last executing test programs: 5m27.179870467s ago: executing program 1 (id=489): capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@mcast2, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r0, &(0x7f0000000140)={&(0x7f0000000080)={0xa, 0x4e26, 0x8080000, @mcast1, 0xc}, 0x1c, 0x0, 0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="280000000000000029000000370000005e010000ed00000001080000000000000000000100000000300000000000000029000000360000003c03000000000000010400000000c910fe8000000000000000020000000000bb480100000000000029000000360000003c25000000000000050200010730000000010abe060003000000000000005b040000000000000600000000000000ab9400000000000009000000000000000c9ea237147fba97be7c65d50bdcf5ed319f8c07c0090d49157cae19ed16b792ed06567f0f4a2c19b11d796bd2e48fb56b0674a45c7db37803db970b6582742e1cee97bac7f205522ce45db6f942e1862c4d633096b70d6baf651b996e142f8440a6f2fd7ddf868dcf3ded6ea85cccf589b0810cb770aac82e08f38eb4757e9117a6dc85da9eda9c3e7544ee1f7e64da28b7380c4f63a3f22a1b898cd0dbeb4b0102000007480000000110050900030000000000000005000000000000ccabfd6b020000000002000000000000000000000000000000010000000000000001000000000000000100000000000000c2040000000000000000000014"], 0x1b8}, 0x4000000) 5m27.051401953s ago: executing program 1 (id=491): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$pppoe(0x18, 0x1, 0x0) socket$pppoe(0x18, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c00000003080102000000074441980000000000050003"], 0x1c}, 0x1, 0x0, 0x0, 0x50}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000180), 0xfea7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r6, @ANYBLOB="ff830500000700ffffff", @ANYRES8=r1], 0x4}}, 0x0) sendfile(r5, r4, 0x0, 0x100000002) (fail_nth: 19) 5m26.795787901s ago: executing program 1 (id=492): r0 = creat(0x0, 0xecf86c37d53049cc) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000200)="440910bc996c301c81830704", 0xc) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) kcmp(0x0, 0x0, 0x0, 0xffffffffffffffff, r3) mount$fuse(0x0, &(0x7f0000002540)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000040)={{}, 0x2c, {'rootmode', 0x3d, 0x2000}}) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000002300)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x0, 0x110, 0x9, 0x8b, 0x5, 0x26, 0x0, 0x0, 0x80, 0x2}}, 0x50) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000065c0), &(0x7f0000006600)=0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000006680), 0x0, 0x44800) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x6, 0x6b, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000040)='\x00\x00\x00\x00\x00\x00', &(0x7f0000002240)=""/4103, 0xfffffffe, 0x0, 0x0, 0x0}) recvmsg(0xffffffffffffffff, 0x0, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010024bd7000e8dbdf252100000008000300", @ANYRES32=r6, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x4014001}, 0x0) 5m26.46452288s ago: executing program 1 (id=494): r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x26020480) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x80000, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) bind$inet6(r0, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x7fff, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000180)=0x80000039f8, 0x4) sendto$inet6(r0, &(0x7f0000000000)="8d", 0x1, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000002a00)=[{{&(0x7f0000000280)=@rc={0x1f, @none}, 0x80, 0x0, 0x0, &(0x7f0000000300)=""/89, 0x59}, 0x379f}], 0x1, 0x2020, 0x0) 5m25.454919477s ago: executing program 1 (id=502): ioctl$VIDIOC_S_FREQUENCY(0xffffffffffffffff, 0x402c5639, &(0x7f0000002280)={0x300, 0x1, 0x40}) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x50, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xfffffffa}]}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x10}, 0x8800) mount_setattr(r0, &(0x7f0000000280)='./file0\x00', 0x0, &(0x7f0000001dc0)={0x0, 0x0, 0x100000, {r0}}, 0xfffffffffffffe5f) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f0000000400)=[{&(0x7f0000000000)="390000001000111867090707a640400f0021ff3f31000000170a001700000000040037000900030001372564b758b9a64411f6bb744dc48f57", 0x39}], 0x1) syz_usb_connect(0x3, 0x24, &(0x7f0000001100)={{0x12, 0x1, 0x0, 0xc1, 0xb3, 0x9a, 0x8, 0x4e6, 0x9, 0x200, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x5, 0x8, 0xe0, 0x22, [{{0x9, 0x4, 0xa2, 0x6, 0x0, 0x69, 0x4b, 0x1, 0x4d}}]}}]}}, 0x0) ioctl$EVIOCGABS20(r0, 0x80184560, &(0x7f00000002c0)=""/69) syz_io_uring_setup(0x8d0, &(0x7f00000000c0)={0x0, 0xc48a, 0x800, 0x3}, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011000100000000000300000008000300", @ANYRES32=r3], 0x20}], 0x1, 0x0, 0x0, 0x4000}, 0x40) r4 = userfaultfd(0x80801) ioctl$UFFDIO_REGISTER(r4, 0x541b, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(r2, &(0x7f00000003c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000380)={&(0x7f0000000440)=@mpls_delroute={0xa8, 0x19, 0x4, 0x70bd2b, 0x25dfdbff, {0x1c, 0x80, 0x10, 0x8, 0xfe, 0x0, 0xff, 0x3, 0x1000}, [@RTA_NEWDST={0x84, 0x13, [{0x3}, {0x8, 0x0, 0x1}, {0x8005, 0x0, 0x1}, {0x7f}, {0xffff9, 0x0, 0x1}, {0x9}, {0x72}, {0xffffa}, {0x7, 0x0, 0x1}, {0xa, 0x0, 0x1}, {0x8, 0x0, 0x1}, {0x946}, {0x5}, {0x1, 0x0, 0x1}, {}, {0x0, 0x0, 0x1}, {0x1, 0x0, 0x1}, {0x1}, {0x2, 0x0, 0x1}, {0x2d, 0x0, 0x1}, {0x1}, {0xffffe}, {0x6, 0x0, 0x1}, {0x8001}, {0x7, 0x0, 0x1}, {0x5}, {0x3}, {0x8, 0x0, 0x1}, {0x8}, {0x81}, {0x9, 0x0, 0x1}, {0x5}]}, @RTA_OIF={0x8}]}, 0xa8}, 0x1, 0x0, 0x0, 0x800}, 0x20000010) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r2) sendmsg$NFQNL_MSG_CONFIG(r6, &(0x7f0000000240)={0x0, 0xffffff3d, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x1}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x1f}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c010}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c00000002030300000000000000000000000010080001000174c5ed000000"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT(r6, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f00000000c0)=ANY=[@ANYBLOB="20000000010301080000000000000000000000000c0002"], 0x20}}, 0x0) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000000), &(0x7f0000000040), 0x2, 0x2) 5m24.991157085s ago: executing program 1 (id=506): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="00000002"], 0x10da) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_procfs(0x0, &(0x7f0000000500)='fdinfo\x00') linkat(r3, &(0x7f0000000040)='./file0\x00', 0xffffffffffffffff, 0x0, 0x1000) syz_emit_ethernet(0x6f, &(0x7f0000000680)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "e400ff", 0x39, 0x3a, 0x0, @private2, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, '\x00', 0x0, 0x11, 0x0, @empty, @ipv4={'\x00', '\xff\xff', @multicast1}, [], "17c17f070000000000"}}}}}}}, 0x0) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_PARM(r4, 0xc0cc5615, &(0x7f0000000200)={0xa, @raw_data="94a9dca1ca73855e3d9bae811b9340ee4a5acf656459ff7c7f0ed903b503fe4451052eb1f82cbb0a7d0ffe4ab11e9b8328bbfae608042d42e1a729ef5f41aa438309e7b3ad0753ced866c69a90a6783db0891a67a8fcff0276d412869fca1889bcaaeb890ca3d894505e2ea73a7dac196fa300701e3617781b9602ce546a83a8e968bbaf1110ac60bab61a6fdf4d50fb9ca374bed2962ffd628b979a9cd76371f0cfae9b660b270f970a39d35be23a6b77760606f10db5f2e9b24a4cbfceb8a806565fed7166b340"}) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0x4c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}]}, 0x4c}}, 0x4004020) 5m24.541144025s ago: executing program 32 (id=506): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="00000002"], 0x10da) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_procfs(0x0, &(0x7f0000000500)='fdinfo\x00') linkat(r3, &(0x7f0000000040)='./file0\x00', 0xffffffffffffffff, 0x0, 0x1000) syz_emit_ethernet(0x6f, &(0x7f0000000680)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "e400ff", 0x39, 0x3a, 0x0, @private2, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, '\x00', 0x0, 0x11, 0x0, @empty, @ipv4={'\x00', '\xff\xff', @multicast1}, [], "17c17f070000000000"}}}}}}}, 0x0) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_PARM(r4, 0xc0cc5615, &(0x7f0000000200)={0xa, @raw_data="94a9dca1ca73855e3d9bae811b9340ee4a5acf656459ff7c7f0ed903b503fe4451052eb1f82cbb0a7d0ffe4ab11e9b8328bbfae608042d42e1a729ef5f41aa438309e7b3ad0753ced866c69a90a6783db0891a67a8fcff0276d412869fca1889bcaaeb890ca3d894505e2ea73a7dac196fa300701e3617781b9602ce546a83a8e968bbaf1110ac60bab61a6fdf4d50fb9ca374bed2962ffd628b979a9cd76371f0cfae9b660b270f970a39d35be23a6b77760606f10db5f2e9b24a4cbfceb8a806565fed7166b340"}) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0x4c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}]}, 0x4c}}, 0x4004020) 2m12.763997897s ago: executing program 2 (id=1403): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@newneigh={0x30, 0x1c, 0x401, 0x0, 0x0, {0x2}, [@NDA_DST_MAC={0xa, 0x1, @remote}, @NDA_IFINDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xe, 0x3}, {}, {0x5, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x40004) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000900000000000008000003000000040004001c000180180010"], 0x34}, 0x1, 0x0, 0x0, 0x700}, 0x84) 2m12.576681131s ago: executing program 2 (id=1405): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x200004) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r2 = socket$nl_generic(0x10, 0x3, 0x10) fstat(0xffffffffffffffff, 0x0) sendmsg$nl_generic(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000018c0)={0xc30, 0x41, 0x107, 0x0, 0x7, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xc18, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @nested={0x4, 0x90}, @typed={0x8, 0x3c, 0x0, 0x0, @uid}, @nested={0xbfd, 0x2f, 0x0, 0x1, [@nested={0x4, 0xa}, @generic="c8aafaa71f84e216bff208238a734f722790428ab870cd500258d4773ba12686f1a308d6824ab8bc803658eadab6fd29737877b05ac9aa4a59d4ac0d65df418eae2df909319274da73e34c22670822ff30118a02f21f965ac8b9269439fefb02c5d2d7a6bdda1e5c20f101b10932bcbb3b9e18c1b2b896869063a800dee73ed1ba097f9b6e9a120074e08d138bc2c08e8f69e3931828d91fec5d73803ca2d04376ec6bd97265681f454e4bb03ff7b815098d23faa11eb74423a3bef610bd3ad3e22c372c80510b7c66803a7e8add261b8bf08d3b98bee2d1912e30b5c6b95278379d9997e33ccb8dd828803b9d48a0675e3da23bc07fb22f6a9613c8a04d39a3781bf5531890fc142a08aa8986a53169a496848fce0c56cb86806cb4b36f2414dc59ce8b03daebb164c46248031866507520da23341a98e4a59be4ac9f5c60d851de2589ebb719a005416bef87f0d1e2e9559874aec6227b0bdcd480c873b42204892720bc7bbe2c79744d3bfe9907e18889068841d1c7eee0ba2b701f2a4d21f25dffb1b2def8c39a470c49d29d0a9cd942ea42624deb0023df36ed35b80ad2a2e19fb002f65773164668b104acd13a1b1432defaee279ec45a02b02753382fe50a7ef286926fd75b928ba4e37d1e5ea7f5a581c02f017da7487d99adc33b094d1a18e88f8804a025cdfcda7a24343586461cf4f8e6a6ced596f4b00365fcd35758e34cf1ae77c0b3965f08e984d4efd2886bd5ac2825a9fb8aa352c10b87a6954cac7128ecfd3126598de84aee1f497b1cc218885c4a188d301cca979960d4bdf66891553689a3bdc955cf3dd83ccf58f06c5ac255f201c42fd26717850c9a8ce3fcb7f990dde16d14005ef418e5dbb34614df918accc1844deb89dd251ff884906088d2f98e472539a406271c54c1996a0e5a7a5c28529847557229142bb8c9d34b1cd5d7275ee370029ef657b83be42de492cf99511f2c3cdaa1af00ae960cf3bbefb9194b478fc60b0be2e40f73cdfdcc31ab1c18003a04926a8b224ed9682690131cd330755e355c085b6e52cb7230ad311069a8f0fe984e387d4b67aa22f21f8e5a6006ec1c204733a7bc7b06607a52846ba8f29b63718c6fc62458b71b0ab5eb26b8a58b2935092d30e8261396238845300bbd8f60570f54a29d6756e715b3a65553e922400d6bba133701be115f3229100766f439d192f61c767bb5eb4d4485eabf6a1c0a6fb9590d48eeb0311172cbc44f5c6362d9c8b4ce182dc23481d117b97c3b3085e696efa2437595195fb394a36ade33e309e5436287f5a69fbef3f91193fd2e930336dc62faf6140d6148f9e3f852323bb7f1cb11aa79bcc50b4ea00e8ec5ca937a78d93bb6e1361f137bfcc180082b01bb372b36300502d0ccae7e0fa3e0b348474d650796bf281b5369f36107d35455952391c16640f4ac12e0b02868dcbe37674a53e44f8583bf54d0197d81fecb471fd16e87dfeb6110df6dd917db804e2def1670ede483ffadc18c751b27354dd3a7cfb7f16bf1732dae0b18ce34abe25c5c328978d6d3ee9d0309ab8dfc22beb935bd6e200f0a5817f5ac23d888c7198a98d97b7bf1654e3d5622f0ae0f6865a7adc17b6495ef84fddd839bb7c18183bdefc213a2ee62a8dff79959740395c961a2b12d880217338b82f108ca2d0e9bfd39d9221c9f574d960c19b64f0395c15d656b4d626f9483f70a19418ac0d9bf473c16e6e4f7852d03d9eadf2bda5049187f0455ff5baf66c77f9c4ef64fc82d64a6c15e478bf29f6cdf2628db38f679fa9eba767a324e88fc67703fcb8866b7c5583319e979a2242190a5b049798709fb1209fa5393e591777a448933c8c98e91532bb4529652b95edc1018f52fdcbb52c059a2923cbdec263ed5a8494b9d94822faf2a25433764a4dbe01c817625aa7bab94b0d4e080f5e0bc92630c93e93fdf0068652b9b156bd3697a17cccb232b8b17089fa0d3a98158f34249a8539b929bb1dbf2638ba885a78522b3a67551e1dbcd4465b00a4449bd929defad5e26d5d6cc5cc46589c12993beac01103022476d8f30f6989854429bdb910375ba209f3117be78965020c5956ad6dd91e7243c990ff0e4ff11bab9aed4f1a35c670bd52fae6ea69975f0c8c67b143fb9d483ac3649e923e63d31915e60d838bcd866897d307b1d7170475cea446153371ebba26fb62445c46336672f6f31b33f0e431a8473ec44b134ca05a4f277060a3bf3cb49c87e61e5579923850d5b20bcd6e22403a02560385165d83f903236b01d9ff329a6c071916637e377848b08845e355d11c5fe79ff5a64404ab0d60fe50b5e305eb06ef04517fc264a404391f24d1a501aa287f58323d35642e5685d71dea06e396a68cc5e55fed634b39ef0e85257ae3d0d56bd3b83f8e14dc73e2bebd01ddf0a943b7cd470e2d81f3fe2858ad84aade0470babe7fee69299becc3f13dd1fc74df292230e85d41da318058e9f136be12c5c2293d261b999b1482e65a7f1306c77e0dcf7a8b1a97c4ab784de6dc77080e5106b06c33d8ac89d7716283b5299c4efe87edd8c06f43f670486eb1310dd02de859d083c49903941194f5d8d8f575c9a88c9eba0609b918540406d55d36858710a27c5edd7f70503ac363658b24fddc3bd179f9387da6140afcffdbe16d4654b5dc0a9eb348a59741c35d4820c68306f1abf510ce4ebdbba8f3a09d7af99f0838964c08798d05b035b5938c1ce086d1073441a32410ff995178eb2a90e73239ee9958e1095b9a2b214cf20670efcd359d2bd2b9dbc79d89edf2b4bbed40ffce073f96618eadcb5429956ae50ad03d5c4e8e6ab7e907f3f85db077592af6fbb7929e4f6aeb60a7ca3c6ccac03f1f446ae70c1d39d17ab772c4f37dcc3cec70738d4a5428169da3c3af7b9940f8f0fdd0f1506049e178026a42f7b8ce25bf1cadbad61142eaccc8aa93de217d3374d7712cf6a9c19f7033e0e32bdabc49864870b082e62619029610d9980fa42d97f9fa15b2e0d031f685565dce4f20ebe3ccc0d3eda8810dbe4c5a6a102061b7ab9431b6fa2840c219cbac9a5cf74e3c527eca45b5f7186d7ea90cd32954544cb7ae3b901eb491820bb56685e7b160fa4f30b0d36d47d6c971a4f8ac74e3ecf49029dca5f5a27f4487930273e1d547e9c6b0d98574cbd8501fcc38974ee11561d046dad4e633e7d151126f6852b49fb6bfe1d774cde6acf52e7c225ee397954331da925e2f6424bad8d3e2f41b6b4fe5a9f3254052dfd5695f9f83f6b7a23ace1aed29c74517ab26342fa7b1c7c436c593cef241ac1ee0285aa1ae5706e8e6a02233fbd6ed16f9a03ca6fa3afcb822a3e1979d434623cfdd390b4873d98649df505dc68e700d7130a0d74189178edc1b25965af0d62f14a8ee706cc7c042045a8832bb58c1b678f051a4cca2c8c1617f97c97c8b978dfce9d5bded418035d033a22c1756d47ffd122686fd00ea0eb18ad23ecede0c7d8210f25be029e95d3c95f81b6c824d6680547f85afe59c40c55a3ae4efa8a09455b7fa1ed4c5d139f61e6ccda2858a959a171dcb752c47ec6c0ef0e88f6120fead64e7114824fbeed1804d80f90bc6710acde4c7cdab3a0e288c757bc92ba7006d805503f53ff611dc2fb2df8051231cab9cf6e98d76ab638f7bcdd8e4595db69648e198493d2cbcdf06f2e01d80bc6407e82c52ff5ede6013dd9bd9d68a2657f26a47f6e356f5bce731f84c8e996080054a84abd04be1a5c3364fd3eb10d2a8141ee46486bd126877dd090697bb6110009cbb48c354709e67b36735fd916a14a145b8fc389ac43604e64718e66325591d7d2db6a1091c4c8f568c12dcaa4d0a890fa8376085108e2c4984cc5471cedcaf789658b9ae791a392052c8ff5a3ade743e90c9efb0160e0870ee7cabe9d0f1667f8396b931cd2f66588d3713687c930308b01aae9e809c3913bd3c78ae15c280b92a4d973fd66cd910b0fe6456539d3a8c62ed64328f1702b8a65211bece1654e5136777e7054e0ba2d08c65051cfb6ccb693f70dc67c0c56fc298adda9d4587f75b50f0abf1cc738ee8da64db67695926644ea1e2f663a355b83e27f5ee5b12cb3e3aeafec235a291251d8ce16935e954da18a287ee1c73de13699b20287dce483e8c265e71593e0b9c0b5843ca41486b3e59afda4d673e89f7631ceaa863b4ddfca3273552f6e9e68dd45c3c96f5364678762a8a9f661bdfa452a15ca7be3b39d6e9c07803eca951efdfcd3aa0e3859df9031089f07d64c1531e11b110b3cec5d35d7cb881877da03a6b083367dddb3c3d60d849679d531"]}]}]}, 0xc30}}, 0x4010) 2m10.807648214s ago: executing program 2 (id=1414): r0 = memfd_create(&(0x7f0000000280)='\x01\xfd\xae.+\xa6\x8c\xb6?2\x199\x94S,|x?Ue[\xbd\xe1!\x033\xbc\'#\xff\x17\x9b%\xf3[d \x97\xf5G\x97A\xc2\xd8\xf0Uq\xe6+\xa5l\x94\v\xb6\a\x17\\\xfb\x04!\xe4\xc4\xb1\xa2\x1c\xffC;\x94Q\r\xb6}\x9c\xecC\v\xcf\xeb\xe4\x9aR\xe5,\x82\x03\x00\x19\x8d\xe8\xc6\xb9\xe4\xb4\x99\x8a\x19P\xb8\x8cx\b\x99\x04R\x05\xaf\xa2\xea5\f\xcc\x1a\x9b\x00Uf\xa5\xf7\x80Tgiz\nX\b\x91\xfd0\x8e\xb6\xa3\v#\xa1\xdf\xb4\xc0\xe6\xb4\xef\xa8i\xd8\xa2\xd2(\x98\x9bA\x8f\x13\xeb\xf4b/\xef!\x8f\xf6]-\xe9k\xb62\x89gEv\x13\xf4\xc7\xb2\xf5\\\x17\x90\xb5\xa6\xa8\xb8o\x0f\xe2 \xe7\x9c$\xd7\xf2@\xf7cdv[\t\x00\x8d\xf3\xcc1\r$\x1e\xff\xf0P\xb2\x97\xb8\xbc\xeb\x91\x87\x8bu\xbf\xd4\'\xff\x1f\f\x016\x9dQ\xeeT\xe8\bY\x00\xb2\x06\xa6\xbel\x9b.o\xbe\x80\x9dx\xd5O\xd6h\\I\xc9\x8d\a\x1d\xc9\x0f\x82\xdbs\xc7\x83L\x9e\xa2\xd1\xb3\xac\x8d\xd8\xb4\xb4\xea\x90Q\xd8\xc7\xeb%\x8bOp\x1ab\x96\xcf\xbb\x15\xcf\xfcN\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00s\xaf\xa2\x14]p+\x96\x1ei|n\xda\xee\\\xae\x96*\x82*\xb8j\xda\xaa\x14\x1f\x1d\xf8\xf8\xae\xfcH\xc4\xb3j\xe8\xcfO\xef\x0e\xafe\xb5*\x89\x18\xb2w\x96\b\x1by\xeaT\xdd\xb3g6\xbc\x85\xb2Y\xccv\x06\x00\x00\x00\xc5e\x90\xc51\x9f\v_# \b\xa5\xbcP,|\xe9\xd6s\x1f\x1f\xbe\xd3\x80\xb1\xa8 \xce|df\x903\v\x02\xea.\x03X\xb5\xe4,8\xb7\xadEI\xdcA\xa7\xcc\xd7\xf9n\x1b\x95\xf8\x11Z\xe6:\x03\xce\xfe\x02\x8ctdy~_oC\x9e\xef\xf0\xa2K\xe9;\x8e:\x01\x03C\x92\xeb\x16\x1c\xbf\xbe\xef\xccUxhg\xffY\xe6\x83\xa6z\xff\x01\x9d o_{!O\xaajU\x84 \xe9\xb59r\x9cw\x18Z\xd3\xcd\x0e\xba\\\xdb\xf0\xe1\x86\t\xaf\vi\xdc\xbf?\xf5\n\xbd^\x05\xc0\xceuC}\xa8\xc7\xad\x86\xd7\x15&\xb9]1\x05J\x96\xf0\x84\xc1\f\xa6p\x96\xb8\x02\x13pA\x19\tf\x12\x88\xc8\x9c\xc9Cn\xd4\xa47V\'+\xcc\xbf\r\xa9\x10\x1d\xcf\xebKlb\xe5:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00G\xdf\xbb\xc0_\x99F\xf4n]\x14\xbc\xcd\xd3\x9f\x9fe\xc5\xe6\xe8Mb\xc6\x82\x82\xcc\xcaXe\xe1\xa2\xaa\x02\x86\xb8\x18\xe2C\xeb\xa9\x17&\x01&\'w\xa1t0\x80\xf0\x93\x80\x9f\x9b\xe0\x9f\xea\xb9\x9eD]#V\xda\x92\xca\xc6\xfa.\xd6\xe31\xfe\xe8\x02\xebX\xbd\nz\x01O\xd3r\xa2\xa9u\x93', 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="78010000170001000000000000000000fc0000000000000000000000000000000000000000000000fe8000000000000000000000000000bbac1414bb000000000000000000000000fc00"/104, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc020000000000000000000000000000ffffffff00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000440005007f000001000000000000000000000000000000003c00000000000000fc02000000000000000000000000000000000000000000000000000000000000000000000c000800"], 0x178}}, 0x0) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x925, 0x8866, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000002540)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0x5, {[@local=@item_4={0x3, 0x2, 0x3, "ac25d16d"}]}}, 0x0}, 0x0) r3 = io_uring_setup(0x191a, &(0x7f0000000000)={0x0, 0x761, 0x10, 0x1, 0x331}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x28801, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(r5, 0x541b, &(0x7f0000000140)={0xffffffffffffffff, 0xf, 0x0, 0xfffffffffffffffe}) close_range(r6, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000000, 0x30, r0, 0x78282000) r7 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TTY_GET(r7, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x3f8, 0x100, 0x70bd25, 0x25dfdbfd, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x20000004}, 0x8810) 2m8.813165502s ago: executing program 2 (id=1422): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r5 = openat$sysfs(0xffffff9c, &(0x7f0000000000)='/sys/power/reserved_size', 0x0, 0x0) fsetxattr(r5, &(0x7f0000000180)=@known='user.incfs.size\x00', 0x0, 0x0, 0x3) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000240), 0x40000, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4040aea0, &(0x7f0000000280)=@arm64={0x0, 0x6, 0x3, '\x00', 0x4}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000480)={0x6, &(0x7f0000000440)=[{0x4, 0xff, 0x1, 0x7a}, {0x5, 0x7, 0x80, 0x400}, {0x3ff, 0x6, 0x40, 0x1592e9a0}, {0x4, 0x8, 0x10, 0x707e}, {0x8, 0x16, 0xf1, 0x6}, {0xfffe, 0x7, 0x2, 0x1}]}) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b04200000000000000002000000540004803c0001800a0001006c696d69740000002c0002800c000240000000000000000008000540000000000c00014000000000000000010800044000000001140001800b0001007470726f78790000040002800900010073797a30000000000900020073797a32"], 0xa8}}, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) ioctl$KVM_RUN(r10, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000500)={0x0, 0x1, 0xdddd1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_PRE_FAULT_MEMORY(r10, 0xc040aed5, &(0x7f0000000080)={0x100000, 0x18000}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r11 = socket(0x400000000010, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r13, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) 2m7.591486456s ago: executing program 2 (id=1426): mprotect(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000200), 0x1, 0x2) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f0000000080)={0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x400, 0x0, 0x4, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x1], 0x5}) ioctl$MEDIA_IOC_DEVICE_INFO(0xffffffffffffffff, 0xc1007c00, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000440)='/proc/consoles\x00', 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000400), r2) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x42, 0x0) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f00000001c0)={0x4000000, 0x1, 0x0, 'queue0\x00'}) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r7, 0x40605346, &(0x7f0000000180)={0x0, 0x0, {0x3, 0x1}}) write$binfmt_script(r2, &(0x7f0000000e40)={'#! ', './file0', [{0x20, '({'}, {0x20, ')!+.'}, {0x20, '^'}, {0x20, '/dev/dsp\x00'}, {0x20, '/dev\xba\xb3\xdf?\xda\x0e\x11\xc7p/kvm\x00\x00V\xd36\x9f\xde\x92\xb9\x00!\xe7\xef\x8b\xe8\xa7\x7f%Z9\xf8>R\x1c\xdc\xe4(\xf4rREz\xd39\xa2'}, {0x20, 'GPL\x00'}, {0x20, '**.