: unable to read RDB block 7 [ 777.418723][ T5819] usb 7-1: config 0 descriptor?? [ 777.420521][T12256] loop6: unable to read partition table [ 777.456618][T12256] loop6: partition table beyond EOD, truncated [ 777.486242][ T5819] ipw 7-1:0.0: IPWireless converter converter detected [ 777.494058][ T5904] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 777.515195][T12256] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 777.708556][ T5904] usb 4-1: device descriptor read/64, error -71 [ 777.757260][ T5944] usb 7-1: USB disconnect, device number 8 [ 777.815306][ T5944] ipw 7-1:0.0: device disconnected [ 777.831752][T12258] netlink: 'syz.8.1521': attribute type 8 has an invalid length. [ 777.983939][ T5904] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 778.155160][ T5904] usb 4-1: device descriptor read/64, error -71 [ 778.214024][ T5819] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 778.288250][ T5904] usb usb4-port1: attempt power cycle [ 778.430043][ T5819] usb 9-1: Using ep0 maxpacket: 16 [ 778.454001][ T5819] usb 9-1: unable to get BOS descriptor or descriptor too short [ 778.464808][ T5819] usb 9-1: config 3 has an invalid interface number: 199 but max is 0 [ 778.473050][ T5819] usb 9-1: config 3 has no interface number 0 [ 778.499187][ T5819] usb 9-1: config 3 interface 199 has no altsetting 0 [ 778.514336][ T5819] usb 9-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice=bf.bf [ 778.523468][ T5819] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 778.546476][ T5819] usb 9-1: Product: syz [ 778.551174][ T5819] usb 9-1: Manufacturer: syz [ 778.573885][ T5819] usb 9-1: SerialNumber: syz [ 778.683961][ T5904] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 778.748423][T12269] CIFS: VFS: Malformed UNC in devname [ 778.827192][ T5904] usb 4-1: device descriptor read/8, error -71 [ 779.095962][ T5819] mdc800 9-1:3.199: probe fails -> wrong Interface [ 779.113951][ T5904] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 779.189354][ T5904] usb 4-1: device descriptor read/8, error -71 [ 779.310879][ T5904] usb usb4-port1: unable to enumerate USB device [ 779.321625][ T5819] usb 9-1: USB disconnect, device number 3 [ 779.934827][ T5819] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 780.150662][ T5819] usb 9-1: config 0 has no interfaces? [ 780.160951][ T5819] usb 9-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 780.171298][ T5819] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.185320][ T5819] usb 9-1: Product: syz [ 780.216683][ T5819] usb 9-1: Manufacturer: syz [ 780.240271][ T5819] usb 9-1: SerialNumber: syz [ 780.278982][ T5819] usb 9-1: config 0 descriptor?? [ 780.383980][ T25] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 780.525430][T12277] input: syz0 as /devices/virtual/input/input32 [ 780.578483][ T25] usb 7-1: Using ep0 maxpacket: 32 [ 780.595439][ T25] usb 7-1: too many configurations: 24, using maximum allowed: 8 [ 780.622266][ T25] usb 7-1: invalid descriptor for config index 0: type = 0x2, length = 158 [ 780.695677][ T25] usb 7-1: can't read configurations, error -22 [ 780.740157][ T31] audit: type=1326 audit(1751056188.007:764): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12281 comm="syz.3.1529" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x0 [ 780.840301][ T31] audit: type=1326 audit(1751056188.097:765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12281 comm="syz.3.1529" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x0 [ 780.864333][ T25] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 781.034477][ T25] usb 7-1: Using ep0 maxpacket: 32 [ 781.044488][ T25] usb 7-1: too many configurations: 24, using maximum allowed: 8 [ 781.058686][ T25] usb 7-1: invalid descriptor for config index 0: type = 0x2, length = 158 [ 781.088553][ T25] usb 7-1: can't read configurations, error -22 [ 781.139175][ T25] usb usb7-port1: attempt power cycle [ 781.554113][ T25] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 781.590872][ T25] usb 7-1: Using ep0 maxpacket: 32 [ 781.606482][ T25] usb 7-1: too many configurations: 24, using maximum allowed: 8 [ 781.673443][ T25] usb 7-1: invalid descriptor for config index 0: type = 0x2, length = 158 [ 781.683334][ T25] usb 7-1: can't read configurations, error -22 [ 781.823767][ T25] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 781.873872][ T25] usb 7-1: Using ep0 maxpacket: 32 [ 781.879929][ T25] usb 7-1: too many configurations: 24, using maximum allowed: 8 [ 781.950474][ T25] usb 7-1: invalid descriptor for config index 0: type = 0x2, length = 158 [ 781.964594][ T25] usb 7-1: can't read configurations, error -22 [ 781.983715][ T25] usb usb7-port1: unable to enumerate USB device [ 782.161678][T12292] loop6: detected capacity change from 0 to 7 [ 782.203215][T12292] Dev loop6: unable to read RDB block 7 [ 782.221523][T12292] loop6: unable to read partition table [ 782.259234][T12292] loop6: partition table beyond EOD, truncated [ 782.302994][T12292] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 782.433766][ T25] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 782.632752][ T25] usb 4-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 782.645465][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 782.685232][ T25] usb 4-1: Product: syz [ 782.700255][ T25] usb 4-1: Manufacturer: syz [ 782.723463][ T25] usb 4-1: SerialNumber: syz [ 782.759813][ T25] usb 4-1: config 0 descriptor?? [ 782.777777][ T25] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 782.979223][T12294] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 783.000630][T12294] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 783.243928][ T25] gspca_sq905c: sq905c_read: usb_control_msg failed (-71) [ 783.275994][ T25] sq905c 4-1:0.0: Reading version command failed [ 783.294700][ T25] sq905c 4-1:0.0: probe with driver sq905c failed with error -71 [ 783.312965][ T25] usb 4-1: USB disconnect, device number 2 [ 783.490160][ T5819] usb 9-1: USB disconnect, device number 4 [ 783.613633][ T5904] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 783.792057][ T5904] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.9e [ 783.811635][ T5904] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 783.870178][ T5904] usb 7-1: config 0 descriptor?? [ 784.313264][ T5904] ath6kl: Unsupported hardware version: 0x0 [ 784.327803][ T5904] ath6kl: Failed to init ath6kl core: -22 [ 784.348031][ T5904] ath6kl_usb 7-1:0.0: probe with driver ath6kl_usb failed with error -22 [ 784.510339][ T5819] usb 7-1: USB disconnect, device number 13 [ 785.106156][T12318] veth0: entered promiscuous mode [ 785.203672][ T5944] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 785.355626][ T5944] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 785.400939][ T5944] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 785.442595][ T5944] usb 9-1: New USB device found, idVendor=04d9, idProduct=a067, bcdDevice= 0.00 [ 785.503150][ T5944] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 785.555858][ T5944] usb 9-1: config 0 descriptor?? [ 785.655007][T12320] fuse: Invalid gid '00000000000000065534' [ 785.778941][T12324] binder: BINDER_SET_CONTEXT_MGR already set [ 785.786466][T12322] binder_alloc: binder_alloc_mmap_handler: 12321 200000ffd000-200001000000 already mapped failed -16 [ 785.820230][T12324] binder: 12321:12324 ioctl 4018620d 200000000040 returned -16 [ 785.848445][T12327] sctp: [Deprecated]: syz.7.1543 (pid 12327) Use of int in max_burst socket option deprecated. [ 785.848445][T12327] Use struct sctp_assoc_value instead [ 785.906733][ T5904] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 785.980744][ T5944] holtek_mouse 0003:04D9:A067.0015: reserved main item tag 0xd [ 786.022219][ T5944] holtek_mouse 0003:04D9:A067.0015: hidraw0: USB HID v0.00 Device [HID 04d9:a067] on usb-dummy_hcd.8-1/input0 [ 786.073866][ T5904] usb 4-1: Using ep0 maxpacket: 16 [ 786.100411][ T5904] usb 4-1: config 2 has an invalid interface number: 97 but max is 0 [ 786.124023][ T5904] usb 4-1: config 2 has no interface number 0 [ 786.135852][ T5904] usb 4-1: New USB device found, idVendor=17ef, idProduct=7205, bcdDevice=32.bd [ 786.156319][ T5904] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 786.183735][ T5904] usb 4-1: Product: syz [ 786.192876][ T5904] usb 4-1: Manufacturer: syz [ 786.203806][ T5904] usb 4-1: SerialNumber: syz [ 786.226614][ T5904] r8152-cfgselector 4-1: Unknown version 0x0000 [ 786.246867][ T5904] hub 4-1:2.97: bad descriptor, ignoring hub [ 786.252962][ T5904] hub 4-1:2.97: probe with driver hub failed with error -5 [ 786.350297][ T5819] usb 9-1: USB disconnect, device number 5 [ 786.533371][T12328] fido_id[12328]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 786.661179][ T5904] r8152-cfgselector 4-1: USB disconnect, device number 3 [ 787.580663][T12358] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1552'. [ 787.641065][T12358] netlink: 'syz.8.1552': attribute type 1 has an invalid length. [ 787.803623][ T5918] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 787.953861][ T5918] usb 4-1: device descriptor read/64, error -71 [ 788.233707][ T5918] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 788.403636][ T5918] usb 4-1: device descriptor read/64, error -71 [ 788.484996][ T5904] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 788.517257][ T5918] usb usb4-port1: attempt power cycle [ 788.647860][ T5904] usb 9-1: device descriptor read/64, error -71 [ 788.893708][ T5918] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 788.903758][ T5904] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 788.929943][ T5918] usb 4-1: device descriptor read/8, error -71 [ 789.055976][ T5904] usb 9-1: device descriptor read/64, error -71 [ 789.164154][ T5904] usb usb9-port1: attempt power cycle [ 789.185942][ T5918] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 789.237247][ T5918] usb 4-1: device descriptor read/8, error -71 [ 789.374257][ T5918] usb usb4-port1: unable to enumerate USB device [ 789.509075][T12385] loop2: detected capacity change from 0 to 7 [ 789.514372][ T5904] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 789.522002][T10909] loop2: [ 789.535162][T10909] loop2: partition table partially beyond EOD, truncated [ 789.550437][T12385] loop2: [ 789.554184][T12385] loop2: partition table partially beyond EOD, truncated [ 789.554874][ T5904] usb 9-1: device descriptor read/8, error -71 [ 789.823690][ T5904] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 789.855921][ T5904] usb 9-1: device descriptor read/8, error -71 [ 789.973162][ T5904] usb usb9-port1: unable to enumerate USB device [ 790.070900][T12392] loop6: detected capacity change from 0 to 7 [ 790.092457][T12392] Dev loop6: unable to read RDB block 7 [ 790.104114][T12392] loop6: unable to read partition table [ 790.110126][T12392] loop6: partition table beyond EOD, truncated [ 790.132215][T12392] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 792.153793][ T5890] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 792.426695][ T5890] usb 9-1: config 220 has an invalid interface number: 76 but max is 2 [ 792.515578][ T5890] usb 9-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 792.572133][T12424] loop2: detected capacity change from 0 to 7 [ 792.616244][ T5890] usb 9-1: config 220 has no interface number 2 [ 792.631937][T12424] Dev loop2: unable to read RDB block 7 [ 792.644244][ T5890] usb 9-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 792.655777][T12424] loop2: unable to read partition table [ 792.684043][T12424] loop2: partition table beyond EOD, truncated [ 792.690317][T12424] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 792.744361][ T5890] usb 9-1: config 220 interface 0 has no altsetting 0 [ 792.762452][ T5890] usb 9-1: config 220 interface 76 has no altsetting 0 [ 792.775058][ T5890] usb 9-1: config 220 interface 1 has no altsetting 0 [ 792.813360][ T5890] usb 9-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 792.828601][ T5890] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 792.867637][ T5890] usb 9-1: Product: syz [ 792.883984][ T5890] usb 9-1: Manufacturer: syz [ 792.909157][ T5890] usb 9-1: SerialNumber: syz [ 793.319511][T12428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 793.329350][T12428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 793.342916][T12428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 793.352308][T12428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 793.364651][T12426] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1571'. [ 793.959583][T12431] xt_CT: No such helper "pptp" [ 794.864814][T12443] loop6: detected capacity change from 0 to 7 [ 795.044379][T12443] Dev loop6: unable to read RDB block 7 [ 795.050901][T12443] loop6: unable to read partition table [ 795.192296][T12443] loop6: partition table beyond EOD, truncated [ 795.217267][T12443] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 795.413851][T12450] netlink: 'syz.0.1577': attribute type 29 has an invalid length. [ 795.735803][ T31] audit: type=1326 audit(1751056203.007:766): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12454 comm="syz.7.1579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f924c58e929 code=0x7ffc0000 [ 795.850920][ T31] audit: type=1326 audit(1751056203.017:767): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12454 comm="syz.7.1579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f924c58e929 code=0x7ffc0000 [ 796.173843][ T5917] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 796.348109][ T5917] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 796.390424][ T5917] usb 7-1: config 0 has no interface number 0 [ 796.393658][ T31] audit: type=1326 audit(1751056203.047:768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12454 comm="syz.7.1579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f924c58e929 code=0x7ffc0000 [ 796.487261][ T5917] usb 7-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 796.512026][ T5917] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 796.664077][ T31] audit: type=1326 audit(1751056203.057:769): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12454 comm="syz.7.1579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f924c58e929 code=0x7ffc0000 [ 796.793164][ T5917] usb 7-1: Product: syz [ 796.816819][ T5917] usb 7-1: Manufacturer: syz [ 796.821594][ T5917] usb 7-1: SerialNumber: syz [ 796.880521][ T31] audit: type=1326 audit(1751056203.067:770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12454 comm="syz.7.1579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f924c58e929 code=0x7ffc0000 [ 796.917868][ T5917] usb 7-1: config 0 descriptor?? [ 796.999483][ T5890] usb 9-1: selecting invalid altsetting 0 [ 797.003927][ T31] audit: type=1326 audit(1751056203.067:771): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12454 comm="syz.7.1579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f924c58e929 code=0x7ffc0000 [ 797.128814][ T5890] usb 9-1: Found UVC 7.01 device syz (8086:0b07) [ 797.149258][ T5890] usb 9-1: No valid video chain found. [ 797.184021][ T5917] usb 7-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 797.206348][ T5890] usb 9-1: selecting invalid altsetting 0 [ 797.232625][ T5890] usbtest 9-1:220.1: probe with driver usbtest failed with error -22 [ 797.263480][ T5890] usb 9-1: USB disconnect, device number 10 [ 797.272816][ T5917] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 797.344379][T12459] netlink: 'syz.0.1577': attribute type 7 has an invalid length. [ 797.375632][ T5917] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 797.399216][ T5917] usb 7-1: media controller created [ 797.463208][ T5917] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 797.499741][T12459] : entered promiscuous mode [ 797.755174][T12466] loop2: detected capacity change from 0 to 7 [ 797.801321][T12466] Dev loop2: unable to read RDB block 7 [ 797.828345][ T5917] i2c i2c-3: ec100: i2c rd failed=-32 reg=33 [ 797.842996][T12466] loop2: unable to read partition table [ 798.053970][T12466] loop2: partition table beyond EOD, truncated [ 798.090342][T12466] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 798.773784][T12476] syz.0.1582 (12476): drop_caches: 2 [ 799.261519][ T5890] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 799.485565][ T5890] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 799.493977][ T5890] usb 4-1: config 0 has no interface number 0 [ 799.519187][ T5890] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 799.540751][ T5890] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 799.599923][ T5890] usb 4-1: Product: syz [ 799.624193][ T5890] usb 4-1: Manufacturer: syz [ 799.651317][ T5890] usb 4-1: SerialNumber: syz [ 799.694459][ T5890] usb 4-1: config 0 descriptor?? [ 799.894327][ T5904] usb 7-1: USB disconnect, device number 14 [ 799.950392][ T5890] usb 4-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 800.012459][ T5890] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 800.054070][ T5890] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 800.074021][ T5890] usb 4-1: media controller created [ 800.154194][T12478] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 800.177321][ T5890] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 800.206188][T12478] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 800.289306][T12478] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 800.330773][T12478] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 800.410459][ T5890] i2c i2c-3: ec100: i2c rd failed=-71 reg=33 [ 800.733252][ T5890] usb 4-1: USB disconnect, device number 8 [ 801.026577][T12495] ttyS ttyS3: ldisc open failed (-12), clearing slot 3 [ 801.503654][ T5904] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 802.086781][ T5904] usb 9-1: config 0 has an invalid interface number: 51 but max is 0 [ 802.097274][ T5904] usb 9-1: config 0 has an invalid interface number: 4 but max is 0 [ 802.166672][ T5904] usb 9-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 802.239987][ T5904] usb 9-1: config 0 has no interface number 0 [ 802.255055][ T5904] usb 9-1: config 0 has no interface number 1 [ 802.293105][ T5904] usb 9-1: New USB device found, idVendor=cc35, idProduct=693f, bcdDevice=e7.0f [ 802.307590][ T5904] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 802.382960][ T979] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 802.410315][ T5904] usb 9-1: Product: syz [ 802.553684][ T979] usb 7-1: Using ep0 maxpacket: 16 [ 802.566784][ T979] usb 7-1: config 1 has an invalid descriptor of length 182, skipping remainder of the config [ 802.581061][ T5904] usb 9-1: Manufacturer: syz [ 802.609345][ T5904] usb 9-1: SerialNumber: syz [ 802.616815][ T979] usb 7-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 802.638495][ T979] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 802.653258][ T5904] usb 9-1: config 0 descriptor?? [ 802.677877][ T5904] cdc_acm 9-1:0.51: probe with driver cdc_acm failed with error -22 [ 802.696197][ T979] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 802.715583][ T979] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 802.755921][ T979] usb 7-1: SerialNumber: syz [ 802.886112][ T5904] usb 9-1: USB disconnect, device number 11 [ 803.066695][ T979] usb 7-1: USB disconnect, device number 15 [ 803.965504][ T5917] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 804.236233][ T5918] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 804.244131][ T5917] usb 7-1: Using ep0 maxpacket: 8 [ 804.269162][ T5917] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 804.280446][ T5917] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 804.395343][ T5918] usb 9-1: Using ep0 maxpacket: 8 [ 804.455495][ T5917] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 804.491023][ T5918] usb 9-1: unable to get BOS descriptor or descriptor too short [ 804.510842][ T5918] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 804.548833][ T5917] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 804.578725][ T5918] usb 9-1: config 1 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 804.613769][ T5917] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 804.645224][ T5918] usb 9-1: config 1 interface 0 has no altsetting 0 [ 804.703862][ T5917] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 804.713226][ T5917] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 804.725198][ T5918] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 804.735467][ T5918] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 804.744218][ T5918] usb 9-1: Product: syz [ 804.748820][ T5918] usb 9-1: Manufacturer: syz [ 804.753896][ T5918] usb 9-1: SerialNumber: syz [ 804.782275][ T5917] usbtmc 7-1:16.0: probe with driver usbtmc failed with error -22 [ 805.424509][T12523] pim6reg0: tun_chr_ioctl cmd 1074025680 [ 805.617071][T12533] loop6: detected capacity change from 0 to 7 [ 805.662654][ T6834] Dev loop6: unable to read RDB block 7 [ 805.686228][ T6834] loop6: unable to read partition table [ 805.806845][ T6834] loop6: partition table beyond EOD, truncated [ 805.880566][T12533] Dev loop6: unable to read RDB block 7 [ 805.886642][T12533] loop6: unable to read partition table [ 805.974116][T12533] loop6: partition table beyond EOD, truncated [ 805.994548][T12533] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 806.284652][T12536] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1598'. [ 806.991624][ T5917] usb 7-1: USB disconnect, device number 16 [ 807.476645][ T5918] cdc_ether 9-1:1.0: probe with driver cdc_ether failed with error -22 [ 807.515244][ T5918] usb 9-1: USB disconnect, device number 12 [ 807.633763][ T25] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 807.804980][T12550] loop8: detected capacity change from 0 to 16384 [ 807.836323][ T25] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 807.863852][T12550] loop8: detected capacity change from 16384 to 16383 [ 807.891580][ T25] usb 4-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00 [ 807.941283][ T25] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 807.977503][ T25] usb 4-1: config 0 descriptor?? [ 807.983918][T12550] Dev loop8: unable to read RDB block 8 [ 807.999831][T12550] loop8: unable to read partition table [ 808.023783][ T5918] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 808.024575][T12550] loop_reread_partitions: partition scan of loop8 (>kWи P9RpC%x| |ƻ5}XB+ﱰ [ 808.024575][T12550] |) failed (rc=-5) [ 808.213699][ T5918] usb 7-1: Using ep0 maxpacket: 32 [ 808.238242][ T5918] usb 7-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 808.272776][ T5918] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 808.299026][ T5918] usb 7-1: Product: syz [ 808.303304][ T5918] usb 7-1: Manufacturer: syz [ 808.315741][T12560] loop6: detected capacity change from 0 to 7 [ 808.376252][T12560] Dev loop6: unable to read RDB block 7 [ 808.376306][T12560] loop6: unable to read partition table [ 808.376585][T12560] loop6: partition table beyond EOD, truncated [ 808.376609][T12560] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 808.382103][ T5918] usb 7-1: SerialNumber: syz [ 808.493286][ T5918] usb 7-1: config 0 descriptor?? [ 808.742946][ T31] audit: type=1326 audit(1751056216.007:772): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12547 comm="syz.6.1604" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7faae198e929 code=0x0 [ 808.938672][ C0] vkms_vblank_simulate: vblank timer overrun [ 809.567813][ T5918] peak_usb 7-1:0.0 can0: unable to request usb[type=0 value=1] err=-71 [ 809.638152][ T5918] peak_usb 7-1:0.0: unable to read PCAN-USB Pro firmware info (err -71) [ 809.825039][ T5918] peak_usb 7-1:0.0: probe with driver peak_usb failed with error -71 [ 809.857473][ T5918] usb 7-1: USB disconnect, device number 17 [ 810.111868][T12580] netlink: 24 bytes leftover after parsing attributes in process `syz.8.1607'. [ 811.725081][ T25] usbhid 4-1:0.0: can't add hid device: -71 [ 811.745596][ T25] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 811.759569][T12593] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1613'. [ 811.903585][ T25] usb 4-1: USB disconnect, device number 9 [ 812.566466][ T31] audit: type=1326 audit(1751056219.827:773): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 812.743596][ T31] audit: type=1326 audit(1751056219.827:774): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 812.935564][ T31] audit: type=1326 audit(1751056219.827:775): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 813.540710][ T31] audit: type=1326 audit(1751056219.827:776): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 813.722306][ T31] audit: type=1326 audit(1751056219.827:777): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 813.910111][ T31] audit: type=1326 audit(1751056219.827:778): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=217 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 814.083795][ T5890] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 814.101917][ T31] audit: type=1326 audit(1751056219.827:779): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 814.183802][ T31] audit: type=1326 audit(1751056219.827:780): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 814.208408][ T31] audit: type=1326 audit(1751056219.827:781): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 814.230946][ T31] audit: type=1326 audit(1751056219.827:782): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 814.255479][ T31] audit: type=1326 audit(1751056219.827:783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 814.276582][ T5890] usb 9-1: device descriptor read/64, error -71 [ 814.279282][ T31] audit: type=1326 audit(1751056219.827:784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f151c590847 code=0x7ffc0000 [ 814.316941][ T5819] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 814.361785][ T31] audit: type=1326 audit(1751056219.837:785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f151c5907bc code=0x7ffc0000 [ 814.384640][ T31] audit: type=1326 audit(1751056219.837:786): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f151c5906f4 code=0x7ffc0000 [ 814.464652][ T31] audit: type=1326 audit(1751056219.837:787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12601 comm="syz.3.1616" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f151c5906f4 code=0x7ffc0000 [ 814.493909][T12619] program syz.0.1619 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 814.543645][ T5819] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 814.567552][ T5819] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 814.594194][ T5890] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 814.602879][ T5819] usb 7-1: New USB device found, idVendor=04da, idProduct=c002, bcdDevice= 0.00 [ 814.623675][ T5819] usb 7-1: New USB device strings: Mfr=0, Product=98, SerialNumber=0 [ 814.684809][ T5819] usb 7-1: Product: syz [ 814.734312][ T5819] usb 7-1: config 0 descriptor?? [ 814.793828][ T5890] usb 9-1: device descriptor read/64, error -71 [ 814.940372][ T5890] usb usb9-port1: attempt power cycle [ 815.008324][T12623] ip6tnl2: entered promiscuous mode [ 815.262242][ T979] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 815.363716][ T5890] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 815.423888][ T5890] usb 9-1: device descriptor read/8, error -71 [ 815.469622][ T5918] usb 7-1: USB disconnect, device number 18 [ 815.539800][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 