last executing test programs: 1m7.78799594s ago: executing program 1 (id=269): socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CLEAR_DIRTY_LOG(r3, 0xc018aec0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) kexec_load(0x0, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00'}) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRES32=r1, @ANYRES32=0x1, @ANYBLOB, @ANYRES32, @ANYBLOB="04000000000000000300"/20, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) msync(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3) socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1, 0x200, &(0x7f0000000340)) lsm_get_self_attr(0x64, &(0x7f0000000000), &(0x7f0000001280)=0xdb, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80082) syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x15243525538eff65) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x143240, 0x0) 1m5.521974856s ago: executing program 1 (id=276): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r1 = epoll_create1(0x0) copy_file_range(r1, 0x0, r0, &(0x7f0000000580)=0x9, 0x7fff, 0x0) r2 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_SELECTION(r2, 0xc040565e, &(0x7f00000000c0)={0x1, 0x102, 0x4, {0xfffffffe, 0x20003, 0xb0c, 0x8}}) 1m5.239784956s ago: executing program 1 (id=277): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x84, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x8000000, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x54, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xfffffffd, 0x6}, [@TCA_NETEM_LATENCY64={0xc, 0xa, 0x7}, @TCA_NETEM_SLOT={0x2c, 0xc, {0x1, 0x0, 0xb2, 0xe9, 0x8, 0x7f}}]}}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000076574683a73797a6b616c6c657230"], 0x38}}, 0x0) 1m3.351873543s ago: executing program 1 (id=281): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7ffffdbe}]}) alarm(0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) alarm(0x6) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x5e20, 0xffffffff, @empty, 0x4}, 0x1c) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002280)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x86, &(0x7f00000001c0)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaabb0800450000780000000000119078ac1414bbe000000100004e2000649078020000000400000001000000a4f97bfa630342f259970c34a4e89d0089a5e176643cbfb7c34e1c06c7f8152004b07d74daea7cc05fedfabfc5c52fed0ef579b4bf1384074ab448554ab236880b870cd0a56885516f8e2e8bbdfc70fa"], 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, 0x0, &(0x7f00000000c0)) r7 = syz_open_dev$vbi(&(0x7f0000000380), 0x1, 0x2) ioctl$VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f0000000180)={0x4, @pix_mp={0x10, 0xb553, 0x26b790c5, 0x9, 0x9, [{0x7b, 0x3}, {0x7f, 0x7}, {0x5, 0x200}, {0xfffffef8, 0xbb17}, {0xfffffffb, 0x7}, {0x9, 0x3a}, {0x9, 0x8}, {0x10000, 0x7}], 0xf1, 0x7, 0x0, 0x0, 0x1}}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010002000000000000000000000a18010000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000002cd40009800800014000000006c80002800c00018008000140000000032400018008000040000000070800014000000008080001400000000908000140000000080c000180080001400000000a24000180080001400000000608000140000000ff0800014000000011"], 0x140}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_io_uring_setup(0x1005c20, &(0x7f00000002c0)={0x0, 0x7789, 0x1000, 0x2}, &(0x7f0000000100), &(0x7f0000000000)) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) 1m2.463231435s ago: executing program 1 (id=288): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x68, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x30, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x17, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x104}}, 0x0) 1m1.935025966s ago: executing program 1 (id=291): memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) socket$inet_udp(0x2, 0x2, 0x0) socket(0x10, 0x2, 0x0) pipe(&(0x7f0000000480)) socket$netlink(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$l2tp6(0xa, 0x2, 0x73) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x801, 0x84) socket$igmp(0x2, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0xc) socket$inet6_udplite(0xa, 0x2, 0x88) pipe(&(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) socket$pppoe(0x18, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002216e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r0], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 1m1.480701671s ago: executing program 32 (id=291): memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) socket$inet_udp(0x2, 0x2, 0x0) socket(0x10, 0x2, 0x0) pipe(&(0x7f0000000480)) socket$netlink(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$l2tp6(0xa, 0x2, 0x73) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x801, 0x84) socket$igmp(0x2, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0xc) socket$inet6_udplite(0xa, 0x2, 0x88) pipe(&(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) socket$pppoe(0x18, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002216e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r0], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 7.782476765s ago: executing program 0 (id=514): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x4b4, 0xde61, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000200)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="201107"], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) (async) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000040)={r4, 0x7}, &(0x7f0000000080)=0x8) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000080)={r4, 0x0, 0x1}, 0x8) 7.303650792s ago: executing program 5 (id=517): socket$packet(0x11, 0x3, 0x300) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x161141) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xf691, 0x10100, 0x0, 0x356}, &(0x7f00000008c0)=0x0, &(0x7f0000000500)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x70a, 0x41e3, 0x0, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r6 = syz_open_dev$sndctrl(0x0, 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r6, 0xc4c85512, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) ioctl$KVM_SET_GUEST_DEBUG(r7, 0x4048ae9b, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) syz_usbip_server_init(0x4) openat$vimc1(0xffffffffffffff9c, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r8, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r10, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 6.658869877s ago: executing program 0 (id=519): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7f, 0x2) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) (async) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x8080) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async) mknod$loop(&(0x7f0000000080)='./bus\x00', 0x1, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x2) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000180)=0x7a, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20001840) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) (async) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x2, 0x1) (async) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) read$FUSE(r4, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000000040)={0x50, 0x0, r5, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) syz_fuse_handle_req(r4, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r6 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) (async) syz_usb_connect$cdc_ncm(0x3, 0x6e, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001020000082505a1a44000010203010902"], 0xfffffffffffffffc) r7 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x421c0) ioctl$LOOP_SET_FD(r7, 0x4c00, r6) (async) dup2(r6, r4) (async) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000040)={0x3, @pix={0x1, 0x200, 0x3131354f, 0x5, 0x4, 0x5, 0x4, 0x100, 0x0, 0x6, 0x0, 0x5}}) 5.905713645s ago: executing program 3 (id=521): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001fc0)=@newtaction={0x308, 0x30, 0xc96f2b0dc02612b1, 0x71bd23, 0x25dfdbff, {}, [{0x2f4, 0x1, [@m_simple={0xb0, 0x14, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0x6, 0x3, ':\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x0, 0x7fff, 0x8, 0x1, 0x3}}, @TCA_DEF_DATA={0x6, 0x3, '[\x00'}]}, {0x59, 0x6, "2142fd3b7739e2df1ce11a6cb358923efde1e857b5f4b6f98b557df785dd171fde9589b89159b81ee8cae94d2e9fa3057e2ef1dcb1a91c625616b378bf4efa552a73c8d7f1dcf6bda7d96971955d93d98a6c82b565"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_csum={0x30, 0x19, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_nat={0x210, 0x12, 0x0, 0x0, {{0x8}, {0x11c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x4, 0x0, 0x87}, @multicast1, @dev={0xac, 0x14, 0x14, 0xf}, 0xff000000}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x80007, 0x8, 0xffffffffffffffff, 0x6, 0x7}, @loopback, @broadcast, 0x80, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x6, 0x5, 0x5, 0xa7, 0xffff0001}, @broadcast, @multicast1, 0xffffffff}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x40, 0x4, 0x0, 0x3, 0x9711}, @multicast1, @multicast1, 0x95c5050eeb275cf0, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0xffff, 0xfffffffb, 0x736fe187decc650e, 0x101, 0x30000}, @remote, @rand_addr=0x64010101, 0xffffffff}}, @TCA_NAT_PARMS={0x28, 0x1, {{0xd, 0xb111, 0xffffffffffffffff, 0x838, 0x2a}, @private=0xa010101, @rand_addr=0x64010102, 0xffffffff, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x18, 0x5af3, 0x8, 0x9, 0xcd}, @private=0xa010100, @multicast1}}]}, {0xcd, 0x6, "00dbe2375389f4c61bb80b5c04766adf4c4041ab3363ca93e40c5281d6bb7035fa3fb2838101ae15e668e34175f78ce7df4b1c48d956acfb10ab481c7729eedfcdef8b67015dd90447d814cbb37713b8e2a37054e99152bbb3f0c77e56a1f6ab9da61c7f00958a0aa5108d67f277272c411cba11ef13007927c9c52984e903960081484a463aa2d388d77984fa7968102f600b0936201c9964cff6e228e131439b5dd84f37bb377965a4af38c2020711a2fad2ba4e11f442caf2f22b704bf9fa89dbd5667b8e65de10"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}, 0x308}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=@newlink={0x4c, 0x10, 0x403, 0x4, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20111}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_MACADDR_MODE={0x8, 0x3, 0x2}]}}}, @IFLA_LINK={0x8}]}, 0x4c}, 0x1, 0xba01}, 0x8810) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 5.592994601s ago: executing program 3 (id=522): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x936d25e723fa96e, 0x0) r0 = semget$private(0x0, 0x207, 0xc0) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000000), 0x8) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)={@cgroup, 0xffffffffffffffff, 0x1e, 0x2018, 0x0, @value=r1}, 0x20) semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000340)=""/235) 5.435960698s ago: executing program 3 (id=523): socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CLEAR_DIRTY_LOG(r3, 0xc018aec0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) kexec_load(0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00'}) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRES32=r1, @ANYRES32=0x1, @ANYBLOB, @ANYRES32, @ANYBLOB="04000000000000000300"/20, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) msync(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3) socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1, 0x200, &(0x7f0000000340)) lsm_get_self_attr(0x64, &(0x7f0000000000), &(0x7f0000001280)=0xdb, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80082) syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x15243525538eff65) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x143240, 0x0) 5.416904507s ago: executing program 5 (id=524): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000000c0)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="00000100000005"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x3) ioctl$TIOCSSOFTCAR(r1, 0x541a, 0x0) unshare(0x2040400) syz_usb_connect$cdc_ncm(0x1, 0x72, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x2, 0x1, 0x6, 0x40, 0xff, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x9, 0x24, 0x6, 0x0, 0x1, "7f79a840"}, {0x5, 0x24, 0x0, 0xaa05}, {0xd, 0x24, 0xf, 0x1, 0xfffffffe, 0x6, 0xb9ae, 0x5}, {0x6, 0x24, 0x1a, 0x81, 0x2a}}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0x7, 0x6, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x210, 0x4, 0xc, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x37, 0x4, 0xdf}}}}}}}]}}, &(0x7f0000000280)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x250, 0x7, 0x10, 0xfd, 0x0, 0x18}, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x1, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x412}}]}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd2(0x6, 0x0) ioctl$KVM_HYPERV_EVENTFD(r3, 0x4018aebd, &(0x7f0000000000)={0x4, r4}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000340)={0x84, &(0x7f0000000240)={0x20, 0x13, 0x2, '\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = syz_kvm_setup_syzos_vm$x86(r3, &(0x7f0000bfd000/0x400000)=nil) syz_kvm_add_vcpu$x86(r5, &(0x7f00000002c0)={0x0, &(0x7f0000000400)=[@wr_crn={0x46, 0x20, {0x2, 0xba8f}}, @wr_crn={0x46, 0x20, {0x9}}, @code={0xa, 0x74, {"460f01c9660fc77001b8010000000f01c10fc72848b875000000000000000f23d00f21f835000000080f23f8f3430f1c0766430f381d8f442e0000c48129e1705466baf80cb8c3300e85ef66bafc0cecc744240016010000c7442402ca5c0000ff1c24"}}, @uexit={0x0, 0x18, 0x1}, @code={0xa, 0x42, {"470f07c441ede13940f4430f28f466bad10466ed0f01c80f20d835080000000f22d866b87f000f00d0f3460f011f0f01df"}}, @wr_crn={0x46, 0x20, {0x8}}, @wr_crn={0x46, 0x20, {0x4, 0xc3}}, @code={0xa, 0x85, {"b92f030000b88300c0feba000000000f3066baf80cb818ac9f82ef66bafc0ced470f011c4466ba430066edc744240035010000c74424022f000000ff2c246466460f38828e3d3a50adb9eb020000b800700000ba000000000f308f0a7810d19532ec26b9800000c00f3235008000000f300f22d9"}}, @cpuid={0x14, 0x18, {0x5, 0x4}}, @rdmsr={0x32, 0x18, {0x95c}}, @rdmsr={0x32, 0x18, {0x8ca}}, @cpuid={0x14, 0x18, {0x69}}, @uexit={0x0, 0x18, 0x5}, @wrmsr={0x1e, 0x20, {0x307, 0x2}}, @wrmsr={0x1e, 0x20, {0xf02, 0x3}}, @cpuid={0x14, 0x18, {0x1, 0x4}}, @wrmsr={0x1e, 0x20, {0x85a, 0x7}}, @code={0xa, 0x58, {"410fc728c4612c15170f01dfc4829d9e2166baf80cb8c7f8c186ef66bafc0cb000ee3e4539062664660f6782350000000f209eb9800000c00f3235001000000f3066b809018ec0"}}, @wr_crn={0x46, 0x20, {0x0, 0x9}}, @uexit={0x0, 0x18}, @code={0xa, 0x5a, {"65d8dc660f38354100660fe4f9460f204266baf80cb8cad9488bef66bafc0c66ed66baf80cb8c8581580ef66bafc0cecc4e17c528100000000c4222d048c594f45000047d8c2f3dacc"}}, @uexit={0x0, 0x18, 0x3}, @wrmsr={0x1e, 0x20, {0x3f8, 0x200}}, @rdmsr={0x32, 0x18, {0xabd}}, @cpuid={0x14, 0x18, {0x1, 0x100}}, @wr_crn={0x46, 0x20, {0x2, 0x7ff}}, @cpuid={0x14, 0x18, {0xba79, 0x8}}, @uexit={0x0, 0x18, 0x40}], 0x465}) 4.127899839s ago: executing program 0 (id=527): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4135, 0x1027}], 0x1}, 0x42) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000400)=ANY=[@ANYBLOB="54020000170001000000000000000000200100000000000000000000000000010000000000000000ac141400000000000000000000000000fc020000000000000003000000000000e000000200001000000000000000000000000000000000080a00000300000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="1242ffff040000000000000000000037660b6aff00000000000000000000000000000000000000000200002000000000", @ANYRES32, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000e0270300000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000650d000000000000e1000000000000000007000000ff0f0000000000000000000008000b000000000008001600000000000c001500000000005d000000040105"], 0x254}}, 0x0) 4.040352036s ago: executing program 4 (id=528): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@getroute={0x14, 0x1a, 0x1, 0x70bd2a, 0x25dfdbfc, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x18890) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_GET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000300)={0x14, r2, 0x1, 0x0, 0x0, {0x1c}}, 0x14}}, 0x4000000) 3.949609792s ago: executing program 3 (id=530): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4135, 0x1027}], 0x1}, 0x42) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000400)=ANY=[@ANYBLOB="54020000170001000000000000000000200100000000000000000000000000010000000000000000ac141400000000000000000000000000fc020000000000000003000000000000e000000200001000000000000400000000000000000000080a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="1242ffff040000000000000000000037660b6aff00000000000000000000000000000000000000000200002000000000", @ANYRES32, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000e0270300000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000650d000000000000e1000000000000000007000000ff0f0000000000000000000008000b000000000008001600000000000c001500000000005d0000000401050000000000000000000000ffff00000000000000003300000002000000e000000200"/210], 0x254}}, 0x0) 3.86778363s ago: executing program 0 (id=531): socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000001780)=[{&(0x7f00000000c0)="844e48dc9be56784a45c7ed3b6bc9d69d1d006daaa21671807e50bb795512ddeb62fd7b38827c68e091fb9ba0b60d4dfb81a9ad6ddfd4b02b0be60da9966fcbdb4e7e92434a0283f093c7b146684b4cfd887da8500922d71fd0f879a0a9974758192d13462ea45ff8b51f0dbc69e7eb1e05c7aa797ea48e5e48ae6bc8fb51dbc9d03b7b5451c761d9ea34eb6f7b216baac939bb68c60d96787afd41b8b5334c221e56df5569f78e94e565f65", 0xac}, {&(0x7f0000000580)="cfcb76eb597b78002656fa175712e6191e7d3eec872d5c195a3e96d4f8b566a958016474a2761ffa0c211f6b6d59d7b94a62199683deb35d590e713d31b72c5f06105cc39132ed8cf75f4273ac5ba21743247fc673783dee4b5bf3ef54f2976e6443123c91656c13c60fd4720deddbf3be29373dea50ee654443f5d9486283761122ba0671ee8dbf552ca0202d4e7b57e549a49f64dc917d7ef19bb828e726e175ac3cc87982a133968c6f76be1e09c7a3ccc791c98f214446f4ab61477182619168410d59c9f25ae22c744da9a73993222565c79513e358ee98d40640cc6d601982142cf88ebd114a1d553a2db11fc4f6fbeb47327fffe8ea7f9ff41a23a2f1c9459e1a565a637a6d012a55a38e13dad79d401f5be45374a67f51a836fb6311b74dac7abb898c6ede11e706cb1f7b3134f94b58631a942551326f9d5d35321198ee50f17b33ae9da97aed640847f558175f7dbcddf1c1eb9f645c684664694d18f076790523ad5d7f4beb5bb0bb4b3e84cc022a047e581cdf3ad0b7c6677001bea3a3150bb47f72a28cb5f4d79dfc962713d9633d12d61f9c547c17527a9a284e3d41d7c5daf467e64513c0dd7ee7d265c3f519645fea26d8f20a422d7abc739974d2a23bebf7394b2b0062f6989e6117c13ff4958090816402e52e58097c194c3cbf3ba5925fe509adf8af9fa7c82a14016c386199b6fd1b87996aa0b265ef9c7dd67048c4ac70e5fa073affb49718725c16d37c419f6306bef1061c420dc4bb3418e7b6452c395831660d37eb1820afba0462c0d7ffaa0c81609efd7d3635dec79502e5c3f4fcad01068b28b16af5337d5b45481aab97ecffd952737329c5248d4ad73856f1e7429a7bb37b2d7e87ca56ddfea6613c089c1620e4111664a43fe841a4a12378653efea63d119d21bb64d73927f4be11d88013c9e6ac04fc03a684d76b952b9fce7fdec82872f592de4dce04b45003c93fc2da3568b274ec4c157800867ed072b036ac65182f086e7a9dd0b2bdf22a503b7d400548c47a0eaf84d1c7b1e32240e5ad0422137dd3616162f0db23183610ddd6a4662096c5883ed751cae6bb03cc4d8a8afe5788aa7a09bc640e9fff6909f365915c4eab81152981b3696f9d6f9b828f7b0c9bad55d52fe920fcadfa999e1bd12d37a7daa44c32a3c3e7fdf07ee94ac862bb8d4f1d412c31ca0fc881e5abde7b4cf521aecba2333ad297b1a0ac95199816557de1864e006264ada5bb8cca98679442b1aedf3e35d477d1998733d01a1a831ceb038c48989e8b41a4bf3649ca97ad9c047344afb9a9b4c9b45aa25cba526d78d22ea15d14622441b55d57173f32db470e8ddb42aacfc3480ad7fd60488bae35e523fdb2711818a30405d7ed52eb06632c80a0092c1d40e5be71729df3c73235dde6c11136c35e3505c3b942dc3a2a1b758e17fcb09fa3c7a1fd0c9ef723ea65439e7e97ed01cd6a2e45a529a54094cd2bd2451d137d8e064a8bf6a3551f65f453e64ae32deac0a8fef02df0ff8575aa64a42a6e226ca85ba140597ea7c8c9dcd74ea2cf61330ffc4896a67b05d261cc5c3fb40cdeaa083a588d2e5591d98387f5d545e4158f51a513f23f0f9bd88a1d71bfee4a09357a4b63ebe8c522c9cda17a9dc7ffedf0d8da917087dddc9c7a221a693ac22760338d2767b332f6cb9e39c4b5dd39e33704fa11cf063a49ba2cc0eb46576681a2adfc790b4f3f59d9ae8fc33b0b630d01acc2ee6c1306fc5eab9347fc88a2f25a59bc45287e3c2b51924475c9a25b6e045767da7c824a1e069119e1e1e3c5b7bb9ac9ca306387c2ba02528e6a20f6497ea45718a4c64b61d1585317b88bcaad660254e9ffb8565f51a5adfc3440bfbbe3304bf974db31209525aeb8cdf5fa67ffb2718b2130129e04a8892738068bd01248cc74d75137554c2fea729cd6e0a7b2fdf5b74c63f40590d0b95506b9bdc942b9a83ac19721bb2235d13376eb6f65c9f8c142828ec29f16e425cbc6951e3329312846fc8903965000747b1fe9f9a2b1d7d6ca105ad2a53e58077137aa67f4f170fc0e0c1392ae43c1bfe790581074b6ceb69abe641fd3600fa9a1719458c9e54f53b706d6e7a6ed1c5f3da27a403785d2454a223c2e20807b9797d34521407d9bfd7c7b7148d4d9ed96b7b9795b0422ce0cc27dd93d9d8b7e6447823ef728dcfc4f262247a3ba9d0211e06aaccac50dc6ae2e16050fd60f073e77156afde3c5090659c0ec0a4265b5d12e9d3d6dddfbc9eebd6b11cef953ca02957ade2cbdc534b73545640d4dc8201d173f35b62b73daeaca8175485a3fb17389f134c4e2741d2c3b5d7508349a5dfc8c9a24cd3b574903333165ec40211688b87d5a18592671f7b270738e4815c049caf535b78adc85d269a07b31cc5f2cd8c31eee4a2cb2ad206c718b5fa4070bb44726448911fc2cc8893c62a46b31cab6942d746da0c55be2a9dacd00f85d7d816990bc9e8d4431b23ea0cbf9b0748f96fd04a16830105f64b6d10018ca9aa29501d1966c82730bc2652fae67147212b24c94f25d92091ce0dcc8b722f7ca4c6aaa9fe9bf99d5d8765b7661a17d682cc54debcdb9cb72d0b51a421c026e82a34e3b00b75d573c824e2fd8fd185bd4a92a9bd0f8ac723563a46b3fb630d58a6cace3783f96e8588fffe899cd26c74f1bae8737357e34cfcbf28f91ccd61ab393c92b14bce22ae4c8062cf3b3d45ada485a30cd5adfb06ca342780e63858165cfcf55ae77c1170c98fd19e2821192f09ee882d08105cad3a9faa9bad7d07dfc4a9f7499fe96fd2aa7656ccf6591ef75c160bb01e40dcccaa4678a205d1dc7a003fe2d809cda3799879e65379c6d16dc834848ffaef0c8be6c78afc8a36149b0e90bb6e6fd441908e6297411a3a65722a214cdab388a5ef37019ce78c25dabd531f942a4a5661361c0b69e40e88a820774eedb3ff7b2a5e928907c315d078f99c86a67c82c043f9eb71ad856703c83ea1a3a228021f8dbf239fecaa020d1f1496a60e3152cfdce40422621447d53bc54eeb42f22706773e4a8b621303c88c4c961fb193402fb8cfb7efa0994a1a3e622f20adf96129fa834eb22c618fef53a10ab76f76e3a38db795a60ae8add5cd94c68644a34db35864cc4ce437df0cfdab20eb527b786ac79a5bd737b1f0332102f6fd390a95ee10a1a57e3c3e1d8992c4d714dfbdfce206515ced798ef0d9e3ede29bc7c8799f600a890390fd8c6e582d7264e3d7db739cc4d90d5182bf970c17588ac29a5312af6c729539a007048ad62d7ea3a12354a878bbbfa55311d2d8f768cc627b712462c6f4369906c40e0e80089dd7f98de85f6d79b6730482b0d7b1e30c56f09305d159e026eebd86f3bd725801b0bb8eda46ce6b59f2e7808354404fbb6f5d672be07eb201eeed967751d08be995418e20a3d4b5b032c82d1b9f0f08fafe7e6eecd6d5cb1983c25970f2689712e0a97f369db2b821afac4315acae33a4747f01aad6d3f1dc5a064bab3e745f94cdd8acbc38d154bac6711a4b71ff56195ed5d36bb7c44984c0548f51ee5a3f89ae84d8c89c5d22083d777b6327374a8a11a56be7f8c085846e6fb758f040eae7e6af348b00298a6aa1c91ea58d620c0a91ebf83820c75483a90effb776c0c14fd46283b2e559e2d9522009160bd6fc392ec1e2001152bf2461bb34ee4ce9274ba47c39249dfb30ea8a12dd957bd6c48d1dd2d88a644634f4b30d4aa74be652ae6ac6c4e4965fbc7777f8f7ec75e7a3a4dc744434c97dcff8418f0d5b30b75fe3e5b9b3d8620c7a1be5ed664ea7c92f79ad94cca87f366dcd835898a6153b95bf67713eb2d6b257689efad611afa41c393ae2c8fce5c15294cbb1b9523a334441e5c73eee8edaf653f0a1db87607d6fa286e4df13ea835cb6cdda499688181f07acaef58c2b7fb3ea1e1a6ebdc40d8aed830faec34bdb0f5e79cd56cf0421feb9f0f558e9af9e76906d0c4584edb6c73f8b34629cffcc666e9280c61c40be4d6e760a56cfc27c9e9c35993210ca6dbdfa5a7a4094549ad81f077fa99bdae2ebdbe71bb3f8516e3038b3628528dc3f74ef041e0ba92f270ed1d8167135b2fe4ba864e946755f3d439687629446be94711538bdd9745118e4e6277f0d72c2935647560fc8fcad753d655b5351e642a973c25f66de169f56331322b9fb74cea066f7632b7d1c15f8ece0c2060960680837fca00a77000cb6e9361625fe939407a5dcf4c9cd0fbb512b558c5c350d9279feb3af5cf32f5d40ecd53187192d67ec56f4e4050582f8a0339f8eeaf5d8a591130d760b8bcc51f68937bc678b61265b206b86f2363c85f3fcbefabce3037d47d6632902902fbd917ac096a8b773f94d4b950827e09b6e54873cefaccc481ba6c7ac3449761e841bf16ee0b4fb207b09f75c7f2342dce18693058672d2d0d3256cfd714303acb8e6e29ea86abb7569b7176b9e48a90bc2b981a09af6cc0e97cef8dd845d11774cb3b0fc95872a0b177fd45587bc60cede33e2471630951949cecc7509480fda4f5ca99f109041aedf79e5183e988b6c11d030cd26004f674b933d74da4bb5d1524afdafee1cbd4546baa6a2b374ef1d6fc93e513f0e12647b37ac824148fe968d7b596cd499a775b4f26dd46d6325552bd75cd2c2a7d5b0f687660499a0ad84b9566dc6f817910b143b407a7eb4ce528ea95f283292892b0542946b5e5fef2c0de898c860b41f1d46b199cc3a57e12f0ab3f56b72722017e158ffd279e74bdb1ecb1b4507294344603aae644b29c5918e38060f794f72bf3df5e77a6c2de69ea7f0d51cd2ed41e702c1df6df2da3cb34b2f774faaedefa93c30e6a2aff0d5a8d83928242161030cbcd52d6ed7eb1ce3e3eb5ff695d797e478c57a2edfd850c559a652e9b6cfcc7ffc259ab390cd3051487f955cf195b91dde5468f9363a31ba8310a208d3a7360255973ba25e20b1151ea5d1750272636be9c7dfdf509ce9302654bf65d04c80e507d17ef2821a359c1bbae0a4c0368ffa1f38c4cd4b3b79c4bb6eea8f8cbe2ca4615d8ec92016ccb37da6373fdcf187f9034c27e084e5c4db0967ef755e31261d22ab1f89251b5f9a8d293e251495c1b197356549193d774e6fe79936f28b9f9804485de3d78f6a447b525a9a3ffd01e8e57338247fc6e62788177fc276f4a0a91a5e517e6ca26a7c82a4afdfd9b5f0bf3ed935086092f9ea44b5f01df85261d8f687c5feca908c43fd5f6607c0eda92ea3747151b84df9a10fd54a30ab80f812fe6021f95212b5324bfcbbe96c99a0afa559231c06a479e9483b1e3dc7bd1b22c4f5bff731ef46046414b14cff9fa5cdc15e64bfff7f980dc8df9266fc3c8d7aebce1d579bc15bc774189bd5967555cab3c456883a81f484f8b549f13501d55f640450f355c6a78b94ec2c109fdc257837aec25914e5e81f0e6b46254c8a46dea3b9feeb6563f324a437b92e837095a154cf2d60d213b1dd15d68612becc1b76b3f519d2ac3e82a315ccba5bdec84c961f6a4ce7948504239ad91942a1c108162425eda6d93e1974d0e74fb254f01fb5ebaeb9afce5bce68552b6d0093e8c33760d8957f5051c1f4ae4a216290287a4331e65a4fe6166bab0f08a47d211432095951d8bc7b8def87e905e4b3802e402618e5da8e1738a16d3321098ec6ae80a37174b715e63357b518cf8ac92bb7664763bb986ff817882e3d9c38e2ae02ac52a2febd4cab1c637be928c6284e9420f64065fced2fec86b56dc70252a562e541e04e87e7557ae34cf48", 0x1000}, {&(0x7f0000000200)="6fe1fb3a3ccfd973d87712aac46f4ffb7d5de7b0f63412079d5fb06c4dfe05897aff6309673995f785ea42979639d996b04659d72d3c1bf8b07afcd97f67b56493eb63abf78b2550e25f33e01f05c371a0b6cbdf39e337d0e514881c9d218f64429ba0b525c16729c9e1922dcb06c9de38b1d3250fb37decb2df65b81834081a655aa6a6cd611beacd79021ec377113fe2fb07e9b8fda21cf405ad6fd69a2d46a330d277c9186588361a5779f68d85ba830c75a746a6447308", 