@-('}, {0x20, ']@$'}, {0x20, '/dev/kvm\x00'}, {0x20, '!A*{({'}], 0xa, "e5ac329d9562478e4ece46259d825e8a8ca203781147a1207b00bdab41640c1384828150f35c836f61c59be92df763a78bea3a64333c1667a15325c617c169ebf6779b136b8fcfea8949b22b"}, 0xc1) r8 = mmap$binder(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0xe8, 0x0, &(0x7f0000000d40)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000840)={@ptr={0x70742a85, 0x1, &(0x7f0000000780)=""/175, 0xaf, 0x0, 0x11}, @ptr={0x70742a85, 0x4, &(0x7f0000000580)=""/12, 0xc, 0x0, 0x3d}, @fd}, &(0x7f00000008c0)={0x0, 0x28, 0x50}}}, @free_buffer={0x40086303, r8}, @register_looper, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000500)={@flat=@binder={0x73622a85, 0xb, 0x1}, @fda={0x66646185, 0x9, 0x0, 0x1d}, @ptr={0x70742a85, 0x40000, &(0x7f0000000480)=""/122, 0x7a, 0x2, 0x40}}, &(0x7f0000000740)={0x0, 0x18, 0x38}}, 0x1000}, @register_looper, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x68, 0x18, &(0x7f00000005c0)={@ptr={0x70742a85, 0x1, &(0x7f00000009c0)=""/132, 0x84, 0x2, 0x3c}, @fda={0x66646185, 0x9, 0x0, 0x27}, @fda={0x66646185, 0x2, 0x0, 0x1}}, &(0x7f0000000a80)={0x0, 0x28, 0x48}}}], 0x82, 0x0, &(0x7f0000000640)="57b4a2d8ef60a9b7ef438c2327cb1755e733a3c130507d09ebf5e3f42be3f5d347de005d9f08c4e2fe1cab64d8a8f8e7ef0ef1e678a7d1f5bbfbed072594e12d35149ee54a652e57ee685ec3880515ebbbe7fb19db1fa183a5ba496096140dcd29461e57f0ce7aa6d3f2b7a363baf4ce82af11ac23e52bc6f252317e05fa6e461bc1"}) write$sndseq(0xffffffffffffffff, &(0x7f0000000140)=[{0x1f, 0x0, 0x1, 0xfd, @tick, {0x0, 0xc}, {0x0, 0xa1}, @raw32}], 0x1c) ioctl$SNDCTL_DSP_RESET(r5, 0x5000, 0x0) r9 = epoll_create(0x8) epoll_pwait2(r9, &(0x7f0000000000)=[{}], 0x1, &(0x7f0000000040)={0x77359400}, &(0x7f0000000280), 0x8) r10 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000900)=ANY=[@ANYBLOB="ffffffffffff6487a20ed3d608004500005803000000006c907800000000000000000420880b0000000000000800000086dd080088be00000000100000000100000000000000080022eb00000000200000000200000000000000000000000800655800000000b03d0ef42580b23fb06828568eac895450472ec172820abbc937d4f99833ef2ee4d3fbb57e4cf16f38810aefb37de2ac42fbfa533387fe43b8"], 0x0) ioctl$KVM_SET_CPUID2(r11, 0x4048aecb, &(0x7f0000000100)=ANY=[@ANYBLOB="040000000000000002000000000000000000000005000000000000000400000000000000000000000000000000000000000000c0000000000400000000000000000000eda400"/84]) syz_usb_connect(0x1, 0x24, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1201500236355310b1131800f1f001020301090212000104f8900109080000004096f9092fb6485bcec796bf895ed76864c7e4b69f61d6dab31caff255d8fc72450f0845dffc9970ef89dc43d204c54bb9bcf44573dcf487d6c41f3b537769c899923b90dfd5ecb5b9a0dc0bb3d7594cbc3f44143862cd679dddea0b9076a3cfcf2429fc1764db"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="850000002e2b0000660000000000000016000000004000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x8, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff4e, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x23) ioctl$KVM_SET_FPU(r3, 0x41a0ae8d, &(0x7f0000000b80)={'\x00', 0x9, 0x7, 0x3e, 0x0, 0x2, 0x0, 0xeeee0000, '\x00', 0x4}) setsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000", 0x24) 2m7.099454094s ago: executing program 2 (id=1428): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x500, &(0x7f0000000000)={&(0x7f0000000ac0)=@newsa={0x154, 0x10, 0x1, 0x100000, 0x25dfdbff, {{@in6=@private2, @in6=@loopback, 0x0, 0x0, 0x4e20}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x0, 0x32}, @in=@multicast2, {0x0, 0x0, 0x0, 0x10, 0xffffffffffffffff, 0x0, 0x7fffffffffffffff}, {}, {0x0, 0xc76c5c1}, 0xffffffff, 0x0, 0x2, 0x0, 0x0, 0xaf}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x0, 0x70bd2a, 0x400000}}]}, 0x154}}, 0x0) 2m6.518925015s ago: executing program 33 (id=1428): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x500, &(0x7f0000000000)={&(0x7f0000000ac0)=@newsa={0x154, 0x10, 0x1, 0x100000, 0x25dfdbff, {{@in6=@private2, @in6=@loopback, 0x0, 0x0, 0x4e20}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x0, 0x32}, @in=@multicast2, {0x0, 0x0, 0x0, 0x10, 0xffffffffffffffff, 0x0, 0x7fffffffffffffff}, {}, {0x0, 0xc76c5c1}, 0xffffffff, 0x0, 0x2, 0x0, 0x0, 0xaf}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x0, 0x70bd2a, 0x400000}}]}, 0x154}}, 0x0) 18.950091672s ago: executing program 6 (id=1946): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000600000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) 18.667638163s ago: executing program 6 (id=1948): pipe(&(0x7f00000002c0)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x101440, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet6(0xa, 0x800, 0x84) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@local, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 0x0, 0x8, 0xa}, {}, {}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, {{@in6=@mcast2, 0x0, 0x2b}, 0x0, @in=@empty}}, 0xe8) connect$inet6(r2, &(0x7f00000003c0)={0xa, 0x3, 0xffffffff, @mcast2, 0x5}, 0x1c) close(r2) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x6c, 0x0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4, 0x0, @loopback={0x2d21}}}, {0x12, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x6c}}, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000100)=0xcf5) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x20000000, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) ppoll(&(0x7f0000000140)=[{r0}], 0x1, 0x0, 0x0, 0x0) r4 = syz_open_pts(r0, 0x0) dup3(r4, r0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000280)=0xd) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000001080), 0x4) sendmsg$kcm(r6, &(0x7f00000001c0)={&(0x7f0000000100)=@phonet={0x23, 0x0, 0xb0, 0x41}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000240)="cb4e88a8af3288", 0x7}, {&(0x7f0000000280)="390100", 0x3}], 0x2}, 0x4011) ioctl$sock_FIOGETOWN(r5, 0x8903, &(0x7f0000003b40)) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r7 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r7, 0xc004500a, &(0x7f0000000080)) r8 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000380)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="08000000000000000000000000000096efb199fd88fd16ffe6af88087d4b06e43285c71aba86ce08e72e2fb56d954cbc7e08e53b15775bdc401398083379a0011a90378c2daa00"/84, @ANYRES32=0x0, @ANYRES32=r8, @ANYBLOB="01000000020000000100"/28], 0x50) ioctl$SNDCTL_DSP_SPEED(r7, 0xc0045002, &(0x7f0000000040)=0xdfe5) bpf$PROG_LOAD(0x5, 0x0, 0x0) 18.627667972s ago: executing program 4 (id=1949): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newsa={0x168, 0x10, 0x633, 0x0, 0x0, {{@in6=@private0, @in=@broadcast, 0x0, 0x4000, 0x0, 0x8001, 0x0, 0x20}, {@in=@dev, 0x0, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0xb}, {0x323}, {}, {}, 0x70bd29, 0x0, 0xa, 0x2}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @encap={0x1c, 0x4, {0x2, 0x4e21}}, @coaddr={0x14, 0xe, @in=@dev={0xac, 0x14, 0x14, 0x3e}}]}, 0x168}}, 0x40810) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[], &(0x7f0000001200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = syz_usb_connect(0x0, 0x202, &(0x7f0000000780)=ANY=[@ANYBLOB="1201100152018b401e040740185d000000010902f00101040000030904"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f00000009c0)={0x84, &(0x7f00000004c0)={0x40, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000900)={0x84, &(0x7f00000002c0)={0x0, 0x7, 0x15, "1455d49c49e91222606a5c13ebb25e921d491b59b2"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x9}, 0x0, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x2, 0x1}}, &(0x7f0000000600)={0x20, 0x0, 0x8, {0x8, 0xcc, [0xff0]}}, &(0x7f0000000640)={0x40, 0x7, 0x2}, &(0x7f0000000680)={0x40, 0x9, 0x1, 0x5}, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, &(0x7f00000007c0)={0x40, 0x19, 0x2, "ec05"}, &(0x7f0000000800)={0x40, 0x1a, 0x2, 0xd1ef}, &(0x7f0000000840)={0x40, 0x1c, 0x1, 0x6}, &(0x7f0000000880)={0x40, 0x1e, 0x1, 0x80}, 0x0}) r2 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, 0x0, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="000000ffffffffffffe7ffffffff05", @ANYRES32=0x1, @ANYRESOCT, @ANYRES32, @ANYBLOB, @ANYRES32, @ANYRESHEX, @ANYBLOB="af83b793953d7fbd", @ANYRES16=0x0, @ANYRESDEC], 0x48) socket$kcm(0xa, 0x5, 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0xd, 0x4000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0xdc8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80842, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r7 = dup(r6) sendmsg$inet(r7, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10, &(0x7f0000001600)=[{&(0x7f0000000140)="be38", 0xffdf}], 0x1, &(0x7f0000000c80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private}}}, @ip_retopts={{0x1c, 0x0, 0x7, {[@timestamp={0x44, 0x4, 0x73}, @noop]}}}], 0x40}, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r7, 0x4c09, 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 18.169088259s ago: executing program 0 (id=1952): r0 = socket(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x161141) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xf691, 0x10100, 0x0, 0x2b4}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r3, 0x70a, 0x41e3, 0x0, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) r6 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$uinput_user_dev(r6, &(0x7f0000000100)={'syz0\x00', {}, 0x7, [0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x4, 0x0, 0x0, 0xf6, 0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xfffffffd, 0x3, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0xffffffff], [0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xfffffffe, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffff, 0xfffffffc, 0x0, 0x0, 0x80000, 0x0, 0x180d, 0x0, 0xae4d, 0x0, 0x0, 0x3], [0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000005, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x101, 0x1, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0xed0, 0x4000000], [0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3e8, 0xfffffffd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0xf, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x101, 0xfffffffe]}, 0x45c) write$input_event(r6, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000ac4010000060a0b040000000000000000020000004c000480340001800b000100746172676574000024000280090001004d41524b000000000c00030002b51112d439c5920800024000000002140001800b0001006c6f6f6b75700000040002800900010073797a30000000000900020073797a3200000000f70007404884b24b02a8a7758a688958ed60ecfd057e10926ba77e5596b13e43cd4488e4aa68af5f7236ec205b6e4cac2a0d86c336bf07dbe861f4f57bcef92dcf818d532d4475b5daa4dadc1690f228e860bba5a0b5d9bde86862e8f7fc08f0debd4974c6fae7d737a0007ec948ac4d8714ebff6b25648fb910e0d6d07f023cf5fa4051627b9c5b69e265538f9ba683bf172a5ff815afa543c12e550a1bcc9287080c7c12cc89d216c56febb0b06134672ea6b0077c846396169475f271319988f49ec94f2996e5d0e1cb151fb223e556f10fb681d068e055eb34e5f8fc7a524ffe5f4632a6c74ad0fe0b1542497d76a5a4416c47805e001c000580080001400800000808"], 0x1ec}}, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r7, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_128={{0x303}, "cfc85eb51b0ace6a", "4617a9f6040839230fb7fead776dd8dc", "3f4051c4", "a44a889722b66244"}, 0x28) recvmmsg(r7, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/88, 0x58}], 0x1}}], 0x1, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000001c0)={0x5813}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000004a008d2a00000000000000000a"], 0x1c}}, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000740)='./binderfs/binder1\x00', 0x1802, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f00000001c0)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x1, 0x4c00, &(0x7f0000000240)='\"'}) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0x0, &(0x7f0000000040), 0x1, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="01000000000000005b00000000000000b9800000c00f3235000400000f300f0170550f01cb650f232e"], 0x422}) 17.128694297s ago: executing program 0 (id=1954): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) fsetxattr(r2, &(0x7f00000001c0)=@known='user.incfs.size\x00', 0x0, 0x0, 0x2) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r1, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f00000002c0)={0x30, r3, 0x1, 0x0, 0x5, 0x0, 0x1, 0x0}) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r4, &(0x7f00000000c0)='6\x00', 0x2) 16.926887351s ago: executing program 0 (id=1956): syz_usb_disconnect(0xffffffffffffffff) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000003f40), 0x0, 0x200000d0) r0 = socket(0x28, 0x803, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, 0x0) r1 = syz_usb_connect(0x4, 0x2d, &(0x7f0000000000)=ANY=[@ANYRESHEX=0x0, @ANYRES64=0x0, @ANYRES32=r0, @ANYRES32=r0], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_usb_connect$cdc_ecm(0x5, 0x60, &(0x7f0000000240)=ANY=[@ANYBLOB="12010002020000082d05a1a440000102030109024e0001010880f57f88677f6c95be70040624060000df05240007000d24a1efe0020000fcff0e0004052415090004240200090581030004020904090582021000c009090905030200040107e8"], &(0x7f0000000440)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x250, 0x6, 0x4, 0x1, 0x10, 0xe}, 0x2d, &(0x7f0000000300)=ANY=[@ANYBLOB="050f2d0004071002040906000c100a81800008fdffff06000a1003000000087f820005560102"], 0x1, [{0xda, &(0x7f0000000340)=@string={0xda, 0x3, "34046b441cd12238e8abb653257c9cce0b60eebce1c1d077188f9b872cc48c223e60c805081bf27fcf8ae58bbd84cfd546f788a8cc7af43cb36f3a1db88e52af9d1d7687e3272df223ffc0b67ad9dc3183a5f4d1a84f7bea3ff5aa30618d591c4e996fcbe8553f8754320890c8751067920a3ca2be212f09817b65c393257895947890e0655a77736a601aeebd08c8cb7bf5934b1925e03e7cd0c06f3f564c8a3bdfebb49bf1ff8921ba3b9c4d2dc908eb862a3b6f01ff867f4b9745dc68c887fe941d2c1a272fe2ea19228ba13e9e0c9695de30575265a7"}}]}) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000140)={0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="00164f0a9fca"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000d00)=ANY=[@ANYBLOB="040a00001400"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_read(r1, 0x5, 0x5e, &(0x7f0000000080)=""/94) getsockopt$packet_int(r0, 0x107, 0xe, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) get_mempolicy(0x0, 0x0, 0x2, &(0x7f000076c000/0x4000)=nil, 0x1) getsockopt$inet_sctp_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, 0x0, &(0x7f00000001c0)) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000003140), 0x800) poll(0x0, 0x0, 0x1) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) move_mount(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x200) ioctl$KVM_GET_XSAVE2(r5, 0x9000aecf, &(0x7f00003b8000/0x4000)=nil) 16.912491903s ago: executing program 3 (id=1957): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "00008000806d0200", "0b3ea924c47b6dfe624cd362581725c7", "000400", "d5a1d50399459b68"}, 0x28) socket$vsock_stream(0x28, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socket$inet_sctp(0x2, 0x400000000001, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x0, 0x0, 0x80, 0x300, 0xffffffffffffffff}, 0x0, 0x0) 16.383189854s ago: executing program 5 (id=1959): bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000020a000000000000000000010008000400", @ANYRES32=r2, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r1], 0x38}}, 0x40004) 16.256879446s ago: executing program 5 (id=1960): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r1, @ANYBLOB="01000000000000000800010000000800050001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb542080005000000000090000880"], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x20000010) 16.044000502s ago: executing program 4 (id=1961): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc00000019000100000000000000000020010000000080ffffff000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000000000000000602d3183000000000000000000000000000a000000000000000000000080400000000000000000000044000500ac1414aa00"], 0xfc}}, 0x0) 16.042946722s ago: executing program 5 (id=1962): syz_emit_ethernet(0x2a, &(0x7f0000001240)={@multicast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @remote, @multicast2, @remote, @rand_addr=0x64010101}}}}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000005c0)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0x58) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x550, 0x1c0, 0xffffffff, 0xffffffff, 0x1c0, 0xffffffff, 0x480, 0xffffffff, 0xffffffff, 0x480, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c0, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@recent0={{0xf8}, {0x81, 0x0, 0x24, 0x0, 'syz1\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x298, 0x2c0, 0x0, {0x0, 0xfc03000000000000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x2b4, 0x1, 0x2, 'syz0\x00'}}, @common=@inet=@recent0={{0xf8}, {0x0, 0x1300, 0x4, 0x0, 'syz0\x00'}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0xfd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5b0) syz_open_dev$vim2m(&(0x7f0000000640), 0x800, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f00000006c0)={&(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x80000, 0x0, 0xffffffffffffffff}) recvmsg$unix(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000780)=""/213, 0xd5}, {&(0x7f0000000880)=""/3, 0x3}, {&(0x7f00000008c0)=""/144, 0x90}, {&(0x7f0000000980)=""/104, 0x68}], 0x4, &(0x7f0000000a40)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb8}, 0x12122) 15.916650035s ago: executing program 5 (id=1963): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) keyctl$reject(0x13, 0x0, 0x75, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r2) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000829bd7000fddbdf253100000008000300", @ANYRES32=r1, @ANYBLOB="0c1d00f3ff"], 0x28}, 0x1, 0x0, 0x0, 0x24000000}, 0x11) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000000c0)=ANY=[@ANYBLOB="98030000", @ANYRES16=r3, @ANYRES32, @ANYBLOB="04008e00080057"], 0x398}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001b40)={0x14a0, r3, 0x0, 0x4000, 0x0, {{0x8}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_SCAN_SUPP_RATES={0x1290, 0x7d, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x23, 0x1, "aa18fdafafc709c95dbc8d9f918b0153076c4bcd4dca21105b7de64b23a416"}, @NL80211_BAND_5GHZ={0x58, 0x1, "9bbdcd14619d838fc10561960bbf9461d07c5a0673f8a177e6288cfa03cdd599bf61704fb62d4d076e8cac7ee01c6db36f895781e756e1640078870b203b5ef7f60eab7dcce04d66a06145d5c5145c5a193f0d48"}, @NL80211_BAND_6GHZ={0x41, 0x3, "c9090089bf8c178f1aab8d695c26f01f299e3eb1812f07e051db8a8cbfedcfa59ee3655a0830b54df9c20188a38245e756ba4ba4e7f31cd45019024905"}, @NL80211_BAND_6GHZ={0xd9, 0x3, "71891e759312fee7a7167e1f9e3fc42c98925d7303a06127d2aa55a681d6376e3d8d57ff702566400047f986db2d599934a7bd321a394007e02dd5d5731c8f1077960a338a42f1403ae42b1f67a7149f2c480a8ad51aa694ec60a1d8439670379c4d0e9cca1a6d2180c294c51ef61406a9212bbc2d8fcf13d753344d7a4ab3ce4c7bf15b8590b78c4a47a140b018e0ac8afd6094c285cb7adbc4835b2714f84a7ccc5c4c8d8bc31ae59676d5e6e58dc04a04dd01d2f057ebe99ddcad83634eb09a3cf5261d5179a14c36bf775d422a418993af0675"}, @NL80211_BAND_5GHZ={0xe9, 0x1, "0c6065cb15bc821500199574df5168f5ac95c1a1c997fe1b9fcf608c4f2480e364e4af0823e48c33b73a2aaa8f043fc6e252dc72a94441f6364bf5946919b400a1d41ee80467865f743f6aadf3fd1945cf2ac7f18acb5b2f9762d0b95e2456649f8a8d14b82a543f2da214dbc0e1bb4fa4a02da04599bb03b7872147493a6c4950668576b009a257a5aa8c37eb4a838528be571091a32427dbb05ef6a222d1cf48b712de89caff506bc62603a8f22fbbf72c83975ba5b513fc773cde4a5b76a160ef683c0723c90aa30a1e7bc9534c8146c90f9adc6a27e459fc3d52cce34352037578708f"}, @NL80211_BAND_2GHZ={0x1004, 0x0, "ba79fc451ac3f9a7076543da60a4075dee6dd8a7f7497527e3078cf9d5958643b84f8214cfbbffc2928ab355d4e6f9cebd17fab39153dcd0468137dd23a2706b15becaeb322f56183eadd4a9f6f8653cad74ac933403ac5bddfb69d1588550f682fdc640a41fcb735d9a85978e3fc61af539b3eae9eb6d0d2c4c92fb117c9024d24201a69c4cf545d8b9a01e70147dbb1724c6316f23df580311ceb83096ca8508ef60b88ce7902ab20f4367165a450cb40996a02907fef5c54e1ffa249801179ef7e91b58ab7511ac133188326ba5072de4d5c8042e13bb940ff1afe89d3f697c192e86960808040768502e54dfbeb1b26829f525c4dc3a46362a78c3ae746a5ed38f770871fa897e1ab13f0e9eb89e3391cd3092950dad7553e13436e635bfea38b579e7a86156d46e04ec8e981b51be9313066ff7d0f70d0e560fa26272bde8a3ad708978386a91918514def593c856ff5ca798b692a5c9d8e9cad01449dfdefaab6b0b9145d79d668e19d7ce61c67ed334ab4c05859688191c9b97a7d53bfa46a2a8977ead0fd7c44bae9ae0dd1c74f7c2e40a80fbfd68bd45d3d5ab3e284b1b648c14c10052024753c4ef7c8c5eef22a4615a6105782f1996a3dc55c5f2ffb123db7053cef08091a94e928669ba75c24e4ebbe23989c9d76771b5d58081c70f9f256ca55cb4012ecaf56670be86b3b78577d7fc8e7fb4110aa7d3fe6cf59dfdebaf1de31cedcbea5b5154740d6b0c80a45fc0c084d913491a02abd5c4bc4626c08828bf19a4081a09f431ae22130a45af56dad6109e5ef7380e9099b6961a11e0944c38066ad477353b689f9fc589cbe60074fef0a9faa5e3f63dad154d415245776a925d9a0b0db34a6fd871374cb6a1a2b581b929de296064ae5d11191501e804664cc717203b6ef08191769252f4fa34fc744ef3900ea16e510b4bf2db3ee2f51360993aab3c663bcb3be8ec9cf7af988fc01cdd4e6b19ab4a40730e5cb562498025d46312b5b024e2a270bb2cb29c0cc7de61fb3d138dbbca22ab3bfd7768eb9bb02711426af5d885339097a58d410e494cfe5fc6cfe6fb8c31f6c676136f125f6727408ef7782002180a21ff339d15b61bd9e23beae57fea558bab63f69cfc0a35d130ec44d14c6e51ddf1a01ceec5b73b7badb4fac9f19270189f2c39cc455fe2da1806ae258cee4f4a68fe4407055929724da1fef0f9eadd09fd981943ef726f886ec3ace4f294f54b48df0e83d80c773fd2edec42ea30a4975c6f0230884b17d88d97e215effccaafd0ad290757fb3744d526774b1152f34e5e35006583ac35dedf8516237f64e4d4a2f238e57baba606631395063750151ac6e74762bb2ad497b943dc84f179ab07f1e29061af4e06bb5c7c2f5047ccb8dd6b01ce5b338b74ed38bf88c1289ca73f1f33bf5b736b97ae8fcf883dcb83c45bdbb3091955cf499e00a71994d678188fe5e91a74ca7365e0575a259a5476c70a0ad2220f0d68850c5974e53977055310006db14557df43bf9b0754b58621efd2a40140415b6b13ef7cdb7fef306250f7cb56b2b1a442ed628e291156f88b5b44e765eaf424e976163e37fc50446df748157e3d7803aff6489bb8ddaf8fc858b1926fa096ab97261c47edf7e1739953b8a2a11f590b5f5bb53685d0f1a588b360c9e28dbd539002a2184d5cb3b3b0f2b9d82a1c01d9819cded985690c602d793215f437af500e09401170c6e0750fc24c677d88ea183ce3fe76e2a441334f8bc41cf2ca95c8fc161ddc98eb1fd2d9434b305ffc0357a7d9687e4660f71234e89a1b5e15b46fd304d159cc36c409076bb0f8d362a2a916ec27ec6cc1c4de17eb26eb9b4b63f5ef47c8f30c0a497df7e78337bd6e2fd6ecca80496c01a0039ab08e0d77d69ce00706550105fd2c3abab2867732424e8ba76973b64bc27a7c6158176ddfc6c5100b6a2ef086a2325811967c441b03ffab40c35951291c7b3a99f9a2ab0c1a3a8339812634df892a1ee0a54a52ae5e664de613d3d042b6e973e4b1f2e5db6e64b8ee3973bce5aa5de0f4d31b5f0ee993177c034f43173d569d91b9f051f16d0b73480a0ba286695ca05578c211247710bcc74ddc2efeb2b1111aa71ebc69ae11352f15709559f8933efdfe5b7145f92291ff40eb4454e3fc72c627a18130c480af8c86b9ee9569e05cf7088a8d5344916015da68e4efd36d141e2132973f361dcc7eaea66bc9f0b23e891edd097cfcfbb1fbaba445225d521636d452840619a2ba4bd90240d22e293cabd9d0c1cdd3490877b596248a43c9b0ff158e39814c981ed5466a1bcfe099f394f13d008853903876ecc1881521f6a9201ca14e672a1168304c1dcd366293818daaf9105d517219c6f81c2e8894104c0db24a4c92f0b9d161d68fae4f31e74bc4db7d48978c12a7a650c89dcd3ba3e83b39bb8149020e7d8d934186406781c394d9cf6e8f6a71bb6991a5c38035f925f9070b32b2bb23a8e2e395c925df264a64d249c0dbc2b97091e44bf5664a9d1cf15ec83dff034db393a15838a10797ac657f00cc9d319e014b6b5f3e57a1c90ed6291e7ec503949f6956ebd8abcf497dd66b89b0202a4e5aaf7c24890f0b2402ca4e3acfd412c4f7c719883c30412f2b5a8104b28109714994b35848a0ca415d2546f52ed782421d0d480f635b4e4dd01cb00d619c24f5ae0bfc32d6dc94beb0debbddd94ceb49807f3fdfce935f9eee90a3535fbd9600fd32b1968aced6662e321cb871e7fa327a201cfa222cb5cfcafe942a7d8ee17b613bd58ddb71caae49a3db495c0f5c9d1e11d5414f3f0093b47fb77dd68549ae4e41e7e46ba3bca21bbc3685db89c9edaa3c8fc5844daa53d9ca445ab99018090abbb5b3d7800e530afc57b7252e407ba7aa05a130a0c32b92f00dbdd627931bc9b6e2e57076f7a4286555d0f13aa9a4e70c570de5a8b4421f86993a42f6d5bf5ced4584ea8a5ce06325f428f35e31607d6f20127d81a349210026c080c9f6a3c337b35edc202db4f553fc03357601b8fed04ea1edb281263866afd3497368e258f7752dfe37c8636cf14e484d97b9f1735cb267fcc78fd248cebbc45ad5489d452c2484012be676d4c2e32859785f514bd734f168b8f813110702de85453002aa2fb7418466f565cee08ccdacc9270050a7a5f05cbb0abd423ae1dcd2af9f95140ad25e567036a9b3d02105e50096b1de9b5eb41acd373e30c6b647e22dfbe2b4a259be4e195df6608c1590eda949ea6ae14b640309675917e6799f4fb141e721f773a26f6c44ac66cbab8f07d93511a95cf86925d8f8bb380234c4605cab650d78b11a8e1ba1d93c2791cbedfd197da23f820faacab0a744366eb404b518a2f262bb1678c81fc03b7fc864c08416aa376490ecffe4b7d9197453c8a166140303692f8df98f7c8ffc61842e984c07074caee34dd8cd804639d87bff6878e613a0ef813b7707eb929d96098b996c9940645eb461b5435b11d056c795a962eaa9e5ff2f7d9232f9563958fd31b508884e0ff33f1a9cd3b3c5817eeeee6ad1bed50c4cda7ccdf07aba9cfd18ba29bdf9201553eaa0f1b60f243a562480c37c0194e48f31e983f13365704c7e282edc5f7503d09c7bea03e828f5f4b7921ecf25ab25406e26d5cdb7b1fdf32fd5afac4f60f9f638c2e26ffff92b1d498214508783529041630ce27a13786f87104d294955a19d3e3567386e7ba380814b5b0506243858f35a8fb81dbba39bed94e34531bf4cf703ebb73bf3b1b0483d9f8b549fe0601a490062f688e03f6f4545024b0bfb0f5b771535add19c16959cc6256d0c63f49233cdd834ade46b2e006e5d9ad86383c101febd1b510d92c3578a5490105d7718bc9181e2f75065cc59fc0caa1ae87934a11d30135931bce82b46a41eeae04685203d5165361fb7d0c63b8523c23232bfb4d6445dc3c28957c2728f715a3e4c39d8ebccd82de3e71d7e7df923cd4d6b18819aa17b05456d722a046e5fde09a5ba1121e1e069b70881c2645b46cf7552cb31cae2df8afaecdecf01854e41636bcb558f321818b3ca4d232e82aa02651fb1445c314420aad92eb7693d490cfdf8fa5c8c4fc52fcf08b9106ef5a5f0710583bdf664f71234a11c3b3c46252d52b7bf9a7258fbe8597c5cd84578c065483d59836fd95ab1c1e27433a5a1adb01874c0750531d7860dc3a86089c33feaafa377a1dd9789dbf21adae30523753ccbc63ed77ac6dddb8c8d5b27170e6b3a47c20804bc7539bc11c5b995fa6320ae1e52a9c19aacaca355934017c493ac26368f29d2f80bd2ab70f732cf2fb46b376322b3fa2cdd2fef605992e35cde29b1bf9d009a8e2e27eafe3aafb228e0e3ccb34c9b9613cd9bd23e9d6aa4e00cf6adeefce4d5aef495a5eb35f6702c351a1bdcc22c47febb5c9a26f80498f9bf7e6f56b7556c4646423d5209eecde6ab843ee6f5519ac84d65a990f75857e5459dbf0fcd9576469037ee25c3bf4c2f3d1a5015b173aa92c41ca80f28d1f1eae995852649f0827de257f41477c6deec96ff44b8d87ebd9051536e2931698481cfeb0351b6b2f6dd3e9f522a8d44f3bc8fc963230797d23096b5447f8e086ec64a553589c3ca2a8eb6b98e8cd5cbfab36bae4b9b620b0967b3fe1afc800bfe97456e1cbd79cabff7487d48baeb2f063c329f101bc8c3f7ab2db9b6179ef8a02dc98dcfba2424b1b8472f3d8224b01d38ecee8629d85a911b7126774fcb94acbed3facc45e8edb8c62726cd8e27c9b149fff6d7f3731c2226132ab45cbcfc32f550f74d4e9b77028b5c7e1f237ebb76286a1abcbb8f8f40381f73252570886cc60978d1aaff76eb3c4353ab1703225cc54424a665cadfb65826f9eef6a78624a7750d90a3e0e23d8d724e1694eef8d376392af9f1f19e7fb595fb0abf619af46196986564691ddaeed572fe4858e8d3c2cadbe8fc4c123e45a36e6e5be49eb2e8627f3a68a7c48d3627a9eae59bca45b5ec77a7ec495d3d828a9e130be8ad107374d1f688f4e67be2c265c0fc70b4b0a045f687907eefd0f0cfce8b0b624cb8ca7b1c4eb3926aa08f3409abd1f181fdc4a3065896f9fc9e789522bbcadd4cc72ba326364932dc1607552d373d08608f0fdf81191fefa9886473cb7b60cf3e8e44f5252d671d46152df9bf9bac8e8b2ce661885a6f0196a3e0bb4bdf78b6621755511cda59bc2a1d6f5f097160d422b04caad62c1e45958ab8d816924981a80368bcf213a3499f8eaaedcce524ed17b359c291ea52cf28e1f9ea0d750e9886f192f4a881b0465ee5c6f7d34d14ad2e819fe5d57f5bb504e528547e03f5a0b0ce19608aebb691c359cf7d9193321a30cdf003b394ecdb51575152d0b912b68cb52e4a729df1dccbdb1fda7fb28ad1c799a673b889cf07b177cd36318ef166f535808b49483e4275cc0f9022f9195056084794de40564a659a374578883ad960484819d88f1b60238b543224ae9196d8ff33daeec299553b44c9056f2ab84807f8d57efc3f93e9aea1d0e2bc85678fd57ac0e40541f62a15f143e6b0d639a52eb9f57431437f93b34fea10f8cd0428d39a0344d845b2b34d468f95d7583df480e18347771c150bfd5cb1dfa5a4b91233f1025f93e586c06cc6a1d5a228a121200c03510fdf85cad2b33d770930f4c90fae5badb1641140879604391df8bd9c1af58b18b7807ed2a140297bff960718fc75123d06efb696471b80c96c883ab83ed843fe935675ce19decaa06964a70a8a03ef5844638f905c81701ae53e1324c628303e"}]}, @NL80211_ATTR_SCAN_SUPP_RATES={0x13c, 