last executing test programs: 19.492590357s ago: executing program 2 (id=4024): syz_usb_connect$hid(0x3, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000000040ef1747600000000000010902244f05001000000904000001030002000921000000012205000905810300000c000069a5e49bee319ecd559ac0ddbc6da9e62f4b1b7c72cff70074de0bf331dec70e0896714fe79418e9539cc21e66d8cbaa552323"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000180)={0x1, 0xaa4, 0x0, &(0x7f0000000340)}) ioctl$KVM_SET_CLOCK(r1, 0x4188aec6, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x20000000000000, 0x4}) 17.784602814s ago: executing program 2 (id=4028): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x40090) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000001600000500000a4c000000060a010400000000000000000a0000010900010073797a31000000000900020073797a320000000006000740dcf100001800048014000180090001007866726d000000000400028014000000110001000000000000000000010000c6610a"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000280)={'ip6_vti0\x00', 0x0, 0x4, 0x0, 0x3, 0x5, 0x12, @mcast2, @private0, 0x0, 0x8007, 0x100, 0x5}}) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x20040845}, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000014c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x15}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000004}, 0x24000000) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x800) recvmmsg(0xffffffffffffffff, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000000440)=""/128, 0x80}], 0x2, &(0x7f00000004c0)=""/193, 0xc1}, 0x7f}, {{&(0x7f00000005c0)=@in, 0x80, &(0x7f0000000700)=[{&(0x7f0000000640)=""/35, 0x23}], 0x1, &(0x7f0000000740)=""/23, 0x17}, 0x3}], 0x2, 0x40012100, 0x0) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000ce94513381fd000000000000000000000002"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0xf, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000100000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf090000000000006609010000000000060000000b0000002c93000000000000b5030000000000008500000076000000b7000000000000009500000000000000"], &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) 15.967125542s ago: executing program 2 (id=4034): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x2, 0x4, 0x0, 0x3, 0xe, 0x0, 0x70bd2c, 0x25dfdbfb, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote, 0x5dd8}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x7, 0xc}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7}}]}, 0x70}, 0x1, 0x7}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000b80)) r3 = socket$packet(0x11, 0x3, 0x300) dup(r1) r4 = fcntl$dupfd(r0, 0x406, r3) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000340)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/251, 0x0}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) 15.56938215s ago: executing program 2 (id=4035): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x3e5d81, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TIOCSLCKTRMIOS(r0, 0x80047437, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000100)="240000005a001f001007f41108000400020100020800038005000000ffc8bbb86ec81f7d", 0x24) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x3e5d81, 0x0) (async) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) ioctl$TIOCSLCKTRMIOS(r0, 0x80047437, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) socket(0x10, 0x3, 0x0) (async) write(r1, &(0x7f0000000100)="240000005a001f001007f41108000400020100020800038005000000ffc8bbb86ec81f7d", 0x24) (async) 15.360659365s ago: executing program 2 (id=4036): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = syz_open_dev$sndpcmc(&(0x7f0000000300), 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000020ac050f02220001828301090224"], 0x0) r1 = io_uring_setup(0x1159, &(0x7f00000000c0)={0x0, 0x2dd6, 0x8, 0x1, 0x81000113}) io_uring_register$IORING_REGISTER_FILES(r1, 0x1e, &(0x7f0000000000)=[r1], 0x1) ioctl$SNDRV_PCM_IOCTL_FORWARD(r0, 0x40084149, 0x0) 14.03472549s ago: executing program 2 (id=4043): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f00000001c0), 0x841, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) syz_io_uring_setup(0x491, &(0x7f0000000280)={0x0, 0xceb5, 0x800, 0x2, 0x5e}, &(0x7f0000000300), &(0x7f0000000340)) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) r4 = shmget$private(0x0, 0x13000, 0x1, &(0x7f0000feb000/0x13000)=nil) r5 = shmat(r4, &(0x7f0000ff1000/0x3000)=nil, 0x400c) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r6 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x0, 0x0) openat$cgroup_subtree(r7, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f0000000200)=ANY=[], 0xe) mremap(&(0x7f0000ff4000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000200)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB='%\x00'/12, @ANYRES32, @ANYBLOB="649c7fff1fee667a381fc719677af3f42f553187bbe141bed130a90229311d12e3a27e61bcd09d7a0b4c2946ba12db62bf8cb09a0052e6157954cb346afd33e28903e5", @ANYRES64=0x0], 0x20) shmdt(r5) capget(0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x24000040) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000140)={0x0, 0x969, 0x3, 0x96, 0x9}, 0x0) 9.27851704s ago: executing program 4 (id=4058): r0 = syz_io_uring_setup(0x3fb1, &(0x7f0000000300)={0x0, 0x9cae, 0x40, 0x5, 0xd6}, &(0x7f0000000100), &(0x7f00000000c0)) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, &(0x7f0000000380)={&(0x7f0000003000)}, 0x1) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000080)="5c00000012006b08000000000000001c7be4406c1d0000007ea60864160af36508001dc0c302000000000000e5178294ff0051f60a84c9f472736f56d22e10278e66f46f0e57a7592267c5e73bbd0000000000000000000000000063", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x48002) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x10, 0x7fffffffffffffff, &(0x7f00000000c0)) r2 = socket(0x840000000002, 0x3, 0x100) connect$inet(r2, &(0x7f0000000400)={0x2, 0x4e20, @remote}, 0x10) sendmmsg$inet(r2, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) sendmsg$key(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000580)={0x2, 0x1, 0xc, 0x0, 0x49, 0x0, 0x70bd27, 0x25dfdbff, [@sadb_sa={0x2, 0x1, 0x4d6, 0xb, 0x7f, 0x25, 0x4, 0xa0000000}, @sadb_spirange={0x2, 0x10, 0x4d2, 0x4d3}, @sadb_lifetime={0x4, 0x3, 0x1fb, 0x8, 0x8, 0x80000000}, @sadb_key={0x16, 0x8, 0x528, 0x0, "8d36bccf7a6799ce47792ef7d1efcad04edcc2bd09aaa355f4e3174bd5e7971ca45f8caad7cdc984db4c8852cd33196808757b106d6b90b405011114e7827d5739aa973129af2bcfa99e4b51f21086428af74f89fc122fc917b20808120419738e6370b497c46f1625573cb1c8bc075f6b431f78cd4db5a9a31b50bef3d2a55fc2cd4cb35721ca1c0b9078ab8b7ef577da3afab4fba8001c6f64d741607c9a9c62af048dfd"}, @sadb_key={0x1d, 0x0, 0x6f0, 0x0, "f708e845fa044112cce76437a5a4dd279e489d96fa8412325825143ba508df4b4c79e1f1c47119155725b9644d56240ef24b5dcbf14fca2b6cc0b4a81f17c4d9ba22f01e85f7d44bae4581852791b495fe56753b828ae04e2531076aef610968a7a5db273e9d7b17f62e444059040438b0e4dc358bf3ae936227f6f8a996eca8213a770672465e6de96bcd04b940fd1821f82da99faeae1684bf74fa394fd80ce466c5b5461d3ae05a6993b15c082ac108f21c98eb8c49a14a1f6116eda94700f5b3608d2b680c71f5b21a4431670907f64ada0af36b5f4c7b3c529a31e8"}, @sadb_sa={0x2, 0x1, 0x4d6, 0x7, 0xd8, 0x9, 0x2, 0x60000000}, @sadb_x_policy={0x8, 0x12, 0x3, 0x2, 0x0, 0x6e6bb9, 0xc4, {0x6, 0x6c, 0x4, 0x6, 0x0, 0x9961, 0x0, @in=@multicast1, @in=@empty}}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e20}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e24}]}, 0x248}}, 0x40) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x4008032, 0xffffffffffffffff, 0xebd53000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x40, r5, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048080}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000200)) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x4c, r5, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x400a}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x2}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0xfd}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x48080}, 0x4000091) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$sock_ifreq(r7, 0x8992, &(0x7f0000000000)={'bond0\x00', @ifru_names='veth1_to_bond\x00'}) r8 = socket$pppl2tp(0x18, 0x1, 0x1) r9 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r8, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r9, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r10 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r10, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}, 0x2}}, 0x2e) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xfffffffffffffec6, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYRES32], 0xb0}, 0x1, 0x0, 0x0, 0x200000c5}, 0x881) fanotify_init(0x20, 0x1000) 8.778990738s ago: executing program 1 (id=4059): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000001780)=[{0x0}, {0x0}], 0x2}}], 0x1, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@dstopts_2292={{0xc8, 0x29, 0x4, {0x4, 0x15, '\x00', [@calipso={0x7, 0x8, {0x1, 0x0, 0x9, 0x9f}}, @generic={0xfe, 0x6b, "f4a4a3142ee1e12b9826287997a6b33d89f3d60da1641d9fe3896c3c1b6c130ef4f01be8f5836d417874540898619050b14420ab124b11de36afb16ef4fc1cf3f4e4fa0e647cd1b07b068d3894180b6aa7527a4a8252f6836a0d67a7782c675a838ea989e567e4774de1f5"}, @generic={0x80, 0x14, "09e12e5f0b6bdcf72f2ec7008a15fa88b025e0ad"}, @calipso={0x7, 0x8, {0x1, 0x0, 0x7a, 0x8001}}, @pad1, @generic={0x93, 0x11, "e80ee304ecb784ec4655260cecea14e498"}]}}}, @hoplimit={{0x14}}, @hopopts={{0x80, 0x29, 0x36, {0x5e, 0xc, '\x00', [@pad1, @pad1, @padn, @calipso={0x7, 0x30, {0x3, 0xa, 0x0, 0xfff, [0x2, 0x966, 0xfffffffffffffff7, 0x1, 0x1]}}, @calipso={0x7, 0x10, {0x0, 0x2, 0x7, 0x6, [0x7fff]}}, @generic={0x8}, @calipso={0x7, 0x10, {0x3, 0x2, 0x3, 0x7, [0x8000]}}, @generic={0x1}]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}], 0x178}}], 0x1, 0x810) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x1000000) 8.390791002s ago: executing program 1 (id=4061): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000010000850000001b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x803, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x2c, r3, 0x2cb3b0415539fbbb, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x4}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x801}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'caif0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b59500000000000000000a000000", @ANYRES32=r5, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c0000140001"], 0x48}}, 0x0) (async) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[], 0x50}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) (async, rerun: 64) syz_usb_connect(0x0, 0x3d7, &(0x7f00000007c0)=ANY=[@ANYBLOB="120100004cefc008e10593085bfd010203010902c50301000000000904"], 0x0) (rerun: 64) 5.111813042s ago: executing program 1 (id=4067): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x4, 0xfffffe0000000001, 0xfa14, 0xffffffff}, 0x0) openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x101800, 0x0) ioctl$FBIOBLANK(r6, 0x4611, 0x3) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, 0x0, 0x0) quotactl_fd$Q_GETFMT(r6, 0xffffffff80000402, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x2, 0x8, 0x0, 0x3}, 0x0) ioprio_get$uid(0x3, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip6_flowlabel\x00') pread64(r8, &(0x7f0000001600)=""/4103, 0x1007, 0x97) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r9, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000003c0)={0x18, r10, 0xef5ebf77ce25880d, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x8c0}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0xf1ff, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffefff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000940)=@newqdisc={0x138, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r3, {0x3}, {}, {0x2, 0x1}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x108, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "0d767b344a4107111e7e642d07ae014c02021bf9ea748c446391894699ec720ff9827531e9b3340038d7a0916c5984381baee6cd3a24fa9327dfcad6fa7c5135531ac295b264596f6d3e857f152d0b7083fb07acdfabd1324a0014a096078ac9c249f66d2af98841b65c33dc69677149a24390411bda91281cd201379858f2fcca40d86f69ed5fc1d5674c90eccc7818ecfcb9e0418db476b3beb17e7a33795eaaf955a98da4290b20627cd3c3edb40de32380fc7781ce8bc43a77a459d826255142030193a40d8f3b2ce6909a57c5bea695b7699c7a393ef756b8ce29f84499994a1138f4be3eea8583115628cedb67fee1eada59655f2b9d67580e94534bc7"}]}}]}, 0x138}, 0x1, 0x0, 0x0, 0x480d8}, 0x4000000) 5.111422454s ago: executing program 4 (id=4068): write$tun(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="020304000100090104"], 0x1043) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x161281, 0x0) write$binfmt_aout(r0, &(0x7f0000000200)=ANY=[], 0x318c) r1 = signalfd(0xffffffffffffffff, &(0x7f0000000240)={[0xfffffffe]}, 0x8) read(r1, &(0x7f0000000740)=""/384, 0x200008ca) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f0000000280)={0x800, 0x369, 0x8001, 0x3, '\x00', '\x00', '\x00', 0x0, 0x3, 0xf, 0x8, "3eb7d4367088cc3ae2b08c4f1944dffa"}) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xf, "0040001e1d113c812e5d6000"}) r2 = syz_open_pts(r0, 0x2042) ioctl$FIONREAD(r2, 0x541b, &(0x7f00000006c0)) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) write$char_usb(r3, &(0x7f0000000000)="e2", 0x1) r4 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r4, 0x107, 0xb, 0x0, 0x0) 4.974546661s ago: executing program 0 (id=4069): r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140), 0x553402, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3a) r2 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)={0x34, 0x43, 0x107, 0xbffffffe, 0x25dfdbfc, {0x3, 0x7c}, [@nested={0x4, 0x145}, @nested={0x1c, 0x1, 0x0, 0x1, [@nested={0x8, 0x1c, 0x0, 0x1, [@nested={0x4, 0x109}]}, @typed={0x8, 0x26, 0x0, 0x0, @uid=r4}, @typed={0x8, 0x9c, 0x0, 0x0, @pid=r3}]}]}, 0x34}}, 0xc000) quotactl_fd$Q_SETINFO(r1, 0xffffffff80000601, r4, &(0x7f0000000180)={0x430d, 0x7, 0x0, 0x6}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) msgget$private(0x0, 0x8) msgsnd(0x0, &(0x7f0000002540)={0x1}, 0x8, 0x800) msgrcv(0x0, &(0x7f0000006cc0)={0x0, ""/123}, 0x83, 0x1, 0x1800) r5 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r5, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) fchown(r5, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000080)="b9060a0000b808000000ba000000000f30b8010000000f01c166bad00466ed440f20c03503000000440f22c0f0284d6f80665700660f38806bcc66b83c010f00d06736400f005c0300c4c249cff0", 0x4e}], 0x1, 0x9, &(0x7f0000000100)=[@cr4={0x1, 0x22}], 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x10, 0x7fff7ff9}]}) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) io_setup(0xe5, &(0x7f00000001c0)) r8 = socket$inet6_udp(0xa, 0x2, 0x0) r9 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r9, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r8, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x6, @private0}}}, 0x3a) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r7) sendmsg$L2TP_CMD_SESSION_GET(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000280)={0x34, r10, 0x1, 0x2, 0x0, {0x7}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xfffffffffffffffb}, @L2TP_ATTR_IFNAME={0x14}]}, 0x34}}, 0x0) ioctl$VHOST_SET_VRING_BASE(r6, 0xaf01, 0x0) ioctl$VHOST_GET_VRING_BASE(r6, 0x4001af84, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000400)={0x54, 0x2, 0x6, 0x5, 0x0, 0x0, {0x5, 0x0, 0x5}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x6}]}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}}, 0x80) ioctl$IOCTL_STOP_ACCEL_DEV(r0, 0x40096101, &(0x7f00000007c0)={{}, 0xfe}) 4.0727054s ago: executing program 4 (id=4070): r0 = syz_usb_connect(0x2, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000340)={0x10, &(0x7f0000000200)={0x40, 0xc4acde141ca2cafa, 0x3, "4c93c4"}, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000680)={0x1c, &(0x7f00000004c0)={0x40, 0xd, 0x3, "60e5f1"}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect(0x2, 0x3b, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010102a39ab910b80c0bc9ae0d01020301090229000101f8400409048afc0101033e080724010205050009050c02"], &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_buf(r1, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000004000000", 0xfe60) 4.051378099s ago: executing program 0 (id=4071): sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000200)=0x1, 0x2a8) openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000001780)=[{0x0}, {0x0}], 0x2}}], 0x1, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@dstopts_2292={{0x68, 0x29, 0x4, {0x4, 0x9, '\x00', [@calipso={0x7, 0x10, {0x1, 0x2, 0x9, 0x9f, [0x8]}}, @generic={0x80, 0x14, "09e12e5f0b6bdcf72f2ec7008a15fa88b025e0ad"}, @calipso={0x7, 0x8, {0x1, 0x0, 0x7a, 0x8001}}, @ra={0x5, 0x2, 0xa7e}, @pad1, @ra={0x5, 0x2, 0xbf4}, @generic={0x93, 0xa, "e80ee304ecb784ec4655"}]}}}, @hoplimit={{0x14}}, @hopopts={{0x70, 0x29, 0x36, {0x5e, 0xb, '\x00', [@pad1, @calipso={0x7, 0x28, {0x3, 0x8, 0x0, 0xfff, [0x2, 0x966, 0xfffffffffffffff7, 0x1]}}, @calipso={0x7, 0x10, {0x0, 0x2, 0x7, 0x6, [0x7fff]}}, @generic={0x8}, @calipso={0x7, 0x10, {0x3, 0x2, 0x3, 0x7, [0x8000]}}, @generic={0x1, 0x3, "2bdb86"}]}}}, @rthdrdstopts={{0x20, 0x29, 0x37, {0x73, 0x0, '\x00', [@pad1]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}], 0x128}}], 0x1, 0x810) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) (fail_nth: 3) 3.259949102s ago: executing program 3 (id=4072): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000000040ef1747600000000000010902244f05001000000904000001030002000921000000012205000905810300000c000069a5e49bee319ecd559ac0ddbc6da9e62f4b1b7c72cff70074de0bf331dec70e0896714fe79418e9539cc21e66d8cbaa552323"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000180)={0x1, 0xaa4, 0x0, &(0x7f0000000340)}) ioctl$KVM_SET_CLOCK(r2, 0x4188aec6, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x20000000000000, 0x4}) socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x20800, 0x0) r3 = syz_io_uring_setup(0xbdc, &(0x7f0000000380)={0x0, 0x60d3, 0x8, 0x0, 0x3df}, &(0x7f00000006c0)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x6003, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001700)=""/216, 0xd8}], 0x1, 0x0, 0x1}) io_uring_enter(r3, 0x47ba, 0x0, 0x28, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000024000/0x18000)=nil, &(0x7f0000000680)=[@text16={0x10, &(0x7f0000000280)="66b9800000c00f326635010000000f3064660f38828e4258660f08676ac744240012e93bf96766c744240201000000f20f78ecf5543e660f3829544e66b9800000c00f326635002000000f300f01df66b80500000066b900200000a90a000f01c40f019c09000f01c2", 0x69}], 0x1, 0x7d, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/locks\x00', 0x0, 0x0) pread64(r6, &(0x7f00000024c0)=""/205, 0x4c, 0x53) flock(r6, 0x6) read$FUSE(r6, &(0x7f0000000200)={0x2020}, 0x2020) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r2, 0x4068aea3, &(0x7f0000000100)={0xbc, 0x0, 0x4}) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r8 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r8, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r8, &(0x7f0000000040)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000780)="f4000900062b3b25fe80000000000000dc8b850f23640000000000000000ad6e911b51818462b4003a", 