last executing test programs: 50.846365803s ago: executing program 1 (id=2486): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="cc00000002020102000000000000000001000003080009000000000404000380"], 0xcc}, 0x1, 0x0, 0x0, 0x81}, 0x800) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) ioctl$EVIOCSFF(r3, 0x40304580, &(0x7f0000000b40)={0x52, 0x1, 0x1, {0x2, 0x1}, {0x60, 0x2}, @period={0x58, 0x96, 0x6, 0x1, 0x8001, {0x5, 0x10, 0x0, 0x5}, 0x0, 0x0}}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000200)=0x1000000001, 0x12) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x20004010}, 0x0) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000000000000004d564b000000000900000000002100"]) r10 = io_uring_setup(0x3eae, &(0x7f0000000080)={0x0, 0xc95e}) socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r10, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x1ef6e3}], 0x100000000000011a) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f00009058803"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000640)=ANY=[@ANYRES32, @ANYRESOCT=r8, @ANYBLOB="0e00"/12, @ANYBLOB="b3", @ANYBLOB="b67be5f92a6860e9cd361dd53cfa7884d2da39e0db98bf0bb4187fe0341ca4dc63df3666f71a186c7ab27688e8d95aa4c768df93ab08ae0bead8f79f0e37af3d65a1698a25f26011815676f7b8f0633abe9d3a5501372c86a9a3d76327fff6e3ee67d06b6871ce4d63f4d0f9d36b0d1f07b12a5765000242d1b5dad7e4a869d3ed2491397a1a8509caadd7aa29748d36ac", @ANYRESDEC=r2], 0x20) 46.661643397s ago: executing program 1 (id=2498): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r3 = landlock_create_ruleset(&(0x7f0000000080)={0x8601, 0x2}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = syz_io_uring_setup(0x1237, &(0x7f0000000380)={0x0, 0x80fd, 0x80, 0x3, 0x2b9}, &(0x7f0000000040)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r4, 0x80, &(0x7f0000000080)=@l2tp={0x2, 0x0, @local, 0x3}}) ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(r1, 0x4008941a, &(0x7f0000000240)) io_uring_enter(r5, 0x47bc, 0x0, 0xfe00, 0x0, 0x0) r8 = syz_io_uring_setup(0x37, &(0x7f0000000080)={0x0, 0x36c4, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r9, r10, &(0x7f0000000600)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r12, 0x0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f00000003c0)=""/218, 0xda}], 0x1}, 0x0, 0x80002101}) io_uring_enter(r8, 0xd81, 0x0, 0x0, 0x0, 0x0) write(r11, &(0x7f0000000780)='5d', 0x2) 44.484107967s ago: executing program 1 (id=2504): r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003d80)=[{{&(0x7f0000000340)=@xdp, 0x80, &(0x7f0000000600)=[{&(0x7f0000000140)=""/39, 0x27}, {&(0x7f0000000a00)=""/4096, 0x1000}, {&(0x7f0000001f40)=""/121, 0x79}, {&(0x7f0000000440)=""/46, 0x2e}, {&(0x7f0000000480)=""/206, 0xce}], 0x5, &(0x7f0000000580)=""/56, 0x38}, 0x40}, {{&(0x7f0000000680)=@phonet, 0x80, &(0x7f0000001e00)=[{&(0x7f0000000800)=""/78, 0x4e}, {&(0x7f0000000780)=""/69, 0x45}, {&(0x7f0000002200)=""/163, 0xa3}, {&(0x7f00000008c0)=""/212, 0xd4}, {&(0x7f0000001a00)=""/193, 0xc1}, {&(0x7f0000001b00)=""/186, 0xba}, {&(0x7f0000001bc0)=""/167, 0xa7}, {&(0x7f0000001c80)=""/138, 0x8a}, {&(0x7f0000001d40)=""/78, 0x4e}, {&(0x7f0000001dc0)=""/3, 0x3}], 0xa}, 0x9}, {{0x0, 0x0, &(0x7f0000002fc0), 0x0, &(0x7f0000003000)=""/247, 0xf7}, 0x9}, {{0x0, 0x0, &(0x7f00000034c0)=[{&(0x7f0000003100)=""/183, 0xb7}, {&(0x7f00000020c0)=""/132, 0x84}, {&(0x7f00000003c0)=""/45, 0x2d}, {&(0x7f0000003280)=""/56, 0x38}, {&(0x7f00000022c0)=""/219, 0xdb}, {&(0x7f0000003ec0)=""/137, 0x89}, {&(0x7f0000001ec0)=""/113, 0x71}], 0x7, &(0x7f0000003540)=""/217, 0xd9}, 0x10ef266b}, {{&(0x7f0000003640)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000003c80)=[{&(0x7f00000036c0)}, {&(0x7f0000003700)=""/188, 0xbc}, {&(0x7f00000037c0)=""/172, 0xac}, {&(0x7f0000003880)=""/43, 0x2b}, {&(0x7f00000038c0)=""/36, 0x24}, {&(0x7f0000001fc0)=""/195, 0xc3}, {&(0x7f00000039c0)=""/151, 0x97}, {&(0x7f00000002c0)=""/35, 0x23}, {&(0x7f0000003ac0)=""/207, 0xcf}, {&(0x7f0000003bc0)=""/186, 0xba}], 0xa, &(0x7f0000003d40)=""/13, 0xd}, 0x1}], 0x5, 0x40000022, 0x0) r3 = socket(0x22, 0x2, 0x24) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x8000, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r4, 0xc0405602, &(0x7f0000000280)={0x1, 0x2, 0x0, "8baadc000000000000001c00ec0000000000000200", 0x43353039}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0x5, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'bond_slave_0\x00'}) write$tun(r5, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd01"], 0xfdef) syz_io_uring_setup(0x3f97, &(0x7f0000002180)={0x0, 0x3715, 0x13580, 0x3, 0xffffffff}, 0x0, 0x0) r7 = syz_open_procfs(0x0, &(0x7f00000005c0)='smaps_rollup\x00') setsockopt$inet_tcp_TLS_RX(r7, 0x6, 0x2, &(0x7f0000000040)=@gcm_256={{0x303}, "1d8633b56b6a7228", "d5bafd7b4202d98bd4798ae074129da0f023f52ab5752e59dccfccca9dd0e045", "f73584fb", "97051a364804d22c"}, 0x38) lseek(r0, 0x5, 0x3) sync() ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb000000010902"], 0x0) syz_open_dev$midi(0x0, 0x7, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), r3) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) close(r0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x66000080) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'ipvlan0\x00'}) 40.754212285s ago: executing program 1 (id=2513): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x20802, 0x0) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000010c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)={0x2c, 0x3e, 0x107, 0x70bd2d, 0x25dfdbfc, {0x4, 0x7c}, [@typed={0x4}, @nested={0x14, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0x8, 0x13, 0x0, 0x0, @u32=0x7fffffff}]}]}, 0x2c}}, 0x0) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000480)={{0x0, 0xefae, 0x0, 0x3}, 'syz1\x00', 0x4d}) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x2c0) ioctl$UI_DEV_CREATE(r2, 0x5501) openat$iommufd(0xffffffffffffff9c, &(0x7f00000001c0), 0x101000, 0x0) close(0x3) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = io_uring_setup(0x1530, &(0x7f0000000480)={0x0, 0xd498, 0x800, 0x8000002, 0x1d4}) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) 38.514981402s ago: executing program 1 (id=2522): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket(0x848000000015, 0x805, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sched_setscheduler(0x0, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000051b7f020510452516aaa0102030209021b0001010010000904ec0201af3af30009050502"], 0x0) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x88, 0x0, 0xee01}, {0x10000, 0x400000000000000, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffd}, {0x2, 0x8, 0xfffffffffffffffc, 0x8}, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1}, {{@in=@remote, 0x2, 0x2b}, 0x0, @in=@empty, 0x0, 0x5, 0x0, 0xb7}}, 0xe8) 37.584144892s ago: executing program 1 (id=2526): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x1b) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = dup(r2) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xa, 0x13, r3, 0xc4513000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x600000000000000, 0x0, 0x0, 0x2) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'team_slave_1\x00', 0x401}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x40400, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_encap(r5, 0x11, 0x64, &(0x7f0000000380), 0xfffffffffffffea4) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x2000081}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000000be260000029078ac14142fffffffff117ce86000"/42], 0x0) ioctl$KDGKBTYPE(r3, 0x4b33, &(0x7f0000000340)) sendmsg(r7, &(0x7f0000000640)={&(0x7f00000000c0)=@in6={0xa, 0x4e24, 0x8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000000)="4ba72c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f00007a8000/0x18000)=nil, 0x0, 0xfffffffffffffe53, 0x7e, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="5800000010000144000000000000000000000000fe7ecd3cf12516ff29d01b2e50bb59aac286293be13c4cfd9a53b3313afc3c3f4cb5658d55472f80a1427d420d9dc0151948fc3f7de97fb5a3c3275f99978a000000000000000000000000000002b46dad2b580921d0b14df3f94b3b252dedd412453201f6240ffba18b3cbcb438295dcba9f2670e80e5f91f69a2a48b463be7ad8ddfd012e655baeff6922a31a8954e1d06ef23739d06f284fa440e00d80000000000000000", @ANYRES32=0x0, @ANYRESOCT=r0, @ANYBLOB="6065bc5013bf6ac99a0270a8b7", @ANYRESOCT=r5], 0x58}}, 0x0) r10 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000044082, 0x0) fallocate(r10, 0x11, 0x0, 0x10000000000004) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f0000000140)) sendmsg$inet6(r3, &(0x7f0000000440)={&(0x7f0000000000)={0xa, 0x4e23, 0x3, @local, 0xfc}, 0x1c, &(0x7f00000000c0), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000029000000360000003a000000000000002400000000000000290000003200000000000000000000000000ffffac1e0101", @ANYRES32=0x0, @ANYBLOB="0000000038000000000000002900000004000000620300000000000005020005000100c910fe800000000000000000000000000040944a0000000000180000000000000029000000390000003c0001030000000018000000000000002900000004000000b500000000000000140000000000000029000000430000000700000000000000480000000000000029000000360000008705000000000000c2047e0512d4c910fc000000000000000000000000000000c91020010000000000000000000000000001000000000000140000000000000029000000340000000600000000000000200000000000000029000000360000007301000000000000000100010004010a"], 0x140}, 0x0) 26.998342601s ago: executing program 4 (id=2555): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x53, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet_int(r4, 0x0, 0xd, &(0x7f0000000040)=0xfffffffc, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000000c0)={{}, 0x0, 0x0}, 0x20) recvmmsg(r4, &(0x7f0000000040), 0x0, 0x45833af92e4b39df, 0x0) r5 = syz_open_procfs(0x0, 0x0) readv(r5, &(0x7f0000001440)=[{0x0}], 0x1) r6 = fsopen(&(0x7f0000000040)='binder\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x5, 0x3f, &(0x7f0000000380)=ANY=[@ANYBLOB="120100024392d5204c05c3067aeb0102030109022d0001088770070904cb99e2fc95bdcc04004f3eafb509059302000409052e09050b02ff0307090509050d10ff0305097f"], 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000300)={{0x84, @remote, 0x4e23, 0x3, 'lc\x00', 0xb, 0x80000000, 0x25}, {@rand_addr=0x64010102, 0x4e23, 0x10000, 0xc3, 0x12d5c, 0x12d5c}}, 0x44) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$EVIOCGMASK(r1, 0x5b04, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000200)={0x1c, &(0x7f0000000140)={0x20, 0xc}, 0x0, 0x0}) 26.837358999s ago: executing program 0 (id=2557): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x40ead000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000140), 0x8) io_setup(0x0, &(0x7f0000000000)) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xc3) r3 = syz_open_dev$video(&(0x7f0000000580), 0x7, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(r3, 0xc0205647, &(0x7f00000002c0)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0xf0f027, 0x0, '\x00', @p_u8=0x0}}) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'wp512-generic\x00'}, 0x58) r6 = accept$alg(r5, 0x0, 0x0) sendmmsg$alg(r6, &(0x7f0000000b80)=[{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)='v', 0xf4240}], 0x1}], 0x1, 0x8004) accept4(r6, 0x0, 0x0, 0x0) accept4(r6, &(0x7f00000009c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x0, 0x800) openat$ptmx(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$nci(r4, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@getnetconf={0x14, 0x52, 0x20, 0x70bd2c, 0x25dfdbff, {}, [""]}, 0x14}}, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x1, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000800000001000c0080000000", @ANYRES32=0x0, @ANYBLOB="000100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/15], 0x50) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(0xffffffffffffffff, 0xc06c4124, &(0x7f0000000200)) 24.258590653s ago: executing program 0 (id=2561): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x6d93, 0x4) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x28, 0x2, [@TCA_CAKE_OVERHEAD={0x8, 0x6, 0x9c}, @TCA_CAKE_OVERHEAD={0x8, 0x6, 0x21}, @TCA_CAKE_RAW={0x8}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x34b}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0xd6629edbb25523a9}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@getchain={0x24, 0x66, 0x1, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x2, 0x7}, {0x1, 0xfff1}, {0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) 24.097622489s ago: executing program 0 (id=2562): r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000), 0x6000, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f00000003c0)={0xb, 0xff, 0x1dc2, 0x800, 0xffffffffffffffff}) r3 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) r5 = syz_open_dev$vcsn(&(0x7f0000000480), 0x1000, 0x4a0901) r6 = gettid() statx(0xffffffffffffffff, &(0x7f00000004c0)='./file0\x00', 0x6000, 0x48, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) r8 = getgid() ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000007c0)={'\x00', 0x5, 0x80, 0xffff0001, 0x849d, 0x3, 0xffffffffffffffff}) fstat(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001040)={0x0}, &(0x7f0000001080)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000010c0)={{{@in6=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast1}}, &(0x7f00000011c0)=0xe8) statx(0xffffffffffffffff, &(0x7f0000001200)='./file0\x00', 0x400, 0x20, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001340)={0x3, 0x1, {0x0}, {}, 0x200, 0x5e}) newfstatat(0xffffffffffffff9c, &(0x7f0000001380)='./file0\x00', &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x100) r17 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000001440), 0x1498c0, 0x0) r18 = syz_open_dev$vbi(&(0x7f0000001480), 0x1, 0x2) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000014c0)={0x0, 0x0}) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001500)={0x10, 0xe6d, {}, {0xee01}, 0x3, 0x2}) lstat(&(0x7f0000001540)='./file0\x00', &(0x7f0000001580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001600)={{{@in=@multicast2, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}}}, &(0x7f0000001700)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001740)={0x0, 0x0, 0x0}, &(0x7f0000001780)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000017c0)={{{@in=@initdev, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast2}}, &(0x7f00000018c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r26 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000001980), 0x2000c2, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000019c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xffffffffffffffff, 0xee01}}, './file0\x00'}) r28 = openat$tun(0xffffffffffffff9c, &(0x7f0000003340), 0x2c0081, 0x0) sendmmsg$unix(r0, &(0x7f0000007b80)=[{{&(0x7f0000000040)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000380)=[{&(0x7f00000000c0)="3bde53696dad1a824a9487d5cfea2352b6c5e4a4680a4cc035fff9a014f7e99a52e6407638db5c61836f8f2dff25fda542d6fe9027fb1af51d9da8482a7a1ddfc9c33cbdcc25e81430fb80e3846f8250ace2ffc341548ca6fc7f0aaf7e06632a158f1daddb4e7c65dd33989a9f7de7dd69e8542e248326e6", 0x78}, {&(0x7f0000000140)="11f19deaebea5479c59f02865631f1eff747b45cc349a4633c16e77d6d0b9750f7b637dc5b683b18cb4eed93a93c3e1b7fa8a0e4c92e6c2dc9b0045d4289da15ae826dad2dfec9be4fb575d39b5449af163610ab407bb4d81b193493005b3a1da58435e1300aa7b196208d5c1f4cd0065c108ac4e558d48b556188c137d666a7a4b8d15802a3ad4bb3d80d151e75e12a44c20e96c23aa246f191c7236d7ac80c06bdb598ffdea84d0282dccda8a12bc94cd84483424a743f843c6137", 0xbc}, {&(0x7f0000000200)="00615dd58032781d68e228fbdabbe83682561dae8d8bcec800b89e93da448a4af951dca83116f854ef9f6e56b3a71787b09b6df502e141014ce1ae83f1b04cd2273e0c9884533c9d9d2df01bb1e661de7478a2b6fcf918eae32be6a171d46702488e63789fa0cbe74c38608dc74f566848f6c3eafefaf80eefc450c7918ed91d3d873f227a22151d52b4a206b4b6b940a4eaa73b2b8139cefd30b488947f343246b75d70ebc6d8a856e99a14cbe36258", 0xb0}, {&(0x7f00000002c0)="14d586f0927a459dceab7006cb831a23d199f3c7d85edca2ee16a06094142388fccbca3c4d3af4d1b4478a529c2304782c63a5154f4637da7fd1bad263aafac69fd58e8714afa5c4c0f882d1c569c1cbeffeb84110c4173b410890f6c1a76f192e16fb54f8d8759a9387b98a1a234c6c0627c86922316d65b91625d91220c83bfffbe8dbddf857", 0x87}], 0x4, &(0x7f0000000600)=[@rights={{0x2c, 0x1, 0x1, [r1, r2, r3, 0xffffffffffffffff, r4, 0xffffffffffffffff, r5]}}, @cred={{0x1c, 0x1, 0x2, {r6, r7, r8}}}], 0x50, 0x4000080}}, {{&(0x7f0000000680)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000000780)=[{&(0x7f0000000700)="2df4f0082f30a7d0df3539abcf3321e04453d8217a4c90d5568ccd6525a0fc79dff69e665f417231b9a9a0abb183b0b1fd9bb55ee55b02c8616bb014c335892790ede518dd7ed4ffda9028df7b337663b9146f5d000a1599dac90707b4e7f48ecd25213d5cfce53cb7e4931c56c003c7f9050660444d804b638dbd0d46432c13", 0x80}], 0x1, &(0x7f0000000940)=[@cred={{0x1c, 0x1, 0x2, {r9, r10, r11}}}], 0x20, 0x8000}}, {{&(0x7f0000000980)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000fc0)=[{&(0x7f0000000a00)="694bb1cdad90c5bf5005eca98a4e3529b0e5b2a9431595b7eae12060ead1bcb66498912b5079fd2484cd19b910cb00ea4587b0d604743651e3857b309043052dc171b07e489ddf92e610d6f2444ce6849c2eeaa90814b69dd9740ac2ee5c", 0x5e}, {&(0x7f0000000a80)="07e4947d66ca3b0399bfb9d712bfa8deb0b2e7ee430743f9f398e0de7d536386ee3fcea43c2cf9347e7d3129f008cddbea8d1e42f6f085858fcd90578b12e091afbd08b7e948bc51142953cc4b7449b586bf2b73005951ec530d9175c27018d79f98c913d4fc29395c73458edb", 0x6d}, {&(0x7f0000000b00)="d98e5cb476337a9d55410f15ceb350a477b06cbf48a3b93358ef3ce2b4e1494894a86a3048f447df2dad85b073cf57dcc9c74501312f5b37395689a7393c8be87f077de079bc3481c2bdc9afb14e19341a3229e10b037de06033b6e77cf7d28d172c2e5e8a57c395a8f7a726cafe3555806c1da71df50dcb96d5b9a8f4b443efc9ce79b27815c641085b02ac4ce7ade491cff98a0944571850b8a1532487d7d068a3d4fe21b7660f054b19cefb7e9e02cb1a12535cc33438eafcc710864e3299bf990f02c51c704c0da0f87db9c55e", 0xcf}, {&(0x7f0000000c00)="b3be3e6fcf7c23f52cd2cabdcc89325b6f8b689a455807720fafcf14d6b4659a8360fc27ea3ed26ceb0f4ac14aa8007e14fd8937b53da9ba744fa375251ed6e04343a904019fbf939d0bfa0a6b353894", 0x50}, {&(0x7f0000000c80)="0f9cbf3ab93489620045d706a2efad5d5b3634a8676ffae16f91f74f33e12a42c57aa7b635da45a74193a2be7772cce6f635756b73813e382b8a9bddb16ebbcbba51457d4f27026b0736d247f6a66c03999d8b4f5a83ae3224fd510cf4b2173f85cd4b8e40e8e11f521d8fa1967b09773765cb2db2e551e1759793963a120e1fc12f3939b0a3720fdbeb6f6294f44dfc463b3429bf5be4cee5c426b2a21f868aaea6bab41a8d0b16b40fa3493ee2ade157028123ffe544633d628c445259c775db4944", 0xc3}, {&(0x7f0000000d80)="88de072bd36dc6d9d556a39ede17c049216e77f286664d89c6673f21ded7b24b6863ad4839e8cf225029836c34bbdbe36457715010acf52239342e89906d4fea291edb9c1bf3414bef758060b0e88d857ffeabb5cb963116ef07ae4789423add316bf94731901846b5276bffd71afcc3b690fb106d311b2be8ff60948ab67b8950f289d0014b4a71b65e85edaa35b932dbe4b450cb7ab127ee614a78ca38d40bf77d8a00c71952f6e3469bbc06a118e8221eaa3a9d961e77f5c6abb92889f66196a0fbaab2c5c01c1e129da1906cef981f6ae268029c90f27ea5bfdbe42bd1e625e3043a", 0xe4}, {&(0x7f0000000e80)="493d7b97793d8f6dc381bf5aa4d871c3f15ac2a8990bdc26ac312c1122f35c3edc620ccdf499fc2839080fb6d8947742c5fb8cbdb3a42a308f45a00d79bea178a1e6899c780bdb9ec3d1b6954607d3f7d1e86d9ad07ad4b4589c2ab5cbf8605fb461a804abac869922b5e7ea65ce7762cdb48abad86823f73d5494d5601b651a911317f1ed1af52d4a27f3b6a247b0a416d0eddca8a8918e4b672bb619e64d745fd5ec0100541d5487835b5dbf0995527734c6fb442763694394db298c566d6a5e8449977f2032a7cfec660f8150fa", 0xcf}, {&(0x7f0000000f80)="a9c142733b7c5d8f63b14cf91408ea5decfb21249c0b359ac22b978863347be8d864e31ee093f20327a1b4aff942fdf618424a2a3eaf7f18", 0x38}], 0x8, &(0x7f0000001a00)=[@cred={{0x1c, 0x1, 0x2, {r12, r13, r14}}}, @cred={{0x1c, 0x1, 0x2, {r15, 0xee01, r16}}}, @rights={{0x18, 0x1, 0x1, [r17, r18]}}, @cred={{0x1c, 0x1, 0x2, {r19, r20, r21}}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r22, r23}}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r24, r25}}}, @rights={{0x18, 0x1, 0x1, [r26, r27]}}], 0xd0, 0x1}}, {{&(0x7f0000001b00)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000003080)=[{&(0x7f0000001b80)="e599e9ea69342a9eaa533710675bd97bf81a26eb25cefc809e4e271c33f7318b455acb7332b795a635155a4bc4e10bcec220b8b2b8b94545fd3f0ad46a95cb44ab6390124c421b43c382e8bb62da24d4e617dc111d59a37428258fd15697af231806c6bd658fc4c6ef141796cca68c8fce24f23e7e17a0ad5b3d1997715821ab17efa536ccf187f5f1b67f109d804c512bebba665ea5a45a6cf27315deebbed5a32c27a9b684e39cc3354908b1d5b1ec72821ba74b0044ceda99bfa579f7bfb13f2acf350d0d249aa2691668d1f066f38c027ef5fe1ed9088f884e45cf8f3670ed08f2ba1c4322dad99ef43364c37de3ac060fe5e6a7e0fbf704c9110277cb47eacd2d63f5d9b8ade10be334c1c4a716eb5ee8cbbe471d6f0e9821a1a38fcf9f3aba93b493e972b5ae0d9b24406ffe5fd5e4f514562dddd0cea0a51b8c8cd3e832483516dd1cec72a6be3e37699aebf76a130d6b99127bab8979279cfbd2f6184ea01099ecaa9bb4bfe24cb90e48e0e1b58329c77b774d975b3f4b3beef63f7cb73c3d9e0a04736717491d12eaaa28e6785885520b07e1120cc4acbf64f892b0d59fde5e3eda6c6b36dc9f0619547e2b79acaacc08aefd95e7a57735bdd880dea25c6c5ee7ddf567555ff326d80b18800d4e030a1aba4e3603e31aba0c7a8ac3628b356d80723d571dcf7a380350160e1013631adeaf7005acae89cea02ad296bbbf76e69d5e130f5c1734285293844e4734732a063f8227461134125841152d3751f95558cec29dd3f57bb5b6efe0cc5d5a13ab3fe55fdc2ffa9afbbe053c717db7a4fb3fa22b9f9cea8ada9ca939f1967df32e7943c5b36e51bdbafb7708d19153fe779fc3b126ffc18a8ef8d44eee33748c3667e82a3a02e7fe80b140d4253c81f65c7e101d83acb58b0f1dfac4029c70eef5574f4a71a6221e88a8b5efd349096bd294264aa594f57f0e9a89cc78c8b1b1fcb7e24f9590c6adf69ec87796323f6a0f5ccc74eda9ff3b44dc4a674f02949aea76878b50a46ef6657ef9b63070b285d0fca2af3fed83f4b73b59cbb5af1df1941325cda94990e55824c125b93a37bc1a9fc14c333bf6b73aa452174519d766c2e7e22ceea91cbcae1f1145c378166980372ada24915d790603bf34a12fb647f87431d75126213b4a45ec5fcdd550142fef61bf397b232dffbe3ce8e9788d9d8aa2209d22a465fb8c5267f023bec3e0e90831f0a7be52857e7ea28df430791fbcbebd32bfbe20622d1ec77488a8c6291f1fda9ed9479e0b3ef0afa0aa0a31954c8a5ce1ec2352d0179cf0e3f64ad287cc1244c1f030e559872394ac59e7567404e510d1d41ebb917be190a11b18d94b9da652960e77dd80bc3e7eaa2d1a5b07e586aa64cf2cf53b2a3a1bc61e8b3f32a4efeaefa29ac281e00fa7df2f88f50491d8ddb4bc03994358b0ce09a0558d7b306f80900486e997feada3ed9f66e404c5c89c5734d9b32c74122530b9a186364d9fdc49824e9d4295ba389252127c21843b8561de08ab1885808d83972c6424c76bb289f421a15a3f9a5bfb70e0386af3df60666ce704f2ce2991d3a4a8ef733be9b630fa3ad98e4d20d7b5385832eee7288a5836b8f264dec093cfc54629cf778b805b06b539d6181cfe94d2e3bc7268047eb7cdd3e199ca442c211d62ae2dd5efb5fc7ed6ad2d6cc0d5e279743e01000fd7f73042ed9f54fe2c653eade5ce13c79636d195a84a894f307fd58fa50fb386d08c99f6755d31fc13a4e6af10b886f6a42d1084b8055824ff1d638f7a3589f43a5b95c4b94a2a96fe7a2938f4c799b7228349b182a8dde17c46d25206893213be1521cb34df36c624391fdfd0f360923c89003314f708be7974334d3b70acd52a2deef14402c18f71680204984c1d26ebc44f61fc6353de4b4232b51ef937ec395cd38506f97f01c01535a89d5209b52b94a2629e3e962040d6ec7b0eb15a1d15a5d916f788ae5f659b2e4fc1b3251203afe99431f9689df435ff7c8d2244a862d28227f0831b057ccb6922f7eb61c9c4b732f101e058062c1599aaff39cff68dd8a1e4d23a7fd4b1f9a03d54270931ff7eb682c76c1ef78c2096b8cda28cd1fa56f4f1f8d56851c4b9289cb9c42e8e25aad43802b44ee19dbdae18455d42e2d791516255cfa14908f56835164647ceb62a8c7b1d416ebe43586280acf8aca989f7a10542fd8a6e83975fab9ea32f85aacd8cfe4bf01eb47152547be6b57a0bf60bb6f66e3e32248598007380e06096c4cdc8b0722512686fa0f1f8092924fbdba7c8e8a4551321e8ec97bf304e68b77d3de2bc1d05a622ee607b1aac631aa60c606d558e1351bc51f97772b15c50376697f377598c42e6f1b7adaa7046eeab73e1b795acb779f5208c6164a0558ef63256f423822f1e7600edaca28cebcac230309f37e4cf0ae9d9d0be881e3a22852687137a72205a5789e951d32b3b5094893637a9e7a62cb2c75266c088442d0d2c000b2ec710f266e6969ce40e21c9ad45f27db6d1ccf87a02ba205d451b4cf8df5667fe90c290772b826aa73716551fc5e66c7a1b713f9a248106484ec0c043e05a8d4a4fcc4dbaee582704bb5129001243c3015c7ded3259570164336cab1f3807906efbc6633142e8277aa809d49af25a9181fb9dbc11e398d8e5bfa2e1477e24594a9182368f68ba3e9e49636126cc9e09179c53cccb5c0e3f4b0e0df557300c93814c96d2ca308547b3e35e327b655488387a1b1bb34ff4bc46f78e6dda70c242b4f80096c53852417f5dd841c75305dcfb1d0230df8b36954af596a0f656d2923e757bf04abfc64ccd3a7958382a009e0a02207fc0f2b7381386514d534373ca69a24f4321e7c6cef4e2cced90e0ae28fcb1e2166f3250b894cf70eb8d6578e47f962ad325909c6520961411dad0803a3a3910964271ccbfbece4047549e7c6834e63969ccbaba39d3eada91ba99d44c8520b81e127316f4e0c9e9df4eaae67cc5b6aa5e8af0077046c2764f83b0896ae53e9d106c27aa1e3ec0f0d78bc57ed6aec2695bff6a461885dd6c4c6b3f20299c481bf0ba27c766dd4179e90bf4589c5407bb083d1eb08a25008819ec62e70202c07fbb576230f8c79344f5f7482d05fb5d8c848b5440ecc56f1c89488138abe7090b227eb1d01272cec58fbf0536c1f900c3251f3f065042ae0f3cac56c3272051c73742443739fe2a8bb1becf1d77f89745077177a062a95975fdc135fb0876201c4564ad492a6f4970c31fe7d4d2ab2cd059165cdff3457f9a321cbe04b0c94ea113adf64e25835bb99a3761e3faad5a94671f2bc2a0ebfa1fd5d18bd6264fda13ec301e217ac11818e8bdbba4021495131f04a810fa030292972541289c4e92af2460451064b5610f6e2ed91888faa7cf143cee9151555416109d7132f8f12002038081718e67459eb02cc6cc6a796896d5de134fcc212e6b7afb4fb85af9d1f5ed61941f15be92aca851f3f355fec924b0fd408aaba1d168dfe752daae0098199e67232d25ac685064076dda833c693f9b8a39f06f5cd62fec5c5d0e4d5e4ccc8f822e7e525e50a4666db9ea4574b7239168c78cea1d5c5c0616135856f213b2f9566534e65a37c64f6e8478af0177b6e17eb7efc888478b381624c3cfefae5dafe44cf22ae8dc209189ee504225443fecd373421b5ffdb3f1c53700eefdceda5459d764d6263d48731945553fc89f1e35d4f6ed155d8e05a8c86ce4a1b4f6ab82525561a4ca73ee20fc9e26a7337865d4b5fdaa30fbca73e93eae1452c20a3e118608ad5020969c6aaf1ada67df2b89cfbe3abb447841d659490112518b3187a849f5072f960b0eba25e2cb7d11a3307fdd690566d734e12f58db5dd9949bd990d8a85fc86b92a9f3a5662889706af41908ad3cb20319b4bba4289776cc5759fac352a0cdb0d5bf3be1b5fa63551a5409ad33b8a353e76990c954bced06f3737bf498bf537e6251544f431854b37e973e4d9752f95576c10fd0a62f5fb80c9935924eca61974ed74a3d4de6bcd0b3d37ceeeb9d34d8f718cce84d167194ec7c81300aad4146eaae71c1e3aff88543d64bccf9390e2f9b3b0aa8144ecc5fe4e482e31d215c5fcd5224909d3f8fcd8450c2de3148a62465a60ade014eeff6d58c12ca04222e8bb465aa4b22a8c1ad56715d3d48a8994b3f6b6ef685402a41f318baeee0b57d5d912a9414ee0426e79e518b5059ef0b3229a333fb4d7f1910c0c891c4eecebbc8e6a20f097064588164b0157e69fab51d81a24665d75f19a9736e749b7a3ba3f7a1c9e182709210df622d380d121fc2fc1c50bb8b9910f3354a07b59ecd487636ff8fbb84bdaabab62aa470bc7f446125e74139a629f119edcd1dff617abcfe61a6dbc97cab2a6cc8f8a8236e83bd2637c73a34a74b9a45089c4256aa6c3dfc857c5e8686d3928b29b87ee449bdf5ca9da3f1c4851939a10c383c2cb100e09446f6eba98e20c44f4316c66239d2e6a9a4ea066849536c2e3d2a33350fd05c308244f62ff92f43743435c15f860d1f812b3ea52ae24b11a69087aacb35a21fcfd794b384b34cc508c95f28ecb0dbf6120b623af200f98fb81d9320a3e1b2feba7f20499fd221f4b39275947d8e6f1ec9853bcfe1bd1dc22662bf75361e2cba1a4bb9ec52603f3e3f4533422daf56bfb4e5cdfb13e294c21e42660a772d1541b5cd0ad6759e5716219665c9e51fa33420ab172ee897e2963f5690ba7c181c47aff3cedae69fceb26283e1e726ad9e2dc01816627ff11422f6c422f26b760e516efcf7031be9a1afef5f5da6f089631090e4ef0d28da42c0997f9c34727d0811742ceff740079d6dec20a4768ac304fa360b0706bc4fbe807d5cdd4b58b103337df77c3443b62f0f3de111a72220ad0534289b11df7c10a1d861b0b7f16a334e666cdab0660d924496e966d276c56fb04e6b129e5b99021824edaee20c09d23855e05d87ca8f3f885d3d6d55fed52a59231f252a28a02011eb881e875f81b09daa7eebe61b0466df6f7dd41cb27fc7c5055ab728e2d8a16980325dee300d65d31c4610611001e6bba9bc93f25bd11d2073de713ed2c21e7126e15ef68ed3ed5efc074d263858fc3a17a307a539e612d1653196153fbdffe85cd5f25682a0e9422462e1f7e4f084240258f25b007d95d04d8b4cb28eb5f994e439661344bed2d9469074aa91e584fd76c3230cf0f2c169365b6e299e6af9b65aba3da3d80580035bdce6d08367792a49760401badc6f2a6b4432b0dc8f507518d92467528e5ea98ab1872297b20f9bca90df9400af5ffeec095d9e3580463351ce26938476a503f64556bb2d7c5e525c3bb3101cdef07cdd3fe6c6d01dfc6ec68871a365cf315adb6716552458e4954521497d0e6da132c9e82315c866150c70f7279f52549e979c9a0d3cdc2f9da933e05b499f0c0377df7e80026209919fd93ddd37d40ed0d79f93281011f4b7d1039c76dc85fef2b7e438d72ee3561b239dd6183ec465a12d1d1f1ee8767ffc3e2e90181f06d85f9d28f25df4d979b2a2676863698915bf4b9e5861c151e6cb1a2b49034c32e8f2f2845dbe5c42737cc354067ea0250d3a715d053554c86d1c5b3a3ca164517632401b723f66c1978a70ef6b697077c92dde2662484e9a7d3e40d4768015f0b59fef8d79beb0fcda72a81a67c4521109c0d32bdc009da6d3ee3354f645b0578870db0efe4b120bebfddcae3a870cc220126e7459742a7d002d3950d72f93c312d466837779f5d134f9bcf6f5d93be742bc079e", 0x1000}, {&(0x7f0000002b80)="235aababf6d6ca9d64c105ed02af3869d5de48c297e1c26753714458583d054a92a291eedd4793db0cfe67f3f7c5be51b13105a25a2124d65d369b9c35d01ef2324a368ba071f3cbbe8c2ba788d44701c017e97c708b7e482c6bac7be338536df5c0345c5ffb5bbf3ba635322a0f9733846f57f2fc894092202047effad284f7b53eae93665cacb78738", 0x8a}, {&(0x7f0000002c40)="f31a7512c85579312c9323043ab956a2fc69235646bb8cc9e1c769ed0d9a7b697315d603931222793b89c5d3c38fe67f0224509681d7e86c3e73b544d273f62e9a059e089f8a49ed92991db5d78bccb8f5cece7a85164652b33b41e8314a7db2a60a50b9cd754613753e822221bb5f180b9910a7e1cfc34dd68ad9ea4741a910fc42cf0b698efd7a1c694e1409c5fc33586a66e63430a4fd4af2df4643ed21983f04", 