815.546742][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 815.553727][ T979] usb 4-1: device descriptor read/64, error -71 [ 815.667445][ T5890] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 815.721891][ T5890] usb 9-1: device descriptor read/8, error -71 [ 815.803759][ T979] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 815.844079][ T5890] usb usb9-port1: unable to enumerate USB device [ 815.943636][ T979] usb 4-1: device descriptor read/64, error -71 [ 816.068745][ T979] usb usb4-port1: attempt power cycle [ 816.423644][ T979] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 816.464539][ T979] usb 4-1: device descriptor read/8, error -71 [ 816.723673][ T979] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 816.776349][ T979] usb 4-1: device descriptor read/8, error -71 [ 816.898045][ T979] usb usb4-port1: unable to enumerate USB device [ 820.344168][ T25] usb 9-1: new full-speed USB device number 17 using dummy_hcd [ 820.516334][ T25] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 820.580924][ T25] usb 9-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00 [ 820.649012][ T25] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 820.881399][ T25] usb 9-1: config 0 descriptor?? [ 821.015782][T12659] raw-gadget.3 gadget.8: fail, usb_ep_enable returned -22 [ 821.611660][ T25] uclogic 0003:5543:0064.0016: unknown main item tag 0x0 [ 821.746678][T12659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 821.757659][ T25] uclogic 0003:5543:0064.0016: unknown main item tag 0x0 [ 821.785731][T12659] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 821.843696][ T25] uclogic 0003:5543:0064.0016: unknown main item tag 0x0 [ 821.958105][ T25] uclogic 0003:5543:0064.0016: unknown main item tag 0x0 [ 822.014230][ T25] uclogic 0003:5543:0064.0016: unknown main item tag 0x0 [ 822.154608][ T25] uclogic 0003:5543:0064.0016: hidraw0: USB HID v1.01 Device [HID 5543:0064] on usb-dummy_hcd.8-1/input0 [ 822.404180][ T25] usb 9-1: USB disconnect, device number 17 [ 822.528549][T12671] fido_id[12671]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/9-1/report_descriptor': No such file or directory [ 822.951654][T11638] syz.1.1366: vmalloc error: size 8388608, failed to allocated page array size 16384, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 823.077700][T11638] CPU: 1 UID: 0 PID: 11638 Comm: syz.1.1366 Not tainted 6.16.0-rc3-syzkaller-00190-g67a993863163 #0 PREEMPT(full) [ 823.077734][T11638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 823.077749][T11638] Call Trace: [ 823.077760][T11638] [ 823.077770][T11638] dump_stack_lvl+0x189/0x250 [ 823.077818][T11638] ? __pfx_dump_stack_lvl+0x10/0x10 [ 823.077855][T11638] ? __pfx__printk+0x10/0x10 [ 823.077880][T11638] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 823.077906][T11638] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 823.077934][T11638] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 823.077963][T11638] warn_alloc+0x214/0x310 [ 823.077997][T11638] ? __pfx_warn_alloc+0x10/0x10 [ 823.078033][T11638] ? __get_vm_area_node+0x28f/0x300 [ 823.078058][T11638] ? relay_open_buf+0x217/0xd40 [ 823.078086][T11638] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 823.078146][T11638] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 823.078177][T11638] ? rcu_is_watching+0x15/0xb0 [ 823.078214][T11638] ? relay_open_buf+0x217/0xd40 [ 823.078237][T11638] ? relay_open_buf+0x217/0xd40 [ 823.078258][T11638] __kvmalloc_node_noprof+0x3b8/0x5f0 [ 823.078282][T11638] ? relay_open_buf+0x217/0xd40 [ 823.078303][T11638] ? trace_kmalloc+0x1f/0xd0 [ 823.078323][T11638] ? relay_open_buf+0x17c/0xd40 [ 823.078359][T11638] relay_open_buf+0x217/0xd40 [ 823.078397][T11638] relay_open+0x427/0x920 [ 823.078429][T11638] do_blk_trace_setup+0x591/0x9d0 [ 823.078472][T11638] blk_trace_setup+0x116/0x1f0 [ 823.078510][T11638] ? __pfx_blk_trace_setup+0x10/0x10 [ 823.078553][T11638] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 823.078588][T11638] blk_trace_ioctl+0x181/0x430 [ 823.078623][T11638] ? __pfx_blk_trace_ioctl+0x10/0x10 [ 823.078667][T11638] ? __lock_acquire+0xab9/0xd20 [ 823.078726][T11638] blkdev_ioctl+0x416/0x6d0 [ 823.078761][T11638] ? __pfx_blkdev_ioctl+0x10/0x10 [ 823.078790][T11638] ? __fget_files+0x2a/0x420 [ 823.078819][T11638] ? bpf_lsm_file_ioctl+0x9/0x20 [ 823.078852][T11638] ? __pfx_blkdev_ioctl+0x10/0x10 [ 823.078884][T11638] __se_sys_ioctl+0xf9/0x170 [ 823.078921][T11638] do_syscall_64+0xfa/0x3b0 [ 823.078955][T11638] ? lockdep_hardirqs_on+0x9c/0x150 [ 823.078988][T11638] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 823.079011][T11638] ? clear_bhb_loop+0x60/0xb0 [ 823.079040][T11638] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 823.079063][T11638] RIP: 0033:0x7fcec8b8e929 [ 823.079089][T11638] Code: Unable to access opcode bytes at 0x7fcec8b8e8ff. [ 823.079102][T11638] RSP: 002b:00007fcec9a08038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 823.079127][T11638] RAX: ffffffffffffffda RBX: 00007fcec8db6160 RCX: 00007fcec8b8e929 [ 823.079144][T11638] RDX: 0000200000000b40 RSI: 00000000c0481273 RDI: 0000000000000004 [ 823.079160][T11638] RBP: 00007fcec8c10b39 R08: 0000000000000000 R09: 0000000000000000 [ 823.079175][T11638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 823.079189][T11638] R13: 0000000000000001 R14: 00007fcec8db6160 R15: 00007fcec8edfa28 [ 823.079224][T11638] [ 823.079247][T11638] Mem-Info: [ 823.534191][T11638] active_anon:25250 inactive_anon:22 isolated_anon:0 [ 823.534191][T11638] active_file:13570 inactive_file:294 isolated_file:0 [ 823.534191][T11638] unevictable:768 dirty:146 writeback:0 [ 823.534191][T11638] slab_reclaimable:6116 slab_unreclaimable:111664 [ 823.534191][T11638] mapped:55130 shmem:23213 pagetables:3990 [ 823.534191][T11638] sec_pagetables:0 bounce:0 [ 823.534191][T11638] kernel_misc_reclaimable:0 [ 823.534191][T11638] free:88766 free_pcp:23689 free_cma:0 [ 823.579407][ C0] vkms_vblank_simulate: vblank timer overrun [ 823.610837][T11638] Node 0 active_anon:0kB inactive_anon:88kB active_file:12kB inactive_file:160kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:135184kB dirty:20kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12656kB pagetables:5176kB sec_pagetables:0kB all_unreclaimable? yes Balloon:0kB [ 823.643553][ C0] vkms_vblank_simulate: vblank timer overrun [ 823.667584][T11638] Node 1 active_anon:101624kB inactive_anon:0kB active_file:54268kB inactive_file:1016kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:85844kB dirty:564kB writeback:0kB shmem:91700kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:1360kB pagetables:10656kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 823.700942][ C0] vkms_vblank_simulate: vblank timer overrun [ 823.731626][T11638] Node 0 DMA free:10216kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:32kB local_pcp:28kB free_cma:0kB [ 823.760860][ C0] vkms_vblank_simulate: vblank timer overrun [ 823.833895][ T5904] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 823.842195][T11638] lowmem_reserve[]: 0 2500 2502 2502 2502 [ 823.849857][T11638] Node 0 DMA32 free:43424kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:12288KB free_highatomic:1276KB active_anon:0kB inactive_anon:88kB active_file:12kB inactive_file:160kB unevictable:1536kB writepending:20kB present:3129332kB managed:2560988kB mlocked:0kB bounce:0kB free_pcp:9696kB local_pcp:3616kB free_cma:0kB [ 823.881627][ C0] vkms_vblank_simulate: vblank timer overrun [ 824.154164][T11638] lowmem_reserve[]: 0 0 1 1 1 [ 824.154280][ T5904] usb 9-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 824.158986][T11638] Node 0 Normal free:24kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:20kB local_pcp:16kB free_cma:0kB [ 824.187224][ T5904] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 824.210376][ T5904] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 824.220438][ T5904] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 824.270824][T11638] lowmem_reserve[]: 0 0 0 0 0 [ 824.292511][T11638] Node 1 Normal free:300584kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:83604kB inactive_anon:0kB active_file:54268kB inactive_file:1016kB unevictable:1536kB writepending:564kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:103072kB local_pcp:50048kB free_cma:0kB [ 824.324870][ C0] vkms_vblank_simulate: vblank timer overrun [ 824.365054][ T5904] usb 9-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 824.400134][T11638] lowmem_reserve[]: 0 0 0 0 0 [ 824.421485][T11638] Node 0 DMA: 0*4kB 1*8kB (U) 0*16kB 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 1*1024kB (U) 2*2048kB (UM) 1*4096kB (M) = 10216kB [ 824.451946][ T5904] usb 9-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 824.464043][ T5904] usb 9-1: Manufacturer: syz [ 824.473160][ T5904] usb 9-1: config 0 descriptor?? [ 824.480166][T11638] Node 0 DMA32: 126*4kB (UMEH) 135*8kB (UME) 229*16kB (UMEH) 177*32kB (UMEH) 118*64kB (UMEH) 85*128kB (UMEH) 39*256kB (ME) 6*512kB (MH) 1*1024kB (M) 0*2048kB 0*4096kB = 43424kB [ 824.500332][T11638] Node 0 Normal: 2*4kB (U) 2*8kB (U) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 24kB [ 824.562054][T11638] Node 1 Normal: 2*4kB (ME) 2*8kB (UE) 3*16kB (UME) 1*32kB (E) 3*64kB (UE) 4*128kB (UME) 0*256kB 2*512kB (ME) 4*1024kB (UME) 2*2048kB (ME) 71*4096kB (M) = 300840kB [ 824.655937][T11638] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 824.680062][T11638] Node 0 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 824.706492][T11638] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 824.716614][T11638] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 824.728501][T11638] 34283 total pagecache pages [ 824.733269][T11638] 1093 pages in swap cache [ 824.740909][T11638] Free swap = 91788kB [ 824.748602][T11638] Total swap = 124996kB [ 824.752922][T11638] 2097051 pages RAM [ 824.757266][T11638] 0 pages HighMem/MovableOnly [ 824.762009][T11638] 424698 pages reserved [ 824.766842][T11638] 0 pages cma reserved [ 824.928473][ T5904] appleir 0003:05AC:8243.0017: unknown main item tag 0x0 [ 824.960366][ T5904] appleir 0003:05AC:8243.0017: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.8-1/input0 [ 825.663803][ T25] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 825.825964][ T25] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 825.871316][ T25] usb 7-1: config 0 has no interface number 0 [ 825.945422][ T25] usb 7-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 826.039097][ T25] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 826.103922][ T25] usb 7-1: Product: syz [ 826.108194][ T25] usb 7-1: Manufacturer: syz [ 826.142732][ T25] usb 7-1: SerialNumber: syz [ 826.174013][ T25] usb 7-1: config 0 descriptor?? [ 826.413167][ T25] usb 7-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 826.426006][ T25] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 826.442949][ T25] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 826.469581][ T25] usb 7-1: media controller created [ 826.570964][ T25] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 826.939002][ T25] usb 7-1: USB disconnect, device number 19 [ 826.995753][ T5944] usb 9-1: USB disconnect, device number 18 [ 827.496106][T12716] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1648'. [ 831.076658][T12766] input: syz1 as /devices/virtual/input/input33 [ 832.941223][T12783] netlink: 16 bytes leftover after parsing attributes in process `syz.8.1671'. [ 833.308808][T10804] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 833.355591][ T25] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 833.365670][T10804] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 834.173883][ T5918] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 834.257528][ T5918] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 834.721015][T12804] tipc: Enabled bearer , priority 10 [ 835.015353][T12811] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 835.052588][T12811] kvm: pic: non byte read [ 835.070660][T12811] kvm: pic: level sensitive irq not supported [ 835.071465][T12811] kvm: pic: non byte read [ 835.112253][T12811] kvm: pic: level sensitive irq not supported [ 835.112350][T12811] kvm: pic: non byte read [ 835.191844][T12811] kvm: pic: level sensitive irq not supported [ 835.192509][T12811] kvm: pic: non byte read [ 835.245081][T12811] kvm: pic: level sensitive irq not supported [ 835.245198][T12811] kvm: pic: non byte read [ 837.186794][T12831] syz.3.1685 (12831): drop_caches: 2 [ 837.533732][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 841.426639][T12883] tipc: Started in network mode [ 841.452026][T12883] tipc: Node identity 4, cluster identity 4711 [ 841.472247][T12883] tipc: Node number set to 4 [ 841.503705][ T5917] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 841.678675][ T5917] usb 4-1: config 0 has an invalid interface number: 7 but max is 0 [ 841.713651][ T5917] usb 4-1: config 0 has no interface number 0 [ 841.745160][ T5917] usb 4-1: config 0 interface 7 altsetting 2 bulk endpoint 0xF has invalid maxpacket 64 [ 841.804508][ T5917] usb 4-1: config 0 interface 7 altsetting 2 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 841.843479][ T5917] usb 4-1: config 0 interface 7 has no altsetting 0 [ 841.852579][ T5917] usb 4-1: New USB device found, idVendor=0f3d, idProduct=68aa, bcdDevice= c.63 [ 841.885527][ T5917] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 841.935034][ T5917] usb 4-1: config 0 descriptor?? [ 841.954568][T12881] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 842.217161][ T5917] usb 4-1: string descriptor 0 read error: -71 [ 842.244789][ T5917] usb 4-1: Error in usbnet_get_endpoints (-22) [ 842.310829][ T5917] usb 4-1: USB disconnect, device number 14 [ 843.055477][T12907] ucma_write: process 1183 (syz.3.1715) changed security contexts after opening file descriptor, this is not allowed. [ 843.085824][T12902] bridge0: port 2(bridge_slave_1) entered disabled state [ 843.093667][T12902] bridge0: port 1(bridge_slave_0) entered disabled state [ 843.203317][T12913] netlink: 'syz.8.1714': attribute type 10 has an invalid length. [ 843.571519][T12902] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 843.611690][T12902] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 843.844016][T12902] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 843.858282][T12902] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 843.875208][T12902] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 843.890452][T12902] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 844.320451][T12913] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 844.789816][T12936] netlink: 'syz.3.1726': attribute type 1 has an invalid length. [ 844.843691][ T5944] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 844.951090][T12936] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 844.974224][ T5944] usb 9-1: device descriptor read/64, error -71 [ 845.061712][T12938] veth5: entered promiscuous mode [ 845.091381][T12938] bond2: (slave veth5): Enslaving as a backup interface with a down link [ 845.223822][ T5944] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 845.383989][ T5944] usb 9-1: device descriptor read/64, error -71 [ 845.507611][ T5944] usb usb9-port1: attempt power cycle [ 845.613729][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 845.863856][ T5944] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 845.899720][ T5944] usb 9-1: device descriptor read/8, error -71 [ 846.144071][ T5944] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 846.184590][ T5944] usb 9-1: device descriptor read/8, error -71 [ 846.294420][ T5944] usb usb9-port1: unable to enumerate USB device [ 851.485468][T12995] xt_CT: No such helper "snmp" [ 852.185345][ T979] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 852.452181][T13012] fuse: Bad value for 'rootmode' [ 852.553602][ T979] usb 4-1: Using ep0 maxpacket: 8 [ 852.602204][ T979] usb 4-1: New USB device found, idVendor=040a, idProduct=0002, bcdDevice=de.7b [ 852.641449][ T979] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 852.663250][T13017] loop2: detected capacity change from 0 to 7 [ 852.670496][T13017] loop2: [ 852.673741][T13017] loop2: partition table partially beyond EOD, truncated [ 852.693980][ T979] gspca_main: spca501-2.14.0 probing 040a:0002 [ 852.841499][ T5918] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 852.896865][T13004] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 852.914080][T13004] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 852.934999][ T979] gspca_spca501: reg write: error -71 [ 852.940442][ T979] spca501 4-1:2.0: Reg write failed for 0x00,0xaa,0x00 [ 852.990666][ T979] spca501 4-1:2.0: probe with driver spca501 failed with error -22 [ 853.053633][ T5918] usb 7-1: device descriptor read/64, error -71 [ 853.262586][ T979] usb 4-1: USB disconnect, device number 15 [ 853.314364][ T5918] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 853.456222][ T5844] Bluetooth: hci5: command 0x0406 tx timeout [ 853.463988][ T5918] usb 7-1: device descriptor read/64, error -71 [ 853.573884][ T5917] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 853.581774][ T5918] usb usb7-port1: attempt power cycle [ 853.757828][ T5917] usb 9-1: Using ep0 maxpacket: 32 [ 853.765375][ T5917] usb 9-1: config 0 has an invalid interface number: 12 but max is 0 [ 853.783721][ T5917] usb 9-1: config 0 has no interface number 0 [ 853.800283][ T5917] usb 9-1: config 0 interface 12 has no altsetting 0 [ 853.822808][ T5917] usb 9-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 853.846075][ T5917] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 853.859196][ T5917] usb 9-1: Product: syz [ 853.863746][ T5819] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 853.877303][ T5917] usb 9-1: Manufacturer: syz [ 853.891003][ T5917] usb 9-1: SerialNumber: syz [ 853.914116][ T5917] usb 9-1: config 0 descriptor?? [ 853.937850][ T5918] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 853.988412][ T5918] usb 7-1: device descriptor read/8, error -71 [ 854.043786][ T5819] usb 4-1: Using ep0 maxpacket: 8 [ 854.051196][ T5819] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 854.194303][ T5819] usb 4-1: config 179 has no interface