0x29}], 0x1}, 0x8040) r9 = syz_usb_connect$printer(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x28, 0x3f0, 0x4, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xf7, 0x10, 0x2, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x7, 0x1, 0x1, 0xff, "", {{{0x9, 0x5, 0x1, 0x2, 0x3ff, 0x7f, 0x6, 0x4}}, [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x8, 0x2, 0x1}}]}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000300)={0xa, 0x6, 0x250, 0xe, 0x9, 0x80, 0x40, 0xe4}, 0x14d, &(0x7f0000000440)={0x5, 0xf, 0x14d, 0x6, [@generic={0xf8, 0x10, 0x4, "f9053a00e5770a0c97b091d8078df85ea007746cc1afcee2ca255842b3cd3a82477d36eeed78a83c4ee0ff38612b0c1645974ebee38043a6b1fb69d47475bba2f41838b6ae901caf225df6d0c893a7cf654dbee5de335a3419889dcbf40a6b58b6bb27591045b89d3cebf539df430f2d1e5ede0dfe16ef778284b5f1403cf823bdaf9295981f7836984338d2665aeff4e11c1316117bd31404f3457c2f4a49a6c250dbb114c08b1b3ada3e55031613e51f4997a6fcdada3c230f14aff390cc34412da66cdd10090692759cf7d09adf3ad640be3477a6d8892ac0e736d4051b5aee8904f021bdec2d598325a56d11a9763ca2312662"}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "6c4ec42672700361c7cab9838c0c5ed8"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x1, 0x6, 0x0, 0xfffc}, @ssp_cap={0x24, 0x10, 0xa, 0x8, 0x6, 0x5, 0xf00f, 0x7, [0xff0000, 0xfff0, 0x0, 0xc0c0, 0xffc000, 0x0]}, @wireless={0xb, 0x10, 0x1, 0xe, 0x8, 0x6, 0xb1, 0x0, 0x9b}, @ptm_cap={0x3}]}, 0x1, [{0xbc, &(0x7f0000000340)=@string={0xbc, 0x3, "c6c8d79fb8f92efd0c57a024cca30045898c164f2491ab18d0119558b530c9dfc9ed750f0f2932d2d711198dba982365a3fe6ea870691aa00547e3133f82e83acac6f951a0d0b28c383394f63ef37e98709c4c10f19bf4d9b5154e1235fe93647b1011fcb365e0afa3f03288f44fc9a1c113cffb4a55e7997726ce6d421d7ae69702f0747cfaf58a680cd42e869aa9bfefdc658ca5e89990031ad731cad791c3a501450f80dc1c02fb7fd8974ad7d599f1f132b819dc8483398b"}}]}) syz_usb_control_io(r9, &(0x7f0000000040)={0x2c, &(0x7f00000006c0)={0x0, 0x9, 0x5, {0xfffffd6a, 0x22, "00000021e1e29f6428749fbaec37c477648355b7b645703b94c695fa13c22fc3ac014e9df6576a8eb798810705326924dec0c6cb3f63d4216d0a5594b9de7af17992bce10a11b0ea256568e5dc69e0ec3bc26c5a5f51af09f6dd0fab472cb34e95ba2eb20732e700"/116}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 3.181758658s ago: executing program 1 (id=4073): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0x200}, 0x0) r2 = syz_open_procfs$pagemap(0x0, &(0x7f0000000180)) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) close(r4) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, &(0x7f0000000300)={0x0, 0x0, 0x0}) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c00)=ANY=[@ANYBLOB="14000000100001000000ddffffff00000000000a3c000000120a09000000000000000000020000000900020073797a310000000008000440000000d50900010073797a3000000000080003400000000114000000110001"], 0x64}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c000000150a0102"], 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) recvmmsg(r5, &(0x7f0000004f40)=[{{0x0, 0x0, 0x0}, 0xff}], 0x1, 0x40000102, 0x0) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r3, 0xc01864b0, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_INIT(r6, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x8, 0xffffffffd24b2432, 0x83, 0xffff, 0x0, 0xabe6, 0x0, 0x0, 0x80, 0x8001}}, 0x50) syz_fuse_handle_req(r6, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.02177264s ago: executing program 0 (id=4074): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000040)={0x1, 0x4}, 0x8) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f00000003c0)=0x491b, 0x4) sendmmsg$inet6(r0, &(0x7f00000002c0)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x3, @mcast1}, 0x1c, 0x0, 0x1f4}}], 0x1, 0x4004000) 2.888756437s ago: executing program 0 (id=4075): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a00000709000100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x40090) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000001600000500000a4c000000060a010400000000000000000a0000010900010073797a31000000000900020073797a320000000006000740dcf100001800048014000180090001007866726d000000000400028014000000110001000000000000000000010000c6610a"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000280)={'ip6_vti0\x00', 0x0, 0x4, 0x0, 0x3, 0x5, 0x12, @mcast2, @private0, 0x0, 0x8007, 0x100, 0x5}}) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x20040845}, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000014c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x15}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000004}, 0x24000000) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x800) recvmmsg(0xffffffffffffffff, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000000440)=""/128, 0x80}], 0x2, &(0x7f00000004c0)=""/193, 0xc1}, 0x7f}, {{&(0x7f00000005c0)=@in, 0x80, &(0x7f0000000700)=[{&(0x7f0000000640)=""/35, 0x23}], 0x1, &(0x7f0000000740)=""/23, 0x17}, 0x3}], 0x2, 0x40012100, 0x0) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000ce94513381fd000000000000000000000002"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0xf, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000100000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf090000000000006609010000000000060000000b0000002c93000000000000b5030000000000008500000076000000b7000000000000009500000000000000"], &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) 1.938840755s ago: executing program 1 (id=4076): syz_open_procfs(0x0, &(0x7f00000006c0)='pagemap\x00') bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1f00000000000000000000000080"], 0x50) pselect6(0x40, &(0x7f00000002c0)={0x0, 0x5000000, 0x0, 0x0, 0x800}, 0x0, &(0x7f0000000280)={0x1f, 0x0, 0xffffffffffffffff}, 0x0, 0x0) 1.429811746s ago: executing program 3 (id=4077): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)={{0x14, 0x10, 0x1, 0x5000000}, [@NFT_MSG_NEWRULE={0x34, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, '\"'}]}], {0x14}}, 0x5c}}, 0x0) 1.263944439s ago: executing program 3 (id=4078): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x2, 0x4, 0x0, 0x3, 0xe, 0x0, 0x70bd2c, 0x25dfdbfb, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote, 0x5dd8}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x7, 0xc}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7}}]}, 0x70}, 0x1, 0x7}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000b80)) r3 = socket$packet(0x11, 0x3, 0x300) r4 = dup(r1) r5 = fcntl$dupfd(r0, 0x406, r3) ioctl$VHOST_NET_SET_BACKEND(r5, 0x4008af30, &(0x7f0000000080)={0x0, r4}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) 1.036145354s ago: executing program 1 (id=4079): syz_open_dev$loop(&(0x7f0000000080), 0x7, 0x8000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$unix(r1, &(0x7f00000004c0)=@abs={0x1, 0x0, 0x4e20}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$inet(0x2, 0x3, 0x9) pipe2$watch_queue(&(0x7f0000000480), 0x80) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r3, 0x6, 0x0, 0x0, 0x0) futex(&(0x7f0000000000)=0x2, 0x3, 0x0, 0x0, 0xffffffffffffffff, 0x2) r4 = add_key$keyring(&(0x7f0000000240), &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000440)='asymmetric\x00', 0x0, &(0x7f0000000000)="308002", 0x3, r4) r5 = fsmount(r3, 0x0, 0x0) r6 = openat$cgroup_subtree(r5, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000040)={[{0x2b, 'cpuset'}]}, 0x8) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_clone(0x8a140600, &(0x7f00000001c0)="07b5e42d30226aba87697ce3ff665d7cb4bdf0381b74230609ad5a0c5b8a9d5c2f3277994317083b76b0aedef0afef4267cf265f61c257cdf6b2b4f80e41dc603103f166f30d40ea85dfe1e8e66067ed6f2943db878e74532cf26a3f8ca5", 0x5e, &(0x7f0000000240), &(0x7f0000000340), &(0x7f0000000380)="646a21c1314836dab1375dc5370b85967842427f74c7fdda0fb7ef9233f6099289037fa8ede14a0147999b5b523275ef4abe7ff27941f54759b8ecf4d9f02b8e7d4d9dfadc80893ce8f09ba0bcc31b1ba7191c0c1c71e4bb4b162e670308b4d33e0f02aa5e24636f9c2d0db8a006018c1225f05d35d6e969f5fabf0a8c6ba2ea8675fa596d5d008285bc2bc52fea5fdafb52bfa310ecb3056c7f32881c0305e3ea74da8d09229309241efeed6eb72cf772") sendmsg$nl_xfrm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000000540)=@newsa={0x1a0, 0x10, 0x1, 0x70bd25, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x0, 0x64}, {@in=@loopback, 0x0, 0x32}, @in=@dev={0xac, 0x14, 0x14, 0x12}, {0xef5, 0x100, 0x0, 0xfffffffffffffffd, 0x0, 0x1, 0x0, 0xe3}, {0xfffffffffffffffd, 0x4, 0x8000000, 0x100000000}, {0x0, 0x0, 0x2}, 0x0, 0x0, 0xa, 0x1, 0x0, 0xcd}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x70bd27, 0x0, 0x70bd2a, 0x70bd28}}, @algo_auth_trunc={0x4c, 0x14, {{'cmac(aes)\x00'}}}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x40000}, 0x10) syz_open_dev$dmmidi(&(0x7f0000000300), 0x6, 0x70202) openat$audio(0xffffffffffffff9c, 0x0, 0x80802, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) 1.023722322s ago: executing program 0 (id=4080): write$tun(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="020304000100090104"], 0x1043) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x161281, 0x0) write$binfmt_aout(r0, &(0x7f0000000200)=ANY=[], 0x318c) r1 = signalfd(0xffffffffffffffff, &(0x7f0000000240)={[0xfffffffe]}, 0x8) read(r1, &(0x7f0000000740)=""/384, 0x200008ca) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f0000000280)={0x800, 0x369, 0x8001, 0x3, '\x00', '\x00', '\x00', 0x0, 0x3, 0xf, 0x8, "3eb7d4367088cc3ae2b08c4f1944dffa"}) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xf, "0040001e1d113c812e5d6000"}) r2 = syz_open_pts(r0, 0x2042) ioctl$FIONREAD(r2, 0x541b, &(0x7f00000006c0)) 880.220355ms ago: executing program 4 (id=4081): socket$nl_generic(0x10, 0x3, 0x10) openat$drirender128(0xffffffffffffff9c, 0x0, 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f00000001c0), 0x841, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$NFNL_MSG_ACCT_NEW(0xffffffffffffffff, 0x0, 0x4000010) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8080000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2010d3}) r3 = open(&(0x7f00009e1000)='./file0\x00', 0x0, 0x140) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, &(0x7f0000000040)={0x7, 0x80a0000, 0x0, r3, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 852.070397ms ago: executing program 3 (id=4082): r0 = socket(0x10, 0x2, 0x0) write(r0, 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, 0x0, &(0x7f00000002c0)) socket$inet_udp(0x2, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x0, 0x84) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r2, 0x4236}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4e21, 0x9, @mcast1, 0x9}, r3, 0x8001}}, 0x48) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 523.482877ms ago: executing program 4 (id=4083): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x900, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20008001}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8922, 0x0) 388.00567ms ago: executing program 3 (id=4084): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000480)={0x0, 0x1f, &(0x7f0000000000)={&(0x7f00000000c0)={0x1c, r1, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @void}}}, 0x1c}}, 0x4000054) 245.442788ms ago: executing program 3 (id=4085): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x256c, 0x6d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001440)={0xfffffffffffffd87, 0x0, 0x0, &(0x7f00000013c0)={0x0, 0x22, 0x5, {[@local=@item_4={0x3, 0x2, 0x0, "741cb976"}]}}, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001840)={0x24, 0x0, &(0x7f0000001740)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000540)={0xfffffffffffffcc9, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x7f, @lang_id={0x0, 0x3, 0x42f}}, 0x0, 0x0}, 0x0) 95.584597ms ago: executing program 0 (id=4086): r0 = syz_open_procfs(0x0, &(0x7f0000000100)='pagemap\x00') r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000100), 0x2) r2 = memfd_create(&(0x7f0000000180)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\xdenJ\xeb\x87\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38\x14\xcb\xfa\xb3j\x92\f\xe0\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf0\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x2) ftruncate(r2, 0xffff) fcntl$addseals(r2, 0x409, 0x7) r3 = ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000140)={r2, 0x1, 0x0, 0x4000}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000007, 0x11, r3, 0x0) pread64(r0, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) 0s ago: executing program 4 (id=4087): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x1, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000180)=@ccm_128={{0x303}, "e9e22b5d3c0acf79", '\x00a\x00', "3d6774d4", "dacc67e62e32779f"}, 0x28) setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000080)=0x6, 0x4) kernel console output (not intermixed with test programs): it: type=1326 audit(1767389638.683:699): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18890 comm="syz.1.3731" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a77b8f749 code=0x7ffc0000 [ 966.172461][ T24] usb usb5-port1: unable to enumerate USB device [ 966.201870][ T5895] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 966.210985][ T5895] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 966.243622][ T5895] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 966.261478][ T30] audit: type=1326 audit(1767389638.703:701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18890 comm="syz.1.3731" exe="/root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f9a77b8f749 code=0x7ffc0000 [ 966.283961][ T5895] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 966.297438][ T5895] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 966.306644][ T30] audit: type=1326 audit(1767389638.703:700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18890 comm="syz.1.3731" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a77b8f749 code=0x7ffc0000 [ 966.331841][ T5895] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 966.343562][ T5895] usb 3-1: config 0 descriptor?? [ 966.375565][ T30] audit: type=1326 audit(1767389638.773:702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18890 comm="syz.1.3731" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a77b8f749 code=0x7ffc0000 [ 966.405743][ T30] audit: type=1326 audit(1767389638.773:703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18890 comm="syz.1.3731" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f9a77b8f783 code=0x7ffc0000 [ 966.466705][ T30] audit: type=1326 audit(1767389638.773:704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18890 comm="syz.1.3731" exe="/root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f9a77b8f807 code=0x7ffc0000 [ 966.489725][ T30] audit: type=1326 audit(1767389638.773:705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18890 comm="syz.1.3731" exe="/root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f9a77b46bdd code=0x7ffc0000 [ 966.518281][ T30] audit: type=1326 audit(1767389638.773:706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18890 comm="syz.1.3731" exe="/root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7f9a77bc3e89 code=0x7ffc0000 [ 966.570100][ T5895] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 78 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 966.659728][ C0] usblp0: nonzero read bulk status received: -71 [ 966.669529][ T5895] usb 3-1: USB disconnect, device number 78 [ 967.171881][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 967.421761][ T5895] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 967.571922][ T5895] usb 4-1: Using ep0 maxpacket: 16 [ 967.580568][ T5895] usb 4-1: unable to get BOS descriptor or descriptor too short [ 967.594036][ T5895] usb 4-1: config 13 has an invalid interface number: 50 but max is 0 [ 967.603422][ T5895] usb 4-1: config 13 has no interface number 0 [ 967.610306][ T5895] usb 4-1: config 13 interface 50 altsetting 167 bulk endpoint 0x88 has invalid maxpacket 16 [ 967.612809][ T24] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 967.623114][ T5895] usb 4-1: config 13 interface 50 has no altsetting 0 [ 967.637695][ T5895] usb 4-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 967.647862][ T5895] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.656295][ T5895] usb 4-1: Product: syz [ 967.660777][ T5895] usb 4-1: Manufacturer: syz [ 967.666045][ T5895] usb 4-1: SerialNumber: syz [ 967.674836][T18907] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 967.697923][T18916] netlink: 'syz.0.3739': attribute type 1 has an invalid length. [ 967.759362][T18918] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3740'. [ 967.815655][ T24] usb 2-1: config 0 has an invalid interface number: 64 but max is 0 [ 967.825992][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 967.836410][ T24] usb 2-1: config 0 has no interface number 0 [ 967.844968][ T24] usb 2-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 967.856611][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.864718][ T24] usb 2-1: Product: syz [ 967.869080][ T24] usb 2-1: Manufacturer: syz [ 967.881834][ T24] usb 2-1: SerialNumber: syz [ 967.902960][ T24] usb 2-1: config 0 descriptor?? [ 967.912322][ T24] uvcvideo 2-1:0.64: probe with driver uvcvideo failed with error -22 [ 967.936277][T18874] usblp0: removed [ 968.116439][ T5895] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 968.123907][ T5895] usb 4-1: MIDIStreaming interface descriptor not found [ 968.131910][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 968.140198][ T24] usb 2-1: USB disconnect, device number 57 [ 968.211792][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 968.223663][ T5895] usb 4-1: USB disconnect, device number 62 [ 968.242320][ T7599] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 968.307712][ T6183] udevd[6183]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:13.50/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 968.422992][ T7599] usb 3-1: Using ep0 maxpacket: 32 [ 968.430490][ T7599] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 968.443662][ T7599] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 968.454226][ T7599] usb 3-1: New USB device found, idVendor=0b0e, idProduct=ffff, bcdDevice= 0.00 [ 968.464598][ T7599] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 968.482137][ T7599] usb 3-1: config 0 descriptor?? [ 968.691609][T18923] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3742'. [ 968.708749][ T7599] usbhid 3-1:0.0: can't add hid device: -71 [ 968.716474][ T7599] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 968.727012][ T7599] usb 3-1: USB disconnect, device number 79 [ 969.085797][T18936] usb usb4: usbfs: interface 0 claimed by hub while 'syz.3.3745' sets config #-1 [ 969.150163][T18936] tipc: Enabled bearer , priority 0 [ 969.223859][T18936] syzkaller0: entered promiscuous mode [ 969.230696][T18936] syzkaller0: entered allmulticast mode [ 969.251832][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 969.395182][T18941] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3746'. [ 969.422099][T18936] tipc: Resetting bearer [ 969.497665][T18934] tipc: Resetting bearer [ 969.981848][ T5895] usb 5-1: new full-speed USB device number 48 using dummy_hcd [ 970.064397][T18955] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3751'. [ 970.162483][ T5895] usb 5-1: no configurations [ 970.177737][ T5895] usb 5-1: can't read configurations, error -22 [ 970.301865][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 970.321835][ T5895] usb 5-1: new full-speed USB device number 49 using dummy_hcd [ 970.513688][ T5895] usb 5-1: no configurations [ 970.518876][ T5895] usb 5-1: can't read configurations, error -22 [ 970.528766][ T5895] usb usb5-port1: attempt power cycle [ 970.701841][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 970.891997][ T5895] usb 5-1: new full-speed USB device number 50 using dummy_hcd [ 970.932316][ T5895] usb 5-1: no configurations [ 970.957448][ T5895] usb 5-1: can't read configurations, error -22 [ 970.986100][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 970.986118][ T30] audit: type=1326 audit(1767389643.683:732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18957 comm="syz.0.