0xa2}, {&(0x7f0000002d00)="1058764eeaf8ab3e59435b0d1ae2a996c74bc4a49f3243fe68658559e5e6594856a682c71045205d23c741951123305ec11c5dccd41d5430e38bfa633ab676875f0d993c322fcd0b7ed5c65220a8273c415a8f7265c59012d72c27d101684dd0614b697f9a701d2865fcbec1db91f50f068309494b9afc64d7e14800f0439c09e823f42d4b507eac5939d4cb3566", 0x8e}, {&(0x7f0000002dc0)="3e6c7d87bcadc6b514443e5e66c312452cefeade99c27f44d0fb64efce0b24fbc4868ff6ea94e818a63ef75b906604f505b2bc23b30b161071e0faf5a4cef80d49bc938a2f37c21149d8d6bb96eb1a89e92b11299be3ab1b6d851199e8a2f99de2f3bfccc1d785e5d3fa7f6b7552e310dfde8557b4ff58b1617b0d6981d695c8612fa6e2ad0a7fa4dcbad403eb17a253bd409de08775000607091ee3084105f34c7c4d657407254b25777affe702", 0xae}, {&(0x7f0000002e80)="fd1f33288f99893cc9ffaecc5808753d552c183f2d34fe769a85a4d2d92ddf9b7cb349c3fb2cae0cfc45c334b2835c01bc5d4a59fc48cfedd106c29ca9de8c770f88927805a8dfbb199c6de603d165471e50ec86f7b4df83", 0x58}, {&(0x7f0000002f00)="b9d514c2aac7ac0fa7dcf5b5b0e6c83514a571a5ac889ba266d1a01ee7c416da0196619e2cf119b3fa254d3ebaa3a81bb2d62290bee7792511c0a59279e5f5d1f937e11b878546585ef2c7a8904bfd265117c203f5289ec66e6e57a149078bafa2882c428a748ddc829863519dc8c94ee5fb692963931ac640e64ad66408855d234f4bdcdbd66e2805cfc6debce754e5abcde666a094cb77cbceb6a917034beeee72cf026d68e69b7a7ecc217e7ee1e0e51b331d1ea3efff796c7cbb227bcdd5165b6960ec8b3f25c37d86775984b4684d68a178a3401be68cc264913365e22c1d7c0829dfc9cca36ab61f101183e22af3fa6afae943e4a6e7a9e934da1f54", 0xff}, {&(0x7f0000003000)="63dfff84517fba927689a6d66a1327f5166f511d2d72a0b9b321dc81e83082e507bd0f2b220cbf8e379ddda89fa7cf119de5a8763db3af5ffc2f87ba94ebb8bbbf4585eb32caa4be1adf66451a5c8ec9e61f87050c020624a8dbecceaa64ea635ceef2e0063889edb2289daef65a", 0x6e}], 0x8, 0x0, 0x0, 0x80}}, {{&(0x7f0000003100)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000003300)=[{&(0x7f0000003180)="b6cdd257f6bcb65ffe292b1b5c95986f619d60c7e010b793a3ead0c557d091", 0x1f}, {&(0x7f00000031c0)="5a76e9232f289d3491e80fb1f52c35a773ff649f1cfee95733c82c12fca3faa4ffd21ede362fe54eacac23cb90926eed2f432263322e87a07ff0bc5eb94020a35b8dc86b9b5249eb6d226f55a62c2e41aa900245878b83c92c6b1ac3f809760c35803225fed9", 0x66}, {&(0x7f0000003240)="ede4a0342b9c90acef91ec232c7a3ced54d5b2eb0566f16dcd68bf1e22451ce3064108796c767c09075e256ee36b3c50ad9d14f43009b5b9583fb84924287bef89200764d5d8b9c2589d9d28d144d431a28b91e73415b4defbda58c2b503be095c0908768e826c0a2a0c99ecb488f8f01d65b0e2e2cd659dbfa96bad39b0d630d67aaf565544c88e78e970a1ac31f7610c36e41adfc8bf902770705cb4baf40292c84cf830782cd5b218332b", 0xac}], 0x3, &(0x7f0000007a40)=[@rights={{0x1c, 0x1, 0x1, [r28, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0x0, 0xee00}}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xee01}}}, @cred={{0x1c}}], 0x110, 0x10}}], 0x5, 0x4000) 23.906474458s ago: executing program 0 (id=2564): syz_usb_connect$cdc_ncm(0x3, 0x0, 0x0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000080)=@lang_id={0x4, 0x3, 0x3801}}]}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = syz_io_uring_setup(0xb, &(0x7f00000002c0)={0x0, 0x200002f, 0x1, 0x0, 0x100020b}, &(0x7f0000000340)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r3, 0xc000000, &(0x7f0000000000)=[{0x0}], 0x1, 0x12}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) io_uring_enter(r4, 0x847ba, 0x0, 0xe, 0x0, 0x0) r7 = syz_open_dev$video4linux(&(0x7f00000000c0), 0x1, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r7, 0xc0305602, &(0x7f0000000040)={0x1000000, 0x0, 0x0, 0x1}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010029bd7000ffdbdf2500000000", @ANYRES32=r2, @ANYBLOB="100804002010000024001280110001006272696467655f736c618c65000000000c000580050019"], 0x44}, 0x1, 0x0, 0x0, 0x404c1}, 0x40040d4) 23.524023361s ago: executing program 4 (id=2566): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x20002102) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0), 0x2200, 0x0) sendmsg$NFT_MSG_GETGEN(r0, &(0x7f0000000240)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x14, 0x10, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20004001}, 0x48004) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r1, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000000) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'bond_slave_1\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x8, 0x8, 0xd9d, 0x9, 0x1, 0xd6a8, 0x9, 0x7}}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000280)) 23.078371199s ago: executing program 2 (id=2567): syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040b306cb0c00000000000109022400010000000909040000010300020009210a00000122030009058103000000017f"], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) fsopen(&(0x7f0000000040)='9p\x00', 0x0) poll(&(0x7f0000000180)=[{0xffffffffffffffff, 0x8000}], 0x1, 0x5) openat2$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x6580, 0x1a, 0x39}, 0x18) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000380)={0x0, 0x1, 0xf, 0x2}) r2 = syz_open_dev$sndctrl(&(0x7f00000001c0), 0x8, 0x88180) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)={@in6={{0xa, 0x4e20, 0x8001, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x6}}, 0x0, 0x2, 0x45, 0x0, "00000000000000000000000000000000000000f300000000000000000000000000000000350d0000000000000000000083c0d55760b2d13d000c00cbcd00800000000000000000080000008000"}, 0xd8) syz_genetlink_get_family_id$ethtool(&(0x7f0000000480), 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, 0x0, 0x4a2000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000280)=@abs, 0x6e) syz_emit_ethernet(0x4e, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffffffaaaaaaa7aa1586dd60001a1000183afffe8000000000000000000000000000bbfb0200000000000000000000000000010000907800090501fe800000000000e1ff000000000000aa"], 0x0) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, 0x0, 0x0) ioctl$sock_inet_SIOCDELRT(0xffffffffffffffff, 0x890c, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) syz_open_dev$dri(0x0, 0x9, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_CURSOR(0xffffffffffffffff, 0xc01c64a3, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f00000000c0)=""/111) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000300)) 22.888404761s ago: executing program 0 (id=2568): openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000001000030426bdb3fe989122e65ed40000", @ANYRES32=0x0, @ANYBLOB], 0x38}}, 0x440088c4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff000000001d040000000000001c000000000000007504000001ed0a0064000028170000000c040000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29fa9ec35866a96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed90000800847683c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d680000000000"], &(0x7f00000001c0)='GPL\x00'}, 0x48) preadv(0xffffffffffffffff, 0x0, 0x0, 0x8, 0x0) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8923, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x44080) r3 = socket$kcm(0xa, 0x3, 0x3a) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r4, 0x84, 0x79, &(0x7f0000000040)={0x0, 0xfcf, 0x1}, 0x8) sendmsg$kcm(r3, &(0x7f00000031c0)={&(0x7f00000006c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000b40)="b564", 0x2}], 0x1, &(0x7f0000000580)=ANY=[@ANYBLOB="18"], 0x18}, 0x8080) sendmsg$kcm(r3, &(0x7f0000000440)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000180)='S\x00', 0x2}], 0x1, 0x0, 0x0, 0x900}, 0x0) 22.467284769s ago: executing program 32 (id=2526): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x1b) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = dup(r2) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xa, 0x13, r3, 0xc4513000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x600000000000000, 0x0, 0x0, 0x2) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'team_slave_1\x00', 0x401}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x40400, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_encap(r5, 0x11, 0x64, &(0x7f0000000380), 0xfffffffffffffea4) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x2000081}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000000be260000029078ac14142fffffffff117ce86000"/42], 0x0) ioctl$KDGKBTYPE(r3, 0x4b33, &(0x7f0000000340)) sendmsg(r7, &(0x7f0000000640)={&(0x7f00000000c0)=@in6={0xa, 0x4e24, 0x8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000000)="4ba72c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f00007a8000/0x18000)=nil, 0x0, 0xfffffffffffffe53, 0x7e, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="5800000010000144000000000000000000000000fe7ecd3cf12516ff29d01b2e50bb59aac286293be13c4cfd9a53b3313afc3c3f4cb5658d55472f80a1427d420d9dc0151948fc3f7de97fb5a3c3275f99978a000000000000000000000000000002b46dad2b580921d0b14df3f94b3b252dedd412453201f6240ffba18b3cbcb438295dcba9f2670e80e5f91f69a2a48b463be7ad8ddfd012e655baeff6922a31a8954e1d06ef23739d06f284fa440e00d80000000000000000", @ANYRES32=0x0, @ANYRESOCT=r0, @ANYBLOB="6065bc5013bf6ac99a0270a8b7", @ANYRESOCT=r5], 0x58}}, 0x0) r10 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000044082, 0x0) fallocate(r10, 0x11, 0x0, 0x10000000000004) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f0000000140)) sendmsg$inet6(r3, &(0x7f0000000440)={&(0x7f0000000000)={0xa, 0x4e23, 0x3, @local, 0xfc}, 0x1c, &(0x7f00000000c0), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000029000000360000003a000000000000002400000000000000290000003200000000000000000000000000ffffac1e0101", @ANYRES32=0x0, @ANYBLOB="0000000038000000000000002900000004000000620300000000000005020005000100c910fe800000000000000000000000000040944a0000000000180000000000000029000000390000003c0001030000000018000000000000002900000004000000b500000000000000140000000000000029000000430000000700000000000000480000000000000029000000360000008705000000000000c2047e0512d4c910fc000000000000000000000000000000c91020010000000000000000000000000001000000000000140000000000000029000000340000000600000000000000200000000000000029000000360000007301000000000000000100010004010a"], 0x140}, 0x0) 21.673968717s ago: executing program 4 (id=2571): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x20802, 0x0) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000010c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)={0x2c, 0x3e, 0x107, 0x70bd2d, 0x25dfdbfc, {0x4, 0x7c}, [@typed={0x4}, @nested={0x14, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0x8, 0x13, 0x0, 0x0, @u32=0x7fffffff}]}]}, 0x2c}}, 0x0) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000480)={{0x0, 0xefae, 0x0, 0x3}, 'syz1\x00', 0x4d}) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x2c0) ioctl$UI_DEV_CREATE(r2, 0x5501) openat$iommufd(0xffffffffffffff9c, &(0x7f00000001c0), 0x101000, 0x0) close(0x3) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = io_uring_setup(0x1530, &(0x7f0000000480)={0x0, 0xd498, 0x800, 0x8000002, 0x1d4}) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) 20.820489402s ago: executing program 3 (id=2572): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x6d93, 0x4) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x28, 0x2, [@TCA_CAKE_OVERHEAD={0x8, 0x6, 0x9c}, @TCA_CAKE_OVERHEAD={0x8, 0x6, 0x21}, @TCA_CAKE_RAW={0x8}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x34b}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0xd6629edbb25523a9}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@getchain={0x24, 0x66, 0x1, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x2, 0x7}, {0x1, 0xfff1}, {0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) 19.984136413s ago: executing program 2 (id=2573): fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) pipe2(&(0x7f00000000c0), 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x0, 0x54) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETGROUP(r2, 0x400454ce, 0x0) close(r2) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x1, 0x0) fchdir(r4) r5 = open(&(0x7f0000000040)='./file1\x00', 0x80242, 0x0) write$FUSE_CREATE_OPEN(r5, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0xff, 0x5, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) sendfile(r5, r5, &(0x7f00000002c0), 0x7f03) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000004}, 0x4040010) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x74100, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x4}) 19.820437737s ago: executing program 3 (id=2574): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$l2tp(0x2, 0x2, 0x73) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xf9}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp=r1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x20040000) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x2c, r2, 0x1, 0x70bd2d, 0x0, {0x1b}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x2c}}, 0x0) 19.470442464s ago: executing program 3 (id=2575): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000580)={0x5, 0x201, 0x4, 0x5, r3}, 0x10) socket$nl_route(0x10, 0x3, 0x0) 19.247759163s ago: executing program 4 (id=2576): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x8607}, 0x10) r1 = syz_open_dev$ndb(&(0x7f0000000540), 0x0, 0x80) ioctl$BLKBSZSET(r1, 0x40081271, 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000040)={@local, @local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, '\x00', 0x44, 0x2f, 0x0, @dev={0xfe, 0x80, '\x00', 0x11}, @ipv4={'\x00', '\xff\xff', @private}, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57}}}}}}}, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x149800, 0x0) poll(&(0x7f00000000c0)=[{r2, 0x80}, {r2, 0x2000}, {0xffffffffffffffff, 0x20c0}], 0x3, 0x101) creat(&(0x7f0000000080)='./file0\x00', 0x8) sendmsg$nl_generic(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="180000001600010a08000000090200000a00531d"], 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x0) 19.193670122s ago: executing program 3 (id=2577): r0 = syz_io_uring_setup(0x109, &(0x7f0000000140)={0x0, 0x5885, 0x0, 0x2}, &(0x7f0000000340)=0x0, &(0x7f0000000000)=0x0) socket$nl_route(0x10, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x3, 0xfffffffffffffffe, 0x0}) io_uring_enter(r0, 0x3512, 0x95ff, 0x0, 0x0, 0x0) 18.874306811s ago: executing program 3 (id=2578): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x140, 0x0) ioctl$TIOCOUTQ(r0, 0x5411, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x90400, 0x0) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f00000002c0)={0x0, 0x7, 0x4, 0x1}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f00000006c0)={0x0, 0x0, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) syz_emit_ethernet(0x4a, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r6, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4010) prlimit64(0x0, 0x6, &(0x7f0000000140), 0x0) r7 = syz_io_uring_setup(0x10f, &(0x7f0000000700)={0x0, 0xfffffffe, 0x100, 0x1}, &(0x7f0000000240)=0x0, &(0x7f0000000180)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x118, &(0x7f0000000080)=0xfffffbfc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000001c00)={0x0, 0x0, 0x0}, 0x0, 0x0, 0x1}) io_uring_enter(r7, 0x47f5, 0x6021, 0x0, 0x0, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000800030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xc4}, 0x890) sendmsg$NFT_MSG_GETOBJ(r10, &(0x7f0000000180)={0x0, 0x18, &(0x7f0000000140)={&(0x7f0000000f80)=ANY=[@ANYBLOB="1b15ac5ab1269a65b37c326f243f526cc65ff654aa5cef84e9d9fbabe603763aba0e1c1fb4049aad42742d67ba0aea04cee312ea0db2a7a220611608bdddfccd2010668f86f6ffb05d4d5ef0537bef95f4e2841f697d0977fe97fe003dbafa81dca9bb5c806e058d19309d38307c2811428712e9779e65486e6d4779b11f3580b22606ca52514b1a50b398870f95a8d48d6045ed4a6e22fdf2e78496782ee78b6dd7fe4613166c93ae"], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0xf4e7c3c478f57200) bpf$PROG_LOAD(0x5, &(0x7f0000001740)={0x8, 0x4, &(0x7f0000000ec0)=ANY=[@ANYBLOB="18000000000048d82e69e80d0000000000000000000073013a00000000009500010000000000918cdc157e95cc58de85c4def2f9270d1fb7b66db716a0dd6c055f19228850e976bcd30ebd309b6967f9ab377676c8c7dd5730b9c7f8e9310002aeccbdf6363fc5d13d0ac71fa873223d79759fc01639cb98278e55f8ea76e05484e48ca8ba02525c3fe6d7aece379bebd6e681d9582a581b2cfb62e173bd263269c985f41559d8500293b53b47c795031c06f73e90f118"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1b, 0x3, &(0x7f0000001580)=ANY=[@ANYBLOB="180017000004000000000000000800009500008d433130405de4d3a0f5ddf26a5d589f34715744921e256f4bdbae27601956e5d3c2572f60437f01cf845b438e9169ea38b05da9592f75e9d9d2f4c9289046edd713a1cf5e039394c22dafac8b3030036cdd46877d9dbfa8ff150017772e411b1cc444dec6a5244a4a7161b9b92c6b7339b9cc3ae78df4fa5c55d6cd36205cfcd609000000ea311de816d625f125efd2fcf5b3d3e0240edc46d5866144a8fdb5ae3dadd285000000aaba56f4ad7a56786dde9146b69be8f19614793d2c551c19f6f5596fdff9bc3979a3fb223999db175415daf2d2c960edb8c94ac50a5b5621e0b27bf6b6fd81ce83338ba3554a14241873fe07cde1e284a638313657900a176ba6b948b58959fc6a40769221d33c09d1e46626eb94f09ae100a28340f9766f45717d592a91788da947203984f9cd667aafcc7aedc27007f9ee6986c8e3fae7015cb6ffcfbeb944a3d02872850a1570c47e43afd1ff8ba55ba8415042b0f1abd1825d5ad664a1bfff5c806904d2746049db00da887772e8be39a37cc609"], 0x0, 0x8, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x800}, 0x94) r11 = socket$kcm(0x2, 0x200000000000001, 0x0) setsockopt$sock_attach_bpf(r11, 0x1, 0x50, &(0x7f0000000100), 0x48) ioctl$BTRFS_IOC_SCRUB(r1, 0xc400941b, &(0x7f0000000ac0)={0x0, 0x0, 0x3}) ioctl$BTRFS_IOC_BALANCE_V2(r2, 0xc4009420, &(0x7f0000001180)={0x10, 0x6, {0xa3, @struct={0x8003b, 0x8}, r3, 0x1, 0x0, 0x5, 0xf, 0x1000000000000, 0x50, @usage=0x3, 0x3, 0x0, [0x5, 0xfffffffffffffffe, 0x0, 0x5, 0xb, 0x4]}, {0x7fff, @usage=0x2e1eb9cd, r4, 0x6, 0x4, 0xb, 0x9, 0x7fffffffffffffff, 0x40, @struct={0x6, 0x8000}, 0x5, 0x7, [0x73, 0x1, 0x1, 0x5, 0x6, 0x6]}, {0x7, @usage=0x8, r12, 0x3, 0x8, 0x1, 0x7, 0x8, 0x420, @usage=0x5, 0x4279, 0xd, [0x9, 0x3, 0x0, 0x5a0adadc, 0x1000, 0xb5f]}, {0x3, 0x0, 0x8000}}) socket$nl_route(0x10, 0x3, 0x0) 18.873544366s ago: executing program 4 (id=2579): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000080)={0x8601, 0x2}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = syz_io_uring_setup(0x1237, 0x0, &(0x7f0000000040)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r2, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(0xffffffffffffffff, 0x4008941a, &(0x7f0000000240)) io_uring_enter(r3, 0x47bc, 0x0, 0x0, 0x0, 0x0) 18.69155663s ago: executing program 0 (id=2580): bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000000)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x88000, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={0x0, @empty, @empty}, &(0x7f0000000280)=0xc) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f00000002c0)=r2) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) process_vm_readv(0x0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}, {0x0}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/90, 0x5a}], 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0}, 0x10) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x8, 0x3, 0x368, 0x1d0, 0x11, 0x148, 0x0, 0x0, 0x2d0, 0x2a8, 0x2a8, 0x2d0, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x188, 0x1d0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv4=@remote, [0xffffff00, 0xff, 0xffffff00], @ipv6=@dev={0xfe, 0x80, '\x00', 0xe}, [0x0, 0xffffff00], @ipv4=@private=0xa010100, [0xffffff00, 0x0, 0xffffff00], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xff000000, 0xff000000, 0xff], 0x8, 0x6, 0x5e, 0x4e21, 0x4e23, 0x4e24, 0x4e21}, 0x40, 0x8e0}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0xffffffff, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@addrtype={{0x30}, {0x242, 0x75f65a4e97d6873f, 0x1}}, @common=@unspec=@quota={{0x38}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x3, 0x6, 0x2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3c8) r6 = socket$vsock_stream(0x28, 0x1, 0x0) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) bind$vsock_stream(r6, &(0x7f0000000440)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r6, 0x3) r7 = socket$vsock_stream(0x28, 0x1, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0x8}}) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000780)={r9, 0x0, 0x0}, 0x20) connect$vsock_stream(r7, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r10 = accept4(r6, 0x0, 0x0, 0x0) sendmmsg(r7, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000240)="e9a4ea8d246a02fb3d7b6d068c4bd0018e0400000000", 0x16}], 0x1}}, {{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001180)="2ebb203023d89132c1980796d3480bf302680bb6d94cc2ddc4b641c81144696a15b4d88e56d04ec393bf39b3774c70aa01f9aee0fc51897c613f9ed201e53a48b093ea3325ebab77c2d8afcdd9e30fec85fdb932aa067d0f6e891750cd952158d3288fc4cb3a551e6d8f828c6e02ef0e295cbf30390c4566dba8ff971c6d212f", 0x80}], 0x1}}], 0x2, 0x44088) recvmsg$kcm(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/150, 0x96}], 0x5}, 0x0) 18.682299955s ago: executing program 4 (id=2581): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x44800}, 0x8800) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x7fffffff}, 0x10) sendmsg$kcm(r1, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="2e0000004a008102e00f80ecdb4cb9020a", 0x4a}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce6798a60e9", 0x1d}], 0x2, 0x0, 0x0, 0x10}, 0x0) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000040)=@x86={0x7, 0x4e, 0x8c, 0x0, 0xfc8, 0xeb, 0x1, 0x23, 0x7, 0xa0, 0xa, 0x1, 0x0, 0x2, 0xf8de, 0x5, 0x7, 0x80, 0xdf, '\x00', 0x0, 0x7dff}) r2 = syz_open_dev$hidraw(&(0x7f0000000080), 0x1, 0x80) ioctl$HIDIOCGRAWPHYS(r2, 0x80404805, &(0x7f0000000240)) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000380)=0x0) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)={0xe4, 0x24, 0x10, 0x70bd2a, 0x25dfdbfb, "", [@typed={0x8, 0x4, 0x0, 0x0, @uid=r5}, @typed={0x4, 0x142}, @generic="e00ec2627152e657e56180a9c039ed759fb94bd5ffad764840eb942af6d60abc7ca51dda9c821f8ae0a07e6a9c800319e5a4353dc6ed2457c07f2f839002a490570274c00d827af2fba42fc067767857252db762e972fa8a55e68a9d816492327288ea77d56b30d40cefa312818631324d335401ee08acb4d469103572abb85493d7f6ca76af7813b3247d4bf9f88a40f8f2f608d55f7604d8c04cf23bf63e95a04676c419d8551417097a3fb3c75d8a5ee41fc1dcd9cf8015361dea2a2aa1d4479f206b6ec159"]}, 0xe4}, {&(0x7f0000000280)={0x60, 0x29, 0x20, 0x70bd27, 0x25dfdbfc, "", [@generic="27f5945b67836b2a3b5f8f3ec78049c0a74ec2836b379562e4636b4190f6c9d95afed568a61a6bce569c2e7a0edb80be22d73f89894b4b8f3d1179e1e02f828bffe754233ab2f891c030265695d6"]}, 0x60}], 0x2, 0x0, 0x0, 0xc000}, 0x1800) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) mmap(&(0x7f0000fd9000/0x3000)=nil, 0x3000, 0x2000014, 0x50, r4, 0xa49bf000) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x118, 0x65, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xe, 0x5}}, [@TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @TCA_CHAIN={0x8}, @filter_kind_options=@f_route={{0xa}, {0xd0, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0xb4, 0x6, [@m_nat={0x7c, 0x0, 0x0, 0x0, {{0x8}, {0x54, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0xfffffffc}, @rand_addr, @loopback}}, @TCA_NAT_PARMS={0x28, 0x1, {{}, @rand_addr, @broadcast}}]}, {0x4}, {0xc}, {0xc}}}, @m_connmark={0x34, 0x0, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x118}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=ANY=[@ANYBLOB="38010000", @ANYRES16=r8, @ANYBLOB="010000000000000000000700000008000300", @ANYRES32=r9, @ANYBLOB="0c009900000000003e000000140004006e69637666300000000000000000000008000500060000000c001780040005000400040014000400766c616e30000000000000000000000005005300000000000a00180003030303030300000a00e80008021100000000001c00178004000100040003000400020004000200040004000400060008001780040003001c0017800400050004000400040001000400020004000200040002000a00e800ffffffffffff0000040017801c00e700db6d365654c98181bfba37013717c4c8c68999db6df653c90400178020001780040001000400050004000200040001000400050004000100040003002400178004000200040002000400020004"], 0x138}}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fd7000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000001500)=@newtfilter={0x2d4, 0x2c, 0x10, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xa, 0xfff3}, {}, {0x1c}}, [@filter_kind_options=@f_u32={{0x8}, {0x2a8, 0x2, [@TCA_U32_SEL={0x2a4, 0x5, {0xc, 0x5, 0x9, 0x4, 0x5, 0x7, 0x4e52, 0x0, [{0x1, 0x6, 0x1, 0xff}, {0x3334, 0x2, 0x5, 0x6bc69c89}, {0x7, 0xa67, 0x80, 0x2}, {0xfffffff7, 0xbef0, 0x2, 0x400}, {0xfffffff8, 0xf2e4, 0x80000000, 0xaa5f}, {0x0, 0x4f7, 0x2, 0x401}, {0x3, 0x2, 0x100, 0x1004}, {0x2, 0x6, 0x400, 0xf}, {0xfff, 0x9, 0x80000000, 0x3}, {0x0, 0x1, 0x80000000, 0x100}, {0x4, 0xabc7, 0xf68f, 0x1}, {0x401, 0xcd, 0x1, 0x8237}, {0x4b, 0x1, 0x7fffffff, 0x12}, {0x401, 0x4, 0xe0e, 0x8}, {0xff, 0x81, 0x6, 0x7}, {0x9, 0xc, 0x1000, 0x5}, {0x0, 0x9, 0x9, 0x8}, {0x40, 0xcf, 0x10, 0x4}, {0x8, 0x80000000, 0x1232, 0xe25}, {0x50, 0xecb4, 0x3, 0x3}, {0x81d, 0x735eecc5, 0x3, 0x4}, {0x7fff, 0x5, 0x4, 0xa}, {0x1c, 0x10, 0x7, 0x7f}, {0x803, 0x5, 0xc, 0x4}, {0xd, 0x401, 0x8, 0x1000}, {0x4, 0x4, 0x0, 0x4}, {0x0, 0x3338, 0xd87, 0x1}, {0x42, 0x8000, 0x7f, 0x3f}, {0x10000, 0xfffffffe, 0x7, 0x9}, {0x45, 0x3, 0x14f0, 0x10001}, {0x4, 0x10, 0xdb, 0x5}, {0x563d, 0x8001, 0x101, 0xfffff000}, {0x80000, 0x5, 0x2}, {0x5, 0x4, 0x9, 0x2}, {0x2, 0x2, 0x8, 0x7}, {0x8, 0x6, 0x526d74f8, 0x1}, {0x8, 0x10001, 0x23f, 0xff}, {0x1, 0x8, 0x0, 0x9}, {0x1, 0xcb, 0xffffffdb, 0x4}, {0x3, 0xfffffffc, 0xb05, 0x7}, {0x7, 0x3, 0x1, 0x3}]}}]}}]}, 0x2d4}}, 0x460d0) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x1, 0x5, 0x9fd, 0x84, 0x105}, 0x50) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x4) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r10}, 0x38) ioctl$KVM_RUN(r6, 0xae80, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000000580)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x38, 0x1, 0x2, 0x5, 0x0, 0x0, {0x2, 0x0, 0x3}, [@CTA_EXPECT_FN={0xa, 0xb, 'Q.931\x00'}, @CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_TIMEOUT={0x8}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x40001}, 0x4004005) 17.812941446s ago: executing program 2 (id=2582): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x18, &(0x7f00000005c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x3001}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 17.738489095s ago: executing program 3 (id=2583): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x6d93, 0x4) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x28, 0x2, [@TCA_CAKE_OVERHEAD={0x8, 0x6, 0x9c}, @TCA_CAKE_OVERHEAD={0x8, 0x6, 0x21}, @TCA_CAKE_RAW={0x8}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x34b}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0xd6629edbb25523a9}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@getchain={0x24, 0x66, 0x1, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x2, 0x7}, {0x1, 0xfff1}, {0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) 17.596661723s ago: executing program 2 (id=2584): syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x4d40) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) pipe2(&(0x7f00000000c0), 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x200080, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x4000, 0x0, 0xa, 0x80, 0xa0}, {}, {}, 0x0, 0x8, 0x1, 0x0, 0x7}, {{@in=@broadcast, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x3501, 0x0, 0x0, 0x4, 0x0, 0x5, 0x7}}, 0xe8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) r5 = socket$key(0xf, 0x3, 0x2) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000010000107000000810000000003"], 0x14}, 0x1, 0x0, 0x0, 0x400c090}, 0x0) recvmmsg(r7, &(0x7f00000071c0)=[{{0x0, 0x0, 0x0}, 0xd4}, {{0x0, 0x0, 0x0}, 0x3563}, {{0x0, 0x0, 0x0}, 0x9}], 0x3, 0x2, 0x0) ioctl$KVM_CHECK_EXTENSION(r6, 0xae03, 0xbe) sendmsg$key(r5, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0xe000, 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0xff, 0x5, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000004}, 0x4040010) 16.007613769s ago: executing program 2 (id=2585): r0 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000000), 0x4a0000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000040)={0x0, 0x1, 0x0, 'queue1\x00', 0x6}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vxcan0\x00', 0x0}) sendmsg$can_raw(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x1d, r1}, 0x10, &(0x7f00000001c0)={&(0x7f0000000180)=@can={{0x2, 0x1}, 0x3, 0x1, 0x0, 0x0, "4772ab6f8d9853b5"}, 0x10}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) write$P9_RATTACH(r0, &(0x7f0000000240)={0x14, 0x69, 0x1, {0x20, 0x0, 0x8}}, 0x14) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$CAN_RAW_FD_FRAMES(r3, 0x65, 0x5, &(0x7f00000002c0), &(0x7f0000000300)=0x4) vmsplice(r3, &(0x7f0000001600)=[{&(0x7f0000000340)="e1f78523113bb235c071b41c2db6d72a8539eb01a18f0df8f9d8ad783f8390e4b77a2103095afcfe8d9a76b89153a73941ba58f3e811688f4c346d40a4ccb762c2dfaca170b442d70101811480bbdbe799d903c35d46db63811f540189425316bc8343d5c33ccf37523d022ce77cf4edbf71b9d44b47436fc63505a0ac1be194418a82bf254c", 0x86}, {&(0x7f0000000400)="c24e29fa81089f877a34d37b7a1b04b2ccc1895270ac43ee02d5233d460b7ec2438e412339a5c7d2f1a08470f54d3c0f56419f8c24b4a80918a90fb13c3b39809dc8fe470ff357210107578f73950847b2155e7c97cecf2c557d658ddcadd8fe78a310ae49a5c63c980ffd579dabca5f38fe6010a22633fb331c64fac58920b2707df179c8b57c", 