0xb9}, {&(0x7f0000000000)="1e300d344c75dcf7cb67d27a8e02dac7b18ed732b8d905ccf39ba62f0845b858da3a409d047315fc71450758a94cd6351235971b936a71f66725f4effd52ed2a", 0x40}, {&(0x7f0000000180)="efc46028aab0", 0x6}, {&(0x7f0000000300)="bcf543b7812cbea08a210e4b963c43f76839be53f5d93f48f6da3afc9642340a011d3c3e65746dc85252ae1fea3db2510d41628321539340eb0cf1961c96c0c317f9ca882e1f7b0582e8e2a3f007c181ba5b1982a2e00fc033f73945cb5e74852f67046fd0ff755709af86dc551378be69fc2bd5a95eee01e892c62018e6c09f28d0b0c2217a60f4dc1dc6e5f76b8bded2f8aa5fe96935fec4ac5dfd8d8776ea6d363f5b016bc54a56249215d6a386f869cd6766edf1b2d5bc7e6a3092e1a32a2feea0a6f7ef394cc17fece981225dd796ae4dbe69c7b7dab95d0c243197990895c2f6a9e2210c51", 0xe8}, {&(0x7f0000000400)="aa1afd0dbf37a2cb", 0x8}, {&(0x7f0000001580)="6e9aff95cb00541007687a1326203aba8870d8ce9740f622940c1e3847cfaf2ebf7916ef984a051c3cc470ea1c981783032073bb046ae86a0ce6d038dbcecbc8f9560a62b6b47eb90fb11a78973ef3477ee96f402bf57f9b0b17724bc812", 0x5e}, {&(0x7f0000001600)="ebe77d231f73c97a9af9cd05ddf1f2dc8c1e1ba7307ade6611e5dfd3526dd689f0576cb9ee15ea0bfda8ab94c10f82f49e47426af35d33de711924aa302ad7def3df3fc8bd711dbb6e3e06d8c965addbd5b58f8b96e0c4575cfef653dd7c90d008e6f7dab8d63dcd4fd9fbfb336cb7d0eb8790a47ae310ce550994a7b9daff0a9ea76726ba4a9c0c2b5099cc11357b079ad5c046c521d3b48e0e4232cd431068b081b39cd1c37f8644d98f1bc1f41a19f1a6753d12a699830f82cd54445048efd4e6b4c663a8c89c220ff8fff85d876078531cbb8be6", 0xd6}, {&(0x7f0000001700)="f7d257201f3497b4abf7fc53c653a76eee0462e38cc17cdc42058ba42bc83b183e0a2f581dd973a90d0308a2b9daf937424998ebdc2b2784c80db5034a3f28f3640df6", 0x43}], 0xa, 0x1, 0x8) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a310000000014000780050015000700000008001240000a0000050005000200000005000400000000000d000300686173683a6e6574"], 0x5c}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000000)={@local, @random="21e300", @void, {@ipv4={0x800, @icmp={{0x6, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, {[@ra={0x94, 0x4, 0x1}]}}, @info_reply={0x10, 0x0, 0x0, 0xb7, 0xb}}}}}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e24, 0x0, @rand_addr, 0x8000}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0xfdff) socketpair$unix(0x1, 0x3, 0x0, 0x0) listen(0xffffffffffffffff, 0x3) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) 3.800366337s ago: executing program 4 (id=532): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000100)=ANY=[@ANYBLOB="480200001a0007000000000002000000fc020000000000000000000000000000e0000002000000000000000000000000ffff0000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000020000000001000000002b000000fc000000000000000000000000000000000000000000000000b40000000000000200000000000000000000007ffffffe0000000100000000e40c00000000000007000000000000000000000000000000000000000000000000002000000000000700000000000000fdffffffffffffff0000040000000000e80a000000000000000000000a000200700000000000000014000e"], 0x248}, 0x1, 0x0, 0x0, 0x4}, 0x0) 3.729432093s ago: executing program 2 (id=533): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) connect$l2tp6(r0, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) r1 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x6}, 0x20) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000001000500050007000000000008000900030000001400200000000000000000000000e1ffe000000108000a0000004000060002000100000014001f"], 0x5c}, 0x1, 0x6c}, 0x0) 3.591842086s ago: executing program 4 (id=534): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = semget$private(0x0, 0x6, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0xb, 0x2, 0x0, 0x0, 0x1000, {[@window={0x3, 0x3, 0x6}, @generic={0x22, 0x2}, @md5sig={0x13, 0x12, "2313a3101166d6c856214c013c019043"}]}}}}}}}, 0x0) semtimedop(r0, &(0x7f00000003c0)=[{0x2, 0x4, 0x1800}], 0x1, 0x0) semop(r0, &(0x7f0000001240)=[{}, {0x2, 0x0, 0x2000}], 0x2) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='loginuid\x00') write$6lowpan_enable(r1, &(0x7f0000000040)='0', 0x1) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r2, 0x3b89, &(0x7f0000000000)={0x28, 0x6, r4, r3, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_GET_HW_INFO(r1, 0x3b8a, &(0x7f00000000c0)={0x28, 0x0, r4, 0xbe, &(0x7f0000000000)=""/190}) semctl$GETZCNT(r0, 0x2, 0xf, 0x0) 3.584583306s ago: executing program 3 (id=535): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)={{0x12, 0x1, 0x0, 0x35, 0xff, 0xaa, 0x20, 0xccd, 0x10af, 0x384e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x59, 0x2, 0x1, 0x9b, 0x1e, 0x2a, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_connect$uac1(0x0, 0x128, &(0x7f00000007c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x116, 0x3, 0x1, 0xd, 0xe0, 0xc, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xff, 0x10}, [@feature_unit={0xf, 0x24, 0x6, 0x6, 0x1, 0x4, [0x5, 0x4, 0xa, 0x3]}, @extension_unit={0xd, 0x24, 0x8, 0x3, 0x6e2a, 0x5, '\x00\x00\x00\x00\x00\x00'}, @processing_unit={0x8, 0x24, 0x7, 0x3, 0x3, 0x71, '\r'}, @feature_unit={0xd, 0x24, 0x6, 0x4, 0x5, 0x3, [0x8, 0x1, 0x5], 0x1}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x305, 0x6, 0x6, 0x8}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x0, 0x24, 0x2, 0x1, 0x8, 0x2, 0x7, 0x3, "f6db61"}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0xfb26, 0x7, 0xd, "dea389567849246527"}, @as_header={0x7, 0x24, 0x1, 0x3, 0x8, 0x1002}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x7, 0x6, 0x5, "f6541778bb"}, @as_header={0x7, 0x24, 0x1, 0x4, 0x5, 0x3}, @format_type_ii_discrete={0x0, 0x24, 0x2, 0x2, 0xc, 0x2dd, 0x4, "0893a257dfc7"}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x4, 0x5, 0xd, {0x7, 0x25, 0x1, 0x3, 0x89, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xc, 0x24, 0x2, 0x2, 0x8000, 0x400, 0x5, "bf9343"}, @as_header={0x7, 0x24, 0x1, 0x9a, 0x3}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x2, 0x7, 0x1, "27e1ffe22b2169d36a"}, @format_type_i_continuous={0xd, 0x24, 0x2, 0x1, 0xff, 0x2, 0x6e, 0x99, "b0a6ec", "73e5"}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0xdb, 0x1, 0xf, 0x4}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x8, 0x9, 0xf7, {0x7, 0x25, 0x1, 0x1, 0xc9, 0x5312}}}}}}}]}}, &(0x7f00000003c0)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x250, 0x7, 0x92, 0x1, 0xff}, 0x36, &(0x7f0000000000)={0x5, 0xf, 0x36, 0x6, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x1, 0x6, 0x6}, @wireless={0xb, 0x10, 0x1, 0xe, 0x49, 0x8, 0x7, 0x193, 0x5}, @ss_cap={0x0, 0x10, 0x3, 0x2, 0x1, 0x1, 0x1, 0x40}, @wireless={0xb, 0x10, 0x1, 0xa, 0x4, 0x28, 0x3, 0x7, 0x2}, @generic={0x0, 0x10, 0x1, "7a455d84ac643c69bec55190f424268f7e837b34e436eab79f16edc8ed2b42e8b3ed19c4a23f63d308fc82e674d86359842ee79163c510ee5a37184a9b9f0894ee15de87e0b5c8e855ddcf8a6b1ff05c1954387ccacf74c82018005a9a02898a88f2049e105b7415e0a39014ddf37ea46864176290a4ffe67ba78ea4365aa28521125ed26a04ca99e8"}]}, 0x3, [{0xc8, &(0x7f0000000240)=@string={0xc8, 0x3, "2ace5d9ec72f2dfec984a512b93d0e679551ad7f1c859631cafa34ef6056a2561e7233e1107d6d44ca0d67389819adc3abdd448da647224704f1041ad6823a0f0f403306f7ecd9883e20ac8bded79719508651d4701078c792ae182e75c0dc827052116c21a35e08e64036a2fd353d39b155a87d7abc40e6b7c7cc9792bf1834f09715fa78dc4d73636815a1cc6c6242b0bef69a6c77c956f3db1f51906f183c5653df76b10c332bebd94931a086e8e9991193fc32e2efc6b093aa6c774f848f464e9c679aa8"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x215}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x2446}}]}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000200)={0x20, 0x8}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x34, &(0x7f00000001c0)={0x0, 0x13}, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.397788507s ago: executing program 2 (id=536): r0 = socket$inet(0xa, 0x801, 0x84) r1 = socket$inet6(0xa, 0x80002, 0x800088) setsockopt$inet6_udp_int(r1, 0x11, 0xb, &(0x7f0000002740)=0x401, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r2 = socket(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'caif0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYRES32=r0, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c0000140001"], 0x48}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) r5 = openat$nullb(0xffffff9c, &(0x7f0000000080), 0x40001, 0x0) r6 = open(&(0x7f0000000100)='./bus\x00', 0x40542, 0x0) ftruncate(r6, 0xee72) sendfile(r5, r6, 0x0, 0x8000fffffffe) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r6) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100feffffff00000000020000000c40990001000000020000000800010001000000"], 0x28}}, 0x8000) sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="cc000000", @ANYRESDEC=r4, @ANYRES8=r3], 0xcc}, 0x1, 0x0, 0x0, 0x200040d1}, 0x804) r8 = accept4(r0, 0x0, 0x0, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r11, 0x4008ae89, &(0x7f0000000380)=ANY=[@ANYBLOB="04000000000000048c"]) sendmmsg$unix(r8, &(0x7f0000001840)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="c6", 0x1}], 0x1, 0x0, 0x0, 0x20048054}}], 0x1, 0x8800) r12 = syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r12, 0xc0145608, &(0x7f0000000240)={0x10002, 0x1, 0x1}) r13 = gettid() ioctl$vim2m_VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000040)=@mmap={0x800, 0x2, 0x4, 0x7e001, 0x6, {0x0, 0x2710}, {0x4, 0x0, 0x8, 0x2, 0x9, 0xe, "080c8d60"}, 0xd5, 0x1, {}, 0x4}) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r13}, &(0x7f0000bbdffc)) 3.303087007s ago: executing program 0 (id=537): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x80001, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/rcu_stall_count', 0x20100, 0x4) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004bec0220a20603008cb4010203010902120001000000000904090000c9c8b70036ba27d29a255afd0c977cd3de8fca6d3d59466063c7c27e276e56083bf847f9861eefce217945557a1dd17b96615b766a181cef87a4edb535c686e3238332fa8ae810b16dd2b91bf57bfe02011ac21d6ee90de6e0d9100b13a15514471a31c0e2f9e6c20d15710b9f100bc3cd834192dae540ddf6f31d9042543329802a9b159c75c7ff8ccf7c9c64eba8aa3512d4143ef185c25d0b5e7a1d25da99c2bd4bd46426e01e05c12eaa30b782bc2afe67ddc578ed191a3f275ca15047726e354cc2daf3edc718f8a2e2e95f2561864fd8b5817ea5b696cb5e9bd03267b86b66d4813a6db707ff77b732ad93c01d50e35c0b250ee0e66e956a5502"], 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) r3 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) r5 = openat$cgroup_subtree(r4, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f0000000040)={[{0x2b, 'rdma'}, {0x2b, 'cpuset'}]}, 0xe) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) r6 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0x5867, 0x400, 0xfffffffc, 0x3cf}, &(0x7f00000006c0)=0x0, &(0x7f0000000300)=0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)}, 0x0) open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) select(0x2, 0x0, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f00000002c0)=0xfffffffc, 0x0, 0x4) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x4, 0x0, 0xffffffffffffffff, &(0x7f0000000140)={0x8400, 0x15, 0x10}, &(0x7f00000001c0)='./file1\x00', 0x18, 0x0, 0x12345, {0x0, r9}}) io_uring_enter(r6, 0x100847c0, 0x0, 0x1, 0x0, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x0, {0xa, 0x80, 0x14, 0x0, 0x0, 0x0, 0x0, 0x7, 0x10017}, [@FRA_DST={0x14, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e22, 0x4e22}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x4c}}, 0x40000) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) 3.148004056s ago: executing program 5 (id=538): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a9fd7869ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4d", 0x2e}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000001880)=[{&(0x7f00000000c0)=""/77, 0x4d}, {&(0x7f0000000280)=""/19, 0x13}], 0x2}, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000080), 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c00000010004b0400000000fcdbdf257a000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012800b00010062726964676500000c0002800500240000000000f52b225afc4fb979a0f1a3ba5c787d5ad3d1100095744ac04dec5d97f3541e66c2cbc197b2dacf7988e419e207e16c32cb4e7ec148f09b5bc6a69c052ce332b18adad03fa469527849c205b5898de347303a6d14b7ec598b9d2f3999eb24d75a17cc1bc48ed46375092b1e793c6055905a1a218961e288544b7a6c16636be2bc59022ea92c5cccc0073aeb397637e135984fe9f33be2d5b3ab3d000d0c22d367a5ca2482bb7123"], 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x10) 2.989762113s ago: executing program 5 (id=539): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4135, 0x1027}], 0x1}, 0x42) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000400)=ANY=[@ANYBLOB="54020000170001000000000000000000200100000000000000000000000000010000000000000000ac141400000000000000000000000000fc020000000000000003000000000000e000000200001000000000000000000000000000000000080a00000000010000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="1242ffff040000000000000000000037660b6aff00000000000000000000000000000000000000000200002000000000", @ANYRES32, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000e0270300000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000650d000000000000e1000000000000000007000000ff0f0000000000000000000008000b000000000008001600000000000c001500000000005d0000000401050000000000000000000000ffff000000000000000033000000020000"], 0x254}}, 0x0) 2.807149818s ago: executing program 5 (id=540): socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CLEAR_DIRTY_LOG(r3, 0xc018aec0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) kexec_load(0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00'}) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRES32=r1, @ANYRES32=0x1, @ANYBLOB, @ANYRES32, @ANYBLOB="04000000000000000300"/20, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) msync(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3) socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1, 0x200, &(0x7f0000000340)) lsm_get_self_attr(0x64, &(0x7f0000000000), &(0x7f0000001280)=0xdb, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80082) syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x15243525538eff65) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x143240, 0x0) 2.370493212s ago: executing program 4 (id=541): r0 = accept4$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, &(0x7f0000000040)=0x10, 0x0) r1 = geteuid() quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000801, r1, &(0x7f0000000080)={0x33, 0x7, 0x800, 0x6, 0x5, 0x8, 0x2, 0x3, 0x10001}) r2 = syz_open_dev$I2C(&(0x7f0000000100), 0xb, 0x420200) ppoll(&(0x7f0000000140)=[{r0, 0x100}, {r0, 0x4000}, {r0}, {r0, 0x1}, {r0}, {r0, 0x9400}, {r0, 0x490}, {r2, 0x81}, {r0}], 0x9, &(0x7f00000001c0)={0x77359400}, &(0x7f0000000200)={[0x54]}, 0x8) r3 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$VIDIOC_G_JPEGCOMP(r3, 0x808c563d, &(0x7f0000000280)) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000340)) r4 = socket$can_bcm(0x1d, 0x2, 0x2) setxattr$security_capability(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0), &(0x7f0000000400)=@v2={0x2000000, [{0x3, 0x9}, {0x4, 0x7}]}, 0x14, 0x3) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000440), 0x10800, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r5, 0xc0189374, &(0x7f0000000480)={{0x1, 0x1, 0x18, r3, {0x9}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r6, 0xc018937c, &(0x7f00000004c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r8 = syz_open_dev$radio(&(0x7f0000000500), 0x3, 0x2) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r8, 0x80286722, &(0x7f0000000580)={&(0x7f0000000540)=""/13, 0xd, 0x3}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'ip6gre0\x00', 0x0, 0x2, 0x4, 0x3, 0x3fffc, 0x35, @empty, @private1={0xfc, 0x1, '\x00', 0x1}, 0x40, 0x8048, 0x8, 0x101}}) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000006c0)={{{@in=@multicast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f00000007c0)=0xe8) sendmsg$nl_xfrm(r7, &(0x7f0000000980)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)=@report={0x120, 0x20, 0x200, 0x70bd29, 0x25dfdbfe, {0x33, {@in=@multicast1, @in6=@local, 0x4e21, 0x0, 0x4e22, 0x2, 0x2, 0xc0, 0x20, 0xc, 0x0, r1}}, [@coaddr={0x14, 0xe, @in=@remote}, @policy={0xac, 0x7, {{@in=@dev={0xac, 0x14, 0x14, 0x20}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e20, 0x0, 0x4e22, 0xff, 0x2, 0xa0, 0x3e06f923e635cbc2, 0x32, r9, r10}, {0x800, 0x2, 0xaf, 0x5, 0x1000, 0x7fffffffffffffff, 0x6, 0x8}, {0x7, 0x10001, 0x4, 0x7c1}, 0x10, 0x0, 0x0, 0x1}}, @replay_thresh={0x8, 0xb, 0x9}, @mark={0xc, 0x15, {0x35075c, 0x5}}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000080}, 0x800) connect$inet6(r7, &(0x7f00000009c0)={0xa, 0x4e21, 0x2, @mcast1, 0x5}, 0x1c) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000b00)={&(0x7f0000000a00), 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x1, 0x101, 0x0, 0x0, {0x1, 0x0, 0xa}, [@CTA_MARK_MASK={0x8}, @CTA_SEQ_ADJ_ORIG={0x14, 0xf, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xd8}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_SYNPROXY={0x24, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x5}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0xff}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x6}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x3}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4008000}, 0x40000) r11 = dup3(r4, r8, 0x80000) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000b80), r6) sendmsg$ETHTOOL_MSG_COALESCE_SET(r7, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x2c, r12, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_COALESCE_STATS_BLOCK_USECS={0x8, 0xa, 0x8}, @ETHTOOL_A_COALESCE_TX_USECS_HIGH={0x8, 0x15, 0x4b}, @ETHTOOL_A_COALESCE_RX_USECS_HIGH={0x8, 0x13, 0x28000}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040000) getsockopt$inet_opts(r11, 0x0, 0xd, &(0x7f0000000c80)=""/133, &(0x7f0000000d40)=0x85) socket$alg(0x26, 0x5, 0x0) pipe2$watch_queue(&(0x7f0000000d80), 0x80) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), r6) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r7, &(0x7f0000000f00)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e40)={0x60, r13, 0x300, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xffffffff}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}], @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xd3}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}]]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x4000040) socket$inet6(0xa, 0xa, 0x401) socket$inet6_mptcp(0xa, 0x1, 0x106) 1.50184004s ago: executing program 2 (id=542): r0 = syz_open_dev$tty1(0xc, 0x4, 0x4) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x235, &(0x7f0000000380)={0x0, 0xf691, 0x10100, 0x3, 0x2b4}, &(0x7f0000000200)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r3, 0x708, 0x41e3, 0x0, 0x0, 0x0) r6 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000280)={0xaa, 0xf540c559b4946f53}) r7 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) memfd_create(0x0, 0x2) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000a40)={@map, 0xffffffffffffffff, 0x5}, 0x20) ioctl$UDMABUF_CREATE(r7, 0x40187542, 0x0) socket(0x29, 0x5, 0x40000) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000240)={{&(0x7f00008ae000/0x2000)=nil, 0x2000}, 0x1}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000100), 0xc06620, 0x4) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) r8 = dup(r0) ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000080)={0x7ff, 0x7, {0x0}, {0xffffffffffffffff}, 0x3, 0x1}) ptrace$PTRACE_GETSIGMASK(0x420a, r9, 0x8, &(0x7f0000000180)) write$UHID_INPUT(r8, &(0x7f0000001040)={0xf, {"a2e3ad21ed0d09f91b5b090987f70906d038e7ff7fc6e5539b0d3d0e8b089b39366d07060890e0878f0e1ac6e7049b334a959b3e9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5bcd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39dd0000000039ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d877a4eddd5d0fc5a752f9000", 0xffffffffffffff52}}, 0x1006) 1.290850787s ago: executing program 4 (id=543): setxattr$trusted_overlay_nlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040), &(0x7f0000000080)={'U-', 0x7f}, 0x16, 0x2) socket$can_raw(0x1d, 0x3, 0x1) (async) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x3b, &(0x7f00000000c0)=ANY=[], 0x8) (async) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0xfffffefffbfbbfbe, &(0x7f0000000100)={0xa, 0x4e20, 0x1, @empty, 0x6}, 0x1c) (async) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r3, r0, &(0x7f0000000040)=0x64, 0x23b) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000ac0)="ee", 0x1}], 0x1, 0x0, 0x10b8}, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file0\x00', 0x1868d, &(0x7f0000000240)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x3e, 0x0, 0x0) (async) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') syz_fuse_handle_req(r6, &(0x7f000000e0c0)="f1187c2666e938b0d719606210914a175384a7d8bfa08a4ce1a6704c4c59dca5bd31c2e0daaec1bf1788b64cc764755c8227d255c9fcb56cddc8d23a8719578a528df745f0862275073dd2c88521736ffbb58e980e9803aa1406002487d226afb38483a478d98869748c28d604cd82f416f3c4f2071aac0274092945c94a4911345f1fb12c47fd864cef4bc44ad5fb5348fea8246b3604a4c9c9a827e4aae4f7677d023169ef281c43f5341372d459170f25365fa911efb58b1a0c883d98677cce26aed7f8410a54aee36c963dd8f82fe532fd73594ee6f83265b5fbf2507319d73f87cb6d2050a7b1e001ec563d4170d9ca49e019c1f34a3f6a29e4adc72fcc343bb15caaa44814a11a621d682070b253354508d7b97b1439ad827954b305797e4de400c046ff93c99fa15125daa8b53581ae5392373621d5beffde817abdd5f4feb80aef8cbec83ad2a830c773ae907c19f5385e77e3adc425fc5d8dfd53312af6cb6556f8e3d871add2dc48a37fc05c65f32149a0ac179386d1016590ed19baede89d890902306e3ca40ddf9ea5f54b51cab0b6bc1bdddea7e6a64746cef6ecebedc1c51c670b0af450099c4052caf1eb0d4137a74f41f101a604fe08ef524e12f8f831c30e15da0947f6f584ae2ad96de45e3143f5a9dbce67edbdf5904a0ca1db282fb70dbec4870f6aeba8a74b24900d7c5a0758afadc26ac6f93695eeec1611d7a1123098420302ac2ecfb31bd545695b61c9f36663cf7ce86cd7ac350670893acf0d065fab2dc2ea43505b261393d285fbceaebe30e0d1fbf8baacb9eaf9f6ca84c598c5604fd4b11412a027760671956d312a4cd2e2dd54100519a0a8f93f5b229728bac624870cefd815a6b6d1ce8b06e045c47ee2f91e3524493df21f46cdd00a60c39f49d29965dbed6f408c42b29a3f76e0f840762b273628f7834397bb37d931231ab16f6cc7bbb5caac7a83fc5ac8c67b120b19d8dbc3ef054e7490851bbf11c4cd19d8aad281fc054613050013dec6821e034f10413f96e289f81f10a52fc941992692b2c3b849d949b5c6465f335cd7876caff414d0a00ec927c2766c83249ca5e2d5dc9a524ea5142375bae891c8bcb34e8b4044964b8141841c619c6b1da249cf65b9c16506926804e4e388b60638c46128b43ab76a32659a5e3fa64c75609e31cc2738392a868434d9108c7710d72f8a34827943ded46328621b39b646cb663500467580b76cd6ee0217149dac6168499edcbff45193f49bd28fd105740f641f341ff8ded97ebea072d805062b35819f28541423b0e16ef996323f5907b0b2a0703e9fd5c6a511787cf6321a87f648170efd691aede0c178e0daf53da03829e4e7617b5b834c6b4196d926c7d7a54b9f1b3d3bc09bb7f22fb18f09150e34bec2102eafe634e13454a9d5cdc10da8e880cddaf892af35c437768b62c73f67ccd8764c34669a91f9d669fa1ebcc4159e4be7d4e589a59cb70c1ba77ef7a6a2c6fa4481c5f2c025ee26e24ea59215f971b1bd22af51af1334432d149a9574cac0d4cb145de1038fc37317b947fffb232209f8c65dce28179c950c7b23bd1052db323662512c5fb41acc84c4e42d1daa9be21e6c1d22b6bedd5f28d2241afc578e2a33e12d1b1b6427c620ce5d80c4a5ef351b2cdaa598c478b56bf79d9dcb8b8556503c66b44b27e8df8e046469a5da9390f58144b8766f9f51d39e8d5bd44e1ad024fed57ec1a3b18f04e6bb3b011f1b23031d85c498766cb10f66e3868a76ef1e388018292fdc4435e14bcf7ff6067535ee3764d8deb725cc0fe0afffe4285958ec9595ae5c5cb04834d15429435272e5b0510f246ce806895b85ba2f81912f76f6b955e28febafbd0c2e854479c4a6150b85c05bd54a1d0d37877e6fd3ae20046380dbf82bf9c8fa8a8d48f76cfc376fc9e0e4fdf0ccb785e9833c6c9ba006f7e59318ac733c3a1250f40ceb7ac3a167727bf89daea038372e212f02cf677a009cdfd224b41fc3c142b0882a53c1b9b7de6e99974d80ff8506c71ad3e063d7bc5c5366042b1cf952c6f76fad74fb16b9d9c9804589ae4f4afbc7bbaa340c1093d76a01fb254c5ea168e83b39bd3c97b8ace4f32612b63e841fd6eb304a663e4f43fcfb5f435716df89146d0ebc0c1517734ca4c90b9dd5db6820a4d730a9a7e6748d0d2b7def30a1c242fa36f52c3f685555b0828e1dd59023290ef4626d3759462cad9371d72a9c63824c91d5cc304ab43279f199811a604c164493793886b643ba6bf53d0a9ec7e304488b18bb2eedde5c128b2ef0303f85ed54875e38d4adbbfd477e8fe9a2217f084000813aecedcccb1dbe482b4856b9ceecb28d40bde5e8376eb8c29dc71b85d4b345fc411937234b318238e962f0d5dd46fdf5149685cb3c4f9c2710f4173f4ec616f7036ccf83ba228e1cc7b205cde9b57f00502d4d1c2af6dffaa37ad30fe0f5d955cfee2e00f48cb7ba02ab86748d0238914c66ca9ad9ff0e8b397c5e527c56b0d63a9b5a7b1da19424bc0c81d627b1389a42626654d901eff0f37d64e0cc894ab2c4399c67b846839a1c40033f4f9ecf8410fc63672ad471253fadd976df6510137d903a76ccf14509dd8839024608d707c4eb69cbcd5ba9cdddb7fbac1c963a99ef6e75eea8924aad62d6aea792042cb372131a83730a6ee7de386410d91697dad01d85ffcb22b3679573fea63a38c192b1b1e3a722adacaaf8e855843e1366763456c86ba9934302e0abfea2044386f31c457cb7ff445d7b00e3ed7d1dd4b2f92c845f65af3a3f68de96dd9b7bba62b7fefb52639b6796ca56d902f9dad52f42a1b79fc814c8a58033daa9f43ee3c540cfd08b0ed21941d67dc3ee37fcb855fa4a03453833714d8f8abf83256c503713adf7f8aee122cdb01d0ed27945d42633b0fc3b2fd51f8a9d403e792c9b77be56c257110669b46bd0f8bea9ec7b895b0b1bc9a9485a51e72763c3ccaf6210af7652ccd437722b359d20bc124e7055c5e41ddc5eb66f966647a3b91f1c51f3c6e340d6e203fcd30f39dd0398f0a1c9fa58f2da697033f5988cbc6e5c8e1fce7904112964b2ac5f938b9132d680f3cb0d8ec2fb65162113462ec459356bc9d28d9efdeb9983d79ed04da1a78f02ea8f5b42210a23d9c98a734dab4069dad2a532ebced93f5dad2ec9290b0016e6db7c3c9ca3ebc71d805aafc113ac93d1e68c637000879fd736cd8a42474e607da884df065a06f4d64054512a396d99cb7dfaad6a91cfce8288cf995e83a1ffd2ec83483a807c7ab3d0703e956222dbbc2fc5d57661fd186626b41a2e18144d592174cc8e45f1580593206e6d7c7f3236eeb41aa772e663834768dc21a4c216490612e6e912ad48f1d90650f1a9a29239ffa8f00747833038b75e8759c50799eba59ba58a1ddd3d9b49806e2c7ae143e88f704d0a5556429445a41ad83a95e43bf32fe2f6954ca030a3f2697014cb351c89cbd3d2792cc73371cae124e5c0055201036c7c0c73d94215214b33234f4e21071743cd553b8d96e3387151860f5143f16980020954d80b7f60955f9c09a6501e9d0eee4d8793e9ca2d04a8aa6831d2e54c0397c6c9f2486b79d06aee46f064c02e77fc4bd7bdf31b9dcf520e26ebb7a02ff3d9eef1357dbcc83877f5613