last executing test programs: 6.68871889s ago: executing program 1 (id=14071): socket$alg(0x26, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000300)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1089d8b8588d72ec29c48284b70043dc6124d877142a48448b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0810000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d4023f210fa34b63a715a74e802a0dc6bf25d8a242bc6099ad2300000480006ef6c1ff0900000000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000026abfb0767192361448279b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b6c7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae616b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48fc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f01000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb796ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccf1f9f3282830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab04000000ffe760e717a04becff0f719197724f4fce1093b62d7e8c7123d890decace0200f404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef29cd1fe582786105c70600000000000000b7561301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f871b136345cf67ca3fb5aac518a75f9e7d7101da841735e186c489b3a06fb99e0347f23a054de2f4d92d6bd72ee2c9fdc75aaaf0100483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f91e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e669261192899d4562db0e22d564ae09bb6d163118e401e024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a998de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99a3594191e104d417e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df98674152f94e32409e2a3bce109b6000000000000a1fec9000000d694210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137ab79a404abde7750898b59270bb29b81367ac91bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f00fb8191bbab2dc591dda61f7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214d00000000d6c98cd1a9fbe1e7d58c08acaf30065b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ce21d69993e9960ff5f76015e6c354463d7d0917fc80e5009756237badf4e7965bbe2777e808fcba821a00e8c5c39609ff854356cb490000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d0b3bc19faa5449209b085f3c334b47f067bbab4000000000000000028df75cf43f8ecc8d37b126602111b40e761fd21081920382f14d12ca3c471c7868e7da7eaa69eb7f7f80572fdd11bb1d070080fbc22bf73468788df51710eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331ff5e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab84875f2c50ba830d3f474b079b407000000deff000040430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71b967ce7daac4be290159f6bcd75f0dda9de5532e66ae9e48b0ed1254a81faae79b6af6fbb869604d51de44c4e0973171ad47d6c00ebc7603093f000000fdec743af930cd6db49a47613808bad959719c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f15d6533f78a1f4e2df4ca23d867693fd42de9b49a1b36d48a44ba6a4530e59bec53e876dc660dd63bed8d31c31c37a373d4efd89fa516dab183ee65744fb8fc4f9ce2242e0f00000000010000000000000000000057d77480e0345effff6413258d1f6eb190aa28cbb4bafe3436b176c7ed4b132fb805d5edd9d188daf28d89c014c3ecca10ae55704544673e1fa03b84f63e022fe755f4007a4a899eaf52c4f49198e97c862e29e4570600000091c691faee1e0c8fe056a07474e6e5490a7d3c3402000000b60600d837c6befc63ddf2f594ad7cbc56a1e44d218c956a5392a995f1fae8e9f206efbb33854dc70104d74dc07748f9745cb796da2dfb714a0500000000000000faed94fc39acfb3fd25dfa8116a154cd1226e1bb72b59fed817072a0da60160761fd3dffda0f7c592eabd8ab68334d2a1693cb187539049e331272bf5135044df8161400211b8012b6eb1ed5656e83f65509bb4b323c5bd61bff949d3bade2f6ffda1360c2786e16937ab61d6dcafed319c716357d0885f9c6d1f442954c167dd9b4acd9468ce3674c82bbb2e31389179b025dbe063b7f906217b2cf8410c7023aa3e5cc3ba1000000000000000000000000000000006ae6301a2da44394275c582a6516bb92ea1980a0a659f2f1811c8b281c209647c4241f292b20508b215dde27bb2487a6e2b5e4a8ccfab90c23827ef06cbe364073005f8a6d1456aaeb85ffb7858f24eced67a67ab825e863928ed64c83f62ffdaa997657335b63c6b4163aff094059e626766845fd779c9e6cdbbd64c24936615ee68538e8fddd0d90f3a7579579a142c0f7b318264d5c13c31cf475829528267ead38523cab7e1664e8426cfce471fef821c8a02a7e7d954d05b68a9c28f79429b09e2bb3681ae2b831e27c735123361c193d66ed4d71f19b199d371ec6bfada7cd370e3fdd3cd980fa1e145fd3f3e96b1feb53c865e1ada08f5d16ed652ee0c7f45352222692fbd679212c225d097aa90f7e1fb1f983415f43e75a19ecf7fd21bfa150ef563aa72ba1c43c5f3d9be128ec26b691f31f9cab931631606a81622f120675c962be2d3b5e95f74f0b209e42e6bdd76e6e725295b1d78d928f6f63c41cbde2ba66ad81168070c8c6e18a6e452a31bde54ad3e16304d06a234f5f9311ef0f78924b68dbb4712efdb6974667bdb54f16fd2061b9ba93638dd177227e94e4ebd0ec1d437db948062bf41742000000000000000000305f70dd02fa0c61d5fe6d8ff35389246037e18d34c1375ae04f44f0c2543c772c5ccb137be7dc1874c514b37c668554d77d4ea5ed144a648257f4a0301067bbcd9b91072659d872f26b796e2b81025edb5f45f785e2c2602b248ecdd80f019ca659be7e8ae953325a27564f33c9d458a60be3dab38baab7eb1a66ab1ffd6308f7fd51beb356fe75eb985b7581bb5584c53984ba9c7340f97e8d3825681c53de5f554e595b00000000000000006a8fa9f05d64c4be42f981f00051a39938613067dbd1427e01bfec016e51844cefa8a855bf23ac887b4a88eed6d9443857242f28e31a41d20105fbf3394ff910e734b4d9101265ff729c426e01c1ab13dda8c388b9e6626f19eecb87e39175e85eff010000000000000000009431807e43886903526074e6b40244c938a4c68a38c25ddd7c143b3f14eafe4b28ec66815cf8d1f56aa1424bc9b5d58790298e5b310969e50c222563b54e60854e1bfeef448aca8c5ccbf5546ce4c3cd5a733fec25fb94e1e0f966bcbd28a4d8fe4f556eaa1104a793006619700798354c6ae05025040965e3083562bfa20968c04007d21dc02c9fd1f75e1ff40f439bdde4e784012e52049b483d02f81b88f5f57816b3fecec79cfca8d37203e769759d6b6a56b7605ced8ee18475a77ff0963a565fb6021d216c01b1099e40550a1cfd80e918d685a7b099a4f8ed654cd76ca61fe5ad8a31ec558fdbfa706d5e738bceae81fe777c307d5bc72183a4c2d35732ab916a781b9912160a3fd2a2e74dd690c57bdfdc1f069f9491bca7a8c59363799be70018c25ece5ad7307dc7a95c51bc25a8bbe2cf5ddf6aa161693782b0e7feb8a768f391b49d4c978c96dbb52f21c122eba9f17c8bed10591958cf06321a248b5f76ceedfe0d080d6aeadc11b237b3326dd04b86ac37c0d131544888db9e128d059761ad9a393e96c3b41c13c5a381bff187a75de560ba6eb3faa5ff8d2bb3c88f8de5efc2fb2200cfda6d07ceae22577064334fbf76a23e62e6059211d995b879f6b7d3f7fcf03652b81e6b7cdeff947ad185d3c6269ca247b429c3b872a8f1ef60407d29a874f4ec31c9effed55543a65a6b4d778cebcd43b7905f3960140bd783540a7353014bda8e9c7a34a5f428fd1f8eb11e837dd9d586487fdebcb1ecd3a003ff0fda4be617fecf1ff0ef2cdfb7fea73ca18874664d60a4b9423f3297bc8eb91b4ee1d73272abbef3e7a828a7d7ab055a8eb58fe379de85338304e26e3620941b463e9049fd105c74c91cc4d71b0f76e2c2e4825106aa7ce2a3adbbc7a0443ece58e752b47e6f677ec97c5c568a89d6e36b165c391339878b699644c96bd6ea589765ed2a0f27080ece2a94c320b002c77f82662675a7713c7067081cac15994698c41ff4754268ae2676384ff799783f55d7e5a1a092a01b965dc99cb7a9d98440c355927629f2bcf9dc2396eb2f5d25829715b24327642ac4741201014a95e0e65e12cdf27e19043e3c5d3e798375cead35b9a93190a52cdecaaccc854a1d41ef365303f0e9b4fc969c9dab6d00000000000000000000008f6555f3b7d5021dfc8eb504f1e4fef716d60f0d50b03fc014fd3dff46f56750f0ba4f1b9f7de5c17e7d1f18522897edab8e9e76b667ec6b01908400f55e16f0cfbf026be5f5acc681053f697d62b3545aec4606e190216c22c1d8807b6c43f0f0a4b53619fe5c9412821c3816194a5e29cf12cc7a197b5bdafb096d2d7f6be483814c92ef29c3a21c169794c7de3b4c706f4de5f4b93c831944c7b66fa49f317aa22dbc211e19f031c4f8bee14ecd5eb061a052044adc4dd1b63a1500a9c0e09dbba23f2726a55975efb4519d864d984dcb3a1dcafa1124a6b004029a706478df3be2438d2e35e6ca674dc190143a0b6f7db3408c0c08011e5d8f54711a0bd410ab53a15b1596cb77d2b58df2d8d8"], &(0x7f0000000100)='GPL\x00'}, 0x41) openat$procfs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/stat\x00', 0x41, 0x0) 6.667767102s ago: executing program 1 (id=14072): keyctl$search(0xa, 0x0, &(0x7f0000000000)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x10000, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x12ba82, 0x189) syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3, 0x3, 0x0, r2}, &(0x7f0000000340), 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000d40)={0x44, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008005}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1=0xe0004001}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x0) 6.199558384s ago: executing program 4 (id=14073): socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20048800) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f4276433eec67beef368c238bba859d2f4f4c28ab94a65821f55045e540914677befa72c15071d28435a016387cf0c69cef003550d83ef4f866ee78add21e6e69a19ca03ba5381791e38b4fb91d725d3e8c0bc7cfa95aa35f48a9127eb93dd67e9746ab92b9cdc9519f2bca2d5d2eaf864381ee2c6a76db4d1b0440dd3aa65b34fbcb3dbfd", 0x3b1}], 0x1, 0x9) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600894f000020"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa30}, 0x94) ioctl$sock_SIOCBRADDBR(r4, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r6 = socket$nl_generic(0x10, 0x3, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r5}, 0x8) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r7, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r9, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r10, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 5.980551924s ago: executing program 4 (id=14074): socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20048800) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f4276433eec67beef368c238bba859d2f4f4c28ab94a65821f55045e540914677befa72c15071d28435a016387cf0c69cef003550d83ef4f866ee78add21e6e69a19ca03ba5381791e38b4fb91d725d3e8c0bc7cfa95aa35f48a9127eb93dd67e9746ab92b9cdc9519f2bca2d5d2eaf8", 0x39c}], 0x1, 0x9) socket$nl_generic(0x10, 0x3, 0x10) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000001900ff00000000001851"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) ioctl$sock_SIOCBRADDBR(r3, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340), 0x8) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 5.809495184s ago: executing program 4 (id=14075): socket$pppl2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000600)='net/tcp6\x00') read$FUSE(r2, &(0x7f0000002680)={0x2020}, 0x2020) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x34}, 0x4}, 0x1c) read$FUSE(r4, &(0x7f0000000640)={0x2020}, 0x2020) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, 0x0, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x808ed3a56aee9e48) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x14d802, 0x0) r7 = dup(r6) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000140)=0xfffffffffffffffe, 0xb, 0x3) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r7, 0x2, 0xffffffffffffffff) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000245000/0x3000)=nil, 0x3000, 0x9) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) syz_mount_image$fuse(&(0x7f0000000140), 0x0, 0x2000400, 0x0, 0x1, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 5.67830671s ago: executing program 0 (id=14076): unshare(0x8040480) setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x8, 0x0, 0x0) 5.36844489s ago: executing program 0 (id=14078): socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20048800) vmsplice(0xffffffffffffffff, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f4276433eec67beef368c238bba859d2f4f4c28ab94a65821f55045e540914677befa72c15071d28435a016387cf0c69cef003550d83ef4f866ee78add21e6e69a19ca03ba5381791e38b4fb91d725d3e8c0bc7cfa95aa35", 0x384}], 0x1, 0x9) socket$nl_generic(0x10, 0x3, 0x10) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000001900ff0000000000185100"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa30}, 0x94) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 5.018429193s ago: executing program 0 (id=14080): keyctl$search(0xa, 0x0, &(0x7f0000000000)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x10000, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x12ba82, 0x189) syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3, 0x3, 0x0, r2}, &(0x7f0000000340), 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1=0xe0004001}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x0) 4.116499118s ago: executing program 4 (id=14085): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'syzkaller1\x00', 0xc201}) r1 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x101343) r2 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) bind$inet6(0xffffffffffffffff, 0x0, 0x0) chdir(0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) open_by_handle_at(r3, &(0x7f0000000040)=@reiserfs_2={0x8, 0xfe, {0xb}}, 0xfe) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) splice(r3, &(0x7f0000000140)=0x8c, r7, &(0x7f00000002c0)=0x6cd, 0x9, 0xc) sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000000000000000003000000400001802c00040014000100020000007f00000100000000000000001400020002000000e000000200000000000000000d0001007564703a73797a30000000009fc6a73a68b861ec134aa0cba062981d4178a165d8a0cac955bb577057145a2ce80fa3e2158067bff94f40ef30049973c2225bd62c4a52735650695d313a7c5da43013e4b2fb96f5ccf2911ac4aef896333f59c279fc4e61cac325924e66c79acc024b8210a65205f5c4ddc7255a9677e183a8c2b856a6eeb06632692c05d5b9edd12cfd6964cd741770841739cc88fceb453864b5cae3b7f431f312cf4f3e40b00588c6d8f9e6103c9d489e2af0811efece79d77217a0c9cb83fe5d5535c834c332c348303b8f5f2c01c040611c830957e373c2a0beff89a3b03ac651f934429fe32a060cca7254c51d5c2bd26f31c4c01f19a51acd5716f6faede97a84"], 0x54}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x5c, r8, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x48, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xffffffff}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000000c0)={0x3c, r4, 0x1, 0x0, 0x0, {{}, {}, {0x20, 0x17, {0x0, 0x0, @l2={'eth', 0x3a, 'veth1_macvtap\x00'}}}}}, 0x3c}}, 0x0) ioctl$VIDIOC_G_STD(r2, 0x80085617, &(0x7f0000000040)) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r9 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xd9, 0x72, 0xa4, 0x40, 0x20b7, 0x1540, 0xb75a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r9, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r9, 0x0, 0x0) syz_usb_control_io$printer(r9, 0x0, &(0x7f0000000080)={0x34, &(0x7f0000000300)=ANY=[@ANYBLOB="000903000000826604ae5331fe748ba3fee816a8b238e3676ffbd3ac6d87a1e4aac691394cf74a0fd7044a2c6c66ff4df1c36f3aecd749a48cbe6fa96eef7ef27f95f3ecee9e"], 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r1, 0x400454a4, &(0x7f0000000040)) 3.948324927s ago: executing program 1 (id=14086): socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20048800) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6", 0x2d0}], 0x1, 0x9) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600894f00"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000001900ff000000000018510000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa30}, 0x94) ioctl$sock_SIOCBRADDBR(r4, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r6 = socket$nl_generic(0x10, 0x3, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r5}, 0x8) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r7, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r9, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r10, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 3.910078074s ago: executing program 3 (id=14087): r0 = socket$inet6(0xa, 0x3, 0x8) sendmmsg$inet6(r0, &(0x7f0000004580)=[{{&(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='$'], 0x28}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000000bc0)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x40010000, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0xb173, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000040)={0x48, 0x1, 0x0, "4749570000000000000000000e00000008000000000000001400", 0x64737664}) syz_usb_control_io(r1, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000640)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) mlockall(0x1) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000300)={0x18, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x41}, [@nested={0x4, 0xe}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000900)={0x44, &(0x7f0000000700)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) syz_usb_control_io$lan78xx(r1, &(0x7f0000000280)={0x14, &(0x7f0000000540)={0x0, 0x10, 0xa1, {0xa1, 0x22, "1205e6dab94fd12996a07b662d91332e4b7e09f90ad9fed693f30d1f21829b74584f0ebb3646ff5b0337256636163fc9f06b26279c20e69e02026b3bd61c0edbd64edc57d0ad51a7e78b08c5e18742385c3d9096e2e392f0858f703f5853d3c29c784c6d96b0c2376485c07bad358050e7cc8aa96292f3a65f0e40a4fb5438d6bb82c5cad7a20b23cee3b97d2ae138d95980913aba76866feb7ec6719912ff"}}, &(0x7f00000000c0)=ANY=[@ANYBLOB="00080000000004034a04"]}, &(0x7f0000000500)={0x34, &(0x7f00000002c0)=ANY=[@ANYBLOB="40089e00000001f2649dc63ad3f2950fb91702e5e76a9c53c224acaac0f6e219aa10e1d17104983b2b884bf99fe08cb30621615482bf7150fe48d0e60160cadd0f8f524708831d9b9f92694daff530a31d988c8e47411a6d2d0a8d14a67f339e3f52effe52e13485509d1d26392111bc962a018a6c9a6311e8f327555a3e7196e052ea501f7ceb6dbbd30f56eecd72dcbaf130edd881280a627fc323ccf7d7a4a9115794"], &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0xc0, 0xa1, 0x4, 0x8}, &(0x7f0000000480)={0x40, 0xa0, 0x4, 0x6}, &(0x7f00000004c0)={0xc0, 0xa2, 0x2f, "d1316062fac60dd18b0ad0e1b324e94e5e0e67fa9780369de3c64aab9bc88135a50350706bffcea705ea71c6904ce5"}}) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000003800)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="83cb", 0x2}], 0x1}}], 0x1, 0x4000c000) sendto$inet6(r4, &(0x7f00000001c0)="c346", 0x2, 0x0, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000001040)={@private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, @loopback, 0x0, 0x2, 0x0, 0x400, 0x0, 0x100092}) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f0000000140)) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000100)) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000049b1a76c2e4eb300000010ac057302000000000001090224000100fd00000904002001030002020921fe03000122050009058103ff03000003ab99b5255e3bc21ff338622178d34cbf9529fd5187a909e93bc9e7c68342"], 0x0) 3.752584949s ago: executing program 1 (id=14088): socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20048800) vmsplice(0xffffffffffffffff, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f427", 0x32e}], 0x1, 0x9) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600894f000020"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000001900ff00000000001851"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa30}, 0x94) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r3}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x6a, 0x0, 0x0, 0xf7ffff7e, 0x0, 0x0, 0x0, 0xe}, 0x94) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3", 0x8}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 3.48167085s ago: executing program 1 (id=14089): socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20048800) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f4276433eec67beef368c238bba859d2f4f4c28ab94a65821f55045e540914677befa72c15071d28435a016387cf0c69cef003550d83ef4f866ee78add21e6e69a19ca03ba5381791e38b4fb91d725d3e8c0bc7cfa95aa35f48a9127eb93dd67e9746ab92b9cdc9519f2bca2d5d2eaf864381ee2c6a76db4d1b0440dd3aa65b34fbcb3dbfd649c5886cb9b9be8e6aa0a1e5e09ad", 0x3c0}], 0x1, 0x9) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600894f000020"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa30}, 0x94) r5 = socket$nl_generic(0x10, 0x3, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r4}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x6a, 0x0, 0x0, 0xf7ffff7e, 0x0, 0x0, 0x0, 0xe}, 0x94) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r6, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={0x0, 0x6f4}}, 0x0) 3.430800358s ago: executing program 0 (id=14090): socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20048800) vmsplice(0xffffffffffffffff, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f4276433eec67beef368c238bba859d2f4f4c28ab94a65821f55045e540914677befa72c15071d28435a016387cf0c69cef003550d83ef4f866ee78add21e6e69a19ca03ba5381791e38b4fb91d725d3e8c0bc7cfa95aa35", 0x384}], 0x1, 0x9) socket$nl_generic(0x10, 0x3, 