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5c3f58f749 code=0x7ffc0000 [ 970.993060][T18961] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3753'. [ 971.039983][ T30] audit: type=1326 audit(1767389643.683:733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18957 comm="syz.0.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5c3f58f749 code=0x7ffc0000 [ 971.071432][ T30] audit: type=1326 audit(1767389643.733:734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18957 comm="syz.0.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f5c3f58f749 code=0x7ffc0000 [ 971.101740][ T5895] usb 5-1: new full-speed USB device number 51 using dummy_hcd [ 971.111918][ T30] audit: type=1326 audit(1767389643.803:735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18957 comm="syz.0.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5c3f58f749 code=0x7ffc0000 [ 971.158060][ T5895] usb 5-1: no configurations [ 971.167761][ T5895] usb 5-1: can't read configurations, error -22 [ 971.175615][T18963] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3753'. [ 971.185013][ T30] audit: type=1326 audit(1767389643.803:736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18957 comm="syz.0.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5c3f58f749 code=0x7ffc0000 [ 971.207926][ T5895] usb usb5-port1: unable to enumerate USB device [ 971.235064][ T30] audit: type=1326 audit(1767389643.933:737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18957 comm="syz.0.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f5c3f58f749 code=0x7ffc0000 [ 971.267281][T18963] netlink: 'syz.2.3753': attribute type 10 has an invalid length. [ 971.318946][T18964] netlink: 'syz.2.3753': attribute type 10 has an invalid length. [ 971.341897][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 972.381119][T18934] tipc: Disabling bearer [ 972.382103][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 972.398928][T18955] bond0: option packets_per_slave: invalid value (18446744073693626368) [ 972.407580][T18955] bond0: option packets_per_slave: allowed values 0 - 65535 [ 972.419920][T18963] team0: Port device dummy0 added [ 972.436688][T18964] team0: Port device dummy0 removed [ 972.455000][T18958] tipc: Enabling of bearer rejected, failed to enable media [ 972.995987][T18987] tipc: Enabling of bearer rejected, already enabled [ 973.207818][ T5895] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 973.372222][ T5895] usb 5-1: Using ep0 maxpacket: 32 [ 973.392739][ T5895] usb 5-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 973.422007][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 973.448954][ T5895] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 973.480870][ T5895] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 973.741932][ T9] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 973.882632][ T5895] gspca_nw80x: reg_r err -32 [ 973.887294][ T5895] nw80x 5-1:3.0: probe with driver nw80x failed with error -32 [ 973.911707][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 973.925571][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 973.954204][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 974.001961][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 974.066731][ T9] usb 4-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 974.087190][T19002] netlink: 'syz.2.3763': attribute type 2 has an invalid length. [ 974.104436][T19002] : entered promiscuous mode [ 974.111880][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 974.150920][ T9] usb 4-1: config 0 descriptor?? [ 974.280102][ T24] usb 5-1: USB disconnect, device number 52 [ 974.404567][T19008] input: syz0 as /devices/virtual/input/input41 [ 974.451973][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 974.491824][T18098] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 974.571240][T18996] program syz.3.3762 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 974.620729][T19009] program syz.3.3762 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 974.659692][T18098] usb 2-1: config 1 has an invalid interface number: 7 but max is 0 [ 974.683378][T18098] usb 2-1: config 1 has no interface number 0 [ 974.699599][T18098] usb 2-1: config 1 interface 7 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 974.729579][T18098] usb 2-1: config 1 interface 7 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 16 [ 974.768188][T18098] usb 2-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 974.800292][T18098] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 974.823229][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 974.837581][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 974.839096][T18098] usb 2-1: Product: syz [ 974.867181][T18098] usb 2-1: Manufacturer: syz [ 974.884566][T18098] usb 2-1: SerialNumber: syz [ 974.899545][ T9] usb 4-1: USB disconnect, device number 63 [ 974.914392][T19012] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3766'. [ 974.954319][T19005] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 974.966109][T19005] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 974.980904][T18098] usb 2-1: Expected 3 endpoints, found: 2 [ 975.148584][T19017] [syz.4.] <== rxrpc_preparse_xdr_yfs_rxgk() = -EKEYREJECTED [d9c19884!=bc, 2c,d9c19820] [ 975.183538][T19017] [syz.4.] <== rxrpc_preparse_xdr_yfs_rxgk() = -EKEYREJECTED [d9c19884!=bc, 2c,d9c19820] [ 975.432670][T19026] program syz.3.3770 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 975.491800][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 975.505002][T19027] program syz.3.3770 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 975.522094][T18098] usb 5-1: new full-speed USB device number 53 using dummy_hcd [ 975.683695][T18098] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 975.715746][T18098] usb 5-1: config 0 has no interfaces? [ 975.752158][T18098] usb 5-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 975.786192][T18098] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.806563][T18098] usb 5-1: Product: syz [ 975.826386][T18098] usb 5-1: Manufacturer: syz [ 975.838667][T18098] usb 5-1: SerialNumber: syz [ 975.883533][T18098] usb 5-1: config 0 descriptor?? [ 976.037280][ T30] audit: type=1326 audit(1767389648.733:738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19029 comm="syz.3.3771" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f772a58f749 code=0x7ffc0000 [ 976.107318][ T30] audit: type=1326 audit(1767389648.803:739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19029 comm="syz.3.3771" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f772a58f749 code=0x7ffc0000 [ 976.178715][ T30] audit: type=1326 audit(1767389648.803:740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19029 comm="syz.3.3771" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f772a58f749 code=0x7ffc0000 [ 976.227380][ T30] audit: type=1326 audit(1767389648.803:741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19029 comm="syz.3.3771" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f772a58f749 code=0x7ffc0000 [ 976.277263][ T30] audit: type=1326 audit(1767389648.853:742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19029 comm="syz.3.3771" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f772a591667 code=0x7ffc0000 [ 976.395201][ T30] audit: type=1326 audit(1767389649.053:743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19029 comm="syz.3.3771" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f772a5915dc code=0x7ffc0000 [ 976.531816][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 976.622588][ T30] audit: type=1326 audit(1767389649.293:744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19029 comm="syz.3.3771" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f772a591514 code=0x7ffc0000 [ 976.646349][T19038] tipc: Enabling of bearer rejected, already enabled [ 976.666569][ T30] audit: type=1326 audit(1767389649.323:745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19029 comm="syz.3.3771" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f772a58e3aa code=0x7ffc0000 [ 976.689385][ T30] audit: type=1326 audit(1767389649.323:746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19029 comm="syz.3.3771" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f772a58f749 code=0x7ffc0000 [ 976.725896][ T30] audit: type=1326 audit(1767389649.323:747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19029 comm="syz.3.3771" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f772a58f749 code=0x7ffc0000 [ 976.749942][ T5827] usb 5-1: USB disconnect, device number 53 [ 976.817121][T19043] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3776'. [ 977.112821][T19055] program syz.3.3781 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 977.136206][T19055] program syz.3.3781 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 977.267790][ T9] usb 2-1: USB disconnect, device number 58 [ 977.553750][T19065] ip6tnl3: entered promiscuous mode [ 977.561691][T19065] ip6tnl3: entered allmulticast mode [ 977.571836][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 977.632004][ T9] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 977.704994][T19069] tipc: Enabling of bearer rejected, already enabled [ 977.816720][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 977.828101][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 977.839946][ T9] usb 2-1: New USB device found, idVendor=2006, idProduct=0118, bcdDevice= 0.00 [ 977.849463][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 977.859882][ T9] usb 2-1: config 0 descriptor?? [ 977.907389][T19073] tipc: Enabling of bearer rejected, already enabled [ 978.273308][T19060] FAULT_INJECTION: forcing a failure. [ 978.273308][T19060] name failslab, interval 1, probability 0, space 0, times 0 [ 978.320117][T19060] CPU: 0 UID: 0 PID: 19060 Comm: syz.1.3783 Tainted: G L syzkaller #0 PREEMPT(full) [ 978.320148][T19060] Tainted: [L]=SOFTLOCKUP [ 978.320157][T19060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 978.320169][T19060] Call Trace: [ 978.320177][T19060] [ 978.320186][T19060] dump_stack_lvl+0xe8/0x150 [ 978.320219][T19060] should_fail_ex+0x414/0x560 [ 978.320255][T19060] should_failslab+0xa8/0x100 [ 978.320280][T19060] kmem_cache_alloc_noprof+0x88/0x710 [ 978.320311][T19060] ? security_inode_alloc+0x39/0x330 [ 978.320341][T19060] security_inode_alloc+0x39/0x330 [ 978.320369][T19060] inode_init_always_gfp+0x9ed/0xdc0 [ 978.320399][T19060] ? __pfx_sock_alloc_inode+0x10/0x10 [ 978.320427][T19060] alloc_inode+0x82/0x1b0 [ 978.320451][T19060] __sock_create+0x12d/0x9d0 [ 978.320488][T19060] __sys_socket+0xd7/0x1b0 [ 978.320521][T19060] __x64_sys_socket+0x7a/0x90 [ 978.320552][T19060] do_syscall_64+0xec/0xf80 [ 978.320574][T19060] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 978.320593][T19060] ? clear_bhb_loop+0x60/0xb0 [ 978.320615][T19060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 978.320633][T19060] RIP: 0033:0x7f9a77b91667 [ 978.320651][T19060] Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 978.320668][T19060] RSP: 002b:00007f9a78a1bfa8 EFLAGS: 00000286 ORIG_RAX: 0000000000000029 [ 978.320687][T19060] RAX: ffffffffffffffda RBX: 00007f9a77de5fa0 RCX: 00007f9a77b91667 [ 978.320702][T19060] RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010 [ 978.320713][T19060] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 978.320724][T19060] R10: 0000200000000040 R11: 0000000000000286 R12: 0000000000000001 [ 978.320736][T19060] R13: 00007f9a77de6038 R14: 00007f9a77de5fa0 R15: 00007f9a77f0fa28 [ 978.320764][T19060] [ 978.509286][T19060] socket: no more sockets [ 978.621839][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 978.794823][ T9] usbhid 2-1:0.0: can't add hid device: -71 [ 978.813312][ T9] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 978.839492][ T9] usb 2-1: USB disconnect, device number 59 [ 979.408844][T19083] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 979.439747][T19083] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 979.631297][T19093] program syz.2.3792 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 979.662047][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 979.704184][T19095] program syz.2.3792 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 979.794166][T19098] PKCS8: Unsupported PKCS#8 version [ 980.102319][ T7599] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 980.268499][ T7599] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 980.305851][ T7599] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 980.333751][ T7599] usb 2-1: New USB device found, idVendor=2006, idProduct=0118, bcdDevice= 0.00 [ 980.363620][ T7599] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 980.390899][ T7599] usb 2-1: config 0 descriptor?? [ 980.471778][ T9] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 980.631875][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 980.641604][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 980.670552][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 980.690973][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 980.700280][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 980.721426][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 980.749087][ T9] usb 3-1: config 0 descriptor?? [ 980.773555][ T9] hub 3-1:0.0: USB hub found [ 980.853569][ T7599] usbhid 2-1:0.0: can't add hid device: -71 [ 980.859660][ T7599] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 980.895574][ T7599] usb 2-1: USB disconnect, device number 60 [ 980.954975][T19111] netlink: 'syz.4.3798': attribute type 10 has an invalid length. [ 980.985202][ T9] hub 3-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 980.996435][T19111] netlink: 'syz.4.3798': attribute type 10 has an invalid length. [ 981.013849][T19111] team0: Port device dummy0 removed [ 981.100214][T19113] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3799'. [ 981.110897][T19113] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3799'. [ 981.121531][T19113] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3799'. [ 981.133108][T19113] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3799'. [ 981.415388][ T9] hid_parser_main: 8 callbacks suppressed [ 981.415412][ T9] hid-generic 0003:046D:C31C.0051: unknown main item tag 0x0 [ 981.490569][ T9] hid-generic 0003:046D:C31C.0051: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.2-1/input0 [ 981.636795][T19133] fuse: Bad value for 'fd' [ 981.648960][T19135] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 981.678825][T19135] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 981.731825][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 981.731964][ T5827] usb 3-1: USB disconnect, device number 80 [ 981.936822][T19142] PKCS8: Unsupported PKCS#8 version [ 982.081725][ T5895] usb 2-1: new full-speed USB device number 61 using dummy_hcd [ 982.181735][ T7599] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 982.254088][ T5895] usb 2-1: unable to get BOS descriptor or descriptor too short [ 982.273856][ T5895] usb 2-1: not running at top speed; connect to a high speed hub [ 982.303985][ T5895] usb 2-1: config 9 has no interfaces? [ 982.323017][ T5895] usb 2-1: New USB device found, idVendor=04b8, idProduct=0601, bcdDevice= 1.00 [ 982.341842][ T7599] usb 3-1: Using ep0 maxpacket: 32 [ 982.348126][ T5895] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 982.356572][ T5895] usb 2-1: Product: syz [ 982.362527][ T7599] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 982.387273][ T5895] usb 2-1: Manufacturer: à „ [ 982.398097][ T7599] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 982.410261][ T5895] usb 2-1: SerialNumber: syz [ 982.427532][ T7599] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 982.446863][ T7599] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 982.465680][ T7599] usb 3-1: config 0 descriptor?? [ 982.492880][ T7599] hub 3-1:0.0: USB hub found [ 982.651199][ T5895] usb 2-1: USB disconnect, device number 61 [ 982.689508][T19108] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 982.722019][T19108] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 982.765513][ T7599] hub 3-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 982.773722][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 982.974156][ T7599] usbhid 3-1:0.0: can't add hid device: -71 [ 982.986907][ T7599] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 983.052708][ T7599] usb 3-1: USB disconnect, device number 81 [ 983.461765][ T7599] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 983.622323][ T7599] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 983.634947][ T7599] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 983.665571][ T7599] usb 2-1: New USB device found, idVendor=054c, idProduct=024b, bcdDevice= 0.00 [ 983.680296][ T7599] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 983.707854][ T7599] usb 2-1: config 0 descriptor?? [ 983.811812][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 983.930846][T19161] FAULT_INJECTION: forcing a failure. [ 983.930846][T19161] name failslab, interval 1, probability 0, space 0, times 0 [ 983.956891][T19161] CPU: 1 UID: 0 PID: 19161 Comm: syz.4.3815 Tainted: G L syzkaller #0 PREEMPT(full) [ 983.956924][T19161] Tainted: [L]=SOFTLOCKUP [ 983.956933][T19161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 983.956945][T19161] Call Trace: [ 983.956954][T19161] [ 983.956964][T19161] dump_stack_lvl+0xe8/0x150 [ 983.956991][T19161] should_fail_ex+0x414/0x560 [ 983.957027][T19161] should_failslab+0xa8/0x100 [ 983.957053][T19161] __kmalloc_cache_noprof+0x84/0x700 [ 983.957072][T19161] ? ipv6_add_addr+0x530/0x1090 [ 983.957104][T19161] ipv6_add_addr+0x530/0x1090 [ 983.957136][T19161] ? __pfx_ipv6_add_addr+0x10/0x10 [ 983.957168][T19161] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 983.957200][T19161] add_addr+0x8b/0x2d0 [ 983.957225][T19161] addrconf_init_auto_addrs+0x296/0xa00 [ 983.957241][T19161] ? __pfx_addrconf_init_auto_addrs+0x10/0x10 [ 983.957257][T19161] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 983.957279][T19161] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 983.957300][T19161] ? tls_dev_event+0x717/0xec0 [ 983.957330][T19161] ? net_generic+0x1e/0x240 [ 983.957360][T19161] ? addrconf_link_ready+0x112/0x170 [ 983.957378][T19161] addrconf_notify+0xb1e/0x1050 [ 983.957394][T19161] notifier_call_chain+0x19d/0x3a0 [ 983.957411][T19161] __dev_notify_flags+0x18d/0x2e0 [ 983.957428][T19161] ? __pfx___dev_notify_flags+0x10/0x10 [ 983.957447][T19161] ? __dev_change_flags+0x4af/0x680 [ 