c7a8c4e3a4636d2e0161a663a946f651cb5915f07762d00c62d2ecb354d09c2088c3de6b59b5ed0002a1fd5f7eb316ab62fef44af65abb81f96f495f867e128e8829a3d2693e00a5b2a14a6b76dff7c1cd80e26dca00482b3055741fcc7973e33346264f268e22ee4a74fb45066eb24cdbf71ea7c69d3fe9e9ce52dcc7e9b0645474ba2a635c36a83135cd98f892c2619a5724faff0aed7e236cad81184dd05dc5645c7e7ad52ef76d615255b2936bc40f0ea017035a8bfacc18c7bc52ec0e29d70126a6e912c6d06856a12ec2792738a9a1c2b2bd1e9b39db4fd115bc901e0d3fba472ea0182604cc9e73cc772117d49dbf41c7098076eb0867d8eeb7b927701bd5cd21bc2b32e4ee2ab86f143770b4718f7c9ebdd32fdef6170ca284d4102360242f4d007fdcdd8fcfbb90e7d9b693fb1101dec0fa152a7417f70003159ca3633299cae4035793aa7668df47b09e0fad406e278a6105bbd2b9a523c1a8fdb394b9de39d3d9e1ce9d9ba717014dbe59855a92ff2375a3a3477c8bd22cde51e5bbb738b92ef4f3781e605c24e7140b2504b59328cb8e20c5c5d19acca392bbf60194e6257f674df0f99945132d78c76f182f2eb52058a908abf568352d50a7aa4d061380cc58cea53f166a753ffc4a51e90a0f46104decd9eaa77d48300f2c7901465effda4fdb0e70f7ede3541890732d4ff10eef7745ca362eb336febc2609f50f237eac6d4950593bfefe0718ae3bbf227ddd524178b39ce4341e68e4c1e5c65b506b73965c5e6ba8e7472d3b573d41b4e458c97d1f0164376cb24fdc38bce00df871938e65f46c3df4fc20e574581d6631d759c316af7f7709e05e9dc465b87234029ae78f071d892d5e7ab7fab90cbaba55acb3e654a18a5f0bf79d6e471d53b5fca51085a65534dbfa953379c4d4a0022f03da76fce767cfe2930992935ea897fc56dc23d377004d119c9b648986e402b035b7927e567db9019c915c0ab54e6e45435336e37d974a7ea3dfad73915badda2e0c32b87391e3226ef0509ec6a33462a246e62e0fb83065db0270c6c026415dfac7be0e7b1e790631347665e789ce6be41e7ea32b987465ca6a803508a52626d92858156920f841da0532854cd5c966f02911d10a4e12f687801d7b87891e0d7a1ed0279e3cbea3d73b3886e798d39460ef71ebafd803e3d367a0c67c31d502021a796e6c351caca55865902dea97edf28ca7f4da37d62e17df5245e52510e1d5bac6851e1a2bb2228aeb6add3c07bad5798176145d1b46d5ae3169581f2286f6ca3b09ce4c44df0031d6ed077e6af6226b6e21634037079331094fd3bcd0126d5c88069d1c240eba9a4ef943552dd69a2786301a0d94ba5f4afad155583d81cae6f68e600979674d05c5593ada14dccf11745118dfb6da366a15655469cc0fe0d31cabff9a84e40896f8726bb64bb0c548b8b7a7c031967ef8a38e85063eeeb48d271aa893cda1c66204cd3b2c35e27fa7dd972bc396283e24671b9f4c1bd9a4dcf30c8887864305b3f92ec1e678f85d552d411f8c2012bc77ae55d6d8a7c31bb6a9b80a530ef2900961a5c59fa0716f5b6ac2aa5b2313b5539414b2abb7ea3f7b4044e91e463f02e9c51891458084782209323df56148ed89c83d2fc194c127e47ae5bd711f5b130e6b21775090c6156cbe9737b33865b48489f4533945c4b9491add986d3095956796c1b217bf6b09ec63958fca7a9ec6b5435bb3fdbaca8a707c37ba79098c47cd9208351b54e292509d4bc33bf40eaac6caa9f94d0918a7461e6bb8e8b259d3d90d641dec6612dc14b683ac4cbc217f6d108f666e66817867c70f3550d1ce37daf358cce35b8231fb70a4b1e302718163e5a628e8f653eeb25041290ef5f5289ec33dcec3bece209afaf2c4c8ed6145768ac945034473b01b63986f9882514722dd85df95448be18a59c5408ec8c95d203e7a4aebc68999c760d3f3929d0d28f7d8d0ea7c02a813515c5a82fc04cdcf20654c91af430aa34859a77eeca938842600afc6035605a0a9c01acdb164f2b2c3d4d7534c5292d08edb1adc446fedce1a14b7defb274851614de5157e8b5864f7ad8bf6d2f98515c07171afbb8c9d29a2202087bba880441bf68084d5bfdf3a7926ea2767a24bacdd5a6b98080b044071b3c21854333b84156771bbffe0458aed18e110ee0ec37f542b53afd04b76bbce6653d49434f0a8fe97d11cca1b211922bc48b0fa7526693889d0ae2b5a5f7746bd20803db5c57563137910efe92c6f4e0417978ac3af913d46fa9d49acf5f84de8e67f90b409bc78c30b58913f0149eab1629c1e8409190894f2591e208f3b61ed699670de4621675e9ca789cadb219013682d0655b785065dd4d2193f0a81b84f27330aa7a06fc09979239eff65b0327bd7887dd671bc4a51ca7dcca404fc24699a7703bdb1fe4b5175760f682531523ed75396e556b391b627035bbd9e323a004ec1875771b72f02af7711046a16e1df4fe22c8cc064bef1a401a430d2ed959aae3ab82db7a86b74821ed07dcf98ca76070b6e18fc749ef2ffeeec9585bd21aedaf8c05918bfd2f9ab1e1a6f023c0f2a2a418f5ecf711526525a165652eeab3ae16405ed177706844d1ca239f52641e0a66d89565d0b83cedc51d339bcf56ca21203fdadafb447c0e337496b2c5318cd5f44e6122c617387f85c3a6f76dc4d437e45f790c5f489bd56e56b8fa1e3111806429cd4ccf871b887ab9d8ee379f4cdd23bdbc476428ff912adcf7a84810c81943a778e57bbc3690911b5e046988dc85b7ccd09b7fc061f9259369601252aaeb4863d8d57796f1f4518130c911d1a331953663ef8a80fec491308297ccea77691fe14820aca10c6719c205988802791a54348222d6a34d9bf656696f396b27cfdea9d5b0e36838640d68ebe3be9ad72450232b66a5db274087e7a350a7d6abd95adf2557ee93154a966aab798b45c2fb1d5fa1f92db67a5bb2819e580dc15955249065189e4d1621c4517a67a76da14090a90b4da7272f57acc4228b49a1e5dc30002c11d03df9b60c382c026fac97ca1e389d6bb2af95494c2775b789988860478cb1e0a0e8e6a5b823fcaf6f8a031983408624a301bfad96784c9fe217e0c656cff8b65b3897a966c5ab572d269e30124ee813ac08ecec1aa40b73a3149e0647a00c612c0910878a079b5c163029435356473beced7fbc6ded2ee3e313082501fa91dc3ff05e4be525212ab350dceb9ac95c4f1db5399ea008b8609cb0c0f1a1319b9de77bbff478c197b9318005cf401a84f49499808fc403ea3ff9e1874d5ebe7997a0c03d977542c1877348da98f1d05641c9debd0dbba6b14ce8a83ac11de52ba7451cd1bb75f58ecc32676b3d00a76ce09e5695380ecc2e73f44ece11f77238d39696572e46761c7d5e638e94693591b70fffd8ab98b3294fc2614e3ce31424947d0515baeab18ca4a23d479fa0a55d2950082cb770dbc34e138e9469f218a657dcdfee84cac9131cf6ad38000630aaf3fad747cb1dfc777188bafc927e7371ae2be48772afc09b7937784c8365c0ac6caac7de7ede4202ba8d28b18e6d20a217c30776f97546dc65822ff02be3be42f6043f828927ddcd693a7b691f9312aed70b5346cab9ff0d21e8783677bd71cd1b5e4975e588e121a90cdb6b4d3219effc8a868dd110f5cdfc119c121c84c2ad04189f84cec8f7d98d71ebb1f9793af002e2d645d7cfc03e3a4f61c28ff69f08024a93b8c712df64c83859374ae6d5575048d7baa3a0fab0ec0ecc731e3523d9deaebed7de16e9c6c453093de8738f8d7f4a244a6f15432cb494855c6c9b840d514af760c73b88099a66fc926b2f05befc766729f109ea436bbbb5ce2513fe654d7e0b379b49ed555cbddb8a690132417a31f48e530449ffe71d1f851acb1bdf245ec02dd39925782511c0d8930f17a14c54906d96a2daf27144914135cef344451982b50c71c1e5bf7d63f646fbdb749e2e9ce8e84ed334fb90d9ab7c6e7b265bdff840606ec572b035877e7d18cad3fa246ed000ec243d38da351fbea47a54dbea0942fbbf3fd9b00f19c21417159eedf477eb6af4ea228cde4ed64cc2d6890db81c74e5e08720dbea0f5364c1923cef7e0a883188a99896483d2977646bc9ebe9c8667fa68b3aa9cd961ad1dcaeba799eec564d20d771390c2ea12eb8cad0575d08320515c790155dcf477952c72c536e1bb2d6bdca553b02d23992129ce65d520c9f38bd385e37b98ac6c6974bd1fce4d53a7d11666ab3c04b6ff39f93ea50790aa027062d99c1486c5c692eefb05c29737b178526c91b62595f79396d40f2558148dd72652806ffd9fb334e744a2025070780d684dedb6db564fc76a5cf6f75766806e5c644bdb58c6c2aefe02a523f676aef200a3ea928810be43ec4367ec203edae43eedecb608cc48cde469217e36002b8419ba55ce00044a6d3590ba22c77001347c1545d07486d6a5f70ad9561fee62ee4eda80953218711d68ead9b38f3ef1012a952a572b38a5c90536754717799777574874b45e0b39e938ab2d31823bb1f44f965e225be271b69a9ccb32da2df01c65401df771f5e3e195ac977e627e3c4b522928d95391c1f6869ec2e340caf3f336e246d042da8fbe9702980babbb45067d82abebdfe34e3832c123575c479b66a33e22e47a5d8f7ee3c40fb538a3bb7a08ec13017f4c58f7ef769b7597f7252c8b6d0e4bbcefe0e32b4c1c92c5da2506d2be19bb6f71e662fb81f016404c96c50e4ad61dd3ba73746ce0489136d3b0414992f506900151bfbdf118a0e2f998f893560225da2c19280238cab9a986c747a265b22c0d6473f8248f83a3e155f4ee67cbde536b3c4dce586cc8d8ea15e55f3569ede91d29f9fdbaa88d20909f3dc3450e22ddb91722ed6e42f515db47259b74e25966408f4cab33177a74a038daf0967864330fc0be9f1f2b685cfa288bf89e72fecefca841fd0564a47826e586b6d4eb8dacbbfb0808a3255d5f69a8c56ca6e17f2041eff85aaa4eac86c1008d428d91237ec5e2cedad5383703ea7ca8e7dfb483ffd8e1f2abe1a90af170660f881f6cac3025087d72b6454bbc3f8b7308a27ee8a6e8294955903b0a69f66dbb4b6d7dfa2e726ebbdf91908990b042bd09ae9a6f6cd39a4d626f62b2efd8e85c02adeb492a9c97a4e883cd2660b570d0cf5b13c60fb58d60f07ca43b2b3a21843f85801c8d824d2bee451b86db0a61b45142a397372a3deb3bc10d80bf4f9907f5f3200c65f9cb6dd6411284ad5f7b837cb121c42b99f1e517569fc12b2606cb3f45daa0597a8aec824bfd4a31e4b17d5715ec48e8b9e666a5a9f881884b5d06cad31f1830d76db5bae7ef1833b727f6a15c0f32b8e561b41d4f286c74c901201ca52b95dd2b7bc930f5c7702eb282f4dce8dbb37f5137996967a07b0131da890e27edbbf5f5bcd3885889277d6faca161a138460fd1e70ef41179389c87338eb9eae94f2b8167e7e0683836b6153b7428ce1969da01b096eea0b4e7d5d85bb96037c17ee9ca630921367f17eb83845264fec0ecc866e58f845f2f32be57ea9d5c2c595f82efa6608c4c8946f0f56f3856fdaf3b8c0f78a017604521c727a136c2ac28c16ae19da2482c199eb7930fda5198f8269c774b8b2bd769c377a6f86416c2c3579e57a329e74021597aa1ed4e6da50806bdbdee831101cfa13b97e99fd512e43fa414f7b4cf1262c16b9e30ac4c34b108355ac16b6053751fb8c2f4eb4bbf7edcfbd0184f2250344e47bbfe9ca50f0e91e65c78270c58603c20679d739b454d1ec3301fd6b884d00d7539bdd3178126aca8ae37b9d8ecfcf14e62e653864d3ee4f1fae9ffb2197ed8a2455c90359b6a09910b79c2822f04bf07b6a27e01c9f1883fbcd08b7c26d7c8c25271338914cbc157dbbd0efada31709841831c71c1aaf111d0d46845d9aaeb7249dae34fdb050047ac38fbf0b746f33d6ea0baa5d4f7ddadeacb5831b7f9d5e219e4bae55d0b8594f52f0011badef967afef02884ce212c3341c340ee8fdca78e887b7bf2a98c31d1bb8a3969b8b4c939c362cd3edc19598fae9ccd82c88aabbad4c4ae278aa1b59d2003375cc932210f4a636af6c3126f200c8a7ac82d8226f244661ac6d73aa76edb53fa5b2216f645e873de27fbf580c7148fa72f992a220d1d4f499779e25c8b996c580a1165848d23088a6369957841653e291c7f520a8665997bf958ff7da53bef74eea85e3a1a3657945513137351cd4aab8499f23718abb8f66dd7d60e9775639e32ca1e8faacdb8f6b66d0b1b714af355773f1aed034f2e4cdaa17bac308dfd889bf123762b5c894de392a3081af84195438fdfd1868e2d978bf3ec1df5e81b9f8f6afdfbe3dc344f2a6dbf550080e403690d2ca7cfc0244014939aa79a8b3a0933e2bbc226385e3e4188a1ba2b37c34e02fd28c31f2c48d1a83294da501ab012d1d5e5fd26cd41ee71b4a150cf784486f9f6b5ab510cf07cf9792dd9e4d8bf48f06464fc957885d346fc501f21a07ac7fc71b9c01519cf4d2fa766d15eaf459fc429ace3a1a61ba078da7324ac06e65d7f36271f6898e8ccd673edeb25571c44606d7bde39d5195472e727bc7e2a2d1578328cdaf90400a7843f31793ad33d0f32885bf9b1f0e56d4a3ec40a1094e0ecec32a1712b88ff3008213795ffece882254753011c6988931fc9f19b5ad0891e20887b47ccf460e303842bb4c0b62163868e805b3bae6e4937a476e7eafe9fde0d0cf62223f714c69be6833c10d06f91a78016b1c00087415ac4a5b7b5e10f98a3e19adf60d56d5bef918c1c7ebbf7cfc37130ffae2ad7a620250c738706b7da926f34069b717b97bf2a0ef0a2bf796034e88d30aa4235744a1aa5601ba718add8cd0cf38411f4787cd22e21dbacd9e480b13af38477e70d2a4800f680fa7cc8684fd467b86555422b1a901144b03e4327b2573769cb02de90e8e30df7afd2e571e2946d23a0efe02bac8e9698d12589378e28d1c36ce328a27abff98eca7b6da95daa681700397ce62c9b50a47cedeafd51b62e953413639a9d9978fb3e1604027751da66b5e481ec1e4697d64a4477c67ec2967e2389b6f716f77c810a62a5fd78c69907f4a4dc210db30d5d4e9dd1a82c9ca1f0dbeecb33a702f4860426e7d1c26d1a00ee4c62e3d671d545b26aab8ac758c53cea2250ed929aa715bf513a5fa242b78ddbc263990c42025ba2a52e368f6a18e2cfc0a6047e7f0e7187c3e36d61905cf0cf824a08e5c240ec56b04c909390322ce24f35001e8d5a599ffadbe2a8755920cc488f40be225110310d4e9e4d4cfa34f953c6f6cc6a5f8a89373739dc5da9445947fb58bec2c8e5b7f8c349d6df29e6a87336dd7bccb036139922faf14f3eeb92ba12d0084b1da8d36a3f9656414c0f32a1b2575a5147568ad96c2125701fc67d00e9d78788bfd0188276727d568bb0800a576913dbc5c1035fbcaa5359bc9b7fca0ef528903250be1a942e59727789ec61ee1ae617c3a23d3a89044a9ec729ef0cf7ec6a3d01e06e864c2e24c38a8389826c2cd471cca5cfd18a34050f24b99dcd26d418465a5e3623d7c9dffe7e65fc25f90710f42d00fb81b33a2db18d0ff7955c8d87ba8fdfe1186b638312505c7810dd0ead9c7722fcef542d2a73f107993e3ec78d3a0b15506ebd4d13a72384f77268b44c32a957aefda0bed253e76cb09012f104bd0c1f04e96b1fc60d08eb79ce9216fe1fde6ffe65d09056c9643ada21ef080b9da75c10f71ad334e4d3b5d3a0e55bd1ffcc18259cd28f6bbdfab16575cdcce86c95f894cd001e795cdaeac95c90d1ba94806ea2fdf45906eb7a2ba0613503f7aa7397e78c964ad3251d297ea76d88b4221efccb2c", 0x2000, &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/custom0\x00', 0x800, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r7, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x325000, 0x800}, 0x1c) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0xfffffd02, 0x0, 0x0, &(0x7f0000000140)=""/55, 0x37}, 0x202) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) (async) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xaece, 0x1) read(r10, &(0x7f0000000040)=""/8, 0x8) 1.289942894s ago: executing program 5 (id=544): syz_usb_connect(0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00') getdents64(r2, 0xffffffffffffffff, 0x43) ioctl$TUNSETLINK(r2, 0x400454cd, 0x118) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x11) r5 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) r6 = syz_open_dev$usbfs(&(0x7f0000000140), 0x76, 0x1701) ioctl$USBDEVFS_SUBMITURB(r6, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x44, &(0x7f0000000080)={0x2, 0x3, 0x17, 0xfffe}, 0x8, 0x20, 0x3, 0x0, 0x8, 0x404, 0x0}) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000000440)={r4, 0x0, {0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1c, "339f020bbe78d09843d601010000000000080d0ec0c1b4e9b1c4369d03740250ceaac594b1b3c741dd17c18e8438ef2a565e04603323695c58d66500", "a1163939c787a16c1ca43f8539f3d3289737f0374c72a964a0193b3e8772fd29f35239d200", "24431a1e77a68e174f000000000000000010e200"}}) 1.119838453s ago: executing program 2 (id=545): r0 = socket$inet6(0xa, 0x3, 0x5) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r1, 0x6, &(0x7f0000002000)={0x1}) fcntl$lock(r1, 0x6, &(0x7f0000000000)) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000280)=@hopopts={0xbb}, 0x8) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000480)={0x2f}, 0x8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="600000000a06050000000000000000000000000005000100070000000900020073797a3000000000140007800800124040000000080013400000000014000300686173683a69702c706f72742c6970000500050002000000050004"], 0x60}}, 0x0) 1.081183807s ago: executing program 2 (id=546): memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) socket$inet_udp(0x2, 0x2, 0x0) socket(0x10, 0x2, 0x0) pipe(&(0x7f0000000480)) socket$netlink(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$l2tp6(0xa, 0x2, 0x73) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x801, 0x84) socket$igmp(0x2, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0xc) socket$inet6_udplite(0xa, 0x2, 0x88) pipe(&(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) socket$pppoe(0x18, 0x1, 0x0) pipe(&(0x7f00000003c0)) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc00000008001100070000001e000e00800000000800", @ANYRES32=r0], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 841.548429ms ago: executing program 4 (id=547): socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000001780)=[{&(0x7f00000000c0)="844e48dc9be56784a45c7ed3b6bc9d69d1d006daaa21671807e50bb795512ddeb62fd7b38827c68e091fb9ba0b60d4dfb81a9ad6ddfd4b02b0be60da9966fcbdb4e7e92434a0283f093c7b146684b4cfd887da8500922d71fd0f879a0a9974758192d13462ea45ff8b51f0dbc69e7eb1e05c7aa797ea48e5e48ae6bc8fb51dbc9d03b7b5451c761d9ea34eb6f7b216baac939bb68c60d96787afd41b8b5334c221e56df5569f78e94e565f65", 0xac}, {&(0x7f0000000580)="cfcb76eb597b78002656fa175712e6191e7d3eec872d5c195a3e96d4f8b566a958016474a2761ffa0c211f6b6d59d7b94a62199683deb35d590e713d31b72c5f06105cc39132ed8cf75f4273ac5ba21743247fc673783dee4b5bf3ef54f2976e6443123c91656c13c60fd4720deddbf3be29373dea50ee654443f5d9486283761122ba0671ee8dbf552ca0202d4e7b57e549a49f64dc917d7ef19bb828e726e175ac3cc87982a133968c6f76be1e09c7a3ccc791c98f214446f4ab61477182619168410d59c9f25ae22c744da9a73993222565c79513e358ee98d40640cc6d601982142cf88ebd114a1d553a2db11fc4f6fbeb47327fffe8ea7f9ff41a23a2f1c9459e1a565a637a6d012a55a38e13dad79d401f5be45374a67f51a836fb6311b74dac7abb898c6ede11e706cb1f7b3134f94b58631a942551326f9d5d35321198ee50f17b33ae9da97aed640847f558175f7dbcddf1c1eb9f645c684664694d18f076790523ad5d7f4beb5bb0bb4b3e84cc022a047e581cdf3ad0b7c6677001bea3a3150bb47f72a28cb5f4d79dfc962713d9633d12d61f9c547c17527a9a284e3d41d7c5daf467e64513c0dd7ee7d265c3f519645fea26d8f20a422d7abc739974d2a23bebf7394b2b0062f6989e6117c13ff4958090816402e52e58097c194c3cbf3ba5925fe509adf8af9fa7c82a14016c386199b6fd1b87996aa0b265ef9c7dd67048c4ac70e5fa073affb49718725c16d37c419f6306bef1061c420dc4bb3418e7b6452c395831660d37eb1820afba0462c0d7ffaa0c81609efd7d3635dec79502e5c3f4fcad01068b28b16af5337d5b45481aab97ecffd952737329c5248d4ad73856f1e7429a7bb37b2d7e87ca56ddfea6613c089c1620e4111664a43fe841a4a12378653efea63d119d21bb64d73927f4be11d88013c9e6ac04fc03a684d76b952b9fce7fdec82872f592de4dce04b45003c93fc2da3568b274ec4c157800867ed072b036ac65182f086e7a9dd0b2bdf22a503b7d400548c47a0eaf84d1c7b1e32240e5ad0422137dd3616162f0db23183610ddd6a4662096c5883ed751cae6bb03cc4d8a8afe5788aa7a09bc640e9fff6909f365915c4eab81152981b3696f9d6f9b828f7b0c9bad55d52fe920fcadfa999e1bd12d37a7daa44c32a3c3e7fdf07ee94ac862bb8d4f1d412c31ca0fc881e5abde7b4cf521aecba2333ad297b1a0ac95199816557de1864e006264ada5bb8cca98679442b1aedf3e35d477d1998733d01a1a831ceb038c48989e8b41a4bf3649ca97ad9c047344afb9a9b4c9b45aa25cba526d78d22ea15d14622441b55d57173f32db470e8ddb42aacfc3480ad7fd60488bae35e523fdb2711818a30405d7ed52eb06632c80a0092c1d40e5be71729df3c73235dde6c11136c35e3505c3b942dc3a2a1b758e17fcb09fa3c7a1fd0c9ef723ea65439e7e97ed01cd6a2e45a529a54094cd2bd2451d137d8e064a8bf6a3551f65f453e64ae32deac0a8fef02df0ff8575aa64a42a6e226ca85ba140597ea7c8c9dcd74ea2cf61330ffc4896a67b05d261cc5c3fb40cdeaa083a588d2e5591d98387f5d545e4158f51a513f23f0f9bd88a1d71bfee4a09357a4b63ebe8c522c9cda17a9dc7ffedf0d8da917087dddc9c7a221a693ac22760338d2767b332f6cb9e39c4b5dd39e33704fa11cf063a49ba2cc0eb46576681a2adfc790b4f3f59d9ae8fc33b0b630d01acc2ee6c1306fc5eab9347fc88a2f25a59bc45287e3c2b51924475c9a25b6e045767da7c824a1e069119e1e1e3c5b7bb9ac9ca306387c2ba02528e6a20f6497ea45718a4c64b61d1585317b88bcaad660254e9ffb8565f51a5adfc3440bfbbe3304bf974db31209525aeb8cdf5fa67ffb2718b2130129e04a8892738068bd01248cc74d75137554c2fea729cd6e0a7b2fdf5b74c63f40590d0b95506b9bdc942b9a83ac19721bb2235d13376eb6f65c9f8c142828ec29f16e425cbc6951e3329312846fc8903965000747b1fe9f9a2b1d7d6ca105ad2a53e58077137aa67f4f170fc0e0c1392ae43c1bfe790581074b6ceb69abe641fd3600fa9a1719458c9e54f53b706d6e7a6ed1c5f3da27a403785d2454a223c2e20807b9797d34521407d9bfd7c7b7148d4d9ed96b7b9795b0422ce0cc27dd93d9d8b7e6447823ef728dcfc4f262247a3ba9d0211e06aaccac50dc6ae2e16050fd60f073e77156afde3c5090659c0ec0a4265b5d12e9d3d6dddfbc9eebd6b11cef953ca02957ade2cbdc534b73545640d4dc8201d173f35b62b73daeaca8175485a3fb17389f134c4e2741d2c3b5d7508349a5dfc8c9a24cd3b574903333165ec40211688b87d5a18592671f7b270738e4815c049caf535b78adc85d269a07b31cc5f2cd8c31eee4a2cb2ad206c718b5fa4070bb44726448911fc2cc8893c62a46b31cab6942d746da0c55be2a9dacd00f85d7d816990bc9e8d4431b23ea0cbf9b0748f96fd04a16830105f64b6d10018ca9aa29501d1966c82730bc2652fae67147212b24c94f25d92091ce0dcc8b722f7ca4c6aaa9fe9bf99d5d8765b7661a17d682cc54debcdb9cb72d0b51a421c026e82a34e3b00b75d573c824e2fd8fd185bd4a92a9bd0f8ac723563a46b3fb630d58a6cace3783f96e8588fffe899cd26c74f1bae8737357e34cfcbf28f91ccd61ab393c92b14bce22ae4c8062cf3b3d45ada485a30cd5adfb06ca342780e63858165cfcf55ae77c1170c98fd19e2821192f09ee882d08105cad3a9faa9bad7d07dfc4a9f7499fe96fd2aa7656ccf6591ef75c160bb01e40dcccaa4678a205d1dc7a003fe2d809cda3799879e65379c6d16dc834848ffaef0c8be6c78afc8a36149b0e90bb6e6fd441908e6297411a3a65722a214cdab388a5ef37019ce78c25dabd531f942a4a5661361c0b69e40e88a820774eedb3ff7b2a5e928907c315d078f99c86a67c82c043f9eb71ad856703c83ea1a3a228021f8dbf239fecaa020d1f1496a60e3152cfdce40422621447d53bc54eeb42f22706773e4a8b621303c88c4c961fb193402fb8cfb7efa0994a1a3e622f20adf96129fa834eb22c618fef53a10ab76f76e3a38db795a60ae8add5cd94c68644a34db35864cc4ce437df0cfdab20eb527b786ac79a5bd737b1f0332102f6fd390a95ee10a1a57e3c3e1d8992c4d714dfbdfce206515ced798ef0d9e3ede29bc7c8799f600a890390fd8c6e582d7264e3d7db739cc4d90d5182bf970c17588ac29a5312af6c729539a007048ad62d7ea3a12354a878bbbfa55311d2d8f768cc627b712462c6f4369906c40e0e80089dd7f98de85f6d79b6730482b0d7b1e30c56f09305d159e026eebd86f3bd725801b0bb8eda46ce6b59f2e7808354404fbb6f5d672be07eb201eeed967751d08be995418e20a3d4b5b032c82d1b9f0f08fafe7e6eecd6d5cb1983c25970f2689712e0a97f369db2b821afac4315acae33a4747f01aad6d3f1dc5a064bab3e745f94cdd8acbc38d154bac6711a4b71ff56195ed5d36bb7c44984c0548f51ee5a3f89ae84d8c89c5d22083d777b6327374a8a11a56be7f8c085846e6fb758f040eae7e6af348b00298a6aa1c91ea58d620c0a91ebf83820c75483a90effb776c0c14fd46283b2e559e2d9522009160bd6fc392ec1e2001152bf2461bb34ee4ce9274ba47c39249dfb30ea8a12dd957bd6c48d1dd2d88a644634f4b30d4aa74be652ae6ac6c4e4965fbc7777f8f7ec75e7a3a4dc744434c97dcff8418f0d5b30b75fe3e5b9b3d8620c7a1be5ed664ea7c92f79ad94cca87f366dcd835898a6153b95bf67713eb2d6b257689efad611afa41c393ae2c8fce5c15294cbb1b9523a334441e5c73eee8edaf653f0a1db87607d6fa286e4df13ea835cb6cdda499688181f07acaef58c2b7fb3ea1e1a6ebdc40d8aed830faec34bdb0f5e79cd56cf0421feb9f0f558e9af9e76906d0c4584edb6c73f8b34629cffcc666e9280c61c40be4d6e760a56cfc27c9e9c35993210ca6dbdfa5a7a4094549ad81f077fa99bdae2ebdbe71bb3f8516e3038b3628528dc3f74ef041e0ba92f270ed1d8167135b2fe4ba864e946755f3d439687629446be94711538bdd9745118e4e6277f0d72c2935647560fc8fcad753d655b5351e642a973c25f66de169f56331322b9fb74cea066f7632b7d1c15f8ece0c2060960680837fca00a77000cb6e9361625fe939407a5dcf4c9cd0fbb512b558c5c350d9279feb3af5cf32f5d40ecd53187192d67ec56f4e4050582f8a0339f8eeaf5d8a591130d760b8bcc51f68937bc678b61265b206b86f2363c85f3fcbefabce3037d47d6632902902fbd917ac096a8b773f94d4b950827e09b6e54873cefaccc481ba6c7ac3449761e841bf16ee0b4fb207b09f75c7f2342dce18693058672d2d0d3256cfd714303acb8e6e29ea86abb7569b7176b9e48a90bc2b981a09af6cc0e97cef8dd845d11774cb3b0fc95872a0b177fd45587bc60cede33e2471630951949cecc7509480fda4f5ca99f109041aedf79e5183e988b6c11d030cd26004f674b933d74da4bb5d1524afdafee1cbd4546baa6a2b374ef1d6fc93e513f0e12647b37ac824148fe968d7b596cd499a775b4f26dd46d6325552bd75cd2c2a7d5b0f687660499a0ad84b9566dc6f817910b143b407a7eb4ce528ea95f283292892b0542946b5e5fef2c0de898c860b41f1d46b199cc3a57e12f0ab3f56b72722017e158ffd279e74bdb1ecb1b4507294344603aae644b29c5918e38060f794f72bf3df5e77a6c2de69ea7f0d51cd2ed41e702c1df6df2da3cb34b2f774faaedefa93c30e6a2aff0d5a8d83928242161030cbcd52d6ed7eb1ce3e3eb5ff695d797e478c57a2edfd850c559a652e9b6cfcc7ffc259ab390cd3051487f955cf195b91dde5468f9363a31ba8310a208d3a7360255973ba25e20b1151ea5d1750272636be9c7dfdf509ce9302654bf65d04c80e507d17ef2821a359c1bbae0a4c0368ffa1f38c4cd4b3b79c4bb6eea8f8cbe2ca4615d8ec92016ccb37da6373fdcf187f9034c27e084e5c4db0967ef755e31261d22ab1f89251b5f9a8d293e251495c1b197356549193d774e6fe79936f28b9f9804485de3d78f6a447b525a9a3ffd01e8e57338247fc6e62788177fc276f4a0a91a5e517e6ca26a7c82a4afdfd9b5f0bf3ed935086092f9ea44b5f01df85261d8f687c5feca908c43fd5f6607c0eda92ea3747151b84df9a10fd54a30ab80f812fe6021f95212b5324bfcbbe96c99a0afa559231c06a479e9483b1e3dc7bd1b22c4f5bff731ef46046414b14cff9fa5cdc15e64bfff7f980dc8df9266fc3c8d7aebce1d579bc15bc774189bd5967555cab3c456883a81f484f8b549f13501d55f640450f355c6a78b94ec2c109fdc257837aec25914e5e81f0e6b46254c8a46dea3b9feeb6563f324a437b92e837095a154cf2d60d213b1dd15d68612becc1b76b3f519d2ac3e82a315ccba5bdec84c961f6a4ce7948504239ad91942a1c108162425eda6d93e1974d0e74fb254f01fb5ebaeb9afce5bce68552b6d0093e8c33760d8957f5051c1f4ae4a216290287a4331e65a4fe6166bab0f08a47d211432095951d8bc7b8def87e905e4b3802e402618e5da8e1738a16d3321098ec6ae80a37174b715e63357b518cf8ac92bb7664763bb986ff817882e3d9c38e2ae02ac52a2febd4cab1c637be928c6284e9420f64065fced2fec86b56dc70252a562e541e04e87e7557ae34cf48", 0x1000}, {&(0x7f0000000200)="6fe1fb3a3ccfd973d87712aac46f4ffb7d5de7b0f63412079d5fb06c4dfe05897aff6309673995f785ea42979639d996b04659d72d3c1bf8b07afcd97f67b56493eb63abf78b2550e25f33e01f05c371a0b6cbdf39e337d0e514881c9d218f64429ba0b525c16729c9e1922dcb06c9de38b1d3250fb37decb2df65b81834081a655aa6a6cd611beacd79021ec377113fe2fb07e9b8fda21cf405ad6fd69a2d46a330d277c9186588361a5779f68d85ba830c75a746a6447308", 0xb9}, {&(0x7f0000000000)="1e300d344c75dcf7cb67d27a8e02dac7b18ed732b8d905ccf39ba62f0845b858da3a409d047315fc71450758a94cd6351235971b936a71f66725f4effd52ed2a", 0x40}, {&(0x7f0000000180)="efc46028aab0", 0x6}, {&(0x7f0000000300)="bcf543b7812cbea08a210e4b963c43f76839be53f5d93f48f6da3afc9642340a011d3c3e65746dc85252ae1fea3db2510d41628321539340eb0cf1961c96c0c317f9ca882e1f7b0582e8e2a3f007c181ba5b1982a2e00fc033f73945cb5e74852f67046fd0ff755709af86dc551378be69fc2bd5a95eee01e892c62018e6c09f28d0b0c2217a60f4dc1dc6e5f76b8bded2f8aa5fe96935fec4ac5dfd8d8776ea6d363f5b016bc54a56249215d6a386f869cd6766edf1b2d5bc7e6a3092e1a32a2feea0a6f7ef394cc17fece981225dd796ae4dbe69c7b7dab95d0c243197990895c2f6a9e2210c51", 0xe8}, {&(0x7f0000000400)="aa1afd0dbf37a2cb", 0x8}, {&(0x7f0000001580)="6e9aff95cb00541007687a1326203aba8870d8ce9740f622940c1e3847cfaf2ebf7916ef984a051c3cc470ea1c981783032073bb046ae86a0ce6d038dbcecbc8f9560a62b6b47eb90fb11a78973ef3477ee96f402bf57f9b0b17724bc812", 0x5e}, {&(0x7f0000001600)="ebe77d231f73c97a9af9cd05ddf1f2dc8c1e1ba7307ade6611e5dfd3526dd689f0576cb9ee15ea0bfda8ab94c10f82f49e47426af35d33de711924aa302ad7def3df3fc8bd711dbb6e3e06d8c965addbd5b58f8b96e0c4575cfef653dd7c90d008e6f7dab8d63dcd4fd9fbfb336cb7d0eb8790a47ae310ce550994a7b9daff0a9ea76726ba4a9c0c2b5099cc11357b079ad5c046c521d3b48e0e4232cd431068b081b39cd1c37f8644d98f1bc1f41a19f1a6753d12a699830f82cd54445048efd4e6b4c663a8c89c220ff8fff85d876078531cbb8be6", 0xd6}, {&(0x7f0000001700)="f7d257201f3497b4abf7fc53c653a76eee0462e38cc17cdc42058ba42bc83b183e0a2f581dd973a90d0308a2b9daf937424998ebdc2b2784c80db5034a3f28f3640df6", 0x43}], 0xa, 0x1, 0x8) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a310000000014000780050015000700000008001240000a0000050005000200000005000400000000000d000300686173683a6e6574"], 0x5c}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000000)={@local, @random="21e300", @void, {@ipv4={0x800, @icmp={{0x6, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, {[@ra={0x94, 0x4, 0x1}]}}, @info_reply={0x10, 0x0, 0x0, 0xb7, 0xb}}}}}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e24, 0x0, @rand_addr, 0x8000}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0xfdff) socketpair$unix(0x1, 0x3, 0x0, 0x0) listen(0xffffffffffffffff, 0x3) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) 639.896488ms ago: executing program 2 (id=548): socket$packet(0x11, 0x3, 0x300) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x161141) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xf691, 0x10100, 0x0, 0x356}, &(0x7f00000008c0)=0x0, &(0x7f0000000500)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x70a, 0x41e3, 0x0, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r6 = syz_open_dev$sndctrl(0x0, 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r6, 0xc4c85512, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) ioctl$KVM_SET_GUEST_DEBUG(r7, 