0x10) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000001900ff0000000000185100"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa30}, 0x94) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 3.26050884s ago: executing program 0 (id=14091): r0 = socket$nl_generic(0x11, 0x3, 0x10) sendmsg(r0, &(0x7f0000000640)={&(0x7f00000000c0)=@caif=@dgm={0x25, 0xd}, 0x80, &(0x7f00000005c0), 0x0, 0x0, 0x0, 0x11000000}, 0x20000041) 3.241236599s ago: executing program 0 (id=14092): unshare(0x20000400) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES16=r0], 0x40c}}, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES64=r1], 0x0) r2 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r2, 0x0, 0xf, &(0x7f0000d10ffc)=0x7ffffffa, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x0, 0x2, @loopback={0xfec0ffff00000000}}], 0x1c) sendto$inet6(r2, &(0x7f0000000000)='\a', 0x1, 0x40008d0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x3b}}, 0x1c) r3 = socket$can_raw(0x1d, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) openat$ptp0(0xffffffffffffff9c, &(0x7f0000002040), 0x82401, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) clock_adjtime(0xffffffd3, &(0x7f0000000000)={0x1, 0x6, 0x4, 0x0, 0x7, 0x8, 0x652, 0x7, 0x8000009657, 0x1, 0x6, 0x0, 0x10, 0x800000000b, 0x80000000000000, 0xcc0, 0x1, 0x1, 0x94d6, 0x10000000000001, 0x0, 0x809, 0x0, 0xfffffffffffffffa, 0x80003, 0xf64d}) setsockopt$CAN_RAW_JOIN_FILTERS(r3, 0x65, 0x6, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) fsmount(0xffffffffffffffff, 0x0, 0xfc) 3.11846859s ago: executing program 1 (id=14093): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001140)={0x34, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001540)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000540)={0x34, &(0x7f00000003c0)={0x20, 0xc, 0x1, "bc"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000ac0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000bc0)={0x20, 0x16}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 2.987415959s ago: executing program 2 (id=14094): socket$inet6_sctp(0xa, 0x801, 0x84) fsopen(0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x0, &(0x7f0000389000/0x4000)=nil) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="010000000400100004012200a3e2000001", @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240), &(0x7f0000000580), 0x2000cc0, r2}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x18, &(0x7f0000000080)={0x0, &(0x7f0000000440)=""/30, &(0x7f0000000380), &(0x7f0000000280), 0x1, r2}, 0x38) 2.155372565s ago: executing program 4 (id=14095): unshare(0x20000400) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES16=r0], 0x40c}}, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES64=r1], 0x0) r2 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r2, 0x0, 0xf, &(0x7f0000d10ffc)=0x7ffffffa, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x0, 0x2, @loopback={0xfec0ffff00000000}}], 0x1c) sendto$inet6(r2, &(0x7f0000000000)='\a', 0x1, 0x40008d0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x3b}}, 0x1c) r3 = socket$can_raw(0x1d, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) openat$ptp0(0xffffffffffffff9c, &(0x7f0000002040), 0x82401, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) clock_adjtime(0xffffffd3, &(0x7f0000000000)={0x1, 0x6, 0x4, 0x0, 0x7, 0x8, 0x652, 0x7, 0x8000009657, 0x1, 0x6, 0x0, 0x10, 0x800000000b, 0x80000000000000, 0xcc0, 0x1, 0x1, 0x94d6, 0x10000000000001, 0x0, 0x809, 0x0, 0xfffffffffffffffa, 0x80003, 0xf64d}) setsockopt$CAN_RAW_JOIN_FILTERS(r3, 0x65, 0x6, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) syz_clone(0x1104000, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0) 1.793669129s ago: executing program 2 (id=14096): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000740)=@file={0x0, './file0\x00'}, 0xfffffffffffffcee) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = syz_io_uring_setup(0x487, &(0x7f00000000c0)={0x0, 0x9010, 0x100, 0x4, 0x165}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x0, r2, 0x0, 0x0, 0x0, 0x60, 0x0, {0x1}}) r6 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r8, 0x4008ae90, &(0x7f0000000240)=ANY=[@ANYBLOB="01000000000000000100000000000000000000000000000000000000ff"]) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="010000000000fdff8604"]) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) ioctl$KVM_CREATE_DEVICE(r10, 0xc00caee0, &(0x7f0000000100)={0x4}) io_uring_enter(r3, 0x3517, 0x173d, 0x42, 0x0, 0x0) 860.493385ms ago: executing program 2 (id=14097): socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20048800) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f4276433eec67beef368c238bba859d2f4f4c28ab94a65821f55045e540914677befa72c15071d28435a016387cf0c69cef003550d83ef4f866ee78add21e6e69a19ca03ba5381791e38b4fb91d725d3e8c0bc7cfa95aa35f48a9127eb93dd67e9746ab92b9cdc9519f2bca2d5d2eaf864381ee2c6a76db4d1b0440dd3aa65b34fbcb3dbfd649c5886cb9b9be8", 0x3b9}], 0x1, 0x9) socket$nl_generic(0x10, 0x3, 0x10) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000001900ff00000000001851"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) ioctl$sock_SIOCBRADDBR(r3, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340), 0x8) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f40600", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 812.598758ms ago: executing program 2 (id=14098): socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20048800) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6", 0x2d0}], 0x1, 0x9) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600894f00"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000001900ff000000000018510000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa30}, 0x94) ioctl$sock_SIOCBRADDBR(r4, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r6 = socket$nl_generic(0x10, 0x3, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r5}, 0x8) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r7, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r9, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r10, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 715.490903ms ago: executing program 2 (id=14099): socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20048800) vmsplice(0xffffffffffffffff, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f427", 0x32e}], 0x1, 0x9) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600894f000020"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000001900ff00000000001851"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa30}, 0x94) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r3}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x6a, 0x0, 0x0, 0xf7ffff7e, 0x0, 0x0, 0x0, 0xe}, 0x94) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3", 0x8}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 612.534153ms ago: executing program 2 (id=14100): keyctl$search(0xa, 0x0, &(0x7f0000000000)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x10000, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x12ba82, 0x189) syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3, 0x3, 0x0, r2}, &(0x7f0000000340), 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1=0xe0004001}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x0) 572.406719ms ago: executing program 3 (id=14101): socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20048800) vmsplice(0xffffffffffffffff, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f4276433eec67beef368c238bba859d2f4f4c28ab94a65821f55045e540914677befa72c15071d28435a016387cf0c69cef003550d83ef4f866ee78add21e6e69a19ca03ba5381791e38b4fb91d725d3e8c0bc7cfa95aa35", 0x384}], 0x1, 0x9) socket$nl_generic(0x10, 0x3, 0x10) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000001900ff0000000000185100"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa30}, 0x94) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 461.852443ms ago: executing program 3 (id=14102): socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20048800) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f4276433eec67beef368c238bba859d2f4f4c28ab94a65821f55045e540914677befa72c15071d28435a016387cf0c69cef003550d83ef4f866ee78add21e6e69a19ca03ba5381791e38b4fb91d725d3e8c0bc7cfa95aa35", 0x384}], 0x1, 0x9) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600894f000020"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000001900ff000000000018510000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) ioctl$sock_SIOCBRADDBR(r4, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r6, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001380)={0x0, 0x0, 0x0}, 0x0) 336.725ms ago: executing program 4 (id=14103): socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20048800) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f4276433eec67beef368c238bba859d2f4f4c28ab94a65821f55045e540914677befa72c15071d28435a016387cf0c69cef003550d83ef4f866ee78add21e6e69a19ca03ba5381791e38b4fb91d725d3e8c0bc7cfa95aa35f48a9127eb93dd67e9746ab92b9cdc9519f2bca2d5d2eaf864381ee2c6a76db4d1b0440dd3aa65b34fbcb3dbfd649c5886cb9b9be8e6aa0a1e5e09ad", 0x3c0}], 0x1, 0x9) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600894f000020"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa30}, 0x94) r5 = socket$nl_generic(0x10, 0x3, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r4}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x6a, 0x0, 0x0, 0xf7ffff7e, 0x0, 0x0, 0x0, 0xe}, 0x94) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r6, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[], 0x6f4}}, 0x0) 273.048542ms ago: executing program 3 (id=14104): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000000240)={0x0, {'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000040)=""/2, 0x2, 0x0, 0x3, 0x1, 0x3, 0x8}}, 0x120) write$UHID_DESTROY(r0, &(0x7f0000000200), 0x4) 154.739181ms ago: executing program 3 (id=14105): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x13, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x6a, 0x0, 0x0, 0xf7ffff7e, 0x0, 0x0, 0x0, 0xe}, 0x94) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'erspan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000010c0)=ANY=[@ANYBLOB="5000000010003b0c00"/20, @ANYRES32=r5, @ANYBLOB="0000000000620000300012800b00010065727370616e00002000028004001200060010004e23000006000f00ef"], 0x50}, 0x1, 0x0, 0x0, 0x100}, 0x40080c0) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r2, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r3, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 0s ago: executing program 3 (id=14106): close(0xffffffffffffffff) socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r2, @ANYBLOB="10007d80", @ANYRES32=r0], 0x2c}, 0x1, 0x0, 0x0, 0x440c0}, 0x0) (fail_nth: 3) kernel console output (not intermixed with test programs): [ 1488.474887][ T8694] openvswitch: netlink: Flow actions attr not present in new flow. [ 1488.568349][ T9] usb 3-1: USB disconnect, device number 54 [ 1488.589157][ T8698] netlink: 1624 bytes leftover after parsing attributes in process `syz.3.13686'. [ 1488.804959][ T8708] openvswitch: netlink: Flow actions attr not present in new flow. [ 1488.927390][ T8714] FAULT_INJECTION: forcing a failure. [ 1488.927390][ T8714] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1488.940540][ T10] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 1488.940724][ T9] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 1488.961876][ T8714] CPU: 0 UID: 0 PID: 8714 Comm: syz.4.13693 Not tainted syzkaller #0 PREEMPT(full) [ 1488.961899][ T8714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1488.961910][ T8714] Call Trace: [ 1488.961919][ T8714] [ 1488.961927][ T8714] dump_stack_lvl+0x189/0x250 [ 1488.961961][ T8714] ? __pfx____ratelimit+0x10/0x10 [ 1488.961979][ T8714] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1488.962001][ T8714] ? __pfx__printk+0x10/0x10 [ 1488.962031][ T8714] should_fail_ex+0x414/0x560 [ 1488.962060][ T8714] _copy_to_user+0x31/0xb0 [ 1488.962083][ T8714] do_fcntl+0x13c2/0x1910 [ 1488.962104][ T8714] ? do_sys_openat2+0x154/0x1c0 [ 1488.962124][ T8714] ? __pfx_do_fcntl+0x10/0x10 [ 1488.962152][ T8714] ? ksys_write+0x1e1/0x250 [ 1488.962180][ T8714] ? bpf_lsm_file_fcntl+0x9/0x20 [ 1488.962203][ T8714] __se_sys_fcntl+0xc8/0x150 [ 1488.962224][ T8714] do_syscall_64+0xfa/0x3b0 [ 1488.962241][ T8714] ? lockdep_hardirqs_on+0x9c/0x150 [ 1488.962259][ T8714] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1488.962276][ T8714] ? clear_bhb_loop+0x60/0xb0 [ 1488.962296][ T8714] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1488.962313][ T8714] RIP: 0033:0x7f12e978eec9 [ 1488.962329][ T8714] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1488.962344][ T8714] RSP: 002b:00007f12ea605038 EFLAGS: 00000246 ORIG_RAX: 0000000000000048 [ 1488.962363][ T8714] RAX: ffffffffffffffda RBX: 00007f12e99e5fa0 RCX: 00007f12e978eec9 [ 1488.962376][ T8714] RDX: 0000000000000000 RSI: 0000000000000010 RDI: 0000000000000003 [ 1488.962386][ T8714] RBP: 00007f12ea605090 R08: 0000000000000000 R09: 0000000000000000 [ 1488.962398][ T8714] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1488.962409][ T8714] R13: 00007f12e99e6038 R14: 00007f12e99e5fa0 R15: 00007f12e9b0fa28 [ 1488.962438][ T8714] [ 1489.240740][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 1489.245986][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 1489.253011][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 52, changing to 9 [ 1489.264147][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 8241, setting to 1024 [ 1489.278776][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1489.287958][ T10] usb 4-1: config 8 has an invalid interface number: 137 but max is 0 [ 1489.296186][ T10] usb 4-1: config 8 has no interface number 0 [ 1489.302300][ T10] usb 4-1: config 8 interface 137 altsetting 5 bulk endpoint 0xF has invalid maxpacket 84 [ 1489.312262][ T10] usb 4-1: config 8 interface 137 has no altsetting 0 [ 1489.322079][ T9] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 1489.331181][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1489.339209][ T9] usb 3-1: Product: syz [ 1489.343381][ T9] usb 3-1: Manufacturer: syz [ 1489.347948][ T9] usb 3-1: SerialNumber: syz [ 1489.353869][ T10] usb 4-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=e5.0d [ 1489.372880][ T9] usb 3-1: config 0 descriptor?? [ 1489.388971][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1489.417537][ T10] usb 4-1: Product: syz [ 1489.446428][ T9] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1489.464905][ T10] usb 4-1: Manufacturer: syz [ 1489.470822][ T10] usb 4-1: SerialNumber: syz [ 1489.501138][ T8706] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1489.656803][ T9] usb 3-1: USB disconnect, device number 55 [ 1489.723668][ T2340] usb 3-1: Failed to submit usb control message: -71 [ 1489.738792][ T2340] usb 3-1: unable to send the bmi data to the device: -71 [ 1489.752913][ T2340] usb 3-1: unable to get target info from device [ 1489.759385][ T2340] usb 3-1: could not get target info (-71) [ 1489.832360][ T2340] usb 3-1: could not probe fw (-71) [ 1489.946517][ T8706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1489.971194][ T8706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1490.028753][ T10] cyberjack 4-1:8.137: Reiner SCT Cyberjack USB card reader converter detected [ 1490.079343][ T10] cyberjack ttyUSB0: usb_submit_urb(read int) failed [ 1490.121056][ T10] usb 4-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 1490.192283][ T10] usb 4-1: USB disconnect, device number 92 [ 1490.252200][ T10] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 1490.302296][ T10] cyberjack 4-1:8.137: device disconnected [ 1490.618958][ T8739] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.13698'. [ 1490.751595][ T5839] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 1490.772519][ T8742] tipc: Enabled bearer , priority 0 [ 1490.794652][ T8742] syzkaller0: entered promiscuous mode [ 1490.801322][ T8745] openvswitch: netlink: Flow actions attr not present in new flow. [ 1490.802590][ T8742] syzkaller0: entered allmulticast mode [ 1490.925237][ T8742] tipc: Resetting bearer [ 1490.945754][ T5839] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1490.963290][ T8740] tipc: Resetting bearer [ 1490.985907][ T5839] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1491.004516][ T5839] usb 3-1: Product: syz [ 1491.008714][ T5839] usb 3-1: Manufacturer: syz [ 1491.024814][ T5839] usb 3-1: SerialNumber: syz [ 1491.026758][ T8740] tipc: Disabling bearer [ 1491.088196][ T8752] FAULT_INJECTION: forcing a failure. [ 1491.088196][ T8752] name failslab, interval 1, probability 0, space 0, times 0 [ 1491.106344][ T8752] CPU: 0 UID: 0 PID: 8752 Comm: syz.4.13703 Not tainted syzkaller #0 PREEMPT(full) [ 1491.106370][ T8752] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1491.106382][ T8752] Call Trace: [ 1491.106390][ T8752] [ 1491.106398][ T8752] dump_stack_lvl+0x189/0x250 [ 1491.106425][ T8752] ? __pfx____ratelimit+0x10/0x10 [ 1491.106445][ T8752] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1491.106465][ T8752] ? __pfx__printk+0x10/0x10 [ 1491.106488][ T8752] ? __pfx___might_resched+0x10/0x10 [ 1491.106507][ T8752] ? fs_reclaim_acquire+0x7d/0x100 [ 1491.106535][ T8752] should_fail_ex+0x414/0x560 [ 1491.106564][ T8752] should_failslab+0xa8/0x100 [ 1491.106589][ T8752] __kmalloc_noprof+0xcb/0x4f0 [ 1491.106608][ T8752] ? kfree+0x4d/0x440 [ 1491.106624][ T8752] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1491.106659][ T8752] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1491.106686][ T8752] ? tomoyo_domain+0xd9/0x130 [ 1491.106708][ T8752] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1491.106737][ T8752] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1491.106761][ T8752] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1491.106800][ T8752] ? __lock_acquire+0xab9/0xd20 [ 1491.106838][ T8752] ? __fget_files+0x2a/0x420 [ 1491.106864][ T8752] ? __fget_files+0x2a/0x420 [ 1491.106885][ T8752] ? __fget_files+0x3a0/0x420 [ 1491.106905][ T8752] ? __fget_files+0x2a/0x420 [ 1491.106931][ T8752] security_file_ioctl+0xcb/0x2d0 [ 1491.106953][ T8752] __se_sys_ioctl+0x47/0x170 [ 1491.106974][ T8752] do_syscall_64+0xfa/0x3b0 [ 1491.106989][ T8752] ? lockdep_hardirqs_on+0x9c/0x150 [ 1491.107005][ T8752] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1491.107021][ T8752] ? clear_bhb_loop+0x60/0xb0 [ 1491.107039][ T8752] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1491.107054][ T8752] RIP: 0033:0x7f12e978eec9 [ 1491.107070][ T8752] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1491.107085][ T8752] RSP: 002b:00007f12ea605038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1491.107104][ T8752] RAX: ffffffffffffffda RBX: 00007f12e99e5fa0 RCX: 00007f12e978eec9 [ 1491.107116][ T8752] RDX: 00002000000000c0 RSI: 00000000c040aed5 RDI: 0000000000000005 [ 1491.107126][ T8752] RBP: 00007f12ea605090 R08: 0000000000000000 R09: 0000000000000000 [ 1491.107135][ T8752] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1491.107145][ T8752] R13: 00007f12e99e6038 R14: 00007f12e99e5fa0 R15: 00007f12e9b0fa28 [ 1491.107173][ T8752] [ 1491.107181][ T8752] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1491.468738][ T5839] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 1491.494909][ T5839] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1491.507535][ T5839] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1491.532024][ T5839] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -32 [ 1491.760663][ T5526] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 1491.946349][ T5526] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1492.003735][ T5526] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1492.026557][ T5526] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1492.129628][ T5526] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1492.194730][ T5526] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1492.268584][ T5526] usb 2-1: config 0 descriptor?? [ 1493.219949][ T8778] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.13710'. [ 1493.446912][ T8784] openvswitch: netlink: Flow actions attr not present in new flow. [ 1493.607149][ T9] usb 3-1: USB disconnect, device number 56 [ 1494.309115][ T5526] plantronics 0003:047F:FFFF.002E: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 1494.420629][T28789] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 1496.000671][ T5839] usb 2-1: reset high-speed USB device number 51 using dummy_hcd [ 1496.696532][ T8819] FAULT_INJECTION: forcing a failure. [ 1496.696532][ T8819] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1496.733882][ T8819] CPU: 1 UID: 0 PID: 8819 Comm: syz.0.13721 Not tainted syzkaller #0 PREEMPT(full) [ 1496.733900][ T8819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1496.733907][ T8819] Call Trace: [ 1496.733912][ T8819] [ 1496.733917][ T8819] dump_stack_lvl+0x189/0x250 [ 1496.733935][ T8819] ? __pfx____ratelimit+0x10/0x10 [ 1496.733949][ T8819] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1496.733964][ T8819] ? __pfx__printk+0x10/0x10 [ 1496.733974][ T8819] ? __might_fault+0xb0/0x130 [ 1496.733991][ T8819] should_fail_ex+0x414/0x560 [ 1496.734008][ T8819] _copy_from_user+0x2d/0xb0 [ 1496.734019][ T8819] ___sys_sendmsg+0x158/0x2a0 [ 1496.734033][ T8819] ? __pfx____sys_sendmsg+0x10/0x10 [ 1496.734065][ T8819] ? __fget_files+0x2a/0x420 [ 1496.734079][ T8819] ? __fget_files+0x3a0/0x420 [ 1496.734096][ T8819] __x64_sys_sendmsg+0x19b/0x260 [ 1496.734109][ T8819] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1496.734136][ T8819] ? do_syscall_64+0xbe/0x3b0 [ 1496.734148][ T8819] do_syscall_64+0xfa/0x3b0 [ 1496.734159][ T8819] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1496.734168][ T8819] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1496.734177][ T8819] ? clear_bhb_loop+0x60/0xb0 [ 1496.734189][ T8819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1496.734198][ T8819] RIP: 0033:0x7f05b998eec9 [ 1496.734208][ T8819] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1496.734216][ T8819] RSP: 002b:00007f05ba7b0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1496.734228][ T8819] RAX: ffffffffffffffda RBX: 00007f05b9be5fa0 RCX: 00007f05b998eec9 [ 1496.734235][ T8819] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000005 [ 1496.734241][ T8819] RBP: 00007f05ba7b0090 R08: 0000000000000000 R09: 0000000000000000 [ 1496.734247][ T8819] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1496.734253][ T8819] R13: 00007f05b9be6038 R14: 00007f05b9be5fa0 R15: 00007f05b9d0fa28 [ 1496.734268][ T8819] [ 1497.174985][ T8824] openvswitch: netlink: Flow actions attr not present in new flow. [ 1497.619423][ T8848] fuse: Unknown parameter 'smackfsfloor' [ 1497.640604][T28789] usb 3-1: device descriptor read/64, error -71 [ 1497.890959][T28789] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 1497.900525][ T5839] usb 2-1: device descriptor read/64, error -71 [ 1498.053718][T28789] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1498.065317][T28789] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1498.074827][T28789] usb 3-1: Product: syz [ 1498.079378][T28789] usb 3-1: Manufacturer: syz [ 1498.088068][T28789] usb 3-1: SerialNumber: syz [ 1498.093206][ T9] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 1498.096611][T28789] usb 3-1: config 0 descriptor?? [ 1498.140648][ T5839] usb 2-1: reset high-speed USB device number 51 using dummy_hcd [ 1498.260528][ T9] usb 4-1: device descriptor read/64, error -71 [ 1498.301596][ T5839] usb 2-1: device firmware changed [ 1498.307905][ T55] usb 2-1: USB disconnect, device number 51 [ 1498.470875][ T55] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 1498.510625][ T9] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 1498.537561][T28789] usb 3-1: Firmware version (0.0) predates our first public release. [ 1498.547824][T28789] usb 3-1: Please update to version 0.2 or newer [ 1498.587754][T28789] usb 3-1: USB disconnect, device number 58 [ 1498.622279][ T55] usb 2-1: config index 0 descriptor too short (expected 39, got 27) [ 1498.630579][ T55] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1498.640408][ T55] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1498.646241][ T9] usb 4-1: device descriptor read/64, error -71 [ 1498.654199][ T55] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1498.660810][ T10] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 1498.668934][ T55] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1498.682002][ T55] usb 2-1: Product: syz [ 1498.704793][ T55] usb 2-1: Manufacturer: syz [ 1498.709612][ T55] usb 2-1: SerialNumber: syz [ 1498.723163][ T55] usb 2-1: config 0 descriptor?? [ 1498.730038][ T55] hub 2-1:0.0: bad descriptor, ignoring hub [ 1498.736437][ T55] hub 2-1:0.0: probe with driver hub failed with error -5 [ 1498.746095][ T55] usb 2-1: selecting invalid altsetting 0 [ 1498.761625][ T9] usb usb4-port1: attempt power cycle [ 1498.853769][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1498.864444][ T10] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1498.873419][ T10] usb 5-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=b1.f9 [ 1498.882886][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1498.891124][ T10] usb 5-1: Product: syz [ 1498.895308][ T10] usb 5-1: Manufacturer: syz [ 1498.899900][ T10] usb 5-1: SerialNumber: syz [ 1498.908220][ T10] usb 5-1: config 0 descriptor?? [ 1498.917850][ T10] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 1498.928259][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1498.938446][ T10] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 1498.947236][ T10] usb 5-1: media controller created [ 1498.950161][ T8845] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1498.971946][ T8845] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1498.974036][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1499.025944][ T10] DVB: Unable to find symbol tda10046_attach() [ 1499.032296][ T10] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 1499.046623][ T10] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 1499.081034][ T55] usb 2-1: USB disconnect, device number 52 [ 1499.100770][ T9] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 1499.132384][ T9] usb 4-1: device descriptor read/8, error -71 [ 1499.370523][ T55] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 1499.390596][ T9] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 1499.411018][ T9] usb 4-1: device descriptor read/8, error -71 [ 1499.520722][ T55] usb 3-1: Using ep0 maxpacket: 8 [ 1499.531754][ T8861] netlink: 'syz.4.13735': attribute type 10 has an invalid length. [ 1499.540145][ T9] usb usb4-port1: unable to enumerate USB device [ 1499.545563][ T55] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1499.562912][ T10] dvb_usb_m920x 5-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 1499.578317][ T10] usb 5-1: USB disconnect, device number 63 [ 1499.583129][ T55] usb 3-1: config 8 has an invalid interface number: 137 but max is 0 [ 1499.602699][ T55] usb 3-1: config 8 has no interface number 0 [ 1499.609198][ T55] usb 3-1: config 8 interface 137 altsetting 5 bulk endpoint 0xF has invalid maxpacket 84 [ 1499.622084][ T55] usb 3-1: config 8 interface 137 has no altsetting 0 [ 1499.631504][ T55] usb 3-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=e5.0d [ 1499.641950][ T55] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1499.650289][ T55] usb 3-1: Product: syz [ 1499.654797][ T55] usb 3-1: Manufacturer: syz [ 1499.659502][ T55] usb 3-1: SerialNumber: syz [ 1499.667412][ T8863] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1499.845111][ T9] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 1499.947445][ T8863] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1499.966745][ T8863] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1499.977923][ T55] cyberjack 3-1:8.137: Reiner SCT Cyberjack USB card reader converter detected [ 1499.988301][ T55] cyberjack ttyUSB0: usb_submit_urb(read int) failed [ 1500.001217][ T55] usb 3-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 1500.002504][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 1500.016058][ T55] usb 3-1: USB disconnect, device number 59 [ 1500.027309][ T55] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 1500.040419][ T9] usb 2-1: config 254 has an invalid interface number: 235 but max is 0 [ 1500.040568][ T55] cyberjack 3-1:8.137: device disconnected [ 1500.074175][ T9] usb 2-1: config 254 has no interface number 0 [ 1500.088894][ T9] usb 2-1: config 254 interface 235 altsetting 2 bulk endpoint 0x6 has invalid maxpacket 32 [ 1500.120044][ T9] usb 2-1: config 254 interface 235 altsetting 2 has an endpoint descriptor with address 0xA2, changing to 0x82 [ 1500.127489][ T8870] openvswitch: netlink: Flow actions attr not present in new flow. [ 1500.164639][ T9] usb 2-1: config 254 interface 235 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1500.196492][ T9] usb 2-1: config 254 interface 235 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1500.216651][ T9] usb 2-1: config 254 interface 235 has no altsetting 0 [ 1500.229861][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=2b.f1 [ 1500.240303][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1500.249556][ T9] usb 2-1: Product: syz [ 1500.253888][ T9] usb 2-1: Manufacturer: syz [ 1500.258583][ T9] usb 2-1: SerialNumber: syz [ 1500.267001][ T8865] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1500.450618][ T55] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 1500.473101][ T8878] pimreg: tun_chr_ioctl cmd 1074812117 [ 1500.483309][ T8865] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1500.492817][ T9] usbtest 2-1:254.235: Linux gadget zero [ 1500.498546][ T9] usbtest 2-1:254.235: high-speed {control in/out bulk-out iso-in} tests (+alt) [ 1500.640524][ T55] usb 5-1: Using ep0 maxpacket: 32 [ 1500.652990][ T55] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 1500.671707][ T55] usb 5-1: config 0 has no interface number 0 [ 1500.678769][ T55] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1500.715221][ T55] usb 5-1: config 0 interface 85 has no altsetting 0 [ 1500.766532][ T55] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1500.784839][ T8881] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1500.804996][ T55] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1500.814114][ T55] usb 5-1: Product: syz [ 1500.818551][ T55] usb 5-1: Manufacturer: syz [ 1500.823515][ T55] usb 5-1: SerialNumber: syz [ 1500.832441][ T55] usb 5-1: config 0 descriptor?? [ 1500.955302][ T8881] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1501.010192][ T8888] fuse: Unknown parameter 'smackfsfloor' [ 1501.350941][ T55] appletouch 5-1:0.85: Failed to request geyser raw mode [ 1501.365763][ T55] appletouch 5-1:0.85: probe with driver appletouch failed with error -5 [ 1501.425412][ T55] usb 5-1: USB disconnect, device number 64 [ 1501.583896][ T8904] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1501.620612][T28789] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 1501.621417][ T8904] sctp: [Deprecated]: syz.2.13748 (pid 8904) Use of int in max_burst socket option deprecated. [ 1501.621417][ T8904] Use struct sctp_assoc_value instead [ 1501.675439][ T8906] kvm: pic: level sensitive irq not supported [ 1501.675502][ T8906] kvm: pic: non byte read [ 1501.690841][ T8906] kvm: pic: level sensitive irq not supported [ 1501.690909][ T8906] kvm: pic: non byte read [ 1501.705122][ T8906] kvm: pic: level sensitive irq not supported [ 1501.705214][ T8906] kvm: pic: non byte read [ 1501.800775][T28789] usb 4-1: Using ep0 maxpacket: 16 [ 1501.815111][T28789] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1501.839382][ T8912] openvswitch: netlink: Flow actions attr not present in new flow. [ 1501.841280][T28789] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1501.888681][T28789] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 1501.912839][T28789] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1501.935891][ T8916] openvswitch: netlink: Flow actions attr not present in new flow. [ 1501.948947][T28789] usb 4-1: config 0 descriptor?? [ 1502.216276][ T8929] CUSE: info not properly terminated [ 1502.265912][ T8933] fuse: Unknown parameter 'smackfsfloor' [ 1502.419189][T28789] nzxt-smart2 0003:1E71:2009.002F: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.3-1/input0 [ 1502.467108][ T8940] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1502.487035][ T8940] FAULT_INJECTION: forcing a failure. [ 1502.487035][ T8940] name failslab, interval 1, probability 0, space 0, times 0 [ 1502.502005][ T8940] CPU: 0 UID: 0 PID: 8940 Comm: syz.0.13757 Not tainted syzkaller #0 PREEMPT(full) [ 1502.502030][ T8940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1502.502041][ T8940] Call Trace: [ 1502.502048][ T8940] [ 1502.502056][ T8940] dump_stack_lvl+0x189/0x250 [ 1502.502088][ T8940] ? __pfx____ratelimit+0x10/0x10 [ 1502.502106][ T8940] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1502.502128][ T8940] ? __pfx__printk+0x10/0x10 [ 1502.502152][ T8940] ? __pfx___might_resched+0x10/0x10 [ 1502.502171][ T8940] ? fs_reclaim_acquire+0x7d/0x100 [ 1502.502200][ T8940] should_fail_ex+0x414/0x560 [ 1502.502230][ T8940] should_failslab+0xa8/0x100 [ 1502.502254][ T8940] __kmalloc_cache_noprof+0x70/0x3d0 [ 1502.502276][ T8940] ? vhost_task_create+0xf8/0x320 [ 1502.502303][ T8940] vhost_task_create+0xf8/0x320 [ 1502.502331][ T8940] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 1502.502356][ T8940] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 1502.502380][ T8940] ? __pfx_vhost_task_create+0x10/0x10 [ 1502.502417][ T8940] ? __pfx_vhost_task_fn+0x10/0x10 [ 1502.502460][ T8940] kvm_mmu_post_init_vm+0x14c/0x300 [ 1502.502481][ T8940] kvm_arch_vcpu_ioctl_run+0xdc/0x1940 [ 1502.502511][ T8940] ? __mutex_trylock_common+0x153/0x260 [ 1502.502537][ T8940] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1502.502558][ T8940] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 1502.502582][ T8940] ? rcu_is_watching+0x15/0xb0 [ 1502.502602][ T8940] ? trace_contention_end+0x39/0x120 [ 1502.502623][ T8940] ? look_up_lock_class+0x74/0x170 [ 1502.502643][ T8940] ? register_lock_class+0x51/0x320 [ 1502.502669][ T8940] ? __lock_acquire+0xab9/0xd20 [ 1502.502719][ T8940] kvm_vcpu_ioctl+0x95c/0xe90 [ 1502.502754][ T8940] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1502.502774][ T8940] ? __lock_acquire+0xab9/0xd20 [ 1502.502814][ T8940] ? __fget_files+0x2a/0x420 [ 1502.502840][ T8940] ? __fget_files+0x2a/0x420 [ 1502.502861][ T8940] ? __fget_files+0x3a0/0x420 [ 1502.502882][ T8940] ? __fget_files+0x2a/0x420 [ 1502.502908][ T8940] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1502.502928][ T8940] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1502.502951][ T8940] __se_sys_ioctl+0xf9/0x170 [ 1502.502973][ T8940] do_syscall_64+0xfa/0x3b0 [ 1502.502991][ T8940] ? lockdep_hardirqs_on+0x9c/0x150 [ 1502.503008][ T8940] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1502.503026][ T8940] ? clear_bhb_loop+0x60/0xb0 [ 1502.503047][ T8940] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1502.503064][ T8940] RIP: 0033:0x7f05b998eec9 [ 1502.503080][ T8940] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1502.503094][ T8940] RSP: 002b:00007f05ba7b0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1502.503113][ T8940] RAX: ffffffffffffffda RBX: 00007f05b9be5fa0 RCX: 00007f05b998eec9 [ 1502.503126][ T8940] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000a [ 1502.503137][ T8940] RBP: 00007f05ba7b0090 R08: 0000000000000000 R09: 0000000000000000 [ 1502.503148][ T8940] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1502.503159][ T8940] R13: 00007f05b9be6038 R14: 00007f05b9be5fa0 R15: 00007f05b9d0fa28 [ 1502.503190][ T8940] [ 1502.950726][ T5929] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 1503.067640][ T8947] netlink: 'syz.4.13759': attribute type 7 has an invalid length. [ 1503.090539][ T5929] usb 3-1: device descriptor read/64, error -71 [ 1503.099368][ T8947] netlink: 45 bytes leftover after parsing attributes in process `syz.4.13759'. [ 1503.148914][ T55] usb 4-1: USB disconnect, device number 97 [ 1503.358386][ T5929] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 1503.429256][ T8956] openvswitch: netlink: Flow actions attr not present in new flow. [ 1503.457953][ T9] usb 2-1: USB disconnect, device number 53 [ 1503.531984][ T5929] usb 3-1: device descriptor read/64, error -71 [ 1503.576120][ T8959] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1503.600940][ T8959] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1503.673671][ T5929] usb usb3-port1: attempt power cycle [ 1503.793827][ T8967] tipc: Enabled bearer , priority 0 [ 1503.817993][ T8967] syzkaller0: entered promiscuous mode [ 1503.834566][ T8967] syzkaller0: entered allmulticast mode [ 1503.963166][ T8967] tipc: Resetting bearer [ 1503.981566][ T8971] fuse: Unknown parameter 'smackfsfloor' [ 1504.013389][ T8966] tipc: Resetting bearer [ 1504.030565][ T5929] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 1504.063194][ T5929] usb 3-1: device descriptor read/8, error -71 [ 1504.380552][ T5929] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1504.432731][ T5929] usb 3-1: device descriptor read/8, error -71 [ 1504.541325][ T5929] usb usb3-port1: unable to enumerate USB device [ 1504.778032][ T8966] tipc: Disabling bearer [ 1504.969097][ T8975] : renamed from bridge_slave_0 (while UP) [ 1505.293305][ T8980] netlink: 'syz.3.13768': attribute type 3 has an invalid length. [ 1505.446261][ T8987] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.13771'. [ 1505.460728][ T5895] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 1505.481475][T28789] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 1505.514718][ T8990] openvswitch: netlink: Flow actions attr not present in new flow. [ 1505.648090][ T5895] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1505.658381][T28789] usb 2-1: Using ep0 maxpacket: 32 [ 1505.670356][T28789] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 52, changing to 9 [ 1505.690832][ T5895] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1505.703247][T28789] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 8241, setting to 1024 [ 1505.714597][ T5895] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1505.723140][ T5895] usb 5-1: Product: syz [ 1505.729308][ T5895] usb 5-1: Manufacturer: syz [ 1505.738544][ T5895] usb 5-1: SerialNumber: syz [ 1505.744980][T28789] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 1505.757671][ T5895] usb 5-1: config 0 descriptor?? [ 1505.762768][T28789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1505.771147][T28789] usb 2-1: Product: syz [ 1505.775903][T28789] usb 2-1: Manufacturer: syz [ 1505.785099][T28789] usb 2-1: SerialNumber: syz [ 1505.801385][T28789] usb 2-1: config 0 descriptor?? [ 1505.832797][T28789] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1505.922465][ T5839] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 1505.978444][ T8998] binder: 8996:8998 ioctl c0306201 2000000003c0 returned -14 [ 1506.025361][T31425] usb 2-1: USB disconnect, device number 54 [ 1506.031562][ T2340] usb 2-1: Failed to submit usb control message: -71 [ 1506.039489][ T2340] usb 2-1: unable to send the bmi data to the device: -71 [ 1506.047684][ T2340] usb 2-1: unable to get target info from device [ 1506.057198][ T2340] usb 2-1: could not get target info (-71) [ 1506.069010][ T2340] usb 2-1: could not probe fw (-71) [ 1506.088051][ T5839] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1506.114179][ T5839] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1506.124105][ T5839] usb 3-1: Product: syz [ 1506.142923][ T5839] usb 3-1: Manufacturer: syz [ 1506.147704][ T5839] usb 3-1: SerialNumber: syz [ 1506.158774][ T5839] usb 3-1: config 0 descriptor?? [ 1506.209082][ T5929] usb 5-1: USB disconnect, device number 65 [ 1506.580662][ T5839] usb 3-1: Firmware version (0.0) predates our first public release. [ 1506.597290][ T5839] usb 3-1: Please update to version 0.2 or newer [ 1506.673706][ T5839] usb 3-1: USB disconnect, device number 64 [ 1506.772039][ T9008] fuse: Unknown parameter 'smackfsfloor' [ 1507.007889][ T9019] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.13782'. [ 1507.068216][ T9025] openvswitch: netlink: Flow actions attr not present in new flow. [ 1507.199491][ T9036] netlink: 32 bytes leftover after parsing attributes in process `syz.1.13787'. [ 1507.208708][ T9036] openvswitch: netlink: Flow actions attr not present in new flow. [ 1507.274804][ T9039] FAULT_INJECTION: forcing a failure. [ 1507.274804][ T9039] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1507.292393][ T9039] CPU: 0 UID: 0 PID: 9039 Comm: syz.1.13788 Not tainted syzkaller #0 PREEMPT(full) [ 1507.292419][ T9039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1507.292431][ T9039] Call Trace: [ 1507.292438][ T9039] [ 1507.292446][ T9039] dump_stack_lvl+0x189/0x250 [ 1507.292472][ T9039] ? __pfx____ratelimit+0x10/0x10 [ 1507.292491][ T9039] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1507.292512][ T9039] ? __pfx__printk+0x10/0x10 [ 1507.292530][ T9039] ? __might_fault+0xb0/0x130 [ 1507.292563][ T9039] should_fail_ex+0x414/0x560 [ 1507.292592][ T9039] _copy_from_user+0x2d/0xb0 [ 1507.292614][ T9039] kvm_arch_vm_ioctl+0x4f8/0x16b0 [ 1507.292637][ T9039] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10 [ 1507.292659][ T9039] ? __lock_acquire+0xab9/0xd20 [ 1507.292684][ T9039] ? __lock_acquire+0xab9/0xd20 [ 1507.292714][ T9039] ? __lock_acquire+0xab9/0xd20 [ 1507.292767][ T9039] ? is_bpf_text_address+0x26/0x2b0 [ 1507.292792][ T9039] ? is_bpf_text_address+0x292/0x2b0 [ 1507.292809][ T9039] ? is_bpf_text_address+0x26/0x2b0 [ 1507.292831][ T9039] ? kernel_text_address+0xa5/0xe0 [ 1507.292864][ T9039] ? __kernel_text_address+0xd/0x40 [ 1507.292886][ T9039] ? unwind_get_return_address+0x4d/0x90 [ 1507.292908][ T9039] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1507.292931][ T9039] ? arch_stack_walk+0xfc/0x150 [ 1507.292965][ T9039] ? stack_trace_save+0x9c/0xe0 [ 1507.292986][ T9039] ? __pfx_stack_trace_save+0x10/0x10 [ 1507.293010][ T9039] ? stack_depot_save_flags+0x40/0x860 [ 1507.293041][ T9039] ? kasan_save_track+0x4f/0x80 [ 1507.293057][ T9039] ? kasan_save_track+0x3e/0x80 [ 1507.293073][ T9039] ? kasan_save_free_info+0x46/0x50 [ 1507.293086][ T9039] ? __kasan_slab_free+0x5b/0x80 [ 1507.293102][ T9039] ? kfree+0x18e/0x440 [ 1507.293117][ T9039] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 1507.293137][ T9039] ? security_file_ioctl+0xcb/0x2d0 [ 1507.293156][ T9039] ? __se_sys_ioctl+0x47/0x170 [ 1507.293173][ T9039] ? do_syscall_64+0xfa/0x3b0 [ 1507.293189][ T9039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1507.293217][ T9039] kvm_vm_ioctl+0x85f/0xc60 [ 1507.293239][ T9039] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 1507.293276][ T9039] ? kasan_quarantine_put+0xdd/0x220 [ 1507.293306][ T9039] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1507.293329][ T9039] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1507.293353][ T9039] ? do_vfs_ioctl+0xbe8/0x1430 [ 1507.293382][ T9039] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1507.293404][ T9039] ? vfs_write+0x956/0xb30 [ 1507.293457][ T9039] ? ksys_write+0x1e1/0x250 [ 1507.293485][ T9039] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1507.293504][ T9039] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 1507.293523][ T9039] __se_sys_ioctl+0xf9/0x170 [ 1507.293545][ T9039] do_syscall_64+0xfa/0x3b0 [ 1507.293562][ T9039] ? lockdep_hardirqs_on+0x9c/0x150 [ 1507.293579][ T9039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1507.293597][ T9039] ? clear_bhb_loop+0x60/0xb0 [ 1507.293618][ T9039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1507.293636][ T9039] RIP: 0033:0x7f8f2db8eec9 [ 1507.293653][ T9039] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1507.293668][ T9039] RSP: 002b:00007f8f2ea46038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1507.293687][ T9039] RAX: ffffffffffffffda RBX: 00007f8f2dde5fa0 RCX: 00007f8f2db8eec9 [ 1507.293700][ T9039] RDX: 0000200000000280 RSI: 000000004038ae7a RDI: 0000000000000004 [ 1507.293712][ T9039] RBP: 00007f8f2ea46090 R08: 0000000000000000 R09: 0000000000000000 [ 1507.293723][ T9039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1507.293734][ T9039] R13: 00007f8f2dde6038 R14: 00007f8f2dde5fa0 R15: 00007f8f2df0fa28 [ 1507.293764][ T9039] [ 1507.755053][ T9043] fuse: Unknown parameter 'smackfsfloor' [ 1507.903831][ T9048] netlink: 1624 bytes leftover after parsing attributes in process `syz.1.13792'. [ 1508.188283][ T9060] openvswitch: netlink: Flow actions attr not present in new flow. [ 1508.201431][ T9066] netlink: 32 bytes leftover after parsing attributes in process `syz.2.13798'. [ 1508.222981][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 1508.223005][ T30] audit: type=1326 audit(1759305708.761:1574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9052 comm="syz.0.13794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05b998eec9 code=0x7ffc0000 [ 1508.260760][ T9066] openvswitch: netlink: Flow actions attr not present in new flow. [ 1508.344385][ T30] audit: type=1326 audit(1759305708.831:1575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9052 comm="syz.0.13794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f05b998eec9 code=0x7ffc0000 [ 1508.472523][ T30] audit: type=1326 audit(1759305708.831:1576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9052 comm="syz.0.13794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05b998eec9 code=0x7ffc0000 [ 1508.496808][ T30] audit: type=1326 audit(1759305708.831:1577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9052 comm="syz.0.13794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05b998eec9 code=0x7ffc0000 [ 1508.523374][ T30] audit: type=1326 audit(1759305708.841:1578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9052 comm="syz.0.13794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f05b998eec9 code=0x7ffc0000 [ 1508.546461][ T30] audit: type=1326 audit(1759305708.841:1579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9052 comm="syz.0.13794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05b998eec9 code=0x7ffc0000 [ 1508.569972][ T30] audit: type=1326 audit(1759305708.841:1580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9052 comm="syz.0.13794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05b998eec9 code=0x7ffc0000 [ 1508.592549][ C1] vkms_vblank_simulate: vblank timer overrun [ 1508.599084][ T30] audit: type=1326 audit(1759305708.851:1581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9052 comm="syz.0.13794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f05b998eec9 code=0x7ffc0000 [ 1508.621495][ C1] vkms_vblank_simulate: vblank timer overrun [ 1508.647062][ T9080] vim2m vim2m.0: vidioc_s_fmt queue busy [ 1508.667606][ T30] audit: type=1326 audit(1759305708.851:1582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9052 comm="syz.0.13794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05b998eec9 code=0x7ffc0000 [ 1508.690201][ C1] vkms_vblank_simulate: vblank timer overrun [ 1508.707043][ T30] audit: type=1326 audit(1759305708.871:1583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9052 comm="syz.0.13794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05b998eec9 code=0x7ffc0000 [ 1509.326786][ T9087] tipc: Enabled bearer , priority 0 [ 1509.342911][ T9087] syzkaller0: entered promiscuous mode [ 1509.367699][ T9087] syzkaller0: entered allmulticast mode [ 1509.837536][ T9087] tipc: Resetting bearer [ 1509.854276][ T9084] tipc: Resetting bearer [ 1509.949369][ T9097] fuse: Unknown parameter 'smackfsfloor' [ 1510.009106][ T9084] tipc: Disabling bearer [ 1510.297764][ T9109] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.13805'. [ 1510.848014][ T9114] 8021q: VLANs not supported on ip_vti0 [ 1510.948494][ T9117] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13809'. [ 1510.961698][ T9118] FAULT_INJECTION: forcing a failure. [ 1510.961698][ T9118] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1510.978485][ T9117] openvswitch: netlink: Flow actions attr not present in new flow. [ 1511.024083][ T9118] CPU: 0 UID: 0 PID: 9118 Comm: syz.2.13808 Not tainted syzkaller #0 PREEMPT(full) [ 1511.024108][ T9118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1511.024121][ T9118] Call Trace: [ 1511.024128][ T9118] [ 1511.024135][ T9118] dump_stack_lvl+0x189/0x250 [ 1511.024161][ T9118] ? __pfx____ratelimit+0x10/0x10 [ 1511.024179][ T9118] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1511.024200][ T9118] ? __pfx__printk+0x10/0x10 [ 1511.024217][ T9118] ? __might_fault+0xb0/0x130 [ 1511.024250][ T9118] should_fail_ex+0x414/0x560 [ 1511.024279][ T9118] _copy_from_user+0x2d/0xb0 [ 1511.024301][ T9118] udmabuf_ioctl+0x121/0x2c0 [ 1511.024329][ T9118] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 1511.024356][ T9118] ? __fget_files+0x2a/0x420 [ 1511.024381][ T9118] ? __fget_files+0x2a/0x420 [ 1511.024402][ T9118] ? __fget_files+0x3a0/0x420 [ 1511.024424][ T9118] ? __fget_files+0x2a/0x420 [ 1511.024449][ T9118] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1511.024467][ T9118] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 1511.024492][ T9118] __se_sys_ioctl+0xf9/0x170 [ 1511.024514][ T9118] do_syscall_64+0xfa/0x3b0 [ 1511.024529][ T9118] ? lockdep_hardirqs_on+0x9c/0x150 [ 1511.024547][ T9118] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1511.024568][ T9118] ? clear_bhb_loop+0x60/0xb0 [ 1511.024589][ T9118] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1511.024605][ T9118] RIP: 0033:0x7fed7f58eec9 [ 1511.024622][ T9118] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1511.024637][ T9118] RSP: 002b:00007fed803a9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1511.024655][ T9118] RAX: ffffffffffffffda RBX: 00007fed7f7e5fa0 RCX: 00007fed7f58eec9 [ 1511.024668][ T9118] RDX: 0000200000000080 RSI: 0000000040087543 RDI: 0000000000000003 [ 1511.024680][ T9118] RBP: 00007fed803a9090 R08: 0000000000000000 R09: 0000000000000000 [ 1511.024692][ T9118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1511.024702][ T9118] R13: 00007fed7f7e6038 R14: 00007fed7f7e5fa0 R15: 00007fed7f90fa28 [ 1511.024737][ T9118] [ 1511.233286][ C0] vkms_vblank_simulate: vblank timer overrun [ 1511.395741][ T9120] openvswitch: netlink: Flow actions attr not present in new flow. [ 1511.568462][ T9132] fuse: Unknown parameter 'smackfsfloor' [ 1511.790769][ T5895] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 1511.950592][ T5895] usb 4-1: Using ep0 maxpacket: 16 [ 1511.974455][ T5895] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1511.998857][ T5895] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1512.028142][ T5895] usb 4-1: Product: syz [ 1512.064266][ T5895] usb 4-1: Manufacturer: syz [ 1512.097285][ T5895] usb 4-1: SerialNumber: syz [ 1512.137713][ T5895] r8152-cfgselector 4-1: Unknown version 0x0000 [ 1512.171002][ T5929] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 1512.238370][ T5895] r8152-cfgselector 4-1: config 0 descriptor?? [ 1512.397911][ T5929] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1512.415217][ T5929] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1512.432888][ T9150] netlink: 32 bytes leftover after parsing attributes in process `syz.0.13823'. [ 1512.442462][ T5929] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1512.451808][ T9150] openvswitch: netlink: Flow actions attr not present in new flow. [ 1512.486712][ T5929] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1512.524042][ T5929] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1512.563973][ T5929] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1512.579542][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1512.614473][ T5929] usb 3-1: Product: syz [ 1512.628204][ T5929] usb 3-1: Manufacturer: syz [ 1512.724403][ T5929] cdc_wdm 3-1:1.0: skipping garbage [ 1512.740746][ T5929] cdc_wdm 3-1:1.0: skipping garbage [ 1512.760900][ T9158] netlink: 24 bytes leftover after parsing attributes in process `syz.4.13824'. [ 1512.776002][ T5929] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 1512.795498][ T9160] netlink: 32 bytes leftover after parsing attributes in process `syz.0.13825'. [ 1512.865956][ T5929] cdc_wdm 3-1:1.0: Unknown control protocol [ 1513.011269][ T9160] openvswitch: netlink: Flow actions attr not present in new flow. [ 1513.025938][ T5895] r8152-cfgselector 4-1: Unknown version 0x08a0 [ 1513.101063][ T5895] r8152-cfgselector 4-1: bad CDC descriptors [ 1513.267894][ T9169] fuse: Unknown parameter 'smackfsfloor' [ 1513.310677][ T9172] openvswitch: netlink: Flow actions attr not present in new flow. [ 1513.406662][ T9176] openvswitch: netlink: Flow actions attr not present in new flow. [ 1513.820689][ T5929] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 1513.980649][ T5929] usb 2-1: Using ep0 maxpacket: 8 [ 1514.000054][ T5929] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1514.011880][ T5929] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1514.022791][ T5929] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1514.034003][ T5929] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1514.048648][ T5929] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1514.058226][ T5929] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1514.274206][ T5929] usb 2-1: GET_CAPABILITIES returned 0 [ 1514.279847][ T5929] usbtmc 2-1:16.0: can't read capabilities [ 1514.478665][ C1] cdc_wdm 3-1:1.0: Unexpected error -71 [ 1514.484290][ C1] wdm_int_callback: 71 callbacks suppressed [ 1514.484304][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 1514.496745][ C1] wdm_int_callback: 72 callbacks suppressed [ 1514.496757][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 1514.509067][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 1514.515710][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 1514.522099][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 1514.528780][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 1514.535051][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 1514.541632][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 1514.547963][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 1514.554544][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 1514.560948][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 1514.567562][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 1514.573890][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 1514.580484][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 1514.586763][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 1514.593377][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 1514.599759][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 1514.606376][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 1514.612677][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 1514.619267][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 1514.626835][ T5895] usb 3-1: USB disconnect, device number 65 [ 1514.633035][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1514.653093][ T5929] usb 2-1: USB disconnect, device number 55 [ 1514.702811][T28789] r8152-cfgselector 4-1: USB disconnect, device number 98 [ 1514.766652][ T9184] netlink: 256 bytes leftover after parsing attributes in process `syz.3.13834'. [ 1514.821622][ T9189] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13835'. [ 1514.831841][ T9189] openvswitch: netlink: Flow actions attr not present in new flow. [ 1514.887381][ T9191] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13836'. [ 1514.897549][ T9191] openvswitch: netlink: Flow actions attr not present in new flow. [ 1514.945204][ T9193] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13837'. [ 1514.955699][ T9193] openvswitch: netlink: Flow actions attr not present in new flow. [ 1515.102924][ T9199] fuse: Unknown parameter 'smackfsfloor' [ 1515.168207][ T9202] tipc: Enabled bearer , priority 0 [ 1515.177139][ T9202] syzkaller0: entered promiscuous mode [ 1515.183539][ T9202] syzkaller0: entered allmulticast mode [ 1515.231009][ T9201] tipc: Resetting bearer [ 1515.241718][ T9204] openvswitch: netlink: Flow actions attr not present in new flow. [ 1515.273241][ T9201] tipc: Disabling bearer [ 1515.407904][ T9212] netlink: 1688 bytes leftover after parsing attributes in process `syz.3.13846'. [ 1515.425491][ T9213] binder: 9207:9213 ioctl c00c620f 200000000200 returned -22 [ 1515.551687][ T9216] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13847'. [ 1516.127042][ T9229] fuse: Unknown parameter 'smackfsfloor' [ 1516.337159][ T9236] loop4: detected capacity change from 0 to 7 [ 1516.371236][ T9236] Dev loop4: unable to read RDB block 7 [ 1516.378465][ T9236] loop4: AHDI p1 p2 p3 [ 1516.383177][ T9236] loop4: partition table partially beyond EOD, truncated [ 1516.391930][ T9236] loop4: p1 start 1601398130 is beyond EOD, truncated [ 1516.399010][ T9236] loop4: p2 start 1702059890 is beyond EOD, truncated [ 1516.527295][ T9240] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13854'. [ 1516.540834][T31425] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 1516.709665][ T9245] tipc: Enabled bearer , priority 0 [ 1516.750048][ T9245] syzkaller0: entered promiscuous mode [ 1516.775207][T31425] usb 4-1: Using ep0 maxpacket: 8 [ 1516.780554][ T9245] syzkaller0: entered allmulticast mode [ 1516.808308][T31425] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1516.852038][T31425] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1516.880694][T31425] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1516.905716][T31425] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1516.930928][ T9244] tipc: Resetting bearer [ 1516.936890][T31425] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1516.950698][T31425] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1517.011777][ T9244] tipc: Disabling bearer [ 1517.158923][ T9249] netlink: 1688 bytes leftover after parsing attributes in process `syz.0.13857'. [ 1517.197872][T31425] usb 4-1: GET_CAPABILITIES returned 0 [ 1517.220568][T31425] usbtmc 4-1:16.0: can't read capabilities [ 1517.351661][ T9251] pim6reg: entered allmulticast mode [ 1517.405350][T31425] usb 4-1: USB disconnect, device number 99 [ 1517.513115][ T9240] 8021q: VLANs not supported on tunl0 [ 1518.013012][ T9260] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 1518.452501][ T30] kauditd_printk_skb: 41 callbacks suppressed [ 1518.452518][ T30] audit: type=1326 audit(1759305719.001:1625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9266 comm="syz.1.13863" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1518.521794][ T30] audit: type=1326 audit(1759305719.061:1626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9266 comm="syz.1.13863" exe="/root/syz-executor" sig=0 arch=c000003e syscall=246 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1518.578598][ T30] audit: type=1326 audit(1759305719.091:1627): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9266 comm="syz.1.13863" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1518.608215][ T30] audit: type=1326 audit(1759305719.091:1628): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9266 comm="syz.1.13863" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1518.630764][ C0] vkms_vblank_simulate: vblank timer overrun [ 1518.675832][ T30] audit: type=1326 audit(1759305719.101:1629): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9266 comm="syz.1.13863" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1518.777634][ T30] audit: type=1326 audit(1759305719.101:1630): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9266 comm="syz.1.13863" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1518.864230][ T30] audit: type=1326 audit(1759305719.101:1631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9266 comm="syz.1.13863" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1518.951208][ T30] audit: type=1326 audit(1759305719.101:1632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9266 comm="syz.1.13863" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1519.050568][ T30] audit: type=1326 audit(1759305719.101:1633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9266 comm="syz.1.13863" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1519.184553][ T30] audit: type=1326 audit(1759305719.721:1634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9266 comm="syz.1.13863" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1519.331813][ T9281] tipc: Enabled bearer , priority 0 [ 1519.388672][ T9281] syzkaller0: entered promiscuous mode [ 1519.434926][ T9281] syzkaller0: entered allmulticast mode [ 1519.606716][ T9280] tipc: Resetting bearer [ 1519.653037][ T9280] tipc: Disabling bearer [ 1519.659169][ T9283] netlink: 'syz.4.13868': attribute type 72 has an invalid length. [ 1519.902204][ T9287] dvmrp0: entered allmulticast mode [ 1520.394695][ T9301] syz.2.13874 (9301) used greatest stack depth: 18360 bytes left [ 1520.437854][ T9] IPVS: starting estimator thread 0... [ 1520.446734][ T9307] kvm: pic: non byte write [ 1520.457180][ T9307] FAULT_INJECTION: forcing a failure. [ 1520.457180][ T9307] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1520.472133][ T9307] CPU: 0 UID: 0 PID: 9307 Comm: syz.3.13876 Not tainted syzkaller #0 PREEMPT(full) [ 1520.472157][ T9307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1520.472168][ T9307] Call Trace: [ 1520.472173][ T9307] [ 1520.472178][ T9307] dump_stack_lvl+0x189/0x250 [ 1520.472196][ T9307] ? __pfx____ratelimit+0x10/0x10 [ 1520.472206][ T9307] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1520.472218][ T9307] ? __pfx__printk+0x10/0x10 [ 1520.472235][ T9307] should_fail_ex+0x414/0x560 [ 1520.472253][ T9307] __kvm_read_guest_page+0x18d/0x240 [ 1520.472269][ T9307] kvm_fetch_guest_virt+0x12b/0x170 [ 1520.472281][ T9307] ? __pfx_kvm_fetch_guest_virt+0x10/0x10 [ 1520.472291][ T9307] __do_insn_fetch_bytes+0x2f9/0x6d0 [ 1520.472306][ T9307] ? __pfx___do_insn_fetch_bytes+0x10/0x10 [ 1520.472319][ T9307] ? lockdep_init_map_type+0x1f0/0x380 [ 1520.472331][ T9307] ? vmx_vcpu_pi_put+0x1da/0x7f0 [ 1520.472347][ T9307] x86_decode_insn+0x33c/0x5310 [ 1520.472357][ T9307] ? __pfx_vmx_vcpu_pi_put+0x10/0x10 [ 1520.472375][ T9307] ? vmx_vcpu_load_vmcs+0x439/0x6b0 [ 1520.472397][ T9307] ? __pfx_x86_decode_insn+0x10/0x10 [ 1520.472415][ T9307] ? __asan_memset+0x22/0x50 [ 1520.472426][ T9307] ? init_decode_cache+0x78/0x90 [ 1520.472437][ T9307] ? init_emulate_ctxt+0x4d6/0x660 [ 1520.472450][ T9307] ? __pfx_init_emulate_ctxt+0x10/0x10 [ 1520.472467][ T9307] x86_emulate_instruction+0x60a/0x1ef0 [ 1520.472482][ T9307] ? rcu_is_watching+0x15/0xb0 [ 1520.472494][ T9307] ? trace_sched_exit_tp+0x36/0x110 [ 1520.472508][ T9307] ? __schedule+0x17ae/0x4cc0 [ 1520.472526][ T9307] ? __pfx_x86_emulate_instruction+0x10/0x10 [ 1520.472548][ T9307] handle_ud+0x142/0x590 [ 1520.472565][ T9307] ? __pfx_handle_ud+0x10/0x10 [ 1520.472579][ T9307] ? __pfx_nested_vmx_reflect_vmexit+0x10/0x10 [ 1520.472602][ T9307] ? nested_mark_vmcs12_pages_dirty+0x1e2/0x3a0 [ 1520.472617][ T9307] ? __pfx_handle_exception_nmi+0x10/0x10 [ 1520.472635][ T9307] vmx_handle_exit+0x1090/0x18a0 [ 1520.472647][ T9307] ? vcpu_run+0x35ed/0x6fb0 [ 1520.472662][ T9307] ? preempt_schedule_thunk+0x16/0x30 [ 1520.472675][ T9307] vcpu_run+0x434f/0x6fb0 [ 1520.472699][ T9307] ? vcpu_run+0x35ed/0x6fb0 [ 1520.472737][ T9307] ? __pfx_vcpu_run+0x10/0x10 [ 1520.472747][ T9307] ? kvm_get_linear_rip+0x419/0x530 [ 1520.472760][ T9307] ? __pfx_kvm_get_linear_rip+0x10/0x10 [ 1520.472780][ T9307] kvm_arch_vcpu_ioctl_run+0xfc9/0x1940 [ 1520.472796][ T9307] ? __mutex_trylock_common+0x153/0x260 [ 1520.472817][ T9307] ? kvm_arch_vcpu_ioctl_run+0x1f3/0x1940 [ 1520.472830][ T9307] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 1520.472844][ T9307] ? rcu_is_watching+0x15/0xb0 [ 1520.472855][ T9307] ? trace_contention_end+0x39/0x120 [ 1520.472867][ T9307] ? __mutex_lock+0x335/0x1350 [ 1520.472880][ T9307] ? kasan_quarantine_put+0xdd/0x220 [ 1520.472893][ T9307] ? kvm_vcpu_ioctl+0x22e/0xe90 [ 1520.472908][ T9307] ? __pfx___mutex_lock+0x10/0x10 [ 1520.472918][ T9307] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1520.472933][ T9307] ? do_vfs_ioctl+0xbe8/0x1430 [ 1520.472946][ T9307] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1520.472958][ T9307] kvm_vcpu_ioctl+0x95c/0xe90 [ 1520.472974][ T9307] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1520.472985][ T9307] ? __lock_acquire+0xab9/0xd20 [ 1520.473005][ T9307] ? __fget_files+0x2a/0x420 [ 1520.473020][ T9307] ? __fget_files+0x2a/0x420 [ 1520.473031][ T9307] ? __fget_files+0x3a0/0x420 [ 1520.473043][ T9307] ? __fget_files+0x2a/0x420 [ 1520.473061][ T9307] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1520.473072][ T9307] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1520.473085][ T9307] __se_sys_ioctl+0xf9/0x170 [ 1520.473096][ T9307] do_syscall_64+0xfa/0x3b0 [ 1520.473107][ T9307] ? lockdep_hardirqs_on+0x9c/0x150 [ 1520.473116][ T9307] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1520.473125][ T9307] ? clear_bhb_loop+0x60/0xb0 [ 1520.473137][ T9307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1520.473146][ T9307] RIP: 0033:0x7fdf5f18eec9 [ 1520.473156][ T9307] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1520.473165][ T9307] RSP: 002b:00007fdf60048038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1520.473176][ T9307] RAX: ffffffffffffffda RBX: 00007fdf5f3e5fa0 RCX: 00007fdf5f18eec9 [ 1520.473183][ T9307] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 1520.473189][ T9307] RBP: 00007fdf60048090 R08: 0000000000000000 R09: 0000000000000000 [ 1520.473195][ T9307] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1520.473201][ T9307] R13: 00007fdf5f3e6038 R14: 00007fdf5f3e5fa0 R15: 00007fdf5f50fa28 [ 1520.473216][ T9307] [ 1520.919846][ C0] net_ratelimit: 1 callbacks suppressed [ 1520.919859][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1520.962881][ T9299] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1520.987067][ T9311] IPVS: using max 32 ests per chain, 76800 per kthread [ 1521.991074][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1522.201333][ T9340] netlink: 32 bytes leftover after parsing attributes in process `syz.4.13885'. [ 1522.210756][ T9340] openvswitch: netlink: Flow actions attr not present in new flow. [ 1522.405651][ T9346] netlink: 28 bytes leftover after parsing attributes in process `syz.3.13887'. [ 1522.420576][ T5929] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1522.425389][ T9346] netlink: 28 bytes leftover after parsing attributes in process `syz.3.13887'. [ 1522.445220][ T9346] bond0: entered promiscuous mode [ 1522.450410][ T9346] bond_slave_0: entered promiscuous mode [ 1522.456867][ T9346] bond_slave_1: entered promiscuous mode [ 1522.464555][ T9346] bond0: left promiscuous mode [ 1522.469341][ T9346] bond_slave_0: left promiscuous mode [ 1522.475193][ T9346] bond_slave_1: left promiscuous mode [ 1522.590857][ T5929] usb 3-1: Using ep0 maxpacket: 8 [ 1522.605190][ T5929] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1522.619812][ T5929] usb 3-1: config 8 has an invalid interface number: 137 but max is 0 [ 1522.633689][ T5929] usb 3-1: config 8 has no interface number 0 [ 1522.642979][ T5929] usb 3-1: config 8 interface 137 altsetting 5 bulk endpoint 0xF has invalid maxpacket 84 [ 1522.657432][ T5929] usb 3-1: config 8 interface 137 has no altsetting 0 [ 1522.671593][ T5929] usb 3-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=e5.0d [ 1522.681346][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1522.689526][ T5929] usb 3-1: Product: syz [ 1522.693922][ T5929] usb 3-1: Manufacturer: syz [ 1522.698614][ T5929] usb 3-1: SerialNumber: syz [ 1522.705812][ T9338] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1522.890752][ T9] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 1523.007498][ T9360] input: syz0 as /devices/virtual/input/input99 [ 1523.027045][ T9338] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1523.031274][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1523.065712][ T9] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1523.076563][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1523.085440][ T9] usb 4-1: Product: syz [ 1523.089692][ T9] usb 4-1: Manufacturer: syz [ 1523.094814][ T9] usb 4-1: SerialNumber: syz [ 1523.109444][ T9] usb 4-1: config 0 descriptor?? [ 1523.118348][ T9338] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1523.164566][ T5929] cyberjack 3-1:8.137: Reiner SCT Cyberjack USB card reader converter detected [ 1523.187312][ T5929] cyberjack ttyUSB0: usb_submit_urb(read int) failed [ 1523.205761][ T5929] usb 3-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 1523.234300][ T5929] usb 3-1: USB disconnect, device number 66 [ 1523.245038][ T5929] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 1523.276458][ T5929] cyberjack 3-1:8.137: device disconnected [ 1523.521354][ T9369] FAULT_INJECTION: forcing a failure. [ 1523.521354][ T9369] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1523.536449][ T9369] CPU: 1 UID: 0 PID: 9369 Comm: syz.1.13893 Not tainted syzkaller #0 PREEMPT(full) [ 1523.536473][ T9369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1523.536483][ T9369] Call Trace: [ 1523.536490][ T9369] [ 1523.536497][ T9369] dump_stack_lvl+0x189/0x250 [ 1523.536525][ T9369] ? __pfx____ratelimit+0x10/0x10 [ 1523.536543][ T9369] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1523.536566][ T9369] ? __pfx__printk+0x10/0x10 [ 1523.536582][ T9369] ? __might_fault+0xb0/0x130 [ 1523.536615][ T9369] should_fail_ex+0x414/0x560 [ 1523.536646][ T9369] _copy_from_user+0x2d/0xb0 [ 1523.536667][ T9369] ___sys_sendmsg+0x158/0x2a0 [ 1523.536691][ T9369] ? __pfx____sys_sendmsg+0x10/0x10 [ 1523.536746][ T9369] ? __fget_files+0x2a/0x420 [ 1523.536768][ T9369] ? __fget_files+0x3a0/0x420 [ 1523.536798][ T9369] __x64_sys_sendmsg+0x19b/0x260 [ 1523.536823][ T9369] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1523.536852][ T9369] ? __pfx_ksys_write+0x10/0x10 [ 1523.536870][ T9369] ? rcu_is_watching+0x15/0xb0 [ 1523.536896][ T9369] ? do_syscall_64+0xbe/0x3b0 [ 1523.536918][ T9369] do_syscall_64+0xfa/0x3b0 [ 1523.536935][ T9369] ? lockdep_hardirqs_on+0x9c/0x150 [ 1523.536952][ T9369] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1523.536969][ T9369] ? clear_bhb_loop+0x60/0xb0 [ 1523.536990][ T9369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1523.537007][ T9369] RIP: 0033:0x7f8f2db8eec9 [ 1523.537023][ T9369] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1523.537039][ T9369] RSP: 002b:00007f8f2ea46038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1523.537058][ T9369] RAX: ffffffffffffffda RBX: 00007f8f2dde5fa0 RCX: 00007f8f2db8eec9 [ 1523.537071][ T9369] RDX: 0000000004008044 RSI: 0000200000000300 RDI: 0000000000000003 [ 1523.537083][ T9369] RBP: 00007f8f2ea46090 R08: 0000000000000000 R09: 0000000000000000 [ 1523.537095][ T9369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1523.537105][ T9369] R13: 00007f8f2dde6038 R14: 00007f8f2dde5fa0 R15: 00007f8f2df0fa28 [ 1523.537133][ T9369] [ 1523.729646][ T9] usb 4-1: Firmware version (0.0) predates our first public release. [ 1523.809106][ T9] usb 4-1: Please update to version 0.2 or newer [ 1523.900904][ T9] usb 4-1: USB disconnect, device number 100 [ 1523.991262][ T9377] syzkaller0: entered promiscuous mode [ 1523.996778][ T9377] syzkaller0: entered allmulticast mode [ 1524.070793][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1524.220571][ T10] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 1524.390767][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 1524.398075][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 52, changing to 9 [ 1524.421084][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 8241, setting to 1024 [ 1524.453981][ T10] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 1524.478675][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1524.502249][ T10] usb 2-1: Product: syz [ 1524.511017][ T10] usb 2-1: Manufacturer: syz [ 1524.522252][ T10] usb 2-1: SerialNumber: syz [ 1524.545925][ T10] usb 2-1: config 0 descriptor?? [ 1524.571548][ T10] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1524.620733][ T5895] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 1524.796666][ T5526] usb 2-1: USB disconnect, device number 56 [ 1524.804537][ T13] usb 2-1: Failed to submit usb control message: -71 [ 1524.814993][ T13] usb 2-1: unable to send the bmi data to the device: -71 [ 1524.829446][ T13] usb 2-1: unable to get target info from device [ 1524.850785][ T5895] usb 4-1: Using ep0 maxpacket: 16 [ 1524.857493][ T5895] usb 4-1: config index 0 descriptor too short (expected 1810, got 18) [ 1524.866051][ T5895] usb 4-1: New USB device found, idVendor=102c, idProduct=6151, bcdDevice=44.e6 [ 1524.887786][ T13] usb 2-1: could not get target info (-71) [ 1524.900504][ T5895] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1524.912794][ T13] usb 2-1: could not probe fw (-71) [ 1524.994182][ T5895] usb 4-1: config 0 descriptor?? [ 1525.014417][ T5895] gspca_main: etoms-2.14.0 probing 102c:6151 [ 1525.111113][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1525.408312][ T5895] usb 4-1: USB disconnect, device number 101 [ 1525.460565][ T5839] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 1525.543171][ T9398] FAULT_INJECTION: forcing a failure. [ 1525.543171][ T9398] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1525.576767][ T9398] CPU: 1 UID: 0 PID: 9398 Comm: syz.1.13902 Not tainted syzkaller #0 PREEMPT(full) [ 1525.576782][ T9398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1525.576789][ T9398] Call Trace: [ 1525.576793][ T9398] [ 1525.576799][ T9398] dump_stack_lvl+0x189/0x250 [ 1525.576816][ T9398] ? __pfx____ratelimit+0x10/0x10 [ 1525.576826][ T9398] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1525.576838][ T9398] ? __pfx__printk+0x10/0x10 [ 1525.576848][ T9398] ? __might_fault+0xb0/0x130 [ 1525.576866][ T9398] should_fail_ex+0x414/0x560 [ 1525.576882][ T9398] _copy_from_user+0x2d/0xb0 [ 1525.576898][ T9398] snd_seq_ioctl+0x1d8/0x420 [ 1525.576916][ T9398] ? __pfx_snd_seq_ioctl+0x10/0x10 [ 1525.576939][ T9398] ? __fget_files+0x3a0/0x420 [ 1525.576951][ T9398] ? __fget_files+0x2a/0x420 [ 1525.576965][ T9398] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1525.576976][ T9398] ? __pfx_snd_seq_ioctl+0x10/0x10 [ 1525.576989][ T9398] __se_sys_ioctl+0xf9/0x170 [ 1525.577001][ T9398] do_syscall_64+0xfa/0x3b0 [ 1525.577011][ T9398] ? lockdep_hardirqs_on+0x9c/0x150 [ 1525.577020][ T9398] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1525.577029][ T9398] ? clear_bhb_loop+0x60/0xb0 [ 1525.577042][ T9398] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1525.577050][ T9398] RIP: 0033:0x7f8f2db8eec9 [ 1525.577060][ T9398] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1525.577069][ T9398] RSP: 002b:00007f8f2ea46038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1525.577079][ T9398] RAX: ffffffffffffffda RBX: 00007f8f2dde5fa0 RCX: 00007f8f2db8eec9 [ 1525.577086][ T9398] RDX: 0000200000000100 RSI: 0000000040505331 RDI: 000000000000000b [ 1525.577093][ T9398] RBP: 00007f8f2ea46090 R08: 0000000000000000 R09: 0000000000000000 [ 1525.577099][ T9398] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1525.577104][ T9398] R13: 00007f8f2dde6038 R14: 00007f8f2dde5fa0 R15: 00007f8f2df0fa28 [ 1525.577120][ T9398] [ 1525.900523][ T5839] usb 5-1: Using ep0 maxpacket: 8 [ 1525.907821][ T5839] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1525.917683][ T5839] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 0 [ 1525.927479][ T5839] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1525.938663][ T5839] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1525.948924][ T5839] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 1525.960490][ T5839] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 47, changing to 9 [ 1525.971659][ T5839] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 26213, setting to 1024 [ 1525.985252][ T5839] usb 5-1: New USB device found, idVendor=0499, idProduct=1055, bcdDevice= 1.a4 [ 1525.994694][ T5839] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1526.006068][ T5839] usb 5-1: Product: syz [ 1526.010246][ T5839] usb 5-1: Manufacturer: syz [ 1526.021370][ T5839] usb 5-1: SerialNumber: syz [ 1526.035932][ T5839] usb 5-1: config 0 descriptor?? [ 1526.052675][ T9393] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1526.150759][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1526.360632][ T9] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 1526.384263][ T5839] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1526.426676][ T5839] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1526.456406][ T5839] usb 5-1: USB disconnect, device number 66 [ 1526.521275][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 1526.681352][ T887] udevd[887]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1526.755130][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1526.802383][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1526.827739][ T9416] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13907'. [ 1526.837062][ T9416] openvswitch: netlink: Flow actions attr not present in new flow. [ 1526.848937][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1526.864749][ T9] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1526.875315][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1526.896305][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1526.907393][ T9] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1526.919893][ T9] usb 3-1: Manufacturer: syz [ 1526.929961][ T9] usb 3-1: config 0 descriptor?? [ 1527.191191][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1527.248567][ T9430] syzkaller0: entered promiscuous mode [ 1527.273796][ T9430] syzkaller0: entered allmulticast mode [ 1527.298350][ T9] rc_core: IR keymap rc-hauppauge not found [ 1527.306833][ T9] Registered IR keymap rc-empty [ 1527.349965][ T9434] netlink: 32 bytes leftover after parsing attributes in process `syz.1.13912'. [ 1527.361473][ T9434] openvswitch: netlink: Flow actions attr not present in new flow. [ 1527.361801][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1527.422630][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1527.485639][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 1527.527540][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input100 [ 1527.558988][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1527.594084][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1527.610290][ T9443] loop5: detected capacity change from 0 to 7 [ 1527.618496][ T9443] Dev loop5: unable to read RDB block 7 [ 1527.620735][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1527.624335][ T9443] loop5: unable to read partition table [ 1527.637437][ T9443] loop5: partition table beyond EOD, truncated [ 1527.643717][ T9443] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1527.658068][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1527.701288][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1527.741578][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1527.744788][ T9447] netlink: 32 bytes leftover after parsing attributes in process `syz.2.13918'. [ 1527.763475][ T9447] openvswitch: netlink: Flow