983.957476][T19161] ? __pfx___dev_change_flags+0x10/0x10 [ 983.957505][T19161] ? is_bpf_text_address+0x26/0x2b0 [ 983.957530][T19161] netif_change_flags+0xe8/0x1a0 [ 983.957545][T19161] do_setlink+0xc55/0x41c0 [ 983.957560][T19161] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 983.957588][T19161] ? __pfx_do_setlink+0x10/0x10 [ 983.957614][T19161] ? __pfx_stack_trace_save+0x10/0x10 [ 983.957648][T19161] ? unwind_next_frame+0xa5/0x23d0 [ 983.957668][T19161] ? lock_acquire+0x101/0x340 [ 983.957684][T19161] ? __mutex_trylock_common+0x153/0x260 [ 983.957698][T19161] ? __pfx___mutex_trylock_common+0x10/0x10 [ 983.957713][T19161] ? rcu_is_watching+0x15/0xb0 [ 983.957728][T19161] ? trace_contention_end+0x39/0x100 [ 983.957753][T19161] ? __mutex_lock+0x335/0x1350 [ 983.957786][T19161] ? rtnl_newlink+0x8ec/0x1c90 [ 983.957810][T19161] ? __pfx___mutex_lock+0x10/0x10 [ 983.957828][T19161] ? ns_capable+0x8a/0xf0 [ 983.957841][T19161] rtnl_newlink+0x14b0/0x1c90 [ 983.957852][T19161] ? finish_task_switch+0x162/0x940 [ 983.957874][T19161] ? __pfx_rtnl_newlink+0x10/0x10 [ 983.957892][T19161] ? finish_task_switch+0x23d/0x940 [ 983.957920][T19161] ? lockdep_hardirqs_on+0x7b/0x110 [ 983.957941][T19161] ? finish_task_switch+0x23d/0x940 [ 983.957969][T19161] ? rcu_is_watching+0x15/0xb0 [ 983.957992][T19161] ? trace_sched_exit_tp+0x36/0xf0 [ 983.958020][T19161] ? __schedule+0x14b1/0x4fd0 [ 983.958061][T19161] ? __pfx___schedule+0x10/0x10 [ 983.958087][T19161] ? __lock_acquire+0x6b6/0x2cf0 [ 983.958108][T19161] ? preempt_schedule_common+0x83/0xd0 [ 983.958131][T19161] ? __dev_queue_xmit+0x289/0x31c0 [ 983.958156][T19161] ? preempt_schedule_thunk+0x16/0x30 [ 983.958169][T19161] ? __local_bh_enable_ip+0xe1/0x130 [ 983.958186][T19161] ? __dev_queue_xmit+0x289/0x31c0 [ 983.958217][T19161] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 983.958252][T19161] ? __pfx_rtnl_newlink+0x10/0x10 [ 983.958279][T19161] rtnetlink_rcv_msg+0x7cf/0xb70 [ 983.958302][T19161] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 983.958313][T19161] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 983.958323][T19161] ? ref_tracker_free+0x63a/0x7d0 [ 983.958338][T19161] ? __asan_memcpy+0x40/0x70 [ 983.958367][T19161] netlink_rcv_skb+0x208/0x470 [ 983.958394][T19161] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 983.958417][T19161] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 983.958443][T19161] netlink_unicast+0x82f/0x9e0 [ 983.958460][T19161] ? __pfx_netlink_unicast+0x10/0x10 [ 983.958471][T19161] ? __alloc_skb+0x198/0x3a0 [ 983.958484][T19161] ? netlink_sendmsg+0x642/0xb30 [ 983.958506][T19161] ? skb_put+0x11b/0x210 [ 983.958531][T19161] netlink_sendmsg+0x805/0xb30 [ 983.958566][T19161] ? __pfx_netlink_sendmsg+0x10/0x10 [ 983.958583][T19161] ? aa_sock_msg_perm+0xf1/0x1b0 [ 983.958598][T19161] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 983.958608][T19161] ? __pfx_netlink_sendmsg+0x10/0x10 [ 983.958621][T19161] __sock_sendmsg+0x21c/0x270 [ 983.958647][T19161] ____sys_sendmsg+0x505/0x820 [ 983.958676][T19161] ? __pfx_____sys_sendmsg+0x10/0x10 [ 983.958709][T19161] ? import_iovec+0x74/0xa0 [ 983.958727][T19161] ___sys_sendmsg+0x21f/0x2a0 [ 983.958741][T19161] ? __pfx____sys_sendmsg+0x10/0x10 [ 983.958770][T19161] ? __fget_files+0x2a/0x420 [ 983.958790][T19161] ? __fget_files+0x3a0/0x420 [ 983.958824][T19161] __x64_sys_sendmsg+0x19b/0x260 [ 983.958851][T19161] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 983.958875][T19161] ? __pfx_ksys_write+0x10/0x10 [ 983.958891][T19161] do_syscall_64+0xec/0xf80 [ 983.958902][T19161] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 983.958912][T19161] ? trace_irq_disable+0x37/0x100 [ 983.958926][T19161] ? clear_bhb_loop+0x60/0xb0 [ 983.958949][T19161] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 983.958969][T19161] RIP: 0033:0x7f4f2938f749 [ 983.958987][T19161] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 983.959005][T19161] RSP: 002b:00007f4f2a2b4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 983.959021][T19161] RAX: ffffffffffffffda RBX: 00007f4f295e5fa0 RCX: 00007f4f2938f749 [ 983.959029][T19161] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 983.959037][T19161] RBP: 00007f4f2a2b4090 R08: 0000000000000000 R09: 0000000000000000 [ 983.959049][T19161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 983.959060][T19161] R13: 00007f4f295e6038 R14: 00007f4f295e5fa0 R15: 00007f4f2970fa28 [ 983.959091][T19161] [ 984.553365][T19161] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 984.757527][ T7599] sony 0003:054C:024B.0052: unknown main item tag 0x0 [ 984.765159][T19165] fuse: Bad value for 'fd' [ 984.778030][ T7599] sony 0003:054C:024B.0052: unknown main item tag 0x0 [ 984.801874][ T7599] sony 0003:054C:024B.0052: unexpected long global item [ 984.832459][ T7599] sony 0003:054C:024B.0052: parse failed [ 984.838245][ T7599] sony 0003:054C:024B.0052: probe with driver sony failed with error -22 [ 984.851791][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 984.957202][T19154] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 984.976024][T19154] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 985.055332][ T7599] usb 2-1: USB disconnect, device number 62 [ 985.128220][T19183] netlink: 63 bytes leftover after parsing attributes in process `syz.1.3822'. [ 985.221871][ T5827] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 985.411831][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 985.413949][ T5827] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 985.433723][ T5827] usb 5-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 985.453542][ T5827] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 985.470398][ T5827] usb 5-1: config 0 descriptor?? [ 985.471846][ T7599] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 985.642001][ T7599] usb 2-1: Using ep0 maxpacket: 32 [ 985.651220][ T7599] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 985.676675][ T7599] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 985.699006][ T24] usb 5-1: USB disconnect, device number 54 [ 985.712143][ T7599] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 985.729402][ T7599] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 985.757225][ T7599] usb 2-1: config 0 descriptor?? [ 985.777486][ T7599] hub 2-1:0.0: USB hub found [ 985.891822][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 985.981885][ T7599] hub 2-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 986.404267][ T7599] hid-generic 0003:046D:C31C.0053: unknown main item tag 0x0 [ 986.415306][ T5895] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 986.435954][T19203] fuse: Bad value for 'fd' [ 986.471919][ T7599] hid-generic 0003:046D:C31C.0053: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.1-1/input0 [ 986.584521][T19209] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 986.592269][T19209] IPv6: NLM_F_CREATE should be set when creating new route [ 986.600100][ T5895] usb 3-1: Using ep0 maxpacket: 16 [ 986.626042][ T5895] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 986.638303][ T5895] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 986.658942][T19209] syzkaller0: entered promiscuous mode [ 986.666137][T19209] syzkaller0: entered allmulticast mode [ 986.674971][ T5895] usb 3-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 986.691577][ T5895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 986.699894][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 986.708711][ T5895] usb 3-1: Product: syz [ 986.739026][ T5895] usb 3-1: Manufacturer: syz [ 986.744338][ T7599] usb 2-1: USB disconnect, device number 63 [ 986.781458][ T5895] usb 3-1: SerialNumber: syz [ 986.807577][ T5895] usb 3-1: config 0 descriptor?? [ 986.941811][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 987.081760][ T5895] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 987.261716][ T5895] usb 2-1: Using ep0 maxpacket: 32 [ 987.287589][ T5895] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 987.328965][ T5895] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 987.342166][ T5895] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 987.351336][ T5895] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 987.369912][ T5895] usb 2-1: config 0 descriptor?? [ 987.400777][ T5895] hub 2-1:0.0: USB hub found [ 987.600694][ T5895] hub 2-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 987.808178][ T5895] usbhid 2-1:0.0: can't add hid device: -71 [ 987.814976][ T5895] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 987.832106][ T5827] usb 5-1: new full-speed USB device number 55 using dummy_hcd [ 987.856721][ T5895] usb 2-1: USB disconnect, device number 64 [ 987.973579][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 988.012368][ T5827] usb 5-1: too many configurations: 128, using maximum allowed: 8 [ 988.041874][ T5827] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 988.049484][ T5827] usb 5-1: can't read configurations, error -61 [ 988.181881][ T5827] usb 5-1: new full-speed USB device number 56 using dummy_hcd [ 988.251221][T19246] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3842'. [ 988.343686][ T5827] usb 5-1: too many configurations: 128, using maximum allowed: 8 [ 988.362826][ T5827] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 988.370450][ T5827] usb 5-1: can't read configurations, error -61 [ 988.377839][ T5827] usb usb5-port1: attempt power cycle [ 988.536832][T19256] syzkaller1: entered promiscuous mode [ 988.551915][T19256] syzkaller1: entered allmulticast mode [ 988.582223][T19260] program syz.1.3846 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 988.633822][T19261] program syz.1.3846 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 988.732121][ T5827] usb 5-1: new full-speed USB device number 57 using dummy_hcd [ 988.762979][ T5827] usb 5-1: too many configurations: 128, using maximum allowed: 8 [ 988.793784][ T5827] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 988.811758][ T5827] usb 5-1: can't read configurations, error -61 [ 988.951943][ T5827] usb 5-1: new full-speed USB device number 58 using dummy_hcd [ 989.002945][ T5827] usb 5-1: too many configurations: 128, using maximum allowed: 8 [ 989.011795][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 989.032455][ T5827] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 989.040063][ T5827] usb 5-1: can't read configurations, error -61 [ 989.048715][ T5827] usb usb5-port1: unable to enumerate USB device [ 989.190516][ T5895] usb 3-1: USB disconnect, device number 82 [ 989.191840][ T5827] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 989.361765][ T5827] usb 2-1: Using ep0 maxpacket: 16 [ 989.377750][ T5827] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 989.386961][ T5827] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 989.395363][ T5827] usb 2-1: Product: syz [ 989.399517][ T5827] usb 2-1: Manufacturer: syz [ 989.404314][ T5827] usb 2-1: SerialNumber: syz [ 989.423212][ T5827] r8152-cfgselector 2-1: Unknown version 0x0000 [ 989.435636][ T5827] r8152-cfgselector 2-1: config 0 descriptor?? [ 989.855076][T19268] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 989.863901][T19268] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 989.874867][ T5827] r8152-cfgselector 2-1: Unknown version 0x0000 [ 989.885966][ T5827] r8152-cfgselector 2-1: bad CDC descriptors [ 989.896381][ T5827] r8152-cfgselector 2-1: USB disconnect, device number 65 [ 990.051817][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 990.135975][T19284] program syz.3.3853 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 990.147527][T19284] program syz.3.3853 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 990.222686][T19285] misc userio: No port type given on /dev/userio [ 990.230674][T19285] misc userio: The device must be registered before sending interrupts [ 990.444360][T19282] loop2: detected capacity change from 0 to 7 [ 990.459905][T19282] Dev loop2: unable to read RDB block 7 [ 990.469983][T19282] loop2: AHDI p1 p2 p3 [ 990.475934][T19282] loop2: partition table partially beyond EOD, truncated [ 990.485568][T19282] loop2: p1 start 1601398130 is beyond EOD, truncated [ 990.492679][T19282] loop2: p2 start 1702059890 is beyond EOD, truncated [ 991.091798][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 991.352954][ T5827] usb 5-1: new full-speed USB device number 59 using dummy_hcd [ 991.522465][ T5827] usb 5-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 991.541755][ T5827] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 991.569371][ T5827] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 991.596636][ T5827] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 991.628517][ T5827] usb 5-1: Product: syz [ 991.661687][ T5827] usb 5-1: Manufacturer: syz [ 991.666341][ T5827] usb 5-1: SerialNumber: syz [ 992.131823][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 993.036412][T19314] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3862'. [ 993.094953][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.102230][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.140498][T19318] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 993.171901][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 993.881996][ T5827] usb 5-1: 0:2 : does not exist [ 993.942834][ T5827] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 993.997616][T19337] FAULT_INJECTION: forcing a failure. [ 993.997616][T19337] name failslab, interval 1, probability 0, space 0, times 0 [ 994.033223][ T5827] usb 5-1: USB disconnect, device number 59 [ 994.069169][T19337] CPU: 0 UID: 0 PID: 19337 Comm: syz.4.3869 Tainted: G L syzkaller #0 PREEMPT(full) [ 994.069202][T19337] Tainted: [L]=SOFTLOCKUP [ 994.069210][T19337] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 994.069224][T19337] Call Trace: [ 994.069240][T19337] [ 994.069250][T19337] dump_stack_lvl+0xe8/0x150 [ 994.069284][T19337] should_fail_ex+0x414/0x560 [ 994.069318][T19337] should_failslab+0xa8/0x100 [ 994.069344][T19337] kmem_cache_alloc_noprof+0x88/0x710 [ 994.069370][T19337] ? __netlink_lookup+0xbd/0x8a0 [ 994.069396][T19337] ? skb_clone+0x212/0x3a0 [ 994.069425][T19337] skb_clone+0x212/0x3a0 [ 994.069453][T19337] __netlink_deliver_tap+0x404/0x850 [ 994.069489][T19337] ? netlink_deliver_tap+0x2e/0x1b0 [ 994.069516][T19337] netlink_deliver_tap+0x19c/0x1b0 [ 994.069542][T19337] netlink_unicast+0x7fa/0x9e0 [ 994.069573][T19337] ? __pfx_netlink_unicast+0x10/0x10 [ 994.069594][T19337] ? __alloc_skb+0x198/0x3a0 [ 994.069615][T19337] ? netlink_sendmsg+0x642/0xb30 [ 994.069639][T19337] ? skb_put+0x11b/0x210 [ 994.069663][T19337] netlink_sendmsg+0x805/0xb30 [ 994.069696][T19337] ? __pfx_netlink_sendmsg+0x10/0x10 [ 994.069725][T19337] ? aa_sock_msg_perm+0xf1/0x1b0 [ 994.069752][T19337] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 994.069773][T19337] ? __pfx_netlink_sendmsg+0x10/0x10 [ 994.069799][T19337] __sock_sendmsg+0x21c/0x270 [ 994.069830][T19337] ____sys_sendmsg+0x505/0x820 [ 994.069859][T19337] ? __pfx_____sys_sendmsg+0x10/0x10 [ 994.069891][T19337] ? import_iovec+0x74/0xa0 [ 994.069919][T19337] ___sys_sendmsg+0x21f/0x2a0 [ 994.069945][T19337] ? __pfx____sys_sendmsg+0x10/0x10 [ 994.070001][T19337] ? __fget_files+0x2a/0x420 [ 994.070024][T19337] ? __fget_files+0x3a0/0x420 [ 994.070059][T19337] __x64_sys_sendmsg+0x19b/0x260 [ 994.070085][T19337] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 994.070119][T19337] ? __pfx_ksys_write+0x10/0x10 [ 994.070152][T19337] do_syscall_64+0xec/0xf80 [ 994.070174][T19337] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 994.070193][T19337] ? trace_irq_disable+0x37/0x100 [ 994.070218][T19337] ? clear_bhb_loop+0x60/0xb0 [ 994.070250][T19337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 994.070270][T19337] RIP: 0033:0x7f4f2938f749 [ 994.070287][T19337] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 994.070304][T19337] RSP: 002b:00007f4f2a2b4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 994.070325][T19337] RAX: ffffffffffffffda RBX: 00007f4f295e5fa0 RCX: 00007f4f2938f749 [ 994.070342][T19337] RDX: 0000000004008000 RSI: 0000200000000000 RDI: 0000000000000003 [ 994.070355][T19337] RBP: 00007f4f2a2b4090 R08: 0000000000000000 R09: 0000000000000000 [ 994.070369][T19337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 994.070381][T19337] R13: 00007f4f295e6038 R14: 00007f4f295e5fa0 R15: 00007f4f2970fa28 [ 994.070413][T19337] [ 994.110216][ T5835] udevd[5835]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 994.112991][T19337] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3869'. [ 994.216578][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 995.261788][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 995.702257][T19359] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3875'. [ 995.904888][T19362] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3875'. [ 996.182030][ T24] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 996.301791][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 996.512879][ T24] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 996.529553][ T24] usb 3-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 996.560000][ T24] usb 3-1: config 0 has no interface number 0 [ 996.587777][ T24] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 996.620884][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 996.644006][ T24] usb 3-1: Product: syz [ 996.648200][ T24] usb 3-1: Manufacturer: syz [ 996.668372][ T24] usb 3-1: SerialNumber: syz [ 996.687581][ T24] usb 3-1: config 0 descriptor?? [ 996.921803][ T5827] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 997.081726][ T5827] usb 2-1: Using ep0 maxpacket: 32 [ 997.188998][ T5827] usb 2-1: unable to get BOS descriptor or descriptor too short [ 997.216275][ T5827] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 997.226578][ T5827] usb 2-1: can't read configurations, error -71 [ 997.236985][T19382] program syz.4.3882 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 997.328874][ T24] uvcvideo 3-1:0.64: Found UVC 0.00 device syz (046d:0823) [ 997.337160][ T24] uvcvideo 3-1:0.64: No valid video chain found. [ 997.341828][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 997.436777][ T24] usb 3-1: USB disconnect, device number 83 [ 998.329762][T19414] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3895'. [ 998.361732][T17912] usb 3-1: new low-speed USB device number 84 using dummy_hcd [ 998.371738][ T5827] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 998.371792][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 998.541919][T17912] usb 3-1: Invalid ep0 maxpacket: 16 [ 998.543618][ T5827] usb 2-1: config index 0 descriptor too short (expected 36, got 26) [ 998.561936][ T5827] usb 2-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 998.591124][ T5827] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 196, using maximum allowed: 30 [ 998.647127][ T5827] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 196 [ 998.672619][ T5827] usb 2-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.00 [ 998.682203][T17912] usb 3-1: new low-speed USB device number 85 using dummy_hcd [ 998.709364][T19424] netlink: 'syz.3.3897': attribute type 4 has an invalid length. [ 998.719724][ T5827] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 998.747101][ T5827] usb 2-1: config 0 descriptor?? [ 998.765566][ T5827] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 998.851748][T17912] usb 3-1: Invalid ep0 maxpacket: 16 [ 998.858371][T17912] usb usb3-port1: attempt power cycle [ 998.974936][ T7599] usb 2-1: USB disconnect, device number 68 [ 999.203186][T17912] usb 3-1: new low-speed USB device number 86 using dummy_hcd [ 999.222701][T17912] usb 3-1: Invalid ep0 maxpacket: 16 [ 999.352374][T17912] usb 3-1: new low-speed USB device number 87 using dummy_hcd [ 999.372594][T17912] usb 3-1: Invalid ep0 maxpacket: 16 [ 999.378374][T17912] usb usb3-port1: unable to enumerate USB device [ 999.411801][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 999.598208][T19438] QAT: Device 0 not found [ 999.641804][ T5827] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 999.751755][ T24] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 999.898949][T19433] fuse: Bad value for 'fd' [ 999.923952][ T24] usb 4-1: config 6 has an invalid interface number: 108 but max is 0 [ 999.932279][ T24] usb 4-1: config 6 has no interface number 0 [ 999.938583][ T24] usb 4-1: config 6 interface 108 has no altsetting 0 [ 999.947567][ T24] usb 4-1: New USB device found, idVendor=0856, idProduct=ac30, bcdDevice=d2.1d [ 999.956769][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 999.964921][ T24] usb 4-1: Product: syz [ 999.969118][ T24] usb 4-1: Manufacturer: syz [ 999.973921][ T24] usb 4-1: SerialNumber: syz [ 1000.187467][T19435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1000.196360][T19435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1000.213467][T19435] syzkaller1: entered promiscuous mode [ 1000.219111][T19435] syzkaller1: entered allmulticast mode [ 1000.236470][T19435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1000.245245][T19435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1000.451828][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1000.553969][ T24] mos7840 4-1:6.108: missing endpoints [ 1000.578451][ T24] usb 4-1: USB disconnect, device number 64 [ 1000.772150][T18098] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 1000.931939][T18098] usb 2-1: Using ep0 maxpacket: 16 [ 1000.942464][T18098] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1000.952968][T18098] usb 2-1: config 0 has no interface number 0 [ 1000.964263][T18098] usb 2-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1000.975954][T18098] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1000.987683][T18098] usb 2-1: Product: syz [ 1000.994191][T18098] usb 2-1: Manufacturer: syz [ 1001.001109][T18098] usb 2-1: SerialNumber: syz [ 1001.014942][T18098] usb 2-1: config 0 descriptor?? [ 1001.029474][T18098] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 1001.179442][T19453] netlink: 180 bytes leftover after parsing attributes in process `syz.2.3908'. [ 1001.189501][T19453] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3908'. [ 1001.361855][T17912] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 1001.444232][T19443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1001.463244][T19443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1001.491800][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1001.531771][T17912] usb 4-1: Using ep0 maxpacket: 16 [ 1001.541304][T17912] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1001.556317][T17912] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1001.567286][T17912] usb 4-1: Product: syz [ 1001.571493][T17912] usb 4-1: Manufacturer: syz [ 1001.576286][T17912] usb 4-1: SerialNumber: syz [ 1001.582817][ T7599] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 1001.596078][T17912] r8152-cfgselector 4-1: Unknown version 0x0000 [ 1001.605286][T17912] r8152-cfgselector 4-1: config 0 descriptor?? [ 1001.761726][ T7599] usb 3-1: Using ep0 maxpacket: 8 [ 1001.776288][ T7599] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1001.797377][ T7599] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1001.819013][ T7599] usb 3-1: Product: syz [ 1001.826076][T17912] r8152-cfgselector 4-1: Needed 1 retries to read version [ 1001.835879][ T7599] usb 3-1: Manufacturer: syz [ 1001.848279][ T7599] usb 3-1: SerialNumber: syz [ 1001.866663][ T7599] usb 3-1: config 0 descriptor?? [ 1002.046599][T19451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1002.069186][T19451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1002.075770][ T7599] usb 3-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 1002.097833][ T6176] r8152-cfgselector 4-1: USB disconnect, device number 65 [ 1002.521134][ T5827] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1002.531795][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1002.543768][ T5827] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1002.562106][ T5827] usb 5-1: can't read configurations, error -71 [ 1002.603507][ T7599] usb write operation failed. (-71) [ 1002.615674][ T7599] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1002.628229][ T7599] dvbdev: DVB: registering new adapter (Terratec H7) [ 1002.636004][ T7599] usb 3-1: media controller created [ 1002.641889][ T7599] usb read operation failed. (-71) [ 1002.647473][ T7599] usb write operation failed. (-71) [ 1002.657422][ T7599] dvb_usb_az6007 3-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 1002.669656][ T7599] usb 3-1: USB disconnect, device number 88 [ 1002.690017][T18098] gspca_spca1528: reg_r err -71 [ 1002.704543][T18098] spca1528 2-1:0.1: probe with driver spca1528 failed with error -71 [ 1002.732496][T19475] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3916'. [ 1002.741399][T19475] bond0: option packets_per_slave: mode dependency failed, not supported in mode balance-tlb(5) [ 1002.752157][T18098] usb 2-1: USB disconnect, device number 69 [ 1002.913599][ T5827] usb 5-1: new low-speed USB device number 61 using dummy_hcd [ 1002.971754][ T7599] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 1003.073699][ T5827] usb 5-1: config 0 has an invalid interface number: 3 but max is 0 [ 1003.081837][ T5827] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1003.093608][ T5827] usb 5-1: config 0 has no interface number 0 [ 1003.101278][ T5827] usb 5-1: config 0 interface 3 altsetting 0 endpoint 0x6 has invalid maxpacket 64, setting to 8 [ 1003.114314][ T5827] usb 5-1: config 0 interface 3 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1003.132097][ T5827] usb 5-1: config 0 interface 3 altsetting 0 endpoint 0x8 has invalid maxpacket 1024, setting to 8 [ 1003.143567][ T5827] usb 5-1: config 0 interface 3 altsetting 0 endpoint 0x4 has invalid maxpacket 1023, setting to 8 [ 1003.154557][ T5827] usb 5-1: config 0 interface 3 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 1003.171852][ T7599] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 1003.171895][ T5827] usb 5-1: New USB device found, idVendor=1199, idProduct=6821, bcdDevice=98.59 [ 1003.189132][ T7599] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1003.189299][ T5827] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1003.229861][ T7599] usb 3-1: config 0 has no interface number 0 [ 1003.245219][ T5827] usb 5-1: config 0 descriptor?? [ 1003.257245][ T7599] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice= 0.07 [ 1003.272573][T19473] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1003.291705][ T7599] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1003.298345][ T5827] hub 5-1:0.3: bad descriptor, ignoring hub [ 1003.311749][ T7599] usb 3-1: Product: syz [ 1003.312890][ T5827] hub 5-1:0.3: probe with driver hub failed with error -5 [ 1003.323130][ T7599] usb 3-1: Manufacturer: syz [ 1003.323152][ T7599] usb 3-1: SerialNumber: syz [ 1003.342807][ T7599] usb 3-1: config 0 descriptor?? [ 1003.350118][ T5827] sierra 5-1:0.3: Sierra USB modem converter detected [ 1003.581798][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1003.627330][ T7599] uvcvideo 3-1:0.64: Found UVC 0.00 device syz (046d:0823) [ 1003.642296][ T7599] uvcvideo 3-1:0.64: No valid video chain found. [ 1003.666764][ T7599] usb 3-1: USB disconnect, device number 89 [ 1004.044555][ T5827] usb 5-1: Sierra USB modem converter now attached to ttyUSB0 [ 1004.139027][ T5827] usb 5-1: USB disconnect, device number 61 [ 1004.184516][ T5827] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 1004.226635][ T5827] sierra 5-1:0.3: device disconnected [ 1004.606846][T19508] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3925'. [ 1004.621857][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1004.651472][T19508] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3925'. [ 1004.863912][T19514] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3927'. [ 1004.895982][T19514] bond0: option packets_per_slave: invalid value (6815744) [ 1004.916624][T19514] bond0: option packets_per_slave: allowed values 0 - 65535 [ 1005.052144][T17912] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 1005.200604][T19517] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3929'. [ 1005.247779][T17912] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1005.286838][T17912] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 1005.322044][T17912] usb 4-1: can't read configurations, error -71 [ 1005.651816][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1006.136248][T19536] tipc: Enabling of bearer rejected, failed to enable media [ 1006.691877][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1007.204923][T19551] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3939'. [ 1007.222021][T19551] bond0: option packets_per_slave: invalid value (6815744) [ 1007.229363][T19551] bond0: option packets_per_slave: allowed values 0 - 65535 [ 1007.487270][T19559] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3940'. [ 1007.517701][T19559] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3940'. [ 1007.721972][ T5895] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 1007.741801][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1007.891747][ T5895] usb 2-1: Using ep0 maxpacket: 32 [ 1007.900142][ T5895] usb 2-1: New USB device found, idVendor=0483, idProduct=1234, bcdDevice=52.85 [ 1007.909568][ T5895] usb 2-1: New USB device strings: Mfr=1, Product=0, SerialNumber=0 [ 1007.919821][ T5895] usb 2-1: Manufacturer: syz [ 1007.940871][ T5895] usb 2-1: config 0 descriptor?? [ 1007.969024][ T5895] usb_8dev 2-1:0.0 can0: sending command message failed [ 1007.984416][ T5895] usb_8dev 2-1:0.0 can0: can't get firmware version [ 1008.043729][ T5895] usb_8dev 2-1:0.0: probe with driver usb_8dev failed with error -22 [ 1008.179177][ T5895] usb 2-1: USB disconnect, device number 70 [ 1008.671920][T19570] netlink: 14 bytes leftover after parsing attributes in process `syz.3.3944'. [ 1008.771812][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1009.021791][ T5827] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 1009.171935][ T5827] usb 2-1: Using ep0 maxpacket: 32 [ 1009.186606][ T5827] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1009.222163][ T5827] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1009.264241][ T6176] usb 3-1: new full-speed USB device number 90 using dummy_hcd [ 1009.283460][ T5827] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1009.305939][ T5827] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1009.342329][ T5827] usb 2-1: config 0 descriptor?? [ 1009.383912][ T5827] hub 2-1:0.0: USB hub found [ 1009.392436][T19587] tipc: Enabling of bearer rejected, failed to enable media [ 1009.444148][ T6176] usb 3-1: config 255 has too many interfaces: 223, using maximum allowed: 32 [ 1009.491430][ T6176] usb 3-1: config 255 has 0 interfaces, different from the descriptor's value: 223 [ 1009.565488][ T6176] usb 3-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 1009.591185][ T5827] hub 2-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 1009.605310][ T6176] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1009.630577][ T6176] usb 3-1: Product: syz [ 1009.655534][ T6176] usb 3-1: Manufacturer: syz [ 1009.677292][ T6176] usb 3-1: SerialNumber: syz [ 1009.691734][ T5895] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 1009.811816][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1009.871723][ T5895] usb 5-1: Using ep0 maxpacket: 32 [ 1009.885546][ T5895] usb 5-1: config 0 has an invalid interface number: 196 but max is 0 [ 1009.894252][ T5895] usb 5-1: config 0 has no interface number 0 [ 1009.900371][ T5895] usb 5-1: config 0 interface 196 has no altsetting 0 [ 1009.921008][ T5895] usb 5-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 1009.930843][ T5895] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1009.982136][ T5895] usb 5-1: Product: syz [ 1009.982389][ T6176] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 1010.005559][ T5895] usb 5-1: Manufacturer: syz [ 1010.012650][ T5895] usb 5-1: SerialNumber: syz [ 1010.021309][ T5827] hid-generic 0003:046D:C31C.0054: unknown main item tag 0x0 [ 1010.042383][ T5827] hid-generic 0003:046D:C31C.0054: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.1-1/input0 [ 1010.073655][ T5895] usb 5-1: config 0 descriptor?? [ 1010.172840][ T6176] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1010.208220][ T6176] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1010.248364][ T6176] usb 4-1: Product: syz [ 1010.261702][ T6176] usb 4-1: Manufacturer: syz [ 1010.283482][ T6176] usb 4-1: SerialNumber: syz [ 1010.317111][ T6176] usb 4-1: config 0 descriptor?? [ 1010.333302][T17912] usb 2-1: USB disconnect, device number 71 [ 1010.586717][ T7599] usb 3-1: USB disconnect, device number 90 [ 1010.692193][T17912] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 1010.851796][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1010.858870][T17912] usb 2-1: Using ep0 maxpacket: 32 [ 1010.868442][T17912] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1010.892385][T17912] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1010.904124][T17912] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1010.913560][T17912] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1010.924354][T17912] usb 2-1: config 0 descriptor?? [ 1010.935011][T17912] hub 2-1:0.0: USB hub found [ 1010.954840][ T6176] usb 4-1: Firmware version (0.0) predates our first public release. [ 1010.964789][ T6176] usb 4-1: Please update to version 0.2 or newer [ 1011.025669][ T6176] usb 4-1: USB disconnect, device number 68 [ 1011.149523][T17912] hub 2-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 1011.353417][T17912] usbhid 2-1:0.0: can't add hid device: -71 [ 1011.359527][T17912] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1011.382965][T19603] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3954'. [ 1011.403387][T19603] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3954'. [ 1011.413375][T17912] usb 2-1: USB disconnect, device number 72 [ 1011.791725][ T6176] usb 4-1: new full-speed USB device number 69 using dummy_hcd [ 1011.891807][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1011.955769][ T6176] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1011.965723][ T6176] usb 4-1: config 0 has no interface number 0 [ 1011.973346][ T6176] usb 4-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 1011.982616][ T6176] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1011.995621][ T6176] usb 4-1: config 0 descriptor?? [ 1012.013506][ T6176] usb 4-1: selecting invalid altsetting 1 [ 1012.022168][ T6176] dvb_ttusb_budget: ttusb_init_controller: error [ 1012.029086][ T6176] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 1012.135419][ T6176] DVB: Unable to find symbol cx22700_attach() [ 1012.172972][T17912] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 1012.176959][ T6176] DVB: Unable to find symbol tda10046_attach() [ 1012.188546][ T6176] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 1012.230081][ T6176] usb 4-1: USB disconnect, device number 69 [ 1012.351867][T17912] usb 2-1: Using ep0 maxpacket: 16 [ 1012.359553][T17912] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1012.382965][T17912] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1012.397814][T17912] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1012.415780][T17912] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1012.429254][T17912] usb 2-1: Product: syz [ 1012.433539][T17912] usb 2-1: Manufacturer: syz [ 1012.439663][T17912] usb 2-1: SerialNumber: syz [ 1012.450878][T17912] usb 2-1: config 0 descriptor?? [ 1012.486789][ T5895] ipheth 5-1:0.196: Unable to find endpoints [ 1012.493589][T17912] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1012.508767][ T5895] usb 5-1: USB disconnect, device number 62 [ 1012.515435][T17912] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 1012.681742][ T7599] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 1012.831701][ T7599] usb 3-1: Using ep0 maxpacket: 16 [ 1012.854201][ T7599] usb 3-1: config 253 has an invalid interface number: 184 but max is 0 [ 1012.867842][ T7599] usb 3-1: config 253 has no interface number 0 [ 1012.877940][ T7599] usb 3-1: config 253 interface 184 has no altsetting 0 [ 1012.878343][T19625] netlink: 144 bytes leftover after parsing attributes in process `syz.3.3961'. [ 1012.889254][ T7599] usb 3-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.00 [ 1012.898790][T19621] netlink: 'syz.3.3961': attribute type 4 has an invalid length. [ 1012.912109][T19621] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3961'. [ 1012.915510][ T7599] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1012.931574][ T7599] usb 3-1: Product: syz [ 1012.935998][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1012.944149][ T7599] usb 3-1: Manufacturer: syz [ 1012.948798][ T7599] usb 3-1: SerialNumber: syz [ 1012.962149][ T7599] go7007 3-1:253.184: probe with driver go7007 failed with error -12 [ 1013.069389][T17912] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 1013.076271][T17912] em28xx 2-1:0.0: Config register raw data: 0x2d [ 1013.082773][T17912] em28xx 2-1:0.0: I2S Audio (1 sample rate(s)) [ 1013.088947][T17912] em28xx 2-1:0.0: No AC97 audio processor [ 1013.173557][T19614] syzkaller0: entered promiscuous mode [ 1013.179148][T19614] syzkaller0: entered allmulticast mode [ 1013.353378][ T7599] usb 3-1: USB disconnect, device number 91 [ 1013.731349][ T7341] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1013.742050][ T7341] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1013.750777][ T7341] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1013.758805][ T7341] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1013.766656][ T7341] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1013.821335][ T5829] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1013.832870][ T5829] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1013.848443][ T5829] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1013.859738][ T5829] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1013.870158][ T5829] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1013.904453][ T6176] usb 2-1: USB disconnect, device number 73 [ 1013.981801][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1014.311850][T17912] usb 4-1: new full-speed USB device number 70 using dummy_hcd [ 1014.341333][T19630] chnl_net:caif_netlink_parms(): no params data found [ 1014.476680][T17912] usb 4-1: config 255 has too many