0x4048ae9b, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) syz_usbip_server_init(0x4) openat$vimc1(0xffffffffffffff9c, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r8, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r10, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 222.415768ms ago: executing program 0 (id=549): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="7c010000190001000000000000000000fc0200000000000000000000000000003c00000000000000000000000000000000000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000df0200000000000000000000000000000000000000000000c4000500ac14143b000000080000000000000000000000006c00"], 0x17c}}, 0x0) 0s ago: executing program 3 (id=550): syz_emit_ethernet(0x8a, &(0x7f0000000180)={@broadcast, @random="1704b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @local, @dev, {[@lsrr={0x83, 0x3}, @rr={0x7, 0x3}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@private=0xa010133, 0xb9}, {@local}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@remote}, {@private=0xa010100}, {@remote}, {@multicast2}]}]}}, "6d3c6c8b0c9d43b4"}}}}}, 0x0) r0 = fcntl$getown(0xffffffffffffffff, 0x9) rt_tgsigqueueinfo(0x0, r0, 0x2d, &(0x7f0000000100)={0x4, 0x0, 0x1}) kernel console output (not intermixed with test programs): 59][ T6290] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 116.614042][ T6297] syzkaller0: entered promiscuous mode [ 116.630667][ T6302] netlink: 8 bytes leftover after parsing attributes in process `syz.1.108'. [ 116.645922][ T6297] syzkaller0: entered allmulticast mode [ 116.682333][ T6297] tipc: Started in network mode [ 116.689276][ T6297] tipc: Node identity 9af8aaf52fa, cluster identity 4711 [ 116.702438][ T6297] tipc: Enabled bearer , priority 0 [ 116.714690][ T6296] tipc: Resetting bearer [ 116.729352][ T6296] tipc: Disabling bearer [ 116.789119][ T6302] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 117.099898][ T6309] netlink: 8 bytes leftover after parsing attributes in process `syz.2.112'. [ 117.365344][ T5937] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 117.540588][ T5937] usb 4-1: Using ep0 maxpacket: 16 [ 117.558462][ T5937] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 117.587475][ T5937] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.676818][ T6327] netlink: 'syz.1.117': attribute type 11 has an invalid length. [ 117.695482][ T6327] FAULT_INJECTION: forcing a failure. [ 117.695482][ T6327] name failslab, interval 1, probability 0, space 0, times 0 [ 117.723626][ T6327] CPU: 0 UID: 0 PID: 6327 Comm: syz.1.117 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 117.723650][ T5937] usb 4-1: Product: syz [ 117.723656][ T6327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 117.723670][ T6327] Call Trace: [ 117.723679][ T6327] [ 117.723687][ T6327] dump_stack_lvl+0x189/0x250 [ 117.723717][ T6327] ? __pfx____ratelimit+0x10/0x10 [ 117.723757][ T6327] ? __pfx_dump_stack_lvl+0x10/0x10 [ 117.723789][ T6327] ? __pfx__printk+0x10/0x10 [ 117.723826][ T6327] ? rcu_read_unlock_special+0x475/0x5e0 [ 117.723867][ T6327] ? ref_tracker_alloc+0x318/0x460 [ 117.723902][ T6327] should_fail_ex+0x414/0x560 [ 117.723936][ T6327] should_failslab+0xa8/0x100 [ 117.723976][ T6327] kmem_cache_alloc_noprof+0x73/0x3c0 [ 117.724008][ T6327] ? skb_clone+0x212/0x3a0 [ 117.724037][ T6327] skb_clone+0x212/0x3a0 [ 117.724064][ T6327] __netlink_deliver_tap+0x404/0x850 [ 117.724113][ T6327] ? netlink_deliver_tap+0x2e/0x1b0 [ 117.724147][ T6327] netlink_deliver_tap+0x19c/0x1b0 [ 117.724182][ T6327] __netlink_sendskb+0x47/0x90 [ 117.724211][ T6327] netlink_dump+0xa84/0xe90 [ 117.724256][ T6327] ? __pfx_netlink_dump+0x10/0x10 [ 117.724283][ T6327] ? __netlink_lookup+0x752/0x810 [ 117.724336][ T6327] ? netlink_lookup+0x30/0x200 [ 117.724364][ T6327] ? netlink_lookup+0x30/0x200 [ 117.724390][ T6327] ? netlink_lookup+0x30/0x200 [ 117.724427][ T6327] __netlink_dump_start+0x5cb/0x7e0 [ 117.724467][ T6327] rtnetlink_rcv_msg+0x9eb/0xb70 [ 117.724502][ T6327] ? __pfx_inet6_dump_ifaddr+0x10/0x10 [ 117.724535][ T6327] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 117.724565][ T6327] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 117.724595][ T6327] ? ref_tracker_free+0x63a/0x7d0 [ 117.724623][ T6327] ? __pfx_inet6_dump_ifaddr+0x10/0x10 [ 117.724655][ T6327] ? __skb_clone+0x63/0x7a0 [ 117.724704][ T6327] netlink_rcv_skb+0x208/0x470 [ 117.724737][ T6327] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 117.724779][ T6327] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 117.724825][ T6327] ? netlink_deliver_tap+0x2e/0x1b0 [ 117.724866][ T6327] netlink_unicast+0x82c/0x9e0 [ 117.724906][ T6327] ? __pfx_netlink_unicast+0x10/0x10 [ 117.724936][ T6327] ? netlink_sendmsg+0x642/0xb30 [ 117.724965][ T6327] ? skb_put+0x11b/0x210 [ 117.725003][ T6327] netlink_sendmsg+0x805/0xb30 [ 117.725045][ T6327] ? __pfx_netlink_sendmsg+0x10/0x10 [ 117.725082][ T6327] ? aa_sock_msg_perm+0xf1/0x1d0 [ 117.725118][ T6327] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 117.725146][ T6327] ? __pfx_netlink_sendmsg+0x10/0x10 [ 117.725179][ T6327] __sock_sendmsg+0x21c/0x270 [ 117.725212][ T6327] ____sys_sendmsg+0x505/0x830 [ 117.725258][ T6327] ? __pfx_____sys_sendmsg+0x10/0x10 [ 117.725303][ T6327] ? import_iovec+0x74/0xa0 [ 117.725331][ T6327] ___sys_sendmsg+0x21f/0x2a0 [ 117.725370][ T6327] ? __pfx____sys_sendmsg+0x10/0x10 [ 117.725454][ T6327] ? __fget_files+0x2a/0x420 [ 117.725490][ T6327] ? __fget_files+0x3a0/0x420 [ 117.725540][ T6327] __x64_sys_sendmsg+0x19b/0x260 [ 117.725581][ T6327] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 117.725629][ T6327] ? __pfx_ksys_write+0x10/0x10 [ 117.725660][ T6327] ? rcu_is_watching+0x15/0xb0 [ 117.725690][ T6327] ? do_syscall_64+0xbe/0x3b0 [ 117.725727][ T6327] do_syscall_64+0xfa/0x3b0 [ 117.725764][ T6327] ? lockdep_hardirqs_on+0x9c/0x150 [ 117.725794][ T6327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.725819][ T6327] ? clear_bhb_loop+0x60/0xb0 [ 117.725848][ T6327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.725873][ T6327] RIP: 0033:0x7fe097f8ebe9 [ 117.725894][ T6327] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 117.725916][ T6327] RSP: 002b:00007fe098edc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 117.725940][ T6327] RAX: ffffffffffffffda RBX: 00007fe0981b5fa0 RCX: 00007fe097f8ebe9 [ 117.725958][ T6327] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000b [ 117.725973][ T6327] RBP: 00007fe098edc090 R08: 0000000000000000 R09: 0000000000000000 [ 117.725987][ T6327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 117.726000][ T6327] R13: 00007fe0981b6038 R14: 00007fe0981b5fa0 R15: 00007fe0982dfa28 [ 117.726039][ T6327] [ 118.230314][ T5937] usb 4-1: Manufacturer: syz [ 118.243461][ T5937] usb 4-1: SerialNumber: syz [ 118.259478][ T5937] usb 4-1: config 0 descriptor?? [ 118.442678][ T5937] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 118.459066][ T5937] usb 4-1: Detected FT232H [ 118.544581][ T6331] netlink: 48 bytes leftover after parsing attributes in process `syz.1.118'. [ 118.628177][ T5937] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 118.642270][ T5937] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 118.653391][ T5937] ftdi_sio 4-1:0.0: GPIO initialisation failed: -71 [ 118.707304][ T5937] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 118.776589][ T5937] usb 4-1: USB disconnect, device number 12 [ 118.822862][ T5937] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 118.872325][ T5937] ftdi_sio 4-1:0.0: device disconnected [ 118.975803][ T6338] netlink: 8 bytes leftover after parsing attributes in process `syz.4.121'. [ 119.001251][ T6338] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 119.083332][ T6340] netlink: 324 bytes leftover after parsing attributes in process `syz.1.122'. [ 119.279464][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 119.279483][ T30] audit: type=1800 audit(1754688607.592:29): pid=6344 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.124" name="$" dev="tmpfs" ino=125 res=0 errno=0 [ 119.338749][ T6348] netlink: 8 bytes leftover after parsing attributes in process `syz.1.125'. [ 119.600313][ T6357] netlink: 'syz.4.128': attribute type 11 has an invalid length. [ 119.650240][ T6357] FAULT_INJECTION: forcing a failure. [ 119.650240][ T6357] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 119.671658][ T6357] CPU: 0 UID: 0 PID: 6357 Comm: syz.4.128 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 119.671680][ T6357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 119.671690][ T6357] Call Trace: [ 119.671696][ T6357] [ 119.671703][ T6357] dump_stack_lvl+0x189/0x250 [ 119.671727][ T6357] ? __pfx____ratelimit+0x10/0x10 [ 119.671747][ T6357] ? __pfx_dump_stack_lvl+0x10/0x10 [ 119.671766][ T6357] ? __pfx__printk+0x10/0x10 [ 119.671797][ T6357] should_fail_ex+0x414/0x560 [ 119.671819][ T6357] _copy_to_user+0x31/0xb0 [ 119.671836][ T6357] simple_read_from_buffer+0xe1/0x170 [ 119.671863][ T6357] proc_fail_nth_read+0x1b3/0x220 [ 119.671883][ T6357] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 119.671904][ T6357] ? rw_verify_area+0x2a6/0x4d0 [ 119.671923][ T6357] ? __lock_acquire+0xab9/0xd20 [ 119.671945][ T6357] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 119.671964][ T6357] vfs_read+0x200/0x980 [ 119.671983][ T6357] ? fdget_pos+0x247/0x320 [ 119.672000][ T6357] ? __pfx___mutex_lock+0x10/0x10 [ 119.672021][ T6357] ? __pfx_vfs_read+0x10/0x10 [ 119.672043][ T6357] ? __fget_files+0x2a/0x420 [ 119.672069][ T6357] ? __fget_files+0x3a0/0x420 [ 119.672092][ T6357] ? __fget_files+0x2a/0x420 [ 119.672122][ T6357] ksys_read+0x145/0x250 [ 119.672144][ T6357] ? __pfx_ksys_read+0x10/0x10 [ 119.672163][ T6357] ? rcu_is_watching+0x15/0xb0 [ 119.672183][ T6357] ? do_syscall_64+0xbe/0x3b0 [ 119.672207][ T6357] do_syscall_64+0xfa/0x3b0 [ 119.672226][ T6357] ? lockdep_hardirqs_on+0x9c/0x150 [ 119.672244][ T6357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.672260][ T6357] ? clear_bhb_loop+0x60/0xb0 [ 119.672279][ T6357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.672295][ T6357] RIP: 0033:0x7f7600b8d5fc [ 119.672308][ T6357] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 119.672321][ T6357] RSP: 002b:00007f7601a4a030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 119.672336][ T6357] RAX: ffffffffffffffda RBX: 00007f7600db5fa0 RCX: 00007f7600b8d5fc [ 119.672347][ T6357] RDX: 000000000000000f RSI: 00007f7601a4a0a0 RDI: 000000000000000c [ 119.672356][ T6357] RBP: 00007f7601a4a090 R08: 0000000000000000 R09: 0000000000000000 [ 119.672365][ T6357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 119.672373][ T6357] R13: 00007f7600db6038 R14: 00007f7600db5fa0 R15: 00007f7600edfa28 [ 119.672396][ T6357] [ 119.890592][ T9] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 120.043202][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 120.049845][ T9] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 120.049874][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.049889][ T9] usb 3-1: Product: syz [ 120.049900][ T9] usb 3-1: Manufacturer: syz [ 120.049911][ T9] usb 3-1: SerialNumber: syz [ 120.055977][ T9] usb 3-1: config 0 descriptor?? [ 120.190788][ T10] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 120.358057][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 120.358120][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 120.358162][ T10] usb 5-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 120.358188][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.361352][ T10] usb 5-1: config 0 descriptor?? [ 120.403532][ T6370] netlink: 8 bytes leftover after parsing attributes in process `syz.0.131'. [ 120.403735][ T6370] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 120.403770][ T6370] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 120.489191][ T9] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 120.507838][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 120.509163][ T9] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 120.509230][ T9] usb 3-1: media controller created [ 120.577864][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 121.218858][ T9] zl10353_read_register: readreg error (reg=127, ret==0) [ 121.218926][ T9] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 121.218942][ T9] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 121.219826][ T6359] dtv5100: wlen = 0, aborting. [ 121.300358][ T10] hid-led 0003:0FC5:B080.0001: probe with driver hid-led failed with error -71 [ 121.302696][ T10] usb 5-1: USB disconnect, device number 5 [ 121.690034][ T6376] GUP no longer grows the stack in syz.3.134 (6376): 200000005000-200000008000 (200000004000) [ 121.690133][ T6376] CPU: 1 UID: 0 PID: 6376 Comm: syz.3.134 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 121.690158][ T6376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 121.690170][ T6376] Call Trace: [ 121.690178][ T6376] [ 121.690188][ T6376] dump_stack_lvl+0x189/0x250 [ 121.690224][ T6376] ? __pfx_dump_stack_lvl+0x10/0x10 [ 121.690251][ T6376] ? __pfx__printk+0x10/0x10 [ 121.690280][ T6376] ? find_vma+0xe7/0x160 [ 121.690326][ T6376] __get_user_pages+0x24d0/0x2ce0 [ 121.690351][ T6376] ? __lock_acquire+0xab9/0xd20 [ 121.690414][ T6376] ? __gup_longterm_locked+0xc68/0x1660 [ 121.690452][ T6376] __gup_longterm_locked+0xde9/0x1660 [ 121.690503][ T6376] ? gup_fast_fallback+0x195f/0x2010 [ 121.690536][ T6376] gup_fast_fallback+0x1e6a/0x2010 [ 121.690599][ T6376] ? __pfx_gup_fast_fallback+0x10/0x10 [ 121.690625][ T6376] ? futex_unqueue+0x22/0x240 [ 121.690662][ T6376] ? __futex_wait+0x1d1/0x3e0 [ 121.690695][ T6376] ? __futex_wait+0x34f/0x3e0 [ 121.690733][ T6376] ? is_valid_gup_args+0x11f/0x200 [ 121.690763][ T6376] ? get_user_pages_fast+0x4d/0xb0 [ 121.690794][ T6376] get_futex_key+0x938/0x1660 [ 121.690833][ T6376] ? __pfx_get_futex_key+0x10/0x10 [ 121.690859][ T6376] ? futex_private_hash_put+0x4b/0x280 [ 121.690895][ T6376] futex_wake+0xf8/0x560 [ 121.690935][ T6376] ? __pfx_futex_wake+0x10/0x10 [ 121.690979][ T6376] ? __might_fault+0xb0/0x130 [ 121.691013][ T6376] do_futex+0x395/0x420 [ 121.691047][ T6376] ? __pfx_do_futex+0x10/0x10 [ 121.691075][ T6376] ? rcu_is_watching+0x15/0xb0 [ 121.691104][ T6376] __se_sys_futex+0x36f/0x400 [ 121.691141][ T6376] ? __pfx___se_sys_futex+0x10/0x10 [ 121.691171][ T6376] ? rcu_is_watching+0x15/0xb0 [ 121.691199][ T6376] ? __x64_sys_futex+0x21/0xf0 [ 121.691231][ T6376] do_syscall_64+0xfa/0x3b0 [ 121.691259][ T6376] ? lockdep_hardirqs_on+0x9c/0x150 [ 121.691285][ T6376] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.691308][ T6376] ? clear_bhb_loop+0x60/0xb0 [ 121.691335][ T6376] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.691357][ T6376] RIP: 0033:0x7f5695b8ebe9 [ 121.691377][ T6376] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 121.691395][ T6376] RSP: 002b:00007f5696a01038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 121.691418][ T6376] RAX: ffffffffffffffda RBX: 00007f5695db6090 RCX: 00007f5695b8ebe9 [ 121.691434][ T6376] RDX: 0000000000000000 RSI: 000000000000000a RDI: 0000200000004000 [ 121.691451][ T6376] RBP: 00007f5695c11e19 R08: 0000200000000300 R09: 00000000a3020000 [ 121.691466][ T6376] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 121.691478][ T6376] R13: 00007f5695db6128 R14: 00007f5695db6090 R15: 00007f5695edfa28 [ 121.691512][ T6376] [ 122.173318][ T6380] netlink: 324 bytes leftover after parsing attributes in process `syz.1.135'. [ 122.309667][ T6383] netlink: 12 bytes leftover after parsing attributes in process `syz.4.136'. [ 122.830791][ T5937] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 123.090906][ T5937] usb 4-1: config 0 has no interfaces? [ 123.119252][ T5937] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 123.119287][ T5937] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.119309][ T5937] usb 4-1: Product: syz [ 123.119326][ T5937] usb 4-1: Manufacturer: syz [ 123.119342][ T5937] usb 4-1: SerialNumber: syz [ 123.181967][ T5937] usb 4-1: config 0 descriptor?? [ 123.530602][ T6395] netlink: 8 bytes leftover after parsing attributes in process `syz.4.139'. [ 124.437350][ T5946] usb 3-1: USB disconnect, device number 8 [ 124.552722][ T5946] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 124.620870][ T5937] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 124.676724][ T6418] netlink: 8 bytes leftover after parsing attributes in process `syz.2.143'. [ 124.686186][ T6418] netlink: 4 bytes leftover after parsing attributes in process `syz.2.143'. [ 124.698973][ T6418] netlink: 16 bytes leftover after parsing attributes in process `syz.2.143'. [ 124.800503][ T5937] usb 5-1: Using ep0 maxpacket: 16 [ 124.823312][ T5937] usb 5-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 124.847479][ T5937] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.886064][ T5937] usb 5-1: Product: syz [ 124.902422][ T5937] usb 5-1: Manufacturer: syz [ 124.917552][ T5937] usb 5-1: SerialNumber: syz [ 124.944337][ T5937] usb 5-1: config 0 descriptor?? [ 124.976552][ T5937] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 125.005148][ T5937] usb 5-1: Detected FT232H [ 125.181556][ T5937] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 125.206306][ T5937] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 125.218871][ T5937] ftdi_sio 5-1:0.0: GPIO initialisation failed: -71 [ 125.260569][ T5937] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 125.327527][ T5937] usb 5-1: USB disconnect, device number 6 [ 125.384091][ T5937] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 125.453770][ T5937] ftdi_sio 5-1:0.0: device disconnected [ 125.501070][ T6432] fuse: Bad value for 'fd' [ 125.909030][ T6440] netlink: 12 bytes leftover after parsing attributes in process `syz.1.149'. [ 126.197851][ T6446] netlink: 8 bytes leftover after parsing attributes in process `syz.1.151'. [ 126.230632][ T5937] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 126.290013][ T5949] usb 4-1: USB disconnect, device number 13 [ 126.405689][ T5937] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 126.436931][ T5937] usb 1-1: config 0 has no interface number 0 [ 126.463519][ T5937] usb 1-1: New USB device found, idVendor=0b48, idProduct=1004, bcdDevice=8c.1e [ 126.484081][ T5937] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.515806][ T5937] usb 1-1: config 0 descriptor?? [ 126.539056][ T5937] usb 1-1: selecting invalid altsetting 1 [ 126.556807][ T5937] dvb_ttusb_budget: ttusb_init_controller: error [ 126.565655][ T5937] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 126.669644][ T5937] DVB: Unable to find symbol ves1820_attach() [ 126.726635][ T5937] DVB: Unable to find symbol stv0297_attach() [ 126.737341][ T5937] dvb_ttusb_budget: no frontend driver found for device [0b48:1004] [ 126.745726][ T5862] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 126.800551][ T10] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 126.910707][ T5862] usb 3-1: Using ep0 maxpacket: 16 [ 126.920298][ T5862] usb 3-1: config 1 interface 0 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 126.934382][ T5862] usb 3-1: config 1 interface 0 altsetting 7 endpoint 0x81 has invalid maxpacket 1088, setting to 1024 [ 126.946099][ T5862] usb 3-1: config 1 interface 0 altsetting 7 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 126.960999][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 126.969870][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 126.978155][ T5862] usb 3-1: config 1 interface 0 has no altsetting 0 [ 126.980670][ T10] usb 2-1: config 1 has an invalid interface number: 26 but max is 1 [ 127.020644][ T10] usb 2-1: config 1 has an invalid interface number: 89 but max is 1 [ 127.029033][ T10] usb 2-1: config 1 has an invalid descriptor of length 11, skipping remainder of the config [ 127.229898][ T10] usb 2-1: config 1 has no interface number 0 [ 127.253733][ T10] usb 2-1: config 1 has no interface number 1 [ 127.268015][ T10] usb 2-1: config 1 interface 26 altsetting 213 bulk endpoint 0xC has invalid maxpacket 1023 [ 127.281738][ T10] usb 2-1: config 1 interface 26 altsetting 213 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 127.297624][ T10] usb 2-1: config 1 interface 26 altsetting 213 bulk endpoint 0xD has invalid maxpacket 8 [ 127.315581][ T10] usb 2-1: config 1 interface 26 altsetting 213 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 127.327007][ T10] usb 2-1: config 1 interface 26 altsetting 213 has 4 endpoint descriptors, different from the interface descriptor's value: 6 [ 127.344304][ T10] usb 2-1: config 1 interface 89 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 127.357591][ T10] usb 2-1: config 1 interface 26 has no altsetting 0 [ 127.396138][ T10] usb 2-1: config 1 interface 89 has no altsetting 0 [ 127.592026][ T10] usb 2-1: New USB device found, idVendor=1f38, idProduct=0001, bcdDevice=29.ec [ 127.601896][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.601997][ T5946] usb 1-1: USB disconnect, device number 7 [ 127.610012][ T10] usb 2-1: Product: syz [ 127.610033][ T10] usb 2-1: Manufacturer: syz [ 127.610048][ T10] usb 2-1: SerialNumber: syz [ 127.646513][ T6451] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 127.672477][ T6451] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 128.025474][ T30] audit: type=1326 audit(1754688616.342:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6466 comm="syz.4.157" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7600b8ebe9 code=0x7ffc0000 [ 128.068080][ T6451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 128.131434][ T30] audit: type=1326 audit(1754688616.342:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6466 comm="syz.4.157" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7600b8ebe9 code=0x7ffc0000 [ 128.155147][ T6451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 128.165456][ T30] audit: type=1326 audit(1754688616.442:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6466 comm="syz.4.157" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7f7600b8ebe9 code=0x7ffc0000 [ 128.395642][ T6470] 8021q: adding VLAN 0 to HW filter on device bond1 [ 128.624665][ T30] audit: type=1326 audit(1754688616.442:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6466 comm="syz.4.157" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7600b8ebe9 code=0x7ffc0000 [ 129.011791][ T30] audit: type=1326 audit(1754688616.442:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6466 comm="syz.4.157" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f7600b8ebe9 code=0x7ffc0000 [ 129.046192][ T30] audit: type=1326 audit(1754688616.442:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6466 comm="syz.4.157" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7600b8ebe9 code=0x7ffc0000 [ 129.069111][ T10] usb 2-1: unknown interface protocol 0x7d, assuming v1 [ 129.079593][ T10] usb 2-1: 26:2 : does not exist [ 129.131280][ T5862] usb 3-1: New USB device found, idVendor=045e, idProduct=0732, bcdDevice= 0.40 [ 129.160499][ T5862] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.161381][ T30] audit: type=1326 audit(1754688616.442:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6466 comm="syz.4.157" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f7600b8ebe9 code=0x7ffc0000 [ 129.183582][ T5862] usb 3-1: Product: 算㈱鳛䩓翑薴赡䫙衞࢕칩᎝㻡➘⧕⟄ౢ竘훋㶨ⳤ휔 [ 129.223367][ T10] usb 2-1: unknown interface protocol 0x13, assuming v1 [ 129.240865][ T10] usb 2-1: 89:2 : does not exist [ 129.281441][ T10] usb 2-1: USB disconnect, device number 7 [ 129.418349][ T5862] usb 3-1: can't set config #1, error -71 [ 129.491877][ T5862] usb 3-1: USB disconnect, device number 9 [ 129.539558][ T6479] bridge_slave_0: left allmulticast mode [ 129.583557][ T6023] udevd[6023]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.26/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 129.640086][ T6479] bridge_slave_0: left promiscuous mode [ 129.711973][ T6479] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.790487][ T10] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 129.879916][ T6479] bridge_slave_1: left allmulticast mode [ 129.886661][ T6479] bridge_slave_1: left promiscuous mode [ 129.901579][ T6479] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.963704][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 129.988449][ T10] usb 2-1: not running at top speed; connect to a high speed hub [ 130.003611][ T6479] bond0: (slave bond_slave_0): Releasing backup interface [ 130.042383][ T10] usb 2-1: config 10 has an invalid interface number: 104 but max is 0 [ 130.055341][ T10] usb 2-1: config 10 has no interface number 0 [ 130.064936][ T10] usb 2-1: New USB device found, idVendor=19d2, idProduct=1075, bcdDevice=57.61 [ 130.072578][ T6479] bond0: (slave bond_slave_1): Releasing backup interface [ 130.096366][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.108119][ T10] usb 2-1: Product: syz [ 130.113264][ T10] usb 2-1: Manufacturer: syz [ 130.118156][ T10] usb 2-1: SerialNumber: syz [ 130.119080][ T6479] team0: Port device team_slave_0 removed [ 130.146279][ T6479] team0: Port device team_slave_1 removed [ 130.158172][ T6479] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 130.167857][ T6479] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 130.179382][ T6479] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 130.187031][ T6479] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 130.271000][ T5862] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 130.332739][ T6493] netlink: 8 bytes leftover after parsing attributes in process `syz.0.163'. [ 130.367669][ T10] option 2-1:10.104: GSM modem (1-port) converter detected [ 130.411534][ T10] usb 2-1: USB disconnect, device number 8 [ 130.426540][ T10] option 2-1:10.104: device disconnected [ 130.453747][ T5862] usb 5-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 130.485638][ T5862] usb 5-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 