0x7d, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x64, 0x2, "93f7e4561da503b2e75e911f9c6f70f9a17fdada22cfcb72b0988cf24cb64a970457fa326525471ecf9b6a760e9a1fb71c45b6962586e61479206b87dacd1494dc3501500db3f2f4e874c4552f400af874d8de5767c2df094da7d769970b1cb7"}, @NL80211_BAND_5GHZ={0x35, 0x1, "0baccde36df7ebd36576930da849cc6eccd84dae2a0683187d7a8aa4cd82714513c9540fe636826eec05d2ee44147e9ec3"}, @NL80211_BAND_60GHZ={0x61, 0x2, "7184de7e319fee09f0795e4c5bdcc4ce89e56f46a1777dd093d011b52204c6dc36bfc51c03e631a3126f1912928c22f73fe29ec7b26898e74bc41d55597601f6c0fb9f66797aec4fc917d662816b320de923b57fa8403aeecc16cc670d"}, @NL80211_BAND_2GHZ={0x36, 0x0, "ad00566cbb837f0553c9c896449355eb2e51dc55b32d71d13bd55946de375b0c3efc740d3f649fc9312dd403a4ce4148db12"}]}, @NL80211_ATTR_SCAN_SSIDS={0x64, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ap_ssid}, {0x19, 0x0, @random="e816619c7a12e739f4066f8f7d1ffeca4c0df2e61e"}, {0xa, 0x0, @default_ibss_ssid}, {0x12, 0x0, @random="717568dc871480746282a2a0eda3"}, {0xa, 0x0, @default_ibss_ssid}]}, @NL80211_ATTR_IE={0x35, 0x2a, [@tim={0x5, 0x29, {0x24, 0x99, 0x2, "e9bf0840f519133b0f237e2d178809235f1f3fb6d297abb860a1f5ab9defcab0b799bd8862fc"}}, @chsw_timing={0x68, 0x4, {0x5, 0x8}}]}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x5}, @NL80211_ATTR_BSSID={0xa, 0xf5, @from_mac}, @NL80211_ATTR_MEASUREMENT_DURATION={0x6, 0xeb, 0x1}]}, 0x14a0}, 0x1, 0x0, 0x0, 0x4000}, 0x4c2cef144c458b5) 15.895701185s ago: executing program 3 (id=1964): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='scalable\x00', 0x9) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200801, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000380)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000240)=':', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) 15.803958729s ago: executing program 4 (id=1965): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000180)=[{0x28, 0x0, 0x73, 0xfffff034}, {0x50, 0x0, 0x5, 0x2}, {0x6, 0x0, 0x2, 0xffffffff}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @random, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @remote, @multicast1}, {0x16, 0x0, 0x0, @multicast1}}}}}, 0x0) 15.803479767s ago: executing program 5 (id=1966): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x3c) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="ddfffffdff000000140012000c00010062726964"], 0x34}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000e80)=ANY=[@ANYBLOB="20000000140001000000000000000000020000ff", @ANYRES32=r3, @ANYBLOB="08000200ac1414aa"], 0x20}}, 0x0) r4 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r4, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x4) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20088814}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x7400, &(0x7f00000001c0)={&(0x7f0000000200)=@delchain={0x24, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x24}}, 0x0) 15.632191476s ago: executing program 5 (id=1967): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x0, 0x1000002, 0x8010, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80801) socket(0x40000000015, 0x805, 0x0) socket$xdp(0x2c, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x6bc3, &(0x7f0000000400)={0x0, 0x707b, 0x0, 0xc, 0x289}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0, 0x60}) io_uring_enter(r3, 0x3516, 0x0, 0x4, 0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0xfffffffffffffd2a, 0x1, 0x4, 0x0, @void, @value}, 0x28) ioctl$KVM_RUN(r8, 0xae80, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x40000000, 0x0, 0x0}, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0xb0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r9 = syz_io_uring_setup(0xa1, &(0x7f0000000640)={0x0, 0xe8ce, 0x0, 0x20, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000020c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x6007, @fd_index=0x4, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001800)=""/211, 0xd3}], 0x1, 0x0, 0x1}) io_uring_enter(r9, 0x47ba, 0x0, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000002800)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) 15.529303751s ago: executing program 4 (id=1968): socket$unix(0x1, 0x1, 0x0) socket$kcm(0x2, 0x2, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$kcm(0x2d, 0x2, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast5-avx\x00'}, 0x58) socket$alg(0x26, 0x5, 0x0) accept$alg(r0, 0x0, 0x0) socket(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x3, 0x7) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r2, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x2, r1}, 0x2) sendmsg$inet6(r2, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e20, 0x1000000080000, @dev={0xfe, 0x80, '\x00', 0x3f}}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000029000000040000002b0000000000000712000000000000"], 0x30}, 0x0) 15.512297946s ago: executing program 3 (id=1969): ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000600)={0x0, 0x4, 0x0, 0xffffffffffffffff, 0x0, 0x0}) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020100020a0000000000000000000000030006002b20002002004e24ac1414aa0000000000000000030005000000000002000a01000000000000000000000000020013"], 0x50}, 0x1, 0x7}, 0x20000000) 15.46803506s ago: executing program 6 (id=1970): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x82) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000040)="273eebfecb7c0e923301b61c42cb1d11f41d00bdab2a3d983b065a56", 0x1c}, {&(0x7f0000000140)="10eba9fdb4cbab48929e1af151000000000000000000001f00000000", 0x1c}], 0x2) 15.115827599s ago: executing program 3 (id=1971): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x14, 0x24, 0x100, 0x0, 0x0, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x24044085}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'sit0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) r4 = inotify_init1(0x800) inotify_rm_watch(r4, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000080)={@empty, 0x0, r3}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) (async) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x24, r5, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4004000) 15.106641365s ago: executing program 6 (id=1972): syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) r2 = syz_io_uring_setup(0x23b, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000380)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r2, 0x2def, 0x0, 0x0, 0x0, 0x0) bind$can_j1939(r0, &(0x7f0000000380)={0x1d, r1, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) sendmmsg$sock(r0, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="1f", 0x206c}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x700}}], 0x2, 0x0) 15.104592437s ago: executing program 4 (id=1973): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) r1 = socket$l2tp6(0xa, 0x2, 0x73) dup3(r0, r1, 0x80000) sendmmsg$inet6(r1, &(0x7f0000000480)=[{{&(0x7f0000000240)={0xa, 0x0, 0x0, @dev, 0x87000000}, 0x1c, 0x0}}, {{&(0x7f0000000140)={0xa, 0x0, 0x0, @dev}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[], 0x30}}], 0x2, 0x0) 3.435700248s ago: executing program 0 (id=1974): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001200576d100000000000000007000000", @ANYRES32=0x0, @ANYBLOB="000002000255000008001d00ca"], 0x3c}}, 0x0) 950.423609ms ago: executing program 4 (id=1975): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_WOWLAN(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_NL_BEARER_GET(0xffffffffffffffff, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000090e3bb0d887877a5c55eff2e4431bcebcb7160bf8f0b595ecb"], 0x14}, 0x1, 0x0, 0x0, 0x20004000}, 0x4000) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0xff}) ioctl$KVM_RUN(r2, 0xae80, 0xfffffffffffffffe) 940.324724ms ago: executing program 3 (id=1976): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r0, 0xffffffffffffffff, 0x4, 0xd) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000840)=@raw={'raw\x00', 0x3c1, 0x3, 0x398, 0x1c0, 0x111, 0x4b4, 0x0, 0xd4feffff, 0x2c8, 0x20a, 0x278, 0x2c8, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x0, 0x198, 0x1c0, 0x0, {}, [@common=@inet=@tcp={{0x30}, {[], [], 0x0, 0x0, 0x2}}, @common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "6d93eb04697dfa39de04767f46614613a407abbf4ed2e83a63b484dbb3bf6b2a850e79009e2905d2f98ba19f91f3c9faee6d3686e9bee067f4e77d9ad66238750c4100d7ee97ec7646259d90edece6e9787a97bc956c01754c34c5c9518c46178ed5f9194454980e579c80eca35a58dc47d1d5e4ff6e216c724e88c702448587", 0x28}}]}, @common=@inet=@TCPMSS={0x28}}, {{@ipv6={@loopback, @private1, [], [], 'veth1_to_hsr\x00', 'pim6reg1\x00'}, 0x0, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@devgroup={{0x38}, {0x4, 0x6, 0x3, 0x1, 0x400}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0xf2eaaf407c114bfd, 0x0, 0x5}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f8) r4 = accept4(r2, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000140)="1fe1bc7f", 0x4) sendmmsg$unix(r4, &(0x7f0000003dc0)=[{{&(0x7f0000000000)=@file={0x0, './file0/file0\x00'}, 0x6e, 0x0}}, {{&(0x7f0000000280)=@abs={0x0, 0x0, 0x4e22}, 0x6e, 0x0}}], 0x2, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007c00), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000300)={0x0, 0x200002, 0x30}, 0xc) r5 = socket$inet(0x2, 0x2, 0x0) lseek(0xffffffffffffffff, 0x1000000, 0x0) poll(&(0x7f0000000080)=[{r1, 0x1248}, {r5, 0x2000}, {r1, 0x8}, {r3, 0x8}, {r0, 0x90}, {r0, 0x1ee8}, {r1}, {r1}, {0xffffffffffffffff, 0x80}], 0x9, 0x9) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) 843.788978ms ago: executing program 0 (id=1977): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x3c) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="ddfffffdff000000140012000c00010062726964"], 0x34}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000e80)=ANY=[@ANYBLOB="20000000140001000000000000000000020000ff", @ANYRES32=r3, @ANYBLOB="08000200ac1414aa"], 0x20}}, 0x0) r4 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r4, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x4) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20088814}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x7400, &(0x7f00000001c0)={&(0x7f0000000200)=@delchain={0x24, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x24}}, 0x0) 843.445905ms ago: executing program 6 (id=1978): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@ipv6_newroute={0x38, 0x18, 0x1, 0x70bd2c, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x2, 0xff}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x4}, @RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @LWTUNNEL_IP_FLAGS={0x6, 0x6, 0x8}}]}, 0x38}, 0x1, 0x0, 0xffffffffffff0000, 0x4901}, 0x0) 241.388175ms ago: executing program 34 (id=1967): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x0, 0x1000002, 0x8010, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80801) socket(0x40000000015, 0x805, 0x0) socket$xdp(0x2c, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x6bc3, &(0x7f0000000400)={0x0, 0x707b, 0x0, 0xc, 0x289}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0, 0x60}) io_uring_enter(r3, 0x3516, 0x0, 0x4, 0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0xfffffffffffffd2a, 0x1, 0x4, 0x0, @void, @value}, 0x28) ioctl$KVM_RUN(r8, 0xae80, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x40000000, 0x0, 0x0}, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0xb0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r9 = syz_io_uring_setup(0xa1, &(0x7f0000000640)={0x0, 0xe8ce, 0x0, 0x20, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000020c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x6007, @fd_index=0x4, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001800)=""/211, 0xd3}], 0x1, 0x0, 0x1}) io_uring_enter(r9, 0x47ba, 0x0, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000002800)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) 218.08713ms ago: executing program 3 (id=1980): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='scalable\x00', 0x9) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200801, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000380)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000240)=':', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) 170.345313ms ago: executing program 0 (id=1981): setns(0xffffffffffffffff, 0x2000000) r0 = socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x4a}, [@ldst={0x6, 0x3}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000080), 0xfffffffffffffffb, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x9, 0x0, 0xffffffff}, 0x10) write(r0, &(0x7f00000000c0)="240000001e005f0214fffffffffffff8070000001d00000000000000050009000d000000", 0x24) 0s ago: executing program 6 (id=1982): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010007001600000000000000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a30"], 0xec}, 0x1, 0x0, 0x0, 0x44080}, 0x0) kernel console output (not intermixed with test programs): [ T43] usb 5-1: Product: 珕蜬ퟖ꺗灹濱꓋ꅎ利쑻얲ઐ᭺了䳸弴䩈枉瀕问랲姿煵嵆뽏쐹쓹ࡣ牊‵൝❇Ꚛ듊削풦 [ 461.687868][ T43] usb 5-1: Manufacturer: 젏ꈜ♗棵ᛙᲵ⚝⒑∝ㄵ抜妘㽛ࠡ돉ꚪض鷧绳鶍䕫덡챠퓢涏Ⅾ벏㘳㡝ᇪᢵ띨땖꼱렝嵸曼失졝ⷉ᭳乪쾻坅另燻৪㡯뒹沂담纄稻犃췠聜ꊨ쵅ꌴ흜㟠㗎昷堄⌎ᩁ툹率鮣ḭ퉷멒풾嚯 [ 461.732816][ T5829] usb 6-1: USB disconnect, device number 68 [ 461.835146][ T43] usb 5-1: SerialNumber: ࠓ [ 461.900946][T11142] net_ratelimit: 249 callbacks suppressed [ 461.900967][T11142] openvswitch: netlink: Message has 8 unknown bytes. [ 461.931202][T11142] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 462.341736][ T5897] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 462.512527][ T5897] usb 7-1: Using ep0 maxpacket: 16 [ 462.533721][ T5897] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 462.551521][ T5897] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 462.571441][ T5897] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 462.621789][ T5897] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 22 [ 462.664516][ T5897] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 462.681533][ T5897] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 462.710520][ T5897] usb 7-1: SerialNumber: syz [ 462.735774][T11148] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 462.759465][ T5897] cdc_acm 7-1:1.0: skipping garbage [ 462.775425][ T5897] cdc_acm 7-1:1.0: Control and data interfaces are not separated! [ 462.801507][ T5897] cdc_acm 7-1:1.0: This needs exactly 3 endpoints [ 462.867668][ T5897] cdc_acm 7-1:1.0: probe with driver cdc_acm failed with error -22 [ 462.982417][ T5897] usb 7-1: USB disconnect, device number 6 [ 463.092653][ T5829] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 463.262516][ T5829] usb 4-1: Using ep0 maxpacket: 32 [ 463.281914][ T5829] usb 4-1: config 0 has an invalid interface number: 133 but max is 0 [ 463.358195][ T5829] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 463.370818][ T5829] usb 4-1: config 0 has no interface number 0 [ 463.399046][ T43] mxuport 5-1:127.31: mxuport_send_ctrl_data_urb - usb_control_msg failed (-71) [ 463.401104][ T5829] usb 4-1: config 0 interface 133 altsetting 0 bulk endpoint 0xB has invalid maxpacket 1024 [ 463.430859][ T43] mxuport 5-1:127.31: mxuport_send_ctrl_data_urb - usb_control_msg failed (-71) [ 463.435609][ T5829] usb 4-1: config 0 interface 133 altsetting 0 endpoint 0xF has invalid maxpacket 55438, setting to 1024 [ 463.495317][ T5829] usb 4-1: config 0 interface 133 altsetting 0 bulk endpoint 0xF has invalid maxpacket 1024 [ 463.517551][ T43] mxuport 5-1:127.31: probe with driver mxuport failed with error -71 [ 463.521430][ T5829] usb 4-1: config 0 interface 133 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 463.579317][ T5829] usb 4-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=71.1e [ 463.583601][ T43] usb 5-1: USB disconnect, device number 106 [ 463.604118][ T5829] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.640026][ T5829] usb 4-1: Product: syz [ 463.656537][ T5829] usb 4-1: Manufacturer: syz [ 463.661185][ T5829] usb 4-1: SerialNumber: syz [ 463.752171][ T5829] usb 4-1: config 0 descriptor?? [ 463.786970][T11167] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 463.826299][T11167] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 464.603577][ T5829] usb 4-1: probing VID:PID(0424:012C) [ 464.634411][ T5829] usb 4-1: vub300 testing BULK OUT EndPoint(0) 0B [ 464.661102][ T5829] usb 4-1: vub300 testing BULK OUT EndPoint(1) 0F [ 464.724714][ T5829] usb 4-1: Could not find two sets of bulk-in/out endpoint pairs [ 464.842945][ T5829] vub300 4-1:0.133: probe with driver vub300 failed with error -22 [ 464.928714][ T5829] usb 4-1: USB disconnect, device number 110 [ 464.982081][T11213] FAULT_INJECTION: forcing a failure. [ 464.982081][T11213] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 465.059966][T11213] CPU: 1 UID: 0 PID: 11213 Comm: syz.5.1620 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 465.059996][T11213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 465.060009][T11213] Call Trace: [ 465.060018][T11213] [ 465.060027][T11213] dump_stack_lvl+0x189/0x250 [ 465.060064][T11213] ? __pfx____ratelimit+0x10/0x10 [ 465.060091][T11213] ? __pfx_dump_stack_lvl+0x10/0x10 [ 465.060123][T11213] ? __pfx__printk+0x10/0x10 [ 465.060155][T11213] ? __might_fault+0xb0/0x130 [ 465.060196][T11213] should_fail_ex+0x414/0x560 [ 465.060229][T11213] _copy_from_user+0x2d/0xb0 [ 465.060253][T11213] ___sys_sendmsg+0x158/0x2a0 [ 465.060279][T11213] ? __pfx____sys_sendmsg+0x10/0x10 [ 465.060348][T11213] ? __might_fault+0xb0/0x130 [ 465.060381][T11213] __sys_sendmmsg+0x227/0x430 [ 465.060409][T11213] ? __pfx___sys_sendmmsg+0x10/0x10 [ 465.060429][T11213] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 465.060484][T11213] ? ksys_write+0x22a/0x250 [ 465.060516][T11213] ? __pfx_ksys_write+0x10/0x10 [ 465.060541][T11213] ? rcu_is_watching+0x15/0xb0 [ 465.060576][T11213] __x64_sys_sendmmsg+0xa0/0xc0 [ 465.060601][T11213] do_syscall_64+0xfa/0x3b0 [ 465.060626][T11213] ? lockdep_hardirqs_on+0x9c/0x150 [ 465.060651][T11213] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.060672][T11213] ? clear_bhb_loop+0x60/0xb0 [ 465.060698][T11213] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.060718][T11213] RIP: 0033:0x7fe55118e969 [ 465.060738][T11213] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 465.060756][T11213] RSP: 002b:00007fe551fb8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 465.060779][T11213] RAX: ffffffffffffffda RBX: 00007fe5513b5fa0 RCX: 00007fe55118e969 [ 465.060794][T11213] RDX: 0000000000000299 RSI: 0000200000003dc0 RDI: 0000000000000004 [ 465.060808][T11213] RBP: 00007fe551fb8090 R08: 0000000000000000 R09: 0000000000000000 [ 465.060822][T11213] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 465.060834][T11213] R13: 0000000000000000 R14: 00007fe5513b5fa0 R15: 00007fe5514dfa28 [ 465.060865][T11213] [ 465.552132][T11225] netlink: 252 bytes leftover after parsing attributes in process `syz.6.1622'. [ 465.778869][T11235] openvswitch: netlink: Message has 8 unknown bytes. [ 465.829683][T11235] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 465.882385][T11238] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1627'. [ 465.891475][ T43] usb 5-1: new full-speed USB device number 107 using dummy_hcd [ 465.966844][T11244] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1627'. [ 466.151760][T11251] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1630'. [ 466.324859][ T5897] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 466.525080][ T5897] usb 7-1: Using ep0 maxpacket: 16 [ 466.556850][ T5897] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 466.577561][ T5897] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 466.611508][ T5897] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 466.624631][ T5897] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 22 [ 466.654315][ T5897] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 466.670401][ T5897] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 466.679931][ T5897] usb 7-1: SerialNumber: syz [ 