last executing test programs: 8.865510753s ago: executing program 2 (id=481): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket(0x40000000015, 0x5, 0x0) getpeername$netlink(r0, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001bc0)=[{{0x0, 0x0, &(0x7f0000002600)=[{&(0x7f0000002280)="c4", 0x1}], 0x1}}], 0x1, 0x4050000) r1 = socket$inet6(0xa, 0x80003, 0x6) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0) socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000008040)=[{0xffffffffffffffff, 0x90}], 0x1, 0x0, 0x0, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000226aa140070ad0001310010203010902240001000000000904000002bd22f00009050303000000000009058aff", @ANYRES8], 0x0) syz_usb_control_io$cdc_ecm(r3, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000580)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000600)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f00ffffff03c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c001f4002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040) writev(0xffffffffffffffff, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 6.257975847s ago: executing program 3 (id=489): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x1000}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c090) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 6.026158715s ago: executing program 3 (id=490): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x129642, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x202000, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x10001, 0x1, 0x9, 0x8000, 0x3, 0x5, 0x6, 0xb762, 0x4, 0x40007, 0x8, 0xf, 0x2, 0x80000001, 0x400, 0x1007fc, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xffffe4f5, 0xd6, 0x4, 0xfffb, 0x7, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0x2, 0x7, 0x6, 0x99, 0x9, 0x5, 0x6, 0x7, 0xfffffff7, 0x6d, 0x4, 0x9, 0xd05, 0x1000044, 0x8, 0x8, 0x1, 0xfffffffb, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x400, 0x8, 0x7, 0xcd, 0x4, 0x80000000, 0xc, 0x4, 0x65, 0x91, 0x659, 0x9, 0xb, 0x9, 0xc28, 0xd, 0x7, 0x3, 0x401, 0x3, 0x2, 0x7, 0x1, 0x10001, 0x3, 0x7, 0x4, 0x8, 0x8, 0x7, 0x1, 0x1, 0x1, 0x7, 0x40, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0x3, 0x7fffffff, 0xff, 0x9, 0xa7, 0xf, 0x1, 0xffffffff, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0x6, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x400002, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0xfffd, 0x2, 0x6, 0x3ff, 0xf04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x6, 0x9, 0x3, 0xfffffffb, 0x20001, 0x0, 0x3, 0x2, 0x5, 0x8, 0x3, 0x8, 0x800, 0xf06, 0x8, 0x7ff, 0x0, 0x9, 0x6, 0x5, 0x400001, 0x4d15, 0x1ff, 0x7, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x2, 0x5, 0x42ba, 0x400004, 0x9, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0xa89, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x5, 0x40ffe, 0x180000, 0x8000, 0x3, 0x200, 0x80, 0x6, 0x9aa, 0xe4cb, 0x402, 0x1, 0x1ff, 0x5, 0x9b4, 0x1, 0x8, 0x0, 0x8, 0xfffffffc, 0xd, 0xfffffffd, 0x4, 0x8, 0x901, 0x5, 0x2, 0x7b, 0xfffffeff, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x10000068, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x4, 0x80000000, 0x7, 0x0, 0x7, 0x8001, 0x2, 0x6, 0x4, 0xc, 0x8, 0xc9cd, 0x2, 0x9, 0x0, 0x200, 0x3, 0x9, 0xd, 0x2, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x3, 0x1000009, 0x3, 0x9, 0x0, 0x401, 0x3, 0x6, 0x33, 0x6, 0x8, 0x8001, 0x4, 0x6, 0x7, 0x5, 0xd, 0x2, 0x7, 0x1, 0x8, 0x3, 0x81, 0x3, 0x9, 0x8001, 0x20000c9, 0x5, 0x65e1, 0x10001, 0xc, 0x48001, 0x0, 0xe, 0x3, 0x97, 0x7, 0xb, 0xffff6f3c, 0xbc4, 0x803, 0xb4, 0xf, 0x1, 0x3, 0xff, 0xfff, 0x0, 0xee3, 0x43, 0x9, 0x1, 0x3, 0x1, 0x3796, 0x6, 0x6, 0xbe, 0x3, 0x45, 0x1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x1, 0x9d6, 0x9, 0x6, 0xea6, 0x3, 0x5, 0x10, 0x8, 0xffffffff, 0x3ff, 0x96, 0x7, 0x2, 0x6, 0x9, 0x5, 0x5, 0x3, 0xd7da, 0x82, 0x7f, 0x9, 0x4, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x2, 0x5, 0x1ff, 0x4, 0x6, 0x1, 0x7, 0x7ff, 0xfffffffe, 0x0, 0xb, 0xfffffff7, 0x8000008, 0x101, 0xc57, 0x5, 0x2, 0x5, 0x8, 0x0, 0xf, 0x1982, 0x1, 0x80000000, 0x1, 0x9, 0x6, 0x7ffc, 0x2, 0x1, 0x2, 0x2, 0x9, 0x5, 0xffffff1c, 0x5, 0x5, 0x7, 0x692, 0x92, 0x4, 0x0, 0x2, 0x9, 0x1b8f, 0x14, 0x65, 0xc00, 0x9, 0x9, 0x3, 0x88, 0x10004, 0x295, 0x6, 0xcb1, 0x1, 0xb7e, 0x10001, 0x8000002, 0xa, 0x6, 0x1, 0x2, 0x3ff, 0xfb5, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d4, 0x2, 0x8000, 0xec, 0xd, 0x5, 0x84d3, 0xfffffeff, 