130.531389][ T5862] usb 5-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 130.569172][ T5862] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 130.586709][ T5862] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.606023][ T6488] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 130.835796][ T6505] netlink: 12 bytes leftover after parsing attributes in process `syz.0.167'. [ 131.040781][ T5946] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 131.064859][ T6513] syzkaller0: entered promiscuous mode [ 131.072381][ T6513] syzkaller0: entered allmulticast mode [ 131.110010][ T6513] tipc: Enabled bearer , priority 0 [ 131.119197][ T6512] tipc: Resetting bearer [ 131.138372][ T6512] tipc: Disabling bearer [ 131.220634][ T5946] usb 4-1: Using ep0 maxpacket: 16 [ 131.242462][ T5946] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 131.538095][ T5946] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.558228][ T5946] usb 4-1: Product: syz [ 131.570134][ T5946] usb 4-1: Manufacturer: syz [ 131.586075][ T5946] usb 4-1: SerialNumber: syz [ 131.621980][ T5946] usb 4-1: config 0 descriptor?? [ 131.649039][ T5946] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 131.842653][ T5946] usb 4-1: Detected FT232H [ 131.874502][ T5946] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 131.891660][ T5946] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 131.914245][ T5946] ftdi_sio 4-1:0.0: GPIO initialisation failed: -71 [ 131.933545][ T5946] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 131.956557][ T5946] usb 4-1: USB disconnect, device number 14 [ 131.988966][ T5946] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 132.018628][ T5946] ftdi_sio 4-1:0.0: device disconnected [ 132.919098][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.926065][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.075083][ T5862] aiptek 5-1:17.0: Aiptek using 400 ms programming speed [ 133.120331][ T5862] input: Aiptek as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:17.0/input/input8 [ 133.247896][ T5862] usb 5-1: USB disconnect, device number 7 [ 133.253806][ C1] aiptek 5-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 134.048154][ T6543] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 134.106704][ T6546] netlink: 12 bytes leftover after parsing attributes in process `syz.0.179'. [ 134.141231][ T6543] macvtap1: entered allmulticast mode [ 134.156810][ T6543] mac80211_hwsim hwsim8 wlan0: entered allmulticast mode [ 134.164302][ T10] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 134.343301][ T6543] mac80211_hwsim hwsim8 wlan0: left allmulticast mode [ 134.361155][ T6543] mac80211_hwsim hwsim8 wlan0: left promiscuous mode [ 134.501374][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 134.596537][ T6545] mac80211_hwsim hwsim7 wlan1: entered promiscuous mode [ 134.624651][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 134.740497][ T10] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 134.749590][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.806329][ T10] usb 5-1: config 0 descriptor?? [ 134.841465][ T10] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 134.870578][ T5946] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 135.060572][ T5946] usb 1-1: Using ep0 maxpacket: 16 [ 135.084937][ T5946] usb 1-1: config 1 interface 0 altsetting 4 bulk endpoint 0x82 has invalid maxpacket 16 [ 135.101957][ T5946] usb 1-1: config 1 interface 0 altsetting 4 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 135.115544][ T5946] usb 1-1: config 1 interface 0 has no altsetting 0 [ 135.138235][ T5946] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 135.150111][ T5946] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.186712][ T5946] usb 1-1: Product: Р [ 135.205572][ T5946] usb 1-1: Manufacturer: ц [ 135.235971][ T5946] usb 1-1: SerialNumber: syz [ 135.257867][ T6552] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 135.274536][ T6552] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 135.346019][ T6561] netlink: 324 bytes leftover after parsing attributes in process `syz.2.184'. [ 135.407489][ T6536] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 135.416363][ T6536] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 135.512698][ T24] usb 5-1: USB disconnect, device number 8 [ 135.745708][ T5946] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -22 [ 135.787512][ T5946] usb 1-1: USB disconnect, device number 8 [ 136.230689][ T5946] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 136.440628][ T5946] usb 5-1: Using ep0 maxpacket: 16 [ 136.469492][ T5946] usb 5-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 136.499161][ T5946] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.540496][ T5946] usb 5-1: Product: syz [ 136.545599][ T5946] usb 5-1: Manufacturer: syz [ 136.551135][ T5946] usb 5-1: SerialNumber: syz [ 136.569024][ T5946] usb 5-1: config 0 descriptor?? [ 136.597894][ T5946] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 136.647754][ T6582] netlink: 12 bytes leftover after parsing attributes in process `syz.2.190'. [ 136.652099][ T5946] usb 5-1: Detected FT232H [ 136.797803][ T5946] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 136.818770][ T5946] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 136.863285][ T5946] ftdi_sio 5-1:0.0: GPIO initialisation failed: -71 [ 136.896327][ T5946] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 136.930311][ T6586] netlink: 12 bytes leftover after parsing attributes in process `syz.2.192'. [ 136.937886][ T5946] usb 5-1: USB disconnect, device number 9 [ 136.949957][ T6588] netlink: 8 bytes leftover after parsing attributes in process `syz.0.194'. [ 136.993001][ T5946] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 136.993735][ T5949] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 137.014150][ T6588] netlink: 56 bytes leftover after parsing attributes in process `syz.0.194'. [ 137.034705][ T5946] ftdi_sio 5-1:0.0: device disconnected [ 137.186694][ T5949] usb 4-1: Using ep0 maxpacket: 32 [ 137.198299][ T6594] netlink: 12 bytes leftover after parsing attributes in process `syz.0.196'. [ 137.210998][ T5949] usb 4-1: config 0 interface 0 has no altsetting 0 [ 137.222896][ T5949] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 137.241399][ T5949] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.248317][ T6596] netlink: 324 bytes leftover after parsing attributes in process `syz.2.197'. [ 137.257937][ T5949] usb 4-1: Product: syz [ 137.260205][ T5937] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 137.273067][ T5949] usb 4-1: Manufacturer: syz [ 137.281128][ T5949] usb 4-1: SerialNumber: syz [ 137.304175][ T5949] usb 4-1: config 0 descriptor?? [ 137.424733][ T5937] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 137.445210][ T5937] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 137.480505][ T5937] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 137.512292][ T5937] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 137.537708][ T5937] usb 2-1: SerialNumber: syz [ 137.558880][ T6590] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 137.664451][ T6607] netlink: 12 bytes leftover after parsing attributes in process `syz.2.202'. [ 137.775362][ T5937] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 137.797544][ T5937] usb 2-1: USB disconnect, device number 9 [ 137.874034][ T5949] gs_usb 4-1:0.0: Configuring for 3 interfaces [ 138.267390][ T5949] gs_usb 4-1:0.0: Couldn't get bit timing const for channel 0 (-EPROTO) [ 138.280816][ T5949] gs_usb 4-1:0.0: probe with driver gs_usb failed with error -71 [ 138.308949][ T5949] usb 4-1: USB disconnect, device number 15 [ 138.598948][ T6621] capability: warning: `syz.0.206' uses 32-bit capabilities (legacy support in use) [ 138.828083][ T6625] netlink: 324 bytes leftover after parsing attributes in process `syz.4.208'. [ 139.144039][ T6631] netlink: 12 bytes leftover after parsing attributes in process `syz.4.210'. [ 139.961040][ T5862] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 140.270862][ T5862] usb 2-1: Using ep0 maxpacket: 8 [ 140.280775][ T5862] usb 2-1: config 0 has an invalid interface number: 52 but max is 0 [ 140.321656][ T5862] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 140.354115][ T5862] usb 2-1: config 0 has no interface number 0 [ 140.360298][ T5862] usb 2-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 140.397250][ T5862] usb 2-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 140.465767][ T5862] usb 2-1: config 0 interface 52 has no altsetting 0 [ 140.508472][ T5862] usb 2-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 140.570694][ T6651] netlink: 'syz.3.217': attribute type 1 has an invalid length. [ 140.574531][ T5862] usb 2-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 140.601979][ T5862] usb 2-1: Manufacturer: syz [ 140.613525][ T5862] usb 2-1: config 0 descriptor?? [ 140.691309][ T6651] 8021q: adding VLAN 0 to HW filter on device bond1 [ 140.862904][ T5862] input: syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.52/input/input9 [ 140.880631][ T10] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 141.061036][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 141.067679][ T5937] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 141.091030][ T10] usb 4-1: config 0 has an invalid interface number: 49 but max is 0 [ 141.104499][ T10] usb 4-1: config 0 has no interface number 0 [ 141.128256][ T10] usb 4-1: config 0 interface 49 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 16 [ 141.144575][ T10] usb 4-1: config 0 interface 49 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 141.164738][ T10] usb 4-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7 [ 141.181428][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.189953][ T10] usb 4-1: Product: syz [ 141.199029][ T10] usb 4-1: Manufacturer: syz [ 141.204345][ T10] usb 4-1: SerialNumber: syz [ 141.226339][ T10] usb 4-1: config 0 descriptor?? [ 141.240983][ T5937] usb 1-1: Using ep0 maxpacket: 16 [ 141.257720][ T6655] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 141.297201][ T5937] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 141.321379][ T5937] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.358827][ T5937] usb 1-1: Product: syz [ 141.364148][ T5937] usb 1-1: Manufacturer: syz [ 141.365103][ T5915] usb 2-1: USB disconnect, device number 10 [ 141.368887][ C1] synaptics_usb 2-1:0.52: synusb_irq - usb_submit_urb failed with result: -19 [ 141.368938][ T5937] usb 1-1: SerialNumber: syz [ 141.425675][ T5937] usb 1-1: config 0 descriptor?? [ 141.473524][ T5937] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 141.542078][ T5937] usb 1-1: Detected FT232H [ 141.555611][ T10] usb 4-1: USB disconnect, device number 16 [ 141.612003][ T6672] netlink: 344 bytes leftover after parsing attributes in process `syz.4.222'. [ 141.677787][ T5937] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 141.706009][ T5937] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 141.746279][ T5937] ftdi_sio 1-1:0.0: GPIO initialisation failed: -71 [ 141.777635][ T5937] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 141.817723][ T5937] usb 1-1: USB disconnect, device number 9 [ 141.848382][ T5937] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 141.882697][ T5937] ftdi_sio 1-1:0.0: device disconnected [ 142.241077][ T10] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 142.423422][ T10] usb 5-1: config 0 interface 0 has no altsetting 0 [ 142.446063][ T10] usb 5-1: New USB device found, idVendor=04e7, idProduct=0009, bcdDevice= 0.00 [ 142.474104][ T6700] netlink: 8 bytes leftover after parsing attributes in process `syz.2.231'. [ 142.483446][ T6700] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 142.491126][ T6700] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 142.547635][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.572252][ T6702] netlink: 344 bytes leftover after parsing attributes in process `syz.1.235'. [ 142.596690][ T10] usb 5-1: config 0 descriptor?? [ 142.795882][ T6706] netlink: 12 bytes leftover after parsing attributes in process `syz.1.238'. [ 143.019475][ T10] elo 0003:04E7:0009.0002: unknown main item tag 0x0 [ 143.032170][ T10] elo 0003:04E7:0009.0002: unknown main item tag 0x0 [ 143.128987][ T6717] netlink: 'syz.1.241': attribute type 11 has an invalid length. [ 143.158205][ T10] elo 0003:04E7:0009.0002: hidraw0: USB HID v80.00 Device [HID 04e7:0009] on usb-dummy_hcd.4-1/input0 [ 143.234871][ T5915] usb 5-1: USB disconnect, device number 10 [ 143.499525][ T6719] fido_id[6719]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 143.650781][ T10] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 143.707891][ T6728] input: syz0 as /devices/virtual/input/input10 [ 143.785404][ T6728] fuse: Unknown parameter 'r' [ 143.850565][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 143.877093][ T10] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 143.919917][ T10] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 143.963113][ T6730] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 143.978741][ T10] usb 4-1: config 0 interface 0 has no altsetting 0 [ 143.993617][ T6730] macvtap1: entered allmulticast mode [ 144.019568][ T6730] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode [ 144.038498][ T10] usb 4-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 144.065808][ T6732] netlink: 344 bytes leftover after parsing attributes in process `syz.4.246'. [ 144.066155][ T6730] mac80211_hwsim hwsim2 wlan0: left allmulticast mode [ 144.084885][ T6730] mac80211_hwsim hwsim2 wlan0: left promiscuous mode [ 144.132906][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 144.197025][ T10] usb 4-1: config 0 descriptor?? [ 144.848662][ T10] hid (null): bogus close delimiter [ 144.921781][ T10] cougar 0003:060B:500A.0003: unexpected long global item [ 144.968240][ T10] cougar 0003:060B:500A.0003: parse failed [ 144.982068][ T10] cougar 0003:060B:500A.0003: probe with driver cougar failed with error -22 [ 145.142596][ T5946] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 145.191367][ T6743] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 145.207767][ T6743] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 145.287541][ T6743] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 145.295149][ T6743] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 145.441280][ T5946] usb 5-1: Using ep0 maxpacket: 32 [ 145.449391][ T5946] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 145.458788][ T5946] usb 5-1: config 0 has no interface number 0 [ 145.467577][ T5946] usb 5-1: config 0 interface 184 has no altsetting 0 [ 145.480577][ T5946] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 145.494217][ T5946] usb 5-1: New USB device strings: Mfr=227, Product=1, SerialNumber=3 [ 145.521334][ T6746] netlink: 12 bytes leftover after parsing attributes in process `syz.1.251'. [ 145.546413][ T5946] usb 5-1: Product: syz [ 145.560130][ T5946] usb 5-1: Manufacturer: syz [ 145.578461][ T5946] usb 5-1: SerialNumber: syz [ 145.597523][ T5946] usb 5-1: config 0 descriptor?? [ 145.627599][ T5946] smsc75xx v1.0.0 [ 145.674793][ T6750] netlink: 'syz.0.253': attribute type 2 has an invalid length. [ 145.728860][ T6750] : entered promiscuous mode [ 146.322167][ T5946] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 146.336223][ T5946] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 146.687866][ T5915] usb 4-1: USB disconnect, device number 17 [ 146.710592][ T5862] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 146.900610][ T5862] usb 1-1: Using ep0 maxpacket: 16 [ 146.955390][ T5862] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 146.976150][ T5862] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.015009][ T5862] usb 1-1: Product: syz [ 147.040483][ T5862] usb 1-1: Manufacturer: syz [ 147.045156][ T5862] usb 1-1: SerialNumber: syz [ 147.084888][ T6772] netlink: 12 bytes leftover after parsing attributes in process `syz.3.257'. [ 147.125842][ T5862] usb 1-1: config 0 descriptor?? [ 147.179098][ T5862] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 147.198644][ T5862] usb 1-1: Detected FT232H [ 147.385412][ T5862] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 147.395302][ T5862] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 147.433502][ T5862] ftdi_sio 1-1:0.0: GPIO initialisation failed: -71 [ 147.478192][ T5862] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 147.539742][ T5862] usb 1-1: USB disconnect, device number 10 [ 147.573736][ T5862] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 147.625700][ T5862] ftdi_sio 1-1:0.0: device disconnected [ 148.475455][ T5946] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000010: -71 [ 148.487957][ T5946] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to write HW_CFG: -71 [ 148.535309][ T5946] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 148.551531][ T10] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 148.582855][ T5946] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -71 [ 148.594670][ T6788] syzkaller0: entered promiscuous mode [ 148.606801][ T6788] syzkaller0: entered allmulticast mode [ 148.634345][ T6791] fuse: Bad value for 'rootmode' [ 148.640811][ T5946] usb 5-1: USB disconnect, device number 11 [ 148.691354][ T6788] tipc: Started in network mode [ 148.697183][ T6788] tipc: Node identity 5eae3546dd42, cluster identity 4711 [ 148.712016][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 148.724106][ T6788] tipc: Enabled bearer , priority 0 [ 148.730010][ T10] usb 4-1: config 0 has an invalid interface number: 146 but max is 0 [ 148.780461][ T10] usb 4-1: config 0 has no interface number 0 [ 148.793927][ T6787] tipc: Resetting bearer [ 148.830607][ T10] usb 4-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 148.867604][ T10] usb 4-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 148.882341][ T6787] tipc: Disabling bearer [ 148.904719][ T10] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 148.941645][ T10] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 148.953243][ T10] usb 4-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 148.973931][ T10] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 149.212741][ T10] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 149.231682][ T6799] netlink: 8 bytes leftover after parsing attributes in process `syz.2.266'. [ 149.247500][ T6799] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 149.255721][ T6799] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 149.264881][ T10] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 149.347470][ T10] usb 4-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 149.397540][ T10] usb 4-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 149.408610][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.527658][ T10] usb 4-1: Product: syz [ 149.578921][ T10] usb 4-1: Manufacturer: syz [ 149.619312][ T10] usb 4-1: SerialNumber: syz [ 149.730892][ T10] usb 4-1: config 0 descriptor?? [ 149.747855][ T6786] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 149.765186][ T10] microtek usb (rev 0.4.3): can only deal with bulk endpoints; endpoint 1 is not bulk. [ 149.787404][ T10] microtek usb (rev 0.4.3): couldn't find an output bulk endpoint. Bailing out. [ 150.178897][ T6815] netlink: 112 bytes leftover after parsing attributes in process `syz.3.261'. [ 150.335467][ T6817] netlink: 324 bytes leftover after parsing attributes in process `syz.0.270'. [ 151.261939][ T6823] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 151.269396][ T6823] IPv6: NLM_F_CREATE should be set when creating new route [ 151.375399][ T6824] lo: entered allmulticast mode [ 151.406088][ T6824] tunl0: entered allmulticast mode [ 151.441290][ T6824] gre0: entered allmulticast mode [ 151.571071][ T6824] gretap0: entered allmulticast mode [ 151.590788][ T10] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 151.608512][ T6824] erspan0: entered allmulticast mode [ 151.628952][ T6824] ip_vti0: entered allmulticast mode [ 151.640316][ T5949] usb 4-1: USB disconnect, device number 18 [ 151.678528][ T6824] ip6_vti0: entered allmulticast mode [ 151.721624][ T6824] sit0: entered allmulticast mode [ 151.760911][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 151.761309][ T6824] ip6tnl0: entered allmulticast mode [ 151.806891][ T10] usb 1-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 151.807549][ T6824] ip6gre0: entered allmulticast mode [ 151.853530][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.864643][ T6824] syz_tun: entered allmulticast mode [ 151.873029][ T6824] ip6gretap0: entered allmulticast mode [ 151.906570][ T10] usb 1-1: Product: syz [ 151.907610][ T6824] bridge0: port 2(bridge_slave_1) entered disabled state [ 151.918625][ T6824] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.919436][ T10] usb 1-1: Manufacturer: syz [ 151.948943][ T10] usb 1-1: SerialNumber: syz [ 151.973188][ T10] usb 1-1: config 0 descriptor?? [ 152.004949][ T10] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 152.024181][ T6824] bridge0: entered allmulticast mode [ 152.046804][ T6824] vcan0: entered allmulticast mode [ 152.060238][ T6824] bond0: entered allmulticast mode [ 152.069255][ T6824] bond_slave_0: entered allmulticast mode [ 152.094323][ T6824] bond_slave_1: entered allmulticast mode [ 152.107891][ T6824] team0: entered allmulticast mode [ 152.114010][ T6824] team_slave_0: entered allmulticast mode [ 152.120047][ T6824] team_slave_1: entered allmulticast mode [ 152.130498][ T5949] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 152.130631][ T6824] dummy0: entered allmulticast mode [ 152.154024][ T6824] nlmon0: entered allmulticast mode [ 152.164293][ T6824] caif0: entered allmulticast mode [ 152.171285][ T6824] batadv0: entered allmulticast mode [ 152.195389][ T6824] vxcan0: entered allmulticast mode [ 152.210536][ T6824] vxcan1: entered allmulticast mode [ 152.217688][ T6824] veth0: entered allmulticast mode [ 152.333830][ T5949] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 152.344862][ T5949] usb 4-1: config 0 interface 0 has no altsetting 0 [ 152.401611][ T6824] veth1: entered allmulticast mode [ 152.467396][ T5949] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 152.476987][ T5949] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 152.486434][ T5949] usb 4-1: Product: syz [ 152.490853][ T5949] usb 4-1: Manufacturer: syz [ 152.509423][ T6824] wg0: entered allmulticast mode [ 152.525596][ T6824] wg1: entered allmulticast mode [ 152.533405][ T5949] usb 4-1: SerialNumber: syz [ 152.591343][ T6824] wg2: entered allmulticast mode [ 152.607982][ T5949] usb 4-1: config 0 descriptor?? [ 152.696718][ T6824] veth0_to_bridge: entered allmulticast mode [ 152.762930][ T5949] usb 4-1: selecting invalid altsetting 0 [ 152.790302][ T6824] veth1_to_bridge: entered allmulticast mode [ 152.953605][ T6824] veth0_to_bond: entered allmulticast mode [ 153.028867][ T6824] veth1_to_bond: entered allmulticast mode [ 153.044246][ T6824] veth0_to_team: entered allmulticast mode [ 153.045986][ T5949] usb 4-1: USB disconnect, device number 19 [ 153.091399][ T6824] veth1_to_team: entered allmulticast mode [ 153.191820][ T6824] veth0_to_batadv: entered allmulticast mode [ 153.209462][ T6824] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 153.224169][ T6824] batadv_slave_0: entered allmulticast mode [ 153.245961][ T6824] veth1_to_batadv: entered allmulticast mode [ 153.315208][ T5978] udevd[5978]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 153.395600][ T6824] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 153.406374][ T6824] batadv_slave_1: entered allmulticast mode [ 153.427010][ T6824] xfrm0: entered allmulticast mode [ 153.436764][ T6824] veth0_to_hsr: entered allmulticast mode [ 153.449220][ T6824] hsr_slave_0: entered allmulticast mode [ 153.466736][ T6826] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 153.483135][ T6824] veth1_to_hsr: entered allmulticast mode [ 153.486772][ T6826] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.495938][ T6824] hsr_slave_1: entered allmulticast mode [ 153.508321][ T6824] hsr0: entered allmulticast mode [ 153.519286][ T6824] veth1_virt_wifi: entered allmulticast mode [ 153.527628][ T6826] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=4127567289 (33020538312 ns) > initial count (21272959856 ns). Using initial count to start timer. [ 153.530274][ T6824] veth0_virt_wifi: entered allmulticast mode [ 153.556469][ T6824] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 153.579942][ T6824] veth1_vlan: entered allmulticast mode [ 153.590206][ T6824] veth0_vlan: entered allmulticast mode [ 153.622452][ T6824] vlan0: entered allmulticast mode [ 153.631278][ T6824] vlan1: entered allmulticast mode [ 153.637687][ T6824] macvlan0: entered allmulticast mode [ 153.650083][ T6824] macvlan1: entered allmulticast mode [ 153.660480][ T6824] ipvlan0: entered allmulticast mode [ 153.666088][ T6824] ipvlan1: entered allmulticast mode [ 153.672359][ T6824] veth1_macvtap: entered allmulticast mode [ 153.681499][ T6824] veth0_macvtap: entered allmulticast mode [ 153.690225][ T6824] macvtap0: entered allmulticast mode [ 153.699780][ T6824] macsec0: entered allmulticast mode [ 153.709503][ T6824] geneve0: entered allmulticast mode [ 153.719248][ T6824] geneve1: entered allmulticast mode [ 153.734080][ T6824] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 153.748021][ T6824] netdevsim netdevsim4 netdevsim1: entered allmulticast mode [ 153.763063][ T6824] netdevsim netdevsim4 netdevsim2: entered allmulticast mode [ 153.775110][ T6824] netdevsim netdevsim4 netdevsim3: entered allmulticast mode [ 153.797218][ T6824] mac80211_hwsim hwsim10 wlan0: entered allmulticast mode [ 153.830228][ T6824] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 