actions attr not present in new flow. [ 1527.781326][ T5929] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 1527.810883][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1527.844635][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1527.870629][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1527.890614][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1527.915804][ T9] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1527.929834][ T9] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1527.943483][ T5929] usb 2-1: Using ep0 maxpacket: 16 [ 1527.976891][ T5929] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1527.988291][ T5929] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1527.998995][ T9] usb 3-1: USB disconnect, device number 67 [ 1528.005763][ T5929] usb 2-1: Product: syz [ 1528.010116][ T5929] usb 2-1: Manufacturer: syz [ 1528.015150][ T5929] usb 2-1: SerialNumber: syz [ 1528.035854][ T5929] r8152-cfgselector 2-1: Unknown version 0x0000 [ 1528.083101][ T5929] r8152-cfgselector 2-1: config 0 descriptor?? [ 1528.230821][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1528.331604][ T5895] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 1528.380562][ T9] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 1528.420557][ T5929] r8152-cfgselector 2-1: Unknown version 0x08a0 [ 1528.427306][ T5929] r8152-cfgselector 2-1: bad CDC descriptors [ 1528.490524][ T5895] usb 5-1: Using ep0 maxpacket: 16 [ 1528.497315][ T5895] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1528.508552][ T5895] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1528.518413][ T5895] usb 5-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 1528.527604][ T5895] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1528.537613][ T5895] usb 5-1: config 0 descriptor?? [ 1528.550936][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 1528.558401][ T9] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1528.569835][ T9] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1528.583494][ T9] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1528.593470][ T9] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1528.606663][ T9] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1528.615847][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1528.852071][ T9] usb 3-1: GET_CAPABILITIES returned 0 [ 1528.858179][ T9] usbtmc 3-1:16.0: can't read capabilities [ 1529.057314][ T5839] usb 3-1: USB disconnect, device number 68 [ 1529.155136][ T5895] usbhid 5-1:0.0: can't add hid device: -71 [ 1529.166696][ T5895] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1529.188883][ T5895] usb 5-1: USB disconnect, device number 67 [ 1529.239156][ T9464] netlink: 32 bytes leftover after parsing attributes in process `syz.0.13924'. [ 1529.251528][ T9464] openvswitch: netlink: Flow actions attr not present in new flow. [ 1529.270985][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1529.440611][ T9469] netlink: 32 bytes leftover after parsing attributes in process `syz.0.13927'. [ 1529.637689][ T9476] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13929'. [ 1529.647326][ T9476] openvswitch: netlink: Flow actions attr not present in new flow. [ 1529.892742][ T9483] syzkaller0: entered promiscuous mode [ 1529.916224][ T9483] syzkaller0: entered allmulticast mode [ 1529.950723][ T5929] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 1530.112330][ T5929] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1530.140884][ T5929] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1530.151443][ T5929] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 1530.180737][ T5929] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1530.207236][ T5929] usb 3-1: config 0 descriptor?? [ 1530.320918][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1530.661491][ T5929] cp2112 0003:10C4:EA90.0030: unknown main item tag 0x0 [ 1530.678392][ T5929] cp2112 0003:10C4:EA90.0030: unknown main item tag 0x0 [ 1530.695708][ T5929] cp2112 0003:10C4:EA90.0030: unknown main item tag 0x0 [ 1530.716109][ T5929] cp2112 0003:10C4:EA90.0030: unknown main item tag 0x0 [ 1530.742357][ T5929] cp2112 0003:10C4:EA90.0030: unknown main item tag 0x0 [ 1530.749384][ T5929] cp2112 0003:10C4:EA90.0030: unknown main item tag 0x0 [ 1530.777178][ T5929] cp2112 0003:10C4:EA90.0030: unknown main item tag 0x0 [ 1530.810732][ T5929] cp2112 0003:10C4:EA90.0030: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 1530.865858][ T9493] netlink: 32 bytes leftover after parsing attributes in process `syz.0.13935'. [ 1530.908118][ T5929] cp2112 0003:10C4:EA90.0030: Part Number: 0x00 Device Version: 0x00 [ 1531.108914][ T5929] cp2112 0003:10C4:EA90.0030: error requesting SMBus config [ 1531.140143][ T5929] cp2112 0003:10C4:EA90.0030: probe with driver cp2112 failed with error -5 [ 1531.351233][ C0] net_ratelimit: 1 callbacks suppressed [ 1531.351253][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1532.390655][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1532.763624][ T5895] r8152-cfgselector 2-1: USB disconnect, device number 57 [ 1532.792279][ T9520] netlink: 32 bytes leftover after parsing attributes in process `syz.4.13942'. [ 1532.804737][ T9520] openvswitch: netlink: Flow actions attr not present in new flow. [ 1532.900907][ T5526] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 1532.923397][ T9522] tipc: Enabling of bearer rejected, already enabled [ 1533.006310][ T5839] usb 3-1: USB disconnect, device number 69 [ 1533.070908][ T5526] usb 4-1: Using ep0 maxpacket: 8 [ 1533.079268][ T5526] usb 4-1: config index 0 descriptor too short (expected 1307, got 27) [ 1533.087683][ T5526] usb 4-1: config 0 has an invalid interface number: 255 but max is -1 [ 1533.096108][ T5526] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1533.106807][ T5526] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1533.118925][ T5526] usb 4-1: config 0 has no interface number 0 [ 1533.146640][ T5526] usb 4-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 1533.166395][ T9530] syzkaller0: entered promiscuous mode [ 1533.176013][ T9530] syzkaller0: entered allmulticast mode [ 1533.185908][ T5526] usb 4-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1533.210724][ T5526] usb 4-1: config 0 interface 255 has no altsetting 0 [ 1533.231019][ T5526] usb 4-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 1533.240806][ T5895] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 1533.268682][ T5526] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1533.290408][ T5526] usb 4-1: Product: syz [ 1533.295415][ T5526] usb 4-1: Manufacturer: syz [ 1533.300296][ T5526] usb 4-1: SerialNumber: syz [ 1533.319448][ T5526] usb 4-1: config 0 descriptor?? [ 1533.338833][ T5526] hub 4-1:0.255: bad descriptor, ignoring hub [ 1533.348760][ T5526] hub 4-1:0.255: probe with driver hub failed with error -5 [ 1533.430973][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1533.436074][ T5895] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1533.453129][ T5895] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1533.464540][ T5895] usb 2-1: Product: syz [ 1533.468992][ T5895] usb 2-1: Manufacturer: syz [ 1533.474884][ T5895] usb 2-1: SerialNumber: syz [ 1533.503860][ T5895] usb 2-1: config 0 descriptor?? [ 1533.660877][ T5526] usb 4-1: USB disconnect, device number 102 [ 1533.922810][ T5895] usb 2-1: Firmware: major: 130, minor: 102, hardware type: HULUSB (4) [ 1533.957028][ T9536] netlink: 32 bytes leftover after parsing attributes in process `syz.4.13947'. [ 1533.970572][ T9536] openvswitch: netlink: Flow actions attr not present in new flow. [ 1534.134637][ T5895] usb 2-1: failed to fetch extended address, random address set [ 1534.203177][ T5895] usb 2-1: USB disconnect, device number 58 [ 1534.261232][ T9] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 1534.432044][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1534.444362][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1534.454195][ T9] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 1534.463549][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1534.471779][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1534.481357][ T5839] usb 4-1: new full-speed USB device number 103 using dummy_hcd [ 1534.495813][ T9] usb 3-1: config 0 descriptor?? [ 1534.645995][ T5839] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1534.655309][ T5839] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1534.663457][ T5839] usb 4-1: Product: syz [ 1534.667917][ T5839] usb 4-1: Manufacturer: syz [ 1534.672647][ T5839] usb 4-1: SerialNumber: syz [ 1534.680365][ T5839] usb 4-1: config 0 descriptor?? [ 1534.893222][ T5839] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1534.935908][ T9] cp2112 0003:10C4:EA90.0031: unknown main item tag 0x0 [ 1534.961395][ T9] cp2112 0003:10C4:EA90.0031: unknown main item tag 0x0 [ 1534.979233][ T9] cp2112 0003:10C4:EA90.0031: unknown main item tag 0x0 [ 1535.015914][ T9] cp2112 0003:10C4:EA90.0031: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 1535.128373][ T9] cp2112 0003:10C4:EA90.0031: Part Number: 0x00 Device Version: 0x00 [ 1535.338041][ T9] cp2112 0003:10C4:EA90.0031: error requesting SMBus config [ 1535.365735][ T9] cp2112 0003:10C4:EA90.0031: probe with driver cp2112 failed with error -5 [ 1535.510948][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1535.955962][ T9560] netlink: 32 bytes leftover after parsing attributes in process `syz.0.13954'. [ 1535.975577][ T9560] openvswitch: netlink: Flow actions attr not present in new flow. [ 1536.176077][ T9546] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1536.223446][ T9546] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1536.262564][ T5839] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1536.289449][ T5839] usb 4-1: USB disconnect, device number 103 [ 1536.450526][ T5895] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 1536.560641][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1536.838424][ T9575] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13959'. [ 1536.856798][ T9575] openvswitch: netlink: Flow actions attr not present in new flow. [ 1536.866573][ T5895] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1536.882954][ T5895] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1536.903932][ T5895] usb 5-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 1536.913182][ T5895] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1536.931036][ T5895] usb 5-1: config 0 descriptor?? [ 1537.103678][ T5839] usb 3-1: USB disconnect, device number 70 [ 1537.364281][ T5895] hid_parser_main: 4 callbacks suppressed [ 1537.364311][ T5895] cp2112 0003:10C4:EA90.0032: unknown main item tag 0x0 [ 1537.420828][ T5895] cp2112 0003:10C4:EA90.0032: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.4-1/input0 [ 1537.590900][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1537.616127][ T9593] openvswitch: netlink: Flow actions attr not present in new flow. [ 1537.631324][ T5895] cp2112 0003:10C4:EA90.0032: Part Number: 0x82 Device Version: 0xFE [ 1538.081932][ T9597] netlink: 32 bytes leftover after parsing attributes in process `syz.1.13966'. [ 1538.135770][ T9597] openvswitch: netlink: Flow actions attr not present in new flow. [ 1538.630599][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1538.809306][ T9609] FAULT_INJECTION: forcing a failure. [ 1538.809306][ T9609] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1538.863543][ T9609] CPU: 0 UID: 0 PID: 9609 Comm: syz.2.13969 Not tainted syzkaller #0 PREEMPT(full) [ 1538.863568][ T9609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1538.863579][ T9609] Call Trace: [ 1538.863587][ T9609] [ 1538.863595][ T9609] dump_stack_lvl+0x189/0x250 [ 1538.863620][ T9609] ? __pfx____ratelimit+0x10/0x10 [ 1538.863635][ T9609] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1538.863653][ T9609] ? __pfx__printk+0x10/0x10 [ 1538.863668][ T9609] ? __might_fault+0xb0/0x130 [ 1538.863698][ T9609] should_fail_ex+0x414/0x560 [ 1538.863723][ T9609] _copy_from_user+0x2d/0xb0 [ 1538.863743][ T9609] lo_ioctl+0x53c/0x1c10 [ 1538.863779][ T9609] ? __pfx_lo_ioctl+0x10/0x10 [ 1538.863798][ T9609] ? ima_match_policy+0x10b/0x2150 [ 1538.863817][ T9609] ? look_up_lock_class+0x74/0x170 [ 1538.863834][ T9609] ? register_lock_class+0x51/0x320 [ 1538.863856][ T9609] ? __lock_acquire+0xab9/0xd20 [ 1538.863882][ T9609] ? process_measurement+0x3d8/0x1a40 [ 1538.863905][ T9609] ? __lock_acquire+0xab9/0xd20 [ 1538.863933][ T9609] ? __lock_acquire+0xab9/0xd20 [ 1538.863959][ T9609] ? __lock_acquire+0xab9/0xd20 [ 1538.863988][ T9609] ? __lock_acquire+0xab9/0xd20 [ 1538.864023][ T9609] ? is_bpf_text_address+0x26/0x2b0 [ 1538.864044][ T9609] ? is_bpf_text_address+0x292/0x2b0 [ 1538.864058][ T9609] ? is_bpf_text_address+0x26/0x2b0 [ 1538.864078][ T9609] ? kernel_text_address+0xa5/0xe0 [ 1538.864101][ T9609] ? __kernel_text_address+0xd/0x40 [ 1538.864121][ T9609] ? unwind_get_return_address+0x4d/0x90 [ 1538.864139][ T9609] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1538.864161][ T9609] ? arch_stack_walk+0xfc/0x150 [ 1538.864192][ T9609] ? stack_trace_save+0x9c/0xe0 [ 1538.864214][ T9609] ? __pfx_stack_trace_save+0x10/0x10 [ 1538.864234][ T9609] ? stack_depot_save_flags+0x40/0x860 [ 1538.864262][ T9609] ? kasan_save_track+0x4f/0x80 [ 1538.864279][ T9609] ? kasan_save_track+0x3e/0x80 [ 1538.864294][ T9609] ? kasan_save_free_info+0x46/0x50 [ 1538.864307][ T9609] ? __kasan_slab_free+0x5b/0x80 [ 1538.864324][ T9609] ? kfree+0x18e/0x440 [ 1538.864339][ T9609] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 1538.864358][ T9609] ? security_file_ioctl+0xcb/0x2d0 [ 1538.864374][ T9609] ? __se_sys_ioctl+0x47/0x170 [ 1538.864389][ T9609] ? do_syscall_64+0xfa/0x3b0 [ 1538.864403][ T9609] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1538.864438][ T9609] ? __asan_memset+0x22/0x50 [ 1538.864453][ T9609] ? blk_get_meta_cap+0x18c/0x750 [ 1538.864480][ T9609] ? __pfx_blk_get_meta_cap+0x10/0x10 [ 1538.864500][ T9609] ? kasan_quarantine_put+0xdd/0x220 [ 1538.864525][ T9609] ? blkdev_common_ioctl+0xff7/0x2550 [ 1538.864542][ T9609] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1538.864568][ T9609] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 1538.864586][ T9609] ? do_vfs_ioctl+0xbe8/0x1430 [ 1538.864643][ T9609] ? __pfx_lo_ioctl+0x10/0x10 [ 1538.864665][ T9609] blkdev_ioctl+0x5a8/0x6d0 [ 1538.864681][ T9609] ? __pfx_blkdev_ioctl+0x10/0x10 [ 1538.864694][ T9609] ? __fget_files+0x2a/0x420 [ 1538.864720][ T9609] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1538.864738][ T9609] ? __pfx_blkdev_ioctl+0x10/0x10 [ 1538.864758][ T9609] __se_sys_ioctl+0xf9/0x170 [ 1538.864778][ T9609] do_syscall_64+0xfa/0x3b0 [ 1538.864795][ T9609] ? lockdep_hardirqs_on+0x9c/0x150 [ 1538.864812][ T9609] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1538.864829][ T9609] ? clear_bhb_loop+0x60/0xb0 [ 1538.864850][ T9609] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1538.864865][ T9609] RIP: 0033:0x7fed7f58eec9 [ 1538.864879][ T9609] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1538.864895][ T9609] RSP: 002b:00007fed803a9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1538.864914][ T9609] RAX: ffffffffffffffda RBX: 00007fed7f7e5fa0 RCX: 00007fed7f58eec9 [ 1538.864933][ T9609] RDX: 00002000000002c0 RSI: 0000000000004c0a RDI: 0000000000000003 [ 1538.864945][ T9609] RBP: 00007fed803a9090 R08: 0000000000000000 R09: 0000000000000000 [ 1538.864956][ T9609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1538.864967][ T9609] R13: 00007fed7f7e6038 R14: 00007fed7f7e5fa0 R15: 00007fed7f90fa28 [ 1538.864997][ T9609] [ 1538.938379][ T5895] usb 5-1: reset high-speed USB device number 68 using dummy_hcd [ 1539.590575][ T5526] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 1539.670976][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1539.762209][ T5526] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1539.827554][ T5526] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1539.903499][ T9624] netlink: 136 bytes leftover after parsing attributes in process `syz.3.13972'. [ 1539.914925][ T9624] A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check. [ 1539.945800][ T5526] usb 2-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=b1.f9 [ 1539.955583][ T5526] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1539.964307][ T5526] usb 2-1: Product: syz [ 1539.968688][ T5526] usb 2-1: Manufacturer: syz [ 1539.973550][ T5526] usb 2-1: SerialNumber: syz [ 1539.980672][ T5526] usb 2-1: config 0 descriptor?? [ 1539.990806][ T5526] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 1540.002908][ T5526] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1540.014626][ T5526] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 1540.024243][ T5526] usb 2-1: media controller created [ 1540.044074][ T5526] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1540.097412][ T9629] openvswitch: netlink: Flow actions attr not present in new flow. [ 1540.316520][ T5526] DVB: Unable to find symbol tda10046_attach() [ 1540.323131][ T5526] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 1540.352991][T28789] usb 5-1: USB disconnect, device number 68 [ 1540.398078][ T5526] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 1540.478904][ T9636] netlink: 32 bytes leftover after parsing attributes in process `syz.4.13977'. [ 1540.496353][ T9636] openvswitch: netlink: Flow actions attr not present in new flow. [ 1540.670753][ T9] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 1540.849509][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1540.940775][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1540.963408][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1540.977839][ T9] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1540.988372][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1541.002403][ T9] usb 3-1: config 0 descriptor?? [ 1541.042190][ T5526] dvb_usb_m920x 2-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 1541.072993][ T5526] usb 2-1: USB disconnect, device number 59 [ 1541.547663][ T30] kauditd_printk_skb: 58 callbacks suppressed [ 1541.547675][ T30] audit: type=1326 audit(1759305742.091:1693): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9648 comm="syz.3.13982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1541.681020][ T30] audit: type=1326 audit(1759305742.091:1694): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9648 comm="syz.3.13982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1541.750884][ C0] net_ratelimit: 1 callbacks suppressed [ 1541.750904][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1541.780592][ T30] audit: type=1326 audit(1759305742.091:1695): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9648 comm="syz.3.13982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1541.877498][ T30] audit: type=1326 audit(1759305742.091:1696): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9648 comm="syz.3.13982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1541.949982][ T30] audit: type=1326 audit(1759305742.091:1697): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9648 comm="syz.3.13982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1542.053389][ T30] audit: type=1326 audit(1759305742.131:1698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9648 comm="syz.3.13982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1542.120156][ T30] audit: type=1326 audit(1759305742.131:1699): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9648 comm="syz.3.13982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1542.148335][ T30] audit: type=1326 audit(1759305742.131:1700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9648 comm="syz.3.13982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1542.184846][ T9659] syzkaller0: entered promiscuous mode [ 1542.195073][ T9659] syzkaller0: entered