number 0 [ 854.210290][ T5819] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 64, changing to 10 [ 854.242597][ T5819] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 1029, setting to 1024 [ 854.301409][ T5819] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 102, changing to 10 [ 854.333847][ T5918] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 854.348099][ T5819] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 24624, setting to 1024 [ 854.396073][ T5918] usb 7-1: device descriptor read/8, error -71 [ 854.409224][ T5819] usb 4-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 854.457015][ T5819] usb 4-1: config 179 interface 65 has no altsetting 0 [ 854.487466][ T5819] usb 4-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 854.513687][ T5819] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 854.534771][ T5918] usb usb7-port1: unable to enumerate USB device [ 854.547564][T13024] raw-gadget.5 gadget.3: fail, usb_ep_enable returned -22 [ 854.636977][ T5819] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input35 [ 854.650200][T13027] syz_tun: entered allmulticast mode [ 854.690998][T13026] syz_tun: left allmulticast mode [ 854.744741][ T5185] input input35: unable to receive magic message: -110 [ 854.791215][T13024] input: syz1 as /devices/virtual/input/input36 [ 854.837007][ T5185] input input35: unable to receive magic message: -32 [ 854.896250][T13024] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1751'. [ 855.021437][ T7232] input input35: unable to receive magic message: -32 [ 855.133938][ T5185] input input35: unable to receive magic message: -32 [ 855.184902][ T979] usb 4-1: USB disconnect, device number 16 [ 855.185064][ C1] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 855.275281][ T979] xpad 4-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 856.009585][ T5917] f81534 9-1:0.12: f81534_set_register: reg: 1003 data: b0 failed: -71 [ 856.037980][ T5917] f81534 9-1:0.12: f81534_find_config_idx: read failed: -71 [ 856.083699][ T979] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 856.091234][ T5917] f81534 9-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 856.161226][ T5917] f81534 9-1:0.12: probe with driver f81534 failed with error -71 [ 856.214648][ T5917] usb 9-1: USB disconnect, device number 23 [ 856.313604][ T979] usb 4-1: Using ep0 maxpacket: 8 [ 856.372978][ T979] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 856.396377][T13052] netlink: 'syz.0.1759': attribute type 4 has an invalid length. [ 856.409353][ T979] usb 4-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 856.444974][T13052] netlink: 'syz.0.1759': attribute type 4 has an invalid length. [ 856.483717][ T979] usb 4-1: config 0 interface 0 has no altsetting 0 [ 856.528715][ T979] usb 4-1: New USB device found, idVendor=0458, idProduct=4018, bcdDevice= 0.00 [ 856.539573][ T5944] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 856.609161][ T979] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 856.641177][ T979] usb 4-1: config 0 descriptor?? [ 856.742872][T13058] loop6: detected capacity change from 0 to 7 [ 856.793644][T13058] Dev loop6: unable to read RDB block 7 [ 856.793705][ T5944] usb 7-1: Using ep0 maxpacket: 16 [ 856.822032][ T979] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 856.841864][ T5944] usb 7-1: config 0 has an invalid interface number: 236 but max is 0 [ 856.854870][ T5944] usb 7-1: config 0 has no interface number 0 [ 856.881797][ T5944] usb 7-1: New USB device found, idVendor=1ce1, idProduct=c102, bcdDevice=84.33 [ 856.906080][ T5944] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 856.917907][T13058] loop6: unable to read partition table [ 856.928189][ T5944] usb 7-1: Product: syz [ 856.932887][ T5944] usb 7-1: Manufacturer: syz [ 856.942652][ T5944] usb 7-1: SerialNumber: syz [ 856.983930][T13058] loop6: partition table beyond EOD, truncated [ 856.991879][ T5944] usb 7-1: config 0 descriptor?? [ 857.007335][T13058] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 857.291867][ T979] usb 7-1: USB disconnect, device number 24 [ 858.577927][ T5844] Bluetooth: hci6: command 0x0406 tx timeout [ 858.584475][ T5819] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 858.754045][ T979] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 858.857442][ T5819] usb 7-1: Using ep0 maxpacket: 8 [ 858.895401][ T5819] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 858.916019][ T5918] usb 4-1: USB disconnect, device number 17 [ 859.035881][ T979] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 859.051607][ T979] usb 9-1: config 0 has no interface number 0 [ 859.079643][ T979] usb 9-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 859.093990][ T5819] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 859.121008][ T979] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 859.143675][ T979] usb 9-1: Product: syz [ 859.163690][ T5819] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 859.173833][ T979] usb 9-1: Manufacturer: syz [ 859.178518][ T979] usb 9-1: SerialNumber: syz [ 859.203755][ T5819] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 859.235334][T13083] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1767'. [ 859.246394][ T979] usb 9-1: config 0 descriptor?? [ 859.255287][ T5819] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 859.273569][ T5819] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 859.458889][ T979] usb 9-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 859.562502][T13077] pim6reg0: tun_chr_ioctl cmd 1074025680 [ 859.572367][ T5819] usb 7-1: usb_control_msg returned -32 [ 859.582195][ T979] usb 9-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 859.588483][ T5819] usbtmc 7-1:16.0: can't read capabilities [ 859.615724][ T979] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 859.644971][ T979] usb 9-1: media controller created [ 859.825724][ T979] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 859.940994][ T979] i2c i2c-3: ec100: i2c rd failed=-32 reg=33 [ 860.520390][T13100] loop2: detected capacity change from 0 to 7 [ 860.564596][T13100] loop2: [ 860.579972][T13100] loop2: partition table partially beyond EOD, truncated [ 860.709659][T13096] netlink: 32 bytes leftover after parsing attributes in process `syz.7.1770'. [ 861.036045][T13107] trusted_key: syz.0.1771 sent an empty control message without MSG_MORE. [ 861.053066][T13107] sctp: [Deprecated]: syz.0.1771 (pid 13107) Use of int in maxseg socket option. [ 861.053066][T13107] Use struct sctp_assoc_value instead [ 861.408028][T13106] loop6: detected capacity change from 0 to 7 [ 861.432173][T13097] netlink: 32 bytes leftover after parsing attributes in process `syz.7.1770'. [ 861.432883][T13106] Dev loop6: unable to read RDB block 7 [ 861.456316][T13106] loop6: unable to read partition table [ 861.462325][T13106] loop6: partition table beyond EOD, truncated [ 861.472074][T13106] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 861.616989][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 862.697462][ T5904] usb 7-1: USB disconnect, device number 25 [ 862.832524][ T5944] usb 9-1: USB disconnect, device number 24 [ 863.042434][T13131] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 863.151771][T13131] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 863.381751][T13136] xt_l2tp: wrong L2TP version: 0 [ 863.429051][T13136] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1780'. [ 863.623178][ T31] kauditd_printk_skb: 17 callbacks suppressed [ 863.623195][ T31] audit: type=1326 audit(1751056270.887:805): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13138 comm="syz.8.1781" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd98418e929 code=0x7ffc0000 [ 863.651994][ C0] vkms_vblank_simulate: vblank timer overrun [ 864.110653][ T31] audit: type=1326 audit(1751056270.947:806): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13138 comm="syz.8.1781" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fd98418e929 code=0x7ffc0000 [ 864.118388][ T5819] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 864.136539][ C0] vkms_vblank_simulate: vblank timer overrun [ 864.178136][T13149] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1782'. [ 864.293807][ T5819] usb 9-1: device descriptor read/64, error -71 [ 864.443634][ T31] audit: type=1326 audit(1751056270.947:807): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13138 comm="syz.8.1781" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd98418e929 code=0x7ffc0000 [ 864.466017][ C0] vkms_vblank_simulate: vblank timer overrun [ 864.549906][ T5819] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 864.580168][ T31] audit: type=1326 audit(1751056270.947:808): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13138 comm="syz.8.1781" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fd98418e929 code=0x7ffc0000 [ 864.914173][ T5819] usb 9-1: device descriptor read/64, error -71 [ 865.043834][ T5819] usb usb9-port1: attempt power cycle [ 865.201172][T13155] loop6: detected capacity change from 0 to 7 [ 865.208370][T13155] Dev loop6: unable to read RDB block 7 [ 865.227837][T13155] loop6: unable