466.734559][T11236] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 466.749240][ T5897] cdc_acm 7-1:1.0: skipping garbage [ 466.768413][ T5897] cdc_acm 7-1:1.0: Control and data interfaces are not separated! [ 466.780353][ T5897] cdc_acm 7-1:1.0: This needs exactly 3 endpoints [ 466.800718][ T5897] cdc_acm 7-1:1.0: probe with driver cdc_acm failed with error -22 [ 466.960954][ T43] usb 7-1: USB disconnect, device number 7 [ 467.093223][T11283] netdevsim netdevsim5 netdevsim0: set [1, 2] type 2 family 0 port 20000 - 0 [ 467.192189][T11283] netdevsim netdevsim5 netdevsim1: set [1, 2] type 2 family 0 port 20000 - 0 [ 467.225736][T11283] netdevsim netdevsim5 netdevsim2: set [1, 2] type 2 family 0 port 20000 - 0 [ 467.264680][T11283] netdevsim netdevsim5 netdevsim3: set [1, 2] type 2 family 0 port 20000 - 0 [ 467.282857][T11283] geneve3: entered promiscuous mode [ 467.288155][T11283] geneve3: entered allmulticast mode [ 467.336715][T11283] netdevsim netdevsim5 netdevsim0: unset [1, 2] type 2 family 0 port 20000 - 0 [ 467.357052][T11283] netdevsim netdevsim5 netdevsim1: unset [1, 2] type 2 family 0 port 20000 - 0 [ 467.366673][T11283] netdevsim netdevsim5 netdevsim2: unset [1, 2] type 2 family 0 port 20000 - 0 [ 467.376287][T11283] netdevsim netdevsim5 netdevsim3: unset [1, 2] type 2 family 0 port 20000 - 0 [ 467.414890][ T10] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 467.574251][ T10] usb 4-1: config 0 has no interfaces? [ 467.594636][ T10] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 467.604316][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.613776][ T10] usb 4-1: Product: syz [ 467.624173][ T10] usb 4-1: Manufacturer: syz [ 467.635547][ T10] usb 4-1: SerialNumber: syz [ 467.689956][ T10] usb 4-1: config 0 descriptor?? [ 468.283271][ T5897] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 468.442370][ T5897] usb 7-1: Using ep0 maxpacket: 8 [ 468.450196][ T5897] usb 7-1: unable to get BOS descriptor or descriptor too short [ 468.460824][ T5897] usb 7-1: config 0 has an invalid interface number: 165 but max is 0 [ 468.483965][ T5897] usb 7-1: config 0 has no interface number 0 [ 468.512332][ T5897] usb 7-1: config 0 interface 165 has no altsetting 0 [ 468.547610][ T5897] usb 7-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=9b.2e [ 468.577811][ T5897] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.596375][ T5897] usb 7-1: Product: syz [ 468.614518][ T5897] usb 7-1: Manufacturer: syz [ 468.630196][T11327] FAULT_INJECTION: forcing a failure. [ 468.630196][T11327] name failslab, interval 1, probability 0, space 0, times 0 [ 468.647023][ T5897] usb 7-1: SerialNumber: syz [ 468.673872][ T5897] usb 7-1: config 0 descriptor?? [ 468.699902][T11327] CPU: 1 UID: 0 PID: 11327 Comm: syz.5.1649 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 468.699933][T11327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 468.699946][T11327] Call Trace: [ 468.699956][T11327] [ 468.699969][T11327] dump_stack_lvl+0x189/0x250 [ 468.700006][T11327] ? __pfx____ratelimit+0x10/0x10 [ 468.700033][T11327] ? __pfx_dump_stack_lvl+0x10/0x10 [ 468.700065][T11327] ? __pfx__printk+0x10/0x10 [ 468.700103][T11327] should_fail_ex+0x414/0x560 [ 468.700137][T11327] should_failslab+0xa8/0x100 [ 468.700170][T11327] __kmalloc_cache_noprof+0x70/0x3d0 [ 468.700200][T11327] ? sctp_add_bind_addr+0x8c/0x370 [ 468.700234][T11327] sctp_add_bind_addr+0x8c/0x370 [ 468.700268][T11327] sctp_copy_local_addr_list+0x30b/0x4e0 [ 468.700311][T11327] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 468.700339][T11327] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 468.700369][T11327] ? sctp_v6_is_any+0x64/0x80 [ 468.700399][T11327] ? sctp_copy_one_addr+0x93/0x360 [ 468.700431][T11327] sctp_bind_addr_copy+0xb3/0x3c0 [ 468.700460][T11327] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 468.700498][T11327] sctp_connect_new_asoc+0x2e0/0x690 [ 468.700523][T11327] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 468.700568][T11327] ? sctp_get_af_specific+0x29/0x80 [ 468.700601][T11327] ? sctp_inet6_send_verify+0x80/0x300 [ 468.700628][T11327] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 468.700652][T11327] __sctp_connect+0x5ba/0xd50 [ 468.700685][T11327] ? __pfx___sctp_connect+0x10/0x10 [ 468.700712][T11327] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 468.700738][T11327] ? security_sctp_bind_connect+0x7e/0x2e0 [ 468.700765][T11327] sctp_getsockopt_connectx3+0x2c4/0x440 [ 468.700797][T11327] ? __pfx_sctp_getsockopt_connectx3+0x10/0x10 [ 468.700826][T11327] ? __local_bh_enable_ip+0x12d/0x1c0 [ 468.700853][T11327] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 468.700888][T11327] sctp_getsockopt+0x98a/0xb60 [ 468.700911][T11327] do_sock_getsockopt+0x35d/0x650 [ 468.700934][T11327] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 468.700953][T11327] ? __pfx_do_syscall_64+0x10/0x10 [ 468.700979][T11327] ? __fget_files+0x3a0/0x420 [ 468.700997][T11327] ? __fget_files+0x2a/0x420 [ 468.701024][T11327] __x64_sys_getsockopt+0x1a5/0x250 [ 468.701044][T11327] ? __pfx_do_syscall_64+0x10/0x10 [ 468.701071][T11327] ? __pfx_do_syscall_64+0x10/0x10 [ 468.701102][T11327] do_syscall_64+0xfa/0x3b0 [ 468.701130][T11327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 468.701149][T11327] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 468.701168][T11327] ? clear_bhb_loop+0x60/0xb0 [ 468.701194][T11327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 468.701213][T11327] RIP: 0033:0x7fe55118e969 [ 468.701232][T11327] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 468.701250][T11327] RSP: 002b:00007fe551fb8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 468.701271][T11327] RAX: ffffffffffffffda RBX: 00007fe5513b5fa0 RCX: 00007fe55118e969 [ 468.701286][T11327] RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000003 [ 468.701299][T11327] RBP: 00007fe551fb8090 R08: 0000200000000180 R09: 0000000000000000 [ 468.701313][T11327] R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000002 [ 468.701325][T11327] R13: 0000000000000000 R14: 00007fe5513b5fa0 R15: 00007fe5514dfa28 [ 468.701355][T11327] [ 470.164867][T11334] vivid-007: ================= START STATUS ================= [ 470.172861][T11334] vivid-007: Enable Output Cropping: true [ 470.179171][T11334] vivid-007: Enable Output Composing: true [ 470.185798][T11334] vivid-007: Enable Output Scaler: true [ 470.192048][T11334] vivid-007: Tx RGB Quantization Range: Automatic [ 470.198629][T11334] vivid-007: Transmit Mode: HDMI [ 470.203786][T11334] vivid-007: Hotplug Present: 0x00000000 [ 470.209586][T11334] vivid-007: RxSense Present: 0x00000000 [ 470.215426][T11334] vivid-007: EDID Present: 0x00000000 [ 470.220949][T11334] vivid-007: ================== END STATUS ================== [ 470.313421][ T5897] comedi comedi0: Wrong number of endpoints [ 470.329772][ T5897] ni6501 7-1:0.165: driver 'ni6501' failed to auto-configure device. [ 470.401214][ T5897] usb 7-1: USB disconnect, device number 8 [ 470.724646][ T10] usb 4-1: USB disconnect, device number 111 [ 470.888457][T11349] netlink: 60 bytes leftover after parsing attributes in process `syz.6.1655'. [ 470.901291][T11349] unsupported nlmsg_type 40 [ 470.929370][T11352] FAULT_INJECTION: forcing a failure. [ 470.929370][T11352] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 470.984329][T11352] CPU: 1 UID: 0 PID: 11352 Comm: syz.3.1654 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 470.984362][T11352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 470.984376][T11352] Call Trace: [ 470.984385][T11352] [ 470.984395][T11352] dump_stack_lvl+0x189/0x250 [ 470.984435][T11352] ? __pfx____ratelimit+0x10/0x10 [ 470.984461][T11352] ? __pfx_dump_stack_lvl+0x10/0x10 [ 470.984491][T11352] ? __pfx__printk+0x10/0x10 [ 470.984537][T11352] should_fail_ex+0x414/0x560 [ 470.984569][T11352] _copy_from_user+0x2d/0xb0 [ 470.984593][T11352] sctp_setsockopt+0x19f/0x1200 [ 470.984614][T11352] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 470.984646][T11352] do_sock_setsockopt+0x25a/0x3e0 [ 470.984669][T11352] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 470.984695][T11352] ? __fget_files+0x2a/0x420 [ 470.984724][T11352] __x64_sys_setsockopt+0x18b/0x220 [ 470.984750][T11352] do_syscall_64+0xfa/0x3b0 [ 470.984774][T11352] ? lockdep_hardirqs_on+0x9c/0x150 [ 470.984799][T11352] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.984829][T11352] ? clear_bhb_loop+0x60/0xb0 [ 470.984853][T11352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.984873][T11352] RIP: 0033:0x7fb09658e969 [ 470.984890][T11352] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 470.984908][T11352] RSP: 002b:00007fb097479038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 470.984930][T11352] RAX: ffffffffffffffda RBX: 00007fb0967b5fa0 RCX: 00007fb09658e969 [ 470.984944][T11352] RDX: 0000000000000017 RSI: 0000000000000084 RDI: 0000000000000003 [ 470.984956][T11352] RBP: 00007fb097479090 R08: 0000000000000009 R09: 0000000000000000 [ 470.984968][T11352] R10: 0000200000000400 R11: 0000000000000246 R12: 0000000000000001 [ 470.984980][T11352] R13: 0000000000000000 R14: 00007fb0967b5fa0 R15: 00007fb0968dfa28 [ 470.985011][T11352] [ 471.184857][ T5897] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 471.215450][T11356] vti0: entered promiscuous mode [ 471.220492][T11356] vti0: entered allmulticast mode [ 471.393061][ T5897] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 471.420705][ T5897] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 471.450115][ T5897] usb 5-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 471.464156][ T5897] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.861706][ T10] usb 7-1: new full-speed USB device number 9 using dummy_hcd [ 471.894710][ C0] raw-gadget.1 gadget.6: ignoring, device is not running [ 471.942049][ T5897] usb 5-1: config 0 descriptor?? [ 472.052552][ T10] usb 7-1: device descriptor read/64, error -32 [ 472.238934][ T5897] Bluetooth: Can't get state to change to load ram patch err [ 472.247542][ T5897] Bluetooth: Loading patch file failed [ 472.262770][ T5897] ath3k 5-1:0.0: probe with driver ath3k failed with error -71 [ 472.291517][ T10] usb 7-1: new full-speed USB device number 10 using dummy_hcd [ 472.312510][ T5891] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 472.315136][ T5897] usb 5-1: USB disconnect, device number 108 [ 472.471549][ T5891] usb 6-1: Using ep0 maxpacket: 16 [ 472.478864][ T5891] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 472.500581][ T5891] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 472.527929][ T10] usb 7-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 472.568391][ T10] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 472.582265][ T5891] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.658053][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10 [ 472.670101][ T5891] usb 6-1: config 0 descriptor?? [ 472.783953][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 472.838804][ T10] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 472.905250][ T10] usb 7-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 472.914846][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.931364][ T10] usb 7-1: Product: syz [ 472.939795][ T10] usb 7-1: Manufacturer: syz [ 472.955975][ T10] usb 7-1: SerialNumber: syz [ 472.981875][ T10] usb 7-1: config 0 descriptor?? [ 473.024062][ T10] input: KB Gear Tablet as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input31 [ 473.147998][ T5891] mcp2221 0003:04D8:00DD.000C: unknown main item tag 0x3 [ 473.226164][ T5891] mcp2221 0003:04D8:00DD.000C: unknown main item tag 0x0 [ 473.259466][ T5891] mcp2221 0003:04D8:00DD.000C: unknown main item tag 0x0 [ 473.337418][ T5891] mcp2221 0003:04D8:00DD.000C: unknown main item tag 0x0 [ 473.377978][ T5891] mcp2221 0003:04D8:00DD.000C: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 474.451548][ T5897] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 474.543817][ T5891] usb 5-1: new full-speed USB device number 109 using dummy_hcd [ 474.627973][ T5897] usb 4-1: config 0 has no interfaces? [ 474.639163][ T5897] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 474.648911][ T5897] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 474.657661][ T5897] usb 4-1: Product: syz [ 474.679408][ T5897] usb 4-1: Manufacturer: syz [ 474.729174][ T5891] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 474.751056][ T43] usb 6-1: USB disconnect, device number 69 [ 474.813792][ T5891] usb 5-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 474.840177][ T5897] usb 4-1: SerialNumber: syz [ 474.872021][ T5891] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.873637][ T5897] usb 4-1: config 0 descriptor?? [ 474.967235][ T5891] usb 5-1: config 0 descriptor?? [ 475.039628][T11417] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 475.469087][ T5897] usb 7-1: USB disconnect, device number 10 [ 475.504613][ T5891] elan 0003:04F3:0755.000D: item fetching failed at offset 3/5 [ 475.538521][ T5891] elan 0003:04F3:0755.000D: Hid Parse failed [ 475.578783][ T5891] elan 0003:04F3:0755.000D: probe with driver elan failed with error -22 [ 475.642275][T11439] netlink: 80 bytes leftover after parsing attributes in process `syz.5.1674'. [ 475.714477][ T5891] usb 5-1: USB disconnect, device number 109 [ 475.799645][T11443] openvswitch: netlink: Message has 8 unknown bytes. [ 475.825743][T11443] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 475.881545][ T5897] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 475.933382][T11443] kvm: apic: phys broadcast and lowest prio [ 476.051484][ T5897] usb 7-1: Using ep0 maxpacket: 32 [ 476.076156][ T5897] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 476.100995][ T5897] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.114896][ T5897] usb 7-1: Product: 買蕴堰㫵꥝њ꾕븙囯 [ 476.129628][ T5897] usb 7-1: Manufacturer: Т [ 476.134556][ T5897] usb 7-1: SerialNumber: љ [ 476.242920][ T10] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 476.326117][T11453] openvswitch: netlink: Message has 8 unknown bytes. [ 476.334022][T11453] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 476.421668][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 476.437790][ T10] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 476.463014][ T10] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 476.493569][ T10] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 476.517727][ T10] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 22 [ 476.616912][ T10] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 476.649844][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 476.684920][ T10] usb 6-1: SerialNumber: syz [ 476.699002][T11443] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 476.718749][ T5897] usb 7-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 476.727021][ T10] cdc_acm 6-1:1.0: skipping garbage [ 476.737159][ T10] cdc_acm 6-1:1.0: Control and data interfaces are not separated! [ 476.746232][ T10] cdc_acm 6-1:1.0: This needs exactly 3 endpoints [ 476.756060][ T10] cdc_acm 6-1:1.0: probe with driver cdc_acm failed with error -22 [ 476.804265][ T5897] usb 7-1: USB disconnect, device number 11 [ 476.842178][ T43] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 476.878297][T10400] udevd[10400]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 476.930124][ T5890] usb 6-1: USB disconnect, device number 70 [ 477.041630][ T43] usb 5-1: Using ep0 maxpacket: 16 [ 477.052654][ T43] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 477.065023][ T43] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 477.076589][ T43] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 477.090651][ T43] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 22 [ 477.169527][ T43] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 477.178813][ T5891] usb 4-1: USB disconnect, device number 112 [ 477.215899][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 477.229543][ T43] usb 5-1: SerialNumber: syz [ 477.250848][T11457] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 477.279542][ T43] cdc_acm 5-1:1.0: skipping garbage [ 477.287027][ T43] cdc_acm 5-1:1.0: Control and data interfaces are not separated! [ 477.314075][ T43] cdc_acm 5-1:1.0: This needs exactly 3 endpoints [ 477.333743][ T43] cdc_acm 5-1:1.0: probe with driver cdc_acm failed with error -22 [ 477.541577][ T43] usb 5-1: USB disconnect, device number 110 [ 477.651515][ T5891] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 477.788964][T11491] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 477.795559][T11491] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 477.823247][T11491] vhci_hcd vhci_hcd.0: Device attached [ 477.831707][ T5891] usb 4-1: Using ep0 maxpacket: 16 [ 477.846092][T11491] vhci_hcd vhci_hcd.0: pdev(0) rhport(1) sockfd(5) [ 477.852651][T11491] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 477.859941][ T5891] usb 4-1: config 7 has an invalid interface number: 117 but max is 2 [ 477.867167][T11491] vhci_hcd vhci_hcd.0: Device attached [ 477.892794][ T5891] usb 4-1: config 7 has an invalid descriptor of length 170, skipping remainder of the config [ 477.921417][ T5891] usb 4-1: config 7 has 2 interfaces, different from the descriptor's value: 3 [ 477.951460][ T5891] usb 4-1: config 7 has no interface number 0 [ 477.958058][ T5891] usb 4-1: config 7 has no interface number 1 [ 477.976257][ T5891] usb 4-1: config 7 interface 117 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 477.991698][ T43] usb 6-1: new full-speed USB device number 71 using dummy_hcd [ 478.031532][ T5891] usb 4-1: config 7 interface 2 altsetting 129 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 478.061655][ T5897] usb 33-1: new low-speed USB device number 3 using vhci_hcd [ 478.094203][ T5891] usb 4-1: config 7 interface 117 has no altsetting 0 [ 478.113539][ T5891] usb 4-1: config 7 interface 2 has no altsetting 0 [ 478.121228][T11504] x_tables: ip_tables: IDLETIMER.0 target: invalid size 40 (kernel) != (user) 29 [ 478.161478][ T43] usb 6-1: device descriptor read/64, error -71 [ 478.411452][ T43] usb 6-1: new full-speed USB device number 72 using dummy_hcd [ 478.560086][T11492] vhci_hcd: connection reset by peer [ 478.560249][T11497] vhci_hcd: connection closed [ 478.566073][ T43] usb 6-1: device descriptor read/64, error -71 [ 478.584033][ T13] vhci_hcd: stop threads [ 478.597929][ T13] vhci_hcd: release socket [ 478.612148][ T13] vhci_hcd: disconnect device [ 478.623275][ T13] vhci_hcd: stop threads [ 478.638423][ T13] vhci_hcd: release socket [ 478.655508][ T13] vhci_hcd: disconnect device [ 478.727313][ T43] usb usb6-port1: attempt power cycle [ 478.984081][T11526] openvswitch: netlink: Message has 8 unknown bytes. [ 479.018730][T11526] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 479.101802][ T43] usb 6-1: new full-speed USB device number 73 using dummy_hcd [ 479.138831][T11529] FAULT_INJECTION: forcing a failure. [ 479.138831][T11529] name failslab, interval 1, probability 0, space 0, times 0 [ 479.152293][ T5829] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 479.162207][ T43] usb 6-1: device descriptor read/8, error -71 [ 479.168569][T11526] kvm: apic: phys broadcast and lowest prio [ 479.185978][T11529] CPU: 1 UID: 0 PID: 11529 Comm: syz.0.1692 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 479.186007][T11529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 479.186020][T11529] Call Trace: [ 479.186029][T11529] [ 479.186038][T11529] dump_stack_lvl+0x189/0x250 [ 479.186075][T11529] ? __pfx____ratelimit+0x10/0x10 [ 479.186101][T11529] ? __pfx_dump_stack_lvl+0x10/0x10 [ 479.186133][T11529] ? __pfx__printk+0x10/0x10 [ 479.186164][T11529] ? ref_tracker_alloc+0x318/0x460 [ 479.186195][T11529] should_fail_ex+0x414/0x560 [ 479.186226][T11529] should_failslab+0xa8/0x100 [ 479.186260][T11529] kmem_cache_alloc_noprof+0x73/0x3c0 [ 479.186288][T11529] ? skb_clone+0x212/0x3a0 [ 479.186324][T11529] skb_clone+0x212/0x3a0 [ 479.186350][T11529] __netlink_deliver_tap+0x404/0x850 [ 479.186396][T11529] ? netlink_deliver_tap+0x2e/0x1b0 [ 479.186430][T11529] netlink_deliver_tap+0x19c/0x1b0 [ 479.186463][T11529] netlink_unicast+0x72f/0x8d0 [ 479.186503][T11529] netlink_sendmsg+0x805/0xb30 [ 479.186533][T11529] ? __pfx_netlink_sendmsg+0x10/0x10 [ 479.186557][T11529] ? aa_sock_msg_perm+0x94/0x160 [ 479.186586][T11529] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 479.186608][T11529] ? __pfx_netlink_sendmsg+0x10/0x10 [ 479.186629][T11529] __sock_sendmsg+0x219/0x270 [ 479.186658][T11529] sock_sendmsg+0x158/0x230 [ 479.186686][T11529] ? __pfx_sock_sendmsg+0x10/0x10 [ 479.186726][T11529] ? __asan_memset+0x22/0x50 [ 479.186750][T11529] ? iov_iter_bvec+0xb8/0x180 [ 479.186774][T11529] splice_to_socket+0x8ff/0xf10 [ 479.186826][T11529] ? __pfx_splice_to_socket+0x10/0x10 [ 479.186900][T11529] ? register_lock_class+0x51/0x320 [ 479.186932][T11529] ? __pfx_splice_to_socket+0x10/0x10 [ 479.186963][T11529] direct_splice_actor+0x101/0x160 [ 479.186997][T11529] splice_direct_to_actor+0x5a5/0xcc0 [ 479.187048][T11529] ? __pfx_direct_splice_actor+0x10/0x10 [ 479.187078][T11529] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 479.187109][T11529] ? __pfx_aa_file_perm+0x10/0x10 [ 479.187145][T11529] do_splice_direct+0x181/0x270 [ 479.187178][T11529] ? __pfx_do_splice_direct+0x10/0x10 [ 479.187209][T11529] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 479.187231][T11529] ? bpf_lsm_file_permission+0x9/0x20 [ 479.187255][T11529] ? security_file_permission+0x75/0x290 [ 479.187280][T11529] ? rw_verify_area+0x258/0x650 [ 479.187320][T11529] do_sendfile+0x4da/0x7e0 [ 479.187342][T11529] ? __pfx_vfs_write+0x10/0x10 [ 479.187376][T11529] ? __pfx_do_sendfile+0x10/0x10 [ 479.187398][T11529] ? __fget_files+0x3a0/0x420 [ 479.187446][T11529] __se_sys_sendfile64+0x13e/0x190 [ 479.187472][T11529] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 479.187491][T11529] ? rcu_is_watching+0x15/0xb0 [ 479.187524][T11529] ? do_syscall_64+0xbe/0x3b0 [ 479.187555][T11529] do_syscall_64+0xfa/0x3b0 [ 479.187581][T11529] ? lockdep_hardirqs_on+0x9c/0x150 [ 479.187606][T11529] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.187627][T11529] ? clear_bhb_loop+0x60/0xb0 [ 479.187652][T11529] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.187672][T11529] RIP: 0033:0x7f7c1ed8e969 [ 479.187691][T11529] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 479.187709][T11529] RSP: 002b:00007f7c1fb74038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 479.187731][T11529] RAX: ffffffffffffffda RBX: 00007f7c1efb5fa0 RCX: 00007f7c1ed8e969 [ 479.187747][T11529] RDX: 0000000000000000 RSI: 0000000000000010 RDI: 0000000000000011 [ 479.187760][T11529] RBP: 00007f7c1fb74090 R08: 0000000000000000 R09: 0000000000000000 [ 479.187774][T11529] R10: 0000000100000002 R11: 0000000000000246 R12: 0000000000000002 [ 479.187787][T11529] R13: 0000000000000000 R14: 00007f7c1efb5fa0 R15: 00007f7c1f0dfa28 [ 479.187832][T11529] [ 479.441744][ T5829] usb 7-1: Using ep0 maxpacket: 8 [ 479.569765][ T5829] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 479.577805][ T5829] usb 7-1: can't read configurations, error -61 [ 479.681488][ T43] usb 6-1: new full-speed USB device number 74 using dummy_hcd [ 479.702169][ T43] usb 6-1: device descriptor read/8, error -71 [ 479.715570][ T5829] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 479.811809][ T43] usb usb6-port1: unable to enumerate USB device [ 479.881535][ T5886] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 479.893737][ T5829] usb 7-1: Using ep0 maxpacket: 8 [ 479.912395][ T5829] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 479.920359][ T5829] usb 7-1: can't read configurations, error -61 [ 479.931180][ T5829] usb usb7-port1: attempt power cycle [ 480.061478][ T5886] usb 5-1: Using ep0 maxpacket: 16 [ 480.069038][ T5886] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 480.094181][ T5886] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 480.107081][ T5886] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 480.122840][ T5886] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 22 [ 480.146110][ T5886] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 480.157771][ T5886] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 480.166327][ T5886] usb 5-1: SerialNumber: syz [ 480.176127][T11526] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 480.187689][ T5886] cdc_acm 5-1:1.0: skipping garbage [ 480.193048][ T5886] cdc_acm 5-1:1.0: Control and data interfaces are not separated! [ 480.201213][ T5886] cdc_acm 5-1:1.0: This needs exactly 3 endpoints [ 480.208441][ T5886] cdc_acm 5-1:1.0: probe with driver cdc_acm failed with error -22 [ 480.302607][ T5829] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 480.344889][ T5829] usb 7-1: Using ep0 maxpacket: 8 [ 480.356458][ T5829] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 480.375573][ T5829] usb 7-1: can't read configurations, error -61 [ 480.400758][ T5886] usb 5-1: USB disconnect, device number 111 [ 480.477255][ T5891] usb 4-1: string descriptor 0 read error: -71 [ 480.477398][ T5891] usb 4-1: New USB device found, idVendor=0856, idProduct=ac42, bcdDevice=cf.a9 [ 480.477417][ T5891] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 480.481170][ T5891] usb 4-1: can't set config #7, error -71 [ 480.493330][ T5891] usb 4-1: USB disconnect, device number 113 [ 480.524326][ T5829] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 480.581772][ T5829] usb 7-1: Using ep0 maxpacket: 8 [ 480.585395][ T5829] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 480.585434][ T5829] usb 7-1: can't read configurations, error -61 [ 480.587127][ T5829] usb usb7-port1: unable to enumerate USB device [ 481.430905][T11579] openvswitch: netlink: VXLAN extension message has 8 unknown bytes. [ 481.611464][ T5829] usb 5-1: new low-speed USB device number 112 using dummy_hcd [ 481.651292][T11582] fuse: Bad value for 'fd' [ 481.660280][T11582] netlink: 488 bytes leftover after parsing attributes in process `syz.0.1703'. [ 481.821548][ T43] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 481.835065][ T5829] usb 5-1: string descriptor 0 read error: -22 [ 481.849632][ T5829] usb 5-1: New USB device found, idVendor=04b4, idProduct=8613, bcdDevice=95.8f [ 481.869422][ T5829] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.953737][ T5829] usb 5-1: config 0 descriptor?? [ 481.991407][ T5829] usbtest 5-1:0.0: FX2 device [ 482.016662][ T5829] usbtest 5-1:0.0: low-speed {control intr-in intr-out} tests (+alt) [ 482.157347][ T5891] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 482.349091][ T5890] usb 5-1: USB disconnect, device number 112 [ 482.583063][ T5891] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 482.593416][ T5891] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 482.611395][ T5891] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 482.651466][ T5891] usb 6-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 482.711441][ T5891] usb 6-1: config 1 interface 1 has no altsetting 0 [ 482.748433][ T5891] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 482.769654][ T5891] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.851486][ T5891] usb 6-1: Product: syz [ 482.855892][ T5891] usb 6-1: Manufacturer: syz [ 482.860517][ T5891] usb 6-1: SerialNumber: syz [ 483.182186][T11589] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 483.193464][T11589] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 483.247267][ T5897] vhci_hcd: vhci_device speed not set [ 483.261525][ T1774] usb 4-1: new full-speed USB device number 114 using dummy_hcd [ 483.411741][ T1774] usb 4-1: device descriptor read/64, error -71 [ 483.467169][T11609] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1710'. [ 483.519343][T11609] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1710'. [ 483.586035][T11609] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1710'. [ 483.691738][ T1774] usb 4-1: new full-speed USB device number 115 using dummy_hcd [ 483.811026][T11616] openvswitch: netlink: Message has 8 unknown bytes. [ 483.820130][T11616] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 483.855257][ T1774] usb 4-1: device descriptor read/64, error -71 [ 483.939737][T11616] kvm: apic: phys broadcast and lowest prio [ 483.983601][ T1774] usb usb4-port1: attempt power cycle [ 484.351804][ T5886] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 484.401909][ T1774] usb 4-1: new full-speed USB device number 116 using dummy_hcd [ 484.432098][ T1774] usb 4-1: device descriptor read/8, error -71 [ 484.501580][ T5886] usb 7-1: Using ep0 maxpacket: 16 [ 484.513414][ T5886] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 484.532894][ T5886] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 484.543504][ T5886] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 484.554931][ T5886] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 22 [ 484.570392][ T5886] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 484.580553][ T5886] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 484.589046][ T5886] usb 7-1: SerialNumber: syz [ 484.611754][T11618] raw-gadget.4 gadget.6: fail, usb_ep_enable returned -22 [ 484.637166][ T5886] cdc_acm 7-1:1.0: skipping garbage [ 484.649131][ T5886] cdc_acm 7-1:1.0: Control and data interfaces are not separated! [ 484.657904][ T5886] cdc_acm 7-1:1.0: This needs exactly 3 endpoints [ 484.669177][ T5886] cdc_acm 7-1:1.0: probe with driver cdc_acm failed with error -22 [ 484.682425][ T1774] usb 4-1: new full-speed USB device number 117 using dummy_hcd [ 484.714809][ T1774] usb 4-1: device descriptor read/8, error -71 [ 484.832281][ T1774] usb usb4-port1: unable to enumerate USB device [ 484.840013][ T5886] usb 7-1: USB disconnect, device number 17 [ 485.337966][ T5891] usb 6-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 485.362259][ T5891] usb 6-1: MIDIStreaming interface descriptor not found [ 485.411810][ T5886] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 485.441302][ T5891] usb 6-1: USB disconnect, device number 75 [ 485.518806][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 485.583660][ T5886] usb 5-1: Using ep0 maxpacket: 32 [ 485.601527][ T5886] usb 5-1: config 1 interface 0 has no altsetting 0 [ 485.614028][ T5886] usb 5-1: New USB device found, idVendor=05ac, idProduct=0254, bcdDevice= 0.40 [ 485.642055][ T5886] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.675061][ T5886] usb 5-1: Product: syz [ 485.682946][ T5886] usb 5-1: Manufacturer: syz [ 485.687594][ T5886] usb 5-1: SerialNumber: syz [ 485.991191][ T5886] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input32 [ 486.004013][T11661] bridge0: entered promiscuous mode [ 486.009415][ T1774] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 486.030557][T11661] macsec1: entered promiscuous mode [ 486.034246][ T5185] bcm5974 5-1:1.0: could not read from device [ 486.041378][T11661] macsec1: entered allmulticast mode [ 486.051786][ T5185] bcm5974 5-1:1.0: could not read from device [ 486.069232][T11663] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1717'. [ 486.070508][ T5185] bcm5974 5-1:1.0: could not read from device [ 486.085666][T11661] bridge0: entered allmulticast mode [ 486.092258][ T5886] usb 5-1: USB disconnect, device number 113 [ 486.100295][T11661] bridge0: port 3(macsec1) entered blocking state [ 486.107916][T11661] bridge0: port 3(macsec1) entered disabled state [ 486.157232][T11661] bridge0: left allmulticast mode [ 486.167197][T11661] bridge0: left promiscuous mode [ 486.186588][ T1774] usb 6-1: Using ep0 maxpacket: 16 [ 486.199289][ T1774] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 486.216419][ T1774] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 486.226711][ T1774] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 486.250997][T11663] bridge7: entered promiscuous mode [ 486.264791][ T1774] usb 6-1: New USB device found, idVendor=044e, idProduct=120c, bcdDevice= 0.00 [ 486.276675][ T1774] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.322959][ T1774] usb 6-1: config 0 descriptor?? [ 486.469897][T11671] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1719'. [ 486.482504][T11671] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 486.655146][T11678] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 486.780361][T11680] netdevsim netdevsim4: Firmware load for './cgroup/../file0' refused, path contains '..' component [ 486.969290][T11691] openvswitch: netlink: Message has 8 unknown bytes. [ 486.984937][T11691] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 487.001565][ T1774] usbhid 6-1:0.0: can't add hid device: -71 [ 487.017848][ T1774] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 487.079860][ T1774] usb 6-1: USB disconnect, device number 76 [ 487.421493][ T5888] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 487.591477][ T5888] usb 7-1: Using ep0 maxpacket: 16 [ 487.601832][ T5890] usb 5-1: new full-speed USB device number 114 using dummy_hcd [ 487.603177][ T5888] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 487.623014][ T5888] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 487.640722][ T5888] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 487.650979][ T5888] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 22 [ 487.690248][ T5888] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 487.703256][ T5888] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 487.713034][ T5888] usb 7-1: SerialNumber: syz [ 487.740654][T11691] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 487.767320][ T5890] usb 5-1: not running at top speed; connect to a high speed hub [ 487.777162][ T5890] usb 5-1: config 1 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 487.810050][ T5890] usb 5-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 487.811933][ T5888] cdc_acm 7-1:1.0: skipping garbage [ 487.828809][ T5890] usb 5-1: config 1 interface 0 has no altsetting 0 [ 487.847131][ T5890] usb 5-1: New USB device found, idVendor=0c16, idProduct=0008, bcdDevice= 0.40 [ 487.861500][ T5890] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.951816][ T5890] usb 5-1: Product: 轥쀧匴㴻⧾寵ᦉꐇ뭨＇ѕீ珎앛´鋚躒끢풺蚵굛☀૊ꨄင雼뗉훖뇦ꍎׇ㦌툥ꁳ鞁⮍㴊旄佂盌伻휒啭姜ᖦ扉悓ᛠ︝咂깑噻ꪐ䨕ꠌ鼭ᶈꊡᒘ鈃 [ 487.973257][ T5890] usb 5-1: Manufacturer: п [ 488.466936][T11706] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 488.474374][T11706] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 488.524045][ T5888] cdc_acm 7-1:1.0: Control and data interfaces are not separated! [ 488.564141][ T5888] cdc_acm 7-1:1.0: This needs exactly 3 endpoints [ 488.571230][ T5888] cdc_acm 7-1:1.0: probe with driver cdc_acm failed with error -22 [ 488.604736][ T5888] usb 7-1: USB disconnect, device number 18 [ 488.703484][ T5890] usbhid 5-1:1.0: can't add hid device: -71 [ 488.709700][ T5890] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 488.730941][ T5890] usb 5-1: USB disconnect, device number 114 [ 489.291446][ T5888] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 489.378078][T11740] netlink: zone id is out of range [ 489.383897][T11740] netlink: set zone limit has 8 unknown bytes [ 489.448892][T11743] netlink: 43 bytes leftover after parsing attributes in process `syz.4.1741'. [ 489.491484][ T5888] usb 4-1: Using ep0 maxpacket: 8 [ 489.502646][ T5888] usb 4-1: unable to get BOS descriptor or descriptor too short [ 489.513702][ T5888] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 489.526302][ T5888] usb 4-1: can't read configurations, error -71 [ 490.481628][T11758] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1745'. [ 490.971480][ T5890] usb 5-1: new full-speed USB device number 115 using dummy_hcd [ 491.133028][ T5890] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 491.171512][ T5890] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 491.204908][ T5890] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 491.224930][ T5890] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 491.241416][ T5890] usb 5-1: Product: syz [ 491.247736][ T5890] usb 5-1: Manufacturer: syz [ 491.257856][ T5890] usb 5-1: SerialNumber: syz [ 491.277709][T11779] openvswitch: netlink: Message has 8 unknown bytes. [ 491.285473][T11779] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 491.429546][T11781] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 491.509636][ T5890] usb 5-1: 0:2 : does not exist [ 491.515137][ T5890] usb 5-1: unit 9 not found! [ 491.542805][ T5890] usb 5-1: 4:0: cannot get min/max values for control 1 (id 4) [ 491.586346][ T5890] usb 5-1: USB disconnect, device number 115 [ 491.620512][T10400] udevd[10400]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 491.703018][ T5891] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 491.739621][T11787] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 491.871721][ T5891] usb 6-1: Using ep0 maxpacket: 16 [ 491.878630][ T5891] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 491.888499][ T5891] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 491.898939][ T5891] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 491.908838][ T5891] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 22 [ 491.923319][ T5891] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 491.932662][ T5891] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 491.940677][ T5891] usb 6-1: SerialNumber: syz [ 491.948505][T11782] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 491.960984][ T5891] cdc_acm 6-1:1.0: skipping garbage [ 491.966273][ T5891] cdc_acm 6-1:1.0: Control and data interfaces are not separated! [ 491.975545][ T5891] cdc_acm 6-1:1.0: This needs exactly 3 endpoints [ 491.982338][ T5888] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 491.990410][ T5891] cdc_acm 6-1:1.0: probe with driver cdc_acm failed with error -22 [ 492.001610][ T43] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 492.142447][ T5888] usb 7-1: Using ep0 maxpacket: 32 [ 492.150177][ T5888] usb 7-1: config 0 has no interfaces? [ 492.158681][ T5888] usb 7-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=8e.fa [ 492.166360][ T5890] usb 6-1: USB disconnect, device number 77 [ 492.169956][ T5888] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.173835][ T43] usb 4-1: Using ep0 maxpacket: 16 [ 492.186553][ T5888] usb 7-1: Product: syz [ 492.191211][ T5888] usb 7-1: Manufacturer: syz [ 492.207809][ T43] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 492.216806][ T5888] usb 7-1: SerialNumber: syz [ 492.228927][ T43] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 492.234269][ T5888] usb 7-1: config 0 descriptor?? [ 492.248128][ T43] usb 4-1: New USB device found, idVendor=1189, idProduct=0893, bcdDevice=f4.95 [ 492.280793][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.292310][ T43] usb 4-1: Product: syz [ 492.296485][ T43] usb 4-1: Manufacturer: syz [ 492.303598][ T43] usb 4-1: SerialNumber: syz [ 492.310467][ T43] usb 4-1: config 0 descriptor?? [ 492.312526][ T5891] usb 5-1: new full-speed USB device number 116 using dummy_hcd [ 492.323881][T11787] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 492.331205][T11787] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 492.462761][ T5891] usb 5-1: device descriptor read/64, error -71 [ 492.471545][T11788] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1753'. [ 492.480790][T11788] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1753'. [ 492.498210][T11788] dummy0: entered promiscuous mode [ 492.508525][T11788] bond0: entered promiscuous mode [ 492.514392][T11788] bond_slave_0: entered promiscuous mode [ 492.520507][T11788] bond_slave_1: entered promiscuous mode [ 492.555546][ T43] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 492.557750][ T5829] usb 7-1: USB disconnect, device number 19 [ 492.570578][ T43] asix 4-1:0.0: probe with driver asix failed with error -71 [ 492.589286][ T43] usb 4-1: USB disconnect, device number 120 [ 492.722934][ T5891] usb 5-1: new full-speed USB device number 117 using dummy_hcd [ 492.861547][ T5891] usb 5-1: device descriptor read/64, error -71 [ 492.904196][T11797] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1756'. [ 492.982911][ T5891] usb usb5-port1: attempt power cycle [ 493.336443][ T5891] usb 5-1: new full-speed USB device number 118 using dummy_hcd [ 493.373354][ T5891] usb 5-1: device descriptor read/8, error -71 [ 493.451749][ T43] usb 4-1: new full-speed USB device number 121 using dummy_hcd [ 493.611707][ T5891] usb 5-1: new full-speed USB device number 119 using dummy_hcd [ 493.625659][ T43] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 493.683377][ T43] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 493.712779][ T5891] usb 5-1: device descriptor read/8, error -71 [ 493.715592][ T43] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 493.757575][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.768830][ T43] usb 4-1: config 0 descriptor?? [ 493.777875][ T43] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 493.798794][T11817] netlink: zone id is out of range [ 493.804452][T11817] netlink: set zone limit has 8 unknown bytes [ 493.822443][ T43] dvb-usb: bulk message failed: -22 (3/0) [ 493.831017][ T5891] usb usb5-port1: unable to enumerate USB device [ 493.894007][ T43] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 493.922313][ T43] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 493.929588][ T43] usb 4-1: media controller created [ 493.938945][T11819] netlink: 72 bytes leftover after parsing attributes in process `syz.5.1761'. [ 493.950835][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 493.979076][T11819] netem: invalid attributes len -7 [ 493.985356][T11819] netem: change failed [ 494.000457][ T43] dvb-usb: bulk message failed: -22 (6/0) [ 494.030030][ T43] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 494.057078][ T43] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input34 [ 494.105043][ T43] dvb-usb: schedule remote query interval to 150 msecs. [ 494.154311][ T43] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 494.199247][ T43] usb 4-1: USB disconnect, device number 121 [ 494.294980][ T43] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 495.032810][ T5829] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 495.042033][T11835] Invalid logical block size (-21931) [ 495.169087][T11838] openvswitch: netlink: Message has 8 unknown bytes. [ 495.194242][T11838] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 495.213257][ T5829] usb 4-1: config 0 has no interfaces? [ 495.223690][ T5829] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 495.229409][T11841] netlink: 'syz.4.1767': attribute type 11 has an invalid length. [ 495.239771][ T5829] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.273046][ T5829] usb 4-1: Product: syz [ 495.290371][ T5829] usb 4-1: Manufacturer: syz [ 495.312760][ T5829] usb 4-1: SerialNumber: syz [ 495.328450][ T5829] usb 4-1: config 0 descriptor?? [ 495.671468][ T5829] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 495.771393][ T5891] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 495.787850][T11859] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1771'. [ 495.820136][ T5890] usb 4-1: USB disconnect, device number 122 [ 495.831422][ T5829] usb 7-1: Using ep0 maxpacket: 16 [ 495.838949][ T5829] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 495.856519][ T5829] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 495.867364][ T5829] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 495.877911][ T5829] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 22 [ 495.893455][ T5829] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 495.902851][ T5829] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 495.910940][ T5829] usb 7-1: SerialNumber: syz [ 495.927626][T11838] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 495.942121][ T5891] usb 5-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 495.957246][ T5829] cdc_acm 7-1:1.0: skipping garbage [ 495.965364][ T5891] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.974049][ T5829] cdc_acm 7-1:1.0: Control and data interfaces are not separated! [ 495.990046][ T5829] cdc_acm 7-1:1.0: This needs exactly 3 endpoints [ 495.997721][ T5829] cdc_acm 7-1:1.0: probe with driver cdc_acm failed with error -22 [ 496.009179][ T5891] usb 5-1: config 0 descriptor?? [ 496.034617][ T5891] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 496.168384][ T5890] usb 7-1: USB disconnect, device number 20 [ 496.265577][T11867] openvswitch: netlink: Multiple metadata blocks provided [ 496.438311][T11852] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1770'. [ 496.475385][ T5891] gspca_cpia1: usb_control_msg 03, error -71 [ 496.482682][ T5891] gspca_cpia1: usb_control_msg 01, error -71 [ 496.488722][ T5891] cpia1 5-1:0.0: only firmware version 1 is supported (got: 0) [ 496.527971][ T5891] usb 5-1: USB disconnect, device number 120 [ 496.529462][T11872] FAULT_INJECTION: forcing a failure. [ 496.529462][T11872] name failslab, interval 1, probability 0, space 0, times 0 [ 496.621515][T11872] CPU: 1 UID: 0 PID: 11872 Comm: syz.3.1774 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 496.621546][T11872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 496.621559][T11872] Call Trace: [ 496.621568][T11872] [ 496.621578][T11872] dump_stack_lvl+0x189/0x250 [ 496.621614][T11872] ? __pfx____ratelimit+0x10/0x10 [ 496.621641][T11872] ? __pfx_dump_stack_lvl+0x10/0x10 [ 496.621672][T11872] ? __pfx__printk+0x10/0x10 [ 496.621700][T11872] ? __pfx___might_resched+0x10/0x10 [ 496.621727][T11872] ? fs_reclaim_acquire+0x7d/0x100 [ 496.621754][T11872] should_fail_ex+0x414/0x560 [ 496.621787][T11872] should_failslab+0xa8/0x100 [ 496.621821][T11872] __kmalloc_noprof+0xcb/0x4f0 [ 496.621849][T11872] ? kfree+0x4d/0x440 [ 496.621874][T11872] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 496.621910][T11872] tomoyo_realpath_from_path+0xe3/0x5d0 [ 496.621942][T11872] ? tomoyo_domain+0xd9/0x130 [ 496.621979][T11872] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 496.622005][T11872] tomoyo_path_number_perm+0x1e8/0x5a0 [ 496.622034][T11872] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 496.622079][T11872] ? __lock_acquire+0xab9/0xd20 [ 496.622125][T11872] ? __fget_files+0x2a/0x420 [ 496.622149][T11872] ? __fget_files+0x2a/0x420 [ 496.622168][T11872] ? __fget_files+0x3a0/0x420 [ 