0x87}, {&(0x7f00000004c0)="8a6f09517ec287bc73060ffc34de2bdd1670279e838396cf7049b8061d90b78506ef49ca961871a821fb3e92083f8719e8d1dbfb2e025ae5d9a65911b143ff0debe1a802a2bf5ed47bbb49460279e591af2e3e030096d25a00d18f25a6da55ad472baecb002f5a2a1a7b09be05b8c10ed863313a4ed09e3c61267cd67ef286c328351334ae4811b2c2cd5b90ca703d24c4ad98345273f1c96cb93fe3c562d27ec93ff5cfac0bfad187b31a851b9a6d9ba9a4358b004319ebe78a95137361cb20e6d2b666b636dc8da6316bcc6c8785b9d6fd5633985b7c099c761ddcf67b66038963b6fac6f1c9f43f594cd874528652bc7427fbfc6e82a7f8c7229f29acbee34e9e413734904008d1a7c76c8dab34b5316bbb84f98846cbde6bca672b55771a4d625c7ce5904b6baee79a08e99b42a2cb7148ac6705ce111c9427b36807a72147e64077f22f79e037376ee0f2a9c9231e2794dec214737b02329274cb3c64e7323f3b37fcd8444a9a846273dc21fc58b6a228ac589aa613bb6e2343ffbf11b5f7e9cbc186833ddee02edddf985e9f2833dc77ea35b0ca25337da84229a37400820b89fcb672c7f353ae0c55a049a5a841060f2d21e90e26b903a807448d5342e6f1e7a4523548b998036c2954fee48b4633f9bfed7984068827390a54e7bc583550195ae6651c055c0d2260caf8518940d06e34bd097f0a1778fe13ab65f20bc3b2c1640a52af22331c7bcba84256ce958bda7ab8d2583e50e09a1f8e8fb28c44a400c4ccab9ea448763a999380d3dca72a10347a5d335b1af78d614581aa3ffa691d130c9f032e21bfba5bae9c230c1b0d6f612962ad6b5900edebd3b1375393287812a149d1e781122ec653f7197a575addbfba92a8b494538b800493a70248ff6cbfc5c943c80ffa002b8386d9f986d3e4f9c4e16817843a3f8f23986c8b0adcde1aaa948446e17cc4abbc0f34232fc10e899288ccc8c4e2d3b330f6f6edd3f0d10f5d7c1428a1c3c2adbf059b2ba5182c3575f072aadf14d9ea1cdbc10dc05a67a708ff2b46d3e3b7047a910c8106ce846ccdd82e89bf9bf1e8c39c771bc9369f1a40b7db07be32fd1aae19019caff83dc2a7233e97acc82fef2d74633ca04cf191b19460fe70bbad06a6134889899ad8991f48b43b1a66533014f9835d405e24d626445272b466d001b3cbd467b3216419828f47fbf5445ee3076d7f71ab5c44a4f16a6b7e12206c7a96086669bf4ead719be715af534b79591cca1166ddb3d6c24f06fd579c2e5b741b4636727491acd3c493db5f5c36ae69322aa820dfc74ad6283dc19f4ff31b3238ecbb8ab29ebba02e1e0f867873f190e720f667636bf80a62d6d3674d2756b0d42d4fad90fc9d2aaa048fcf97c507c16cd0bb931570d9b3b8b3ce53d8bdf47149bb04f4e938449c57d2255fc47c26e0a7ee928e8c8fca3bde95cb8137ccf192316944b821d964c1044edd950a663a41a7015be88d979d8ff8f0ddd69a19f284ed1100a96f9a0cdf0a359be825aac501ed636c7ed9a3f5bffe3c4e10483dc61d296683c32eae93e2dfa64f69ebb37a7b67a5d7971974866f6b31b17a18710f07265e3b15fc85d7fd7749a8bb5eac3ffa094995aa0ebf13791d398c5e268de40dd9f0a7b991ede8511f8361184e2990a1f6c68530db91a5b873c8c2fc1f17915d055537c32d4f297439d6a81a9f3cdeefe370404eb32bb05ceaff069098a63a4487019a4dc2402ab39c0a8b67bad8a75b437b3098adfdbb62f4eecc9ec997f08a4846ca4166f96a9e9421ca538e184d1709b5470ed1c852ef31dc1806dc8927e2f0dc12c24f9a195dc4ab5e90640b7f2188285718a8f2e9c13d19777f58cc13f947432d0101b9cc12806a9abdeb74040e5fae1ec003d74114df367c6eccdcae3f93f9e4724c5e0fc3982cc50dac3a258abaa0814cfacdc9d399bbad0d9ce8cd28946941869057362d93aac95e4347603c7b899bdb61ee178892d74819760bb3e60d52d31f45e75933c2d174a6c479bdf9065d4ee717b5c30f9672f6167e1f2b436dcb2d385140aa2747bbc4b8407dfa99ca85c7e21f72f41adea554ba3b0cb675f74adaff9d609d4b4400af59db1200560e9967780198037aba9a612896164dc2a17aeea42959d080f6cf4e29d5780123b5f066aa08b0d093db56c01946a94a8604c540f9ac8c69810d4062917acd190f02e643752d48a47b349712abb7bbbb544ed7d6e715461c94c6cce80f44608e80ca02d64272db6d85c54ebe737bdfe64dca64a308f9487499e7049540eaf3bd552e268870021699ed5963aefdd99dcc57f3ff59a2255f8ece227750b874d62a752af051cf1d2de72e1e7080637736cb4e4d7b330a766dcd21be2dc06dc33b0da14a7ad1acc23ba6576f10e2bde38b97e65f89207c96aa98a3b5e5dbe1c9f99a92e9446247add7af1659f936dc2a508420f7059ac468f76f6b648760b3677b06c0be8cf5e8bfb0d9ba85d05fd6e6c01fd947b553f965eaea23fd1cb2b05126b7448827aaca35cf124449b9cc6d4067d50778edb394f932250a698470605524982ef74414f3255de8548114d0fb37b411a1109d3405b658fc4186c0ffcd845e16ffd07f6f84e4d1a91082936bb2a635ead7c695443d3cdc7901a690a14c8bc8f6f002117275d04c38a575000b72ca12d5ad3140e8d70b1b745d99b7f3130859bf54804b1801950e20cbe89af6a88587d072b858f15289ea3f6799b82d6cd77b452bfc6c3c37e2b782ac573a9b8c4a717ba09b2eec1d0bd1fe3e84351e8ff709155187e0d61b495f7e315e63f378ca97222ffb2bcbf29ee40542c0225779248a8c00aa93e1fcb27f800243ada0d7bf1b62141391ab3acf18e49c8bfa77234fa4b92636959c6bae29f98095f43231cf7d6a240fb660fc0ae0f65aff0d710ceb3b01a08c40cfd307ee4c03afbe3fac6d0c999079d143b253c2a82c54306dac0e370a1f3b7815369ebad2b6dce8e895e3d220b879be2399deb5519fe0d0bc412ba858a0c72d3f4dee0d70555767a9e8f6d64ffab5430b1f013acd46e5d891853fe321d89475b6151faf96a8f5ac63abcec3ad0e2c56322d48b1a2e798d1a93b0913089b748e9b632ef67005b6572ba94bbec90f90a075368056516ab1ed7b867f08c6a9c6239fee34a4bf57a23232f82cc3600951e082fb7ad82ea1a9ae1b674ef40c4d1f4dfbe820861323b34186cfb0efd8da7cdd9d576a80a13e2f031a6313ccbcac8ee43e6e76766f54ad6eb75bafe78b19b05711321647ccaf6671d5fc2a6a0f546871fe0ed4b9f7505335ea9c5d6f5cf8a5260438cb7759b18b1071a72773cd581d6eba03632d7c2efdb307546c2d1152d58e717b2089ddd0d28e9839bc9a16a9df23885968f0fa9a59ac3efda800afd18d7bc1387f1317d9d9c8c8ff0c8e05463fca36307cea8e4e5ab6d4c93951853175c87b6c6d1bf11d68f479e809e4c27d8d9bdb17fef1c2257a04835070f4eace30b9ccd740a7f8179558a4b67142aecc2102154682b8fcc76abc5f459855b6f8eaaffaaa0aa802590f96453b51eb18e05569e2170a9ba3163ca057a0ef1e66c4a511a084d360eeacdce0ad5d4bf51bd547b915800fed2cf878cb9065d48e6d57db7b01494074b4f389cbfdae64c53912f986735a9295792b125ae99f944d990b7f33649df2d9fcb872abaf0e26e970068b8723b7b84b799d5e2be731c28988e0eac8a9891b47ca082874d756f8265448e771f920a51a0a73c405c068b627bf2560401f933a5f4afaa8cbb92938a9a03b115d4fc927cc17c7971974350ba51f7e17827c8af32517e27fc763e2004470c0a98bff192640d2cd05508a5cba2a9d3b3cb135b9cd5090a3f63645aef8c994b2fc6f06bae5b0fc4f7e3f409a8dc03d630f2c2217804ffee19ffc429f29ba2d4a6ea1c41a5aa050f705734114fefefa443788962ac9ad823ce7e5db60b4f7b9db534075ce7b4365a404078af91b1405ab76bcef95d66157dde6f4520f6d9b38347a7b6a35ee00cc5726bcc32a72c4cf8af37c82ee33c13622da2dc13894a09ab9597a1c852305fdaffaf87a60feffc3ede429df8d375989a8a0798efbfe7f3617c528371fff8b9b7777e0cf873d833f049ff8a4106771c970e49a02ebd3c67b28975e4ef34c32af9e309267169994a2466216961a40817ea2d809c09ca9d8fe3cedd186dfb76f541496861bd0101297464f1b0720a20410a45c9e8a46f7d1d47d5fc50a9ea9c8eae94f3433eeafa89a222ebea886cdfd8ad618473e4c2992077c2e455d9f010e9e589874c57cf0aeeca313e90e32364bbdb9eb7e5c4af8c17c87df129f951b8cd2fc416b364c549fc6ea942018b575735afbfca8befb3bcae026ae8b02714ed228c29a4539ea65249423e3752674def159dced6cf815168aa524f3d5948d89d7d872c231ceb056fa6540cbf9fff0e511b2da90a856c55619d50aa6faaaef7a6452027430df638a6bd71293c6727794b47f2542748e334c7696398b135336a5e09ddccace3996386cd2fa5cfcfb41cd49ea2249e0a08dff099b2ece85ce4e66b91edccdbf3a832632b9e805965ba12781777c886edd14f7645a7eb7493bac3aac77d4aa1c06416db6f634bd7f5845fdf4c293b4085e6c9750e3ac7f7d87cf52e4c421ef8d7c4af248101effaacf50c419f11e20fc56c6c1606f962f120235720819c30a75da177596fdb93815cb6de5ac2fc833861a2f15e951c2599bdafd6672c3d93a3d424bbc782eef53d0a282c04cb4c8bedde463a5926e02c4a89080152fe85e4f2e80f61310cedcac8aff5e3a0c13c0589d9283a810d6b98040c87a334bb6b7e11aa172d95bc54bc7958f8150d24138f6c6404dffc2a0518dfdfc6177600ca5e2069f01f81b0189b60e0186f8db02770a8c06cd37d3262b7579811e47cbf8e51bc4409f8dc3f68058ae1306a8f062bf565cbb38025c4a7e113cb65b2dc2f8ee5c58f51b973769fa775c59a21e041d5c6eac07d908e9df8d920c73a577ad93f3251b1ef7013a9646c31698c750d0879c2bb0292522f184fdf0858a87c0182e88a43ccd66d858a7bfb13633a53983ad756194bcd2e849135c7f43b37535d0967ffd6775cad7b00b7f800121a8faf048db20788a6bddc3f45c34b16fa4915fa54d3c8459d412913682ebd3dbc6ccd3e8d4ddab7979b89098aeef4b1f1beb0c09542c8feae6226efa6bd999f63eed8e47b35fa016dc3dba8273d7c906dd537894dc7e30b1a67193e684c7b372db52d13cf911da1bb68b9d3ff55e4b9b8a5dd04ec4a9d83d5dc89d13f22474696730f9a5888d728a96b863ce9d7a029d8d6afbf2d6f035c045a4d96fdd4584b44a10ace83b63eb8b41922d71f40dcb92fe83bbe0e82ba8434046dae43b8a8e4d40ee62d0dcd3c6a91e019c6965cc9264fe816ead555c65334f57dbd989944b27b2093895b6f68250c4cb32d65f08ece36d52b157579167d62a89de7ed0dcd788b06af8634a875bd30c1abb5d8bfd07d1748dbf1238699cc37db4eee2f307040234be827dc64a934a1a3581276595ee084dcee596f24ab8c2ee0fb54ad0c3bab905c71bd53cdb46be00d074315406b3965cb0b16781f0a2ecd2556ba9d5447a4cc72a084153b963935639df96ab2c5734870a3a2f8c2792d02fc65a7aeb7f5ea9d5977190a7623b5ce56d9f569332ecee9db2e6b087a22ee564f27eaf95320983ed5fac34e99d3182bf08442bfcdb42e52bab1c52ca4203ed845d93b727030e518bd98633ea7431767a136d0559b40bad94", 0x1000}, {&(0x7f00000014c0)="eba1146537e1f81cc113df980deee42e04b1179e36aca25aebc54aa654740226f20fec9de8fc342c4ebb618f01726f0ec6039941de13686c11dd4f7dff5efdeb8966a652d447b1", 0x47}, {&(0x7f0000001540)="95cf2144145c3de892c2e56e38ecd279928cc24dec0a220317fa2272dc40d99cc89342d07b5bf787068aab382212c9137630eed65d9ad2a4501195b1dbf3b256285c914df98d88fa7a0eca964ac7de86b41fdd26d0567dd71238a5e86f62817e071e015af30f0d38a10b89c05e0869379f7a95e2a0c6bc364d227e54680a302d292adc2bf9991028b90b221e74f1865e39e7d766f488b21a4ed7f353eec8f3b04d", 0xa1}], 0x5, 0x9) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r0, 0x80047210, &(0x7f0000001680)) (async) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r2, 0xc0505350, &(0x7f00000016c0)={{0x7f, 0x9}, {0x5, 0x4}, 0x3, 0x6, 0x80}) (async) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r3, 0x408c5333, &(0x7f0000001740)={0x3, 0x6, 0x0, 'queue1\x00', 0x7ff}) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000001800)={{0x9, 0x2}, {0x0, 0x5}, 0x9, 0x4, 0x6}) (async) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000018c0), r2) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000001a00)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001900)={0xa4, r4, 0x4, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000000}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x800}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x1}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x24}]}, 0xa4}, 0x1, 0x0, 0x0, 0xc000}, 0x1) (async) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000001a40)=0x1) fsopen(&(0x7f0000001a80)='hugetlbfs\x00', 0x1) connect$pppoe(r0, &(0x7f0000001ac0)={0x18, 0x0, {0x4, @empty, 'virt_wifi0\x00'}}, 0x1e) (async) r5 = socket$alg(0x26, 0x5, 0x0) (async) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001b00)='/proc/cpuinfo\x00', 0x0, 0x0) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000001b40)={{0x5ff, 0x9}, 0x64}, 0x10) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000001b80)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}, {0x0, @struct}}) (async) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000006, 0x30, r6, 0xd44e1000) (async) fcntl$getownex(r5, 0x10, &(0x7f0000001f80)={0x0, 0x0}) sched_setattr(r7, &(0x7f0000001fc0)={0x38, 0x0, 0x0, 0x3, 0xaf, 0x7f, 0x48000000000, 0x10000, 0x466, 0xb47}, 0x0) (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) setsockopt$ARPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000002000)={'filter\x00', 0x4}, 0x68) ioctl$BLKCRYPTOIMPORTKEY(r6, 0xc0401289, &(0x7f0000002140)={&(0x7f0000002080)="a228e8b8cbdd474440284ce407cbe21b3462", 0x12, &(0x7f00000020c0)=""/127, 0x7f}) (async) shmget(0x1, 0x800000, 0x20, &(0x7f0000800000/0x800000)=nil) (async) syz_io_uring_setup(0x36a3, &(0x7f0000002180)={0x0, 0x5e82, 0x1000, 0x2, 0x2e4, 0x0, r0}, &(0x7f0000002200), &(0x7f0000002240)) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000002440)={&(0x7f0000002280)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002400)={&(0x7f00000022c0)={0x108, 0x16, 0x300, 0x70bd29, 0x25dfdbfb, {0x1}, [@generic="4f3b2f48cb9263307f303f74df6aeec5b4476db9fa5140dc0c34d7f23bd629a73306114133fc85969be9248959d2fde9cb79d7374181bc7b9d552ddb9f5256cd2000dbffa76e1c3c570ea82ab04c30610eae8bacfb482c907223fa84ab421c277a9ae70376586ef2765cc4d14e019a00ac097806934c368470ed447aae7d26ffd09c25ae406bc717ddb05559233f133c203291e42016f7034acee8fedc329aef8d88d77fbb371d712d9aa9c57f78e7fc5a2f4a2cedbf930a9ec3979df7", @typed={0x8, 0x19, 0x0, 0x0, @u32=0x1}, @typed={0xc, 0x5, 0x0, 0x0, @u64}, @nested={0x20, 0xb3, 0x0, 0x1, [@nested={0x4, 0x2a}, @nested={0x4, 0x46}, @nested={0x4, 0x79}, @typed={0x4, 0xdf}, @typed={0xc, 0x151, 0x0, 0x0, @u64=0x5}]}]}, 0x108}, 0x1, 0x0, 0x0, 0x4008000}, 0x200040c4) 15.810514072s ago: executing program 2 (id=2586): mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000009ac900000000440000000800030009ad835fe0d7f4b4c4", @ANYRES32=r2, @ANYBLOB="0a001800030303030303000008005a8004000180"], 0x30}}, 0x0) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) execve(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000800)={[&(0x7f0000000940)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01', &(0x7f0000000a40)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01']}) 3.455354598s ago: executing program 33 (id=2580): bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000000)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x88000, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={0x0, @empty, @empty}, &(0x7f0000000280)=0xc) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f00000002c0)=r2) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) process_vm_readv(0x0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}, {0x0}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/90, 0x5a}], 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0}, 0x10) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x8, 0x3, 0x368, 0x1d0, 0x11, 0x148, 0x0, 0x0, 0x2d0, 0x2a8, 0x2a8, 0x2d0, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x188, 0x1d0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv4=@remote, [0xffffff00, 0xff, 0xffffff00], @ipv6=@dev={0xfe, 0x80, '\x00', 0xe}, [0x0, 0xffffff00], @ipv4=@private=0xa010100, [0xffffff00, 0x0, 0xffffff00], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xff000000, 0xff000000, 0xff], 0x8, 0x6, 0x5e, 0x4e21, 0x4e23, 0x4e24, 0x4e21}, 0x40, 0x8e0}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0xffffffff, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@addrtype={{0x30}, {0x242, 0x75f65a4e97d6873f, 0x1}}, @common=@unspec=@quota={{0x38}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x3, 0x6, 0x2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3c8) r6 = socket$vsock_stream(0x28, 0x1, 0x0) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) bind$vsock_stream(r6, &(0x7f0000000440)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r6, 0x3) r7 = socket$vsock_stream(0x28, 0x1, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0x8}}) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000780)={r9, 0x0, 0x0}, 0x20) connect$vsock_stream(r7, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r10 = accept4(r6, 0x0, 0x0, 0x0) sendmmsg(r7, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000240)="e9a4ea8d246a02fb3d7b6d068c4bd0018e0400000000", 0x16}], 0x1}}, {{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001180)="2ebb203023d89132c1980796d3480bf302680bb6d94cc2ddc4b641c81144696a15b4d88e56d04ec393bf39b3774c70aa01f9aee0fc51897c613f9ed201e53a48b093ea3325ebab77c2d8afcdd9e30fec85fdb932aa067d0f6e891750cd952158d3288fc4cb3a551e6d8f828c6e02ef0e295cbf30390c4566dba8ff971c6d212f", 0x80}], 0x1}}], 0x2, 0x44088) recvmsg$kcm(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/150, 0x96}], 0x5}, 0x0) 3.131688507s ago: executing program 34 (id=2581): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x44800}, 0x8800) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x7fffffff}, 0x10) sendmsg$kcm(r1, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="2e0000004a008102e00f80ecdb4cb9020a", 0x4a}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce6798a60e9", 0x1d}], 0x2, 0x0, 0x0, 0x10}, 0x0) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000040)=@x86={0x7, 0x4e, 0x8c, 0x0, 0xfc8, 0xeb, 0x1, 0x23, 0x7, 0xa0, 0xa, 0x1, 0x0, 0x2, 0xf8de, 0x5, 0x7, 0x80, 0xdf, '\x00', 0x0, 0x7dff}) r2 = syz_open_dev$hidraw(&(0x7f0000000080), 0x1, 0x80) ioctl$HIDIOCGRAWPHYS(r2, 0x80404805, &(0x7f0000000240)) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000380)=0x0) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)={0xe4, 0x24, 0x10, 0x70bd2a, 0x25dfdbfb, "", [@typed={0x8, 0x4, 0x0, 0x0, @uid=r5}, @typed={0x4, 0x142}, @generic="e00ec2627152e657e56180a9c039ed759fb94bd5ffad764840eb942af6d60abc7ca51dda9c821f8ae0a07e6a9c800319e5a4353dc6ed2457c07f2f839002a490570274c00d827af2fba42fc067767857252db762e972fa8a55e68a9d816492327288ea77d56b30d40cefa312818631324d335401ee08acb4d469103572abb85493d7f6ca76af7813b3247d4bf9f88a40f8f2f608d55f7604d8c04cf23bf63e95a04676c419d8551417097a3fb3c75d8a5ee41fc1dcd9cf8015361dea2a2aa1d4479f206b6ec159"]}, 0xe4}, {&(0x7f0000000280)={0x60, 0x29, 0x20, 0x70bd27, 0x25dfdbfc, "", [@generic="27f5945b67836b2a3b5f8f3ec78049c0a74ec2836b379562e4636b4190f6c9d95afed568a61a6bce569c2e7a0edb80be22d73f89894b4b8f3d1179e1e02f828bffe754233ab2f891c030265695d6"]}, 0x60}], 0x2, 0x0, 0x0, 0xc000}, 0x1800) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) mmap(&(0x7f0000fd9000/0x3000)=nil, 0x3000, 0x2000014, 0x50, r4, 0xa49bf000) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x118, 0x65, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xe, 0x5}}, [@TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @TCA_CHAIN={0x8}, @filter_kind_options=@f_route={{0xa}, {0xd0, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0xb4, 0x6, [@m_nat={0x7c, 0x0, 0x0, 0x0, {{0x8}, {0x54, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0xfffffffc}, @rand_addr, @loopback}}, @TCA_NAT_PARMS={0x28, 0x1, {{}, @rand_addr, @broadcast}}]}, {0x4}, {0xc}, {0xc}}}, @m_connmark={0x34, 0x0, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x118}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=ANY=[@ANYBLOB="38010000", @ANYRES16=r8, @ANYBLOB="010000000000000000000700000008000300", @ANYRES32=r9, @ANYBLOB="0c009900000000003e000000140004006e69637666300000000000000000000008000500060000000c001780040005000400040014000400766c616e30000000000000000000000005005300000000000a00180003030303030300000a00e80008021100000000001c00178004000100040003000400020004000200040004000400060008001780040003001c0017800400050004000400040001000400020004000200040002000a00e800ffffffffffff0000040017801c00e700db6d365654c98181bfba37013717c4c8c68999db6df653c90400178020001780040001000400050004000200040001000400050004000100040003002400178004000200040002000400020004"], 0x138}}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fd7000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000001500)=@newtfilter={0x2d4, 0x2c, 0x10, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xa, 0xfff3}, {}, {0x1c}}, [@filter_kind_options=@f_u32={{0x8}, {0x2a8, 0x2, [@TCA_U32_SEL={0x2a4, 0x5, {0xc, 0x5, 0x9, 0x4, 0x5, 0x7, 0x4e52, 0x0, [{0x1, 0x6, 0x1, 0xff}, {0x3334, 0x2, 0x5, 0x6bc69c89}, {0x7, 0xa67, 0x80, 0x2}, {0xfffffff7, 0xbef0, 0x2, 0x400}, {0xfffffff8, 0xf2e4, 0x80000000, 0xaa5f}, {0x0, 0x4f7, 0x2, 0x401}, {0x3, 0x2, 0x100, 0x1004}, {0x2, 0x6, 0x400, 0xf}, {0xfff, 0x9, 0x80000000, 0x3}, {0x0, 0x1, 0x80000000, 0x100}, {0x4, 0xabc7, 0xf68f, 0x1}, {0x401, 0xcd, 0x1, 0x8237}, {0x4b, 0x1, 0x7fffffff, 0x12}, {0x401, 0x4, 0xe0e, 0x8}, {0xff, 0x81, 0x6, 0x7}, {0x9, 0xc, 0x1000, 0x5}, {0x0, 0x9, 0x9, 0x8}, {0x40, 0xcf, 0x10, 0x4}, {0x8, 0x80000000, 0x1232, 0xe25}, {0x50, 0xecb4, 0x3, 0x3}, {0x81d, 0x735eecc5, 0x3, 0x4}, {0x7fff, 0x5, 0x4, 0xa}, {0x1c, 0x10, 0x7, 0x7f}, {0x803, 0x5, 0xc, 0x4}, {0xd, 0x401, 0x8, 0x1000}, {0x4, 0x4, 0x0, 0x4}, {0x0, 0x3338, 0xd87, 0x1}, {0x42, 0x8000, 0x7f, 0x3f}, {0x10000, 0xfffffffe, 0x7, 0x9}, {0x45, 0x3, 0x14f0, 0x10001}, {0x4, 0x10, 0xdb, 0x5}, {0x563d, 0x8001, 0x101, 0xfffff000}, {0x80000, 0x5, 0x2}, {0x5, 0x4, 0x9, 0x2}, {0x2, 0x2, 0x8, 0x7}, {0x8, 0x6, 0x526d74f8, 0x1}, {0x8, 0x10001, 0x23f, 0xff}, {0x1, 0x8, 0x0, 0x9}, {0x1, 0xcb, 0xffffffdb, 0x4}, {0x3, 0xfffffffc, 0xb05, 0x7}, {0x7, 0x3, 0x1, 0x3}]}}]}}]}, 0x2d4}}, 0x460d0) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x1, 0x5, 0x9fd, 0x84, 0x105}, 0x50) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x4) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r10}, 0x38) ioctl$KVM_RUN(r6, 0xae80, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000000580)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x38, 0x1, 0x2, 0x5, 0x0, 0x0, {0x2, 0x0, 0x3}, [@CTA_EXPECT_FN={0xa, 0xb, 'Q.931\x00'}, @CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_TIMEOUT={0x8}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x40001}, 0x4004005) 2.048173415s ago: executing program 35 (id=2583): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x6d93, 0x4) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x28, 0x2, [@TCA_CAKE_OVERHEAD={0x8, 0x6, 0x9c}, @TCA_CAKE_OVERHEAD={0x8, 0x6, 0x21}, @TCA_CAKE_RAW={0x8}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x34b}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0xd6629edbb25523a9}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@getchain={0x24, 0x66, 0x1, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x2, 0x7}, {0x1, 0xfff1}, {0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) 0s ago: executing program 36 (id=2586): mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000009ac900000000440000000800030009ad835fe0d7f4b4c4", @ANYRES32=r2, @ANYBLOB="0a001800030303030303000008005a8004000180"], 0x30}}, 0x0) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) execve(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000800)={[&(0x7f0000000940)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01', &(0x7f0000000a40)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01']}) kernel console output (not intermixed with test programs): 57475][ T5955] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 647.765905][ T5955] cdc_wdm 5-1:1.0: Unknown control protocol [ 647.779417][T13516] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2096'. [ 647.967604][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 647.968171][ T5862] usb 5-1: USB disconnect, device number 95 [ 647.974269][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 647.974290][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 648.179971][T13529] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2100'. [ 648.802789][ T5955] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 648.966783][ T5955] usb 4-1: Using ep0 maxpacket: 32 [ 648.988625][ T5955] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 649.035983][ T5955] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 649.070030][ T5955] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 649.086636][ T5955] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 649.100795][T13551] usb usb8: usbfs: process 13551 (syz.4.2107) did not claim interface 0 before use [ 649.195435][ T5955] usb 4-1: config 0 descriptor?? [ 649.251248][ T5955] hub 4-1:0.0: USB hub found [ 649.816568][ T5955] hub 4-1:0.0: 2 ports detected [ 650.025392][ T5955] hub 4-1:0.0: hub_hub_status failed (err = -71) [ 650.059515][ T5955] hub 4-1:0.0: config failed, can't get hub status (err -71) [ 650.115627][ T5955] usbhid 4-1:0.0: can't add hid device: -71 [ 650.123878][ T5955] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 650.233075][ T5955] usb 4-1: USB disconnect, device number 98 [ 650.732200][ T5996] usb 2-1: new low-speed USB device number 78 using dummy_hcd [ 650.883836][ T5996] usb 2-1: Invalid ep0 maxpacket: 64 [ 651.062268][ T5996] usb 2-1: new low-speed USB device number 79 using dummy_hcd [ 651.212481][ T5996] usb 2-1: Invalid ep0 maxpacket: 64 [ 651.218432][ T5996] usb usb2-port1: attempt power cycle [ 651.562333][ T5996] usb 2-1: new low-speed USB device number 80 using dummy_hcd [ 651.605748][ T5996] usb 2-1: Invalid ep0 maxpacket: 64 [ 651.752195][ T5996] usb 2-1: new low-speed USB device number 81 using dummy_hcd [ 651.773983][ T5996] usb 2-1: Invalid ep0 maxpacket: 64 [ 651.787875][ T5996] usb usb2-port1: unable to enumerate USB device [ 651.932553][ T5862] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 652.246232][ T5862] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 652.301261][ T5862] usb 4-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 652.435115][ T5862] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 652.462422][ T5862] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 652.500921][ T5862] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 652.677038][ T5862] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 652.732288][T13584] loop6: detected capacity change from 0 to 63 [ 652.743964][T13584] buffer_io_error: 10 callbacks suppressed [ 652.744015][T13584] Buffer I/O error on dev loop6, logical block 0, async page read [ 652.761303][T13584] Buffer I/O error on dev loop6, logical block 0, async page read [ 652.771611][T13584] Buffer I/O error on dev loop6, logical block 0, async page read [ 652.790318][T13587] Buffer I/O error on dev loop6, logical block 0, lost async page write [ 652.806040][T13587] Buffer I/O error on dev loop6, logical block 1, lost async page write [ 652.814757][ T5955] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 652.827700][T13587] Buffer I/O error on dev loop6, logical block 2, lost async page write [ 652.837096][T13587] Buffer I/O error on dev loop6, logical block 3, lost async page write [ 652.869647][T13587] Buffer I/O error on dev loop6, logical block 4, lost async page write [ 652.869904][T13588] Buffer I/O error on dev loop6, logical block 0, lost async page write [ 652.890656][T13587] Buffer I/O error on dev loop6, logical block 5, lost async page write [ 652.926541][T13584] loop6: unable to read partition table [ 652.970861][T13584] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 652.979902][ T5955] usb 1-1: Using ep0 maxpacket: 16 [ 652.982391][ T5955] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 653.042441][ T5955] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 653.072158][ T5955] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 653.107391][ T5955] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 653.116044][ T5955] usb 1-1: Product: syz [ 653.120433][ T5955] usb 1-1: Manufacturer: syz [ 653.131242][ T5955] usb 1-1: SerialNumber: syz [ 653.141004][ T5955] usb 1-1: config 0 descriptor?? [ 653.157831][ T5955] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 653.168569][ T5955] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 654.001359][ T5955] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 654.009537][ T5955] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 654.166293][T13600] netlink: 'syz.4.2123': attribute type 10 has an invalid length. [ 654.190341][T13600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 654.206308][T13600] batadv0: entered promiscuous mode [ 654.253256][T13600] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 654.702317][ T5955] em28xx 1-1:0.0: Unknown AC97 audio processor detected! [ 654.751543][T13583] delete_channel: no stack [ 654.757961][ T5862] usb 4-1: USB disconnect, device number 99 [ 654.768666][ T5955] em28xx 1-1:0.0: couldn't setup AC97 register 2 [ 654.996915][T13609] netlink: 'syz.1.2126': attribute type 33 has an invalid length. [ 655.027745][T13609] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2126'. [ 655.172618][T13612] input: syz1 as /devices/virtual/input/input50 [ 656.253343][ T5955] em28xx 1-1:0.0: couldn't setup AC97 register 6 [ 656.281934][ T5955] em28xx 1-1:0.0: couldn't setup AC97 register 54 [ 656.443313][ T5955] em28xx 1-1:0.0: couldn't setup AC97 register 56 [ 656.984692][ T5981] usb 1-1: USB disconnect, device number 68 [ 658.579172][ T1227] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 658.732400][ T1227] usb 1-1: Using ep0 maxpacket: 32 [ 658.743891][ T1227] usb 1-1: config index 0 descriptor too short (expected 35577, got 27) [ 658.762129][ T1227] usb 1-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 658.777543][ T1227] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 658.817468][ T1227] usb 1-1: config 1 has no interface number 0 [ 658.858569][ T1227] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 658.912083][ T1227] usb 1-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 658.962201][ T1227] usb 1-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 658.995623][ T1227] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 659.057645][ T1227] snd_usb_pod 1-1:1.1: Line 6 Pocket POD found [ 659.275379][ T1227] snd_usb_pod 1-1:1.1: Line 6 Pocket POD now attached [ 659.559071][ T5981] hid-generic 0000:3000000:0000.0018: unknown main item tag 0x4 [ 659.568572][ T5981] hid-generic 0000:3000000:0000.0018: unknown main item tag 0x2 [ 659.576788][ T5981] hid-generic 0000:3000000:0000.0018: unknown main item tag 0x0 [ 659.585124][ T5981] hid-generic 0000:3000000:0000.0018: unknown main item tag 0x0 [ 659.595294][ T5981] hid-generic 0000:3000000:0000.0018: unknown main item tag 0x0 [ 659.605890][ T5981] hid-generic 0000:3000000:0000.0018: unknown main item tag 0x0 [ 659.614995][ T5981] hid-generic 0000:3000000:0000.0018: unknown main item tag 0x0 [ 659.623275][ T5981] hid-generic 0000:3000000:0000.0018: unknown main item tag 0x0 [ 659.631032][ T5981] hid-generic 0000:3000000:0000.0018: unknown main item tag 0x0 [ 659.639153][ T5981] hid-generic 0000:3000000:0000.0018: unknown main item tag 0x0 [ 659.649129][ T5981] hid-generic 0000:3000000:0000.0018: hidraw0: HID v0.00 Device [sy] on syz0 [ 659.673142][ T1227] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 659.689126][ T5981] usb 1-1: USB disconnect, device number 69 [ 659.697812][ T5981] snd_usb_pod 1-1:1.1: Line 6 Pocket POD now disconnected [ 659.763688][T13675] fido_id[13675]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 659.844632][ T1227] usb 2-1: config 0 has an invalid interface number: 239 but max is 0 [ 659.853091][ T1227] usb 2-1: config 0 has no interface number 0 [ 659.861634][ T1227] usb 2-1: New USB device found, idVendor=6189, idProduct=182d, bcdDevice= 1.73 [ 659.871028][ T1227] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 659.879732][ T1227] usb 2-1: Product: syz [ 659.884810][ T1227] usb 2-1: Manufacturer: syz [ 659.889588][ T1227] usb 2-1: SerialNumber: syz [ 659.900964][ T1227] usb 2-1: config 0 descriptor?? [ 659.979269][T13680] bridge0: entered promiscuous mode [ 660.524800][ T1227] asix 2-1:0.239 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 660.536135][ T1227] asix 2-1:0.239: probe with driver asix failed with error -32 [ 660.632993][ T5866] usb 1-1: new full-speed USB device number 70 using dummy_hcd [ 660.792173][ T5862] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 660.806488][ T5866] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 1024, setting to 64 [ 660.829701][ T5866] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 660.842487][ T5866] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 660.852124][ T5866] usb 1-1: Product: syz [ 660.862595][ T5866] usb 1-1: Manufacturer: syz [ 660.867447][ T5866] usb 1-1: SerialNumber: syz [ 660.876859][ T5866] usb 1-1: config 0 descriptor?? [ 660.897304][T13667] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 660.914670][T13688] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 660.916606][T13667] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 660.943907][ T5866] hub 1-1:0.0: bad descriptor, ignoring hub [ 660.949923][ T5866] hub 1-1:0.0: probe with driver hub failed with error -5 [ 660.951289][T13684] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 660.986455][ T5862] usb 5-1: Using ep0 maxpacket: 16 [ 660.991646][T13684] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 661.015031][ T5862] usb 5-1: config index 0 descriptor too short (expected 1316, got 36) [ 661.034806][ T5862] usb 5-1: config 0 has an invalid interface number: 157 but max is -1 [ 661.037547][T13667] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 661.063169][T13667] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 661.090533][ T5862] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 661.130274][ T5862] usb 5-1: config 0 has no interface number 0 [ 661.156851][ T5862] usb 5-1: config 0 interface 157 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 16 [ 661.191048][ T5862] usb 5-1: config 0 interface 157 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 661.229985][ T5862] usb 5-1: config 0 interface 157 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 661.244364][ T5862] usb 5-1: New USB device found, idVendor=0483, idProduct=3746, bcdDevice=94.86 [ 661.262258][ T5862] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 661.282119][ T5862] usb 5-1: Product: syz [ 661.286407][ T5862] usb 5-1: Manufacturer: syz [ 661.309414][ T5862] usb 5-1: SerialNumber: syz [ 661.315025][ T5866] usb 1-1: USB disconnect, device number 70 [ 661.364147][ T5862] usb 5-1: config 0 descriptor?? [ 661.370487][T13686] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 661.603195][ T5862] ftdi_sio 5-1:0.157: FTDI USB Serial Device converter detected [ 661.624782][ T5862] ftdi_sio ttyUSB0: unknown device type: 0x9486 [ 661.643965][ T5862] usb 5-1: USB disconnect, device number 96 [ 661.670120][ T5862] ftdi_sio 5-1:0.157: device disconnected [ 662.583742][ T5862] usb 2-1: USB disconnect, device number 82 [ 664.522169][ T5862] usb 4-1: new full-speed USB device number 100 using dummy_hcd [ 664.704425][ T5862] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 664.731382][ T5862] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 664.782229][ T5862] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 664.787243][T13750] random: crng reseeded on system resumption [ 664.833304][ T5862] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 664.849542][ T5862] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.922947][ T5862] usb 4-1: Product: syz [ 664.927232][ T5862] usb 4-1: Manufacturer: syz [ 664.942412][ T5862] usb 4-1: SerialNumber: syz [ 664.961876][ T5862] usb 4-1: config 0 descriptor?? [ 664.998384][T13741] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 665.015698][T13741] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 665.043836][ T5862] usb 4-1: ucan: probing device on interface #0 [ 665.308735][T13759] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2158'. [ 665.372417][ T5866] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 665.512216][ T5866] usb 5-1: device descriptor read/64, error -71 [ 665.687176][ T5862] ucan 4-1:0.0 can0: registered device [ 665.762196][ T5866] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 665.892174][ T5866] usb 5-1: device descriptor read/64, error -71 [ 665.899949][ T5862] ucan 4-1:0.0 can0: firmware string: unknown [ 665.907714][ T5996] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 665.936200][T13750] Unrecognized hibernate image header format! [ 665.946355][T13750] PM: hibernation: Image mismatch: architecture specific data [ 665.972131][T13751] Unrecognized hibernate image header format! [ 665.993072][T13751] PM: hibernation: Image mismatch: architecture specific data [ 666.004118][ T5866] usb usb5-port1: attempt power cycle [ 666.072356][ T5996] usb 2-1: Using ep0 maxpacket: 8 [ 666.090858][ T5996] usb 2-1: New USB device found, idVendor=0763, idProduct=2080, bcdDevice=d0.ab [ 666.122724][T13741] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 666.142109][ T5996] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.167612][T13741] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 666.178202][ T5996] usb 2-1: Product: syz [ 666.192220][T13741] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2159'. [ 666.221946][ T5996] usb 2-1: Manufacturer: syz [ 666.228352][ T5996] usb 2-1: SerialNumber: syz [ 666.245160][ T5996] usb 2-1: config 0 descriptor?? [ 666.251826][T13741] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 666.282607][T13741] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 666.356229][ T5866] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 666.379042][T13768] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2166'. [ 666.394926][ T5866] usb 5-1: device descriptor read/8, error -71 [ 666.397829][T13771] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 666.429623][T13771] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 666.622490][ T5981] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 666.642362][ T5866] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 666.804996][ T5866] usb 5-1: device descriptor read/8, error -71 [ 666.812282][ T5981] usb 1-1: Using ep0 maxpacket: 32 [ 666.820019][ T5981] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 666.833595][ T5981] usb 1-1: config 0 has no interface number 0 [ 666.900575][ T5981] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 666.910165][ T5981] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.922528][ T5866] usb usb5-port1: unable to enumerate USB device [ 666.923897][ T5981] usb 1-1: Product: syz [ 666.960746][ T5981] usb 1-1: Manufacturer: syz [ 666.985951][ T5981] usb 1-1: SerialNumber: syz [ 667.009851][ T5981] usb 1-1: config 0 descriptor?? [ 667.030752][ T5981] smsc95xx v2.0.0 [ 667.244154][ T5981] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 667.276789][ T5981] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 667.471850][ T1227] usb 4-1: USB disconnect, device number 100 [ 667.637266][ T5981] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 667.677088][ T5981] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -32 [ 668.366334][ T5866] usb 1-1: USB disconnect, device number 71 [ 668.873922][ T5996] usb 2-1: USB disconnect, device number 83 [ 669.394534][ T5964] udevd[5964]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 669.998819][T13846] binder: BINDER_SET_CONTEXT_MGR already set [ 670.005035][T13846] binder: 13837:13846 ioctl 4018620d 200000000040 returned -16 [ 670.015592][T13846] binder: 13837:13846 ioctl c0306201 200000000240 returned -11 [ 670.272258][ T1227] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 670.439238][ T30] audit: type=1326 audit(1754527491.805:652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13849 comm="syz.4.2178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 670.462391][ T1227] usb 2-1: Using ep0 maxpacket: 16 [ 670.475366][ T1227] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 670.502130][ T1227] usb 2-1: config 0 has no interface number 0 [ 670.515947][ T1227] usb 2-1: config 0 interface 1 has no altsetting 0 [ 670.619392][ T30] audit: type=1326 audit(1754527491.855:653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13849 comm="syz.4.2178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 670.789137][ T1227] usb 2-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=ff.7e [ 671.310665][ T1227] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.393696][ T1227] usb 2-1: Product: syz [ 671.398027][ T1227] usb 2-1: Manufacturer: syz [ 671.407426][ T30] audit: type=1326 audit(1754527491.855:654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13849 comm="syz.4.2178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 671.448568][ T1227] usb 2-1: SerialNumber: syz [ 671.523376][ T1227] usb 2-1: config 0 descriptor?? [ 671.631006][ T30] audit: type=1326 audit(1754527491.855:655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13849 comm="syz.4.2178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 671.752795][ T30] audit: type=1326 audit(1754527491.855:656): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13849 comm="syz.4.2178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 671.940596][ T30] audit: type=1326 audit(1754527491.855:657): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13849 comm="syz.4.2178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 672.164374][ T30] audit: type=1326 audit(1754527491.855:658): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13849 comm="syz.4.2178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 672.355525][ T30] audit: type=1326 audit(1754527491.855:659): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13849 comm="syz.4.2178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 672.606545][ T30] audit: type=1326 audit(1754527491.855:660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13849 comm="syz.4.2178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 672.812403][ T30] audit: type=1326 audit(1754527491.855:661): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13849 comm="syz.4.2178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 674.296685][ T1227] i2c-cp2615 2-1:0.1: probe with driver i2c-cp2615 failed with error -71 [ 674.305788][ T5981] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 674.348736][ T1227] usb 2-1: USB disconnect, device number 84 [ 674.682087][ T5981] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 674.699688][ T5981] usb 5-1: config 0 has no interface number 0 [ 674.716717][ T5981] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 674.905129][ T5981] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 674.926097][ T5981] usb 5-1: config 0 descriptor?? [ 674.968939][ T5981] cp210x 5-1:0.1: cp210x converter detected [ 675.379451][ T5981] cp210x 5-1:0.1: failed to get vendor val 0x000e size 3: -32 [ 675.389080][ T5981] cp210x 5-1:0.1: failed to get vendor val 0x3711 size 2: -71 [ 675.421281][ T5981] cp210x 5-1:0.1: GPIO initialisation failed: -71 [ 675.472647][ T5996] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 675.473640][ T5981] usb 5-1: cp210x converter now attached to ttyUSB0 [ 675.491088][T13925] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2193'. [ 675.532403][ T5981] usb 5-1: USB disconnect, device number 101 [ 675.563122][ T5981] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 675.602172][ T5981] cp210x 5-1:0.1: device disconnected [ 675.645064][ T5996] usb 2-1: Using ep0 maxpacket: 16 [ 675.776631][ T5996] usb 2-1: New USB device found, idVendor=0483, idProduct=1234, bcdDevice=ff.76 [ 675.811019][ T5996] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 675.845637][ T5996] usb 2-1: Product: syz [ 675.860150][ T5996] usb 2-1: Manufacturer: syz [ 675.880415][ T5996] usb 2-1: SerialNumber: syz [ 675.918158][ T5996] usb 2-1: config 0 descriptor?? [ 676.198710][ T5996] usb 2-1: ignoring: not an USB2CAN converter [ 676.733926][T13911] vlan0: entered promiscuous mode [ 677.222371][ T5996] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 677.392337][ T5996] usb 5-1: Using ep0 maxpacket: 16 [ 677.406832][ T5996] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 677.439421][ T5996] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 677.459425][ T5996] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 677.473143][ T5996] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 677.482480][ T5996] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 677.507003][ T5996] usb 5-1: config 0 descriptor?? [ 677.935957][ T5996] hid_parser_main: 6 callbacks suppressed [ 677.935985][ T5996] microsoft 0003:045E:07DA.0019: unknown main item tag 0x1 [ 677.951753][ T5996] microsoft 0003:045E:07DA.0019: unknown main item tag 0x0 [ 677.959461][ T5996] microsoft 0003:045E:07DA.0019: unknown main item tag 0x0 [ 677.967417][ T5996] microsoft 0003:045E:07DA.0019: unknown main item tag 0x0 [ 677.975486][ T5996] microsoft 0003:045E:07DA.0019: unknown main item tag 0x0 [ 677.983315][ T5996] microsoft 0003:045E:07DA.0019: unknown main item tag 0x0 [ 677.997158][ T5981] usb 1-1: new full-speed USB device number 72 using dummy_hcd [ 678.030483][ T5996] input: HID 045e:07da as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:045E:07DA.0019/input/input51 [ 678.058539][ T5996] microsoft 0003:045E:07DA.0019: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0 [ 678.101155][ T5956] usb 2-1: USB disconnect, device number 85 [ 678.136006][ C0] raw-gadget.2 gadget.4: ignoring, device is not running [ 678.168835][ T5996] usb 5-1: USB disconnect, device number 102 [ 678.185408][ T5981] usb 1-1: too many configurations: 175, using maximum allowed: 8 [ 678.208941][ T5981] usb 1-1: config 7 has an invalid interface number: 192 but max is 0 [ 678.228566][ T5981] usb 1-1: config 7 has no interface number 0 [ 678.236002][ T5981] usb 1-1: config 7 interface 192 altsetting 7 endpoint 0x1 has invalid wMaxPacketSize 0 [ 678.246823][ T5981] usb 1-1: config 7 interface 192 has no altsetting 0 [ 678.261356][ T5981] usb 1-1: config 7 has an invalid interface number: 192 but max is 0 [ 678.274598][T13948] fido_id[13948]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 678.308808][ T5981] usb 1-1: config 7 has no interface number 0 [ 678.335054][ T5981] usb 1-1: config 7 interface 192 altsetting 7 endpoint 0x1 has invalid wMaxPacketSize 0 [ 678.365989][ T5981] usb 1-1: config 7 interface 192 has no altsetting 0 [ 678.379377][ T5981] usb 1-1: config 7 has an invalid interface number: 192 but max is 0 [ 678.396032][ T5981] usb 1-1: config 7 has no interface number 0 [ 678.404865][ T5981] usb 1-1: config 7 interface 192 altsetting 7 endpoint 0x1 has invalid wMaxPacketSize 0 [ 678.415944][ T5981] usb 1-1: config 7 interface 192 has no altsetting 0 [ 678.425292][ T5981] usb 1-1: config 7 has an invalid interface number: 192 but max is 0 [ 678.435128][ T5981] usb 1-1: config 7 has no interface number 0 [ 678.441397][ T5981] usb 1-1: config 7 interface 192 altsetting 7 endpoint 0x1 has invalid wMaxPacketSize 0 [ 678.453778][ T5981] usb 1-1: config 7 interface 192 has no altsetting 0 [ 678.464183][ T5981] usb 1-1: config 7 has an invalid interface number: 192 but max is 0 [ 678.477099][ T5981] usb 1-1: config 7 has no interface number 0 [ 678.505075][ T5981] usb 1-1: config 7 interface 192 altsetting 7 endpoint 0x1 has invalid wMaxPacketSize 0 [ 678.524964][ T5981] usb 1-1: config 7 interface 192 has no altsetting 0 [ 678.634436][T13954] ptrace attach of "./syz-executor exec"[5880] was attempted by "./syz-executor exec"[13954] [ 678.845556][ T5981] usb 1-1: config 7 has an invalid interface number: 192 but max is 0 [ 678.855670][ T5981] usb 1-1: config 7 has no interface number 0 [ 678.862251][ T5981] usb 1-1: config 7 interface 192 altsetting 7 endpoint 0x1 has invalid wMaxPacketSize 0 [ 678.873417][ T5981] usb 1-1: config 7 interface 192 has no altsetting 0 [ 678.886484][ T5981] usb 1-1: config 7 has an invalid interface number: 192 but max is 0 [ 678.895320][ T5981] usb 1-1: config 7 has no interface number 0 [ 678.901605][ T5981] usb 1-1: config 7 interface 192 altsetting 7 endpoint 0x1 has invalid wMaxPacketSize 0 [ 678.917846][ T5981] usb 1-1: config 7 interface 192 has no altsetting 0 [ 678.948998][ T5981] usb 1-1: config 7 has an invalid interface number: 192 but max is 0 [ 678.958558][ T5981] usb 1-1: config 7 has no interface number 0 [ 678.979197][ T5981] usb 1-1: config 7 interface 192 altsetting 7 endpoint 0x1 has invalid wMaxPacketSize 0 [ 679.012965][ T5981] usb 1-1: config 7 interface 192 has no altsetting 0 [ 679.029527][ T5981] usb 1-1: New USB device found, idVendor=09fb, idProduct=ebbe, bcdDevice=d4.8d [ 679.051299][ T5981] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.068585][ T5981] usb 1-1: Product: syz [ 679.091880][ T5981] usb 1-1: Manufacturer: syz [ 679.104335][ T5981] usb 1-1: SerialNumber: syz [ 679.854530][ T5981] usb 1-1: USB disconnect, device number 72 [ 680.035699][T13964] netlink: 240 bytes leftover after parsing attributes in process `syz.2.2204'. [ 680.183649][T13960] netlink: 'syz.3.2202': attribute type 5 has an invalid length. [ 680.461253][T13971] loop2: detected capacity change from 0 to 7 [ 680.469163][T13971] Dev loop2: unable to read RDB block 7 [ 680.479115][T13971] loop2: unable to read partition table [ 680.485744][T13971] loop2: partition table beyond EOD, truncated [ 680.492482][T13971] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 680.587814][T13972] sctp: [Deprecated]: syz.1.2206 (pid 13972) Use of int in maxseg socket option. [ 680.587814][T13972] Use struct sctp_assoc_value instead [ 681.270718][ T5956] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 681.472558][ T5956] usb 1-1: config 0 has no interfaces? [ 681.497867][ T5956] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 681.522510][ T5956] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 681.594230][ T5956] usb 1-1: Product: syz [ 681.623359][ T5956] usb 1-1: Manufacturer: syz [ 681.635261][ T5956] usb 1-1: SerialNumber: syz [ 681.671682][ T5956] usb 1-1: config 0 descriptor?? [ 681.759402][T13985] binder: 13984:13985 ioctl 4018620d 0 returned -22 [ 681.980886][T13976] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 681.993875][T13976] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 682.372230][ T5955] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 682.532246][ T5955] usb 5-1: Using ep0 maxpacket: 16 [ 682.557247][ T5955] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 682.602340][ T5955] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 682.638588][ T5955] usb 5-1: Product: syz [ 682.652244][ T5955] usb 5-1: Manufacturer: syz [ 682.692836][ T5955] usb 5-1: SerialNumber: syz [ 682.710220][ T5955] usb 5-1: config 0 descriptor?? [ 683.122943][ T5955] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 683.138678][ T5955] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 683.170426][ T5955] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 683.189162][ T5955] usb 5-1: media controller created [ 683.241417][ T5955] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 683.324200][T13992] dtv5100: wlen = 0, aborting. [ 683.422451][ T5955] zl10353_read_register: readreg error (reg=127, ret==0) [ 683.453442][ T5955] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 683.479433][ T5955] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 683.520967][T13996] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2215'. [ 683.538557][ T5955] usb 5-1: USB disconnect, device number 103 [ 683.637971][ T5955] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 683.805573][ T1227] usb 4-1: new full-speed USB device number 101 using dummy_hcd [ 683.998616][ T1227] usb 4-1: unable to get BOS descriptor or descriptor too short [ 684.015682][ T1227] usb 4-1: not running at top speed; connect to a high speed hub [ 684.034561][ T1227] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 684.072464][ T1227] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 684.098167][ T1227] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 684.116032][ T1227] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 684.182775][ T1227] usb 4-1: Product: syz [ 684.187309][ T1227] usb 4-1: Manufacturer: syz [ 684.676766][ T1227] usb 4-1: SerialNumber: syz [ 684.956159][T13996] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2215'. [ 684.971344][T13996] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2215'. [ 684.998140][ T5956] usb 1-1: USB disconnect, device number 73 [ 685.029790][ T1227] usb 4-1: 0:2 : does not exist [ 685.035219][ T1227] usb 4-1: unit 4 not found! [ 685.081646][ T1227] usb 4-1: 5:0: cannot get min/max values for control 2 (id 5) [ 685.116635][ T1227] usb 4-1: 5:0: cannot get min/max values for control 3 (id 5) [ 685.180373][ T1227] usb 4-1: 5:0: cannot get min/max values for control 3 (id 5) [ 685.221574][ T1227] usb 4-1: USB disconnect, device number 101 [ 685.265562][ T6019] udevd[6019]: setting owner of /dev/mixer3 to uid=0, gid=29 failed: No such file or directory [ 685.289461][ T5964] udevd[5964]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 687.337261][T14035] binder: 14033:14035 ioctl 4018620d 0 returned -22 [ 687.489993][T14009] syz.4.2220 (14009): drop_caches: 2 [ 687.903464][ T5956] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 688.066510][ T5956] usb 1-1: Using ep0 maxpacket: 16 [ 688.080451][ T5956] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 69, changing to 10 [ 688.098829][ T5956] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 17984, setting to 1024 [ 688.124025][ T5956] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 688.165665][ T5956] usb 1-1: New USB device found, idVendor=046d, idProduct=c531, bcdDevice= 0.00 [ 688.185347][ T5956] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 688.212886][ T5956] usb 1-1: config 0 descriptor?? [ 688.231787][T14047] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 688.626654][T14067] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 688.649434][T14047] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 688.672612][T14047] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 688.708953][T14047] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2227'. [ 688.808534][ T5956] logitech-djreceiver 0003:046D:C531.001A: ignoring exceeding usage max [ 688.991841][ T5956] usb 1-1: USB disconnect, device number 74 [ 689.042213][ T5955] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 689.192500][ T5955] usb 4-1: device descriptor read/64, error -71 [ 689.283409][ T5866] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 689.444357][ T5866] usb 5-1: config 0 has an invalid interface number: 9 but max is 0 [ 689.462574][ T5955] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 689.474701][ T5866] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 689.504427][ T5866] usb 5-1: config 0 has no interface number 0 [ 689.510722][ T5866] usb 5-1: New USB device found, idVendor=0421, idProduct=0302, bcdDevice=45.e8 [ 689.532111][ T5866] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 689.553399][ T5866] usb 5-1: config 0 descriptor?? [ 689.564280][ T5866] rndis_host 5-1:0.9: More than one union descriptor, skipping ... [ 689.582436][ T5866] rndis_host 5-1:0.9: skipping garbage [ 689.587991][ T5866] usb 5-1: bad CDC descriptors [ 689.598141][ T5866] cdc_acm 5-1:0.9: More than one union descriptor, skipping ... [ 689.612508][ T5955] usb 4-1: device descriptor read/64, error -71 [ 689.638131][ T5866] cdc_acm 5-1:0.9: skipping garbage [ 690.018956][ T5955] usb usb4-port1: attempt power cycle [ 690.148631][T14092] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 690.157488][T14092] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 690.472094][ T5955] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 690.493004][ T5955] usb 4-1: device descriptor read/8, error -71 [ 690.782102][ T5955] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 690.802764][ T5955] usb 4-1: device descriptor read/8, error -71 [ 690.912498][ T5955] usb usb4-port1: unable to enumerate USB device [ 691.220094][T14103] binder: 14102:14103 ioctl 4018620d 0 returned -22 [ 691.356995][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 691.363772][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 692.091853][ T5866] usb 5-1: USB disconnect, device number 104 [ 692.222254][ T5955] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 692.390256][ T5955] usb 4-1: Using ep0 maxpacket: 8 [ 692.445039][ T5955] usb 4-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 692.466771][ T5955] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 692.501497][ T5955] usb 4-1: Product: syz [ 692.535736][ T5955] usb 4-1: Manufacturer: syz [ 692.559699][ T5955] usb 4-1: SerialNumber: syz [ 692.584098][ T5955] usb 4-1: config 0 descriptor?? [ 692.595970][ T5955] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 692.823346][T14140] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2251'. [ 692.893858][T14145] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2250'. [ 693.321653][T14159] binder: BINDER_SET_CONTEXT_MGR already set [ 693.362495][T14159] binder: 14157:14159 ioctl 4018620d 200000004a80 returned -16 [ 693.861048][T14183] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2264'. [ 694.922628][ T5955] gspca_sonixj: reg_w1 err -110 [ 695.042231][ T5955] sonixj 4-1:0.0: probe with driver sonixj failed with error -110 [ 695.043359][T14207] netlink: 'syz.4.2270': attribute type 12 has an invalid length. [ 695.080668][T14207] netlink: 'syz.4.2270': attribute type 29 has an invalid length. [ 695.129774][T14207] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2270'. [ 695.159532][T14207] netlink: 59 bytes leftover after parsing attributes in process `syz.4.2270'. [ 695.343559][ T5981] usb 4-1: USB disconnect, device number 106 [ 695.362421][ T5866] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 695.524261][ T5866] usb 5-1: config 1 has an invalid descriptor of length 161, skipping remainder of the config [ 695.546817][ T5866] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 695.563237][ T5866] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 695.572643][ T5866] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 695.592209][ T5866] usb 5-1: SerialNumber: syz [ 695.829417][T14202] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 695.905334][T14202] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 695.936472][ T5866] usb 5-1: 0:2 : does not exist [ 695.977178][ T5866] usb 5-1: unit 5: unexpected type 0x09 [ 696.036742][ T5866] usb 5-1: USB disconnect, device number 105 [ 696.084246][T14220] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2275'. [ 696.138881][ T5964] udevd[5964]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 696.315528][T14226] binder: BINDER_SET_CONTEXT_MGR already set [ 696.321776][T14226] binder: 14225:14226 ioctl 4018620d 200000004a80 returned -16 [ 696.502312][ T5955] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 696.602271][ T5866] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 696.652432][ T5955] usb 4-1: Using ep0 maxpacket: 32 [ 696.661612][ T5955] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 696.673266][ T5955] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 696.685108][ T5955] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 696.694684][ T5955] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 696.713218][ T5955] usb 4-1: config 0 descriptor?? [ 696.754962][ T5866] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 696.765926][ T5866] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 696.775339][ T5866] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 696.792752][ T5866] usb 2-1: config 0 descriptor?? [ 696.804578][ T5866] pwc: Askey VC010 type 2 USB