allmulticast mode [ 1542.205817][ T30] audit: type=1326 audit(1759305742.131:1701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9648 comm="syz.3.13982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1542.236812][ T30] audit: type=1326 audit(1759305742.131:1702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9648 comm="syz.3.13982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1542.471966][ T9] plantronics 0003:047F:FFFF.0033: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 1542.790590][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1543.056071][T28789] usb 3-1: USB disconnect, device number 71 [ 1543.324924][ T9673] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13987'. [ 1543.628068][ T9678] netlink: 32 bytes leftover after parsing attributes in process `syz.0.13989'. [ 1543.682784][ T9678] openvswitch: netlink: Flow actions attr not present in new flow. [ 1543.830903][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1543.901620][ T9684] syzkaller0: entered promiscuous mode [ 1543.938250][ T9684] syzkaller0: entered allmulticast mode [ 1544.214661][ T5929] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 1544.396680][ T5929] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1544.413237][ T5929] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1544.419284][ T9703] openvswitch: netlink: Flow actions attr not present in new flow. [ 1544.431122][ T9701] syzkaller0: entered promiscuous mode [ 1544.436784][ T5929] usb 2-1: Product: syz [ 1544.443981][ T9701] syzkaller0: entered allmulticast mode [ 1544.446262][ T5929] usb 2-1: Manufacturer: syz [ 1544.470301][ T5929] usb 2-1: SerialNumber: syz [ 1544.494911][ T5929] usb 2-1: config 0 descriptor?? [ 1544.870618][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1545.140863][ T5895] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 1545.178726][ T5929] usb 2-1: Firmware version (0.0) predates our first public release. [ 1545.190372][ T5929] usb 2-1: Please update to version 0.2 or newer [ 1545.299243][ T5929] usb 2-1: USB disconnect, device number 60 [ 1545.361605][ T5895] usb 3-1: Using ep0 maxpacket: 32 [ 1545.369429][ T5895] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 1545.378307][ T5895] usb 3-1: config 0 has no interface number 0 [ 1545.386909][ T5895] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1545.410806][ T5895] usb 3-1: config 0 interface 85 has no altsetting 0 [ 1545.452148][ T5895] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1545.488913][ T5895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1545.514438][ T5895] usb 3-1: Product: syz [ 1545.534688][ T9714] netlink: 32 bytes leftover after parsing attributes in process `syz.3.14000'. [ 1545.570545][ T9714] openvswitch: netlink: Flow actions attr not present in new flow. [ 1545.589719][ T5895] usb 3-1: Manufacturer: syz [ 1545.611441][ T5895] usb 3-1: SerialNumber: syz [ 1545.641354][ T5895] usb 3-1: config 0 descriptor?? [ 1545.861048][ T9725] netlink: 48 bytes leftover after parsing attributes in process `syz.0.14005'. [ 1545.911008][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1545.929511][ T9729] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14002'. [ 1546.033447][ T9729] netlink: 20 bytes leftover after parsing attributes in process `syz.3.14002'. [ 1546.077136][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.083617][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1546.150047][ T5895] appletouch 3-1:0.85: Failed to request geyser raw mode [ 1546.209090][ T5895] appletouch 3-1:0.85: probe with driver appletouch failed with error -5 [ 1546.300797][ T5895] usb 3-1: USB disconnect, device number 72 [ 1546.438209][ T9739] openvswitch: netlink: Flow actions attr not present in new flow. [ 1546.528047][ T9742] openvswitch: netlink: Flow actions attr not present in new flow. [ 1546.627413][ T9742] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.14009'. [ 1546.762165][ T9745] fuse: Unknown parameter 'group_i00000000000000000000' [ 1546.806676][ T9748] netlink: 32 bytes leftover after parsing attributes in process `syz.0.14012'. [ 1546.832904][ T9748] openvswitch: netlink: Flow actions attr not present in new flow. [ 1546.950789][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1547.130659][ T5895] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 1547.280713][ T5895] usb 3-1: Using ep0 maxpacket: 32 [ 1547.287893][ T5895] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1547.296177][ T5895] usb 3-1: config 0 has no interface number 0 [ 1547.302398][ T5895] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1547.313537][ T5895] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1547.323591][ T5895] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 1547.332775][ T5895] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1547.344825][ T5895] usb 3-1: config 0 descriptor?? [ 1547.726545][ T9769] openvswitch: netlink: Flow actions attr not present in new flow. [ 1547.838406][ T9773] openvswitch: netlink: Flow actions attr not present in new flow. [ 1547.990943][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1548.024257][ T5895] input: HID 28bd:0094 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.1/0003:28BD:0094.0034/input/input102 [ 1548.145408][ T5895] uclogic 0003:28BD:0094.0034: input,hidraw0: USB HID v0.00 Device [HID 28bd:0094] on usb-dummy_hcd.2-1/input1 [ 1548.464381][ T5895] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 1548.830502][ T5895] usb 2-1: Using ep0 maxpacket: 8 [ 1548.837802][ T5895] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1548.846870][ T5895] usb 2-1: config 8 has an invalid interface number: 137 but max is 0 [ 1548.855235][ T5895] usb 2-1: config 8 has no interface number 0 [ 1548.874652][ T5895] usb 2-1: config 8 interface 137 altsetting 5 bulk endpoint 0xF has invalid maxpacket 84 [ 1548.900208][ T5895] usb 2-1: config 8 interface 137 has no altsetting 0 [ 1548.927949][ T5895] usb 2-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=e5.0d [ 1548.948951][ T5895] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1548.999587][ T5895] usb 2-1: Product: syz [ 1549.022544][ T5895] usb 2-1: Manufacturer: syz [ 1549.027347][ T5895] usb 2-1: SerialNumber: syz [ 1549.040603][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1549.072623][ T9788] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1549.183776][ T5526] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 1549.320565][ T5526] usb 5-1: device descriptor read/64, error -71 [ 1549.406287][ T9788] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1549.456300][ T9788] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1549.508071][ T5895] cyberjack 2-1:8.137: Reiner SCT Cyberjack USB card reader converter detected [ 1549.553726][ T5895] cyberjack ttyUSB0: usb_submit_urb(read int) failed [ 1549.570567][ T5526] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 1549.591469][ T5895] usb 2-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 1549.655417][ T5895] usb 2-1: USB disconnect, device number 61 [ 1549.681390][ T5895] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 1549.693271][ T5895] cyberjack 2-1:8.137: device disconnected [ 1549.710573][ T5526] usb 5-1: device descriptor read/64, error -71 [ 1549.729929][ T9806] fuse: Unknown parameter 'group_i00000000000000000000' [ 1549.798572][ T9808] openvswitch: netlink: Flow actions attr not present in new flow. [ 1549.821546][ T5526] usb usb5-port1: attempt power cycle [ 1549.865508][ T5895] usb 3-1: USB disconnect, device number 73 [ 1550.080878][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1550.159028][ T9821] netlink: 32 bytes leftover after parsing attributes in process `syz.1.14038'. [ 1550.173467][ T5526] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 1550.183857][ T9821] openvswitch: netlink: Flow actions attr not present in new flow. [ 1550.213298][ T5526] usb 5-1: device descriptor read/8, error -71 [ 1550.431251][ T9828] tipc: Enabling of bearer rejected, failed to enable media [ 1550.444582][ T9828] syzkaller0: entered promiscuous mode [ 1550.450381][ T9828] syzkaller0: entered allmulticast mode [ 1550.462632][ T5526] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 1550.503322][ T5526] usb 5-1: device descriptor read/8, error -71 [ 1550.621306][ T5526] usb usb5-port1: unable to enumerate USB device [ 1551.110594][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1551.337605][ T9838] FAULT_INJECTION: forcing a failure. [ 1551.337605][ T9838] name failslab, interval 1, probability 0, space 0, times 0 [ 1551.364540][ T9838] CPU: 1 UID: 0 PID: 9838 Comm: syz.1.14043 Not tainted syzkaller #0 PREEMPT(full) [ 1551.364565][ T9838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1551.364575][ T9838] Call Trace: [ 1551.364581][ T9838] [ 1551.364586][ T9838] dump_stack_lvl+0x189/0x250 [ 1551.364604][ T9838] ? __pfx____ratelimit+0x10/0x10 [ 1551.364615][ T9838] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1551.364627][ T9838] ? __pfx__printk+0x10/0x10 [ 1551.364639][ T9838] ? __pfx___might_resched+0x10/0x10 [ 1551.364649][ T9838] ? fs_reclaim_acquire+0x7d/0x100 [ 1551.364666][ T9838] should_fail_ex+0x414/0x560 [ 1551.364683][ T9838] should_failslab+0xa8/0x100 [ 1551.364698][ T9838] __kmalloc_node_track_caller_noprof+0xcc/0x4e0 [ 1551.364710][ T9838] ? __kasan_kmalloc+0x93/0xb0 [ 1551.364720][ T9838] ? ip6_setup_cork+0x6c1/0x10e0 [ 1551.364738][ T9838] kmemdup_noprof+0x2b/0x70 [ 1551.364748][ T9838] ip6_setup_cork+0x6c1/0x10e0 [ 1551.364775][ T9838] ip6_append_data+0x23d/0x380 [ 1551.364789][ T9838] ? __pfx_raw6_getfrag+0x10/0x10 [ 1551.364802][ T9838] rawv6_sendmsg+0x127a/0x1820 [ 1551.364821][ T9838] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 1551.364845][ T9838] ? __pfx_aa_sk_perm+0x10/0x10 [ 1551.364872][ T9838] ? sock_rps_record_flow+0x19/0x410 [ 1551.364888][ T9838] ? inet_sendmsg+0x2f4/0x370 [ 1551.364899][ T9838] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1551.364911][ T9838] __sock_sendmsg+0x19c/0x270 [ 1551.364927][ T9838] __sys_sendto+0x3bd/0x520 [ 1551.364939][ T9838] ? __pfx___sys_sendto+0x10/0x10 [ 1551.364947][ T9838] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 1551.364965][ T9838] ? __fget_files+0x3a0/0x420 [ 1551.364984][ T9838] ? ksys_write+0x22a/0x250 [ 1551.364998][ T9838] ? __pfx_ksys_write+0x10/0x10 [ 1551.365008][ T9838] ? rcu_is_watching+0x15/0xb0 [ 1551.365022][ T9838] __x64_sys_sendto+0xde/0x100 [ 1551.365034][ T9838] do_syscall_64+0xfa/0x3b0 [ 1551.365044][ T9838] ? lockdep_hardirqs_on+0x9c/0x150 [ 1551.365053][ T9838] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1551.365062][ T9838] ? clear_bhb_loop+0x60/0xb0 [ 1551.365074][ T9838] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1551.365083][ T9838] RIP: 0033:0x7f8f2db8eec9 [ 1551.365093][ T9838] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1551.365101][ T9838] RSP: 002b:00007f8f2ea46038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1551.365113][ T9838] RAX: ffffffffffffffda RBX: 00007f8f2dde5fa0 RCX: 00007f8f2db8eec9 [ 1551.365121][ T9838] RDX: 0000000000000002 RSI: 0000200000000440 RDI: 0000000000000003 [ 1551.365127][ T9838] RBP: 00007f8f2ea46090 R08: 0000000000000000 R09: 0000000000000000 [ 1551.365133][ T9838] R10: 0000000000007b00 R11: 0000000000000246 R12: 0000000000000001 [ 1551.365139][ T9838] R13: 00007f8f2dde6038 R14: 00007f8f2dde5fa0 R15: 00007f8f2df0fa28 [ 1551.365154][ T9838] [ 1552.150897][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1552.383609][ T9844] openvswitch: netlink: Flow actions attr not present in new flow. [ 1552.526573][ T30] kauditd_printk_skb: 24 callbacks suppressed [ 1552.526589][ T30] audit: type=1326 audit(1759305753.071:1727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9853 comm="syz.1.14050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1552.670591][ T5929] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 1552.720633][ T30] audit: type=1326 audit(1759305753.101:1728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9853 comm="syz.1.14050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1552.764634][ T30] audit: type=1326 audit(1759305753.101:1729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9853 comm="syz.1.14050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=139 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1552.804271][ T30] audit: type=1326 audit(1759305753.101:1730): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9853 comm="syz.1.14050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1552.849035][ T30] audit: type=1326 audit(1759305753.101:1731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9853 comm="syz.1.14050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1552.884708][ T30] audit: type=1326 audit(1759305753.111:1732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9853 comm="syz.1.14050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1552.930653][ T5929] usb 5-1: Using ep0 maxpacket: 8 [ 1552.947538][ T5929] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1552.956941][ T5929] usb 5-1: config 8 has an invalid interface number: 137 but max is 0 [ 1552.970764][ T30] audit: type=1326 audit(1759305753.111:1733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9853 comm="syz.1.14050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1552.998704][ T5929] usb 5-1: config 8 has no interface number 0 [ 1553.005341][ T10] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 1553.027176][ T5929] usb 5-1: config 8 interface 137 altsetting 5 bulk endpoint 0xF has invalid maxpacket 84 [ 1553.042421][ T5929] usb 5-1: config 8 interface 137 has no altsetting 0 [ 1553.049673][ T30] audit: type=1326 audit(1759305753.111:1734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9853 comm="syz.1.14050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1553.078738][ T5929] usb 5-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=e5.0d [ 1553.088193][ T5929] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1553.099577][ T5929] usb 5-1: Product: syz [ 1553.106981][ T5929] usb 5-1: Manufacturer: syz [ 1553.123544][ T5929] usb 5-1: SerialNumber: syz [ 1553.135437][ T30] audit: type=1326 audit(1759305753.111:1735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9853 comm="syz.1.14050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1553.165444][ T9851] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1553.172884][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 1553.185134][ T10] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1553.194369][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1553.218193][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1553.240199][ T10] usb 2-1: Product: syz [ 1553.254713][ T10] usb 2-1: Manufacturer: syz [ 1553.264875][ T30] audit: type=1326 audit(1759305753.111:1736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9853 comm="syz.1.14050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f2db8eec9 code=0x7ffc0000 [ 1553.286664][ T10] usb 2-1: SerialNumber: syz [ 1553.299027][ T10] r8152-cfgselector 2-1: Unknown version 0x0000 [ 1553.309590][ T10] r8152-cfgselector 2-1: config 0 descriptor?? [ 1553.498328][ T9851] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1553.535639][ T9851] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1553.572160][ T5929] cyberjack 5-1:8.137: Reiner SCT Cyberjack USB card reader converter detected [ 1553.608645][ T5929] cyberjack ttyUSB0: usb_submit_urb(read int) failed [ 1553.617629][ T5929] usb 5-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 1553.646409][ T5929] usb 5-1: USB disconnect, device number 73 [ 1553.730175][ T5929] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 1553.753984][ T5929] cyberjack 5-1:8.137: device disconnected [ 1553.938614][ T10] r8152-cfgselector 2-1: Unknown version 0x08a0 [ 1553.945985][ T10] r8152-cfgselector 2-1: bad CDC descriptors [ 1554.230930][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1555.206076][ T9889] netlink: 32 bytes leftover after parsing attributes in process `syz.2.14060'. [ 1555.215566][ T9889] openvswitch: netlink: Flow actions attr not present in new flow. [ 1555.270614][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1555.901771][ T10] r8152-cfgselector 2-1: USB disconnect, device number 62 [ 1555.953379][ T5839] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 1556.122905][ T5839] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1556.140207][ T5839] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1556.167653][ T5839] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1556.177063][ T5839] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1556.196440][ T5839] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1556.228889][ T5839] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1556.240136][ T5839] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1556.248430][ T5839] usb 5-1: Product: syz [ 1556.252936][ T5839] usb 5-1: Manufacturer: syz [ 1556.269353][ T5839] cdc_wdm 5-1:1.0: skipping garbage [ 1556.282515][ T5839] cdc_wdm 5-1:1.0: skipping garbage [ 1556.303614][ T5839] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 1556.310015][ T5839] cdc_wdm 5-1:1.0: Unknown control protocol [ 1556.313295][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1556.900253][ C0] wdm_int_callback: 8 callbacks suppressed [ 1556.900277][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 1556.912703][ C0] wdm_int_callback: 8 callbacks suppressed [ 1556.912719][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 1556.927219][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 1556.934021][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 1556.940262][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 1556.947050][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 1556.953657][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 1556.960358][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 1556.966667][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 1556.973279][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 1556.979559][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 1556.986151][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 1556.992599][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 1556.999217][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 1557.005532][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 1557.012142][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 1557.018450][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 1557.025051][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 1557.031390][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 1557.038004][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 1557.074499][ T5929] usb 5-1: USB disconnect, device number 74 [ 1557.080501][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1557.351468][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1557.370318][ T9917] openvswitch: netlink: Flow actions attr not present in new flow. [ 1558.041087][ T9927] openvswitch: netlink: Flow actions attr not present in new flow. [ 1558.390952][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1558.785262][ T9937] openvswitch: netlink: Flow actions attr not present in new flow. [ 1559.430606][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1559.449604][ T9950] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 1560.058886][ T9959] tipc: Enabling of bearer rejected, already enabled [ 1560.287378][ T9965] netlink: 32 bytes leftover after parsing attributes in process `syz.1.14086'. [ 1560.298625][ T9965] openvswitch: netlink: Flow actions attr not present in new flow. [ 1560.380805][ T5839] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1560.471110][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1560.525042][ T9969] openvswitch: netlink: Flow actions attr not present in new flow. [ 1560.614185][ T5839] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1560.646961][ T5839] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1560.660705][ T5839] usb 5-1: Product: syz [ 1560.665070][ T5839] usb 5-1: Manufacturer: syz [ 1560.675475][ T5839] usb 5-1: SerialNumber: syz [ 1560.682957][ T5839] usb 5-1: config 0 descriptor?? [ 1560.760844][ T5929] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 1560.934866][ T5929] usb 4-1: Using ep0 maxpacket: 32 [ 1560.949355][ T5929] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 1560.976084][ T5929] usb 4-1: config 0 has no interface number 0 [ 1560.998618][ T5929] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1561.016480][ T5929] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1561.045433][ T5929] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1561.074279][ T5929] usb 4-1: Product: syz [ 1561.082396][ T5929] usb 4-1: Manufacturer: syz [ 1561.087100][ T5929] usb 4-1: SerialNumber: syz [ 1561.106029][ T5929] usb 4-1: config 0 descriptor?? [ 1561.134614][ T5839] usb 5-1: Firmware: major: 130, minor: 102, hardware type: HULUSB (4) [ 1561.134642][ T5929] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 1561.153745][ T5929] em28xx 4-1:0.132: Video interface 132 found: [ 1561.330650][ T7226] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 1561.345845][ T5839] usb 5-1: failed to fetch extended address, random address set [ 1561.461250][ T5839] usb 5-1: USB disconnect, device number 75 [ 1561.525102][ T7226] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1561.551119][ T5929] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 1561.571173][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 1561.571189][ T30] audit: type=1326 audit(1759305762.101:1748): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9966 comm="syz.3.14087" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1561.614465][ T7226] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1561.639189][ T30] audit: type=1326 audit(1759305762.101:1749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9966 comm="syz.3.14087" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1561.716943][ T7226] usb 2-1: Product: syz [ 1561.717614][ T30] audit: type=1326 audit(1759305762.101:1750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9966 comm="syz.3.14087" exe="/root/syz-executor" sig=0 arch=c000003e syscall=151 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1561.754325][ T7226] usb 2-1: Manufacturer: syz [ 1561.777723][ T7226] usb 2-1: SerialNumber: syz [ 1561.828904][ T30] audit: type=1326 audit(1759305762.101:1751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9966 comm="syz.3.14087" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1561.900869][ T30] audit: type=1326 audit(1759305762.101:1752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9966 comm="syz.3.14087" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1561.933727][ T30] audit: type=1326 audit(1759305762.101:1753): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9966 comm="syz.3.14087" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fdf5f18eacb code=0x7ffc0000 [ 1561.993901][ T5929] em28xx 4-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=0) [ 1562.017989][ T5929] em28xx 4-1:0.132: board has no eeprom [ 1562.038888][ T30] audit: type=1326 audit(1759305762.111:1754): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9966 comm="syz.3.14087" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fdf5f18eacb code=0x7ffc0000 [ 1562.098290][ T30] audit: type=1326 audit(1759305762.111:1755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9966 comm="syz.3.14087" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fdf5f1c1785 code=0x7ffc0000 [ 1562.132916][ T30] audit: type=1326 audit(1759305762.331:1756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9966 comm="syz.3.14087" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1562.157302][ T30] audit: type=1326 audit(1759305762.331:1757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9966 comm="syz.3.14087" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf5f18eec9 code=0x7ffc0000 [ 1562.290639][ T5929] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 1562.298524][ T5929] em28xx 4-1:0.132: analog set to bulk mode. [ 1562.310998][T31425] em28xx 4-1:0.132: Registering V4L2 extension [ 1562.370611][ T10] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 1562.468461][ T9970] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1562.480153][ T9970] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1562.540515][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 1562.551696][ C0] net_ratelimit: 2 callbacks suppressed [ 1562.551714][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1562.567133][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1562.579788][ T10] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1562.604776][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1562.628016][ T10] usb 5-1: Product: syz [ 1562.638614][ T10] usb 5-1: Manufacturer: syz [ 1562.654231][ T10] usb 5-1: SerialNumber: syz [ 1562.674682][ T10] usb 5-1: config 0 descriptor?? [ 1562.699179][ T10] streamzap 5-1:0.0: streamzap_probe: endpoint doesn't match input device 0203 [ 1562.845191][ T7226] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x0000011c. ret = -EPIPE [ 1562.868604][ T7226] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1562.887062][ T7226] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1562.912819][ T7226] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -32 [ 1563.389537][ T9999] netlink: 32 bytes leftover after parsing attributes in process `syz.2.14098'. [ 1563.398819][ T9999] openvswitch: netlink: Flow actions attr not present in new flow. [ 1563.459321][T10001] openvswitch: netlink: Flow actions attr not present in new flow. [ 1563.524478][T31425] em28xx 4-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 1563.536809][T31425] em28xx 4-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 1563.546917][T31425] em28xx 4-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 1563.556300][T31425] em28xx 4-1:0.132: failed to trigger read from i2c address 0x40 (error=-5) [ 1563.565164][ T5895] usb 4-1: USB disconnect, device number 104 [ 1563.590589][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1563.601803][ T5895] em28xx 4-1:0.132: Disconnecting em28xx [ 1563.718709][T10012] openvswitch: netlink: Flow actions attr not present in new flow. [ 1563.753100][T31425] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 1563.773248][T31425] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 1563.793539][ T7226] usb 5-1: USB disconnect, device number 76 [ 1563.821805][T31425] em28xx 4-1:0.132: No AC97 audio processor [ 1563.870205][ T5839] hid-generic 0000:0003:0001.0035: unknown main item tag 0x0 [ 1563.895954][T31425] usb 4-1: Decoder not found [ 1563.909699][T31425] em28xx 4-1:0.132: failed to create media graph [ 1563.916908][ T5839] hid-generic 0000:0003:0001.0035: unknown main item tag 0x0 [ 1563.934056][ T5839] hid-generic 0000:0003:0001.0035: hidraw0: HID v0.03 Device [syz0] on syz1 [ 1563.970308][T10016] openvswitch: netlink: Flow actions attr not present in new flow. [ 1564.058470][T31425] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 1564.064774][T10017] fido_id[10017]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1564.092285][T10022] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14105'. [ 1564.189839][T31425] em28xx 4-1:0.132: Remote control support is not available for this card. [ 1564.192350][T10019] ================================================================== [ 1564.208998][T10019] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xc7/0x430 [ 1564.216372][T10019] Read of size 8 at addr ffff888034cdc740 by task v4l_id/10019 [ 1564.223897][T10019] [ 1564.226207][T10019] CPU: 1 UID: 0 PID: 10019 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 1564.226220][T10019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1564.226227][T10019] Call Trace: [ 1564.226233][T10019] [ 1564.226238][T10019] dump_stack_lvl+0x189/0x250 [ 1564.226253][T10019] ? rcu_is_watching+0x15/0xb0 [ 1564.226264][T10019] ? __kasan_check_byte+0x12/0x40 [ 1564.226277][T10019] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1564.226288][T10019] ? rcu_is_watching+0x15/0xb0 [ 1564.226298][T10019] ? lock_release+0x4b/0x3e0 [ 1564.226308][T10019] ? __virt_addr_valid+0x1c8/0x5c0 [ 1564.226321][T10019] ? __virt_addr_valid+0x4a5/0x5c0 [ 1564.226334][T10019] print_report+0xca/0x240 [ 1564.226344][T10019] ? v4l2_fh_open+0xc7/0x430 [ 1564.226353][T10019] kasan_report+0x118/0x150 [ 1564.226366][T10019] ? v4l2_fh_open+0xc7/0x430 [ 1564.226376][T10019] v4l2_fh_open+0xc7/0x430 [ 1564.226386][T10019] em28xx_v4l2_open+0x157/0x9a0 [ 1564.226402][T10019] v4l2_open+0x20f/0x360 [ 1564.226413][T10019] chrdev_open+0x4c9/0x5e0 [ 1564.226427][T10019] ? __pfx_chrdev_open+0x10/0x10 [ 1564.226439][T10019] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 1564.226455][T10019] ? __pfx_chrdev_open+0x10/0x10 [ 1564.226466][T10019] do_dentry_open+0x950/0x13f0 [ 1564.226478][T10019] vfs_open+0x3b/0x340 [ 1564.226485][T10019] ? path_openat+0x2ecd/0x3830 [ 1564.226496][T10019] path_openat+0x2ee5/0x3830 [ 1564.226506][T10019] ? arch_stack_walk+0xfc/0x150 [ 1564.226521][T10019] ? stack_depot_save_flags+0x40/0x860 [ 1564.226536][T10019] ? __pfx_path_openat+0x10/0x10 [ 1564.226545][T10019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1564.226559][T10019] do_filp_open+0x1fa/0x410 [ 1564.226568][T10019] ? __lock_acquire+0xab9/0xd20 [ 1564.226577][T10019] ? __pfx_do_filp_open+0x10/0x10 [ 1564.226591][T10019] ? _raw_spin_unlock+0x28/0x50 [ 1564.226604][T10019] ? alloc_fd+0x64c/0x6c0 [ 1564.226618][T10019] do_sys_openat2+0x121/0x1c0 [ 1564.226627][T10019] ? __pfx_do_sys_openat2+0x10/0x10 [ 1564.226636][T10019] ? exc_page_fault+0x76/0xf0 [ 1564.226646][T10019] ? do_user_addr_fault+0xc85/0x1380 [ 1564.226657][T10019] __x64_sys_openat+0x138/0x170 [ 1564.226667][T10019] do_syscall_64+0xfa/0x3b0 [ 1564.226676][T10019] ? lockdep_hardirqs_on+0x9c/0x150 [ 1564.226685][T10019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1564.226694][T10019] ? clear_bhb_loop+0x60/0xb0 [ 1564.226704][T10019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1564.226714][T10019] RIP: 0033:0x7fa336aa7407 [ 1564.226724][T10019] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1564.226733][T10019] RSP: 002b:00007ffef0b35cf0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1564.226743][T10019] RAX: ffffffffffffffda RBX: 00007fa337149880 RCX: 00007fa336aa7407 [ 1564.226750][T10019] RDX: 0000000000000000 RSI: 00007ffef0b36f1a RDI: ffffffffffffff9c [ 1564.226757][T10019] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1564.226763][T10019] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1564.226768][T10019] R13: 00007ffef0b35f40 R14: 00007fa33724e000 R15: 000055ee1e7024d8 [ 1564.226778][T10019] [ 1564.226782][T10019] [ 1564.534684][T10019] Allocated by task 31425: [ 1564.539083][T10019] kasan_save_track+0x3e/0x80 [ 1564.543752][T10019] __kasan_kmalloc+0x93/0xb0 [ 1564.548326][T10019] __kmalloc_cache_noprof+0x230/0x3d0 [ 1564.553681][T10019] em28xx_v4l2_init+0x10b/0x2e70 [ 1564.558607][T10019] em28xx_init_extension+0x120/0x1c0 [ 1564.563872][T10019] process_scheduled_works+0xade/0x17b0 [ 1564.569399][T10019] worker_thread+0x8a0/0xda0 [ 1564.573969][T10019] kthread+0x711/0x8a0 [ 1564.578022][T10019] ret_from_fork+0x436/0x7d0 [ 1564.582593][T10019] ret_from_fork_asm+0x1a/0x30 [ 1564.587341][T10019] [ 1564.589645][T10019] Freed by task 31425: [ 1564.593689][T10019] kasan_save_track+0x3e/0x80 [ 1564.598347][T10019] kasan_save_free_info+0x46/0x50 [ 1564.603350][T10019] __kasan_slab_free+0x5b/0x80 [ 1564.608094][T10019] kfree+0x18e/0x440 [ 1564.611986][T10019] em28xx_v4l2_init+0x1683/0x2e70 [ 1564.616992][T10019] em28xx_init_extension+0x120/0x1c0 [ 1564.622256][T10019] process_scheduled_works+0xade/0x17b0 [ 1564.627787][T10019] worker_thread+0x8a0/0xda0 [ 1564.632365][T10019] kthread+0x711/0x8a0 [ 1564.636417][T10019] ret_from_fork+0x436/0x7d0 [ 1564.640988][T10019] ret_from_fork_asm+0x1a/0x30 [ 1564.641236][ C0] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 1564.645829][T10019] [ 1564.645836][T10019] The buggy address belongs to the object at ffff888034cdc000 [ 1564.645836][T10019] which belongs to the cache kmalloc-8k of size 8192 [ 1564.668989][T10019] The buggy address is located 1856 bytes inside of [ 1564.668989][T10019] freed 8192-byte region [ffff888034cdc000, ffff888034cde000) [ 1564.682939][T10019] [ 1564.685246][T10019] The buggy address belongs to the physical page: [ 1564.691730][T10019] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34cd8 [ 1564.700472][T10019] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1564.708967][T10019] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1564.716500][T10019] page_type: f5(slab) [ 1564.720474][T10019] raw: 00fff00000000040 ffff88801a042280 ffffea0001542c00 dead000000000004 [ 1564.729047][T10019] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 1564.737668][T10019] head: 00fff00000000040 ffff88801a042280 ffffea0001542c00 dead000000000004 [ 1564.746325][T10019] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 1564.754986][T10019] head: 00fff00000000003 ffffea0000d33601 00000000ffffffff 00000000ffffffff [ 1564.763639][T10019] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1564.772292][T10019] page dumped because: kasan: bad access detected [ 1564.778702][T10019] page_owner tracks the page as allocated [ 1564.784393][T10019] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 49, tgid 49 (kworker/u8:3), ts 1036283788688, free_ts 1036099039233 [ 1564.803668][T10019] post_alloc_hook+0x240/0x2a0 [ 1564.808422][T10019] get_page_from_freelist+0x21e4/0x22c0 [ 1564.814044][T10019] __alloc_frozen_pages_noprof+0x181/0x370 [ 1564.819922][T10019] alloc_pages_mpol+0x232/0x4a0 [ 1564.824755][T10019] allocate_slab+0x8a/0x370 [ 1564.829237][T10019] ___slab_alloc+0xbeb/0x1420 [ 1564.833894][T10019] __kmalloc_noprof+0x305/0x4f0 [ 1564.838729][T10019] ieee802_11_parse_elems_full+0x152/0x2ab0 [ 1564.844640][T10019] ieee80211_inform_bss+0x10c/0x10a0 [ 1564.849910][T10019] cfg80211_inform_single_bss_data+0xd02/0x1ac0 [ 1564.856138][T10019] cfg80211_inform_bss_data+0x1fb/0x3b30 [ 1564.861756][T10019] cfg80211_inform_bss_frame_data+0x3d7/0x730 [ 1564.867808][T10019] ieee80211_bss_info_update+0x746/0x9e0 [ 1564.873425][T10019] ieee80211_ibss_rx_queued_mgmt+0xa36/0x2ae0 [ 1564.879481][T10019] ieee80211_iface_work+0x85f/0x12d0 [ 1564.884746][T10019] cfg80211_wiphy_work+0x2b8/0x470 [ 1564.889837][T10019] page last free pid 27771 tgid 27771 stack trace: [ 1564.896397][T10019] __free_frozen_pages+0xbc4/0xd30 [ 1564.901493][T10019] __put_partials+0x156/0x1a0 [ 1564.906241][T10019] put_cpu_partial+0x17c/0x250 [ 1564.911011][T10019] __slab_free+0x2d5/0x3c0 [ 1564.915405][T10019] qlist_free_all+0x97/0x140 [ 1564.919977][T10019] kasan_quarantine_reduce+0x148/0x160 [ 1564.925418][T10019] __kasan_slab_alloc+0x22/0x80 [ 1564.930250][T10019] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 1564.935692][T10019] ptlock_alloc+0x20/0x70 [ 1564.940004][T10019] pte_alloc_one+0x7d/0x170 [ 1564.944487][T10019] __pte_alloc+0x25/0x1a0 [ 1564.948799][T10019] copy_pmd_range+0x6a91/0x71d0 [ 1564.953631][T10019] copy_page_range+0xc14/0x1270 [ 1564.958458][T10019] dup_mmap+0xf57/0x1ac0 [ 1564.962681][T10019] copy_mm+0x13c/0x4b0 [ 1564.966731][T10019] copy_process+0x1706/0x3c00 [ 1564.971392][T10019] [ 1564.973702][T10019] Memory state around the buggy address: [ 1564.979310][T10019] ffff888034cdc600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1564.987362][T10019] ffff888034cdc680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1564.995589][T10019] >ffff888034cdc700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1565.003633][T10019] ^ [ 1565.009853][T10019] ffff888034cdc780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1565.017907][T10019] ffff888034cdc800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1565.025958][T10019] ================================================================== [ 1565.112141][ T5895] em28xx 4-1:0.132: Closing input extension [ 1565.124234][T10019] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1565.131444][T10019] CPU: 0 UID: 0 PID: 10019 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 1565.140549][T10019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1565.150634][T10019] Call Trace: [ 1565.153904][T10019] [ 1565.156828][T10019] dump_stack_lvl+0x99/0x250 [ 1565.161505][T10019] ? __asan_memcpy+0x40/0x70 [ 1565.166109][T10019] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1565.171308][T10019] ? __pfx__printk+0x10/0x10 [ 1565.176332][T10019] vpanic+0x281/0x750 [ 1565.180326][T10019] ? preempt_schedule+0xae/0xc0 [ 1565.185178][T10019] ? __pfx_vpanic+0x10/0x10 [ 1565.189673][T10019] ? preempt_schedule_common+0x83/0xd0 [ 1565.195140][T10019] ? preempt_schedule+0xae/0xc0 [ 1565.199982][T10019] ? __pfx_preempt_schedule+0x10/0x10 [ 1565.205434][T10019] panic+0xb9/0xc0 [ 1565.209241][T10019] ? __pfx_panic+0x10/0x10 [ 1565.213673][T10019] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 1565.219574][T10019] ? v4l2_fh_open+0xc7/0x430 [ 1565.224193][T10019] check_panic_on_warn+0x89/0xb0 [ 1565.229132][T10019] ? v4l2_fh_open+0xc7/0x430 [ 1565.233707][T10019] end_report+0x78/0x160 [ 1565.237934][T10019] kasan_report+0x129/0x150 [ 1565.242431][T10019] ? v4l2_fh_open+0xc7/0x430 [ 1565.247021][T10019] v4l2_fh_open+0xc7/0x430 [ 1565.251431][T10019] em28xx_v4l2_open+0x157/0x9a0 [ 1565.256280][T10019] v4l2_open+0x20f/0x360 [ 1565.260510][T10019] chrdev_open+0x4c9/0x5e0 [ 1565.264915][T10019] ? __pfx_chrdev_open+0x10/0x10 [ 1565.269866][T10019] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 1565.276193][T10019] ? __pfx_chrdev_open+0x10/0x10 [ 1565.281118][T10019] do_dentry_open+0x950/0x13f0 [ 1565.285865][T10019] vfs_open+0x3b/0x340 [ 1565.289912][T10019] ? path_openat+0x2ecd/0x3830 [ 1565.294658][T10019] path_openat+0x2ee5/0x3830 [ 1565.299228][T10019] ? arch_stack_walk+0xfc/0x150 [ 1565.304069][T10019] ? stack_depot_save_flags+0x40/0x860 [ 1565.309515][T10019] ? __pfx_path_openat+0x10/0x10 [ 1565.314432][T10019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1565.320496][T10019] do_filp_open+0x1fa/0x410 [ 1565.325006][T10019] ? __lock_acquire+0xab9/0xd20 [ 1565.329834][T10019] ? __pfx_do_filp_open+0x10/0x10 [ 1565.334841][T10019] ? _raw_spin_unlock+0x28/0x50 [ 1565.339671][T10019] ? alloc_fd+0x64c/0x6c0 [ 1565.343983][T10019] do_sys_openat2+0x121/0x1c0 [ 1565.348640][T10019] ? __pfx_do_sys_openat2+0x10/0x10 [ 1565.353815][T10019] ? exc_page_fault+0x76/0xf0 [ 1565.358469][T10019] ? do_user_addr_fault+0xc85/0x1380 [ 1565.363733][T10019] __x64_sys_openat+0x138/0x170 [ 1565.368561][T10019] do_syscall_64+0xfa/0x3b0 [ 1565.373041][T10019] ? lockdep_hardirqs_on+0x9c/0x150 [ 1565.378212][T10019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1565.384252][T10019] ? clear_bhb_loop+0x60/0xb0 [ 1565.388908][T10019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1565.394777][T10019] RIP: 0033:0x7fa336aa7407 [ 1565.399174][T10019] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1565.418758][T10019] RSP: 002b:00007ffef0b35cf0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1565.427154][T10019] RAX: ffffffffffffffda RBX: 00007fa337149880 RCX: 00007fa336aa7407 [ 1565.435112][T10019] RDX: 0000000000000000 RSI: 00007ffef0b36f1a RDI: ffffffffffffff9c [ 1565.443062][T10019] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1565.451018][T10019] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1565.458965][T10019] R13: 00007ffef0b35f40 R14: 00007fa33724e000 R15: 000055ee1e7024d8 [ 1565.466932][T10019] [ 1565.470233][T10019] Kernel Offset: disabled [ 1565.474555][T10019] Rebooting in 86400 seconds..