interfaces: 223, using maximum allowed: 32 [ 1014.502660][T17912] usb 4-1: config 255 has 0 interfaces, different from the descriptor's value: 223 [ 1014.514879][T17912] usb 4-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 1014.529449][T17912] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1014.561737][T17912] usb 4-1: Product: syz [ 1014.566012][T17912] usb 4-1: Manufacturer: syz [ 1014.570608][T17912] usb 4-1: SerialNumber: syz [ 1014.626208][T19646] tipc: Enabling of bearer rejected, already enabled [ 1014.663541][T19630] bridge0: port 1(bridge_slave_0) entered blocking state [ 1014.681075][T19630] bridge0: port 1(bridge_slave_0) entered disabled state [ 1014.690500][T19630] bridge_slave_0: entered allmulticast mode [ 1014.699525][T19652] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3967'. [ 1014.710532][T19630] bridge_slave_0: entered promiscuous mode [ 1014.718203][T19652] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3967'. [ 1014.729893][T19630] bridge0: port 2(bridge_slave_1) entered blocking state [ 1014.746041][T19630] bridge0: port 2(bridge_slave_1) entered disabled state [ 1014.762575][T19630] bridge_slave_1: entered allmulticast mode [ 1014.784984][T19630] bridge_slave_1: entered promiscuous mode [ 1015.011811][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1015.076078][ T5941] bridge_slave_1: left allmulticast mode [ 1015.088560][ T5941] bridge_slave_1: left promiscuous mode [ 1015.106752][ T5941] bridge0: port 2(bridge_slave_1) entered disabled state [ 1015.120377][ T5827] usb 4-1: USB disconnect, device number 70 [ 1015.144790][ T5941] bridge_slave_0: left allmulticast mode [ 1015.150601][ T5941] bridge_slave_0: left promiscuous mode [ 1015.156856][ T5941] bridge0: port 1(bridge_slave_0) entered disabled state [ 1015.824029][ T5941] batman_adv: batadv0: Removing interface: vxlan0 [ 1015.892948][ T5829] Bluetooth: hci5: command tx timeout [ 1015.908347][ T5941] bond1 (unregistering): Released all slaves [ 1016.061239][ T5941] bond2 (unregistering): Released all slaves [ 1016.061829][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1016.111846][ T7599] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 1016.207131][ T5941] bond3 (unregistering): Released all slaves [ 1016.301947][ T7599] usb 3-1: Using ep0 maxpacket: 8 [ 1016.309390][ T7599] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 1016.336862][ T7599] usb 3-1: config 0 has no interface number 0 [ 1016.344718][ T7599] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1016.365783][ T7599] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1016.389318][ T7599] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1016.421991][ T7599] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1016.445409][ T7599] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1016.467681][ T7599] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1016.488616][ T7599] usb 3-1: config 0 descriptor?? [ 1016.489154][ T5941] bond4 (unregistering): Released all slaves [ 1016.538935][ T7599] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1016.664419][ T5941] bond5 (unregistering): Released all slaves [ 1016.820723][ T5941] bond6 (unregistering): Released all slaves [ 1016.983656][ T5941] bond7 (unregistering): Released all slaves [ 1017.101812][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1017.139540][ T5941] bond8 (unregistering): Released all slaves [ 1017.155074][ T5941] bond9 (unregistering): Released all slaves [ 1017.171340][ T5941] bond10 (unregistering): Released all slaves [ 1017.195202][T19630] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1017.211597][T19630] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1017.279487][T19630] team0: Port device team_slave_0 added [ 1017.297726][T19630] team0: Port device team_slave_1 added [ 1017.323851][ T5941] tipc: Disabling bearer [ 1017.353892][ T5941] tipc: Left network mode [ 1017.460952][T19630] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1017.473634][T19630] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1017.503890][T19630] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1017.546602][T19630] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1017.561818][T19630] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1017.596856][T19630] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1017.789442][T19630] hsr_slave_0: entered promiscuous mode [ 1017.806737][T19630] hsr_slave_1: entered promiscuous mode [ 1017.824240][T19630] debugfs: 'hsr0' already exists in 'hsr' [ 1017.836910][T19630] Cannot create hsr debugfs directory [ 1017.972562][ T5829] Bluetooth: hci5: command tx timeout [ 1018.131787][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1018.237542][ T5941] hsr_slave_0: left promiscuous mode [ 1018.245497][ T5941] hsr_slave_1: left promiscuous mode [ 1018.252939][ T5941] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1018.261905][ T5941] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1018.464171][ T5941] team0 (unregistering): Port device macvlan0 removed [ 1018.701829][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 1018.709698][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 1018.780864][ T6176] usb 3-1: USB disconnect, device number 92 [ 1018.796555][ T6176] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 1018.898067][ T5941] team0 (unregistering): Port device team_slave_1 removed [ 1018.942264][ T5941] team0 (unregistering): Port device team_slave_0 removed [ 1019.182653][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1019.919442][T19630] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1019.931155][T19630] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1019.966199][T19630] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1019.990848][T19630] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1020.052428][ T5829] Bluetooth: hci5: command tx timeout [ 1020.101245][T19630] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1020.125980][T19630] 8021q: adding VLAN 0 to HW filter on device team0 [ 1020.139319][ T5941] bridge0: port 1(bridge_slave_0) entered blocking state [ 1020.146518][ T5941] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1020.161514][ T1141] bridge0: port 2(bridge_slave_1) entered blocking state [ 1020.168769][ T1141] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1020.211856][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1020.268623][T19630] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1020.324475][T19630] veth0_vlan: entered promiscuous mode [ 1020.339796][T19630] veth1_vlan: entered promiscuous mode [ 1020.380352][T19630] veth0_macvtap: entered promiscuous mode [ 1020.391105][T19630] veth1_macvtap: entered promiscuous mode [ 1020.417827][T19630] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1020.435975][T19630] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1020.454701][ T6850] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1020.470983][ T6850] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1020.493986][ T6850] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1020.530911][ T6850] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1020.589680][T10927] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1020.614929][T10927] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1020.651309][T10927] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1020.661127][T10927] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1021.252058][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1022.131910][ T5829] Bluetooth: hci5: command tx timeout [ 1022.291946][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1023.331918][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1024.371877][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1025.411859][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1026.451940][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1027.491906][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1028.531904][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1029.571835][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1030.611889][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1031.651930][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1032.691893][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1033.731855][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1034.771842][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1035.811933][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1036.851931][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1037.432733][ T7341] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1037.447440][ T7341] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1037.457400][ T7341] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1037.469689][ T7341] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1037.477748][ T7341] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1037.891793][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1037.986098][T19764] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3979'. [ 1038.030508][T19764] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3979'. [ 1038.091035][T19768] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3981'. [ 1038.100870][T19764] fuse: Bad value for 'fd' [ 1038.254392][T19770] netlink: 'syz.1.3981': attribute type 10 has an invalid length. [ 1038.283340][T18098] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 1038.296002][T19772] netlink: 'syz.1.3981': attribute type 10 has an invalid length. [ 1038.361266][T19770] team0: Port device dummy0 added [ 1038.376861][T19772] team0: Port device dummy0 removed [ 1038.415666][T19772] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1038.453955][T18098] usb 3-1: config index 0 descriptor too short (expected 20260, got 36) [ 1038.466498][T18098] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 5 [ 1038.495411][T18098] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1038.541221][T18098] usb 3-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 1038.589553][T18098] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1038.610548][T18098] usb 3-1: config 0 descriptor?? [ 1038.706875][ T6850] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1038.774152][T19751] chnl_net:caif_netlink_parms(): no params data found [ 1038.909202][ T6850] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1038.931901][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1039.102534][T19780] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1039.134221][T19780] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1039.168456][T19780] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1039.194937][ T6850] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1039.212186][T19780] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1039.493965][T18098] usb 3-1: string descriptor 0 read error: -71 [ 1039.530002][T19789] batman_adv: batadv0: adding TT local entry ba:e1:05:00:07:00 to non-existent VLAN 1280 [ 1039.541511][T19789] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3985'. [ 1039.545709][ T6850] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1039.562398][T18098] usbhid 3-1:0.0: can't add hid device: -71 [ 1039.568352][T18098] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1039.577747][ T5829] Bluetooth: hci3: command tx timeout [ 1039.598516][T18098] usb 3-1: USB disconnect, device number 93 [ 1039.745147][T19751] bridge0: port 1(bridge_slave_0) entered blocking state [ 1039.762251][T19751] bridge0: port 1(bridge_slave_0) entered disabled state [ 1039.769623][T19751] bridge_slave_0: entered allmulticast mode [ 1039.783214][T19751] bridge_slave_0: entered promiscuous mode [ 1039.792177][T19751] bridge0: port 2(bridge_slave_1) entered blocking state [ 1039.799603][T19751] bridge0: port 2(bridge_slave_1) entered disabled state [ 1039.807316][T19751] bridge_slave_1: entered allmulticast mode [ 1039.815763][T19751] bridge_slave_1: entered promiscuous mode [ 1039.971838][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1039.980568][T19751] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1040.073885][T19751] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1040.481855][T18098] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 1040.711740][T18098] usb 3-1: Using ep0 maxpacket: 16 [ 1040.724272][T18098] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1040.750461][T18098] usb 3-1: config 0 has no interface number 0 [ 1040.784438][T18098] usb 3-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1040.818654][T18098] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1040.837618][T18098] usb 3-1: Product: syz [ 1040.859971][T18098] usb 3-1: Manufacturer: syz [ 1040.876775][T18098] usb 3-1: SerialNumber: syz [ 1040.920820][T18098] usb 3-1: config 0 descriptor?? [ 1040.946404][T18098] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 1041.014005][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1041.651739][ T5829] Bluetooth: hci3: command tx timeout [ 1041.694988][ T6850] team0: Port device bridge1 removed [ 1041.867381][ T6850] bond1 (unregistering): Released all slaves [ 1041.945952][T19832] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3995'. [ 1041.969375][T19832] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3995'. [ 1042.023675][T19832] fuse: Bad value for 'fd' [ 1042.057330][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1042.172269][ T6850] bond2 (unregistering): Released all slaves [ 1042.382662][ T6850] bond3 (unregistering): Released all slaves [ 1042.578987][ T6850] bond4 (unregistering): Released all slaves [ 1042.622959][T18098] gspca_spca1528: reg_r err -71 [ 1042.642739][T18098] spca1528 3-1:0.1: probe with driver spca1528 failed with error -71 [ 1042.663807][T18098] usb 3-1: USB disconnect, device number 94 [ 1042.918152][ T6850] bond5 (unregistering): Released all slaves [ 1043.055031][ T6850] bond6 (unregistering): Released all slaves [ 1043.068830][T19751] team0: Port device team_slave_0 added [ 1043.091788][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1043.109401][T19751] team0: Port device team_slave_1 added [ 1043.254886][ T6850] : left promiscuous mode [ 1043.388225][T19751] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1043.412099][T19751] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1043.489137][T19751] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1043.506829][ T6850] tipc: Left network mode [ 1043.529223][T19751] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1043.565997][T19751] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1043.600751][T19751] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1043.739580][ T5829] Bluetooth: hci3: command tx timeout [ 1043.831556][T19751] hsr_slave_0: entered promiscuous mode [ 1043.850223][T19751] hsr_slave_1: entered promiscuous mode [ 1043.872802][T19751] debugfs: 'hsr0' already exists in 'hsr' [ 1043.885378][T19751] Cannot create hsr debugfs directory [ 1043.932084][T17912] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 1043.992185][T18098] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 1044.104847][T17912] usb 4-1: Using ep0 maxpacket: 8 [ 1044.136668][T17912] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1044.148062][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1044.171502][T18098] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 1044.185341][T17912] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1044.187588][T18098] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1044.206678][T18098] usb 3-1: config 0 has no interface number 0 [ 1044.212050][T17912] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1044.216183][T18098] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 1044.240146][T17912] usb 4-1: New USB device found, idVendor=046d, idProduct=c293, bcdDevice= 0.00 [ 1044.250097][T17912] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1044.260995][T17912] usb 4-1: config 0 descriptor?? [ 1044.292321][T18098] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1044.300368][T18098] usb 3-1: Product: syz [ 1044.305571][T18098] usb 3-1: Manufacturer: syz [ 1044.310199][T18098] usb 3-1: SerialNumber: syz [ 1044.318210][T18098] usb 3-1: config 0 descriptor?? [ 1044.335325][T18098] uvcvideo 3-1:0.64: Found UVC 0.00 device syz (046d:0823) [ 1044.346108][T18098] uvcvideo 3-1:0.64: No valid video chain found. [ 1044.553947][T19857] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1044.553955][ T6850] hsr_slave_0: left promiscuous mode [ 1044.569736][ T6850] hsr_slave_1: left promiscuous mode [ 1044.570214][T19857] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1044.590373][ T6850] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1044.599958][ T7599] usb 3-1: USB disconnect, device number 95 [ 1044.606110][ T6850] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1044.623158][ T6850] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1044.630624][ T6850] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1044.650644][ T6850] veth1_macvtap: left promiscuous mode [ 1044.657674][ T6850] veth0_macvtap: left promiscuous mode [ 1044.663448][ T6850] veth1_vlan: left allmulticast mode [ 1044.668799][ T6850] veth1_vlan: left promiscuous mode [ 1044.674532][ T6850] veth0_vlan: left promiscuous mode [ 1044.724220][T17912] logitech 0003:046D:C293.0055: unknown main item tag 0x0 [ 1044.731400][T17912] logitech 0003:046D:C293.0055: unknown main item tag 0x0 [ 1044.761768][T17912] logitech 0003:046D:C293.0055: unknown main item tag 0x0 [ 1044.769067][T17912] logitech 0003:046D:C293.0055: unknown main item tag 0x0 [ 1044.792495][ T6850] pim6reg (unregistering): left allmulticast mode [ 1044.801420][T17912] logitech 0003:046D:C293.0055: hidraw0: USB HID v0.00 Device [HID 046d:c293] on usb-dummy_hcd.3-1/input0 [ 1044.825061][T17912] logitech 0003:046D:C293.0055: no inputs found [ 1044.928164][T18098] usb 4-1: USB disconnect, device number 71 [ 1044.937038][ T6850] team0 (unregistering): Port device macvlan0 removed [ 1045.179610][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1045.267892][ T6850] team0 (unregistering): Port device team_slave_1 removed [ 1045.310164][ T6850] team0 (unregistering): Port device team_slave_0 removed [ 1045.812331][ T5829] Bluetooth: hci3: command tx timeout [ 1046.066543][T19751] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1046.081390][T19751] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1046.096706][T19751] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1046.108767][T19751] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1046.211844][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1046.243464][T19751] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1046.265082][T19751] 8021q: adding VLAN 0 to HW filter on device team0 [ 1046.278426][ T1141] bridge0: port 1(bridge_slave_0) entered blocking state [ 1046.285698][ T1141] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1046.310569][T17410] bridge0: port 2(bridge_slave_1) entered blocking state [ 1046.317704][T17410] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1046.425631][T19751] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1046.478503][T19751] veth0_vlan: entered promiscuous mode [ 1046.493191][T19751] veth1_vlan: entered promiscuous mode [ 1046.522639][T19751] veth0_macvtap: entered