webcam detected. [ 697.052292][ T1227] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 697.132843][ T5955] ft260 0003:0403:6030.001B: unknown main item tag 0x7 [ 697.202473][ T1227] usb 5-1: Using ep0 maxpacket: 8 [ 697.211609][ T5866] pwc: recv_control_msg error -32 req 02 val 2b00 [ 697.214817][ T1227] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 697.219496][ T5866] pwc: recv_control_msg error -32 req 02 val 2700 [ 697.236818][ T1227] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 697.240378][ T5866] pwc: recv_control_msg error -32 req 02 val 2c00 [ 697.247494][ T1227] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 697.261714][ T1227] usb 5-1: Product: syz [ 697.267278][ T1227] usb 5-1: Manufacturer: syz [ 697.269843][ T5866] pwc: recv_control_msg error -32 req 04 val 1000 [ 697.272742][ T1227] usb 5-1: SerialNumber: syz [ 697.288623][ T5866] pwc: recv_control_msg error -32 req 04 val 1300 [ 697.291370][ T1227] usb 5-1: config 0 descriptor?? [ 697.307378][ T5866] pwc: recv_control_msg error -32 req 04 val 1400 [ 697.309747][ T1227] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 697.324238][ T5955] ft260 0003:0403:6030.001B: chip code: 6424 8183 [ 697.482277][ T5981] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 697.525697][T14224] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 697.537096][ T5955] ft260 0003:0403:6030.001B: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.3-1/input0 [ 697.547937][ T5866] pwc: recv_control_msg error -71 req 02 val 2100 [ 697.564791][ T5866] pwc: recv_control_msg error -71 req 04 val 1500 [ 697.576477][ T5866] pwc: recv_control_msg error -71 req 02 val 2500 [ 697.585381][ T5866] pwc: recv_control_msg error -71 req 02 val 2400 [ 697.593707][ T5866] pwc: recv_control_msg error -71 req 02 val 2600 [ 697.601192][ T5866] pwc: recv_control_msg error -71 req 02 val 2900 [ 697.611025][ T5866] pwc: recv_control_msg error -71 req 02 val 2800 [ 697.618511][ T5866] pwc: recv_control_msg error -71 req 04 val 1100 [ 697.628537][ T5866] pwc: recv_control_msg error -71 req 04 val 1200 [ 697.638698][ T5866] pwc: Registered as video103. [ 697.648252][ T5866] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input52 [ 697.657318][ T5981] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 697.682494][ T5866] usb 2-1: USB disconnect, device number 86 [ 697.689132][ T5981] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 697.730774][ T5981] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 697.746443][ T5981] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 697.764204][ T5981] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 697.782252][ T5981] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 697.799012][ T5981] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 697.808960][ T5981] usb 1-1: Product: syz [ 697.820731][ T5981] usb 1-1: Manufacturer: syz [ 697.840663][ T5981] cdc_wdm 1-1:1.0: skipping garbage [ 697.846335][ T5981] cdc_wdm 1-1:1.0: skipping garbage [ 697.854114][ T5981] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 697.860272][ T5981] cdc_wdm 1-1:1.0: Unknown control protocol [ 697.944717][ T5955] ft260 0003:0403:6030.001B: failed to retrieve status: -71 [ 697.954056][ T5955] ft260 0003:0403:6030.001B: failed to reset I2C controller: -71 [ 697.977660][ T5955] usb 4-1: USB disconnect, device number 107 [ 698.045976][ T5981] usb 1-1: USB disconnect, device number 75 [ 699.053399][T14261] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2286'. [ 699.231084][T14266] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2286'. [ 699.322201][ T1227] gspca_zc3xx: reg_r err -32 [ 699.952102][ T1227] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 699.958477][ T1227] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -32 [ 700.232357][ T5866] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 700.403459][ T5866] usb 2-1: no configurations [ 700.422302][ T5866] usb 2-1: can't read configurations, error -22 [ 700.538699][T14281] binder: BINDER_SET_CONTEXT_MGR already set [ 700.545953][T14281] binder: 14280:14281 ioctl 4018620d 200000004a80 returned -16 [ 700.592299][ T5866] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 700.650527][T14278] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 700.657140][T14278] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 700.671377][T14278] vhci_hcd vhci_hcd.0: Device attached [ 700.712849][T14284] vhci_hcd: connection closed [ 700.713910][ T1158] vhci_hcd: stop threads [ 700.729129][ T1158] vhci_hcd: release socket [ 700.737341][ T1158] vhci_hcd: disconnect device [ 700.755113][T14288] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 700.759705][ T5866] usb 2-1: no configurations [ 700.776660][ T5866] usb 2-1: can't read configurations, error -22 [ 700.785810][T14288] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 700.796049][ T5866] usb usb2-port1: attempt power cycle [ 701.142352][ T5866] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 701.191179][ T5866] usb 2-1: no configurations [ 701.205083][ T5866] usb 2-1: can't read configurations, error -22 [ 701.342620][ T5866] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 701.403677][ T5866] usb 2-1: no configurations [ 701.412986][ T5866] usb 2-1: can't read configurations, error -22 [ 701.433341][ T5866] usb usb2-port1: unable to enumerate USB device [ 701.752158][ T1227] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 701.782484][ T5866] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 701.796194][ T5981] usb 5-1: USB disconnect, device number 106 [ 701.934420][ T1227] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 701.944109][ T1227] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 701.957493][ T1227] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 701.957597][ T5866] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 701.970001][ T5866] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 701.977202][ T1227] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 701.995607][ T5866] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 701.998505][ T1227] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 702.011213][ T5866] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 702.030586][ T5866] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 702.039362][ T1227] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 702.056130][ T1227] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 702.064862][ T1227] usb 4-1: Product: syz [ 702.069312][ T1227] usb 4-1: Manufacturer: syz [ 702.082722][ T5866] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 702.094140][ T5866] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 702.102493][ T5866] usb 1-1: Product: syz [ 702.107065][ T5866] usb 1-1: Manufacturer: syz [ 702.108428][ T1227] cdc_wdm 4-1:1.0: skipping garbage [ 702.119726][ T5866] cdc_wdm 1-1:1.0: skipping garbage [ 702.129052][ T1227] cdc_wdm 4-1:1.0: skipping garbage [ 702.132275][ T5866] cdc_wdm 1-1:1.0: skipping garbage [ 702.148569][ T1227] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 702.155814][ T1227] cdc_wdm 4-1:1.0: Unknown control protocol [ 702.182794][ T5866] cdc_wdm 1-1:1.0: cdc-wdm1: USB WDM device [ 702.188953][ T5866] cdc_wdm 1-1:1.0: Unknown control protocol [ 702.261810][T14318] loop2: detected capacity change from 0 to 7 [ 702.270432][ T6019] Dev loop2: unable to read RDB block 7 [ 702.276523][ T6019] loop2: unable to read partition table [ 702.285098][ T6019] loop2: partition table beyond EOD, truncated [ 702.300917][T14318] Dev loop2: unable to read RDB block 7 [ 702.307310][T14318] loop2: unable to read partition table [ 702.316890][ T1227] usb 4-1: USB disconnect, device number 108 [ 702.332889][T14302] cdc_wdm 4-1:1.0: Error submitting int urb - -19 [ 702.341891][T14318] loop2: partition table beyond EOD, truncated [ 702.358613][T14318] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 702.550786][ T5981] usb 1-1: USB disconnect, device number 76 [ 702.627892][T14320] syzkaller0: entered promiscuous mode [ 702.633929][T14320] syzkaller0: entered allmulticast mode [ 703.676373][T14334] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2304'. [ 704.554322][ T1227] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 704.847390][ T1227] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 704.870253][ T1227] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 704.936159][ T1227] usb 1-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 705.009862][ T1227] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 705.050414][ T1227] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 705.123281][ T1227] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 705.138029][ T1227] usb 1-1: invalid MIDI out EP 0 [ 705.373817][T14342] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 705.384566][T14342] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 705.699149][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 705.699164][ T30] audit: type=1326 audit(1754527527.125:698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14338 comm="syz.0.2305" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4ab518ebe9 code=0x0 [ 705.867554][ T1227] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 707.128017][ T5981] usb 1-1: USB disconnect, device number 77 [ 709.176686][T14337] tipc: Enabled bearer , priority 0 [ 709.185778][T14340] syzkaller0: entered promiscuous mode [ 709.191467][T14340] syzkaller0: entered allmulticast mode [ 709.437945][T14345] tipc: Resetting bearer [ 709.504519][T14345] tipc: Disabling bearer [ 709.632119][ T5996] usb 1-1: new full-speed USB device number 78 using dummy_hcd [ 709.833125][ T5996] usb 1-1: not running at top speed; connect to a high speed hub [ 709.853354][ T5996] usb 1-1: config 95 has an invalid interface number: 1 but max is 0 [ 709.866636][ T5996] usb 1-1: config 95 has no interface number 0 [ 709.891188][ T5996] usb 1-1: config 95 interface 1 has no altsetting 0 [ 709.965293][ T5996] usb 1-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 710.022125][ T5955] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 710.042177][ T5996] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 710.065502][ T5996] usb 1-1: Product: syz [ 710.077927][ T5996] usb 1-1: Manufacturer: syz [ 710.088930][ T5996] usb 1-1: SerialNumber: syz [ 710.215896][ T5955] usb 2-1: too many endpoints for config 0 interface 0 altsetting 10: 254, using maximum allowed: 30 [ 710.232256][ T5955] usb 2-1: config 0 interface 0 altsetting 10 endpoint 0x81 has an invalid bInterval 64, changing to 10 [ 710.251182][ T5955] usb 2-1: config 0 interface 0 altsetting 10 has 2 endpoint descriptors, different from the interface descriptor's value: 254 [ 710.271212][ T5955] usb 2-1: config 0 interface 0 has no altsetting 0 [ 710.278573][ T5955] usb 2-1: New USB device found, idVendor=1477, idProduct=1006, bcdDevice= 0.00 [ 710.290936][ T5955] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 710.323466][ T5955] usb 2-1: config 0 descriptor?? [ 710.372107][ T5981] usb 4-1: new full-speed USB device number 109 using dummy_hcd [ 710.557344][ T5981] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 710.575591][ T5981] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 710.616089][ T5981] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 710.655359][ T5981] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 710.690161][ T5981] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 710.720794][ T5981] usb 4-1: Product: syz [ 710.736665][ T5981] usb 4-1: Manufacturer: syz [ 710.752547][ T5981] usb 4-1: SerialNumber: syz [ 710.951190][ T5955] usb 2-1: string descriptor 0 read error: -71 [ 710.970016][ T5955] usbhid 2-1:0.0: can't add hid device: -71 [ 710.991583][ T5955] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 711.028378][ T5955] usb 2-1: USB disconnect, device number 91 [ 711.312648][ T5981] usb 4-1: USB disconnect, device number 109 [ 711.369062][ T6019] udevd[6019]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 711.510082][T14389] netlink: 'syz.1.2316': attribute type 5 has an invalid length. [ 712.522407][T14411] netlink: 'syz.3.2321': attribute type 2 has an invalid length. [ 712.551151][T14411] : entered promiscuous mode [ 712.871353][T14416] netlink: 84 bytes leftover after parsing attributes in process `syz.4.2322'. [ 713.221912][ T30] audit: type=1326 audit(1754527534.615:699): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14407 comm="syz.4.2322" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x0 [ 713.777811][ T5996] usb 1-1: USB disconnect, device number 78 [ 713.871308][ C0] vkms_vblank_simulate: vblank timer overrun [ 714.094806][T14425] input: syz1 as /devices/virtual/input/input53 [ 714.326420][ T5964] udevd[5964]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:95.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 715.234106][ T30] audit: type=1326 audit(1754527536.665:700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14429 comm="syz.4.2327" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x0 [ 715.385585][T14438] netlink: 'syz.0.2329': attribute type 3 has an invalid length. [ 715.409143][T14438] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2329'. [ 715.455278][T14438] netlink: 'syz.0.2329': attribute type 3 has an invalid length. [ 715.467131][T14438] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2329'. [ 715.500998][T14438] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 715.737293][T14438] bond6: entered promiscuous mode [ 715.743371][T14438] bond6: entered allmulticast mode [ 715.753941][T14438] 8021q: adding VLAN 0 to HW filter on device bond6 [ 715.898939][ T5996] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 715.974662][T14444] binder: 14443:14444 ioctl c0306201 2000000003c0 returned -14 [ 715.985518][T14444] binder: 14443:14444 ioctl c0306201 200000000440 returned -14 [ 716.097804][ T5996] usb 4-1: Using ep0 maxpacket: 8 [ 716.170400][ T5996] usb 4-1: New USB device found, idVendor=0ab4, idProduct=0014, bcdDevice=c4.18 [ 716.202741][ T5996] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 716.243728][ T5996] usb 4-1: Product: syz [ 716.255781][ T5996] usb 4-1: Manufacturer: syz [ 716.260659][ T5996] usb 4-1: SerialNumber: syz [ 716.300872][T14446] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 716.332915][ T5996] usb 4-1: config 0 descriptor?? [ 716.356094][ T5996] esd_usb 4-1:0.0: sending version message failed [ 716.396817][ T5996] esd_usb 4-1:0.0: probe with driver esd_usb failed with error -22 [ 717.002152][ T5996] usb 5-1: new full-speed USB device number 107 using dummy_hcd [ 717.049763][T14465] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2336'. [ 717.065422][ T30] audit: type=1326 audit(1754527538.475:701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14463 comm="syz.2.2336" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dd518ebe9 code=0x7ffc0000 [ 717.087952][ C0] vkms_vblank_simulate: vblank timer overrun [ 717.136279][T14464] loop2: detected capacity change from 0 to 7 [ 717.141938][ T30] audit: type=1326 audit(1754527538.475:702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14463 comm="syz.2.2336" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dd518ebe9 code=0x7ffc0000 [ 717.171322][ T30] audit: type=1326 audit(1754527538.475:703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14463 comm="syz.2.2336" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f0dd518ebe9 code=0x7ffc0000 [ 717.204180][ T5996] usb 5-1: config index 0 descriptor too short (expected 69, got 36) [ 717.215113][T14464] Dev loop2: unable to read RDB block 7 [ 717.221027][ T5996] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 717.225258][T14464] loop2: unable to read partition table [ 717.245808][ T30] audit: type=1326 audit(1754527538.475:704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14463 comm="syz.2.2336" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dd518ebe9 code=0x7ffc0000 [ 717.269306][ C0] vkms_vblank_simulate: vblank timer overrun [ 717.283187][ T30] audit: type=1326 audit(1754527538.475:705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14463 comm="syz.2.2336" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dd518ebe9 code=0x7ffc0000 [ 717.308268][ T5996] usb 5-1: New USB device found, idVendor=093a, idProduct=2622, bcdDevice=b7.89 [ 717.318176][ T5996] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 717.328623][ T5996] usb 5-1: Product: syz [ 717.369660][ T5996] usb 5-1: Manufacturer: syz [ 717.382312][ T5996] usb 5-1: SerialNumber: syz [ 717.392776][T14464] loop2: partition table beyond EOD, truncated [ 717.397229][ T5996] usb 5-1: config 0 descriptor?? [ 717.408180][ T30] audit: type=1326 audit(1754527538.475:706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14463 comm="syz.2.2336" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f0dd518ebe9 code=0x7ffc0000 [ 717.414361][T14464] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 717.466455][ T5996] gspca_main: gspca_pac7302-2.14.0 probing 093a:2622 [ 717.488884][ T30] audit: type=1326 audit(1754527538.555:707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14463 comm="syz.2.2336" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dd518ebe9 code=0x7ffc0000 [ 717.573728][ T30] audit: type=1326 audit(1754527538.565:708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14463 comm="syz.2.2336" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7f0dd518ebe9 code=0x7ffc0000 [ 717.613806][ T5233] Dev loop2: unable to read RDB block 7 [ 717.662229][ T5233] loop2: unable to read partition table [ 717.720369][ T5233] loop2: partition table beyond EOD, truncated [ 718.059672][T14483] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2340'. [ 718.240762][ T5866] usb 4-1: USB disconnect, device number 110 [ 718.402340][ T5996] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 718.409633][ T5996] gspca_pac7302 5-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 718.862917][ T5996] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 719.024130][ T5996] usb 2-1: config 0 has an invalid interface number: 239 but max is 0 [ 719.035038][ T5996] usb 2-1: config 0 has no interface number 0 [ 719.053535][ T5996] usb 2-1: New USB device found, idVendor=6189, idProduct=182d, bcdDevice= 1.73 [ 719.068372][ T5996] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 719.095258][ T5996] usb 2-1: Product: syz [ 719.102860][ T5996] usb 2-1: Manufacturer: syz [ 719.111622][ T5996] usb 2-1: SerialNumber: syz [ 719.130950][ T5996] usb 2-1: config 0 descriptor?? [ 719.361028][ T5981] hid-generic 00A0:0006:0003.001C: unknown main item tag 0x0 [ 719.407065][ T5981] hid-generic 00A0:0006:0003.001C: unknown main item tag 0x0 [ 719.436578][ T5981] hid-generic 00A0:0006:0003.001C: unknown main item tag 0x0 [ 719.463770][ T5981] hid-generic 00A0:0006:0003.001C: unknown main item tag 0x0 [ 719.471710][ T5981] hid-generic 00A0:0006:0003.001C: unknown main item tag 0x0 [ 719.479468][ T5981] hid-generic 00A0:0006:0003.001C: unknown main item tag 0x0 [ 719.488533][ T5981] hid-generic 00A0:0006:0003.001C: unknown main item tag 0x0 [ 719.499933][ T5981] hid-generic 00A0:0006:0003.001C: unknown main item tag 0x0 [ 719.509061][ T5981] hid-generic 00A0:0006:0003.001C: unknown main item tag 0x0 [ 719.527021][ T5981] hid-generic 00A0:0006:0003.001C: unknown main item tag 0x0 [ 719.561496][ T5981] hid-generic 00A0:0006:0003.001C: hidraw0: HID v0.05 Device [syz1] on syz0 [ 719.585053][ T5996] asix 2-1:0.239 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 719.630087][ T5996] asix 2-1:0.239: probe with driver asix failed with error -71 [ 719.710346][ T5996] usb 2-1: USB disconnect, device number 92 [ 720.028325][T14499] fido_id[14499]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 720.068367][ T5866] usb 5-1: USB disconnect, device number 107 [ 720.182079][T14507] tipc: Enabled bearer , priority 0 [ 720.182618][ T5996] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 720.196560][T14507] syzkaller0: entered promiscuous mode [ 720.203065][ T5981] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 720.330760][T14507] syzkaller0: entered allmulticast mode [ 720.382363][ T5996] usb 2-1: Using ep0 maxpacket: 32 [ 720.549525][ T5996] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 720.590330][ T5996] usb 2-1: config 0 has no interface number 0 [ 720.638121][ T5996] usb 2-1: config 0 interface 184 has no altsetting 0 [ 720.638814][ T5981] usb 1-1: config 0 has no interfaces? [ 720.714204][ T5996] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 720.738269][ T5981] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 720.782435][ T5981] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 720.806855][ T5996] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 720.809308][ T5981] usb 1-1: Product: syz [ 720.835844][ T5981] usb 1-1: Manufacturer: syz [ 720.845992][ T5981] usb 1-1: SerialNumber: syz [ 720.890371][ T5981] usb 1-1: config 0 descriptor?? [ 720.981275][ T5996] usb 2-1: Product: syz [ 721.007552][ T5996] usb 2-1: Manufacturer: syz [ 721.031775][ T5996] usb 2-1: SerialNumber: syz [ 721.049624][ T5996] usb 2-1: config 0 descriptor?? [ 721.058508][T14519] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2349'. [ 721.067682][ T5955] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 721.083124][ T5996] smsc75xx v1.0.0 [ 721.118551][T14519] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2349'. [ 721.254478][ T5955] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 256 [ 721.317203][ T5955] usb 4-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 721.347214][T14502] tipc: Enabled bearer , priority 0 [ 721.373606][ T5955] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.99 [ 721.405257][ T5955] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 721.415666][T14522] loop2: detected capacity change from 0 to 7 [ 721.438900][T14523] syzkaller0: entered promiscuous mode [ 721.450258][T14522] Dev loop2: unable to read RDB block 7 [ 721.471035][T14507] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 721.480795][T14522] loop2: unable to read partition table [ 721.507545][T14522] loop2: partition table beyond EOD, truncated [ 721.509573][T14523] syzkaller0: entered allmulticast mode [ 721.523907][T14522] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 721.593877][ T5955] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 721.625056][ T5955] usb 4-1: invalid MIDI out EP 0 [ 721.688813][T14523] tipc: Resetting bearer [ 721.806389][T14507] tipc: Resetting bearer [ 721.991077][T14506] tipc: Resetting bearer [ 722.035281][ T5955] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 722.058790][T14506] tipc: Disabling bearer [ 722.159918][ T5955] usb 4-1: USB disconnect, device number 111 [ 722.184949][ T5996] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 722.199579][ T5996] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 722.215041][ T5996] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 722.995676][ T5996] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -61 [ 723.106929][ T5866] usb 1-1: USB disconnect, device number 79 [ 723.225826][T14533] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2353'. [ 723.765557][T14543] netlink: 668 bytes leftover after parsing attributes in process `syz.4.2355'. [ 723.815414][T14543] netlink: 668 bytes leftover after parsing attributes in process `syz.4.2355'. [ 723.988698][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 723.988719][ T30] audit: type=1804 audit(1754527545.415:713): pid=14547 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.2355" name="file1" dev="ramfs" ino=50028 res=1 errno=0 [ 724.102885][T14546] tipc: Enabled bearer , priority 0 [ 724.200151][T14548] syzkaller0: entered promiscuous mode [ 724.206547][T14548] syzkaller0: entered allmulticast mode [ 724.279884][T14548] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2356'. [ 724.589128][T14523] tipc: Resetting bearer [ 724.936874][T14523] tipc: Disabling bearer [ 725.059475][ T5866] usb 2-1: USB disconnect, device number 93 [ 725.070173][T14538] tipc: Resetting bearer [ 725.326487][T14538] tipc: Disabling bearer [ 725.586263][ T5866] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 725.683009][T14563] 8021q: adding VLAN 0 to HW filter on device bond10 [ 725.695063][T14563] bond0: (slave bond10): Enslaving as an active interface with an up link [ 725.808206][ T5866] usb 5-1: New USB device found, idVendor=0b95, idProduct=772b, bcdDevice=a2.4c [ 725.843151][ T5866] usb 5-1: New USB device strings: Mfr=24, Product=2, SerialNumber=3 [ 725.847378][T14568] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2361'. [ 725.868666][ T5866] usb 5-1: Product: syz [ 725.881005][ T5866] usb 5-1: Manufacturer: syz [ 725.908970][ T5866] usb 5-1: SerialNumber: syz [ 725.949020][ T5866] usb 5-1: config 0 descriptor?? [ 726.042315][T14572] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.2362'. [ 726.362583][ T5955] usb 4-1: new full-speed USB device number 112 using dummy_hcd [ 726.712622][T14556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 726.778829][T14556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 726.820361][ T5866] asix 5-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 726.841305][ T5866] asix 5-1:0.0: probe with driver asix failed with error -71 [ 726.858709][ T5866] usb 5-1: USB disconnect, device number 108 [ 726.929110][ T5955] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 726.943644][ T5955] usb 4-1: config 0 has no interface number 0 [ 726.972364][ T5955] usb 4-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 727.001431][ T5955] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 727.103715][ T5955] usb 4-1: Product: syz [ 727.138840][ T5955] usb 4-1: Manufacturer: syz [ 727.147915][ T5955] usb 4-1: SerialNumber: syz [ 727.167526][ T5955] usb 4-1: config 0 descriptor?? [ 727.182909][ T5955] hub 4-1:0.132: bad descriptor, ignoring hub [ 727.192366][ T5955] hub 4-1:0.132: probe with driver hub failed with error -5 [ 727.242478][ T5955] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.132/input/input54 [ 727.822538][ T5981] usb 4-1: USB disconnect, device number 112 [ 729.219352][T14602] veth1_to_batadv: entered promiscuous mode [ 729.932369][ T5981] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 730.367220][T14623] tipc: Enabled bearer , priority 0 [ 730.375903][T14623] syzkaller0: entered promiscuous mode [ 730.381755][T14623] syzkaller0: entered allmulticast mode [ 730.393249][T14623] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2373'. [ 730.406878][T14623] tipc: Resetting bearer [ 731.185868][T14619] tipc: Resetting bearer [ 731.231617][T14619] tipc: Disabling bearer [ 731.545882][ T5981] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 732.164183][ T5981] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 732.173771][ T5981] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.233196][ T5981] usb 2-1: config 0 descriptor?? [ 732.702348][T14651] FAULT_INJECTION: forcing a failure. [ 732.702348][T14651] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 732.730502][T14651] CPU: 1 UID: 0 PID: 14651 Comm: syz.2.2380 Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 PREEMPT(full) [ 732.730535][T14651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 732.730555][T14651] Call Trace: [ 732.730564][T14651] [ 732.730576][T14651] dump_stack_lvl+0x189/0x250 [ 732.730608][T14651] ? __pfx____ratelimit+0x10/0x10 [ 732.730635][T14651] ? __pfx_dump_stack_lvl+0x10/0x10 [ 732.730660][T14651] ? __pfx__printk+0x10/0x10 [ 732.730691][T14651] ? __might_fault+0xb0/0x130 [ 732.730733][T14651] should_fail_ex+0x414/0x560 [ 732.730763][T14651] _copy_from_user+0x2d/0xb0 [ 732.730785][T14651] ___sys_sendmsg+0x158/0x2a0 [ 732.730821][T14651] ? __pfx____sys_sendmsg+0x10/0x10 [ 732.730891][T14651] ? __fget_files+0x2a/0x420 [ 732.730922][T14651] ? __fget_files+0x3a0/0x420 [ 732.730966][T14651] __x64_sys_sendmsg+0x19b/0x260 [ 732.731007][T14651] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 732.731050][T14651] ? __pfx_ksys_write+0x10/0x10 [ 732.731075][T14651] ? rcu_is_watching+0x15/0xb0 [ 732.731104][T14651] ? do_syscall_64+0xbe/0x3b0 [ 732.731137][T14651] do_syscall_64+0xfa/0x3b0 [ 732.731163][T14651] ? lockdep_hardirqs_on+0x9c/0x150 [ 732.731188][T14651] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.731210][T14651] ? clear_bhb_loop+0x60/0xb0 [ 732.731238][T14651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.731260][T14651] RIP: 0033:0x7f0dd518ebe9 [ 732.731281][T14651] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 732.731301][T14651] RSP: 002b:00007f0dd607a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 732.731325][T14651] RAX: ffffffffffffffda RBX: 00007f0dd53b5fa0 RCX: 00007f0dd518ebe9 [ 732.731341][T14651] RDX: 0000000000000004 RSI: 00002000000006c0 RDI: 0000000000000004 [ 732.731355][T14651] RBP: 00007f0dd607a090 