to read partition table [ 865.265869][T13155] loop6: partition table beyond EOD, truncated [ 865.300404][T13155] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 865.513762][ T5819] usb 9-1: new high-speed USB device number 27 using dummy_hcd [ 865.638437][ T5819] usb 9-1: device descriptor read/8, error -71 [ 865.953715][ T5819] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 866.016592][ T5819] usb 9-1: device descriptor read/8, error -71 [ 866.133993][ T5819] usb usb9-port1: unable to enumerate USB device [ 866.962794][T13171] netlink: 32 bytes leftover after parsing attributes in process `syz.7.1788'. [ 867.202591][T13175] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1789'. [ 867.296982][ T31] audit: type=1326 audit(1751056274.577:809): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13176 comm="syz.3.1790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 867.343759][ T31] audit: type=1326 audit(1751056274.597:810): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13176 comm="syz.3.1790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 867.437437][ T31] audit: type=1326 audit(1751056274.597:811): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13176 comm="syz.3.1790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 867.461113][ T31] audit: type=1326 audit(1751056274.597:812): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13176 comm="syz.3.1790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 867.500759][ T31] audit: type=1326 audit(1751056274.597:813): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13176 comm="syz.3.1790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 867.873788][ T31] audit: type=1326 audit(1751056274.597:814): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13176 comm="syz.3.1790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f151c58e929 code=0x7ffc0000 [ 868.757273][T13198] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1793'. [ 868.836898][T13199] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1793'. [ 869.600436][T13204] RDS: rds_bind could not find a transport for ae0c:91e3:ccfb:11d2:0:5efe:150.125.240.108, load rds_tcp or rds_rdma? [ 869.975602][T13208] use of bytesused == 0 is deprecated and will be removed in the future, [ 870.026116][T13208] use the actual size instead. [ 870.593874][ T32] INFO: task syz.5.1390:11714 blocked for more than 143 seconds. [ 870.632761][ T32] Not tainted 6.16.0-rc3-syzkaller-00190-g67a993863163 #0 [ 870.642176][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 870.722806][ T32] task:syz.5.1390 state:D stack:28328 pid:11714 tgid:11713 ppid:9848 task_flags:0x400040 flags:0x00004004 [ 870.763392][ T32] Call Trace: [ 870.771042][ T32] [ 870.815102][ T32] __schedule+0x16f5/0x4d00 [ 870.898931][ T32] ? is_bpf_text_address+0x26/0x2b0 [ 871.059457][ T32] ? __lock_acquire+0xa91/0xd20 [ 871.096127][ T32] ? schedule+0x165/0x360 [ 871.105870][ T32] ? __pfx___schedule+0x10/0x10 [ 871.173123][ T32] ? schedule+0x91/0x360 [ 871.185469][ T32] schedule+0x165/0x360 [ 871.201925][ T32] schedule_preempt_disabled+0x13/0x30 [ 871.355115][ T32] __mutex_lock+0x724/0xe80 [ 871.386516][ T32] ? __mutex_lock+0x51b/0xe80 [ 871.400815][ T32] ? blk_trace_setup+0xfb/0x1f0 [ 871.412640][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 871.443553][ T32] blk_trace_setup+0xfb/0x1f0 [ 871.517513][ T32] ? __pfx_blk_trace_setup+0x10/0x10 [ 871.547087][ T32] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 871.586361][ T32] blk_trace_ioctl+0x181/0x430 [ 871.591239][ T32] ? __pfx_blk_trace_ioctl+0x10/0x10 [ 871.633582][ T32] ? __lock_acquire+0xab9/0xd20 [ 871.652214][ T32] blkdev_ioctl+0x416/0x6d0 [ 871.673569][ T32] ? __pfx_blkdev_ioctl+0x10/0x10 [ 871.692897][ T32] ? __fget_files+0x2a/0x420 [ 871.715064][ T32] ? bpf_lsm_file_ioctl+0x9/0x20 [ 871.743107][ T32] ? __pfx_blkdev_ioctl+0x10/0x10 [ 871.766225][ T32] __se_sys_ioctl+0xf9/0x170 [ 871.799685][ T32] do_syscall_64+0xfa/0x3b0 [ 871.823694][ T32] ? lockdep_hardirqs_on+0x9c/0x150 [ 871.849026][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 871.923451][ T32] ? clear_bhb_loop+0x60/0xb0 [ 871.943602][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 871.960981][ T32] RIP: 0033:0x7f082f18e929 [ 871.990554][ T32] RSP: 002b:00007f082ff9c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 872.033736][ T32] RAX: ffffffffffffffda RBX: 00007f082f3b5fa0 RCX: 00007f082f18e929 [ 872.069311][ T32] RDX: 0000200000000140 RSI: 00000000c0481273 RDI: 0000000000000004 [ 872.100761][ T32] RBP: 00007f082f210b39 R08: 0000000000000000 R09: 0000000000000000 [ 872.147061][ T32] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 872.181541][ T32] R13: 0000000000000000 R14: 00007f082f3b5fa0 R15: 00007f082f4dfa28 [ 872.220533][ T32] [ 872.237622][ T32] INFO: task syz.5.1390:11715 blocked for more than 145 seconds. [ 872.290818][ T32] Not tainted 6.16.0-rc3-syzkaller-00190-g67a993863163 #0 [ 872.330718][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 872.377612][ T32] task:syz.5.1390 state:D stack:28904 pid:11715 tgid:11713 ppid:9848 task_flags:0x400040 flags:0x00004004 [ 872.442759][ T32] Call Trace: [ 872.461339][ T32] [ 872.478294][ T32] __schedule+0x16f5/0x4d00 [ 872.511099][ T32] ? schedule+0x165/0x360 [ 872.521275][ T32] ? __pfx___schedule+0x10/0x10 [ 872.543170][ T32] ? schedule+0x91/0x360 [ 872.570076][ T32] schedule+0x165/0x360 [ 872.586329][ T32] schedule_preempt_disabled+0x13/0x30 [ 872.601492][ T32] __mutex_lock+0x724/0xe80 [ 872.606756][ T32] ? __mutex_lock+0x51b/0xe80 [ 872.611502][ T32] ? blk_trace_ioctl+0x1b9/0x430 [ 872.621511][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 872.630413][ T32] ? kasan_save_track+0x4f/0x80 [ 872.640914][ T32] ? kasan_save_track+0x3e/0x80 [ 872.647296][ T32] ? kasan_save_free_info+0x46/0x50 [ 872.652657][ T32] ? __kasan_slab_free+0x62/0x70 [ 872.666371][ T32] ? kfree+0x18e/0x440 [ 872.671961][ T32] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 872.691118][ T32] ? security_file_ioctl+0xcb/0x2d0 [ 872.697728][ T32] blk_trace_ioctl+0x1b9/0x430 [ 872.702658][ T32] ? __pfx_blk_trace_ioctl+0x10/0x10 [ 872.714804][ T32] ? do_vfs_ioctl+0xf37/0x1990 [ 872.719754][ T32] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 872.729990][ T32] ? kasan_quarantine_put+0xdd/0x220 [ 872.738836][ T32] blkdev_common_ioctl+0xdce/0x2450 [ 872.750106][ T32] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 872.757558][ T32] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 872.763448][ T32] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 872.770447][ T32] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 872.789243][ T32] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 872.800148][ T32] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 872.810456][ T32] ? __lock_acquire+0xab9/0xd20 [ 872.828287][ T32] blkdev_ioctl+0x4ef/0x6d0 [ 872.833036][ T32] ? __pfx_blkdev_ioctl+0x10/0x10 [ 872.843333][ T32] ? __fget_files+0x2a/0x420 [ 872.852913][ T32] ? bpf_lsm_file_ioctl+0x9/0x20 [ 872.863462][ T32] ? __pfx_blkdev_ioctl+0x10/0x10 [ 872.871456][ T32] __se_sys_ioctl+0xf9/0x170 [ 872.880691][ T32] do_syscall_64+0xfa/0x3b0 [ 872.889759][ T32] ? lockdep_hardirqs_on+0x9c/0x150 [ 872.901515][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 872.913325][ T32] ? clear_bhb_loop+0x60/0xb0 [ 872.922659][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 872.931827][ T32] RIP: 0033:0x7f082f18e929 [ 872.941123][ T32] RSP: 002b:00007f082ff7b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 872.953427][ T32] RAX: ffffffffffffffda RBX: 00007f082f3b6080 RCX: 00007f082f18e929 [ 872.966891][ T32] RDX: 0000000000000000 RSI: 0000000000001276 RDI: 0000000000000004 [ 872.980242][ T32] RBP: 00007f082f210b39 R08: 0000000000000000 R09: 0000000000000000 [ 872.991912][ T32] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 873.005131][ T32] R13: 0000000000000001 R14: 00007f082f3b6080 R15: 00007f082f4dfa28 [ 873.013339][ T32] [ 873.025010][ T32] INFO: task syz.5.1390:11716 blocked for more than 145 seconds. [ 873.049620][ T32] Not tainted 6.16.0-rc3-syzkaller-00190-g67a993863163 #0 [ 873.058749][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 873.076461][ T32] task:syz.5.1390 state:D stack:28904 pid:11716 tgid:11713 ppid:9848 task_flags:0x400040 flags:0x00004004 [ 873.096412][ T32] Call Trace: [ 873.099909][ T32] [ 873.103028][ T32] __schedule+0x16f5/0x4d00 [ 873.112798][ T32] ? is_bpf_text_address+0x26/0x2b0 [ 873.121891][ T32] ? __lock_acquire+0xa90/0xd20 [ 873.143407][ T32] ? schedule+0x165/0x360 [ 873.149051][ T32] ? __pfx___schedule+0x10/0x10 [ 873.160560][ T32] ? schedule+0x91/0x360 [ 873.207461][ T32] schedule+0x165/0x360 [ 873.240873][ T32] schedule_preempt_disabled+0x13/0x30 [ 873.281240][ T32] __mutex_lock+0x724/0xe80 [ 873.298441][ T32] ? __mutex_lock+0x51b/0xe80 [ 873.308494][ T32] ? blk_trace_setup+0xfb/0x1f0 [ 873.313871][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 873.319352][ T32] blk_trace_setup+0xfb/0x1f0 [ 873.331964][ T32] ? __pfx_blk_trace_setup+0x10/0x10 [ 873.338565][ T32] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 873.354780][ T32] blk_trace_ioctl+0x181/0x430 [ 873.359836][ T32] ? __pfx_blk_trace_ioctl+0x10/0x10 [ 873.372837][ T32] ? __lock_acquire+0xab9/0xd20 [ 873.379955][ T32] blkdev_ioctl+0x416/0x6d0 [ 873.397156][ T32] ? __pfx_blkdev_ioctl+0x10/0x10 [ 873.437078][ T32] ? __fget_files+0x2a/0x420 [ 873.468652][ T32] ? bpf_lsm_file_ioctl+0x9/0x20 [ 873.477087][ T32] ? __pfx_blkdev_ioctl+0x10/0x10 [ 873.482366][ T32] __se_sys_ioctl+0xf9/0x170 [ 873.487634][ T32] do_syscall_64+0xfa/0x3b0 [ 873.493362][ T32] ? lockdep_hardirqs_on+0x9c/0x150 [ 873.507533][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 873.514165][ T32] ? clear_bhb_loop+0x60/0xb0 [ 873.518916][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 873.525383][ T32] RIP: 0033:0x7f082f18e929 [ 873.531007][ T32] RSP: 002b:00007f082ff5a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 873.541605][ T32] RAX: ffffffffffffffda RBX: 00007f082f3b6160 RCX: 00007f082f18e929 [ 873.552201][ T32] RDX: 0000200000000b40 RSI: 00000000c0481273 RDI: 0000000000000004 [ 873.566909][ T32] RBP: 00007f082f210b39 R08: 0000000000000000 R09: 0000000000000000 [ 873.590485][ T32] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 873.606876][ T32] R13: 0000000000000001 R14: 00007f082f3b6160 R15: 00007f082f4dfa28 [ 873.621212][ T32] [ 873.627257][ T32] [ 873.627257][ T32] Showing all locks held in the system: [ 873.642646][ T32] 1 lock held by khungtaskd/32: [ 873.651517][ T32] #0: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 873.672681][ T32] 3 locks held by kworker/u8:7/3667: [ 873.682988][ T32] #0: ffff8880302f0948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 873.712362][ T32] #1: ffffc9000c647bc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 873.743526][ T32] #2: ffffffff8f50fcc8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 873.753240][ T32] 2 locks held by getty/5590: [ 873.765801][ T32] #0: ffff8880312de0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 873.786042][ T32] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 873.801648][ T32] 3 locks held by kworker/u8:18/10803: [ 873.820605][ T32] #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 873.834845][ T32] #1: ffffc9001cf6fbc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 873.859976][ T32] #2: ffffffff8f50fcc8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 873.876923][ T32] 2 locks held by syz.1.1366/11638: [ 873.882214][ T32] 1 lock held by syz.5.1390/11714: [ 873.891317][ T32] #0: ffff888024ff3040 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 [ 873.908936][ T32] 1 lock held by syz.5.1390/11715: [ 873.919802][ T32] #0: ffff888024ff3040 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 [ 873.941659][ T32] 1 lock held by syz.5.1390/11716: [ 873.957544][ T32] #0: ffff888024ff3040 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 [ 873.975446][ T32] 1 lock held by syz.4.1431/11903: [ 873.980642][ T32] #0: ffff888024ff3040 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 [ 873.998236][ T32] 1 lock held by syz.4.1431/11904: [ 874.004496][ T32] #0: ffff888024ff3040 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 [ 874.015013][ T32] 1 lock held by syz.4.1431/11906: [ 874.020178][ T32] #0: ffff888024ff3040 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 [ 874.038537][ T32] 2 locks held by syz.7.1797/13213: [ 874.046579][ T32] #0: ffff888053eab208 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 874.061089][ T32] #1: ffffffff8f50fcc8 (rtnl_mutex){+.+.}-{4:4}, at: raw_release+0x1bb/0x960 [ 874.072925][ T32] 2 locks held by syz.7.1797/13219: [ 874.082352][ T32] #0: ffffffff8f50fcc8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 874.099996][ T32] #1: ffffffff8e144978 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 [ 874.121361][ T32] 1 lock held by syz.7.1797/13220: [ 874.127753][ T32] #0: ffffffff8f50fcc8 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x71c/0xb70 [ 874.152496][ T32] [ 874.156256][ T32] ============================================= [ 874.156256][ T32] [ 874.165542][ T32] NMI backtrace for cpu 1 [ 874.165562][ T32] CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted 6.16.0-rc3-syzkaller-00190-g67a993863163 #0 PREEMPT(full) [ 874.165586][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 874.165608][ T32] Call Trace: [ 874.165616][ T32] [ 874.165626][ T32] dump_stack_lvl+0x189/0x250 [ 874.165662][ T32] ? __wake_up_klogd+0xd9/0x110 [ 874.165690][ T32] ? __pfx_dump_stack_lvl+0x10/0x10 [ 874.165723][ T32] ? __pfx__printk+0x10/0x10 [ 874.165760][ T32] nmi_cpu_backtrace+0x39e/0x3d0 [ 874.165790][ T32] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 874.165813][ T32] ? _printk+0xcf/0x120 [ 874.165840][ T32] ? __pfx__printk+0x10/0x10 [ 874.165866][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 874.165897][ T32] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 874.165926][ T32] watchdog+0xfee/0x1030 [ 874.165956][ T32] ? watchdog+0x1de/0x1030 [ 874.165994][ T32] kthread+0x70e/0x8a0 [ 874.166022][ T32] ? __pfx_watchdog+0x10/0x10 [ 874.166051][ T32] ? __pfx_kthread+0x10/0x10 [ 874.166077][ T32] ? _raw_spin_unlock_irq+0x23/0x50 [ 874.166106][ T32] ? lockdep_hardirqs_on+0x9c/0x150 [ 874.166134][ T32] ? __pfx_kthread+0x10/0x10 [ 874.166160][ T32] ret_from_fork+0x3fc/0x770 [ 874.166193][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 874.166230][ T32] ? __switch_to_asm+0x39/0x70 [ 874.166251][ T32] ? __switch_to_asm+0x33/0x70 [ 874.166272][ T32] ? __pfx_kthread+0x10/0x10 [ 874.166298][ T32] ret_from_fork_asm+0x1a/0x30 [ 874.166337][ T32] [ 874.166346][ T32] Sending NMI from CPU 1 to CPUs 0: [ 874.326023][ C0] NMI backtrace for cpu 0 [ 874.326044][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc3-syzkaller-00190-g67a993863163 #0 PREEMPT(full) [ 874.326067][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 874.326079][ C0] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 874.326110][ C0] Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d e3 35 21 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 874.326127][ C0] RSP: 0018:ffffffff8de07d80 EFLAGS: 000002c6 [ 874.326144][ C0] RAX: 327e45f874b31800 RBX: ffffffff81974d58 RCX: 327e45f874b31800 [ 874.326159][ C0] RDX: 0000000000000001 RSI: ffffffff8d982179 RDI: ffffffff8be28f00 [ 874.326172][ C0] RBP: ffffffff8de07ea8 R08: ffff8880b8632f5b R09: 1ffff110170c65eb [ 874.326186][ C0] R10: dffffc0000000000 R11: ffffed10170c65ec R12: ffffffff8fa109f0 [ 874.326199][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffffffff1bd2a50 [ 874.326212][ C0] FS: 0000000000000000(0000) GS:ffff888125c50000(0000) knlGS:0000000000000000 [ 874.326227][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 874.326239][ C0] CR2: 00005555923dc5c8 CR3: 00000000243d0000 CR4: 00000000003526f0 [ 874.326256][ C0] DR0: 0000000000000000 DR1: 0000000000000008 DR2: 0000000000000000 [ 874.326267][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 874.326278][ C0] Call Trace: [ 874.326285][ C0] [ 874.326293][ C0] default_idle+0x13/0x20 [ 874.326311][ C0] default_idle_call+0x74/0xb0 [ 874.326329][ C0] do_idle+0x1e8/0x510 [ 874.326351][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 874.326375][ C0] ? __pfx_do_idle+0x10/0x10 [ 874.326396][ C0] ? do_idle+0x4ef/0x510 [ 874.326413][ C0] cpu_startup_entry+0x44/0x60 [ 874.326429][ C0] rest_init+0x2de/0x300 [ 874.326447][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 874.326473][ C0] start_kernel+0x47d/0x500 [ 874.326492][ C0] x86_64_start_reservations+0x24/0x30 [ 874.326515][ C0] x86_64_start_kernel+0x143/0x1c0 [ 874.326538][ C0] common_startup_64+0x13e/0x147 [ 874.326568][ C0] [ 874.481553][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 874.481652][ T32] CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted 6.16.0-rc3-syzkaller-00190-g67a993863163 #0 PREEMPT(full) [ 874.481686][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 874.481704][ T32] Call Trace: [ 874.481719][ T32] [ 874.481731][ T32] dump_stack_lvl+0x99/0x250 [ 874.481778][ T32] ? __asan_memcpy+0x40/0x70 [ 874.481815][ T32] ? __pfx_dump_stack_lvl+0x10/0x10 [ 874.481856][ T32] ? __pfx__printk+0x10/0x10 [ 874.481909][ T32] panic+0x2db/0x790 [ 874.481954][ T32] ? __pfx_panic+0x10/0x10 [ 874.481994][ T32] ? nmi_backtrace_stall_check+0x433/0x440 [ 874.482040][ T32] ? preempt_schedule_thunk+0x16/0x30 [ 874.482073][ T32] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 874.482116][ T32] watchdog+0x102d/0x1030 [ 874.482154][ T32] ? watchdog+0x1de/0x1030 [ 874.482198][ T32] kthread+0x70e/0x8a0 [ 874.482231][ T32] ? __pfx_watchdog+0x10/0x10 [ 874.482265][ T32] ? __pfx_kthread+0x10/0x10 [ 874.482296][ T32] ? _raw_spin_unlock_irq+0x23/0x50 [ 874.482331][ T32] ? lockdep_hardirqs_on+0x9c/0x150 [ 874.482378][ T32] ? __pfx_kthread+0x10/0x10 [ 874.482409][ T32] ret_from_fork+0x3fc/0x770 [ 874.482450][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 874.482495][ T32] ? __switch_to_asm+0x39/0x70 [ 874.482520][ T32] ? __switch_to_asm+0x33/0x70 [ 874.482545][ T32] ? __pfx_kthread+0x10/0x10 [ 874.482582][ T32] ret_from_fork_asm+0x1a/0x30 [ 874.482635][ T32] [ 874.692192][ T32] Kernel Offset: disabled [ 874.696534][ T32] Rebooting in 86400 seconds..