promiscuous mode [ 1046.531209][T19751] veth1_macvtap: entered promiscuous mode [ 1046.548296][T19751] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1046.563478][T19751] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1046.576893][T17410] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1046.587469][T17410] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1046.597000][T17410] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1046.607122][T17410] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1046.679460][ T6850] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1046.694571][ T6850] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1046.718439][ T6850] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1046.727756][ T6850] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1047.251961][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1048.291973][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1049.331844][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1050.371871][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1051.411873][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1052.451869][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1053.491870][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1054.544477][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1054.544654][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.557841][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1055.571889][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1056.611959][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1057.651863][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1058.701902][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1059.731882][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1060.771862][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1061.811833][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1062.851835][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1063.891851][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1064.931886][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1065.971992][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1067.011844][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1068.061894][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1069.091800][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 1069.178360][ T7341] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1069.200709][ T7341] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1069.210021][ T7341] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1069.218498][ T7341] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1069.228816][ T7341] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1069.265898][T19904] bond1: option ad_select: invalid value (253) [ 1069.288977][T19918] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4008'. [ 1069.320822][T19904] bond1 (unregistering): Released all slaves [ 1069.332483][T18098] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 1069.387069][T19918] fuse: Bad value for 'fd' [ 1069.396286][T19915] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4008'. [ 1069.496130][T18098] usb 4-1: Using ep0 maxpacket: 16 [ 1069.520083][T18098] usb 4-1: config 0 has an invalid interface descriptor of length 8, skipping [ 1069.535620][T18098] usb 4-1: config 0 descriptor has 1 excess byte, ignoring [ 1069.635701][T18098] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1069.654010][T18098] usb 4-1: New USB device found, idVendor=17ef, idProduct=720c, bcdDevice=51.90 [ 1069.703321][T18098] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1069.716598][T18098] usb 4-1: Product: syz [ 1069.720955][T18098] usb 4-1: Manufacturer: syz [ 1069.729813][T18098] usb 4-1: SerialNumber: syz [ 1069.746948][T18098] r8152-cfgselector 4-1: Unknown version 0x0000 [ 1069.766597][T18098] r8152-cfgselector 4-1: config 0 descriptor?? [ 1070.002253][T18098] r8152-cfgselector 4-1: USB disconnect, device number 72 [ 1070.132777][T19919] chnl_net:caif_netlink_parms(): no params data found [ 1070.278722][T19919] bridge0: port 1(bridge_slave_0) entered blocking state [ 1070.286367][T19919] bridge0: port 1(bridge_slave_0) entered disabled state [ 1070.294760][T19919] bridge_slave_0: entered allmulticast mode [ 1070.303361][T19919] bridge_slave_0: entered promiscuous mode [ 1070.311423][T19919] bridge0: port 2(bridge_slave_1) entered blocking state [ 1070.319935][T19919] bridge0: port 2(bridge_slave_1) entered disabled state [ 1070.327592][T19919] bridge_slave_1: entered allmulticast mode [ 1070.334787][T19919] bridge_slave_1: entered promiscuous mode [ 1070.368580][T19919] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1070.380301][T19919] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1070.455644][T19919] team0: Port device team_slave_0 added [ 1070.494888][T19919] team0: Port device team_slave_1 added [ 1070.553605][T19938] binder: 19932:19938 ioctl 4018620d 0 returned -22 [ 1070.568635][T19938] binder: 19932:19938 ioctl c018620c 200000000380 returned -1 [ 1070.619967][T19919] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1070.634192][T19919] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1070.661865][T19919] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1070.677325][T19919] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1070.685572][T19919] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1070.717591][T19919] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1070.766857][T17410] vlan2: left promiscuous mode [ 1070.790221][T17410] bridge_slave_0: left promiscuous mode [ 1070.799388][T17410] bridge0: port 1(vlan2) entered disabled state [ 1071.000316][T19955] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4015'. [ 1071.251889][ T5829] Bluetooth: hci0: command tx timeout [ 1071.845756][T17410] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1071.855795][T17410] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1071.913873][T17410] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 1071.952323][T17410] bond0 (unregistering): Released all slaves [ 1072.039205][T19969] FAULT_INJECTION: forcing a failure. [ 1072.039205][T19969] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1072.052894][T19971] kernel profiling enabled (shift: 6) [ 1072.053775][T19969] CPU: 1 UID: 0 PID: 19969 Comm: syz.4.4017 Tainted: G L syzkaller #0 PREEMPT(full) [ 1072.053805][T19969] Tainted: [L]=SOFTLOCKUP [ 1072.053812][T19969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1072.053824][T19969] Call Trace: [ 1072.053834][T19969] [ 1072.053843][T19969] dump_stack_lvl+0xe8/0x150 [ 1072.053874][T19969] should_fail_ex+0x414/0x560 [ 1072.053909][T19969] _copy_to_user+0x31/0xb0 [ 1072.053934][T19969] simple_read_from_buffer+0xe1/0x170 [ 1072.053962][T19969] proc_fail_nth_read+0x1b3/0x220 [ 1072.053987][T19969] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1072.054010][T19969] ? rw_verify_area+0x2a6/0x4d0 [ 1072.054028][T19969] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1072.054049][T19969] vfs_read+0x200/0xa30 [ 1072.054063][T19969] ? fdget_pos+0x247/0x320 [ 1072.054090][T19969] ? __pfx___mutex_lock+0x10/0x10 [ 1072.054113][T19969] ? __pfx_vfs_read+0x10/0x10 [ 1072.054132][T19969] ? __fget_files+0x2a/0x420 [ 1072.054159][T19969] ? __fget_files+0x3a0/0x420 [ 1072.054181][T19969] ? __fget_files+0x2a/0x420 [ 1072.054218][T19969] ksys_read+0x145/0x250 [ 1072.054239][T19969] ? __pfx_ksys_read+0x10/0x10 [ 1072.054268][T19969] do_syscall_64+0xec/0xf80 [ 1072.054287][T19969] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1072.054306][T19969] ? trace_irq_disable+0x37/0x100 [ 1072.054331][T19969] ? clear_bhb_loop+0x60/0xb0 [ 1072.054353][T19969] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1072.054372][T19969] RIP: 0033:0x7f08b5f8e15c [ 1072.054389][T19969] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1072.054407][T19969] RSP: 002b:00007f08b6dbf030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1072.054428][T19969] RAX: ffffffffffffffda RBX: 00007f08b61e6090 RCX: 00007f08b5f8e15c [ 1072.054443][T19969] RDX: 000000000000000f RSI: 00007f08b6dbf0a0 RDI: 0000000000000004 [ 1072.054455][T19969] RBP: 00007f08b6dbf090 R08: 0000000000000000 R09: 0000000000000000 [ 1072.054467][T19969] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 1072.054479][T19969] R13: 00007f08b61e6128 R14: 00007f08b61e6090 R15: 00007f08b630fa28 [ 1072.054510][T19969] [ 1072.158382][T19977] netlink: 84 bytes leftover after parsing attributes in process `syz.2.4018'. [ 1072.262538][T19971] input: syz0 as /devices/virtual/input/input42 [ 1072.329131][T19979] netlink: 14 bytes leftover after parsing attributes in process `syz.4.4020'. [ 1072.379443][T19977] netlink: 84 bytes leftover after parsing attributes in process `syz.2.4018'. [ 1072.578012][T17410] bond1 (unregistering): Released all slaves [ 1072.610297][T19984] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4021'. [ 1072.622714][T19984] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4021'. [ 1072.651773][ T24] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 1072.837521][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 1072.851334][ T24] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 219 [ 1072.873878][ T24] usb 3-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= 5.f5 [ 1072.893714][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1072.902500][ T24] usb 3-1: Product: syz [ 1072.914096][ T24] usb 3-1: Manufacturer: syz [ 1072.920157][ T24] usb 3-1: SerialNumber: syz [ 1072.938047][T17410] bond2 (unregistering): Released all slaves [ 1072.938432][ T24] usb 3-1: config 0 descriptor?? [ 1072.956454][T19980] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1072.985527][ T24] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1073.292592][ T24] usb 3-1: USB disconnect, device number 96 [ 1073.331912][ T5829] Bluetooth: hci0: command tx timeout [ 1073.343562][T17410] bond3 (unregistering): Released all slaves [ 1073.419741][T19987] udevd[19987]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1073.632459][T17410] bond4 (unregistering): Released all slaves [ 1073.757299][T17410] bond5 (unregistering): Released all slaves [ 1073.944524][T17410] bond6 (unregistering): Released all slaves [ 1074.105192][T17410] bond7 (unregistering): Released all slaves [ 1074.269550][T17410] bond8 (unregistering): Released all slaves [ 1074.356604][T19997] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4023'. [ 1074.367152][T19997] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4023'. [ 1074.377522][T19997] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4023'. [ 1074.493957][T17410] bond9 (unregistering): Released all slaves [ 1074.518426][T19948] syzkaller1: entered promiscuous mode [ 1074.531197][T19948] syzkaller1: entered allmulticast mode [ 1074.951050][T19979] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1074.971182][T19979] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1074.991065][T19979] bond0 (unregistering): Released all slaves [ 1075.122066][T17410] tipc: Disabling bearer [ 1075.127824][T17410] tipc: Left network mode [ 1075.210006][T19919] hsr_slave_0: entered promiscuous mode [ 1075.217135][T19919] hsr_slave_1: entered promiscuous mode [ 1075.230302][T19919] debugfs: 'hsr0' already exists in 'hsr' [ 1075.236155][T19919] Cannot create hsr debugfs directory [ 1075.368229][T18098] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 1075.412161][ T5829] Bluetooth: hci0: command tx timeout [ 1075.547067][T18098] usb 3-1: config index 0 descriptor too short (expected 20260, got 36) [ 1075.579051][T17410] hsr_slave_0: left promiscuous mode [ 1075.590579][T18098] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 5 [ 1075.618823][T17410] hsr_slave_1: left promiscuous mode [ 1075.620211][T18098] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1075.638330][T18098] usb 3-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 1075.649101][T18098] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1075.680585][T17410] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1075.719260][T18098] usb 3-1: config 0 descriptor?? [ 1075.750620][T17410] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1075.989950][T17410] team0 (unregistering): Port device batadv1 removed [ 1076.174801][T18098] usb 3-1: string descriptor 0 read error: -71 [ 1076.259870][T18098] usbhid 3-1:0.0: can't add hid device: -71 [ 1076.270521][T18098] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1076.313577][T18098] usb 3-1: USB disconnect, device number 97 [ 1077.142026][T17912] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 1077.290141][T17410] team0 (unregistering): Port device team_slave_1 removed [ 1077.322125][T17912] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1077.334335][T17912] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1077.344833][T17912] usb 5-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 1077.355337][T17912] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1077.364426][T17912] usb 5-1: Product: syz [ 1077.368693][T17912] usb 5-1: Manufacturer: syz [ 1077.376743][T17912] usb 5-1: SerialNumber: syz [ 1077.386632][T17912] usb 5-1: config 0 descriptor?? [ 1077.395856][T17912] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 1077.414843][T17912] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1077.427953][T17912] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 1077.437045][T17912] usb 5-1: media controller created [ 1077.452342][T17912] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1077.492650][ T5829] Bluetooth: hci0: command tx timeout [ 1077.508299][T17912] DVB: Unable to find symbol tda10046_attach() [ 1077.514707][T17912] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 1077.523621][T17912] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 1077.592747][T17410] team0 (unregistering): Port device team_slave_0 removed [ 1077.615484][T20036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1077.644968][T20036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1077.666519][T17912] dvb_usb_m920x 5-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 1077.693186][T17912] usb 5-1: USB disconnect, device number 63 [ 1078.647585][T20055] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4031'. [ 1078.702693][T20057] syzkaller1: entered promiscuous mode [ 1078.722765][T20057] syzkaller1: entered allmulticast mode [ 1078.773913][T20064] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4031'. [ 1079.032695][T20070] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4035'. [ 1079.052367][T20072] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4035'. [ 1079.289366][T17410] IPVS: stop unused estimator thread 0... [ 1079.472472][T17912] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 1079.617749][T19919] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1079.631749][T17912] usb 3-1: Using ep0 maxpacket: 32 [ 1079.638887][T17912] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1079.657378][T17912] usb 3-1: config 0 has no interfaces? [ 1079.668005][T17912] usb 3-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 1079.670661][T19919] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1079.685275][T17912] usb 3-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 1079.695557][T17912] usb 3-1: Product: syz [ 1079.699747][T17912] usb 3-1: Manufacturer: syz [ 1079.718432][T17912] usb 3-1: SerialNumber: syz [ 1079.732373][T17912] usb 3-1: config 0 descriptor?? [ 1079.772960][T19919] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1079.821782][T19919] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1079.896724][T20089] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4038'. [ 1080.182630][T19919] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1080.220941][T19919] 8021q: adding VLAN 0 to HW filter on device team0 [ 1080.247932][ T8144] bridge0: port 1(bridge_slave_0) entered blocking state [ 1080.255194][ T8144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1080.288467][ T5989] bridge0: port 2(bridge_slave_1) entered blocking state [ 1080.295715][ T5989] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1080.486259][ T9] usb 3-1: USB disconnect, device number 98 [ 1080.499597][T19919] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1080.607015][T19919] veth0_vlan: entered promiscuous mode [ 1080.621088][T19919] veth1_vlan: entered promiscuous mode [ 1080.671576][T19919] veth0_macvtap: entered promiscuous mode [ 1080.694161][T19919] veth1_macvtap: entered promiscuous mode [ 1080.716428][T19919] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1080.739468][T19919] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1080.760366][ T1141] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1080.782039][ T7599] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 1080.825231][T17410] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1080.866849][T17410] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1080.896609][T17410] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1080.940064][ T5941] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1080.952003][ T7599] usb 4-1: device descriptor read/64, error -71 [ 1080.965034][ T5941] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1081.044580][T17410] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1081.054884][T17410] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1081.207218][ T7599] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 1081.290012][T20144] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4044'. [ 1081.317128][T20144] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4044'. [ 1081.361977][ T7599] usb 4-1: device descriptor read/64, error -71 [ 1081.434178][ T9] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 1081.482139][ T7599] usb usb4-port1: attempt power cycle [ 1081.591889][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 1081.597237][ T5908] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 1081.616879][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1081.649988][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1081.740271][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1081.761785][ T5908] usb 5-1: device descriptor read/64, error -71 [ 1081.779875][ T9] usb 2-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 1081.811025][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1081.841915][ T7599] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 1081.886224][ T9] usb 2-1: config 0 descriptor?? [ 1081.905423][ T7599] usb 4-1: device descriptor read/8, error -71 [ 1082.031747][ T5908] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 1082.251310][ T5908] usb 5-1: device descriptor read/64, error -71 [ 1082.331831][ T7599] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 1082.351981][ T9] hid-picolcd 0003:04D8:F002.0056: unknown main item tag 0x0 [ 1082.382452][ T7599] usb 4-1: device descriptor read/8, error -71 [ 1082.407094][ T9] hid-picolcd 0003:04D8:F002.0056: unknown main item tag 0x0 [ 1082.414870][ T5908] usb usb5-port1: attempt power cycle [ 1082.448572][ T9] hid-picolcd 0003:04D8:F002.0056: unknown main item tag 0x0 [ 1082.474960][ T9] hid-picolcd 0003:04D8:F002.0056: unknown main item tag 0x0 [ 1082.504611][ T7599] usb usb4-port1: unable to