R08: 0000000000000000 R09: 0000000000000000 [ 732.731369][T14651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 732.731382][T14651] R13: 00007f0dd53b6038 R14: 00007f0dd53b5fa0 R15: 00007f0dd54dfa28 [ 732.731416][T14651] [ 733.280655][T14661] input: syz1 as /devices/virtual/input/input55 [ 734.315271][ T5981] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 734.346146][ T5981] [drm:udl_init] *ERROR* Selecting channel failed [ 734.504714][ T5981] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 2 [ 734.562888][ T5981] [drm] Initialized udl on minor 2 [ 734.625575][ T5981] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 734.701556][ T5981] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 734.714641][T14687] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2387'. [ 734.762827][ T44] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 734.805574][ T5981] usb 2-1: USB disconnect, device number 95 [ 734.812993][ T44] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 735.307272][T14701] FAULT_INJECTION: forcing a failure. [ 735.307272][T14701] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 735.360106][T14701] CPU: 0 UID: 0 PID: 14701 Comm: syz.0.2391 Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 PREEMPT(full) [ 735.360139][T14701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 735.360154][T14701] Call Trace: [ 735.360164][T14701] [ 735.360174][T14701] dump_stack_lvl+0x189/0x250 [ 735.360207][T14701] ? __pfx____ratelimit+0x10/0x10 [ 735.360234][T14701] ? __pfx_dump_stack_lvl+0x10/0x10 [ 735.360261][T14701] ? __pfx__printk+0x10/0x10 [ 735.360305][T14701] should_fail_ex+0x414/0x560 [ 735.360356][T14701] _copy_to_user+0x31/0xb0 [ 735.360380][T14701] simple_read_from_buffer+0xe1/0x170 [ 735.360417][T14701] proc_fail_nth_read+0x1b3/0x220 [ 735.360446][T14701] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 735.360475][T14701] ? rw_verify_area+0x2a6/0x4d0 [ 735.360501][T14701] ? __lock_acquire+0xab9/0xd20 [ 735.360532][T14701] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 735.360558][T14701] vfs_read+0x200/0x980 [ 735.360585][T14701] ? fdget_pos+0x247/0x320 [ 735.360609][T14701] ? __pfx___mutex_lock+0x10/0x10 [ 735.360638][T14701] ? __pfx_vfs_read+0x10/0x10 [ 735.360668][T14701] ? __fget_files+0x2a/0x420 [ 735.360706][T14701] ? __fget_files+0x3a0/0x420 [ 735.360745][T14701] ? __fget_files+0x2a/0x420 [ 735.360788][T14701] ksys_read+0x145/0x250 [ 735.360820][T14701] ? __pfx_ksys_read+0x10/0x10 [ 735.360846][T14701] ? rcu_is_watching+0x15/0xb0 [ 735.360874][T14701] ? do_syscall_64+0xbe/0x3b0 [ 735.360906][T14701] do_syscall_64+0xfa/0x3b0 [ 735.360933][T14701] ? lockdep_hardirqs_on+0x9c/0x150 [ 735.360959][T14701] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 735.360981][T14701] ? clear_bhb_loop+0x60/0xb0 [ 735.361009][T14701] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 735.361030][T14701] RIP: 0033:0x7f4ab518d5fc [ 735.361050][T14701] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 735.361070][T14701] RSP: 002b:00007f4ab5f1f030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 735.361094][T14701] RAX: ffffffffffffffda RBX: 00007f4ab53b5fa0 RCX: 00007f4ab518d5fc [ 735.361110][T14701] RDX: 000000000000000f RSI: 00007f4ab5f1f0a0 RDI: 0000000000000005 [ 735.361125][T14701] RBP: 00007f4ab5f1f090 R08: 0000000000000000 R09: 0000000000000000 [ 735.361139][T14701] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 735.361152][T14701] R13: 00007f4ab53b6038 R14: 00007f4ab53b5fa0 R15: 00007f4ab54dfa28 [ 735.361187][T14701] [ 735.604948][ C0] vkms_vblank_simulate: vblank timer overrun [ 735.888319][T14708] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2395'. [ 736.408529][T14726] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2397'. [ 736.420903][T14726] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2397'. [ 737.693501][T14743] loop2: detected capacity change from 0 to 7 [ 737.731223][ T5964] Dev loop2: unable to read RDB block 7 [ 737.756663][ T5964] loop2: unable to read partition table [ 737.788053][ T5964] loop2: partition table beyond EOD, truncated [ 737.806290][T14743] Dev loop2: unable to read RDB block 7 [ 737.850661][T14743] loop2: unable to read partition table [ 737.889266][T14743] loop2: partition table beyond EOD, truncated [ 737.905800][ T5981] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 737.947348][T14743] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 738.082282][ T5981] usb 2-1: Using ep0 maxpacket: 32 [ 738.114826][ T5981] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 738.159096][ T5981] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 738.168679][ T44] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 738.197207][ T5981] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 738.252186][ T5981] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 738.280212][ T5981] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 738.310930][ T5981] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 738.357167][ T44] usb 5-1: config 0 has no interfaces? [ 738.374176][ T44] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 738.401030][ T5981] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 738.420044][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 738.428728][ T44] usb 5-1: Product: syz [ 738.428785][ T5981] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 738.447130][ T44] usb 5-1: Manufacturer: syz [ 738.452080][ T44] usb 5-1: SerialNumber: syz [ 738.473975][ T44] usb 5-1: config 0 descriptor?? [ 738.510894][ T5981] usb 2-1: config 0 descriptor?? [ 738.737998][ T5981] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 96 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 738.902178][T14757] tipc: Enabled bearer , priority 0 [ 738.943829][T14757] syzkaller0: entered promiscuous mode [ 739.038946][T14757] syzkaller0: entered allmulticast mode [ 739.045354][ T5981] usb 2-1: USB disconnect, device number 96 [ 739.361825][ T5981] usblp0: removed [ 739.711358][T14756] tipc: Resetting bearer [ 740.165174][T14756] tipc: Disabling bearer [ 740.292260][ T5981] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 740.422636][ T5981] usb 2-1: device descriptor read/64, error -71 [ 740.552411][T14771] [U] [ 740.555599][T14771] [U] [ 740.558341][T14771] [U] [ 740.561078][T14771] [U] [ 740.618648][T14771] [U] [ 740.621417][T14771] [U] [ 740.624120][T14771] [U] [ 740.626904][T14771] [U] [ 740.696696][T14775] [U] [ 741.279579][ T5996] usb 5-1: USB disconnect, device number 109 [ 741.802496][T14792] netem: invalid attributes len -8 [ 741.807805][T14792] netem: change failed [ 741.868075][ T51] Bluetooth: hci2: unexpected event for opcode 0x0060 [ 743.269350][T14815] netlink: 'syz.2.2421': attribute type 10 has an invalid length. [ 743.300420][T14812] ptrace attach of "./syz-executor exec"[5880] was attempted by "./syz-executor exec"[14812] [ 743.318110][T14815] team0: Port device dummy0 added [ 743.379784][T14815] netlink: 'syz.2.2421': attribute type 10 has an invalid length. [ 743.410628][T14815] team0: Port device dummy0 removed [ 743.441334][T14815] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 743.591506][T14815] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2421'. [ 744.289137][T14822] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 744.348895][T14822] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2424'. [ 745.057674][ T5996] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 745.273741][T14842] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2427'. [ 745.386388][ T30] audit: type=1326 audit(1754527566.715:714): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14826 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f103718ebe9 code=0x7ffc0000 [ 745.420841][ T5996] usb 1-1: config 0 has no interfaces? [ 745.436086][T14841] kvm: kvm [14840]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x8aa6 [ 745.453567][ T30] audit: type=1326 audit(1754527566.715:715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14826 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f103718ebe9 code=0x7ffc0000 [ 745.487442][ T5996] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 745.497278][T14841] kvm: kvm [14840]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x733e [ 745.519101][ T30] audit: type=1326 audit(1754527566.715:716): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14826 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f103718ebe9 code=0x7ffc0000 [ 745.546783][T14841] kvm: kvm [14840]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0xdb9f [ 745.646196][ T5996] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.646236][ T30] audit: type=1326 audit(1754527566.715:717): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14826 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f103718ebe9 code=0x7ffc0000 [ 745.664360][ T5996] usb 1-1: Product: syz [ 745.743073][ T5996] usb 1-1: Manufacturer: syz [ 745.757003][ T5996] usb 1-1: SerialNumber: syz [ 745.779063][ T5996] usb 1-1: config 0 descriptor?? [ 745.850022][ T30] audit: type=1326 audit(1754527566.715:718): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14826 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f103718ebe9 code=0x7ffc0000 [ 746.172071][ T30] audit: type=1326 audit(1754527566.715:719): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14826 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f103718ebe9 code=0x7ffc0000 [ 746.291160][T14843] pim6reg: entered allmulticast mode [ 746.319172][T14843] pim6reg: left allmulticast mode [ 746.335951][ T30] audit: type=1326 audit(1754527566.715:720): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14826 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f103718ebe9 code=0x7ffc0000 [ 746.366096][ T30] audit: type=1326 audit(1754527566.715:721): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14826 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f103718ebe9 code=0x7ffc0000 [ 746.407616][ T30] audit: type=1326 audit(1754527566.715:722): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14826 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f103718ebe9 code=0x7ffc0000 [ 746.675245][ T30] audit: type=1326 audit(1754527566.725:723): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14826 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f103718ebe9 code=0x7ffc0000 [ 746.880889][T14850] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 747.139544][T14850] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 747.192098][T14854] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2430'. [ 747.274698][T14854] vlan0: entered allmulticast mode [ 747.281343][T14854] macvtap0: entered allmulticast mode [ 747.295277][T14854] veth0_macvtap: entered allmulticast mode [ 747.682368][T14860] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 748.103700][ T5981] usb 1-1: USB disconnect, device number 80 [ 748.282720][ T5996] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 748.464955][ T5996] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 748.475403][ T5996] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 748.501509][T14872] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 748.534140][T14872] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2434'. [ 748.571412][ T5996] usb 4-1: New USB device found, idVendor=0499, idProduct=5ae2, bcdDevice= 9.0f [ 748.581042][ T5996] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=7 [ 748.590227][ T5996] usb 4-1: Product: syz [ 748.600385][ T5996] usb 4-1: Manufacturer: syz [ 748.610123][ T5996] usb 4-1: SerialNumber: syz [ 748.673470][ T5996] usb 4-1: config 0 descriptor?? [ 748.964452][T14867] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 748.998766][T14866] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 749.107072][T14866] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 749.115283][T14867] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 749.497703][ T5996] usb 4-1: USB disconnect, device number 113 [ 749.560466][ T5964] udevd[5964]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 750.033342][T14888] IPVS: set_ctl: invalid protocol: 1 0.0.0.0:0 [ 750.525860][ T5981] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 750.690570][T14896] bridge2: entered promiscuous mode [ 750.768202][ T5981] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 750.781288][ T5981] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 751.269625][ T5981] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 751.279038][ T5981] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 751.295612][T14890] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 751.330820][ T5981] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 751.554173][T14890] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 751.702770][T14890] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 751.795250][ T5981] usb 5-1: USB disconnect, device number 110 [ 752.795482][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 752.801880][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 753.332406][ T5981] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 753.508267][ T5981] usb 5-1: Using ep0 maxpacket: 32 [ 753.524188][ T5981] usb 5-1: config 4 has an invalid interface number: 128 but max is 0 [ 753.560768][ T5981] usb 5-1: config 4 has no interface number 0 [ 753.611195][ T5981] usb 5-1: config 4 interface 128 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 753.848312][ T5981] usb 5-1: config 4 interface 128 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 753.951828][ T5996] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 753.956489][ T5981] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 754.040052][ T5981] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 754.106409][ T5981] hub 5-1:4.128: USB hub found [ 754.133065][ T5996] usb 2-1: Using ep0 maxpacket: 32 [ 754.150114][ T5996] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 754.225940][ T5996] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 754.309050][ T5996] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 754.309744][ T5981] hub 5-1:4.128: 2 ports detected [ 754.320961][ T5996] usb 2-1: Product: syz [ 754.327158][ T5996] usb 2-1: Manufacturer: syz [ 754.337295][ T5981] hub 5-1:4.128: Using single TT (err -22) [ 754.351099][ T5996] usb 2-1: SerialNumber: syz [ 754.508745][ T5996] usb 2-1: config 0 descriptor?? [ 754.522673][T14919] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 754.540862][ T5996] hub 2-1:0.0: bad descriptor, ignoring hub [ 754.551805][ T5996] hub 2-1:0.0: probe with driver hub failed with error -5 [ 754.653489][ T5981] hub 5-1:4.128: hub_hub_status failed (err = -71) [ 754.720590][ T5981] hub 5-1:4.128: config failed, can't get hub status (err -71) [ 754.892516][ T5996] usb 2-1: USB disconnect, device number 99 [ 754.956781][ T5981] usb 5-1: USB disconnect, device number 111 [ 755.542276][ T5996] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 755.644962][T14939] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2451'. [ 755.702501][ T5996] usb 1-1: Using ep0 maxpacket: 8 [ 755.740817][ T5996] usb 1-1: unable to get BOS descriptor or descriptor too short [ 755.753531][ T5996] usb 1-1: config 4 has an invalid interface number: 147 but max is 0 [ 755.775373][ T5996] usb 1-1: config 4 contains an unexpected descriptor of type 0x2, skipping [ 755.801659][ T5996] usb 1-1: config 4 has no interface number 0 [ 755.821046][ T5996] usb 1-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 755.845024][ T5996] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 755.855814][ T5996] usb 1-1: Product: syz [ 755.860201][ T5996] usb 1-1: Manufacturer: syz [ 755.868287][ T5996] usb 1-1: SerialNumber: syz [ 756.152622][ T5866] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 756.323730][ T5866] usb 4-1: Using ep0 maxpacket: 8 [ 756.354415][ T5866] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 756.393692][ T5866] usb 4-1: config 179 has no interface number 0 [ 756.400078][ T5866] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 756.520369][T14968] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 756.534289][T14968] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 756.611025][ T5866] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 756.628743][ T5996] usb 1-1: Found UVC 0.02 device syz (04f2:b746) [ 756.635691][ T5996] usb 1-1: No valid video chain found. [ 756.644649][ T5866] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 756.651064][T14965] hsr0: entered promiscuous mode [ 756.662991][ T5996] usb 1-1: USB disconnect, device number 81 [ 756.672215][T14965] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2457'. [ 756.686817][T14965] hsr_slave_0: left promiscuous mode [ 756.695313][ T5866] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 756.719488][ T5866] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 756.734180][ T5866] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 756.743693][ T5866] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 756.806904][ T5981] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 756.832433][T14965] hsr_slave_1: left promiscuous mode [ 756.937997][T14965] hsr0 (unregistering): left promiscuous mode [ 756.985891][T14947] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 757.376059][T14981] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 757.571099][T14981] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 757.672200][ T5981] usb 2-1: device descriptor read/64, error -71 [ 757.956165][ T5981] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 758.142457][ T5981] usb 2-1: Using ep0 maxpacket: 32 [ 758.151093][ T5981] usb 2-1: config 0 has an invalid interface number: 184 but max is 11 [ 758.168871][ T5981] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 12 [ 758.181490][ T5981] usb 2-1: config 0 has no interface number 0 [ 758.192188][ T5981] usb 2-1: config 0 interface 184 has no altsetting 0 [ 758.211546][ T5981] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 758.221321][ T5981] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 758.239961][ T5981] usb 2-1: Product: syz [ 758.257754][ T5981] usb 2-1: Manufacturer: syz [ 758.272624][ T5981] usb 2-1: SerialNumber: syz [ 758.291095][ T5981] usb 2-1: config 0 descriptor?? [ 758.311774][ T5981] smsc75xx v1.0.0 [ 758.984072][ T44] usb 4-1: USB disconnect, device number 114 [ 758.984187][ C0] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 758.999128][ C0] dummy_hcd dummy_hcd.3: timer fired with no URBs pending? [ 759.014248][ T5981] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 759.035358][ T5981] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 759.137819][T14985] 8021q: adding VLAN 0 to HW filter on device bond11 [ 759.176588][T14985] bond11: entered promiscuous mode [ 759.238509][T14985] bond0: (slave bond11): Enslaving as an active interface with an up link [ 759.368963][T14988] kvm: pic: non byte read [ 759.390176][T14988] kvm: pic: level sensitive irq not supported [ 759.390264][T14988] kvm: pic: non byte read [ 759.414418][T14988] kvm: pic: level sensitive irq not supported [ 759.414495][T14988] kvm: pic: non byte read [ 759.431525][T14988] kvm: pic: level sensitive irq not supported [ 759.431696][T14988] kvm: pic: non byte read [ 759.484939][T14988] kvm: pic: level sensitive irq not supported [ 759.485044][T14988] kvm: pic: non byte read [ 759.536539][T14988] kvm: pic: level sensitive irq not supported [ 759.536620][T14988] kvm: pic: non byte read [ 759.851350][T14988] kvm: pic: level sensitive irq not supported [ 759.851430][T14988] kvm: pic: non byte read [ 759.868449][T14988] kvm: pic: level sensitive irq not supported [ 759.868582][T14988] kvm: pic: non byte read [ 759.880056][T14988] kvm: pic: level sensitive irq not supported [ 759.880156][T14988] kvm: pic: non byte read [ 760.017782][T14997] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2464'. [ 760.102928][T15001] loop2: detected capacity change from 0 to 7 [ 760.140408][T15001] Dev loop2: unable to read RDB block 7 [ 760.163708][T15001] loop2: unable to read partition table [ 760.192881][T15001] loop2: partition table beyond EOD, truncated [ 760.234604][T15001] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 760.743609][ T5981] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 760.755193][ T5981] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 760.778512][ T5981] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 760.831912][ T5981] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 760.874868][ T5981] usb 2-1: USB disconnect, device number 101 [ 761.282307][ T44] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 761.422248][ T44] usb 5-1: device descriptor read/64, error -71 [ 761.665068][ T44] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 761.812285][ T44] usb 5-1: device descriptor read/64, error -71 [ 761.958178][ T44] usb usb5-port1: attempt power cycle [ 762.047726][T15007] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2468'. [ 762.058513][T15007] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2468'. [ 762.495182][T15036] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 762.523664][ T44] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 762.562420][ T44] usb 5-1: device descriptor read/8, error -71 [ 762.783062][ T5996] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 762.823626][ T44] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 762.863120][ T44] usb 5-1: device descriptor read/8, error -71 [ 762.872732][T15044] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2477'. [ 762.978345][ T5996] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 763.015085][ T44] usb usb5-port1: unable to enumerate USB device [ 763.284898][ T5996] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 763.347203][ T5996] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 763.356827][ T5996] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 763.388601][ T5996] usb 2-1: Product: syz [ 763.419974][ T5996] usb 2-1: Manufacturer: syz [ 763.439063][ T5996] usb 2-1: SerialNumber: syz [ 763.481419][ T5996] hub 2-1:1.0: bad descriptor, ignoring hub [ 763.547075][ T5996] hub 2-1:1.0: probe with driver hub failed with error -5 [ 763.880318][ T5996] usb 2-1: USB disconnect, device number 102 [ 764.602526][ T5996] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 764.769861][T15065] tipc: Enabled bearer , priority 0 [ 764.788310][T15065] syzkaller0: entered promiscuous mode [ 764.806735][T15065] syzkaller0: entered allmulticast mode [ 764.916049][ T5996] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 764.941389][ T5996] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 765.025933][T15068] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2482'. [ 765.041404][T15068] tipc: Resetting bearer [ 765.154557][ T5996] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 765.249803][ T5996] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 765.268541][ T5996] usb 2-1: Product: syz [ 765.277546][ T5996] usb 2-1: Manufacturer: syz [ 765.287369][ T5996] usb 2-1: SerialNumber: syz [ 765.503530][T15062] tipc: Resetting bearer [ 765.548787][T15062] tipc: Disabling bearer [ 765.837685][ T5996] usb 2-1: can't set config #1, error -71 [ 765.863389][ T5996] usb 2-1: USB disconnect, device number 103 [ 766.044193][T15070] : entered promiscuous mode [ 766.656528][T15083] netlink: 'syz.1.2486': attribute type 9 has an invalid length. [ 766.699540][T15083] netlink: 212160 bytes leftover after parsing attributes in process `syz.1.2486'. [ 766.871824][T15078] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 766.886788][T15078] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2484'. [ 767.302361][ T5996] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 767.462092][ T5996] usb 2-1: Using ep0 maxpacket: 16 [ 767.532076][ T5996] usb 2-1: config 0 has an invalid interface number: 107 but max is 0 [ 767.591136][ T5996] usb 2-1: config 0 has no interface number 0 [ 767.686023][ T5996] usb 2-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 767.773735][ T5996] usb 2-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 767.880756][ T5996] usb 2-1: Product: syz [ 767.951669][ T5996] usb 2-1: Manufacturer: syz [ 767.967852][ T5996] usb 2-1: SerialNumber: syz [ 768.008299][ T5996] usb 2-1: config 0 descriptor?? [ 768.057378][T15097] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2489'. [ 768.085403][ T5996] keyspan 2-1:0.107: Keyspan 4 port adapter converter detected [ 768.108110][ T5996] keyspan 2-1:0.107: found no endpoint descriptor for endpoint 81 [ 768.153563][ T5996] keyspan 2-1:0.107: found no endpoint descriptor for endpoint 1 [ 768.169305][ T5996] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 768.186070][ T5996] keyspan 2-1:0.107: found no endpoint descriptor for endpoint 2 [ 768.200854][ T5996] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 768.257146][ T5996] keyspan 2-1:0.107: found no endpoint descriptor for endpoint 4 [ 768.294056][ T5996] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 768.358134][ T5996] keyspan 2-1:0.107: found no endpoint descriptor for endpoint 6 [ 768.468389][T15105] syzkaller1: entered promiscuous mode [ 768.474136][T15105] syzkaller1: entered allmulticast mode [ 768.553785][ T5996] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 769.984331][ T44] usb 2-1: USB disconnect, device number 104 [ 770.048352][ T44] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 770.109412][ T44] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 770.203296][ T44] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 770.275403][ T44] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 770.326515][ T44] keyspan 2-1:0.107: device disconnected [ 771.632108][ T5996] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 771.836911][ T5996] usb 5-1: config 0 has an invalid interface number: 249 but max is 0 [ 771.865744][ T5996] usb 5-1: config 0 has no interface number 0 [ 771.901393][ T5996] usb 5-1: config 0 interface 249 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 771.919989][ T5996] usb 5-1: config 0 interface 249 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 0 [ 771.941369][ T5996] usb 5-1: config 0 interface 249 altsetting 0 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 772.050850][ T5996] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=be.87 [ 772.067261][ T5996] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 772.095125][ T5996] usb 5-1: config 0 descriptor?? [ 772.106590][ T5996] port100 5-1:0.249: NFC: Could not find bulk-in or bulk-out endpoint [ 772.313887][T15138] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 772.351469][T15138] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 772.485124][ T5996] usb 5-1: USB disconnect, device number 116 [ 772.692876][T15152] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2503'. [ 773.172178][ T44] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 773.268626][T15167] input: syz1 as /devices/virtual/input/input56 [ 773.367013][ T44] usb 2-1: config 0 has no interfaces? [ 773.397474][ T44] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 773.491881][ T44] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 773.662233][ T5981] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 774.155676][ T44] usb 2-1: config 0 descriptor?? [ 774.275900][ T5981] usb 5-1: config 0 has no interfaces? [ 774.285260][ T5981] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 774.340376][ T5981] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 774.502198][ T5981] usb 5-1: Product: syz [ 774.506416][ T5981] usb 5-1: Manufacturer: syz [ 774.520409][ T5981] usb 5-1: SerialNumber: syz [ 774.658012][ T5981] usb 5-1: config 0 descriptor?? [ 775.486586][T15182] input: syz1 as /devices/virtual/input/input57 [ 776.001254][ T5996] usb 2-1: USB disconnect, device number 105 [ 776.111829][T15186] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2511'. [ 776.189047][T15155] delete_channel: no stack [ 776.555855][T15196] input: syz1 as /devices/virtual/input/input58 [ 776.636285][ T5981] usb 5-1: USB disconnect, device number 117 [ 777.222060][ T5981] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 777.262893][ T5996] usb 1-1: new low-speed USB device number 82 using dummy_hcd [ 777.401024][ T5981] usb 5-1: Using ep0 maxpacket: 16 [ 777.409541][ T5981] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 777.431508][ T5981] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 777.452268][ T5996] usb 1-1: Invalid ep0 maxpacket: 32 [ 777.462179][ T5981] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 777.482986][ T5981] usb 5-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 777.517825][ T5981] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 777.692254][ T5996] usb 1-1: new low-speed USB device number 83 using dummy_hcd [ 777.722727][ T5981] usb 5-1: config 0 