153.845608][ T6824] bridge1: entered allmulticast mode [ 153.854997][ T6824] erspan1: entered allmulticast mode [ 153.865890][ T6837] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 153.968597][ T6844] tipc: Enabling of bearer rejected, failed to enable media [ 154.011950][ T36] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.036570][ T12] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.049042][ T12] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.068883][ T12] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.078125][ T5949] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 154.250698][ T5949] usb 4-1: Using ep0 maxpacket: 16 [ 154.259870][ T5949] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 154.269124][ T5949] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.280504][ T5949] usb 4-1: Product: syz [ 154.284751][ T5949] usb 4-1: Manufacturer: syz [ 154.289411][ T5949] usb 4-1: SerialNumber: syz [ 154.311252][ T5949] usb 4-1: config 0 descriptor?? [ 154.326000][ T5949] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 154.360559][ T9] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 154.370895][ T5949] usb 4-1: Detected FT232H [ 154.451097][ T10] gspca_sonixj: reg_r err -110 [ 154.465605][ T6864] netlink: 8 bytes leftover after parsing attributes in process `syz.2.283'. [ 154.478134][ T6864] netlink: 56 bytes leftover after parsing attributes in process `syz.2.283'. [ 154.490735][ T10] sonixj 1-1:0.0: probe with driver sonixj failed with error -110 [ 154.523727][ T5949] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 154.538663][ T5949] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 154.549458][ T5949] ftdi_sio 4-1:0.0: GPIO initialisation failed: -71 [ 154.564269][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 154.579433][ T9] usb 5-1: New USB device found, idVendor=10d2, idProduct=2865, bcdDevice=a4.c9 [ 154.589462][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.613467][ T5949] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 154.636338][ T9] usb 5-1: config 0 descriptor?? [ 154.649149][ T5949] usb 4-1: USB disconnect, device number 20 [ 154.663670][ T9] usblcd 5-1:0.0: USBLCD model not supported. [ 154.675786][ T5949] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 154.694906][ T5949] ftdi_sio 4-1:0.0: device disconnected [ 154.703596][ T6866] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 154.714082][ T6866] macvtap1: entered allmulticast mode [ 154.722194][ T6866] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode [ 154.736151][ T6866] mac80211_hwsim hwsim4 wlan0: left allmulticast mode [ 154.743221][ T6866] mac80211_hwsim hwsim4 wlan0: left promiscuous mode [ 154.866454][ T6856] netlink: 8 bytes leftover after parsing attributes in process `syz.4.279'. [ 154.879460][ T6868] netlink: 12 bytes leftover after parsing attributes in process `syz.2.285'. [ 155.257901][ T9] usb 1-1: USB disconnect, device number 11 [ 155.506027][ T6876] 8021q: adding VLAN 0 to HW filter on device bond1 [ 156.860334][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 156.870071][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 156.878284][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 156.887927][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 156.896715][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 157.150638][ T10] usb 5-1: USB disconnect, device number 12 [ 157.222131][ T6898] netlink: 8 bytes leftover after parsing attributes in process `syz.2.298'. [ 157.245156][ T6898] netlink: 56 bytes leftover after parsing attributes in process `syz.2.298'. [ 157.278033][ T6897] macvtap1: entered allmulticast mode [ 157.495823][ T5949] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 157.650512][ T5949] usb 4-1: device descriptor read/64, error -71 [ 157.817430][ T6913] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 157.944369][ T5949] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 158.100518][ T5937] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 158.122133][ T10] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 158.129749][ T5949] usb 4-1: device descriptor read/64, error -71 [ 158.252355][ T6889] chnl_net:caif_netlink_parms(): no params data found [ 158.259667][ T5949] usb usb4-port1: attempt power cycle [ 158.300782][ T5937] usb 3-1: Using ep0 maxpacket: 16 [ 158.334393][ T5937] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 158.364076][ T5937] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.368124][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 158.401989][ T10] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 158.443070][ T5937] usb 3-1: Product: syz [ 158.449773][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 158.469127][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.469336][ T5937] usb 3-1: Manufacturer: syz [ 158.496980][ T10] usb 1-1: Product: syz [ 158.497424][ T5937] usb 3-1: SerialNumber: syz [ 158.518410][ T10] usb 1-1: Manufacturer: syz [ 158.519594][ T5937] usb 3-1: config 0 descriptor?? [ 158.538965][ T10] usb 1-1: SerialNumber: syz [ 158.564554][ T5937] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 158.623966][ T5937] usb 3-1: Detected FT232H [ 158.624863][ T10] hub 1-1:1.0: bad descriptor, ignoring hub [ 158.661228][ T5949] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 158.680470][ T10] hub 1-1:1.0: probe with driver hub failed with error -5 [ 158.718276][ T5949] usb 4-1: device descriptor read/8, error -71 [ 158.766386][ T5937] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 158.785815][ T5937] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 158.806033][ T5937] ftdi_sio 3-1:0.0: GPIO initialisation failed: -71 [ 158.820549][ T5951] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 158.826196][ T5937] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 158.856943][ T5937] usb 3-1: USB disconnect, device number 10 [ 158.871950][ T5937] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 158.897546][ T5937] ftdi_sio 3-1:0.0: device disconnected [ 158.990809][ T5949] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 158.991942][ T5861] Bluetooth: hci1: command tx timeout [ 159.006155][ T5862] usb 1-1: USB disconnect, device number 12 [ 159.023036][ T5951] usb 5-1: Using ep0 maxpacket: 32 [ 159.039351][ T5949] usb 4-1: device descriptor read/8, error -71 [ 159.055254][ T6889] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.071271][ T6889] bridge0: port 1(bridge_slave_0) entered disabled state [ 159.077587][ T5951] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 159.099984][ T6889] bridge_slave_0: entered allmulticast mode [ 159.108210][ T5951] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 159.117812][ T6889] bridge_slave_0: entered promiscuous mode [ 159.128539][ T6889] bridge0: port 2(bridge_slave_1) entered blocking state [ 159.135917][ T6889] bridge0: port 2(bridge_slave_1) entered disabled state [ 159.143825][ T5951] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 159.145208][ T6889] bridge_slave_1: entered allmulticast mode [ 159.164959][ T5951] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 159.179575][ T5951] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 159.182107][ T6889] bridge_slave_1: entered promiscuous mode [ 159.199294][ T5951] usb 5-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 159.209065][ T5949] usb usb4-port1: unable to enumerate USB device [ 159.219706][ T5951] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.228180][ T5951] usb 5-1: Product: syz [ 159.238109][ T5951] usb 5-1: Manufacturer: syz [ 159.243367][ T5951] usb 5-1: SerialNumber: syz [ 159.273936][ T5951] usb 5-1: config 0 descriptor?? [ 159.325866][ T6889] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 159.330672][ T5937] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 159.340903][ T6889] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 159.405084][ T6889] team0: Port device team_slave_0 added [ 159.416547][ T6889] team0: Port device team_slave_1 added [ 159.468131][ T6889] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 159.475497][ T6889] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 159.505571][ T6889] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 159.525868][ T5937] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 159.545910][ T6889] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 159.556311][ T5937] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 159.570582][ T6889] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 159.601287][ T6889] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 159.619955][ T5937] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 159.630227][ T5937] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.639846][ T5937] usb 1-1: Product: syz [ 159.644334][ T5937] usb 1-1: Manufacturer: syz [ 159.650708][ T5937] usb 1-1: SerialNumber: syz [ 159.672886][ T5937] hub 1-1:1.0: bad descriptor, ignoring hub [ 159.678859][ T5937] hub 1-1:1.0: probe with driver hub failed with error -5 [ 159.779789][ T6889] hsr_slave_0: entered promiscuous mode [ 159.786970][ T6889] hsr_slave_1: entered promiscuous mode [ 159.795240][ T6889] debugfs: 'hsr0' already exists in 'hsr' [ 159.802763][ T6889] Cannot create hsr debugfs directory [ 160.196172][ T6889] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 160.235013][ T6889] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 160.298347][ T6889] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 160.315759][ T6889] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 160.483490][ T6967] netlink: 12 bytes leftover after parsing attributes in process `syz.3.306'. [ 160.510705][ T5951] iforce 5-1:0.0: usb_submit_urb failed: -110 [ 160.517968][ T5951] input input12: Device does not respond to id packet M [ 160.526335][ T5951] iforce 5-1:0.0: usb_submit_urb failed: -32 [ 160.545772][ T5951] input input12: Device does not respond to id packet P [ 160.566204][ T5951] iforce 5-1:0.0: usb_submit_urb failed: -32 [ 160.586179][ T5951] input input12: Device does not respond to id packet B [ 160.602681][ T5951] iforce 5-1:0.0: usb_submit_urb failed: -32 [ 160.634821][ T6889] 8021q: adding VLAN 0 to HW filter on device bond0 [ 160.647676][ T5951] input input12: Device does not respond to id packet N [ 160.689731][ T5951] iforce 5-1:0.0: usb_submit_urb failed: -32 [ 160.727582][ T5951] iforce 5-1:0.0: usb_submit_urb failed: -32 [ 160.775753][ T5951] iforce 5-1:0.0: usb_submit_urb failed: -32 [ 160.788409][ T6889] 8021q: adding VLAN 0 to HW filter on device team0 [ 160.816085][ T5951] iforce 5-1:0.0: usb_submit_urb failed: -32 [ 160.856635][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.863848][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 160.874210][ T5951] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input12 [ 160.964261][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.971538][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 161.072557][ T5861] Bluetooth: hci1: command tx timeout [ 161.401500][ T5951] usb 1-1: USB disconnect, device number 13 [ 161.416727][ T5937] usb 5-1: USB disconnect, device number 13 [ 161.582744][ T6991] netlink: 12 bytes leftover after parsing attributes in process `syz.3.311'. [ 161.591395][ T6889] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 161.653291][ T6992] macvtap1: entered allmulticast mode [ 161.708169][ T6992] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode [ 161.756068][ T6992] mac80211_hwsim hwsim2 wlan0: left allmulticast mode [ 162.008080][ T6889] veth0_vlan: entered promiscuous mode [ 162.063026][ T6889] veth1_vlan: entered promiscuous mode [ 162.798266][ T6889] veth0_macvtap: entered promiscuous mode [ 162.828583][ T6889] veth1_macvtap: entered promiscuous mode [ 162.850525][ T5862] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 162.969605][ T6889] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 163.013506][ T6889] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 163.032685][ T5862] usb 5-1: Using ep0 maxpacket: 16 [ 163.069192][ T5983] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.071457][ T5862] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 163.086330][ T5937] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 163.089248][ T5983] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.116674][ T5862] usb 5-1: config 0 has no interface number 0 [ 163.130558][ T5862] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 163.146847][ T5983] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.151491][ T5861] Bluetooth: hci1: command tx timeout [ 163.177874][ T5983] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.180666][ T5862] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 163.214434][ T5862] usb 5-1: config 0 interface 41 has no altsetting 0 [ 163.232088][ T5862] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 163.242841][ T5862] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.250976][ T5937] usb 1-1: Using ep0 maxpacket: 16 [ 163.258525][ T5862] usb 5-1: Product: syz [ 163.263628][ T5862] usb 5-1: Manufacturer: syz [ 163.268548][ T5862] usb 5-1: SerialNumber: syz [ 163.282156][ T5937] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 163.310143][ T5937] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.358873][ T5862] usb 5-1: config 0 descriptor?? [ 163.367223][ T5937] usb 1-1: Product: syz [ 163.383109][ T7006] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 163.401781][ T5937] usb 1-1: Manufacturer: syz [ 163.406471][ T5937] usb 1-1: SerialNumber: syz [ 163.414354][ T7006] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 163.480803][ T5937] usb 1-1: config 0 descriptor?? [ 163.512318][ T5937] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 163.558158][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 163.575523][ T5937] usb 1-1: Detected FT232H [ 163.588566][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 163.647921][ T7006] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 163.658904][ T7006] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 163.700649][ T5937] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 163.718701][ T7028] netlink: 4 bytes leftover after parsing attributes in process `syz.3.320'. [ 163.720670][ T5937] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 163.738127][ T3563] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 163.738697][ T5937] ftdi_sio 1-1:0.0: GPIO initialisation failed: -71 [ 163.758732][ T3563] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 163.766995][ T5937] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 163.785340][ T5937] usb 1-1: USB disconnect, device number 14 [ 163.799025][ T5937] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 163.823805][ T5937] ftdi_sio 1-1:0.0: device disconnected [ 164.294731][ T5949] usb 6-1: new low-speed USB device number 2 using dummy_hcd [ 164.297770][ T5862] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 164.461618][ T5949] usb 6-1: Invalid ep0 maxpacket: 16 [ 164.600875][ T5949] usb 6-1: new low-speed USB device number 3 using dummy_hcd [ 164.761892][ T5949] usb 6-1: Invalid ep0 maxpacket: 16 [ 164.772754][ T5949] usb usb6-port1: attempt power cycle [ 164.894864][ T7057] netlink: 12 bytes leftover after parsing attributes in process `syz.3.323'. [ 165.110764][ T5949] usb 6-1: new low-speed USB device number 4 using dummy_hcd [ 165.174061][ T5949] usb 6-1: Invalid ep0 maxpacket: 16 [ 165.230892][ T5861] Bluetooth: hci1: command tx timeout [ 165.331610][ T5949] usb 6-1: new low-speed USB device number 5 using dummy_hcd [ 165.360712][ T5951] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 165.414912][ T5949] usb 6-1: Invalid ep0 maxpacket: 16 [ 165.443978][ T5949] usb usb6-port1: unable to enumerate USB device [ 165.722039][ T5951] usb 3-1: Using ep0 maxpacket: 32 [ 165.752490][ T5951] usb 3-1: config 26 has too many interfaces: 141, using maximum allowed: 32 [ 165.768952][ T5951] usb 3-1: config 26 has an invalid descriptor of length 0, skipping remainder of the config [ 165.837663][ T5951] usb 3-1: config 26 has 0 interfaces, different from the descriptor's value: 141 [ 165.952217][ T5951] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 165.972853][ T5951] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.301913][ T5951] usb 3-1: Product: syz [ 166.315714][ T5951] usb 3-1: Manufacturer: syz [ 166.321488][ T5951] usb 3-1: SerialNumber: syz [ 166.494068][ T5862] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0000:ffffffb9 [ 166.510678][ T5862] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -71 [ 166.565991][ T5862] usb 5-1: USB disconnect, device number 14 [ 166.653604][ T5951] usb 3-1: USB disconnect, device number 11 [ 166.937511][ T7087] syz.0.328 (7087): drop_caches: 0 [ 167.174899][ T7094] FAULT_INJECTION: forcing a failure. [ 167.174899][ T7094] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 167.232624][ T7094] CPU: 1 UID: 0 PID: 7094 Comm: syz.5.330 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 167.232657][ T7094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 167.232670][ T7094] Call Trace: [ 167.232679][ T7094] [ 167.232688][ T7094] dump_stack_lvl+0x189/0x250 [ 167.232722][ T7094] ? __pfx____ratelimit+0x10/0x10 [ 167.232762][ T7094] ? __pfx_dump_stack_lvl+0x10/0x10 [ 167.232788][ T7094] ? __pfx__printk+0x10/0x10 [ 167.232818][ T7094] ? __might_fault+0xb0/0x130 [ 167.232859][ T7094] should_fail_ex+0x414/0x560 [ 167.232889][ T7094] _copy_from_user+0x2d/0xb0 [ 167.232910][ T7094] ___sys_sendmsg+0x158/0x2a0 [ 167.232947][ T7094] ? __pfx____sys_sendmsg+0x10/0x10 [ 167.233016][ T7094] ? __fget_files+0x2a/0x420 [ 167.233047][ T7094] ? __fget_files+0x3a0/0x420 [ 167.233090][ T7094] __x64_sys_sendmsg+0x19b/0x260 [ 167.233125][ T7094] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 167.233186][ T7094] ? __pfx_ksys_write+0x10/0x10 [ 167.233213][ T7094] ? rcu_is_watching+0x15/0xb0 [ 167.233266][ T7094] ? do_syscall_64+0xbe/0x3b0 [ 167.233296][ T7094] do_syscall_64+0xfa/0x3b0 [ 167.233326][ T7094] ? lockdep_hardirqs_on+0x9c/0x150 [ 167.233351][ T7094] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.233370][ T7094] ? clear_bhb_loop+0x60/0xb0 [ 167.233372][ T5951] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 167.233397][ T7094] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.233418][ T7094] RIP: 0033:0x7f87e718ebe9 [ 167.233439][ T7094] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 167.233459][ T7094] RSP: 002b:00007f87e7f9e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 167.233483][ T7094] RAX: ffffffffffffffda RBX: 00007f87e73b5fa0 RCX: 00007f87e718ebe9 [ 167.233500][ T7094] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 167.233515][ T7094] RBP: 00007f87e7f9e090 R08: 0000000000000000 R09: 0000000000000000 [ 167.233530][ T7094] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 167.233544][ T7094] R13: 00007f87e73b6038 R14: 00007f87e73b5fa0 R15: 00007f87e74dfa28 [ 167.233578][ T7094] [ 167.578669][ T7099] netlink: 324 bytes leftover after parsing attributes in process `syz.3.332'. [ 167.750932][ T7110] netlink: 'syz.0.335': attribute type 24 has an invalid length. [ 167.960448][ T5951] usb 3-1: Using ep0 maxpacket: 16 [ 167.987497][ T5951] usb 3-1: config 1 interface 0 altsetting 74 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 168.020534][ T5951] usb 3-1: config 1 interface 0 has no altsetting 0 [ 168.045728][ T5951] usb 3-1: New USB device found, idVendor=046d, idProduct=c22d, bcdDevice= 0.40 [ 168.072225][ T5951] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.090923][ T5951] usb 3-1: Product: syz [ 168.095655][ T5951] usb 3-1: Manufacturer: ї [ 168.104732][ T5951] usb 3-1: SerialNumber: syz [ 168.429249][ T9] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 168.602055][ T7092] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 168.620475][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 168.627813][ T9] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 168.627978][ T7092] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 168.636643][ T9] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 168.740578][ T9] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 168.750009][ T9] usb 1-1: config 1 has no interface number 1 [ 168.758154][ T9] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 168.780923][ T9] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 14129, setting to 64 [ 168.806533][ T9] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 168.820877][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.829432][ T9] usb 1-1: Product: syz [ 168.834219][ T9] usb 1-1: Manufacturer: syz [ 168.838964][ T9] usb 1-1: SerialNumber: syz [ 168.865313][ T7112] delete_channel: no stack [ 169.295386][ T9] usb 1-1: USB disconnect, device number 15 [ 169.331379][ T5915] usb 4-1: new low-speed USB device number 25 using dummy_hcd [ 169.490600][ T5915] usb 4-1: device descriptor read/64, error -71 [ 169.740702][ T5915] usb 4-1: new low-speed USB device number 26 using dummy_hcd [ 169.882976][ T5915] usb 4-1: device descriptor read/64, error -71 [ 169.918203][ T5951] usbhid 3-1:1.0: can't add hid device: -71 [ 169.935102][ T5951] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 169.955407][ T5951] usb 3-1: USB disconnect, device number 12 [ 170.031580][ T5915] usb usb4-port1: attempt power cycle [ 170.113009][ T5862] usb 1-1: new low-speed USB device number 16 using dummy_hcd [ 170.281400][ T5862] usb 1-1: Invalid ep0 maxpacket: 16 [ 170.404862][ T5915] usb 4-1: new low-speed USB device number 27 using dummy_hcd [ 170.430851][ T5862] usb 1-1: new low-speed USB device number 17 using dummy_hcd [ 170.443365][ T5915] usb 4-1: device descriptor read/8, error -71 [ 170.610777][ T5862] usb 1-1: Invalid ep0 maxpacket: 16 [ 170.616666][ T5862] usb usb1-port1: attempt power cycle [ 170.700657][ T5915] usb 4-1: new low-speed USB device number 28 using dummy_hcd [ 170.721486][ T5915] usb 4-1: device descriptor read/8, error -71 [ 170.837243][ T5915] usb usb4-port1: unable to enumerate USB device [ 171.190963][ T5862] usb 1-1: new low-speed USB device number 18 using dummy_hcd [ 171.239495][ T5862] usb 1-1: Invalid ep0 maxpacket: 16 [ 171.470509][ T5862] usb 1-1: new low-speed USB device number 19 using dummy_hcd [ 171.541856][ T5862] usb 1-1: Invalid ep0 maxpacket: 16 [ 171.560258][ T5862] usb usb1-port1: unable to enumerate USB device [ 171.950868][ T7172] netlink: 4 bytes leftover after parsing attributes in process `syz.2.353'. [ 172.004131][ T7172] netlink: 12 bytes leftover after parsing attributes in process `syz.2.353'. [ 172.390658][ T5862] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 172.542845][ T5862] usb 4-1: config 0 has an invalid interface number: 47 but max is 0 [ 172.569900][ T5862] usb 4-1: config 0 has no interface number 0 [ 172.649754][ T5862] usb 4-1: config 0 interface 47 altsetting 252 bulk endpoint 0xD has invalid maxpacket 8 [ 172.703781][ T5862] usb 4-1: config 0 interface 47 altsetting 252 bulk endpoint 0x1 has invalid maxpacket 8 [ 172.739069][ T5862] usb 4-1: config 0 interface 47 altsetting 252 endpoint 0x9 has invalid maxpacket 1024, setting to 64 [ 172.811853][ T5862] usb 4-1: config 0 interface 47 has no altsetting 0 [ 172.881002][ T5862] usb 4-1: New USB device found, idVendor=7d15, idProduct=31b2, bcdDevice=57.4b [ 172.918075][ T7189] netlink: 8 bytes leftover after parsing attributes in process `syz.5.355'. [ 172.927281][ T7189] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 172.935125][ T7189] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 172.956551][ T5862] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.031324][ T5862] usb 4-1: config 0 descriptor?? [ 173.040836][ T7175] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 173.049623][ T7175] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 173.222079][ T5862] usb-storage 4-1:0.47: USB Mass Storage device detected [ 173.455685][ T5862] usb 4-1: USB disconnect, device number 29 [ 175.718024][ T7219] netlink: 28 bytes leftover after parsing attributes in process `syz.0.365'. [ 176.310546][ T5946] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 176.326355][ T7229] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 176.483166][ T5946] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 176.517774][ T5946] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 176.536625][ T5946] usb 5-1: New USB device found, idVendor=146b, idProduct=0902, bcdDevice= 0.00 [ 176.570003][ T5946] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.590331][ T5946] usb 5-1: config 0 descriptor?? [ 176.591475][ T5915] usb 4-1: new low-speed USB device number 30 using dummy_hcd [ 176.778042][ T5915] usb 4-1: device descriptor read/64, error -71 [ 177.111628][ T5946] bigben 0003:146B:0902.0004: unexpected rdesc, please submit for review [ 177.141109][ T5946] bigben 0003:146B:0902.0004: hidraw0: USB HID v0.01 Device [HID 146b:0902] on usb-dummy_hcd.4-1/input0 [ 177.173771][ T5946] bigben 0003:146B:0902.0004: not enough fields in HID_OUTPUT_REPORT 0 [ 177.190558][ T5946] bigben 0003:146B:0902.0004: no output report found [ 177.197886][ T5915] usb 4-1: new low-speed USB device number 31 using dummy_hcd [ 177.309032][ T5862] usb 5-1: USB disconnect, device number 15 [ 177.360779][ T5915] usb 4-1: device descriptor read/64, error -71 [ 177.460545][ T5946] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 177.490838][ T5915] usb usb4-port1: attempt power cycle [ 177.647550][ T5946] usb 3-1: Using ep0 maxpacket: 8 [ 177.654721][ T5946] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 177.674405][ T5946] usb 3-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 177.684695][ T5946] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.738109][ T5946] usb 3-1: Product: syz [ 177.751600][ T5946] usb 3-1: Manufacturer: syz [ 177.769342][ T5946] usb 3-1: SerialNumber: syz [ 177.796451][ T5946] usb 3-1: config 0 descriptor?? [ 177.885528][ T5915] usb 4-1: new low-speed USB device number 32 using dummy_hcd [ 177.955710][ T5915] usb 4-1: device descriptor read/8, error -71 [ 177.963992][ T5946] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 178.038400][ T30] audit: type=1326 audit(1754688666.352:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7244 comm="syz.4.374" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7600b8ebe9 code=0x0 [ 178.200658][ T5915] usb 4-1: new low-speed USB device number 33 using dummy_hcd [ 178.234662][ T5915] usb 4-1: device descriptor read/8, error -71 [ 178.371567][ T5915] usb usb4-port1: unable to enumerate USB device [ 179.031120][ T5946] gspca_zc3xx: reg_w_i err -110 [ 179.825973][ T7263] netlink: 'syz.4.377': attribute type 24 has an invalid length. [ 180.030519][ T5946] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 180.037020][ T5946] gspca_zc3xx 3-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 180.249218][ T5915] usb 3-1: USB disconnect, device number 13 [ 180.310346][ T7279] netlink: 12 bytes leftover after parsing attributes in process `syz.2.383'. [ 180.629683][ T5946] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 180.830862][ T5946] usb 4-1: Using ep0 maxpacket: 16 [ 180.849145][ T5946] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 180.876528][ T5946] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 180.899795][ T5946] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 180.909535][ T5946] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.918446][ T5946] usb 4-1: Product: syz [ 180.923664][ T5946] usb 4-1: Manufacturer: syz [ 180.930740][ T5946] usb 4-1: SerialNumber: syz [ 180.967788][ T5946] usb 4-1: config 0 descriptor?? [ 180.997602][ T5946] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 181.019834][ T5946] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 181.198620][ T7289] netlink: 324 bytes leftover after parsing attributes in process `syz.4.386'. [ 181.599009][ T5946] em28xx 4-1:0.0: chip ID is em2874 [ 181.871642][ T5946] usb 4-1: USB disconnect, device number 34 [ 181.878665][ T5946] em28xx 4-1:0.0: Disconnecting em28xx [ 181.952026][ T5946] em28xx 4-1:0.0: Freeing device [ 181.994965][ T7302] netlink: 'syz.5.391': attribute type 24 has an invalid length. [ 182.210113][ T7309] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 182.419740][ T7316] netlink: 324 bytes leftover after parsing attributes in process `syz.2.398'. [ 182.865105][ T7331] netlink: 'syz.5.405': attribute type 24 has an invalid length. [ 182.911051][ T5946] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 183.223886][ T5946] usb 1-1: Using ep0 maxpacket: 32 [ 183.239582][ T5946] usb 1-1: config 0 has an invalid interface number: 9 but max is 0 [ 183.248636][ T5946] usb 1-1: config 0 has no interface number 0 [ 183.267136][ T5946] usb 1-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 183.348381][ T5946] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.950691][ T5946] usb 1-1: Product: syz [ 183.954927][ T5946] usb 1-1: Manufacturer: syz [ 183.959549][ T5946] usb 1-1: SerialNumber: syz [ 183.986998][ T5946] usb 1-1: config 0 descriptor?? [ 184.092083][ T5946] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 185.180498][ T5946] gspca_topro: reg_w err -110 [ 185.210583][ T5946] gspca_topro: Sensor soi763a [ 185.914440][ T7364] netlink: 12 bytes leftover after parsing attributes in process `syz.3.413'. [ 185.936195][ T7365] netlink: 24 bytes leftover after parsing attributes in process `syz.4.412'. [ 185.974424][ T5915] usb 1-1: USB disconnect, device number 20 [ 186.133349][ T7365] fuse: Invalid uid '00000000000000000001' [ 186.143730][ T7365] netlink: 196 bytes leftover after parsing attributes in process `syz.4.412'. [ 186.189586][ T7374] netlink: 12 bytes leftover after parsing attributes in process `syz.5.416'. [ 186.262282][ T7376] input: syz1 as /devices/virtual/input/input13 [ 186.292657][ T5946] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 186.460693][ T5946] usb 3-1: Using ep0 maxpacket: 32 [ 186.474792][ T5946] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 186.485027][ T5946] usb 3-1: config 0 has no interface number 0 [ 186.492263][ T5946] usb 3-1: too many endpoints for config 0 interface 12 altsetting 2: 235, using maximum allowed: 30 [ 186.510459][ T5946] usb 3-1: config 0 interface 12 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 186.665726][ T5946] usb 3-1: config 0 interface 12 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 186.723990][ T5946] usb 3-1: config 0 interface 12 altsetting 2 has 2 endpoint descriptors, different from the interface descriptor's value: 235 [ 186.764416][ T5946] usb 3-1: config 0 interface 12 has no altsetting 0 [ 186.782237][ T5946] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 186.791929][ T5946] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.808732][ T5946] usb 3-1: Product: syz [ 186.818800][ T5946] usb 3-1: Manufacturer: syz [ 186.832605][ T5946] usb 3-1: SerialNumber: syz [ 186.868498][ T5946] usb 3-1: config 0 descriptor?? [ 186.902165][ T5946] f81534 3-1:0.12: unsupported endpoint max packet size [ 187.791872][ T7403] netlink: 8 bytes leftover after parsing attributes in process `syz.4.425'. [ 187.801264][ T7403] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 187.808882][ T7403] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 188.175641][ T7405] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.183307][ T7405] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.490865][ T7410] netlink: 324 bytes leftover after parsing attributes in process `syz.2.427'. [ 188.989583][ T7420] netlink: 12 bytes leftover after parsing attributes in process `syz.3.431'. [ 189.151048][ T12] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.196747][ T12] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.244927][ T12] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.277415][ T7423] netlink: 324 bytes leftover after parsing attributes in process `syz.3.433'. [ 189.290573][ T12] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.344365][ T7425] netlink: 28 bytes leftover after parsing attributes in process `syz.2.432'. [ 189.378910][ T7425] netlink: 'syz.2.432': attribute type 7 has an invalid length. [ 189.412437][ T7432] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 189.465025][ T7425] netlink: 'syz.2.432': attribute type 8 has an invalid length. [ 189.482819][ T7425] netlink: 4 bytes leftover after parsing attributes in process `syz.2.432'. [ 189.535507][ T7432] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 191.061176][ T7461] __nla_validate_parse: 1 callbacks suppressed [ 191.061196][ T7461] netlink: 12 bytes leftover after parsing attributes in process `syz.3.444'. [ 191.190702][ T7464] ipvlan0: mtu less than device minimum [ 191.319101][ T7464] netlink: 52 bytes leftover after parsing attributes in process `syz.4.443'. [ 191.419306][ T7465] netlink: 52 bytes leftover after parsing attributes in process `syz.4.443'. [ 191.584718][ T24] usb 3-1: USB disconnect, device number 14 [ 191.629811][ T7472] netlink: 12 bytes leftover after parsing attributes in process `syz.3.449'. [ 192.066084][ T7481] netlink: 8 bytes leftover after parsing attributes in process `syz.3.450'. [ 192.129438][ T7481] bridge0: port 3(gretap0) entered blocking state [ 192.139624][ T7481] bridge0: port 3(gretap0) entered disabled state [ 192.147225][ T7481] gretap0: entered allmulticast mode [ 192.160972][ T7481] gretap0: entered promiscuous mode [ 192.167848][ T7481] bridge0: port 3(gretap0) entered blocking state [ 192.174499][ T7481] bridge0: port 3(gretap0) entered forwarding state [ 192.559178][ T7488] netlink: 'syz.0.452': attribute type 5 has an invalid length. [ 192.665576][ T30] audit: type=1326 audit(1754688680.952:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7483 comm="syz.0.452" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8113d8ebe9 code=0x0 [ 193.139526][ T5862] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 193.350694][ T5951] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 193.380443][ T5862] usb 1-1: Using ep0 maxpacket: 32 [ 193.389667][ T5862] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 193.398675][ T5862] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 193.410531][ T5862] usb 1-1: config 0 has no interface number 0 [ 193.468443][ T5862] usb 1-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 0.02 [ 193.480189][ T5862] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.507848][ T5862] usb 1-1: Product: syz [ 193.549386][ T5862] usb 1-1: Manufacturer: syz [ 193.710156][ T5862] usb 1-1: SerialNumber: syz [ 193.793477][ T5862] usb 1-1: config 0 descriptor?? [ 193.806634][ T5951] usb 3-1: config 0 has no interfaces? [ 193.820532][ T5951] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 193.851274][ T5951] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.871661][ T5862] gspca_main: xirlink-cit-2.14.0 probing 0545:8080 [ 193.952126][ T5951] usb 3-1: Product: syz [ 193.952361][ T5862] input: xirlink-cit as /devices/platform/dummy_hcd.0/usb1/1-1/input/input14 [ 194.024169][ T5951] usb 3-1: Manufacturer: syz [ 194.165460][ T5951] usb 3-1: SerialNumber: syz [ 194.248867][ T5951] usb 3-1: config 0 descriptor?? [ 194.355146][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.409416][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.834858][ T7511] netlink: 'syz.4.457': attribute type 1 has an invalid length. [ 196.005556][ T7511] 8021q: adding VLAN 0 to HW filter on device bond2 [ 196.046789][ T5951] usb 1-1: USB disconnect, device number 22 [ 196.200637][ T7517] netlink: 8 bytes leftover after parsing attributes in process `syz.5.460'. [ 196.229919][ T7517] netlink: 56 bytes leftover after parsing attributes in process `syz.5.460'. [ 196.245455][ T7518] netlink: 8 bytes leftover after parsing attributes in process `syz.4.457'. [ 196.273132][ T7511] bond2: (slave veth3): Enslaving as an active interface with a down link [ 196.318608][ T7518] vlan2: entered allmulticast mode [ 196.356823][ T7514] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 196.496907][ T24] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 196.539473][ T7521] netlink: 36 bytes leftover after parsing attributes in process `syz.0.461'. [ 196.565834][ T7521] netlink: 16 bytes leftover after parsing attributes in process `syz.0.461'. [ 196.583100][ T7521] netlink: 36 bytes leftover after parsing attributes in process `syz.0.461'. [ 196.602849][ T7521] netlink: 36 bytes leftover after parsing attributes in process `syz.0.461'. [ 196.650792][ T24] usb 4-1: device descriptor read/64, error -71 [ 196.900506][ T24] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 196.926774][ T10] usb 3-1: USB disconnect, device number 15 [ 197.064274][ T7529] netlink: 'syz.2.464': attribute type 33 has an invalid length. [ 197.204699][ T24] usb 4-1: device descriptor read/64, error -71 [ 197.243688][ T7529] netlink: 152 bytes leftover after parsing attributes in process `syz.2.464'. [ 197.340897][ T24] usb usb4-port1: attempt power cycle [ 197.540557][ T5862] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 197.786299][ T5862] usb 3-1: device descriptor read/64, error -71 [ 197.792693][ T24] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 197.993461][ T24] usb 4-1: device descriptor read/8, error -71 [ 198.130492][ T5862] usb 3-1: new full-speed USB device number 17 using dummy_hcd [ 198.260689][ T24] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 198.293449][ T5862] usb 3-1: device descriptor read/64, error -71 [ 198.330947][ T24] usb 4-1: device descriptor read/8, error -71 [ 198.442566][ T5862] usb usb3-port1: attempt power cycle [ 198.464391][ T24] usb usb4-port1: unable to enumerate USB device [ 198.520558][ T7548] netlink: 8 bytes leftover after parsing attributes in process `syz.0.468'. [ 198.534897][ T7548] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 198.543651][ T7548] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 199.003313][ T5862] usb 3-1: new full-speed USB device number 18 using dummy_hcd [ 199.061931][ T5862] usb 3-1: device descriptor read/8, error -71 [ 199.360162][ T5862] usb 3-1: new full-speed USB device number 19 using dummy_hcd [ 199.483623][ T7561] capability: warning: `syz.3.471' uses deprecated v2 capabilities in a way that may be insecure [ 199.495028][ T5862] usb 3-1: device descriptor read/8, error -71 [ 199.640618][ T5862] usb usb3-port1: unable to enumerate USB device [ 199.676717][ T7564] trusted_key: encrypted_key: insufficient parameters specified [ 199.973146][ T1211] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 200.170542][ T1211] usb 6-1: Using ep0 maxpacket: 16 [ 200.208785][ T1211] usb 6-1: New USB device found, idVendor=0483, idProduct=1234, bcdDevice=ff.76 [ 200.344073][ T1211] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.352650][ T7568] netlink: 8 bytes leftover after parsing attributes in process `syz.2.473'. [ 200.389321][ T1211] usb 6-1: Product: syz [ 200.440890][ T1211] usb 6-1: Manufacturer: syz [ 200.460548][ T1211] usb 6-1: SerialNumber: syz [ 200.526790][ T1211] usb 6-1: config 0 descriptor?? [ 200.789744][ T1211] usb_8dev 6-1:0.0 can0: sending command message failed [ 200.844312][ T1211] usb_8dev 6-1:0.0 can0: can't get firmware version [ 200.942512][ T1211] usb_8dev 6-1:0.0: probe with driver usb_8dev failed with error -22 [ 200.992027][ T1211] usb 6-1: USB disconnect, device number 6 [ 201.807852][ T7601] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 201.910708][ T1211] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 201.950581][ T10] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 202.073890][ T1211] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 202.147304][ T7604] __nla_validate_parse: 1 callbacks suppressed [ 202.147325][ T7604] netlink: 8 bytes leftover after parsing attributes in process `syz.0.488'. [ 202.150448][ T1211] usb 3-1: can't read configurations, error -22 [ 202.173438][ T10] usb 5-1: config 0 has no interfaces? [ 202.184521][ T7604] netlink: 56 bytes leftover after parsing attributes in process `syz.0.488'. [ 202.195958][ T10] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 202.209152][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.223887][ T10] usb 5-1: Product: syz [ 202.234791][ T10] usb 5-1: Manufacturer: syz [ 202.253488][ T10] usb 5-1: SerialNumber: syz [ 202.274821][ T10] usb 5-1: config 0 descriptor?? [ 202.361485][ T1211] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 202.424943][ T7607] netlink: 'syz.0.489': attribute type 24 has an invalid length. [ 202.613044][ T1211] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 202.622519][ T1211] usb 3-1: can't read configurations, error -22 [ 202.676842][ T1211] usb usb3-port1: attempt power cycle [ 203.200681][ T1211] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 203.236295][ T1211] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 203.244589][ T1211] usb 3-1: can't read configurations, error -22 [ 203.404897][ T1211] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 203.728729][ T1211] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 203.740330][ T1211] usb 3-1: can't read configurations, error -22 [ 203.760287][ T1211] usb usb3-port1: unable to enumerate USB device [ 204.497997][ T24] usb 5-1: USB disconnect, device number 16 [ 204.646895][ T7625] FAULT_INJECTION: forcing a failure. [ 204.646895][ T7625] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 204.714396][ T7625] CPU: 1 UID: 0 PID: 7625 Comm: syz.4.495 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 204.714428][ T7625] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 204.714441][ T7625] Call Trace: [ 204.714450][ T7625] [ 204.714460][ T7625] dump_stack_lvl+0x189/0x250 [ 204.714492][ T7625] ? __pfx____ratelimit+0x10/0x10 [ 204.714520][ T7625] ? __pfx_dump_stack_lvl+0x10/0x10 [ 204.714546][ T7625] ? __pfx__printk+0x10/0x10 [ 204.714577][ T7625] ? __might_fault+0xb0/0x130 [ 204.714620][ T7625] should_fail_ex+0x414/0x560 [ 204.714650][ T7625] _copy_from_iter+0x1db/0x16f0 [ 204.714685][ T7625] ? rcu_is_watching+0x15/0xb0 [ 204.714709][ T7625] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 204.714760][ T7625] ? __pfx__copy_from_iter+0x10/0x10 [ 204.714793][ T7625] ? __build_skb_around+0x257/0x3e0 [ 204.714827][ T7625] ? netlink_sendmsg+0x642/0xb30 [ 204.714854][ T7625] ? skb_put+0x11b/0x210 [ 204.714886][ T7625] netlink_sendmsg+0x6b2/0xb30 [ 204.714926][ T7625] ? __pfx_netlink_sendmsg+0x10/0x10 [ 204.714958][ T7625] ? aa_sock_msg_perm+0xf1/0x1d0 [ 204.714991][ T7625] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 204.715014][ T7625] ? __pfx_netlink_sendmsg+0x10/0x10 [ 204.715043][ T7625] __sock_sendmsg+0x21c/0x270 [ 204.715072][ T7625] ____sys_sendmsg+0x505/0x830 [ 204.715111][ T7625] ? __pfx_____sys_sendmsg+0x10/0x10 [ 204.715153][ T7625] ? import_iovec+0x74/0xa0 [ 204.715178][ T7625] ___sys_sendmsg+0x21f/0x2a0 [ 204.715213][ T7625] ? __pfx____sys_sendmsg+0x10/0x10 [ 204.715284][ T7625] ? __fget_files+0x2a/0x420 [ 204.715316][ T7625] ? __fget_files+0x3a0/0x420 [ 204.715360][ T7625] __x64_sys_sendmsg+0x19b/0x260 [ 204.715396][ T7625] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 204.715444][ T7625] ? __pfx_ksys_write+0x10/0x10 [ 204.715470][ T7625] ? rcu_is_watching+0x15/0xb0 [ 204.715497][ T7625] ? do_syscall_64+0xbe/0x3b0 [ 204.715530][ T7625] do_syscall_64+0xfa/0x3b0 [ 204.715557][ T7625] ? lockdep_hardirqs_on+0x9c/0x150 [ 204.715583][ T7625] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.715605][ T7625] ? clear_bhb_loop+0x60/0xb0 [ 204.715632][ T7625] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.715654][ T7625] RIP: 0033:0x7f7600b8ebe9 [ 204.715673][ T7625] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 204.715694][ T7625] RSP: 002b:00007f7601a4a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 204.715717][ T7625] RAX: ffffffffffffffda RBX: 00007f7600db5fa0 RCX: 00007f7600b8ebe9 [ 204.715738][ T7625] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000006 [ 204.715753][ T7625] RBP: 00007f7601a4a090 R08: 0000000000000000 R09: 0000000000000000 [ 204.715766][ T7625] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 204.715779][ T7625] R13: 00007f7600db6038 R14: 00007f7600db5fa0 R15: 00007f7600edfa28 [ 204.715812][ T7625] [ 205.327922][ T7636] netlink: 28 bytes leftover after parsing attributes in process `syz.4.499'. [ 205.350928][ T10] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 205.399158][ T7636] openvswitch: netlink: Flow key attr not present in new flow. [ 205.516835][ T7640] netlink: 8 bytes leftover after parsing attributes in process `syz.5.500'. [ 205.530612][ T7640] netlink: 56 bytes leftover after parsing attributes in process `syz.5.500'. [ 205.550614][ T7642] netlink: 8 bytes leftover after parsing attributes in process `syz.2.497'. [ 205.559963][ T7642] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 205.567719][ T7642] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 205.589579][ T10] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 205.623629][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.657524][ T10] usb 1-1: config 0 descriptor?? [ 205.684117][ T10] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 206.410479][ T10] gspca_stv06xx: I2C: Read error writing address: -71 [ 206.468809][ T10] usb 1-1: USB disconnect, device number 23 [ 207.100212][ T7655] netlink: 8 bytes leftover after parsing attributes in process `syz.3.504'. [ 207.302227][ T7659] netlink: 12 bytes leftover after parsing attributes in process `syz.3.506'. [ 207.400873][ T5951] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 207.580789][ T5951] usb 1-1: Using ep0 maxpacket: 8 [ 207.590715][ T5951] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 207.625402][ T5951] usb 1-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 207.679158][ T5951] usb 1-1: config 0 interface 0 has no altsetting 0 [ 207.699505][ T5951] usb 1-1: New USB device found, idVendor=0458, idProduct=4018, bcdDevice= 0.00 [ 207.791759][ T10] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 207.870655][ T5951] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.908382][ T5951] usb 1-1: config 0 descriptor?? [ 208.040618][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 208.064531][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 208.096819][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 208.107319][ T10] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 208.116817][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.136336][ T10] usb 4-1: config 0 descriptor?? [ 208.336046][ T5951] kye 0003:0458:4018.0005: unknown main item tag 0x0 [ 208.355247][ T5951] kye 0003:0458:4018.0005: reserved main item tag 0xe [ 208.357041][ T7667] bridge0: entered promiscuous mode [ 208.368678][ T5951] kye 0003:0458:4018.0005: item fetching failed at offset 15/133 [ 208.393832][ T5951] kye 0003:0458:4018.0005: parse failed [ 208.402274][ T5951] kye 0003:0458:4018.0005: probe with driver kye failed with error -22 [ 208.471453][ T7667] macsec1: entered promiscuous mode [ 208.562645][ T5951] usb 1-1: USB disconnect, device number 24 [ 208.590337][ T5861] Bluetooth: hci4: Malformed LE Event: 0x0d [ 208.601968][ T7671] FAULT_INJECTION: forcing a failure. [ 208.601968][ T7671] name failslab, interval 1, probability 0, space 0, times 0 [ 208.609627][ T10] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 208.639636][ T7671] CPU: 0 UID: 0 PID: 7671 Comm: syz.5.509 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 208.639666][ T7671] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 208.639680][ T7671] Call Trace: [ 208.639688][ T7671] [ 208.639697][ T7671] dump_stack_lvl+0x189/0x250 [ 208.639729][ T7671] ? __pfx____ratelimit+0x10/0x10 [ 208.639757][ T7671] ? __pfx_dump_stack_lvl+0x10/0x10 [ 208.639784][ T7671] ? __pfx__printk+0x10/0x10 [ 208.639818][ T7671] ? __lock_acquire+0xab9/0xd20 [ 208.639860][ T7671] should_fail_ex+0x414/0x560 [ 208.639890][ T7671] should_failslab+0xa8/0x100 [ 208.639922][ T7671] kmem_cache_alloc_noprof+0x73/0x3c0 [ 208.639951][ T7671] ? skb_clone+0x212/0x3a0 [ 208.639977][ T7671] skb_clone+0x212/0x3a0 [ 208.640001][ T7671] __netlink_deliver_tap+0x404/0x850 [ 208.640043][ T7671] ? netlink_deliver_tap+0x2e/0x1b0 [ 208.640073][ T7671] netlink_deliver_tap+0x19c/0x1b0 [ 208.640103][ T7671] netlink_unicast+0x7fa/0x9e0 [ 208.640138][ T7671] ? __pfx_netlink_unicast+0x10/0x10 [ 208.640166][ T7671] ? netlink_sendmsg+0x642/0xb30 [ 208.640192][ T7671] ? skb_put+0x11b/0x210 [ 208.640225][ T7671] netlink_sendmsg+0x805/0xb30 [ 208.640263][ T7671] ? __pfx_netlink_sendmsg+0x10/0x10 [ 208.640295][ T7671] ? aa_sock_msg_perm+0xf1/0x1d0 [ 208.640327][ T7671] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 208.640363][ T7671] ? __pfx_netlink_sendmsg+0x10/0x10 [ 208.640394][ T7671] __sock_sendmsg+0x21c/0x270 [ 208.640422][ T7671] ____sys_sendmsg+0x505/0x830 [ 208.640461][ T7671] ? __pfx_____sys_sendmsg+0x10/0x10 [ 208.640504][ T7671] ? import_iovec+0x74/0xa0 [ 208.640529][ T7671] ___sys_sendmsg+0x21f/0x2a0 [ 208.640565][ T7671] ? __pfx____sys_sendmsg+0x10/0x10 [ 208.640639][ T7671] ? __fget_files+0x2a/0x420 [ 208.640672][ T7671] ? __fget_files+0x3a0/0x420 [ 208.640716][ T7671] __x64_sys_sendmsg+0x19b/0x260 [ 208.640753][ T7671] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 208.640797][ T7671] ? __pfx_ksys_write+0x10/0x10 [ 208.640824][ T7671] ? rcu_is_watching+0x15/0xb0 [ 208.640853][ T7671] ? do_syscall_64+0xbe/0x3b0 [ 208.640886][ T7671] do_syscall_64+0xfa/0x3b0 [ 208.640913][ T7671] ? lockdep_hardirqs_on+0x9c/0x150 [ 208.640940][ T7671] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 208.640962][ T7671] ? clear_bhb_loop+0x60/0xb0 [ 208.640989][ T7671] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 208.641016][ T7671] RIP: 0033:0x7f87e718ebe9 [ 208.641036][ T7671] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 208.641055][ T7671] RSP: 002b:00007f87e7f9e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 208.641078][ T7671] RAX: ffffffffffffffda RBX: 00007f87e73b5fa0 RCX: 00007f87e718ebe9 [ 208.641093][ T7671] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000006 [ 208.641106][ T7671] RBP: 00007f87e7f9e090 R08: 0000000000000000 R09: 0000000000000000 [ 208.641119][ T7671] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 208.641132][ T7671] R13: 00007f87e73b6038 R14: 00007f87e73b5fa0 R15: 00007f87e74dfa28 [ 208.641165][ T7671] [ 208.942949][ T10] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 208.949971][ T10] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 208.956925][ T10] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 208.963873][ T10] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 208.980591][ T10] savu 0003:1E7D:2D5A.0006: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 209.028215][ T7661] syz.3.507: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 209.099840][ T7661] CPU: 0 UID: 0 PID: 7661 Comm: syz.3.507 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 209.099864][ T7661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 209.099874][ T7661] Call Trace: [ 209.099880][ T7661] [ 209.099886][ T7661] dump_stack_lvl+0x189/0x250 [ 209.099911][ T7661] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 209.099936][ T7661] ? __pfx_dump_stack_lvl+0x10/0x10 [ 209.099955][ T7661] ? __pfx__printk+0x10/0x10 [ 209.099978][ T7661] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 209.100003][ T7661] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 209.100038][ T7661] warn_alloc+0x214/0x310 [ 209.100074][ T7661] ? stack_depot_save_flags+0x40/0x860 [ 209.100102][ T7661] ? __pfx_warn_alloc+0x10/0x10 [ 209.100128][ T7661] ? kasan_save_track+0x4f/0x80 [ 209.100148][ T7661] ? xskq_create+0x56/0x170 [ 209.100166][ T7661] ? xsk_init_queue+0xb0/0x110 [ 209.100181][ T7661] ? xsk_setsockopt+0x4dc/0x8d0 [ 209.100196][ T7661] ? do_sock_setsockopt+0x17c/0x1b0 [ 209.100219][ T7661] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 209.100240][ T7661] ? do_syscall_64+0xfa/0x3b0 [ 209.100260][ T7661] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.100282][ T7661] __vmalloc_node_range_noprof+0x125/0x12f0 [ 209.100328][ T7661] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 209.100365][ T7661] ? xskq_create+0x56/0x170 [ 209.100393][ T7661] ? __kasan_kmalloc+0x93/0xb0 [ 209.100421][ T7661] vmalloc_user_noprof+0xad/0xf0 [ 209.100444][ T7661] ? xskq_create+0xbf/0x170 [ 209.100462][ T7661] xskq_create+0xbf/0x170 [ 209.100490][ T7661] xsk_init_queue+0xb0/0x110 [ 209.100510][ T7661] xsk_setsockopt+0x4dc/0x8d0 [ 209.100529][ T7661] ? __pfx_xsk_setsockopt+0x10/0x10 [ 209.100546][ T7661] ? __pfx_aa_sk_perm+0x10/0x10 [ 209.100569][ T7661] ? aa_sock_opt_perm+0xff/0x1b0 [ 209.100594][ T7661] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 209.100612][ T7661] ? __pfx_xsk_setsockopt+0x10/0x10 [ 209.100630][ T7661] do_sock_setsockopt+0x17c/0x1b0 [ 209.100656][ T7661] __x64_sys_setsockopt+0x13f/0x1b0 [ 209.100690][ T7661] do_syscall_64+0xfa/0x3b0 [ 209.100721][ T7661] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.100740][ T7661] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 209.100763][ T7661] ? clear_bhb_loop+0x60/0xb0 [ 209.100787][ T7661] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.100803][ T7661] RIP: 0033:0x7f5695b8ebe9 [ 209.100818][ T7661] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 209.100832][ T7661] RSP: 002b:00007f5696a22038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 209.100849][ T7661] RAX: ffffffffffffffda RBX: 00007f5695db5fa0 RCX: 00007f5695b8ebe9 [ 209.100860][ T7661] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 209.100869][ T7661] RBP: 00007f5695c11e19 R08: 0000000000000052 R09: 0000000000000000 [ 209.100879][ T7661] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 209.100889][ T7661] R13: 00007f5695db6038 R14: 00007f5695db5fa0 R15: 00007f5695edfa28 [ 209.100912][ T7661] [ 209.538155][ T7661] Mem-Info: [ 209.541533][ T7661] active_anon:5756 inactive_anon:0 isolated_anon:0 [ 209.541533][ T7661] active_file:11171 inactive_file:39905 isolated_file:0 [ 209.541533][ T7661] unevictable:768 dirty:229 writeback:0 [ 209.541533][ T7661] slab_reclaimable:10780 slab_unreclaimable:100055 [ 209.541533][ T7661] mapped:30160 shmem:1360 pagetables:1329 [ 209.541533][ T7661] sec_pagetables:0 bounce:0 [ 209.541533][ T7661] kernel_misc_reclaimable:0 [ 209.541533][ T7661] free:1296984 free_pcp:21278 free_cma:0 [ 209.588568][ T7661] Node 0 active_anon:23024kB inactive_anon:0kB active_file:44528kB inactive_file:159420kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:120508kB dirty:888kB writeback:0kB shmem:3904kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12468kB pagetables:5188kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 209.649900][ T7661] Node 1 active_anon:0kB inactive_anon:0kB active_file:156kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:132kB dirty:28kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 209.691156][ T7661] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 209.730710][ T7677] netlink: 28 bytes leftover after parsing attributes in process `syz.5.511'. [ 209.739665][ T7677] openvswitch: netlink: Flow key attr not present in new flow. [ 209.789760][ T7661] lowmem_reserve[]: 0 2497 2499 2499 2499 [ 209.804396][ T7661] Node 0 DMA32 free:1280436kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22772kB inactive_anon:0kB active_file:44528kB inactive_file:157848kB unevictable:1536kB writepending:888kB present:3129332kB managed:2557520kB mlocked:0kB bounce:0kB free_pcp:67936kB local_pcp:29596kB free_cma:0kB [ 209.842085][ T7661] lowmem_reserve[]: 0 0 1 1 1 [ 209.846876][ T7661] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:52kB inactive_anon:0kB active_file:0kB inactive_file:1572kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 209.938466][ T7661] lowmem_reserve[]: 0 0 0 0 0 [ 209.943399][ T7661] Node 1 Normal free:3892384kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:156kB inactive_file:200kB unevictable:1536kB writepending:28kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:16576kB local_pcp:10528kB free_cma:0kB [ 210.005651][ T7661] lowmem_reserve[]: 0 0 0 0 0 [ 210.045947][ T7661] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 210.059382][ T7661] Node 0 DMA32: 1152*4kB (UME) 861*8kB (UME) 406*16kB (UME) 430*32kB (UME) 338*64kB (UME) 194*128kB (UME) 124*256kB (UME) 40*512kB (UM) 35*1024kB (UME) 5*2048kB (UM) 272*4096kB (UM) = 1290632kB [ 210.081655][ T24] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 210.103489][ T7661] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 210.133911][ T7661] Node 1 Normal: 141*4kB (UME) 72*8kB (UME) 18*16kB (UME) 141*32kB (UE) 32*64kB (UME) 9*128kB (UME) 3*256kB (UME) 4*512kB (UME) 3*1024kB (UME) 1*2048kB (E) 946*4096kB (M) = 3891892kB [ 210.209969][ T7661] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 210.221749][ T7661] Node 0 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 210.231811][ T7661] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 210.242345][ T7661] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 210.262492][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 210.266312][ T7661] 52430 total pagecache pages [ 210.283105][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 210.285995][ T7661] 0 pages in swap cache [ 210.303908][ T24] usb 1-1: New USB device found, idVendor=04b4, idProduct=de61, bcdDevice= 0.00 [ 210.305575][ T7661] Free swap = 124996kB [ 210.319312][ T7661] Total swap = 124996kB [ 210.328020][ T7661] 2097051 pages RAM [ 210.333365][ T7661] 0 pages HighMem/MovableOnly [ 210.338246][ T7661] 425645 pages reserved [ 210.338506][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.381496][ T7661] 0 pages cma reserved [ 210.408225][ T24] usb 1-1: config 0 descriptor?? [ 210.540642][ T1211] usb 3-1: new full-speed USB device number 24 using dummy_hcd [ 210.611324][ T7699] 8021q: adding VLAN 0 to HW filter on device bond1 [ 210.798820][ T1211] usb 3-1: config 0 has no interfaces? [ 210.819036][ T24] usbhid 1-1:0.0: can't add hid device: -71 [ 210.825091][ T1211] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 210.848285][ T24] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 210.862476][ T7706] netlink: 12 bytes leftover after parsing attributes in process `syz.4.518'. [ 210.865669][ T1211] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.923591][ T1211] usb 3-1: Product: syz [ 210.940852][ T24] usb 1-1: USB disconnect, device number 25 [ 210.951090][ T1211] usb 3-1: Manufacturer: syz [ 210.955746][ T1211] usb 3-1: SerialNumber: syz [ 210.981829][ T1211] usb 3-1: config 0 descriptor?? [ 211.254339][ T7693] program syz.2.516 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 211.266061][ T7693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 211.275359][ T7693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 211.337981][ T7715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 211.338273][ T7715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 211.450941][ T5937] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 211.575884][ T24] usb 4-1: USB disconnect, device number 39 [ 211.660114][ T5937] usb 5-1: config 0 has an invalid interface number: 29 but max is 0 [ 211.708592][ T5937] usb 5-1: config 0 has no interface number 0 [ 211.739612][ T5937] usb 5-1: config 0 interface 29 has no altsetting 0 [ 211.785024][ T5937] usb 5-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 211.800489][ T7678] Bluetooth: hci2: command 0x0406 tx timeout [ 211.806572][ T7678] Bluetooth: hci0: command 0x0406 tx timeout [ 211.812898][ T7678] Bluetooth: hci3: command 0x0406 tx timeout [ 211.819054][ T7678] Bluetooth: hci4: command 0x0406 tx timeout [ 211.830513][ T5937] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.844943][ T5937] usb 5-1: Product: syz [ 211.849207][ T5937] usb 5-1: Manufacturer: syz [ 211.854698][ T5937] usb 5-1: SerialNumber: syz [ 211.894584][ T5937] usb 5-1: config 0 descriptor?? [ 212.153748][ T5937] peak_usb 5-1:0.29: PEAK-System PCAN-USB X6 v65 fw v224.204.25 (2 channels) [ 212.390209][ T5937] peak_usb 5-1:0.29 can0: unable to request usb[type=2 value=5] err=-71 [ 212.564657][ T5937] peak_usb 5-1:0.29: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 212.610610][ T9] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 212.632077][ T5937] peak_usb 5-1:0.29: probe with driver peak_usb failed with error -71 [ 212.664374][ T5937] usb 5-1: USB disconnect, device number 17 [ 212.794495][ T9] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 212.808047][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.847490][ T9] usb 6-1: config 0 descriptor?? [ 212.870277][ T9] cp210x 6-1:0.0: cp210x converter detected [ 213.218462][ T7729] netlink: 16 bytes leftover after parsing attributes in process `syz.4.525'. [ 213.243912][ T5937] usb 3-1: USB disconnect, device number 24 [ 213.287967][ T7729] openvswitch: netlink: Flow actions attr not present in new flow. [ 213.296953][ T7724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 213.341168][ T7724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 213.424386][ T9] cp210x 6-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 213.455922][ T7733] netlink: 'syz.2.526': attribute type 14 has an invalid length. [ 213.497555][ T7732] netlink: 12 bytes leftover after parsing attributes in process `syz.0.527'. [ 213.693297][ T7740] netlink: 12 bytes leftover after parsing attributes in process `syz.3.530'. [ 213.770301][ T7745] netlink: 324 bytes leftover after parsing attributes in process `syz.4.532'. [ 214.125942][ T7753] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 214.152906][ T7753] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 214.152906][ T7753] The task syz.4.534 (7753) triggered the difference, watch for misbehavior. [ 214.290671][ T5946] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 214.299143][ T9] cp210x 6-1:0.0: failed to get vendor val 0x370c size 15: -71 [ 214.327400][ T9] cp210x 6-1:0.0: GPIO initialisation failed: -71 [ 214.348644][ T9] usb 6-1: cp210x converter now attached to ttyUSB0 [ 214.374439][ T9] usb 6-1: USB disconnect, device number 7 [ 214.409766][ T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 214.410062][ T6023] udevd[6023]: setting mode of /dev/ttyUSB0 to 020660 failed: No such file or directory [ 214.429125][ T9] cp210x 6-1:0.0: device disconnected [ 214.449966][ T6023] udevd[6023]: setting owner of /dev/ttyUSB0 to uid=0, gid=18 failed: No such file or directory [ 214.461998][ T5946] usb 4-1: Using ep0 maxpacket: 32 [ 214.479094][ T5946] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 214.496439][ T5946] usb 4-1: config 0 has no interface number 0 [ 214.517428][ T5946] usb 4-1: config 0 interface 89 has no altsetting 0 [ 214.538581][ T5946] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 214.565526][ T5946] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.588083][ T5946] usb 4-1: Product: syz [ 214.597105][ T5946] usb 4-1: Manufacturer: syz [ 214.605536][ T7762] netlink: 12 bytes leftover after parsing attributes in process `syz.5.539'. [ 214.616854][ T5946] usb 4-1: SerialNumber: syz [ 214.621633][ T10] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 214.642585][ T5946] usb 4-1: config 0 descriptor?? [ 214.663036][ T5946] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 214.684378][ T5946] em28xx 4-1:0.89: Video interface 89 found: bulk [ 214.790778][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 214.798037][ T10] usb 1-1: config 0 has an invalid interface number: 9 but max is 0 [ 214.821399][ T10] usb 1-1: config 0 has no interface number 0 [ 214.838085][ T10] usb 1-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 214.885468][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.077327][ T7752] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 215.096392][ T10] usb 1-1: Product: syz [ 215.110470][ T10] usb 1-1: Manufacturer: syz [ 215.117877][ T7752] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 215.127166][ T10] usb 1-1: SerialNumber: syz [ 215.146918][ T10] usb 1-1: config 0 descriptor?? [ 215.167423][ T10] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 215.623559][ T5946] em28xx 4-1:0.89: unknown em28xx chip ID (0) [ 216.576363][ T7785] loop6: detected capacity change from 0 to 524287999 [ 216.617267][ T7776] syz.4.543 (7776): drop_caches: 2 [ 216.634466][ T10] gspca_topro: reg_r err -71 [ 216.639312][ T10] gspca_topro: Sensor soi763a [ 216.687477][ T10] usb 1-1: USB disconnect, device number 26 [ 216.711239][ T7787] netlink: 16 bytes leftover after parsing attributes in process `syz.2.546'. [ 216.855518][ T5946] em28xx 4-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 216.874856][ T5946] em28xx 4-1:0.89: board has no eeprom [ 216.990471][ T5946] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67) [ 217.013862][ T5946] em28xx 4-1:0.89: analog set to bulk mode. [ 217.032365][ T1211] em28xx 4-1:0.89: Registering V4L2 extension [ 217.076774][ T5946] usb 4-1: USB disconnect, device number 40 [ 217.105043][ T5946] em28xx 4-1:0.89: Disconnecting em28xx [ 217.149313][ T1211] em28xx 4-1:0.89: Config register raw data: 0xffffffed [ 217.234752][ T7797] 8021q: adding VLAN 0 to HW filter on device bond3 [ 217.441902][ T1211] em28xx 4-1:0.89: AC97 chip type couldn't be determined [ 217.476664][ T1211] em28xx 4-1:0.89: No AC97 audio processor [ 217.508879][ T1211] usb 4-1: Decoder not found [ 217.523123][ T1211] em28xx 4-1:0.89: failed to create media graph [ 217.594381][ T1211] em28xx 4-1:0.89: V4L2 device video103 deregistered [ 217.648280][ T7791] ================================================================== [ 217.656400][ T7791] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xc7/0x430 [ 217.663795][ T7791] Read of size 8 at addr ffff8880318c0740 by task v4l_id/7791 [ 217.671271][ T7791] [ 217.673595][ T7791] CPU: 1 UID: 0 PID: 7791 Comm: v4l_id Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 217.673614][ T7791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 217.673624][ T7791] Call Trace: [ 217.673631][ T7791] [ 217.673637][ T7791] dump_stack_lvl+0x189/0x250 [ 217.673659][ T7791] ? rcu_is_watching+0x15/0xb0 [ 217.673674][ T7791] ? __kasan_check_byte+0x12/0x40 [ 217.673698][ T7791] ? __pfx_dump_stack_lvl+0x10/0x10 [ 217.673715][ T7791] ? rcu_is_watching+0x15/0xb0 [ 217.673730][ T7791] ? lock_release+0x4b/0x3e0 [ 217.673755][ T7791] ? __virt_addr_valid+0x1c8/0x5c0 [ 217.673776][ T7791] ? __virt_addr_valid+0x4a5/0x5c0 [ 217.673801][ T7791] print_report+0xca/0x240 [ 217.673817][ T7791] ? v4l2_fh_open+0xc7/0x430 [ 217.673836][ T7791] kasan_report+0x118/0x150 [ 217.673859][ T7791] ? v4l2_fh_open+0xc7/0x430 [ 217.673881][ T7791] v4l2_fh_open+0xc7/0x430 [ 217.673903][ T7791] em28xx_v4l2_open+0x157/0x9a0 [ 217.673925][ T7791] v4l2_open+0x20f/0x360 [ 217.673947][ T7791] chrdev_open+0x4c9/0x5e0 [ 217.673972][ T7791] ? __pfx_chrdev_open+0x10/0x10 [ 217.674005][ T7791] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 217.674043][ T7791] ? __pfx_chrdev_open+0x10/0x10 [ 217.674075][ T7791] do_dentry_open+0x953/0x13f0 [ 217.674105][ T7791] vfs_open+0x3b/0x340 [ 217.674125][ T7791] ? path_openat+0x2ecd/0x3830 [ 217.674146][ T7791] path_openat+0x2ee5/0x3830 [ 217.674163][ T7791] ? arch_stack_walk+0xfc/0x150 [ 217.674190][ T7791] ? stack_depot_save_flags+0x40/0x860 [ 217.674213][ T7791] ? __pfx_path_openat+0x10/0x10 [ 217.674230][ T7791] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.674254][ T7791] do_filp_open+0x1fa/0x410 [ 217.674272][ T7791] ? __lock_acquire+0xab9/0xd20 [ 217.674295][ T7791] ? __pfx_do_filp_open+0x10/0x10 [ 217.674322][ T7791] ? _raw_spin_unlock+0x28/0x50 [ 217.674339][ T7791] ? alloc_fd+0x64c/0x6c0 [ 217.674365][ T7791] do_sys_openat2+0x121/0x1c0 [ 217.674382][ T7791] ? __pfx_do_sys_openat2+0x10/0x10 [ 217.674399][ T7791] ? exc_page_fault+0x76/0xf0 [ 217.674419][ T7791] ? do_user_addr_fault+0xc8a/0x1390 [ 217.674444][ T7791] __x64_sys_openat+0x138/0x170 [ 217.674463][ T7791] do_syscall_64+0xfa/0x3b0 [ 217.674483][ T7791] ? lockdep_hardirqs_on+0x9c/0x150 [ 217.674501][ T7791] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.674517][ T7791] ? clear_bhb_loop+0x60/0xb0 [ 217.674535][ T7791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.674550][ T7791] RIP: 0033:0x7faea88a7407 [ 217.674565][ T7791] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 217.674579][ T7791] RSP: 002b:00007ffd6184ae40 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 217.674595][ T7791] RAX: ffffffffffffffda RBX: 00007faea9075880 RCX: 00007faea88a7407 [ 217.674607][ T7791] RDX: 0000000000000000 RSI: 00007ffd6184cf1d RDI: ffffffffffffff9c [ 217.674617][ T7791] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 217.674626][ T7791] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 217.674635][ T7791] R13: 00007ffd6184b090 R14: 00007faea91dc000 R15: 000055a0d89ae4d8 [ 217.674653][ T7791] [ 217.674658][ T7791] [ 217.985032][ T7791] Allocated by task 1211: [ 217.989366][ T7791] kasan_save_track+0x3e/0x80 [ 217.994068][ T7791] __kasan_kmalloc+0x93/0xb0 [ 217.998696][ T7791] __kmalloc_cache_noprof+0x230/0x3d0 [ 218.004079][ T7791] em28xx_v4l2_init+0x10b/0x2e70 [ 218.009028][ T7791] em28xx_init_extension+0x120/0x1c0 [ 218.014347][ T7791] process_scheduled_works+0xade/0x17b0 [ 218.019898][ T7791] worker_thread+0x8a0/0xda0 [ 218.024490][ T7791] kthread+0x70e/0x8a0 [ 218.028562][ T7791] ret_from_fork+0x3fc/0x770 [ 218.033149][ T7791] ret_from_fork_asm+0x1a/0x30 [ 218.037917][ T7791] [ 218.040246][ T7791] Freed by task 1211: [ 218.044229][ T7791] kasan_save_track+0x3e/0x80 [ 218.048926][ T7791] kasan_save_free_info+0x46/0x50 [ 218.053958][ T7791] __kasan_slab_free+0x5b/0x80 [ 218.058723][ T7791] kfree+0x18e/0x440 [ 218.062622][ T7791] em28xx_v4l2_init+0x1683/0x2e70 [ 218.067674][ T7791] em28xx_init_extension+0x120/0x1c0 [ 218.072968][ T7791] process_scheduled_works+0xade/0x17b0 [ 218.078509][ T7791] worker_thread+0x8a0/0xda0 [ 218.083113][ T7791] kthread+0x70e/0x8a0 [ 218.087182][ T7791] ret_from_fork+0x3fc/0x770 [ 218.091778][ T7791] ret_from_fork_asm+0x1a/0x30 [ 218.096570][ T7791] [ 218.098905][ T7791] The buggy address belongs to the object at ffff8880318c0000 [ 218.098905][ T7791] which belongs to the cache kmalloc-8k of size 8192 [ 218.112973][ T7791] The buggy address is located 1856 bytes inside of [ 218.112973][ T7791] freed 8192-byte region [ffff8880318c0000, ffff8880318c2000) [ 218.127041][ T7791] [ 218.129390][ T7791] The buggy address belongs to the physical page: [ 218.135823][ T7791] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x318c0 [ 218.144598][ T7791] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 218.153106][ T7791] ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 218.161019][ T7791] page_type: f5(slab) [ 218.165267][ T7791] raw: 00fff00000000040 ffff88801a442280 ffffea0001540600 0000000000000003 [ 218.173856][ T7791] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 218.182478][ T7791] head: 00fff00000000040 ffff88801a442280 ffffea0001540600 0000000000000003 [ 218.191156][ T7791] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 218.199846][ T7791] head: 00fff00000000003 ffffea0000c63001 00000000ffffffff 00000000ffffffff [ 218.208541][ T7791] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 218.217215][ T7791] page dumped because: kasan: bad access detected [ 218.223640][ T7791] page_owner tracks the page as allocated [ 218.229360][ T7791] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 7437, tgid 7436 (syz.3.437), ts 189682999829, free_ts 189642052723 [ 218.251855][ T7791] post_alloc_hook+0x240/0x2a0 [ 218.256677][ T7791] get_page_from_freelist+0x21e4/0x22c0 [ 218.262231][ T7791] __alloc_frozen_pages_noprof+0x181/0x370 [ 218.268061][ T7791] alloc_pages_mpol+0x232/0x4a0 [ 218.272918][ T7791] allocate_slab+0x8a/0x370 [ 218.277427][ T7791] ___slab_alloc+0xbeb/0x1410 [ 218.282112][ T7791] __kmalloc_node_track_caller_noprof+0x2f8/0x4e0 [ 218.288573][ T7791] kmalloc_reserve+0x136/0x290 [ 218.293350][ T7791] __alloc_skb+0x142/0x2d0 [ 218.297797][ T7791] netlink_dump+0x167/0xe90 [ 218.302303][ T7791] netlink_recvmsg+0x676/0xa30 [ 218.307071][ T7791] sock_recvmsg_nosec+0x183/0x1c0 [ 218.312098][ T7791] ____sys_recvmsg+0x3aa/0x460 [ 218.316866][ T7791] ___sys_recvmsg+0x1b5/0x510 [ 218.321549][ T7791] do_recvmmsg+0x307/0x770 [ 218.325983][ T7791] __x64_sys_recvmmsg+0x1af/0x240 [ 218.331018][ T7791] page last free pid 7436 tgid 7436 stack trace: [ 218.337351][ T7791] __free_frozen_pages+0xbc4/0xd30 [ 218.342470][ T7791] __put_partials+0x156/0x1a0 [ 218.347183][ T7791] put_cpu_partial+0x17c/0x250 [ 218.351980][ T7791] __slab_free+0x2d5/0x3c0 [ 218.356395][ T7791] qlist_free_all+0x97/0x140 [ 218.360988][ T7791] kasan_quarantine_reduce+0x148/0x160 [ 218.366469][ T7791] __kasan_slab_alloc+0x22/0x80 [ 218.371326][ T7791] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 218.376817][ T7791] getname_flags+0xb8/0x540 [ 218.381345][ T7791] __x64_sys_symlinkat+0x7a/0xb0 [ 218.386289][ T7791] do_syscall_64+0xfa/0x3b0 [ 218.390800][ T7791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.396707][ T7791] [ 218.399028][ T7791] Memory state around the buggy address: [ 218.404697][ T7791] ffff8880318c0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 218.412780][ T7791] ffff8880318c0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 218.420837][ T7791] >ffff8880318c0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 218.428893][ T7791] ^ [ 218.435054][ T7791] ffff8880318c0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 218.443124][ T7791] ffff8880318c0800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 218.451206][ T7791] ================================================================== [ 218.476136][ T1211] em28xx 4-1:0.89: Registering snapshot button... [ 218.534647][ T1211] input: em28xx snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.89/input/input15 [ 218.594194][ T1211] em28xx 4-1:0.89: Remote control support is not available for this card. [ 218.613095][ T7791] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 218.620351][ T7791] CPU: 0 UID: 0 PID: 7791 Comm: v4l_id Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 218.631653][ T7791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 218.641722][ T7791] Call Trace: [ 218.645006][ T7791] [ 218.647970][ T7791] dump_stack_lvl+0x99/0x250 [ 218.652609][ T7791] ? __asan_memcpy+0x40/0x70 [ 218.657219][ T7791] ? __pfx_dump_stack_lvl+0x10/0x10 [ 218.662432][ T7791] ? __pfx__printk+0x10/0x10 [ 218.667040][ T7791] vpanic+0x281/0x750 [ 218.671033][ T7791] ? preempt_schedule+0xae/0xc0 [ 218.675897][ T7791] ? __pfx_vpanic+0x10/0x10 [ 218.680409][ T7791] ? preempt_schedule_common+0x83/0xd0 [ 218.685914][ T7791] ? preempt_schedule+0xae/0xc0 [ 218.690777][ T7791] ? __pfx_preempt_schedule+0x10/0x10 [ 218.696160][ T7791] panic+0xb9/0xc0 [ 218.699893][ T7791] ? __pfx_panic+0x10/0x10 [ 218.704317][ T7791] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 218.710225][ T7791] ? v4l2_fh_open+0xc7/0x430 [ 218.714829][ T7791] check_panic_on_warn+0x89/0xb0 [ 218.719778][ T7791] ? v4l2_fh_open+0xc7/0x430 [ 218.724385][ T7791] end_report+0x78/0x160 [ 218.728650][ T7791] kasan_report+0x129/0x150 [ 218.733166][ T7791] ? v4l2_fh_open+0xc7/0x430 [ 218.737859][ T7791] v4l2_fh_open+0xc7/0x430 [ 218.742556][ T7791] em28xx_v4l2_open+0x157/0x9a0 [ 218.747429][ T7791] v4l2_open+0x20f/0x360 [ 218.751689][ T7791] chrdev_open+0x4c9/0x5e0 [ 218.756127][ T7791] ? __pfx_chrdev_open+0x10/0x10 [ 218.761082][ T7791] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 218.767428][ T7791] ? __pfx_chrdev_open+0x10/0x10 [ 218.772386][ T7791] do_dentry_open+0x953/0x13f0 [ 218.777186][ T7791] vfs_open+0x3b/0x340 [ 218.781256][ T7791] ? path_openat+0x2ecd/0x3830 [ 218.786028][ T7791] path_openat+0x2ee5/0x3830 [ 218.790634][ T7791] ? arch_stack_walk+0xfc/0x150 [ 218.795501][ T7791] ? stack_depot_save_flags+0x40/0x860 [ 218.800987][ T7791] ? __pfx_path_openat+0x10/0x10 [ 218.805943][ T7791] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.812050][ T7791] do_filp_open+0x1fa/0x410 [ 218.816579][ T7791] ? __lock_acquire+0xab9/0xd20 [ 218.821474][ T7791] ? __pfx_do_filp_open+0x10/0x10 [ 218.826529][ T7791] ? _raw_spin_unlock+0x28/0x50 [ 218.831394][ T7791] ? alloc_fd+0x64c/0x6c0 [ 218.835747][ T7791] do_sys_openat2+0x121/0x1c0 [ 218.840433][ T7791] ? __pfx_do_sys_openat2+0x10/0x10 [ 218.845660][ T7791] ? exc_page_fault+0x76/0xf0 [ 218.850352][ T7791] ? do_user_addr_fault+0xc8a/0x1390 [ 218.855671][ T7791] __x64_sys_openat+0x138/0x170 [ 218.860534][ T7791] do_syscall_64+0xfa/0x3b0 [ 218.865086][ T7791] ? lockdep_hardirqs_on+0x9c/0x150 [ 218.870298][ T7791] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.876390][ T7791] ? clear_bhb_loop+0x60/0xb0 [ 218.881091][ T7791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.886992][ T7791] RIP: 0033:0x7faea88a7407 [ 218.891430][ T7791] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 218.911137][ T7791] RSP: 002b:00007ffd6184ae40 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 218.919662][ T7791] RAX: ffffffffffffffda RBX: 00007faea9075880 RCX: 00007faea88a7407 [ 218.927659][ T7791] RDX: 0000000000000000 RSI: 00007ffd6184cf1d RDI: ffffffffffffff9c [ 218.935655][ T7791] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 218.943741][ T7791] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 218.951881][ T7791] R13: 00007ffd6184b090 R14: 00007faea91dc000 R15: 000055a0d89ae4d8 [ 218.959881][ T7791] [ 218.963266][ T7791] Kernel Offset: disabled [ 218.967624][ T7791] Rebooting in 86400 seconds..