496.622186][T11872] ? __fget_files+0x2a/0x420 [ 496.622211][T11872] security_file_ioctl+0xcb/0x2d0 [ 496.622238][T11872] __se_sys_ioctl+0x47/0x170 [ 496.622268][T11872] do_syscall_64+0xfa/0x3b0 [ 496.622294][T11872] ? lockdep_hardirqs_on+0x9c/0x150 [ 496.622319][T11872] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.622340][T11872] ? clear_bhb_loop+0x60/0xb0 [ 496.622375][T11872] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.622394][T11872] RIP: 0033:0x7fb09658e969 [ 496.622413][T11872] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 496.622430][T11872] RSP: 002b:00007fb097479038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 496.622453][T11872] RAX: ffffffffffffffda RBX: 00007fb0967b5fa0 RCX: 00007fb09658e969 [ 496.622468][T11872] RDX: 0000000000000000 RSI: 000000000000894b RDI: 0000000000000003 [ 496.622481][T11872] RBP: 00007fb097479090 R08: 0000000000000000 R09: 0000000000000000 [ 496.622498][T11872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 496.622510][T11872] R13: 0000000000000000 R14: 00007fb0967b5fa0 R15: 00007fb0968dfa28 [ 496.622544][T11872] [ 496.622636][T11872] ERROR: Out of memory at tomoyo_realpath_from_path. [ 497.371832][ T5890] usb 4-1: new full-speed USB device number 123 using dummy_hcd [ 497.541745][ T5890] usb 4-1: device descriptor read/64, error -71 [ 497.791591][ T5890] usb 4-1: new full-speed USB device number 124 using dummy_hcd [ 497.951703][ T5890] usb 4-1: device descriptor read/64, error -71 [ 497.993367][T11905] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1784'. [ 498.062031][ T5890] usb usb4-port1: attempt power cycle [ 498.161741][ T5829] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 498.201620][T11908] netlink: 164 bytes leftover after parsing attributes in process `syz.6.1785'. [ 498.255658][T11908] netlink: 6 bytes leftover after parsing attributes in process `syz.6.1785'. [ 498.341887][ T5829] usb 6-1: Using ep0 maxpacket: 32 [ 498.356045][ T5829] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 498.372088][ T5829] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 498.384321][ T5829] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 498.397644][ T5829] usb 6-1: Product: syz [ 498.403532][ T5829] usb 6-1: Manufacturer: syz [ 498.408167][ T5829] usb 6-1: SerialNumber: syz [ 498.411487][ T5890] usb 4-1: new full-speed USB device number 125 using dummy_hcd [ 498.416837][ T5829] usb 6-1: config 0 descriptor?? [ 498.432274][ T5890] usb 4-1: device descriptor read/8, error -71 [ 498.444667][T11903] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 498.458857][ T5829] hub 6-1:0.0: bad descriptor, ignoring hub [ 498.468963][ T5829] hub 6-1:0.0: probe with driver hub failed with error -5 [ 498.602692][T11913] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1787'. [ 498.684543][T11903] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 498.694054][T11903] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 498.719311][ T5890] usb 4-1: new full-speed USB device number 126 using dummy_hcd [ 498.969227][ T5890] usb 4-1: device descriptor read/8, error -71 [ 499.091963][ T5890] usb usb4-port1: unable to enumerate USB device [ 499.336654][T11931] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1791'. [ 499.640362][T11942] loop8: detected capacity change from 0 to 7 [ 499.648845][T11942] Dev loop8: unable to read RDB block 7 [ 499.654966][T11942] loop8: unable to read partition table [ 499.661754][T11942] loop8: partition table beyond EOD, truncated [ 499.700815][T11942] loop_reread_partitions: partition scan of loop8 (被x ) failed (rc=-5) [ 499.869869][T11948] kvm: apic: phys broadcast and lowest prio [ 500.231501][ T5888] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 500.351020][T11961] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1798'. [ 500.403423][ T5888] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 500.450586][ T5888] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 500.497568][ T5888] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 500.605705][ T5888] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 500.645145][T11971] FAULT_INJECTION: forcing a failure. [ 500.645145][T11971] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 500.668798][ T5888] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 500.691969][T11971] CPU: 1 UID: 0 PID: 11971 Comm: syz.3.1801 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 500.691998][T11971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 500.692011][T11971] Call Trace: [ 500.692020][T11971] [ 500.692029][T11971] dump_stack_lvl+0x189/0x250 [ 500.692067][T11971] ? __pfx____ratelimit+0x10/0x10 [ 500.692095][T11971] ? __pfx_dump_stack_lvl+0x10/0x10 [ 500.692127][T11971] ? __pfx__printk+0x10/0x10 [ 500.692160][T11971] ? __might_fault+0xb0/0x130 [ 500.692202][T11971] should_fail_ex+0x414/0x560 [ 500.692235][T11971] _copy_from_user+0x2d/0xb0 [ 500.692263][T11971] ___sys_sendmsg+0x158/0x2a0 [ 500.692288][T11971] ? __pfx____sys_sendmsg+0x10/0x10 [ 500.692357][T11971] ? __might_fault+0xb0/0x130 [ 500.692403][T11971] __sys_sendmmsg+0x227/0x430 [ 500.692430][T11971] ? __pfx___sys_sendmmsg+0x10/0x10 [ 500.692449][T11971] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 500.692503][T11971] ? ksys_write+0x22a/0x250 [ 500.692552][T11971] ? __pfx_ksys_write+0x10/0x10 [ 500.692578][T11971] ? rcu_is_watching+0x15/0xb0 [ 500.692611][T11971] __x64_sys_sendmmsg+0xa0/0xc0 [ 500.692634][T11971] do_syscall_64+0xfa/0x3b0 [ 500.692660][T11971] ? lockdep_hardirqs_on+0x9c/0x150 [ 500.692685][T11971] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.692706][T11971] ? clear_bhb_loop+0x60/0xb0 [ 500.692731][T11971] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.692752][T11971] RIP: 0033:0x7fb09658e969 [ 500.692770][T11971] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 500.692789][T11971] RSP: 002b:00007fb097479038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 500.692811][T11971] RAX: ffffffffffffffda RBX: 00007fb0967b5fa0 RCX: 00007fb09658e969 [ 500.692827][T11971] RDX: 0000000000000299 RSI: 0000200000003dc0 RDI: 0000000000000004 [ 500.692841][T11971] RBP: 00007fb097479090 R08: 0000000000000000 R09: 0000000000000000 [ 500.692854][T11971] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 500.692867][T11971] R13: 0000000000000000 R14: 00007fb0967b5fa0 R15: 00007fb0968dfa28 [ 500.692899][T11971] [ 500.723532][ T5888] usb 5-1: New USB device found, idVendor=2294, idProduct=425a, bcdDevice=d1.41 [ 500.726495][ C1] vkms_vblank_simulate: vblank timer overrun [ 500.729882][ T5888] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.944075][ T5888] usb 5-1: Product: syz [ 500.948288][ T5888] usb 5-1: Manufacturer: syz [ 500.953008][ T5888] usb 5-1: SerialNumber: syz [ 501.011353][ T5888] usb 5-1: config 0 descriptor?? [ 501.233664][T11953] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 501.234564][T11953] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 501.455216][ T5888] usb 5-1: ucan: probing device on interface #0 [ 501.482314][ T5888] usb 5-1: ucan: invalid endpoint configuration [ 501.510436][ T5888] usb 5-1: ucan: probe failed; try to update the device firmware [ 501.581467][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.587910][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.590021][ T5891] usb 6-1: USB disconnect, device number 78 [ 501.621188][ T5888] usb 5-1: USB disconnect, device number 121 [ 501.713207][T11992] netlink: 180 bytes leftover after parsing attributes in process `syz.6.1806'. [ 501.991563][ T5890] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 502.011396][ T5891] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 502.174840][ T5890] usb 7-1: Using ep0 maxpacket: 8 [ 502.202424][ T5890] usb 7-1: descriptor type invalid, skip [ 502.204600][ T5891] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 502.210282][ T5890] usb 7-1: config 5 has an invalid interface number: 7 but max is 3 [ 502.259954][ T5890] usb 7-1: config 5 has an invalid interface number: 49 but max is 3 [ 502.264371][ T5891] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 502.277058][ T5890] usb 7-1: config 5 has an invalid interface number: 217 but max is 3 [ 502.301612][ T5890] usb 7-1: config 5 has an invalid interface number: 183 but max is 3 [ 502.322831][ T5891] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 502.330441][ T5890] usb 7-1: config 5 contains an unexpected descriptor of type 0x1, skipping [ 502.381495][ T1774] usb 5-1: new full-speed USB device number 122 using dummy_hcd [ 502.388632][ T5891] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 502.404329][ T5890] usb 7-1: config 5 has an invalid interface number: 145 but max is 3 [ 502.427579][ T5890] usb 7-1: config 5 has 5 interfaces, different from the descriptor's value: 4 [ 502.439818][ T5890] usb 7-1: config 5 has no interface number 0 [ 502.446239][ T5891] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.449949][ T5890] usb 7-1: config 5 has no interface number 1 [ 502.477624][ T5890] usb 7-1: config 5 has no interface number 2 [ 502.485230][ T5890] usb 7-1: config 5 has no interface number 3 [ 502.494251][ T5891] usb 6-1: config 0 descriptor?? [ 502.495098][ T5890] usb 7-1: config 5 has no interface number 4 [ 502.531626][ T1774] usb 5-1: device descriptor read/64, error -71 [ 502.549240][ T5890] usb 7-1: config 5 interface 7 altsetting 43 has an invalid descriptor for endpoint zero, skipping [ 502.581024][ T5890] usb 7-1: config 5 interface 49 altsetting 9 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 502.603802][ T5890] usb 7-1: config 5 interface 49 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 502.625070][ T5890] usb 7-1: too many endpoints for config 5 interface 217 altsetting 47: 226, using maximum allowed: 30 [ 502.641560][ T5890] usb 7-1: config 5 interface 217 altsetting 47 endpoint 0xB has invalid maxpacket 1023, setting to 64 [ 502.662716][ T5890] usb 7-1: config 5 interface 217 altsetting 47 has a duplicate endpoint with address 0x4, skipping [ 502.680588][ T5890] usb 7-1: config 5 interface 217 altsetting 47 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 502.695105][ T5890] usb 7-1: config 5 interface 217 altsetting 47 has a duplicate endpoint with address 0xA, skipping [ 502.706697][ T5890] usb 7-1: config 5 interface 217 altsetting 47 has a duplicate endpoint with address 0x8, skipping [ 502.720877][ T5890] usb 7-1: config 5 interface 217 altsetting 47 has a duplicate endpoint with address 0xB, skipping [ 502.735275][ T5890] usb 7-1: config 5 interface 217 altsetting 47 has a duplicate endpoint with address 0xA, skipping [ 502.750639][ T5890] usb 7-1: config 5 interface 217 altsetting 47 has 9 endpoint descriptors, different from the interface descriptor's value: 226 [ 502.777740][ T5890] usb 7-1: config 5 interface 183 altsetting 168 has a duplicate endpoint with address 0x7, skipping [ 502.790769][ T5890] usb 7-1: config 5 interface 183 altsetting 168 has a duplicate endpoint with address 0x9, skipping [ 502.802025][ T1774] usb 5-1: new full-speed USB device number 123 using dummy_hcd [ 502.814567][ T5890] usb 7-1: config 5 interface 183 altsetting 168 has a duplicate endpoint with address 0xA, skipping [ 502.826933][ T5890] usb 7-1: config 5 interface 183 altsetting 168 has a duplicate endpoint with address 0x7, skipping [ 502.842331][ T5890] usb 7-1: config 5 interface 183 altsetting 168 has a duplicate endpoint with address 0x7, skipping [ 502.859557][ T5890] usb 7-1: config 5 interface 183 altsetting 168 has a duplicate endpoint with address 0xA, skipping [ 502.893864][ T5890] usb 7-1: config 5 interface 183 altsetting 168 has a duplicate endpoint with address 0x8, skipping [ 502.914318][ T5890] usb 7-1: config 5 interface 183 altsetting 168 has an invalid descriptor for endpoint zero, skipping [ 502.925054][ T5891] plantronics 0003:047F:FFFF.000E: No inputs registered, leaving [ 502.933387][ T5890] usb 7-1: config 5 interface 183 altsetting 168 has a duplicate endpoint with address 0xA, skipping [ 502.950275][ T1774] usb 5-1: device descriptor read/64, error -71 [ 503.010821][ T5890] usb 7-1: config 5 interface 183 altsetting 168 has a duplicate endpoint with address 0x8, skipping [ 503.031016][ T5890] usb 7-1: config 5 interface 183 altsetting 168 has an invalid descriptor for endpoint zero, skipping [ 503.040046][ T5891] plantronics 0003:047F:FFFF.000E: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 503.059497][ T5890] usb 7-1: config 5 interface 183 altsetting 168 has a duplicate endpoint with address 0x4, skipping [ 503.084575][ T5890] usb 7-1: config 5 interface 183 altsetting 168 has a duplicate endpoint with address 0x4, skipping [ 503.120229][ T5890] usb 7-1: config 5 interface 145 altsetting 52 has an invalid descriptor for endpoint zero, skipping [ 503.135713][ T1774] usb usb5-port1: attempt power cycle [ 503.164390][ T5890] usb 7-1: config 5 interface 145 altsetting 52 has an invalid descriptor for endpoint zero, skipping [ 503.176198][T11993] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 503.184654][T11993] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 503.195098][ T5891] usb 6-1: USB disconnect, device number 79 [ 503.216472][ T5890] usb 7-1: config 5 interface 7 has no altsetting 0 [ 503.232787][ T5890] usb 7-1: config 5 interface 49 has no altsetting 0 [ 503.250012][ T5890] usb 7-1: config 5 interface 217 has no altsetting 0 [ 503.265552][T12017] fido_id[12017]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 503.280322][ T5890] usb 7-1: config 5 interface 183 has no altsetting 0 [ 503.287530][ T5890] usb 7-1: config 5 interface 145 has no altsetting 0 [ 503.298838][ T5890] usb 7-1: New USB device found, idVendor=1b3d, idProduct=011c, bcdDevice=d4.e0 [ 503.308672][ T5890] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 503.327050][ T5890] usb 7-1: Product: ᰉ [ 503.343938][ T5890] usb 7-1: Manufacturer: 釂ᰵ﬿＋ꗙ漿䣀␫꣱ਯM齨뚰둭䆆媎ɮ眳隤骅᳂⚲䮁Ⳮ젇ﵐᆆ핸䑥瓣쪙픃ꑩẈ䀸绒ϱ緧Ը깔外댗ᶘ䔖訯皑钯瑱䶟떁鹯辔塰솹춾ꠚⓈꠟ宸ꛘ焳⌓ꆑ㘍ཊ㍱澓㭪㷚⿘逝䬻诤ࡆ⁓楒ꄞ遗ꥩ [ 503.384111][ T5890] usb 7-1: SerialNumber: ч [ 503.511560][ T1774] usb 5-1: new full-speed USB device number 124 using dummy_hcd [ 503.555994][ T1774] usb 5-1: device descriptor read/8, error -71 [ 503.675535][ T5890] ftdi_sio 7-1:5.7: FTDI USB Serial Device converter detected [ 503.695465][ T5890] ftdi_sio ttyUSB0: unknown device type: 0xd4e0 [ 503.735292][ T5890] ftdi_sio 7-1:5.49: FTDI USB Serial Device converter detected [ 503.754643][ T5890] ftdi_sio ttyUSB1: unknown device type: 0xd4e0 [ 503.777651][ T5890] ftdi_sio 7-1:5.217: FTDI USB Serial Device converter detected [ 503.812307][ T1774] usb 5-1: new full-speed USB device number 125 using dummy_hcd [ 503.826729][ T5890] ftdi_sio ttyUSB2: unknown device type: 0xd4e0 [ 503.860276][ T5890] ftdi_sio 7-1:5.183: FTDI USB Serial Device converter detected [ 503.872095][ T1774] usb 5-1: device descriptor read/8, error -71 [ 503.887754][ T5890] ftdi_sio ttyUSB3: unknown device type: 0xd4e0 [ 503.918024][ T5890] ftdi_sio 7-1:5.145: FTDI USB Serial Device converter detected [ 503.943731][ T5890] ftdi_sio ttyUSB4: unknown device type: 0xd4e0 [ 503.971768][ T5890] usb 7-1: USB disconnect, device number 21 [ 503.991968][ T1774] usb usb5-port1: unable to enumerate USB device [ 504.009201][ T5890] ftdi_sio 7-1:5.7: device disconnected [ 504.036822][ T5890] ftdi_sio 7-1:5.49: device disconnected [ 504.066636][ T5890] ftdi_sio 7-1:5.217: device disconnected [ 504.109445][ T5890] ftdi_sio 7-1:5.183: device disconnected [ 504.124650][ T5890] ftdi_sio 7-1:5.145: device disconnected [ 504.152328][ T5891] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 504.336737][ T5891] usb 6-1: Using ep0 maxpacket: 32 [ 504.346704][ T5891] usb 6-1: config 0 interface 0 has no altsetting 0 [ 504.360729][ T5891] usb 6-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 504.381576][ T5891] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.390796][ T5891] usb 6-1: Product: syz [ 504.396134][ T5891] usb 6-1: Manufacturer: syz [ 504.401229][ T5891] usb 6-1: SerialNumber: syz [ 504.413728][T12046] openvswitch: netlink: Message has 8 unknown bytes. [ 504.420776][T12046] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 504.433114][ T5891] usb 6-1: config 0 descriptor?? [ 504.750943][T12054] openvswitch: netlink: Message has 8 unknown bytes. [ 504.759625][ T5890] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 504.769659][T12054] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 504.853978][ T5891] gs_usb 6-1:0.0: Couldn't get device config: (err=-71) [ 504.884576][ T5891] gs_usb 6-1:0.0: probe with driver gs_usb failed with error -71 [ 504.911757][ T5891] usb 6-1: USB disconnect, device number 80 [ 504.921939][ T5890] usb 7-1: Using ep0 maxpacket: 16 [ 504.931030][ T5890] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 504.945092][ T5890] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 504.958469][ T5890] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 504.975969][ T5890] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 22 [ 505.002218][ T5890] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 505.016304][ T5890] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 505.025089][ T5890] usb 7-1: SerialNumber: syz [ 505.034560][T12046] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 505.044293][ T5890] cdc_acm 7-1:1.0: skipping garbage [ 505.049553][ T5890] cdc_acm 7-1:1.0: Control and data interfaces are not separated! [ 505.058175][ T5890] cdc_acm 7-1:1.0: This needs exactly 3 endpoints [ 505.065095][ T5890] cdc_acm 7-1:1.0: probe with driver cdc_acm failed with error -22 [ 505.141494][ T1774] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 505.251161][ T5891] usb 7-1: USB disconnect, device number 22 [ 505.321745][ T1774] usb 4-1: Using ep0 maxpacket: 16 [ 505.330682][ T1774] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 505.355991][ T1774] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 505.369229][T12070] netlink: 'syz.4.1817': attribute type 3 has an invalid length. [ 505.384621][ T1774] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 505.389546][T12070] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1817'. [ 505.404880][ T1774] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 22 [ 505.455645][ T1774] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 505.475093][ T1774] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 505.487331][ T1774] usb 4-1: SerialNumber: syz [ 505.498421][T12058] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 505.512112][ T1774] cdc_acm 4-1:1.0: skipping garbage [ 505.517895][ T1774] cdc_acm 4-1:1.0: Control and data interfaces are not separated! [ 505.531473][ T1774] cdc_acm 4-1:1.0: This needs exactly 3 endpoints [ 505.552441][ T1774] cdc_acm 4-1:1.0: probe with driver cdc_acm failed with error -22 [ 505.734389][T12081] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1820'. [ 505.774231][ T5888] usb 4-1: USB disconnect, device number 127 [ 506.185092][T12104] vti0: entered promiscuous mode [ 506.190249][T12104] vti0: entered allmulticast mode [ 506.339840][T12109] netlink: 'syz.0.1828': attribute type 1 has an invalid length. [ 506.405671][T12109] 8021q: adding VLAN 0 to HW filter on device bond1 [ 506.412692][ T1774] usb 7-1: new full-speed USB device number 23 using dummy_hcd [ 506.549430][T12111] bond1: (slave veth0_to_bond): making interface the new active one [ 506.565212][T12111] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 506.577870][ T1774] usb 7-1: device descriptor read/64, error -71 [ 506.688792][T12109] vlan2: entered allmulticast mode [ 506.714179][T12109] veth1: entered allmulticast mode [ 506.742821][T12109] veth1: entered promiscuous mode [ 506.760564][T12109] veth1: left promiscuous mode [ 506.785916][T12109] bond1: (slave vlan2): Enslaving as an active interface with an up link [ 506.861883][ T1774] usb 7-1: new full-speed USB device number 24 using dummy_hcd [ 507.042979][ T1774] usb 7-1: device descriptor read/64, error -71 [ 507.179396][ T1774] usb usb7-port1: attempt power cycle [ 507.443456][ T5888] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 507.563471][ T1774] usb 7-1: new full-speed USB device number 25 using dummy_hcd [ 507.613927][ T1774] usb 7-1: device descriptor read/8, error -71 [ 507.675856][ T5888] usb 4-1: unable to get BOS descriptor or descriptor too short [ 507.726254][ T5888] usb 4-1: not running at top speed; connect to a high speed hub [ 507.736402][T12153] FAULT_INJECTION: forcing a failure. [ 507.736402][T12153] name failslab, interval 1, probability 0, space 0, times 0 [ 507.766827][ T5888] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 147, changing to 4 [ 507.786061][T12153] CPU: 0 UID: 0 PID: 12153 Comm: syz.0.1837 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 507.786095][T12153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 507.786108][T12153] Call Trace: [ 507.786117][T12153] [ 507.786126][T12153] dump_stack_lvl+0x189/0x250 [ 507.786162][T12153] ? __pfx____ratelimit+0x10/0x10 [ 507.786188][T12153] ? __pfx_dump_stack_lvl+0x10/0x10 [ 507.786219][T12153] ? __pfx__printk+0x10/0x10 [ 507.786248][T12153] ? ref_tracker_alloc+0x318/0x460 [ 507.786279][T12153] should_fail_ex+0x414/0x560 [ 507.786312][T12153] should_failslab+0xa8/0x100 [ 507.786350][T12153] kmem_cache_alloc_noprof+0x73/0x3c0 [ 507.786379][T12153] ? skb_clone+0x212/0x3a0 [ 507.786407][T12153] skb_clone+0x212/0x3a0 [ 507.786432][T12153] __netlink_deliver_tap+0x404/0x850 [ 507.786477][T12153] ? netlink_deliver_tap+0x2e/0x1b0 [ 507.786511][T12153] netlink_deliver_tap+0x19c/0x1b0 [ 507.786545][T12153] netlink_unicast+0x72f/0x8d0 [ 507.786586][T12153] netlink_sendmsg+0x805/0xb30 [ 507.786617][T12153] ? __pfx_netlink_sendmsg+0x10/0x10 [ 507.786642][T12153] ? aa_sock_msg_perm+0x94/0x160 [ 507.786669][T12153] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 507.786693][T12153] ? __pfx_netlink_sendmsg+0x10/0x10 [ 507.786714][T12153] __sock_sendmsg+0x219/0x270 [ 507.786744][T12153] ____sys_sendmsg+0x505/0x830 [ 507.786772][T12153] ? __pfx_____sys_sendmsg+0x10/0x10 [ 507.786805][T12153] ? import_iovec+0x74/0xa0 [ 507.786832][T12153] ___sys_sendmsg+0x21f/0x2a0 [ 507.786856][T12153] ? __pfx____sys_sendmsg+0x10/0x10 [ 507.786918][T12153] ? __fget_files+0x2a/0x420 [ 507.786937][T12153] ? __fget_files+0x3a0/0x420 [ 507.786968][T12153] __x64_sys_sendmsg+0x19b/0x260 [ 507.786993][T12153] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 507.787026][T12153] ? __pfx_ksys_write+0x10/0x10 [ 507.787053][T12153] ? rcu_is_watching+0x15/0xb0 [ 507.787085][T12153] ? do_syscall_64+0xbe/0x3b0 [ 507.787117][T12153] do_syscall_64+0xfa/0x3b0 [ 507.787142][T12153] ? lockdep_hardirqs_on+0x9c/0x150 [ 507.787166][T12153] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.787188][T12153] ? clear_bhb_loop+0x60/0xb0 [ 507.787213][T12153] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.787234][T12153] RIP: 0033:0x7f7c1ed8e969 [ 507.787264][T12153] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 507.787282][T12153] RSP: 002b:00007f7c1fb74038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 507.787303][T12153] RAX: ffffffffffffffda RBX: 00007f7c1efb5fa0 RCX: 00007f7c1ed8e969 [ 507.787318][T12153] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 