descriptor?? [ 777.819458][T15217] random: crng reseeded on system resumption [ 777.952218][ T5996] usb 1-1: Invalid ep0 maxpacket: 32 [ 777.959370][ T5996] usb usb1-port1: attempt power cycle [ 778.078612][T15222] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 778.086676][T15222] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 778.332602][ T5996] usb 1-1: new low-speed USB device number 84 using dummy_hcd [ 778.368725][ T5996] usb 1-1: Invalid ep0 maxpacket: 32 [ 778.503309][ T5996] usb 1-1: new low-speed USB device number 85 using dummy_hcd [ 778.610406][ T5996] usb 1-1: Invalid ep0 maxpacket: 32 [ 778.627696][ T5996] usb usb1-port1: unable to enumerate USB device [ 779.182213][ T44] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 779.313396][ T44] usb 4-1: device descriptor read/64, error -71 [ 779.552488][ T44] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 780.091863][ T5981] usbhid 5-1:0.0: can't add hid device: -71 [ 780.099757][ T44] usb 4-1: device descriptor read/64, error -71 [ 780.106360][ T5981] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 780.131145][ T5981] usb 5-1: USB disconnect, device number 118 [ 780.219169][T15249] IPVS: set_ctl: invalid protocol: 44 0.0.0.0:20001 [ 780.233889][ T44] usb usb4-port1: attempt power cycle [ 780.349232][T15244] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2526'. [ 780.369678][T15254] netlink: 'syz.2.2530': attribute type 28 has an invalid length. [ 780.382221][T15254] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2530'. [ 780.882157][ T44] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 781.019043][ T44] usb 4-1: device descriptor read/8, error -71 [ 781.145056][T15257] input: syz1 as /devices/virtual/input/input59 [ 781.336357][ T44] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 781.457111][T15262] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2531'. [ 781.575226][ T44] usb 4-1: device descriptor read/8, error -71 [ 781.703294][ T44] usb usb4-port1: unable to enumerate USB device [ 781.989249][ T5996] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 782.278637][ T5996] usb 1-1: Using ep0 maxpacket: 16 [ 782.334253][ T5996] usb 1-1: config 0 has an invalid interface number: 68 but max is 0 [ 782.343270][ T5996] usb 1-1: config 0 has no interface number 0 [ 782.429005][ T5996] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 782.442533][ T5996] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 782.591759][ T5996] usb 1-1: Product: syz [ 782.681375][ T5996] usb 1-1: Manufacturer: syz [ 782.738145][ T5996] usb 1-1: SerialNumber: syz [ 782.807536][ T5996] usb 1-1: config 0 descriptor?? [ 782.912402][ T5996] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 783.994548][ T1158] usb 1-1: Failed to submit usb control message: -110 [ 784.016634][ T1158] usb 1-1: unable to send the bmi data to the device: -110 [ 784.047583][ T1158] usb 1-1: unable to get target info from device [ 784.098622][ T1158] usb 1-1: could not get target info (-110) [ 784.128095][ T1158] usb 1-1: could not probe fw (-110) [ 784.189509][T15293] loop6: detected capacity change from 0 to 1 [ 784.206258][ T5964] Dev loop6: unable to read RDB block 1 [ 784.221453][ T5964] loop6: unable to read partition table [ 784.294314][ T5964] loop6: partition table beyond EOD, truncated [ 784.318374][T15293] Dev loop6: unable to read RDB block 1 [ 784.324660][T15293] loop6: unable to read partition table [ 784.333391][T15293] loop6: partition table beyond EOD, truncated [ 784.339805][T15293] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 784.762145][ T5996] usb 1-1: USB disconnect, device number 86 [ 785.241121][T15309] input: syz1 as /devices/virtual/input/input60 [ 786.902198][ T44] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 787.119934][ T44] usb 1-1: device descriptor read/64, error -71 [ 787.426576][ T44] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 787.573875][ T44] usb 1-1: device descriptor read/64, error -71 [ 787.693094][ T44] usb usb1-port1: attempt power cycle [ 788.612163][ T5981] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 788.762725][ T44] usb usb1-port1: Cannot enable. Maybe the USB cable is bad? [ 788.800299][ T5981] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 788.863810][ T5981] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 788.875546][ T5981] usb 5-1: Product: syz [ 788.880386][ T5981] usb 5-1: Manufacturer: syz [ 788.890457][ T5981] usb 5-1: SerialNumber: syz [ 788.911614][ T5981] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 788.922899][ T44] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 788.987913][ T44] usb 1-1: Using ep0 maxpacket: 32 [ 788.995863][ T5955] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 789.019210][ T44] usb 1-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 0.01 [ 789.069582][ T44] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 789.131109][ T44] usb 1-1: Product: syz [ 789.142225][ T44] usb 1-1: Manufacturer: syz [ 789.147176][ T44] usb 1-1: SerialNumber: syz [ 789.210372][ T44] usb 1-1: config 0 descriptor?? [ 789.447049][ T44] usb 5-1: USB disconnect, device number 119 [ 789.480584][ T5866] usb 1-1: USB disconnect, device number 90 [ 790.222308][ T5955] usb 5-1: Service connection timeout for: 256 [ 790.231796][ T5955] ath9k_htc 5-1:1.0: ath9k_htc: Unable to initialize HTC services [ 790.253511][ T5955] ath9k_htc: Failed to initialize the device [ 790.272551][ T44] usb 5-1: ath9k_htc: USB layer deinitialized [ 790.631289][ T44] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 790.822649][ T44] usb 5-1: Using ep0 maxpacket: 8 [ 790.835564][ T44] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 790.851079][ T44] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 790.878414][ T44] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 790.889112][ T44] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 790.904235][ T44] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 790.930081][ T44] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 790.965994][ T44] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 791.232137][ T44] usb 5-1: GET_CAPABILITIES returned 0 [ 791.248549][ T44] usbtmc 5-1:16.0: can't read capabilities [ 791.740675][T15371] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 791.771090][T15371] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 792.060283][T15371] usbtmc 5-1:16.0: INITIATE_ABORT_BULK_IN returned 0 [ 793.492496][ T5866] usb 5-1: USB disconnect, device number 120 [ 793.608200][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 793.608221][ T30] audit: type=1326 audit(1754527615.025:755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15389 comm="syz.4.2566" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 793.710883][ T30] audit: type=1326 audit(1754527615.025:756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15389 comm="syz.4.2566" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 793.838257][ T30] audit: type=1326 audit(1754527615.025:757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15389 comm="syz.4.2566" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 794.053823][ T30] audit: type=1326 audit(1754527615.025:758): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15389 comm="syz.4.2566" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 794.176101][ T30] audit: type=1326 audit(1754527615.025:759): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15389 comm="syz.4.2566" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 794.252637][ T30] audit: type=1326 audit(1754527615.035:760): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15389 comm="syz.4.2566" exe="/root/syz-executor" sig=0 arch=c000003e syscall=47 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 794.334478][ T30] audit: type=1326 audit(1754527615.035:761): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15389 comm="syz.4.2566" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 794.396554][ T30] audit: type=1326 audit(1754527615.035:762): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15389 comm="syz.4.2566" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 794.426276][ T30] audit: type=1326 audit(1754527615.035:763): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15389 comm="syz.4.2566" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 794.522215][ T5996] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 794.621507][ T30] audit: type=1326 audit(1754527615.745:764): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15389 comm="syz.4.2566" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd1c58ebe9 code=0x7ffc0000 [ 794.709781][ T5996] usb 1-1: config 0 has no interfaces? [ 794.758832][ T5996] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 794.794502][ T5996] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 794.820794][ T5996] usb 1-1: Product: syz [ 794.835302][ T5996] usb 1-1: Manufacturer: syz [ 794.850320][ T5996] usb 1-1: SerialNumber: syz [ 794.882287][ T5955] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 794.935097][ T5996] usb 1-1: config 0 descriptor?? [ 795.062025][ T5955] usb 4-1: Using ep0 maxpacket: 32 [ 795.105264][ T5955] usb 4-1: config 0 has an invalid interface number: 101 but max is 1 [ 795.128446][ T5955] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 795.182045][ T5955] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 795.240394][ T5955] usb 4-1: config 0 has no interface number 0 [ 795.277715][ T5955] usb 4-1: config 0 interface 101 has no altsetting 0 [ 795.310929][ T5955] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice=59.84 [ 795.335364][ T5955] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 795.375339][ T5955] usb 4-1: config 0 descriptor?? [ 795.429199][ T5955] hub 4-1:0.101: bad descriptor, ignoring hub [ 795.473810][ T5955] hub 4-1:0.101: probe with driver hub failed with error -5 [ 795.784199][ T5955] usb 4-1: USB disconnect, device number 120 [ 795.796892][T15405] input: syz1 as /devices/virtual/input/input61 [ 796.716996][T13397] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 796.730297][T13397] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 796.747999][T13397] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 796.757479][T13397] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 796.765589][T13397] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 797.659717][T15410] chnl_net:caif_netlink_parms(): no params data found [ 798.284607][ T5955] usb 1-1: USB disconnect, device number 91 [ 798.286279][T15410] bridge0: port 1(bridge_slave_0) entered blocking state [ 798.308194][T15410] bridge0: port 1(bridge_slave_0) entered disabled state [ 798.318233][T15410] bridge_slave_0: entered allmulticast mode [ 798.479314][T15410] bridge_slave_0: entered promiscuous mode [ 798.521316][T15410] bridge0: port 2(bridge_slave_1) entered blocking state [ 798.557656][T15410] bridge0: port 2(bridge_slave_1) entered disabled state [ 798.596633][T15440] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2578'. [ 798.606100][T15410] bridge_slave_1: entered allmulticast mode [ 798.640532][T15410] bridge_slave_1: entered promiscuous mode [ 798.862847][T13397] Bluetooth: hci5: command tx timeout [ 800.944912][T13397] Bluetooth: hci5: command tx timeout [ 801.243157][T15460] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2586'. [ 803.022059][T13397] Bluetooth: hci5: command tx timeout [ 805.112274][T13397] Bluetooth: hci5: command tx timeout [ 814.225878][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 814.237299][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 814.898440][ T51] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 814.909721][ T51] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 814.922424][ T51] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 814.930708][ T51] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 814.942758][ T51] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 815.026807][ T51] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 815.043605][ T51] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 815.052663][ T51] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 815.062873][ T51] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 815.070674][ T51] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 815.428939][ T51] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 815.439186][ T51] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 815.456439][ T51] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 815.494600][ T51] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 815.511785][ T51] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 817.031698][ T51] Bluetooth: hci6: command tx timeout [ 817.102213][ T51] Bluetooth: hci7: command tx timeout [ 817.582398][ T51] Bluetooth: hci8: command tx timeout [ 817.772919][T13397] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 817.796487][T13397] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 817.805183][T13397] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 817.823146][T13397] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 817.842976][T13397] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 819.102667][ T51] Bluetooth: hci6: command tx timeout [ 819.182263][ T51] Bluetooth: hci7: command tx timeout [ 819.662180][ T51] Bluetooth: hci8: command tx timeout [ 819.903438][ T51] Bluetooth: hci9: command tx timeout [ 821.182261][ T51] Bluetooth: hci6: command tx timeout [ 821.264588][ T51] Bluetooth: hci7: command tx timeout [ 821.742208][ T51] Bluetooth: hci8: command tx timeout [ 821.982363][ T51] Bluetooth: hci9: command tx timeout [ 823.262829][ T51] Bluetooth: hci6: command tx timeout [ 823.342475][ T51] Bluetooth: hci7: command tx timeout [ 823.822352][ T51] Bluetooth: hci8: command tx timeout [ 824.062482][ T51] Bluetooth: hci9: command tx timeout [ 826.152114][ T51] Bluetooth: hci9: command tx timeout [ 856.018744][T13397] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 856.043080][T13397] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 856.051836][T13397] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 856.071044][T13397] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 856.085390][T13397] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 858.143585][ T51] Bluetooth: hci10: command tx timeout [ 860.224210][ T51] Bluetooth: hci10: command tx timeout [ 862.312307][ T51] Bluetooth: hci10: command tx timeout [ 864.392550][ T51] Bluetooth: hci10: command tx timeout [ 875.426782][ T5876] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 875.438099][ T5876] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 875.449507][T15489] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 875.455280][T15487] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 875.472336][T15487] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 875.482486][T15487] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 875.491681][T15489] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 875.514368][T15487] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 875.514472][T15489] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 875.544107][T15487] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 875.678789][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 875.685770][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 876.326662][T13397] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 876.342650][T13397] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 876.355904][T13397] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 876.384417][T13397] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 876.393007][T13397] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 877.582123][T13397] Bluetooth: hci12: command tx timeout [ 877.662139][T13397] Bluetooth: hci11: command tx timeout [ 878.205806][T15487] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 878.223604][T15487] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 878.232295][T15487] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 878.242770][T15487] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 878.252737][T15487] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 878.542327][T15487] Bluetooth: hci13: command tx timeout [ 879.662165][T15487] Bluetooth: hci12: command tx timeout [ 879.742231][T15487] Bluetooth: hci11: command tx timeout [ 880.302264][T15487] Bluetooth: hci14: command tx timeout [ 880.632814][T15487] Bluetooth: hci13: command tx timeout [ 881.743689][T15487] Bluetooth: hci12: command tx timeout [ 881.822603][T15487] Bluetooth: hci11: command tx timeout [ 882.382342][T15487] Bluetooth: hci14: command tx timeout [ 882.702167][T15487] Bluetooth: hci13: command tx timeout [ 883.823340][T15487] Bluetooth: hci12: command tx timeout [ 883.902065][T15487] Bluetooth: hci11: command tx timeout [ 884.463175][T15487] Bluetooth: hci14: command tx timeout [ 884.782059][T15487] Bluetooth: hci13: command tx timeout [ 886.542932][T15487] Bluetooth: hci14: command tx timeout [ 916.877152][T13397] Bluetooth: hci15: unexpected cc 0x0c03 length: 249 > 1 [ 916.915296][T13397] Bluetooth: hci15: unexpected cc 0x1003 length: 249 > 9 [ 916.962532][T13397] Bluetooth: hci15: unexpected cc 0x1001 length: 249 > 9 [ 916.987815][T13397] Bluetooth: hci15: unexpected cc 0x0c23 length: 249 > 4 [ 916.996673][T13397] Bluetooth: hci15: unexpected cc 0x0c38 length: 249 > 2 [ 919.022367][T15487] Bluetooth: hci15: command tx timeout [ 921.102279][T15487] Bluetooth: hci15: command tx timeout [ 923.182778][T15487] Bluetooth: hci15: command tx timeout [ 923.832611][T15487] Bluetooth: hci5: command 0x0406 tx timeout [ 925.262124][T13397] Bluetooth: hci15: command tx timeout [ 935.949497][T15487] Bluetooth: hci16: unexpected cc 0x0c03 length: 249 > 1 [ 935.966807][T15487] Bluetooth: hci16: unexpected cc 0x1003 length: 249 > 9 [ 935.976415][T15487] Bluetooth: hci16: unexpected cc 0x1001 length: 249 > 9 [ 935.985714][T15487] Bluetooth: hci16: unexpected cc 0x0c23 length: 249 > 4 [ 935.994587][T15487] Bluetooth: hci16: unexpected cc 0x0c38 length: 249 > 2 [ 936.007476][ T51] Bluetooth: hci17: unexpected cc 0x0c03 length: 249 > 1 [ 936.020816][ T51] Bluetooth: hci17: unexpected cc 0x1003 length: 249 > 9 [ 936.048050][ T51] Bluetooth: hci17: unexpected cc 0x1001 length: 249 > 9 [ 936.058046][ T51] Bluetooth: hci17: unexpected cc 0x0c23 length: 249 > 4 [ 936.068282][ T51] Bluetooth: hci17: unexpected cc 0x0c38 length: 249 > 2 [ 936.802309][ T51] Bluetooth: hci18: unexpected cc 0x0c03 length: 249 > 1 [ 936.828025][ T51] Bluetooth: hci18: unexpected cc 0x1003 length: 249 > 9 [ 936.837084][ T51] Bluetooth: hci18: unexpected cc 0x1001 length: 249 > 9 [ 936.845859][ T51] Bluetooth: hci18: unexpected cc 0x0c23 length: 249 > 4 [ 936.855382][ T51] Bluetooth: hci18: unexpected cc 0x0c38 length: 249 > 2 [ 937.115076][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 937.135844][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 938.062390][ T5876] Bluetooth: hci16: command tx timeout [ 938.142241][ T5876] Bluetooth: hci17: command tx timeout [ 938.726879][T13397] Bluetooth: hci19: unexpected cc 0x0c03 length: 249 > 1 [ 938.737607][T13397] Bluetooth: hci19: unexpected cc 0x1003 length: 249 > 9 [ 938.746878][T13397] Bluetooth: hci19: unexpected cc 0x1001 length: 249 > 9 [ 938.755508][T13397] Bluetooth: hci19: unexpected cc 0x0c23 length: 249 > 4 [ 938.775013][T13397] Bluetooth: hci19: unexpected cc 0x0c38 length: 249 > 2 [ 938.942143][ T5876] Bluetooth: hci18: command tx timeout [ 939.182560][ T5876] Bluetooth: hci8: command 0x0406 tx timeout [ 939.182950][T13397] Bluetooth: hci6: command 0x0406 tx timeout [ 939.188902][ T5876] Bluetooth: hci7: command 0x0406 tx timeout [ 940.143098][T15489] Bluetooth: hci16: command tx timeout [ 940.222204][T15489] Bluetooth: hci17: command tx timeout [ 940.862165][T15489] Bluetooth: hci19: command tx timeout [ 941.022215][T15489] Bluetooth: hci18: command tx timeout [ 942.222855][ T51] Bluetooth: hci16: command tx timeout [ 942.302923][T15489] Bluetooth: hci17: command tx timeout [ 942.952430][T15489] Bluetooth: hci19: command tx timeout [ 943.112327][T15489] Bluetooth: hci18: command tx timeout [ 944.302964][T15489] Bluetooth: hci9: command 0x0406 tx timeout [ 944.302972][T15487] Bluetooth: hci16: command tx timeout [ 944.382338][ T51] Bluetooth: hci17: command tx timeout [ 945.022120][ T51] Bluetooth: hci19: command tx timeout [ 945.182363][ T51] Bluetooth: hci18: command tx timeout [ 947.102137][ T51] Bluetooth: hci19: command tx timeout [ 947.343246][ T31] INFO: task kworker/0:3:5866 blocked for more than 143 seconds. [ 947.365672][ T31] Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 [ 947.374331][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 947.392030][ T31] task:kworker/0:3 state:D stack:21160 pid:5866 tgid:5866 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 947.428371][ T31] Workqueue: events switchdev_deferred_process_work [ 947.441698][ T31] Call Trace: [ 947.445624][ T31] [ 947.458395][ T31] __schedule+0x1798/0x4cc0 [ 947.482240][ T31] ? __pfx___schedule+0x10/0x10 [ 947.487827][ T31] ? schedule+0x91/0x360 [ 947.565033][ T31] schedule+0x165/0x360 [ 947.582437][ T31] schedule_preempt_disabled+0x13/0x30 [ 947.588101][ T31] __mutex_lock+0x7e6/0x1360 [ 947.593579][ T31] ? look_up_lock_class+0x74/0x170 [ 947.598757][ T31] ? __mutex_lock+0x5b6/0x1360 [ 947.604267][ T31] ? switchdev_deferred_process_work+0xe/0x20 [ 947.610492][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 947.616828][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 947.622856][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 947.628712][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 947.645496][ T31] switchdev_deferred_process_work+0xe/0x20 [ 947.652468][ T31] process_scheduled_works+0xade/0x17b0 [ 947.658600][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 947.665365][ T31] worker_thread+0x8a0/0xda0 [ 947.670290][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 947.682152][ T31] ? __kthread_parkme+0x7b/0x200 [ 947.687215][ T31] kthread+0x70e/0x8a0 [ 947.692361][ T31] ? __pfx_worker_thread+0x10/0x10 [ 947.697625][ T31] ? __pfx_kthread+0x10/0x10 [ 947.712993][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 947.722204][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 947.727546][ T31] ? __pfx_kthread+0x10/0x10 [ 947.733311][ T31] ret_from_fork+0x3fc/0x770 [ 947.742292][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 947.747552][ T31] ? __switch_to_asm+0x39/0x70 [ 947.754276][ T31] ? __switch_to_asm+0x33/0x70 [ 947.762452][ T31] ? __pfx_kthread+0x10/0x10 [ 947.767185][ T31] ret_from_fork_asm+0x1a/0x30 [ 947.776755][ T31] [ 947.782569][ T31] INFO: task syz-executor:15410 blocked for more than 143 seconds. [ 947.804104][ T31] Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 [ 947.811705][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 947.838704][ T31] task:syz-executor state:D stack:22632 pid:15410 tgid:15410 ppid:1 task_flags:0x400140 flags:0x00004004 [ 947.865904][ T31] Call Trace: [ 947.869801][ T31] [ 947.893984][ T31] __schedule+0x1798/0x4cc0 [ 947.898676][ T31] ? __pfx___schedule+0x10/0x10 [ 947.908739][ T31] ? schedule+0x91/0x360 [ 947.932377][ T31] schedule+0x165/0x360 [ 947.937978][ T31] schedule_preempt_disabled+0x13/0x30 [ 947.966040][ T31] __mutex_lock+0x7e6/0x1360 [ 947.970974][ T31] ? __mutex_lock+0x5b6/0x1360 [ 947.978526][ T31] ? rtnl_newlink+0x8db/0x1c70 [ 947.991991][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 947.997107][ T31] ? ns_capable+0x8a/0xf0 [ 948.017442][ T31] ? rtnl_link_get_net_capable+0x16a/0x350 [ 948.035826][ T31] rtnl_newlink+0x8db/0x1c70 [ 948.040779][ T31] ? __lock_acquire+0xab9/0xd20 [ 948.047346][ T31] ? __pfx_rtnl_newlink+0x10/0x10 [ 948.056746][ T31] ? __lock_acquire+0xab9/0xd20 [ 948.061710][ T31] ? __lock_acquire+0xab9/0xd20 [ 948.083302][ T31] ? __pfx_rtnl_newlink+0x10/0x10 [ 948.088727][ T31] rtnetlink_rcv_msg+0x7cc/0xb70 [ 948.098346][ T31] ? __lock_acquire+0xab9/0xd20 [ 948.104063][ T31] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 948.109285][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 948.132472][ T31] netlink_rcv_skb+0x205/0x470 [ 948.137404][ T31] ? __lock_acquire+0xab9/0xd20 [ 948.146750][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 948.185732][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 948.191123][ T31] ? netlink_deliver_tap+0x2e/0x1b0 [ 948.238231][ T31] netlink_unicast+0x82c/0x9e0 [ 948.244336][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 948.249972][ T31] ? netlink_sendmsg+0x642/0xb30 [ 948.259844][ T31] ? skb_put+0x11b/0x210 [ 948.264554][ T31] netlink_sendmsg+0x805/0xb30 [ 948.269473][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 948.292237][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 948.297481][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 948.308346][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 948.332277][ T31] __sock_sendmsg+0x219/0x270 [ 948.337119][ T31] __sys_sendto+0x3bd/0x520 [ 948.341762][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 948.354609][ T31] ? blkcg_maybe_throttle_current+0x1ab/0xb40 [ 948.361046][ T31] ? rcu_is_watching+0x15/0xb0 [ 948.367692][ T31] __x64_sys_sendto+0xde/0x100 [ 948.376188][ T31] do_syscall_64+0xfa/0x3b0 [ 948.380966][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 948.388187][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 948.412100][ T31] ? clear_bhb_loop+0x60/0xb0 [ 948.416858][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 948.427150][ T31] RIP: 0033:0x7f2068790a7c [ 948.431637][ T31] RSP: 002b:00007f2068adf650 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 948.476786][ T31] RAX: ffffffffffffffda RBX: 00007f20694e4620 RCX: 00007f2068790a7c [ 948.485658][ T31] RDX: 0000000000000068 RSI: 00007f20694e4670 RDI: 0000000000000003 [ 948.498949][ T31] RBP: 0000000000000000 R08: 00007f2068adf6a4 R09: 000000000000000c [ 948.507508][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 [ 948.546532][ T31] R13: 0000000000000000 R14: 00007f20694e4670 R15: 0000000000000000 [ 948.572108][ T31] [ 948.575564][ T31] INFO: task syz.4.2581:15437 blocked for more than 144 seconds. [ 948.607474][ T31] Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 [ 948.617276][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 948.639878][ T31] task:syz.4.2581 state:D stack:26408 pid:15437 tgid:15434 ppid:5886 task_flags:0x400140 flags:0x00004006 [ 948.664556][ T31] Call Trace: [ 948.668002][ T31] [ 948.677328][ T31] __schedule+0x1798/0x4cc0 [ 948.696561][ T31] ? __pfx___schedule+0x10/0x10 [ 948.701520][ T31] ? schedule+0x91/0x360 [ 948.715558][ T31] schedule+0x165/0x360 [ 948.719880][ T31] schedule_preempt_disabled+0x13/0x30 [ 948.735247][ T31] __mutex_lock+0x7e6/0x1360 [ 948.740224][ T31] ? __mutex_lock+0x5b6/0x1360 [ 948.746530][ T31] ? nl80211_pre_doit+0x5f/0x930 [ 948.751825][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 948.760361][ T31] ? __nla_parse+0x40/0x60 [ 948.776532][ T31] nl80211_pre_doit+0x5f/0x930 [ 948.781687][ T31] ? genl_family_rcv_msg_attrs_parse+0x212/0x2a0 [ 948.795536][ T31] genl_family_rcv_msg_doit+0x1bb/0x300 [ 948.801208][ T31] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 948.808122][ T31] ? bpf_lsm_capable+0x9/0x20 [ 948.813813][ T31] ? security_capable+0x7e/0x2e0 [ 948.822066][ T31] genl_rcv_msg+0x60e/0x790 [ 948.832563][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 948.837856][ T31] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 948.843504][ T31] ? __pfx_nl80211_new_interface+0x10/0x10 [ 948.852317][ T31] ? __pfx_nl80211_post_doit+0x10/0x10 [ 948.858202][ T31] ? __asan_memcpy+0x40/0x70 [ 948.868479][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 948.874818][ T31] netlink_rcv_skb+0x205/0x470 [ 948.882259][ T31] ? __lock_acquire+0xab9/0xd20 [ 948.887923][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 948.895002][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 948.901226][ T31] ? down_read+0x1ad/0x2e0 [ 948.914840][ T31] genl_rcv+0x28/0x40 [ 948.922493][ T31] netlink_unicast+0x82c/0x9e0 [ 948.927512][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 948.933684][ T31] ? netlink_sendmsg+0x642/0xb30 [ 948.938984][ T31] ? skb_put+0x11b/0x210 [ 948.943862][ T31] netlink_sendmsg+0x805/0xb30 [ 948.948707][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 948.954917][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 948.960015][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 948.982399][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 948.987876][ T31] __sock_sendmsg+0x219/0x270 [ 948.997806][ T31] ____sys_sendmsg+0x505/0x830 [ 949.020598][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 949.043754][ T31] ? import_iovec+0x74/0xa0 [ 949.048521][ T31] ___sys_sendmsg+0x21f/0x2a0 [ 949.057689][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 