enumerate USB device [ 1082.511058][ T9] hid-picolcd 0003:04D8:F002.0056: unknown main item tag 0x0 [ 1082.602909][ T9] hid-picolcd 0003:04D8:F002.0056: No report with id 0xf3 found [ 1082.638933][ T9] hid-picolcd 0003:04D8:F002.0056: No report with id 0xf4 found [ 1082.699131][ T9] usb 2-1: USB disconnect, device number 74 [ 1082.801750][ T5908] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 1082.881053][ T5908] usb 5-1: device descriptor read/8, error -71 [ 1083.027331][ T7341] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1083.038635][ T7341] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1083.047453][ T7341] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1083.056967][ T7341] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1083.064543][ T7341] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1083.134671][ T5908] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 1083.203700][ T5908] usb 5-1: device descriptor read/8, error -71 [ 1083.352290][ T5908] usb usb5-port1: unable to enumerate USB device [ 1083.694570][T20178] chnl_net:caif_netlink_parms(): no params data found [ 1084.315337][T20178] bridge0: port 1(bridge_slave_0) entered blocking state [ 1084.354116][T20178] bridge0: port 1(bridge_slave_0) entered disabled state [ 1084.386818][T20178] bridge_slave_0: entered allmulticast mode [ 1084.466354][T20178] bridge_slave_0: entered promiscuous mode [ 1084.744782][T20217] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4054'. [ 1084.766884][T20210] syzkaller1: entered promiscuous mode [ 1084.797944][T20210] syzkaller1: entered allmulticast mode [ 1084.822220][T20218] program syz.4.4054 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1084.849860][T20178] bridge0: port 2(bridge_slave_1) entered blocking state [ 1084.881986][T20178] bridge0: port 2(bridge_slave_1) entered disabled state [ 1084.913535][T20178] bridge_slave_1: entered allmulticast mode [ 1084.942554][T20178] bridge_slave_1: entered promiscuous mode [ 1085.101864][ T5829] Bluetooth: hci2: command tx timeout [ 1085.198972][T20178] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1085.248897][T20178] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1085.358623][T20224] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4058'. [ 1085.375707][T20178] team0: Port device team_slave_0 added [ 1085.509597][T20178] team0: Port device team_slave_1 added [ 1085.739585][T20178] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1085.766674][T20178] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1085.820303][T20178] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1085.878161][T20178] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1085.894511][T20178] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1085.921492][T20178] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1086.754982][ T7563] bond1 (unregistering): Released all slaves [ 1087.064501][ T7563] bond2 (unregistering): Released all slaves [ 1087.172481][ T5829] Bluetooth: hci2: command tx timeout [ 1087.362716][ T7563] bond3 (unregistering): Released all slaves [ 1087.560381][ T7563] bond4 (unregistering): Released all slaves [ 1087.800136][ T7563] bond5 (unregistering): Released all slaves [ 1088.083898][ T7563] bond6 (unregistering): Released all slaves [ 1088.288366][ T7563] bond7 (unregistering): Released all slaves [ 1088.331761][T17912] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1088.438591][ T7563] bond8 (unregistering): Released all slaves [ 1088.466424][T17912] usb 4-1: device descriptor read/64, error -71 [ 1088.561398][ T7563] bond9 (unregistering): Released all slaves [ 1088.680317][ T7563] bond10 (unregistering): Released all slaves [ 1088.712644][T17912] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1088.805462][ T7563] bond11 (unregistering): Released all slaves [ 1088.844689][T17912] usb 4-1: device descriptor read/64, error -71 [ 1088.927389][ T7563] bond12 (unregistering): Released all slaves [ 1088.952115][T17912] usb usb4-port1: attempt power cycle [ 1089.046211][ T7563] bond13 (unregistering): Released all slaves [ 1089.170317][ T7563] team0: Port device macvlan2 removed [ 1089.181384][ T7563] bond14 (unregistering): Released all slaves [ 1089.251842][ T5829] Bluetooth: hci2: command tx timeout [ 1089.292103][T17912] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1089.314897][ T7563] bond15 (unregistering): Released all slaves [ 1089.315052][T17912] usb 4-1: device descriptor read/8, error -71 [ 1089.357679][T20256] syzkaller1: entered promiscuous mode [ 1089.363884][T20256] syzkaller1: entered allmulticast mode [ 1089.522258][ T7563] : left promiscuous mode [ 1089.561803][T17912] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1089.599931][T20178] hsr_slave_0: entered promiscuous mode [ 1089.604509][T20264] netlink: zone id is out of range [ 1089.628750][T20178] hsr_slave_1: entered promiscuous mode [ 1089.635246][T17912] usb 4-1: device descriptor read/8, error -71 [ 1089.643750][T20178] debugfs: 'hsr0' already exists in 'hsr' [ 1089.665141][T20178] Cannot create hsr debugfs directory [ 1089.700114][ T7563] tipc: Disabling bearer [ 1089.743026][T17912] usb usb4-port1: unable to enumerate USB device [ 1089.780500][ T7563] tipc: Left network mode [ 1090.733036][T20284] FAULT_INJECTION: forcing a failure. [ 1090.733036][T20284] name failslab, interval 1, probability 0, space 0, times 0 [ 1090.746555][ T7563] hsr_slave_0: left promiscuous mode [ 1090.753937][ T7563] hsr_slave_1: left promiscuous mode [ 1090.782532][T20284] CPU: 0 UID: 0 PID: 20284 Comm: syz.0.4071 Tainted: G L syzkaller #0 PREEMPT(full) [ 1090.782565][T20284] Tainted: [L]=SOFTLOCKUP [ 1090.782573][T20284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1090.782584][T20284] Call Trace: [ 1090.782593][T20284] [ 1090.782602][T20284] dump_stack_lvl+0xe8/0x150 [ 1090.782631][T20284] should_fail_ex+0x414/0x560 [ 1090.782668][T20284] should_failslab+0xa8/0x100 [ 1090.782694][T20284] __kmalloc_cache_noprof+0x84/0x700 [ 1090.782714][T20284] ? trace_contention_end+0x39/0x100 [ 1090.782738][T20284] ? vhost_task_create+0xf8/0x320 [ 1090.782767][T20284] vhost_task_create+0xf8/0x320 [ 1090.782790][T20284] ? arch_stack_walk+0xfc/0x150 [ 1090.782811][T20284] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 1090.782835][T20284] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 1090.782862][T20284] ? __pfx_vhost_task_create+0x10/0x10 [ 1090.782895][T20284] ? __pfx_vhost_task_fn+0x10/0x10 [ 1090.782924][T20284] ? __lock_acquire+0x6b6/0x2cf0 [ 1090.782948][T20284] ? kasan_save_track+0x4f/0x80 [ 1090.782968][T20284] ? kasan_save_track+0x3e/0x80 [ 1090.782985][T20284] ? kasan_save_free_info+0x46/0x50 [ 1090.783021][T20284] kvm_mmu_post_init_vm+0x14c/0x300 [ 1090.783052][T20284] kvm_arch_vcpu_ioctl_run+0xdc/0x1c90 [ 1090.783092][T20284] ? look_up_lock_class+0x57/0x110 [ 1090.783114][T20284] ? register_lock_class+0x31/0x2e0 [ 1090.783133][T20284] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 1090.783163][T20284] ? __lock_acquire+0x6b6/0x2cf0 [ 1090.783185][T20284] ? __mutex_lock+0x335/0x1350 [ 1090.783221][T20284] ? kasan_quarantine_put+0xbb/0x1f0 [ 1090.783253][T20284] ? do_raw_write_lock+0x120/0x260 [ 1090.783290][T20284] kvm_vcpu_ioctl+0x99a/0xed0 [ 1090.783320][T20284] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1090.783342][T20284] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1090.783384][T20284] ? __fget_files+0x2a/0x420 [ 1090.783411][T20284] ? __fget_files+0x2a/0x420 [ 1090.783434][T20284] ? __fget_files+0x3a0/0x420 [ 1090.783457][T20284] ? __fget_files+0x2a/0x420 [ 1090.783482][T20284] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1090.783504][T20284] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1090.783530][T20284] __se_sys_ioctl+0xfc/0x170 [ 1090.783551][T20284] do_syscall_64+0xec/0xf80 [ 1090.783571][T20284] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1090.783590][T20284] ? trace_irq_disable+0x37/0x100 [ 1090.783615][T20284] ? clear_bhb_loop+0x60/0xb0 [ 1090.783641][T20284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1090.783661][T20284] RIP: 0033:0x7faa5f78f749 [ 1090.783678][T20284] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1090.783697][T20284] RSP: 002b:00007faa605c3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1090.783718][T20284] RAX: ffffffffffffffda RBX: 00007faa5f9e6090 RCX: 00007faa5f78f749 [ 1090.783733][T20284] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000009 [ 1090.783746][T20284] RBP: 00007faa605c3090 R08: 0000000000000000 R09: 0000000000000000 [ 1090.783759][T20284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1090.783770][T20284] R13: 00007faa5f9e6128 R14: 00007faa5f9e6090 R15: 00007faa5fb0fa28 [ 1090.783802][T20284] [ 1091.228095][T17912] usb 5-1: new full-speed USB device number 68 using dummy_hcd [ 1091.332761][ T5829] Bluetooth: hci2: command tx timeout [ 1091.383605][T17912] usb 5-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1091.405300][T17912] usb 5-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1091.416695][T17912] usb 5-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 1091.427833][T17912] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1091.437312][T17912] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1091.448659][T20280] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1091.628544][T20299] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4075'. [ 1091.640645][T20295] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4073'. [ 1091.662037][ T5921] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 1091.672054][T20295] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4073'. [ 1091.839486][ T5921] usb 4-1: config index 0 descriptor too short (expected 20260, got 36) [ 1091.851931][ T5921] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 5 [ 1091.872989][ T5921] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1091.895243][ T5921] usb 4-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 1091.917762][ T5921] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1091.946809][ T5921] usb 4-1: config 0 descriptor?? [ 1092.440099][T20305] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1092.476405][T20305] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1092.601216][ T5921] usb 4-1: string descriptor 0 read error: -71 [ 1092.638399][ T5921] usbhid 4-1:0.0: can't add hid device: -71 [ 1092.651810][ T5921] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1092.676536][ T5921] usb 4-1: USB disconnect, device number 81 [ 1093.013558][T20307] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1093.024957][T20307] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1093.082972][T17912] aiptek 5-1:17.0: Aiptek using 400 ms programming speed [ 1093.091429][T17912] input: Aiptek as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:17.0/input/input43 [ 1093.187362][T17912] usb 5-1: USB disconnect, device number 68 [ 1093.193417][ C0] aiptek 5-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1093.448822][T20315] syzkaller1: entered promiscuous mode [ 1093.457330][T20315] syzkaller1: entered allmulticast mode [ 1093.498633][T20178] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1093.567937][T20178] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1093.607786][T20178] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1093.661912][T20178] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1093.835005][ T7563] IPVS: stop unused estimator thread 0... [ 1094.188569][T20344] tipc: Started in network mode [ 1094.201180][T20344] tipc: Node identity c245e4b34e1, cluster identity 4711 [ 1094.233366][T20344] tipc: Enabled bearer , priority 0 [ 1094.260189][T20349] syzkaller0: entered promiscuous mode [ 1094.277429][T20349] syzkaller0: entered allmulticast mode [ 1094.319464][T20343] tipc: Resetting bearer [ 1094.374764][T20343] tipc: Disabling bearer [ 1094.434597][T20178] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1094.530910][T20178] 8021q: adding VLAN 0 to HW filter on device team0 [ 1094.574811][ T9513] bridge0: port 1(bridge_slave_0) entered blocking state [ 1094.582046][ T9513] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1094.611506][T20357] ------------[ cut here ]------------ [ 1094.618129][T20357] WARNING: fs/exec.c:119 at path_noexec+0x1af/0x200, CPU#0: syz.0.4086/20357 [ 1094.627114][T20357] Modules linked in: [ 1094.631317][T20357] CPU: 0 UID: 0 PID: 20357 Comm: syz.0.4086 Tainted: G L syzkaller #0 PREEMPT(full) [ 1094.642493][T20357] Tainted: [L]=SOFTLOCKUP [ 1094.646898][T20357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1094.652168][ T5921] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 1094.657093][T20357] RIP: 0010:path_noexec+0x1af/0x200 [ 1094.670077][T20357] Code: 02 31 ff 48 89 de e8 b0 ac 86 ff d1 eb eb 07 e8 c7 a7 86 ff b3 01 89 d8 5b 41 5e 41 5f 5d e9 d8 1f 22 09 cc e8 b2 a7 86 ff 90 <0f> 0b 90 e9 48 ff ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c a6 [ 1094.690273][T20357] RSP: 0018:ffffc90003d47bd8 EFLAGS: 00010287 [ 1094.696502][T20357] RAX: ffffffff823a500e RBX: ffff88802f937200 RCX: 0000000000080000 [ 1094.704558][T20357] RDX: ffffc9001d4c8000 RSI: 000000000000006b RDI: 000000000000006c [ 1094.712569][T20357] RBP: 0000000000080000 R08: ffff88807b290000 R09: 0000000000000003 [ 1094.720536][T20357] R10: 0000000000000003 R11: 0000000000000002 R12: 0000000000000011 [ 1094.728536][T20357] R13: 1ffff920007a8f90 R14: 0000000000000000 R15: dffffc0000000000 [ 1094.736549][T20357] FS: 00007faa605e46c0(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000 [ 1094.745512][T20357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1094.752132][T20357] CR2: 000020000019f030 CR3: 0000000041c7a000 CR4: 00000000003526f0 [ 1094.760105][T20357] Call Trace: [ 1094.763435][T20357] [ 1094.766383][T20357] do_mmap+0xa43/0x10d0 [ 1094.770938][T20357] ? __pfx_do_mmap+0x10/0x10 [ 1094.775900][T20357] ? down_write_killable+0x178/0x230 [ 1094.781328][T20357] ? __pfx_down_write_killable+0x10/0x10 [ 1094.787360][T20357] ? common_file_perm+0x1b5/0x220 [ 1094.792879][T20357] vm_mmap_pgoff+0x2a6/0x4d0 [ 1094.797511][T20357] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 1094.802790][T20357] ? __fget_files+0x2a/0x420 [ 1094.807603][T20357] ? __fget_files+0x3a0/0x420 [ 1094.812351][T20357] ? __fget_files+0x2a/0x420 [ 1094.816941][T20357] ksys_mmap_pgoff+0x51f/0x760 [ 1094.821754][T20357] do_syscall_64+0xec/0xf80 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1094.826263][T20357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1094.832354][T20357] ? trace_irq_disable+0x37/0x100 [ 1094.837371][T20357] ? clear_bhb_loop+0x60/0xb0 [ 1094.842084][T20357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1094.847971][T20357] RIP: 0033:0x7faa5f78f749 [ 1094.852560][T20357] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1094.872284][T20357] RSP: 002b:00007faa605e4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1094.878748][T17410] bridge0: port 2(bridge_slave_1) entered blocking state [ 1094.881111][T20357] RAX: ffffffffffffffda RBX: 00007faa5f9e5fa0 RCX: 00007faa5f78f749 [ 1094.887859][T17410] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1094.904372][T20357] RDX: 0000000003000007 RSI: 0000000000003000 RDI: 0000200000000000 [ 1094.912410][T20357] RBP: 00007faa5f813f91 R08: 0000000000000006 R09: 0000000000000000 [ 1094.920390][T20357] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000000 [ 1094.928410][T20357] R13: 00007faa5f9e6038 R14: 00007faa5f9e5fa0 R15: 00007faa5fb0fa28 [ 1094.936489][T20357] [ 1094.939498][T20357] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1094.946764][T20357] CPU: 0 UID: 0 PID: 20357 Comm: syz.0.4086 Tainted: G L syzkaller #0 PREEMPT(full) [ 1094.957685][T20357] Tainted: [L]=SOFTLOCKUP [ 1094.962011][T20357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1094.972048][T20357] Call Trace: [ 1094.975316][T20357] [ 1094.978247][T20357] vpanic+0x1e0/0x670 [ 1094.982221][T20357] panic+0xb9/0xc0 [ 1094.985924][T20357] ? __pfx_panic+0x10/0x10 [ 1094.990325][T20357] __warn+0x317/0x4b0 [ 1094.994287][T20357] ? path_noexec+0x1af/0x200 [ 1094.998862][T20357] ? path_noexec+0x1af/0x200 [ 1095.003433][T20357] __report_bug+0x288/0x500 [ 1095.007949][T20357] ? path_noexec+0x1af/0x200 [ 1095.012527][T20357] ? __pfx___report_bug+0x10/0x10 [ 1095.017617][T20357] ? futex_unqueue+0x211/0x240 [ 1095.022366][T20357] ? arch_get_unmapped_area_topdown+0x251/0xbc0 [ 1095.028586][T20357] ? path_noexec+0x1af/0x200 [ 1095.033160][T20357] report_bug+0x16a/0x220 [ 1095.037470][T20357] ? path_noexec+0x1af/0x200 [ 1095.042042][T20357] ? path_noexec+0x1b1/0x200 [ 1095.046620][T20357] handle_bug+0x98/0x200 [ 1095.050849][T20357] exc_invalid_op+0x1a/0x50 [ 1095.055332][T20357] asm_exc_invalid_op+0x1a/0x20 [ 1095.060165][T20357] RIP: 0010:path_noexec+0x1af/0x200 [ 1095.065360][T20357] Code: 02 31 ff 48 89 de e8 b0 ac 86 ff d1 eb eb 07 e8 c7 a7 86 ff b3 01 89 d8 5b 41 5e 41 5f 5d e9 d8 1f 22 09 cc e8 b2 a7 86 ff 90 <0f> 0b 90 e9 48 ff ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c a6 [ 1095.084952][T20357] RSP: 0018:ffffc90003d47bd8 EFLAGS: 00010287 [ 1095.091005][T20357] RAX: ffffffff823a500e RBX: ffff88802f937200 RCX: 0000000000080000 [ 1095.098972][T20357] RDX: ffffc9001d4c8000 RSI: 000000000000006b RDI: 000000000000006c [ 1095.106931][T20357] RBP: 0000000000080000 R08: ffff88807b290000 R09: 0000000000000003 [ 1095.114884][T20357] R10: 0000000000000003 R11: 0000000000000002 R12: 0000000000000011 [ 1095.122838][T20357] R13: 1ffff920007a8f90 R14: 0000000000000000 R15: dffffc0000000000 [ 1095.130800][T20357] ? path_noexec+0x1ae/0x200 [ 1095.135391][T20357] ? path_noexec+0x1ae/0x200 [ 1095.139969][T20357] do_mmap+0xa43/0x10d0 [ 1095.144116][T20357] ? __pfx_do_mmap+0x10/0x10 [ 1095.148715][T20357] ? down_write_killable+0x178/0x230 [ 1095.153987][T20357] ? __pfx_down_write_killable+0x10/0x10 [ 1095.159602][T20357] ? common_file_perm+0x1b5/0x220 [ 1095.164614][T20357] vm_mmap_pgoff+0x2a6/0x4d0 [ 1095.169190][T20357] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 1095.174397][T20357] ? __fget_files+0x2a/0x420 [ 1095.178977][T20357] ? __fget_files+0x3a0/0x420 [ 1095.183644][T20357] ? __fget_files+0x2a/0x420 [ 1095.188221][T20357] ksys_mmap_pgoff+0x51f/0x760 [ 1095.192974][T20357] do_syscall_64+0xec/0xf80 [ 1095.197466][T20357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1095.203511][T20357] ? trace_irq_disable+0x37/0x100 [ 1095.208521][T20357] ? clear_bhb_loop+0x60/0xb0 [ 1095.213180][T20357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1095.219070][T20357] RIP: 0033:0x7faa5f78f749 [ 1095.223484][T20357] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1095.243091][T20357] RSP: 002b:00007faa605e4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1095.251498][T20357] RAX: ffffffffffffffda RBX: 00007faa5f9e5fa0 RCX: 00007faa5f78f749 [ 1095.259457][T20357] RDX: 0000000003000007 RSI: 0000000000003000 RDI: 0000200000000000 [ 1095.267421][T20357] RBP: 00007faa5f813f91 R08: 0000000000000006 R09: 0000000000000000 [ 1095.275381][T20357] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000000 [ 1095.283339][T20357] R13: 00007faa5f9e6038 R14: 00007faa5f9e5fa0 R15: 00007faa5fb0fa28 [ 1095.291329][T20357] [ 1095.294704][T20357] Kernel Offset: disabled [ 1095.299019][T20357] Rebooting in 86400 seconds..