507.787331][T12153] RBP: 00007f7c1fb74090 R08: 0000000000000000 R09: 0000000000000000 [ 507.787349][T12153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 507.787362][T12153] R13: 0000000000000000 R14: 00007f7c1efb5fa0 R15: 00007f7c1f0dfa28 [ 507.787394][T12153] [ 508.080174][ T1774] usb 7-1: new full-speed USB device number 26 using dummy_hcd [ 508.147474][ T5888] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 508.148111][ T1774] usb 7-1: device descriptor read/8, error -71 [ 508.156657][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.156684][ T5888] usb 4-1: Product: syz [ 508.156701][ T5888] usb 4-1: Manufacturer: syz [ 508.156718][ T5888] usb 4-1: SerialNumber: syz [ 508.426356][T12162] netlink: zone id is out of range [ 508.431982][T12162] netlink: set zone limit has 8 unknown bytes [ 508.612368][ T1774] usb usb7-port1: unable to enumerate USB device [ 510.021433][ T5897] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 510.166440][ T5888] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 510.184455][ T5897] usb 5-1: Using ep0 maxpacket: 16 [ 510.193273][ T5897] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 510.206582][ T5897] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 510.289826][ T5897] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 510.330126][ T5888] usb 4-1: USB disconnect, device number 2 [ 510.457686][ T5897] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2e22, bcdDevice= 0.00 [ 510.480342][ T5897] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 510.535208][ T5897] usb 5-1: config 0 descriptor?? [ 510.556119][T12186] netlink: 80 bytes leftover after parsing attributes in process `syz.0.1845'. [ 510.774600][ T5897] koneplus 0003:1E7D:2E22.000F: item fetching failed at offset 0/2 [ 510.849416][ T5897] koneplus 0003:1E7D:2E22.000F: parse failed [ 510.858849][ T5897] koneplus 0003:1E7D:2E22.000F: probe with driver koneplus failed with error -22 [ 510.925016][T12191] team_slave_0: entered promiscuous mode [ 510.930794][T12191] team_slave_1: entered promiscuous mode [ 510.970389][ T5897] usb 5-1: USB disconnect, device number 126 [ 511.363963][T12206] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1853'. [ 511.398770][T12206] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1853'. [ 511.408965][T12206] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1853'. [ 511.931417][ T5891] usb 5-1: new full-speed USB device number 127 using dummy_hcd [ 512.009425][T12223] netlink: 192 bytes leftover after parsing attributes in process `syz.5.1857'. [ 512.025306][T12223] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1857'. [ 512.144406][ T5891] usb 5-1: unable to get BOS descriptor or descriptor too short [ 512.172763][ T5891] usb 5-1: not running at top speed; connect to a high speed hub [ 512.224710][T12227] FAULT_INJECTION: forcing a failure. [ 512.224710][T12227] name failslab, interval 1, probability 0, space 0, times 0 [ 512.237669][T12227] CPU: 1 UID: 0 PID: 12227 Comm: syz.3.1860 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 512.237697][T12227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 512.237709][T12227] Call Trace: [ 512.237718][T12227] [ 512.237728][T12227] dump_stack_lvl+0x189/0x250 [ 512.237764][T12227] ? __pfx____ratelimit+0x10/0x10 [ 512.237790][T12227] ? __pfx_dump_stack_lvl+0x10/0x10 [ 512.237820][T12227] ? __pfx__printk+0x10/0x10 [ 512.237856][T12227] ? __pfx___might_resched+0x10/0x10 [ 512.237883][T12227] ? fs_reclaim_acquire+0x7d/0x100 [ 512.237910][T12227] should_fail_ex+0x414/0x560 [ 512.237943][T12227] should_failslab+0xa8/0x100 [ 512.237976][T12227] __kmalloc_noprof+0xcb/0x4f0 [ 512.238006][T12227] ? copy_splice_read+0x143/0x9b0 [ 512.238041][T12227] copy_splice_read+0x143/0x9b0 [ 512.238085][T12227] ? __pfx_copy_splice_read+0x10/0x10 [ 512.238117][T12227] ? register_lock_class+0x51/0x320 [ 512.238150][T12227] ? file_end_write+0xd8/0x250 [ 512.238182][T12227] ? direct_splice_actor+0x10c/0x160 [ 512.238215][T12227] ? __pfx_shmem_file_splice_read+0x10/0x10 [ 512.238244][T12227] splice_direct_to_actor+0x4d0/0xcc0 [ 512.238291][T12227] ? __pfx_direct_splice_actor+0x10/0x10 [ 512.238321][T12227] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 512.238352][T12227] ? __pfx_aa_file_perm+0x10/0x10 [ 512.238388][T12227] do_splice_direct+0x181/0x270 [ 512.238422][T12227] ? __pfx_do_splice_direct+0x10/0x10 [ 512.238452][T12227] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 512.238475][T12227] ? bpf_lsm_file_permission+0x9/0x20 [ 512.238499][T12227] ? security_file_permission+0x75/0x290 [ 512.238524][T12227] ? rw_verify_area+0x258/0x650 [ 512.238556][T12227] do_sendfile+0x4da/0x7e0 [ 512.238576][T12227] ? __pfx_vfs_write+0x10/0x10 [ 512.238611][T12227] ? __pfx_do_sendfile+0x10/0x10 [ 512.238632][T12227] ? __fget_files+0x3a0/0x420 [ 512.238663][T12227] __se_sys_sendfile64+0x13e/0x190 [ 512.238692][T12227] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 512.238711][T12227] ? rcu_is_watching+0x15/0xb0 [ 512.238744][T12227] ? do_syscall_64+0xbe/0x3b0 [ 512.238775][T12227] do_syscall_64+0xfa/0x3b0 [ 512.238801][T12227] ? lockdep_hardirqs_on+0x9c/0x150 [ 512.238826][T12227] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.238855][T12227] ? clear_bhb_loop+0x60/0xb0 [ 512.238881][T12227] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.238913][T12227] RIP: 0033:0x7fb09658e969 [ 512.238931][T12227] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 512.238949][T12227] RSP: 002b:00007fb097479038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 512.238970][T12227] RAX: ffffffffffffffda RBX: 00007fb0967b5fa0 RCX: 00007fb09658e969 [ 512.238984][T12227] RDX: 0000000000000000 RSI: 0000000000000010 RDI: 0000000000000011 [ 512.238997][T12227] RBP: 00007fb097479090 R08: 0000000000000000 R09: 0000000000000000 [ 512.239010][T12227] R10: 0000000100000002 R11: 0000000000000246 R12: 0000000000000002 [ 512.239023][T12227] R13: 0000000000000000 R14: 00007fb0967b5fa0 R15: 00007fb0968dfa28 [ 512.239054][T12227] [ 512.782415][ T5891] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 147, changing to 4 [ 512.827950][ T5891] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 512.847926][ T5891] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.886102][ T5891] usb 5-1: Product: syz [ 512.900412][ T5891] usb 5-1: Manufacturer: syz [ 512.976606][ T5891] usb 5-1: SerialNumber: syz [ 513.199278][T12238] netlink: 'syz.3.1864': attribute type 21 has an invalid length. [ 513.208475][T12238] netlink: 'syz.3.1864': attribute type 1 has an invalid length. [ 513.276091][ T5891] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 513.306760][ T5891] usb 5-1: USB disconnect, device number 127 [ 513.312709][ T5897] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 513.462148][ T5897] usb 7-1: device descriptor read/64, error -71 [ 513.476281][T12243] FAULT_INJECTION: forcing a failure. [ 513.476281][T12243] name failslab, interval 1, probability 0, space 0, times 0 [ 513.489692][T12243] CPU: 0 UID: 0 PID: 12243 Comm: syz.5.1866 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 513.489729][T12243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 513.489742][T12243] Call Trace: [ 513.489752][T12243] [ 513.489761][T12243] dump_stack_lvl+0x189/0x250 [ 513.489797][T12243] ? __pfx____ratelimit+0x10/0x10 [ 513.489823][T12243] ? __pfx_dump_stack_lvl+0x10/0x10 [ 513.489853][T12243] ? __pfx__printk+0x10/0x10 [ 513.489882][T12243] ? __pfx___might_resched+0x10/0x10 [ 513.489908][T12243] ? fs_reclaim_acquire+0x7d/0x100 [ 513.489934][T12243] should_fail_ex+0x414/0x560 [ 513.489967][T12243] should_failslab+0xa8/0x100 [ 513.490000][T12243] __kmalloc_cache_noprof+0x70/0x3d0 [ 513.490029][T12243] ? ip_set_create+0x348/0x1940 [ 513.490059][T12243] ip_set_create+0x348/0x1940 [ 513.490093][T12243] ? trace_contention_end+0x39/0x120 [ 513.490125][T12243] ? __pfx_ip_set_create+0x10/0x10 [ 513.490189][T12243] nfnetlink_rcv_msg+0xb4d/0x1130 [ 513.490218][T12243] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 513.490263][T12243] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 513.490288][T12243] ? kasan_save_free_info+0x46/0x50 [ 513.490361][T12243] netlink_rcv_skb+0x205/0x470 [ 513.490392][T12243] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 513.490418][T12243] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 513.490462][T12243] ? bpf_lsm_capable+0x9/0x20 [ 513.490488][T12243] ? security_capable+0x7e/0x2e0 [ 513.490521][T12243] nfnetlink_rcv+0x26a/0x2520 [ 513.490549][T12243] ? __dev_queue_xmit+0x1cd7/0x3a70 [ 513.490577][T12243] ? kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 513.490609][T12243] ? __dev_queue_xmit+0x27e/0x3a70 [ 513.490632][T12243] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 513.490664][T12243] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 513.490688][T12243] ? __pfx___dev_queue_xmit+0x10/0x10 [ 513.490735][T12243] ? ref_tracker_free+0x63a/0x7d0 [ 513.490761][T12243] ? __copy_skb_header+0xa7/0x550 [ 513.490785][T12243] ? __pfx_ref_tracker_free+0x10/0x10 [ 513.490812][T12243] ? __skb_clone+0x63/0x7a0 [ 513.490837][T12243] ? __skb_clone+0x483/0x7a0 [ 513.490865][T12243] ? skb_clone+0x246/0x3a0 [ 513.490889][T12243] ? __netlink_deliver_tap+0x807/0x850 [ 513.490918][T12243] ? netlink_deliver_tap+0x2e/0x1b0 [ 513.490955][T12243] ? netlink_deliver_tap+0x2e/0x1b0 [ 513.490984][T12243] ? netlink_deliver_tap+0x2e/0x1b0 [ 513.491020][T12243] netlink_unicast+0x758/0x8d0 [ 513.491078][T12243] netlink_sendmsg+0x805/0xb30 [ 513.491109][T12243] ? __pfx_netlink_sendmsg+0x10/0x10 [ 513.491133][T12243] ? aa_sock_msg_perm+0x94/0x160 [ 513.491178][T12243] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 513.491202][T12243] ? __pfx_netlink_sendmsg+0x10/0x10 [ 513.491223][T12243] __sock_sendmsg+0x219/0x270 [ 513.491252][T12243] ____sys_sendmsg+0x505/0x830 [ 513.491279][T12243] ? __pfx_____sys_sendmsg+0x10/0x10 [ 513.491314][T12243] ? import_iovec+0x74/0xa0 [ 513.491339][T12243] ___sys_sendmsg+0x21f/0x2a0 [ 513.491363][T12243] ? __pfx____sys_sendmsg+0x10/0x10 [ 513.491423][T12243] ? __fget_files+0x2a/0x420 [ 513.491442][T12243] ? __fget_files+0x3a0/0x420 [ 513.491473][T12243] __x64_sys_sendmsg+0x19b/0x260 [ 513.491498][T12243] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 513.491530][T12243] ? __pfx_ksys_write+0x10/0x10 [ 513.491556][T12243] ? rcu_is_watching+0x15/0xb0 [ 513.491590][T12243] ? do_syscall_64+0xbe/0x3b0 [ 513.491621][T12243] do_syscall_64+0xfa/0x3b0 [ 513.491647][T12243] ? lockdep_hardirqs_on+0x9c/0x150 [ 513.491672][T12243] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 513.491692][T12243] ? clear_bhb_loop+0x60/0xb0 [ 513.491725][T12243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 513.491745][T12243] RIP: 0033:0x7fe55118e969 [ 513.491764][T12243] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 513.491782][T12243] RSP: 002b:00007fe551fb8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 513.491805][T12243] RAX: ffffffffffffffda RBX: 00007fe5513b5fa0 RCX: 00007fe55118e969 [ 513.491821][T12243] RDX: 0000000004004020 RSI: 0000200000000100 RDI: 0000000000000004 [ 513.491835][T12243] RBP: 00007fe551fb8090 R08: 0000000000000000 R09: 0000000000000000 [ 513.491849][T12243] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 513.491862][T12243] R13: 0000000000000000 R14: 00007fe5513b5fa0 R15: 00007fe5514dfa28 [ 513.491894][T12243] [ 514.181415][ T5886] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 514.198426][ T5897] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 514.271503][ T1774] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 514.343361][ T5886] usb 6-1: config 0 has no interfaces? [ 514.352350][ T5886] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 514.361746][ T5886] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.362483][ T5897] usb 7-1: device descriptor read/64, error -71 [ 514.369782][ T5886] usb 6-1: Product: syz [ 514.369804][ T5886] usb 6-1: Manufacturer: syz [ 514.389760][ T5886] usb 6-1: SerialNumber: syz [ 514.402552][ T5886] usb 6-1: config 0 descriptor?? [ 514.462352][ T1774] usb 4-1: config 0 has no interfaces? [ 514.486805][ T1774] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 514.503611][ T5897] usb usb7-port1: attempt power cycle [ 514.509399][T12256] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1870'. [ 514.513986][ T1774] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.543658][ T1774] usb 4-1: Product: syz [ 514.547911][ T1774] usb 4-1: Manufacturer: syz [ 514.554060][ T1774] usb 4-1: SerialNumber: syz [ 514.566842][ T1774] usb 4-1: config 0 descriptor?? [ 514.815711][ T30] audit: type=1800 audit(1748807267.104:38): pid=12241 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1865" name="file0" dev="tmpfs" ino=2056 res=0 errno=0 [ 514.871488][ T5897] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 514.892631][ T5897] usb 7-1: device descriptor read/8, error -71 [ 515.023754][ T30] audit: type=1326 audit(1748807267.314:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12255 comm="syz.4.1871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f337b12ab39 code=0x7ffc0000 [ 515.105703][ T30] audit: type=1326 audit(1748807267.314:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12255 comm="syz.4.1871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f337b12ab39 code=0x7ffc0000 [ 515.247283][ T30] audit: type=1326 audit(1748807267.314:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12255 comm="syz.4.1871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f337b18e969 code=0x7ffc0000 [ 515.263922][ T5897] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 515.309945][ T5897] usb 7-1: device descriptor read/8, error -71 [ 515.875412][ T5897] usb usb7-port1: unable to enumerate USB device [ 516.003941][ T30] audit: type=1326 audit(1748807267.314:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12255 comm="syz.4.1871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f337b18e969 code=0x7ffc0000 [ 516.106181][ T30] audit: type=1326 audit(1748807267.344:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12255 comm="syz.4.1871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f337b12ab39 code=0x7ffc0000 [ 516.129606][ T30] audit: type=1326 audit(1748807267.344:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12255 comm="syz.4.1871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f337b12ab39 code=0x7ffc0000 [ 516.441473][ T30] audit: type=1326 audit(1748807267.344:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12255 comm="syz.4.1871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f337b12ab39 code=0x7ffc0000 [ 516.508064][T12267] openvswitch: netlink: Message has 8 unknown bytes. [ 516.515038][T12267] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 516.585998][ T30] audit: type=1326 audit(1748807267.344:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12255 comm="syz.4.1871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f337b18e969 code=0x7ffc0000 [ 516.618221][ T5886] usb 4-1: USB disconnect, device number 3 [ 516.694746][ T30] audit: type=1326 audit(1748807267.354:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12255 comm="syz.4.1871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f337b18e969 code=0x7ffc0000 [ 516.991528][ T5891] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 517.075290][ T5886] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 517.093917][ T43] usb 6-1: USB disconnect, device number 81 [ 517.331570][ T5891] usb 7-1: Using ep0 maxpacket: 16 [ 517.340598][ T5891] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 517.351762][ T5891] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 517.361969][ T1774] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 517.378931][ T5891] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 517.400362][ T5891] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 22 [ 517.456698][ T5886] usb 4-1: unable to get BOS descriptor or descriptor too short [ 517.491250][ T5886] usb 4-1: not running at top speed; connect to a high speed hub [ 517.506793][ T5886] usb 4-1: config 4 has an invalid interface number: 147 but max is 0 [ 517.516342][ T5891] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 517.530109][ T5891] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 517.541029][ T5886] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 517.557451][ T5891] usb 7-1: SerialNumber: syz [ 517.564200][ T5886] usb 4-1: config 4 has no interface number 0 [ 517.591039][T12267] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 517.638943][ T5886] usb 4-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 517.657182][ T5886] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.668166][ T5891] cdc_acm 7-1:1.0: skipping garbage [ 517.713699][ T5891] cdc_acm 7-1:1.0: Control and data interfaces are not separated! [ 517.735697][ T5886] usb 4-1: Product: syz [ 517.794568][ T5891] cdc_acm 7-1:1.0: This needs exactly 3 endpoints [ 517.806180][ T5886] usb 4-1: Manufacturer: syz [ 517.810890][ T5886] usb 4-1: SerialNumber: syz [ 517.829340][T12275] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1877'. [ 517.872059][T12276] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1877'. [ 517.933874][ T5891] cdc_acm 7-1:1.0: probe with driver cdc_acm failed with error -22 [ 518.264647][ T5891] usb 7-1: USB disconnect, device number 31 [ 518.337616][T12284] tipc: Enabling of bearer rejected, already enabled [ 518.435735][T12286] FAULT_INJECTION: forcing a failure. [ 518.435735][T12286] name failslab, interval 1, probability 0, space 0, times 0 [ 518.450773][T12286] CPU: 1 UID: 0 PID: 12286 Comm: syz.4.1880 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 518.450804][T12286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 518.450818][T12286] Call Trace: [ 518.450827][T12286] [ 518.450837][T12286] dump_stack_lvl+0x189/0x250 [ 518.450874][T12286] ? __pfx____ratelimit+0x10/0x10 [ 518.450913][T12286] ? __pfx_dump_stack_lvl+0x10/0x10 [ 518.450944][T12286] ? __pfx__printk+0x10/0x10 [ 518.450980][T12286] should_fail_ex+0x414/0x560 [ 518.451010][T12286] should_failslab+0xa8/0x100 [ 518.451059][T12286] kmem_cache_alloc_noprof+0x73/0x3c0 [ 518.451087][T12286] ? skb_clone+0x212/0x3a0 [ 518.451124][T12286] skb_clone+0x212/0x3a0 [ 518.451151][T12286] __netlink_deliver_tap+0x404/0x850 [ 518.451198][T12286] ? netlink_deliver_tap+0x2e/0x1b0 [ 518.451232][T12286] netlink_deliver_tap+0x19c/0x1b0 [ 518.451267][T12286] netlink_sendskb+0x68/0x140 [ 518.451298][T12286] netlink_rcv_skb+0x28c/0x470 [ 518.451334][T12286] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 518.451364][T12286] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 518.451409][T12286] ? netlink_deliver_tap+0x2e/0x1b0 [ 518.451440][T12286] ? netlink_deliver_tap+0x2e/0x1b0 [ 518.451477][T12286] netlink_unicast+0x758/0x8d0 [ 518.451519][T12286] netlink_sendmsg+0x805/0xb30 [ 518.451545][T12286] ? __pfx_netlink_sendmsg+0x10/0x10 [ 518.451570][T12286] ? aa_sock_msg_perm+0x94/0x160 [ 518.451600][T12286] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 518.451623][T12286] ? __pfx_netlink_sendmsg+0x10/0x10 [ 518.451644][T12286] __sock_sendmsg+0x219/0x270 [ 518.451668][T12286] ____sys_sendmsg+0x505/0x830 [ 518.451688][T12286] ? __pfx_____sys_sendmsg+0x10/0x10 [ 518.451718][T12286] ? import_iovec+0x74/0xa0 [ 518.451745][T12286] ___sys_sendmsg+0x21f/0x2a0 [ 518.451768][T12286] ? __pfx____sys_sendmsg+0x10/0x10 [ 518.451829][T12286] ? __fget_files+0x2a/0x420 [ 518.451856][T12286] ? __fget_files+0x3a0/0x420 [ 518.451896][T12286] __x64_sys_sendmsg+0x19b/0x260 [ 518.451920][T12286] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 518.451951][T12286] ? __pfx_ksys_write+0x10/0x10 [ 518.451972][T12286] ? rcu_is_watching+0x15/0xb0 [ 518.451996][T12286] ? do_syscall_64+0xbe/0x3b0 [ 518.452028][T12286] do_syscall_64+0xfa/0x3b0 [ 518.452053][T12286] ? lockdep_hardirqs_on+0x9c/0x150 [ 518.452077][T12286] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.452097][T12286] ? clear_bhb_loop+0x60/0xb0 [ 518.452119][T12286] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.452135][T12286] RIP: 0033:0x7f337b18e969 [ 518.452151][T12286] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 518.452169][T12286] RSP: 002b:00007f337bff1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 518.452192][T12286] RAX: ffffffffffffffda RBX: 00007f337b3b5fa0 RCX: 00007f337b18e969 [ 518.452208][T12286] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 518.452220][T12286] RBP: 00007f337bff1090 R08: 0000000000000000 R09: 0000000000000000 [ 518.452233][T12286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 518.452245][T12286] R13: 0000000000000000 R14: 00007f337b3b5fa0 R15: 00007f337b4dfa28 [ 518.452274][T12286] [ 519.000021][ T5886] usb 4-1: Found UVC 0.02 device syz (04f2:b746) [ 519.051865][ T5897] usb 6-1: new full-speed USB device number 82 using dummy_hcd [ 519.060933][ T5886] usb 4-1: No streaming interface found for terminal 6. [ 519.115262][T12292] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1882'. [ 519.144493][T12292] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1882'. [ 519.146985][ T5886] usb 4-1: USB disconnect, device number 4 [ 519.191456][ T5897] usb 6-1: device descriptor read/64, error -71 [ 519.257904][T12298] bond0: entered promiscuous mode [ 519.281596][T12298] bond_slave_0: entered promiscuous mode [ 519.304305][T12298] bond_slave_1: entered promiscuous mode [ 519.329864][T12298] bond0: entered allmulticast mode [ 519.356206][T12298] bond_slave_0: entered allmulticast mode [ 519.378124][T12298] bond_slave_1: entered allmulticast mode [ 519.441989][ T5897] usb 6-1: new full-speed USB device number 83 using dummy_hcd [ 519.582790][ T5897] usb 6-1: device descriptor read/64, error -71 [ 519.651527][ T1774] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 519.702089][ T5897] usb usb6-port1: attempt power cycle [ 519.816759][ T1774] usb 5-1: config 0 has no interfaces? [ 519.836979][ T1774] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 519.848158][ T1774] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 519.857916][ T1774] usb 5-1: Product: syz [ 519.862542][ T1774] usb 5-1: Manufacturer: syz [ 519.867931][ T1774] usb 5-1: SerialNumber: syz [ 519.884970][ T1774] usb 5-1: config 0 descriptor?? [ 520.041523][ T5897] usb 6-1: new full-speed USB device number 84 using dummy_hcd [ 520.148520][ T5886] usb 5-1: USB disconnect, device number 3 [ 520.156536][ T30] kauditd_printk_skb: 500 callbacks suppressed [ 520.156556][ T30] audit: type=1800 audit(1748807272.434:548): pid=12300 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1885" name="file0" dev="tmpfs" ino=1987 res=0 errno=0 [ 520.192409][ T5897] usb 6-1: device descriptor read/8, error -71 [ 520.431559][ T5897] usb 6-1: new full-speed USB device number 85 using dummy_hcd [ 520.737375][ T5897] usb 6-1: device descriptor read/8, error -71 [ 520.851713][ T5897] usb usb6-port1: unable to enumerate USB device [ 520.980897][T12324] openvswitch: netlink: Message has 8 unknown bytes. [ 521.021532][T12324] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 521.181628][ T5829] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 