949.085580][ T31] ? __fget_files+0x2a/0x420 [ 949.090498][ T31] ? __fget_files+0x3a0/0x420 [ 949.096806][ T31] __x64_sys_sendmsg+0x19b/0x260 [ 949.101817][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 949.122008][ T31] ? rcu_is_watching+0x15/0xb0 [ 949.126928][ T31] ? do_syscall_64+0xbe/0x3b0 [ 949.131829][ T31] do_syscall_64+0xfa/0x3b0 [ 949.143443][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 949.148906][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 949.159383][ T31] ? clear_bhb_loop+0x60/0xb0 [ 949.185618][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 949.205811][ T31] RIP: 0033:0x7fbd1c58ebe9 [ 949.210368][ T31] RSP: 002b:00007fbd1d4d4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 949.219785][ T31] RAX: ffffffffffffffda RBX: 00007fbd1c7b5fa0 RCX: 00007fbd1c58ebe9 [ 949.246763][ T31] RDX: 0000000000000000 RSI: 00002000000004c0 RDI: 0000000000000008 [ 949.266725][ T31] RBP: 00007fbd1c611e19 R08: 0000000000000000 R09: 0000000000000000 [ 949.275499][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 949.302058][ T31] R13: 00007fbd1c7b6038 R14: 00007fbd1c7b5fa0 R15: 00007fbd1c8dfa28 [ 949.310333][ T31] [ 949.322123][ T31] INFO: task syz.0.2580:15435 blocked for more than 145 seconds. [ 949.339356][ T31] Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 [ 949.347722][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 949.373628][ T31] task:syz.0.2580 state:D stack:25096 pid:15435 tgid:15435 ppid:5885 task_flags:0x440040 flags:0x00004004 [ 949.392099][ T31] Call Trace: [ 949.395454][ T31] [ 949.398593][ T31] __schedule+0x1798/0x4cc0 [ 949.407376][ T31] ? __pfx___schedule+0x10/0x10 [ 949.413285][ T31] ? schedule+0x91/0x360 [ 949.417574][ T31] schedule+0x165/0x360 [ 949.438907][ T31] schedule_preempt_disabled+0x13/0x30 [ 949.445181][ T31] rwsem_down_read_slowpath+0x5fd/0x8f0 [ 949.450781][ T31] ? rwsem_down_read_slowpath+0x4b8/0x8f0 [ 949.460971][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 949.469959][ T31] down_read+0x98/0x2e0 [ 949.480607][ T31] page_cache_ra_order+0x318/0xd40 [ 949.488012][ T31] ? maybe_unlock_mmap_for_io+0x225/0x2d0 [ 949.500492][ T31] do_sync_mmap_readahead+0x25e/0x7a0 [ 949.522286][ T31] ? __pfx_do_sync_mmap_readahead+0x10/0x10 [ 949.528270][ T31] ? count_memcg_event_mm+0x1d/0x250 [ 949.537795][ T31] ? count_memcg_event_mm+0x1d/0x250 [ 949.562024][ T31] filemap_fault+0x62c/0x1200 [ 949.566809][ T31] ? __pagetable_ctor+0x253/0x340 [ 949.582337][ T31] ? __pfx_filemap_fault+0x10/0x10 [ 949.587538][ T31] ? rcu_is_watching+0x15/0xb0 [ 949.602911][ T31] ? __raw_spin_lock_init+0x45/0x100 [ 949.608522][ T31] __do_fault+0x138/0x390 [ 949.617452][ T31] __handle_mm_fault+0x1847/0x5440 [ 949.642207][ T31] ? __lock_acquire+0xab9/0xd20 [ 949.649529][ T31] ? __pfx___handle_mm_fault+0x10/0x10 [ 949.660200][ T31] ? __pfx_do_futex+0x10/0x10 [ 949.675901][ T31] ? lock_vma_under_rcu+0xdf/0x3d0 [ 949.681480][ T31] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 949.716496][ T31] handle_mm_fault+0x40a/0x8e0 [ 949.721561][ T31] do_user_addr_fault+0xa81/0x1390 [ 949.742009][ T31] ? rcu_is_watching+0x15/0xb0 [ 949.746967][ T31] ? trace_page_fault_user+0x84/0x1e0 [ 949.756371][ T31] exc_page_fault+0x76/0xf0 [ 949.761749][ T31] asm_exc_page_fault+0x26/0x30 [ 949.792299][ T31] RIP: 0033:0x7f4ab5065209 [ 949.796799][ T31] RSP: 002b:00007f4ab54dfb90 EFLAGS: 00010246 [ 949.822551][ T31] RAX: 0000200000008400 RBX: 0000000000000002 RCX: fffffffffffffcff [ 949.830596][ T31] RDX: 064a8dd4193119e4 RSI: 0000200000000300 RDI: 000055558bfa53c8 [ 949.843426][ T31] RBP: 00007f4ab53b7da0 R08: 0000001b32020000 R09: 000000000000000c [ 949.851844][ T31] R10: 0000000000000000 R11: 0000000000000001 R12: 00007f4ab53b609c [ 949.873625][ T31] R13: 00007f4ab53b6090 R14: fffffffffffffffe R15: 00007f4ab54dfca0 [ 949.908249][ T31] [ 949.911358][ T31] INFO: task syz.0.2580:15436 blocked for more than 145 seconds. [ 949.933288][ T31] Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 [ 949.940911][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 949.952706][ T31] task:syz.0.2580 state:D stack:26792 pid:15436 tgid:15435 ppid:5885 task_flags:0x440040 flags:0x00004004 [ 949.965687][ T31] Call Trace: [ 949.969132][ T31] [ 949.973314][ T31] __schedule+0x1798/0x4cc0 [ 949.977997][ T31] ? __pfx___schedule+0x10/0x10 [ 949.984422][ T31] ? schedule+0x91/0x360 [ 949.989206][ T31] schedule+0x165/0x360 [ 949.994068][ T31] schedule_preempt_disabled+0x13/0x30 [ 950.002991][ T31] rwsem_down_read_slowpath+0x5fd/0x8f0 [ 950.012533][ T31] ? rwsem_down_read_slowpath+0x4b8/0x8f0 [ 950.022307][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 950.034772][ T31] down_read+0x98/0x2e0 [ 950.044406][ T31] page_cache_ra_order+0x318/0xd40 [ 950.049691][ T31] ? maybe_unlock_mmap_for_io+0x16a/0x2d0 [ 950.092502][ T31] do_sync_mmap_readahead+0x25e/0x7a0 [ 950.098093][ T31] ? __pfx_do_sync_mmap_readahead+0x10/0x10 [ 950.112298][ T31] ? count_memcg_event_mm+0x1d/0x250 [ 950.117834][ T31] ? count_memcg_event_mm+0x1d/0x250 [ 950.145052][ T31] filemap_fault+0x62c/0x1200 [ 950.149898][ T31] ? __pfx_filemap_fault+0x10/0x10 [ 950.172446][ T31] ? __pfx_filemap_map_pages+0x10/0x10 [ 950.178514][ T31] ? __handle_mm_fault+0x27b7/0x5440 [ 950.205918][ T31] __do_fault+0x138/0x390 [ 950.210318][ T31] __handle_mm_fault+0x3611/0x5440 [ 950.231994][ T31] ? __pfx___handle_mm_fault+0x10/0x10 [ 950.237652][ T31] ? find_vma+0xe7/0x160 [ 950.258904][ T31] ? __pfx_find_vma+0x10/0x10 [ 950.275908][ T31] handle_mm_fault+0x40a/0x8e0 [ 950.280995][ T31] do_user_addr_fault+0x764/0x1390 [ 950.295748][ T31] exc_page_fault+0x76/0xf0 [ 950.300649][ T31] asm_exc_page_fault+0x26/0x30 [ 950.306870][ T31] RIP: 0010:rep_movs_alternative+0xf/0x90 [ 950.322017][ T31] Code: c4 10 e9 84 0a 04 00 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 83 f9 40 73 44 83 f9 08 73 25 85 c9 74 0f <8a> 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 4d 0a 04 00 66 2e [ 950.412094][ T31] RSP: 0018:ffffc9001ba07d58 EFLAGS: 00050202 [ 950.418321][ T31] RAX: 00007ffffffff001 RBX: 0000000000000004 RCX: 0000000000000004 [ 950.452293][ T31] RDX: 0000000000000001 RSI: 00002000000002c0 RDI: ffffc9001ba07e40 [ 950.460550][ T31] RBP: ffffc9001ba07ea8 R08: 0000000000000003 R09: 0000000000000004 [ 950.472981][ T31] R10: dffffc0000000000 R11: fffff52003740fc8 R12: 00000000400454da [ 950.481305][ T31] R13: ffff88802ec50000 R14: ffffc9001ba07e40 R15: 00002000000002c0 [ 950.516138][ T31] _copy_from_user+0x7a/0xb0 [ 950.521072][ T31] __tun_chr_ioctl+0x7bc/0x1df0 [ 950.536525][ T31] ? __pfx___tun_chr_ioctl+0x10/0x10 [ 950.556519][ T31] ? __fget_files+0x2a/0x420 [ 950.561174][ T31] ? __fget_files+0x3a0/0x420 [ 950.575943][ T31] ? __fget_files+0x2a/0x420 [ 950.580720][ T31] ? bpf_lsm_file_ioctl+0x9/0x20 [ 950.609649][ T31] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 950.615399][ T31] __se_sys_ioctl+0xfc/0x170 [ 950.620023][ T31] do_syscall_64+0xfa/0x3b0 [ 950.642250][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 950.647853][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 950.672031][ T31] ? clear_bhb_loop+0x60/0xb0 [ 950.676871][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 950.706452][ T31] RIP: 0033:0x7f4ab518ebe9 [ 950.711039][ T31] RSP: 002b:00007f4ab5f1f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 950.732435][ T31] RAX: ffffffffffffffda RBX: 00007f4ab53b5fa0 RCX: 00007f4ab518ebe9 [ 950.740815][ T31] RDX: 00002000000002c0 RSI: 00000000400454da RDI: 0000000000000003 [ 950.772661][ T31] RBP: 00007f4ab5211e19 R08: 0000000000000000 R09: 0000000000000000 [ 950.780964][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 950.812288][ T31] R13: 00007f4ab53b6038 R14: 00007f4ab53b5fa0 R15: 00007f4ab54dfa28 [ 950.820610][ T31] [ 950.842314][ T31] INFO: task syz.3.2583:15445 blocked for more than 146 seconds. [ 950.850290][ T31] Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 [ 950.866717][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 950.877292][ T31] task:syz.3.2583 state:D stack:27688 pid:15445 tgid:15443 ppid:5881 task_flags:0x400140 flags:0x00004004 [ 950.902515][ T31] Call Trace: [ 950.951679][ T31] [ 950.957725][ T31] __schedule+0x1798/0x4cc0 [ 950.972601][ T31] ? __pfx___schedule+0x10/0x10 [ 950.982219][ T31] ? schedule+0x91/0x360 [ 950.986521][ T31] schedule+0x165/0x360 [ 950.990810][ T31] schedule_preempt_disabled+0x13/0x30 [ 950.997574][ T31] __mutex_lock+0x7e6/0x1360 [ 951.002588][ T31] ? __mutex_lock+0x5b6/0x1360 [ 951.007392][ T31] ? rtnetlink_rcv_msg+0x71c/0xb70 [ 951.013217][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 951.018398][ T31] rtnetlink_rcv_msg+0x71c/0xb70 [ 951.032534][ T31] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 951.037995][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 951.054468][ T31] ? ref_tracker_free+0x63a/0x7d0 [ 951.062179][ T31] ? __asan_memcpy+0x40/0x70 [ 951.066823][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 951.072983][ T31] ? __skb_clone+0x63/0x7a0 [ 951.077544][ T31] netlink_rcv_skb+0x205/0x470 [ 951.102449][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 951.108180][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 951.135651][ T31] ? netlink_deliver_tap+0x2e/0x1b0 [ 951.141101][ T31] netlink_unicast+0x82c/0x9e0 [ 951.164357][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 951.170418][ T31] ? netlink_sendmsg+0x642/0xb30 [ 951.180042][ T31] ? skb_put+0x11b/0x210 [ 951.187115][ T31] netlink_sendmsg+0x805/0xb30 [ 951.202253][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 951.207635][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 951.216580][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 951.235889][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 951.241242][ T31] __sock_sendmsg+0x219/0x270 [ 951.285596][ T31] ____sys_sendmsg+0x505/0x830 [ 951.290616][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 951.297746][ T31] ? import_iovec+0x74/0xa0 [ 951.311999][ T31] ___sys_sendmsg+0x21f/0x2a0 [ 951.330918][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 951.336765][ T31] ? __fget_files+0x2a/0x420 [ 951.341421][ T31] ? __fget_files+0x3a0/0x420 [ 951.361988][ T31] __x64_sys_sendmsg+0x19b/0x260 [ 951.366994][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 951.378948][ T31] ? do_syscall_64+0xbe/0x3b0 [ 951.402182][ T31] do_syscall_64+0xfa/0x3b0 [ 951.406923][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 951.417010][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 951.442207][ T31] ? clear_bhb_loop+0x60/0xb0 [ 951.446942][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 951.457031][ T31] RIP: 0033:0x7f103718ebe9 [ 951.461748][ T31] RSP: 002b:00007f1037fad038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 951.486005][ T31] RAX: ffffffffffffffda RBX: 00007f10373b5fa0 RCX: 00007f103718ebe9 [ 951.496871][ T31] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000003 [ 951.521991][ T31] RBP: 00007f1037211e19 R08: 0000000000000000 R09: 0000000000000000 [ 951.530451][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 951.543742][ T31] R13: 00007f10373b6038 R14: 00007f10373b5fa0 R15: 00007f10374dfa28 [ 951.563753][ T31] [ 951.567125][ T31] INFO: task syz.3.2583:15447 blocked for more than 147 seconds. [ 951.579074][ T31] Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 [ 951.589231][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 951.612276][ T31] task:syz.3.2583 state:D stack:27688 pid:15447 tgid:15443 ppid:5881 task_flags:0x400040 flags:0x00004004 [ 951.643805][ T31] Call Trace: [ 951.647258][ T31] [ 951.650293][ T31] __schedule+0x1798/0x4cc0 [ 951.658144][ T31] ? __pfx___schedule+0x10/0x10 [ 951.663598][ T31] ? schedule+0x91/0x360 [ 951.668158][ T31] schedule+0x165/0x360 [ 951.673005][ T31] schedule_preempt_disabled+0x13/0x30 [ 951.678894][ T31] __mutex_lock+0x7e6/0x1360 [ 951.692320][ T31] ? __mutex_lock+0x5b6/0x1360 [ 951.697174][ T31] ? rtnetlink_rcv_msg+0x71c/0xb70 [ 951.722901][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 951.732572][ T31] rtnetlink_rcv_msg+0x71c/0xb70 [ 951.737921][ T31] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 951.752244][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 951.758055][ T31] ? ref_tracker_free+0x63a/0x7d0 [ 951.772062][ T31] ? __asan_memcpy+0x40/0x70 [ 951.776762][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 951.786668][ T31] ? __skb_clone+0x63/0x7a0 [ 951.791284][ T31] netlink_rcv_skb+0x205/0x470 [ 951.812558][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 951.818207][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 951.832005][ T31] ? netlink_deliver_tap+0x2e/0x1b0 [ 951.837405][ T31] netlink_unicast+0x82c/0x9e0 [ 951.854651][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 951.862562][ T31] ? netlink_sendmsg+0x642/0xb30 [ 951.867614][ T31] ? skb_put+0x11b/0x210 [ 951.872604][ T31] netlink_sendmsg+0x805/0xb30 [ 951.882450][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 951.887818][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 951.897330][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 951.903498][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 951.909017][ T31] __sock_sendmsg+0x219/0x270 [ 951.923606][ T31] ____sys_sendmsg+0x505/0x830 [ 951.932580][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 951.938063][ T31] ? import_iovec+0x74/0xa0 [ 951.943273][ T31] ___sys_sendmsg+0x21f/0x2a0 [ 951.952287][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 951.969085][ T31] ? __fget_files+0x2a/0x420 [ 952.005536][ T31] ? __fget_files+0x3a0/0x420 [ 952.010398][ T31] __x64_sys_sendmsg+0x19b/0x260 [ 952.032174][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 952.042416][ T31] ? do_user_addr_fault+0xc8a/0x1390 [ 952.052550][ T31] ? do_syscall_64+0xbe/0x3b0 [ 952.062151][ T31] do_syscall_64+0xfa/0x3b0 [ 952.066787][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 952.072342][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.078435][ T31] ? clear_bhb_loop+0x60/0xb0 [ 952.092088][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.098278][ T31] RIP: 0033:0x7f103718ebe9 [ 952.121987][ T31] RSP: 002b:00007f1037f8c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 952.155534][ T31] RAX: ffffffffffffffda RBX: 00007f10373b6090 RCX: 00007f103718ebe9 [ 952.175940][ T31] RDX: 0000000020004804 RSI: 00002000000002c0 RDI: 0000000000000003 [ 952.185107][ T31] RBP: 00007f1037211e19 R08: 0000000000000000 R09: 0000000000000000 [ 952.196852][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 952.215862][ T31] R13: 00007f10373b6128 R14: 00007f10373b6090 R15: 00007f10374dfa28 [ 952.235837][ T31] [ 952.239035][ T31] INFO: task syz.2.2586:15460 blocked for more than 148 seconds. [ 952.246922][ T31] Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 [ 952.260494][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 952.269896][ T31] task:syz.2.2586 state:D stack:25928 pid:15460 tgid:15459 ppid:5883 task_flags:0x400140 flags:0x00004004 [ 952.292779][ T31] Call Trace: [ 952.296123][ T31] [ 952.299080][ T31] __schedule+0x1798/0x4cc0 [ 952.310001][ T31] ? __pfx___schedule+0x10/0x10 [ 952.315520][ T31] ? schedule+0x91/0x360 [ 952.319890][ T31] schedule+0x165/0x360 [ 952.341211][ T31] schedule_preempt_disabled+0x13/0x30 [ 952.348290][ T31] __mutex_lock+0x7e6/0x1360 [ 952.377889][ T31] ? __mutex_lock+0x5b6/0x1360 [ 952.396390][ T31] ? nl80211_pre_doit+0x5f/0x930 [ 952.416782][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 952.422082][ T31] ? __nla_parse+0x40/0x60 [ 952.435728][ T31] nl80211_pre_doit+0x5f/0x930 [ 952.440581][ T31] ? genl_family_rcv_msg_attrs_parse+0x212/0x2a0 [ 952.452408][ T31] genl_family_rcv_msg_doit+0x1bb/0x300 [ 952.462403][ T31] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 952.468678][ T31] ? bpf_lsm_capable+0x9/0x20 [ 952.481970][ T31] ? security_capable+0x7e/0x2e0 [ 952.486965][ T31] genl_rcv_msg+0x60e/0x790 [ 952.491580][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 952.517644][ T31] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 952.523319][ T31] ? __pfx_nl80211_join_mesh+0x10/0x10 [ 952.528826][ T31] ? __pfx_nl80211_post_doit+0x10/0x10 [ 952.538694][ T31] ? __asan_memcpy+0x40/0x70 [ 952.555544][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 952.561011][ T31] netlink_rcv_skb+0x205/0x470 [ 952.566798][ T31] ? __lock_acquire+0xab9/0xd20 [ 952.572448][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 952.577625][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 952.583741][ T31] ? down_read+0x1ad/0x2e0 [ 952.588216][ T31] genl_rcv+0x28/0x40 [ 952.596591][ T31] netlink_unicast+0x82c/0x9e0 [ 952.601491][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 952.612849][ T31] ? netlink_sendmsg+0x642/0xb30 [ 952.622640][ T31] ? skb_put+0x11b/0x210 [ 952.626983][ T31] netlink_sendmsg+0x805/0xb30 [ 952.632774][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 952.638300][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 952.662870][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 952.668428][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 952.691967][ T31] __sock_sendmsg+0x219/0x270 [ 952.696760][ T31] ____sys_sendmsg+0x505/0x830 [ 952.701587][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 952.761964][ T31] ? import_iovec+0x74/0xa0 [ 952.766917][ T31] ___sys_sendmsg+0x21f/0x2a0 [ 952.771730][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 952.821992][ T31] ? __fget_files+0x2a/0x420 [ 952.826691][ T31] ? __fget_files+0x3a0/0x420 [ 952.831457][ T31] __x64_sys_sendmsg+0x19b/0x260 [ 952.857631][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 952.871982][ T31] ? rcu_is_watching+0x15/0xb0 [ 952.876875][ T31] ? do_syscall_64+0xbe/0x3b0 [ 952.881602][ T31] do_syscall_64+0xfa/0x3b0 [ 952.931978][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 952.937412][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.961953][ T31] ? clear_bhb_loop+0x60/0xb0 [ 952.966813][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.992372][ T31] RIP: 0033:0x7f0dd518ebe9 [ 952.996953][ T31] RSP: 002b:00007f0dd607a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 953.052467][ T31] RAX: ffffffffffffffda RBX: 00007f0dd53b5fa0 RCX: 00007f0dd518ebe9 [ 953.081947][ T31] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 953.090087][ T31] RBP: 00007f0dd5211e19 R08: 0000000000000000 R09: 0000000000000000 [ 953.121941][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 953.130007][ T31] R13: 00007f0dd53b6038 R14: 00007f0dd53b5fa0 R15: 00007f0dd54dfa28 [ 953.171957][ T31] [ 953.175260][ T31] [ 953.175260][ T31] Showing all locks held in the system: [ 953.255977][ T31] 3 locks held by kworker/u8:0/12: [ 953.261278][ T31] #0: ffff88802f8fd148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 953.333029][ T31] #1: ffffc90000117bc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 953.347590][ T31] #2: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 953.357590][ T31] 2 locks held by kworker/u8:1/13: [ 953.362902][ T31] #0: ffff8880b8639f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 953.373363][ T31] #1: ffff8880b8724008 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 [ 953.383554][ T31] 1 lock held by khungtaskd/31: [ 953.388620][ T31] #0: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 953.399087][ T31] 1 lock held by klogd/5222: [ 953.420340][ T31] #0: ffff8880b8639f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 953.443386][ T31] 2 locks held by getty/5625: [ 953.448149][ T31] #0: ffff88814cf2d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 953.459177][ T31] #1: ffffc900036be2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 953.469785][ T31] 3 locks held by kworker/0:3/5866: [ 953.485696][ T31] #0: ffff88801a480d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 953.505865][ T31] #1: ffffc90003f6fbc0 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 953.517232][ T31] #2: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 [ 953.535348][ T31] 2 locks held by syz.1.2526/15244: [ 953.542376][ T31] 2 locks held by syz-executor/15410: [ 953.547820][ T31] #0: ffffffff8eca4da0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 953.563895][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 953.582063][ T31] 2 locks held by syz.4.2581/15437: [ 953.592998][ T31] #0: ffffffff8f599a30 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 953.601348][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: nl80211_pre_doit+0x5f/0x930 [ 953.622626][ T31] 1 lock held by syz.0.2580/15435: [ 953.627970][ T31] #0: ffff888022d17c48 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x318/0xd40 [ 953.642871][ T31] 2 locks held by syz.0.2580/15436: [ 953.648140][ T31] #0: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x37a/0x1df0 [ 953.664083][ T31] #1: ffff888022d17c48 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x318/0xd40 [ 953.683035][ T31] 1 lock held by syz.3.2583/15445: [ 953.688542][ T31] #0: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x71c/0xb70 [ 953.703114][ T31] 1 lock held by syz.3.2583/15447: [ 953.708484][ T31] #0: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x71c/0xb70 [ 953.721424][ T31] 2 locks held by syz.2.2586/15460: [ 953.734641][ T31] #0: ffffffff8f599a30 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 953.745256][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: nl80211_pre_doit+0x5f/0x930 [ 953.763091][ T31] 2 locks held by syz-executor/15469: [ 953.768606][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 953.785219][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 953.798536][ T31] 2 locks held by syz-executor/15470: [ 953.805511][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 953.823794][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 953.842528][ T31] 2 locks held by syz-executor/15472: [ 953.848182][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 953.897939][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 953.915807][ T31] 2 locks held by syz-executor/15475: [ 953.921243][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 953.930768][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 953.951965][ T31] 2 locks held by syz-executor/15484: [ 953.957387][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 953.972281][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 953.992736][ T31] 2 locks held by syz-executor/15494: [ 953.998357][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 954.022179][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 954.081979][ T31] 2 locks held by syz-executor/15496: [ 954.101582][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 954.112484][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 954.132028][ T31] 2 locks held by syz-executor/15498: [ 954.137632][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 954.162164][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 954.182312][ T31] 2 locks held by syz-executor/15501: [ 954.187964][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 954.201379][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 954.222933][ T31] 2 locks held by syz-executor/15510: [ 954.236992][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 954.252329][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 954.302860][ T31] 2 locks held by syz-executor/15521: [ 954.311975][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 954.322224][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 954.342363][ T31] 2 locks held by syz-executor/15522: [ 954.347921][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 954.362811][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 954.374096][ T31] 2 locks held by syz-executor/15524: [ 954.379508][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 954.391177][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 954.402971][ T31] 2 locks held by syz-executor/15528: [ 954.412322][ T31] #0: ffffffff8f527710 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 954.422482][ T31] #1: ffffffff8f534588 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 954.442384][ T31] [ 954.444781][ T31] ============================================= [ 954.444781][ T31] [ 954.462564][ T31] NMI backtrace for cpu 0 [ 954.462587][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 PREEMPT(full) [ 954.462613][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 954.462627][ T31] Call Trace: [ 954.462635][ T31] [ 954.462645][ T31] dump_stack_lvl+0x189/0x250 [ 954.462680][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 954.462707][ T31] ? __pfx__printk+0x10/0x10 [ 954.462751][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 954.462777][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 954.462814][ T31] ? __pfx__printk+0x10/0x10 [ 954.462929][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 954.462959][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 954.463002][ T31] watchdog+0xf93/0xfe0 [ 954.463043][ T31] ? watchdog+0x1de/0xfe0 [ 954.463087][ T31] kthread+0x70e/0x8a0 [ 954.463119][ T31] ? __pfx_watchdog+0x10/0x10 [ 954.463147][ T31] ? __pfx_kthread+0x10/0x10 [ 954.463176][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 954.463199][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 954.463222][ T31] ? __pfx_kthread+0x10/0x10 [ 954.463251][ T31] ret_from_fork+0x3fc/0x770 [ 954.463276][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 954.463305][ T31] ? __switch_to_asm+0x39/0x70 [ 954.463333][ T31] ? __switch_to_asm+0x33/0x70 [ 954.463360][ T31] ? __pfx_kthread+0x10/0x10 [ 954.463388][ T31] ret_from_fork_asm+0x1a/0x30 [ 954.463435][ T31] [ 954.463445][ T31] Sending NMI from CPU 0 to CPUs 1: [ 954.616938][ C1] NMI backtrace for cpu 1 [ 954.616958][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 PREEMPT(full) [ 954.616980][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 954.616991][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 954.617019][ C1] Code: 13 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 97 0f 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 954.617035][ C1] RSP: 0018:ffffc90000197de0 EFLAGS: 000002c2 [ 954.617053][ C1] RAX: 514d19e28a825a00 RBX: ffffffff81968308 RCX: 514d19e28a825a00 [ 954.617076][ C1] RDX: 0000000000000001 RSI: ffffffff8d9b4405 RDI: ffffffff8be32600 [ 954.617089][ C1] RBP: ffffc90000197f20 R08: ffff8880b8732f9b R09: 1ffff110170e65f3 [ 954.617102][ C1] R10: dffffc0000000000 R11: ffffed10170e65f4 R12: ffffffff8fa34130 [ 954.617116][ C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff110039d5b40 [ 954.617129][ C1] FS: 0000000000000000(0000) GS:ffff888125d24000(0000) knlGS:0000000000000000 [ 954.617144][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 954.617156][ C1] CR2: 000055bc2fddf000 CR3: 000000000df36000 CR4: 00000000003526f0 [ 954.617173][ C1] Call Trace: [ 954.617181][ C1] [ 954.617189][ C1] default_idle+0x13/0x20 [ 954.617214][ C1] default_idle_call+0x74/0xb0 [ 954.617246][ C1] do_idle+0x1e8/0x510 [ 954.617267][ C1] ? __pfx_do_idle+0x10/0x10 [ 954.617282][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 954.617313][ C1] cpu_startup_entry+0x44/0x60 [ 954.617330][ C1] start_secondary+0x101/0x110 [ 954.617357][ C1] common_startup_64+0x13e/0x147 [ 954.617390][ C1] [ 954.644460][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 954.644488][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 PREEMPT(full) [ 954.644520][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 954.644538][ T31] Call Trace: [ 954.644551][ T31] [ 954.644565][ T31] dump_stack_lvl+0x99/0x250 [ 954.644604][ T31] ? __asan_memcpy+0x40/0x70 [ 954.644635][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 954.644667][ T31] ? __pfx__printk+0x10/0x10 [ 954.644722][ T31] vpanic+0x281/0x750 [ 954.644756][ T31] ? __pfx_vpanic+0x10/0x10 [ 954.644794][ T31] ? preempt_schedule+0xae/0xc0 [ 954.644825][ T31] ? preempt_schedule_common+0x83/0xd0 [ 954.644861][ T31] panic+0xb9/0xc0 [ 954.644889][ T31] ? __pfx_panic+0x10/0x10 [ 954.644920][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 954.644968][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 954.645013][ T31] watchdog+0xfd2/0xfe0 [ 954.645055][ T31] ? watchdog+0x1de/0xfe0 [ 954.645105][ T31] kthread+0x70e/0x8a0 [ 954.645141][ T31] ? __pfx_watchdog+0x10/0x10 [ 954.645174][ T31] ? __pfx_kthread+0x10/0x10 [ 954.645209][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 954.645246][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 954.645275][ T31] ? __pfx_kthread+0x10/0x10 [ 954.645308][ T31] ret_from_fork+0x3fc/0x770 [ 954.645338][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 954.645372][ T31] ? __switch_to_asm+0x39/0x70 [ 954.645403][ T31] ? __switch_to_asm+0x33/0x70 [ 954.645434][ T31] ? __pfx_kthread+0x10/0x10 [ 954.645467][ T31] ret_from_fork_asm+0x1a/0x30 [ 954.645519][ T31] [ 954.962699][ T31] Kernel Offset: disabled [ 954.967244][ T31] Rebooting in 86400 seconds..