521.334384][ T5829] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 521.352578][ T5829] usb 5-1: config 1 has no interface number 0 [ 521.371438][ T5886] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 521.396900][ T5829] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 521.447375][ T5829] usb 5-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 521.457800][ T5829] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 521.479457][ T5829] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 521.496639][ T5829] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.520804][ T5829] usb 5-1: Product: syz [ 521.535452][ T5829] usb 5-1: Manufacturer: syz [ 521.540122][ T5829] usb 5-1: SerialNumber: syz [ 521.563079][ T5886] usb 4-1: Using ep0 maxpacket: 16 [ 521.579666][ T5886] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 521.598806][ T5886] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 521.611376][ T5886] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 521.641269][ T5886] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 22 [ 521.673288][ T5886] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 521.701435][ T5886] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 521.709797][ T5886] usb 4-1: SerialNumber: syz [ 521.731715][T12325] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 521.755602][ T5886] cdc_acm 4-1:1.0: skipping garbage [ 521.761108][ T5886] cdc_acm 4-1:1.0: Control and data interfaces are not separated! [ 521.769694][ T5886] cdc_acm 4-1:1.0: This needs exactly 3 endpoints [ 521.789914][ T5886] cdc_acm 4-1:1.0: probe with driver cdc_acm failed with error -22 [ 521.879382][T12333] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 521.913296][T12335] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1895'. [ 521.926652][T12335] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1895'. [ 521.958965][ T5886] usb 4-1: USB disconnect, device number 5 [ 522.023156][T12337] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1896'. [ 522.063832][T12337] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1896'. [ 522.079489][T12337] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1896'. [ 522.088982][ T30] audit: type=1326 audit(1748807274.364:549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12338 comm="syz.5.1897" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe55118e969 code=0x0 [ 522.381430][ T5897] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 522.403731][ T5829] cdc_ncm 5-1:1.1: bind() failure [ 522.437095][T12346] netlink: 72 bytes leftover after parsing attributes in process `syz.6.1900'. [ 522.452794][T12346] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 522.531518][ T5897] usb 6-1: Using ep0 maxpacket: 8 [ 522.538861][ T5897] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 522.552708][ T5897] usb 6-1: config 0 interface 0 has no altsetting 0 [ 522.566064][ T5897] usb 6-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=bc.76 [ 522.585340][ T5897] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.594393][ T5897] usb 6-1: Product: syz [ 522.598645][ T5897] usb 6-1: Manufacturer: syz [ 522.604017][ T5897] usb 6-1: SerialNumber: syz [ 522.622049][ T5897] usb 6-1: config 0 descriptor?? [ 522.636024][ T5897] snd_usb_toneport 6-1:0.0: Line 6 TonePort UX2 found [ 522.661160][T12322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 522.670067][T12322] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 522.697989][ T10] usb 5-1: USB disconnect, device number 4 [ 522.808837][T12352] tipc: Started in network mode [ 522.821483][T12352] tipc: Node identity ac14140c, cluster identity 4711 [ 522.829131][T12352] tipc: Enabled bearer , priority 10 [ 522.835531][ T5829] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 522.858529][ T5897] snd_usb_toneport 6-1:0.0: cannot get proper max packet size [ 522.874941][ T5897] snd_usb_toneport 6-1:0.0: Line 6 TonePort UX2 now disconnected [ 522.889174][ T5897] snd_usb_toneport 6-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 523.052465][ T5829] usb 7-1: config 0 has no interfaces? [ 523.110621][ T5829] usb 7-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 523.140393][ T5829] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.149883][ T5829] usb 7-1: Product: syz [ 523.158328][ T5829] usb 7-1: Manufacturer: syz [ 523.163495][ T5829] usb 7-1: SerialNumber: syz [ 523.174949][ T5829] usb 7-1: config 0 descriptor?? [ 523.390525][ T30] audit: type=1800 audit(1748807275.674:550): pid=12348 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1901" name="file0" dev="tmpfs" ino=449 res=0 errno=0 [ 523.412482][ T5829] usb 7-1: USB disconnect, device number 32 [ 523.842726][ T10] tipc: Node number set to 2886997004 [ 524.003284][T12364] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1907'. [ 524.279616][T12371] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1909'. [ 524.286650][T12372] netlink: 43 bytes leftover after parsing attributes in process `syz.3.1910'. [ 524.331206][T12371] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1909'. [ 524.354256][T12371] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1909'. [ 524.373930][T12374] FAULT_INJECTION: forcing a failure. [ 524.373930][T12374] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 524.393451][T12374] CPU: 1 UID: 0 PID: 12374 Comm: syz.4.1911 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 524.393479][T12374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 524.393492][T12374] Call Trace: [ 524.393501][T12374] [ 524.393510][T12374] dump_stack_lvl+0x189/0x250 [ 524.393545][T12374] ? __pfx____ratelimit+0x10/0x10 [ 524.393570][T12374] ? __pfx_dump_stack_lvl+0x10/0x10 [ 524.393600][T12374] ? __pfx__printk+0x10/0x10 [ 524.393636][T12374] should_fail_ex+0x414/0x560 [ 524.393667][T12374] _copy_from_user+0x2d/0xb0 [ 524.393690][T12374] copy_from_sockptr+0x5e/0xa0 [ 524.393716][T12374] packet_setsockopt+0x6c6/0x12c0 [ 524.393741][T12374] ? __pfx_packet_setsockopt+0x10/0x10 [ 524.393760][T12374] ? rcu_read_lock_any_held+0xb3/0x120 [ 524.393788][T12374] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 524.393818][T12374] ? vfs_write+0x8d8/0xa90 [ 524.393850][T12374] ? aa_sk_perm+0x81e/0x950 [ 524.393878][T12374] ? __pfx_aa_sk_perm+0x10/0x10 [ 524.393899][T12374] ? __lock_acquire+0xab9/0xd20 [ 524.393928][T12374] ? aa_sock_opt_perm+0x74/0x110 [ 524.393956][T12374] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 524.393978][T12374] ? __pfx_packet_setsockopt+0x10/0x10 [ 524.394001][T12374] do_sock_setsockopt+0x25a/0x3e0 [ 524.394024][T12374] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 524.394048][T12374] ? __fget_files+0x2a/0x420 [ 524.394076][T12374] __x64_sys_setsockopt+0x18b/0x220 [ 524.394102][T12374] do_syscall_64+0xfa/0x3b0 [ 524.394127][T12374] ? lockdep_hardirqs_on+0x9c/0x150 [ 524.394150][T12374] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.394170][T12374] ? clear_bhb_loop+0x60/0xb0 [ 524.394194][T12374] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.394214][T12374] RIP: 0033:0x7f337b18e969 [ 524.394232][T12374] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 524.394249][T12374] RSP: 002b:00007f337bfaf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 524.394270][T12374] RAX: ffffffffffffffda RBX: 00007f337b3b6160 RCX: 00007f337b18e969 [ 524.394285][T12374] RDX: 000000000000000c RSI: 0000000000000107 RDI: 0000000000000003 [ 524.394297][T12374] RBP: 00007f337bfaf090 R08: 0000000000000004 R09: 0000000000000000 [ 524.394310][T12374] R10: 0000200000001400 R11: 0000000000000246 R12: 0000000000000001 [ 524.394332][T12374] R13: 0000000000000000 R14: 00007f337b3b6160 R15: 00007f337b4dfa28 [ 524.394364][T12374] [ 524.641139][ C1] vkms_vblank_simulate: vblank timer overrun [ 524.984914][T12382] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1914'. [ 525.081667][ T1774] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 525.216377][ T5829] usb 6-1: USB disconnect, device number 86 [ 525.261889][ T1774] usb 7-1: Using ep0 maxpacket: 16 [ 525.292884][ T1774] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 525.312335][ T1774] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 525.331769][ T1774] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 525.348182][ T1774] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 525.367641][ T1774] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 525.392416][ T1774] usb 7-1: config 0 descriptor?? [ 525.896152][ T1774] microsoft 0003:045E:07DA.0010: unbalanced collection at end of report description [ 525.940060][ T1774] microsoft 0003:045E:07DA.0010: parse failed [ 525.962770][ T1774] microsoft 0003:045E:07DA.0010: probe with driver microsoft failed with error -22 [ 526.101747][ T1774] usb 7-1: USB disconnect, device number 33 [ 526.258787][T12416] netlink: 100 bytes leftover after parsing attributes in process `syz.5.1927'. [ 526.653071][T12420] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1929'. [ 526.674719][ T10] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 526.873328][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 526.897701][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 526.927958][ T10] usb 6-1: New USB device found, idVendor=0419, idProduct=0600, bcdDevice= 0.00 [ 526.937511][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.958406][ T10] usb 6-1: config 0 descriptor?? [ 527.005835][T12432] tipc: Started in network mode [ 527.010957][T12432] tipc: Node identity ac14140c, cluster identity 4711 [ 527.020040][T12432] tipc: Enabled bearer , priority 10 [ 527.043314][T12434] usb usb8: usbfs: process 12434 (syz.4.1936) did not claim interface 0 before use [ 527.174245][ T10] usbhid 6-1:0.0: can't add hid device: -32 [ 527.180748][ T10] usbhid 6-1:0.0: probe with driver usbhid failed with error -32 [ 527.181703][ T5890] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 527.290803][T12441] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1939'. [ 527.300323][T12441] netem: invalid attributes len -7 [ 527.309273][T12441] netem: change failed [ 527.354817][T12443] netlink: 'syz.4.1940': attribute type 23 has an invalid length. [ 527.364828][ T5890] usb 7-1: Using ep0 maxpacket: 32 [ 527.376015][ T5890] usb 7-1: config 0 has no interfaces? [ 527.386237][ T5890] usb 7-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=8e.fa [ 527.395858][ T5890] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.404189][ T5890] usb 7-1: Product: syz [ 527.408604][ T5890] usb 7-1: Manufacturer: syz [ 527.415620][ T5890] usb 7-1: SerialNumber: syz [ 527.427522][ T5890] usb 7-1: config 0 descriptor?? [ 527.631552][ T10] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 527.646007][T12430] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1933'. [ 527.723124][ T5890] usb 7-1: USB disconnect, device number 34 [ 527.811462][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 527.818474][ T10] usb 5-1: config 11 has an invalid interface number: 95 but max is 0 [ 527.830448][ T10] usb 5-1: config 11 has no interface number 0 [ 527.838743][ T10] usb 5-1: config 11 interface 95 altsetting 64 endpoint 0x82 has invalid maxpacket 25408, setting to 64 [ 527.855861][ T10] usb 5-1: config 11 interface 95 has no altsetting 0 [ 527.863977][ T10] usb 5-1: language id specifier not provided by device, defaulting to English [ 527.886411][ T10] usb 5-1: New USB device found, idVendor=10f0, idProduct=2002, bcdDevice=dc.4d [ 527.896571][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.905165][ T10] usb 5-1: Product: syz [ 527.909647][ T10] usb 5-1: SerialNumber: syz [ 527.919067][ T30] audit: type=1326 audit(1748807280.204:551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12445 comm="syz.3.1941" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb09658e969 code=0x7ffc0000 [ 527.971442][ T30] audit: type=1326 audit(1748807280.204:552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12445 comm="syz.3.1941" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb09658e969 code=0x7ffc0000 [ 527.994291][ T30] audit: type=1326 audit(1748807280.204:553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12445 comm="syz.3.1941" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fb09658e969 code=0x7ffc0000 [ 528.019523][ T5829] tipc: Node number set to 2886997004 [ 528.025563][ T30] audit: type=1326 audit(1748807280.204:554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12445 comm="syz.3.1941" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fb09658e9a3 code=0x7ffc0000 [ 528.052759][ T30] audit: type=1326 audit(1748807280.204:555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12445 comm="syz.3.1941" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb09658e969 code=0x7ffc0000 [ 528.076021][ T30] audit: type=1326 audit(1748807280.204:556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12445 comm="syz.3.1941" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb09658e969 code=0x7ffc0000 [ 528.098700][ T30] audit: type=1326 audit(1748807280.234:557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12445 comm="syz.3.1941" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fb09658e969 code=0x7ffc0000 [ 528.121626][ T30] audit: type=1326 audit(1748807280.234:558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12445 comm="syz.3.1941" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb09658e969 code=0x7ffc0000 [ 528.146679][ T30] audit: type=1326 audit(1748807280.234:559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12445 comm="syz.3.1941" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb09658e969 code=0x7ffc0000 [ 528.174998][ T10] usbhid 5-1:11.95: couldn't find an input interrupt endpoint [ 528.192577][ T10] usb 5-1: USB disconnect, device number 5 [ 528.204850][ T30] audit: type=1326 audit(1748807280.234:560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12445 comm="syz.3.1941" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fb09658e969 code=0x7ffc0000 [ 529.331813][ T5829] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 529.387246][ T10] usb 6-1: USB disconnect, device number 87 [ 529.507896][ T5829] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 529.533362][ T5829] usb 5-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 529.547332][ T5829] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 529.585149][ T5829] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 530.555953][T12491] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 530.678098][ T5829] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 530.709131][ T5829] stv0680 5-1:4.0: STV(e): camera ping failed!! [ 530.845138][ T5829] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 530.870456][T12502] __nla_validate_parse: 1 callbacks suppressed [ 530.870472][T12502] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1958'. [ 530.887873][ T5829] stv0680 5-1:4.0: last error: 0, command = 0x0 [ 530.914066][ T5829] usb 5-1: USB disconnect, device number 6 [ 530.980737][T12502] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1958'. [ 531.270075][T12506] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 531.564110][T12511] SET target dimension over the limit! [ 531.598909][T12512] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1961'. [ 531.838253][T12517] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1966'. [ 543.571330][ C1] sched: DL replenish lagged too much [ 544.503667][T12539] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1974'. [ 546.041470][ T5843] Bluetooth: hci0: command 0x0406 tx timeout [ 547.164004][T12551] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1977'. [ 655.951290][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 655.958327][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5829/2:b..l P5200/1:b..l [ 655.967995][ C0] rcu: (detected by 0, t=10502 jiffies, g=72501, q=630 ncpus=2) [ 655.975760][ C0] task:udevd state:R running task stack:22952 pid:5200 tgid:5200 ppid:1 task_flags:0x400140 flags:0x00004002 [ 655.990434][ C0] Call Trace: [ 655.993752][ C0] [ 655.996722][ C0] __schedule+0x16f5/0x4d00 [ 656.001284][ C0] ? preempt_schedule_irq+0xb5/0x150 [ 656.006594][ C0] ? __pfx___schedule+0x10/0x10 [ 656.011466][ C0] ? path_openat+0x2ee5/0x3830 [ 656.016365][ C0] ? do_filp_open+0x1fa/0x410 [ 656.021173][ C0] ? preempt_schedule_irq+0xaa/0x150 [ 656.026477][ C0] preempt_schedule_irq+0xb5/0x150 [ 656.031597][ C0] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 656.037334][ C0] ? rcu_irq_exit_check_preempt+0xdf/0x210 [ 656.043149][ C0] irqentry_exit+0x6f/0x90 [ 656.047577][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 656.053578][ C0] RIP: 0010:lock_acquire+0x175/0x360 [ 656.058875][ C0] Code: 00 00 00 00 9c 8f 44 24 30 f7 44 24 30 00 02 00 00 0f 85 cd 00 00 00 f7 44 24 08 00 02 00 00 74 01 fb 65 48 8b 05 7b fd fd 10 <48> 3b 44 24 58 0f 85 f2 00 00 00 48 83 c4 60 5b 41 5c 41 5d 41 5e [ 656.078489][ C0] RSP: 0018:ffffc900033371d0 EFLAGS: 00000206 [ 656.084650][ C0] RAX: c455588cd7f43300 RBX: 0000000000000000 RCX: c455588cd7f43300 [ 656.092620][ C0] RDX: 0000000000000000 RSI: ffffffff8db5d737 RDI: ffffffff8be26f40 [ 656.100589][ C0] RBP: ffffffff822ece5a R08: 0000000000000000 R09: ffffffff822ece5a [ 656.108554][ C0] R10: dffffc0000000000 R11: ffffed100601a724 R12: 0000000000000002 [ 656.116518][ C0] R13: ffffffff8e13d080 R14: 0000000000000000 R15: 0000000000000246 [ 656.124507][ C0] ? __page_table_check_zero+0xba/0x530 [ 656.130061][ C0] ? __page_table_check_zero+0xba/0x530 [ 656.135628][ C0] ? __page_table_check_zero+0xba/0x530 [ 656.141271][ C0] __page_table_check_zero+0xd7/0x530 [ 656.146648][ C0] ? __page_table_check_zero+0xba/0x530 [ 656.152205][ C0] ? __reset_page_owner+0x148/0x1f0 [ 656.157544][ C0] __free_frozen_pages+0xc84/0xe70 [ 656.162663][ C0] __put_partials+0x161/0x1c0 [ 656.167337][ C0] put_cpu_partial+0x17c/0x250 [ 656.172095][ C0] ? put_cpu_partial+0x6d/0x250 [ 656.176946][ C0] __slab_free+0x2f7/0x400 [ 656.181361][ C0] ? __phys_addr+0xd3/0x180 [ 656.185867][ C0] qlist_free_all+0x97/0x140 [ 656.190464][ C0] kasan_quarantine_reduce+0x148/0x160 [ 656.196011][ C0] __kasan_slab_alloc+0x22/0x80 [ 656.200957][ C0] __kmalloc_noprof+0x224/0x4f0 [ 656.205812][ C0] ? tomoyo_encode+0x28b/0x550 [ 656.210668][ C0] tomoyo_encode+0x28b/0x550 [ 656.215276][ C0] tomoyo_realpath_from_path+0x58d/0x5d0 [ 656.220921][ C0] tomoyo_check_open_permission+0x1c1/0x3b0 [ 656.226810][ C0] ? tomoyo_check_open_permission+0x16a/0x3b0 [ 656.232872][ C0] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 656.239321][ C0] ? tomoyo_file_open+0x165/0x220 [ 656.244353][ C0] security_file_open+0xb1/0x270 [ 656.249285][ C0] do_dentry_open+0x35e/0x1970 [ 656.254062][ C0] vfs_open+0x3b/0x340 [ 656.258128][ C0] ? path_openat+0x2ecd/0x3830 [ 656.262891][ C0] path_openat+0x2ee5/0x3830 [ 656.267484][ C0] ? arch_stack_walk+0xfc/0x150 [ 656.272357][ C0] ? __pfx_path_openat+0x10/0x10 [ 656.277292][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 656.283365][ C0] do_filp_open+0x1fa/0x410 [ 656.287865][ C0] ? __lock_acquire+0xab9/0xd20 [ 656.292715][ C0] ? __pfx_do_filp_open+0x10/0x10 [ 656.297760][ C0] ? _raw_spin_unlock+0x28/0x50 [ 656.302603][ C0] ? alloc_fd+0x64c/0x6c0 [ 656.306986][ C0] do_sys_openat2+0x121/0x1c0 [ 656.311748][ C0] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 656.317293][ C0] ? __pfx_do_sys_openat2+0x10/0x10 [ 656.322581][ C0] ? rcu_is_watching+0x15/0xb0 [ 656.327345][ C0] __x64_sys_openat+0x138/0x170 [ 656.332197][ C0] do_syscall_64+0xfa/0x3b0 [ 656.336698][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 656.341900][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 656.347959][ C0] ? clear_bhb_loop+0x60/0xb0 [ 656.352633][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 656.358521][ C0] RIP: 0033:0x7f4e080a7407 [ 656.362946][ C0] RSP: 002b:00007ffdf543c2e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 656.371354][ C0] RAX: ffffffffffffffda RBX: 00007f4e08893880 RCX: 00007f4e080a7407 [ 656.379320][ C0] RDX: 0000000000080000 RSI: 00007ffdf543c460 RDI: ffffffffffffff9c [ 656.387284][ C0] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 656.395260][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 0000560dd562f7f5 [ 656.403224][ C0] R13: 0000560dd562f7f5 R14: 0000000000000001 R15: 0000000000000000 [ 656.411298][ C0] [ 656.414330][ C0] task:kworker/0:3 state:R running task stack:18808 pid:5829 tgid:5829 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 656.427908][ C0] Workqueue: mld mld_mca_work [ 656.432674][ C0] Call Trace: [ 656.436056][ C0] [ 656.439008][ C0] __schedule+0x16f5/0x4d00 [ 656.443522][ C0] ? kasan_save_track+0x3e/0x80 [ 656.448373][ C0] ? __kasan_slab_alloc+0x6c/0x80 [ 656.453395][ C0] ? preempt_schedule_common+0x83/0xd0 [ 656.458854][ C0] ? kmalloc_reserve+0xbd/0x290 [ 656.463711][ C0] ? igmp6_send+0x162/0x11e0 [ 656.468300][ C0] ? __pfx___schedule+0x10/0x10 [ 656.473249][ C0] ? preempt_schedule+0xae/0xc0 [ 656.478189][ C0] ? ipv6_get_lladdr+0x2aa/0x3f0 [ 656.483141][ C0] preempt_schedule_common+0x83/0xd0 [ 656.488509][ C0] preempt_schedule+0xae/0xc0 [ 656.493191][ C0] ? __pfx_preempt_schedule+0x10/0x10 [ 656.498586][ C0] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 656.504671][ C0] preempt_schedule_thunk+0x16/0x30 [ 656.509872][ C0] __local_bh_enable_ip+0x13e/0x1c0 [ 656.515077][ C0] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 656.520800][ C0] ? do_raw_read_unlock+0x3d/0x80 [ 656.525823][ C0] ipv6_get_lladdr+0x2aa/0x3f0 [ 656.530585][ C0] ? ipv6_get_lladdr+0x2b/0x3f0 [ 656.535439][ C0] igmp6_send+0x4ba/0x11e0 [ 656.539857][ C0] ? do_raw_spin_lock+0x121/0x290 [ 656.544977][ C0] ? look_up_lock_class+0x74/0x170 [ 656.550104][ C0] ? igmp6_send+0x173/0x11e0 [ 656.554699][ C0] ? __pfx_igmp6_send+0x10/0x10 [ 656.559541][ C0] ? mld_mca_work+0x52/0x440 [ 656.564141][ C0] ? __pfx___mutex_lock+0x10/0x10 [ 656.569171][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 656.574899][ C0] mld_mca_work+0x2a2/0x440 [ 656.579396][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 656.585120][ C0] process_scheduled_works+0xade/0x17b0 [ 656.590685][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 656.596763][ C0] worker_thread+0x8a0/0xda0 [ 656.601356][ C0] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 656.607683][ C0] ? __kthread_parkme+0x7b/0x200 [ 656.612638][ C0] kthread+0x711/0x8a0 [ 656.616705][ C0] ? __pfx_worker_thread+0x10/0x10 [ 656.621990][ C0] ? __pfx_kthread+0x10/0x10 [ 656.626577][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 656.631770][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 656.637013][ C0] ? __pfx_kthread+0x10/0x10 [ 656.641601][ C0] ret_from_fork+0x3fc/0x770 [ 656.646219][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 656.651334][ C0] ? __switch_to_asm+0x39/0x70 [ 656.656092][ C0] ? __switch_to_asm+0x33/0x70 [ 656.660867][ C0] ? __pfx_kthread+0x10/0x10 [ 656.665469][ C0] ret_from_fork_asm+0x1a/0x30 [ 656.670342][ C0] [ 662.559060][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 662.573170][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 663.791993][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 663.806490][ T1299] ieee802154 phy1 wpan1: encryption failed: -22