0x2, 0x5, 0x7fffffff, 0x80, 0x2, 0x90, 0x2, 0x6, 0x3, 0x70, 0x0, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0x7, 0xa4a, 0x7, 0x400, 0xc, 0xfffffff9, 0x8001, 0xd, 0x1, 0x9, 0xfff, 0x421, 0x3ff, 0x2, 0xd, 0xfb6, 0xc, 0xfffffffd, 0xac, 0x0, 0xa, 0x0, 0x6, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x0) 5.703499851s ago: executing program 2 (id=492): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000001000)={0x73622a85, 0x10b, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x54, 0x0, &(0x7f0000000e00)=[@acquire, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x58, 0x18, &(0x7f00000006c0)={@ptr={0x70742a85, 0xfffffffe, 0x0, 0x0, 0x2, 0x32}, @fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000bc0)={0x0, 0x28, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f00000004c0)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x1001}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) prlimit64(0x0, 0x7, &(0x7f0000000ec0), 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x1000000000000, &(0x7f0000000340)="cb"}) 5.665520839s ago: executing program 3 (id=493): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010101}]}, &(0x7f0000000180)=0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$EBT_SO_GET_INFO(r2, 0x0, 0x80, &(0x7f00000001c0)={'nat\x00', 0x0, 0x0, 0x0, [0x8, 0x401, 0x5, 0x0, 0x911f, 0x100000001]}, 0x0) ioctl$XFS_IOC_DIOINFO(r1, 0x800c581e, &(0x7f0000000140)) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="6400000000010104000c0000141a000042000000240001801400018008000100e000000108000200e000e2012c00028005000100008c35c8209e1be9a3a686f14589050180080001000000000008000200ac1e00010c0002800500010000000000034000"], 0x64}}, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000040)='mem\x00\xffEev\xf2r\xf1\x18\x1d\xb9\x00y_hug$\bo-\x03Q`]o\x8cr\x9d_etl\xf9\xdd\a\xad\\H\xe94\b,H\xbf', 0x0, 0x0) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, &(0x7f0000000040), &(0x7f0000000100)=0xc) r3 = socket$inet_udp(0x2, 0x2, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl1\x00', r4, 0xc0, 0x10, 0x9, 0x0, {{0x14, 0x4, 0x2, 0x4, 0x50, 0x66, 0x0, 0x9, 0x4, 0x0, @rand_addr=0x64010100, @multicast1, {[@timestamp_addr={0x44, 0x34, 0x26, 0x1, 0x5, [{@empty, 0x7}, {@loopback, 0x53}, {@loopback, 0x8}, {@multicast2, 0x9}, {@local, 0x8000}, {@empty, 0xfffffc00}]}, @cipso={0x86, 0x6, 0x2}]}}}}}) r5 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='file0\x00', 0x0, 0x0) read(r5, &(0x7f0000000000), 0x12) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r5, 0xc0305602, &(0x7f0000000000)={0x0, 0x0, 0x3002}) 5.298526044s ago: executing program 4 (id=497): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000380)={0x8, 0x4d, 0x2ba8}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) r1 = syz_usb_connect(0x5, 0x35, 0x0, 0x0) syz_usb_disconnect(r1) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, &(0x7f0000000780)={0x34, &(0x7f0000000580)={0x20, 0x16, 0x1, "c2"}, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.821907782s ago: executing program 2 (id=499): bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, 0x0, 0x0, 0x1, 0x5}, 0x94) io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x40000, 0xa, 0x20002f7}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r3, 0x1, 0x2a, &(0x7f0000000100)=0xfffe, 0x4) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000240)="3d4077e50823a7746c0ee30dd0afdfb5ff2a258d495dc9d2c2a25bc7dc0b11bde0d15d0770675db17901", 0x2a}, {&(0x7f0000000080)="b28231adddba8ed6f23bf98ca8caa015ab797f57", 0x14}], 0x2, 0x0) recvmmsg(r3, &(0x7f0000001440)=[{{&(0x7f0000000280)=@un=@abs, 0x0, &(0x7f0000001400)=[{&(0x7f0000001480)=""/1}, {&(0x7f0000000300)=""/102}, {&(0x7f0000000380)=""/4096}, {&(0x7f0000001380)=""/111}]}}], 0x700, 0x40002002, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xffc1) setsockopt$sock_int(r3, 0x1, 0x10, &(0x7f0000000180)=0x55b7, 0x4) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 4.661697325s ago: executing program 2 (id=501): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000b00)=ANY=[@ANYBLOB="61124c000000000061138c0000000000bf2000000000000007000000080000003d0301000000000095000000000000006916000000000000bf67000000000000170600000fff07006706000002000000070600000ee60000bf050000000000001f650000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070500000419311f3d2401000000000095000000000000000500000000000000950000000000000032ed3c5be95e76b67754bb12dc8c27df8ecf264e0f84f9f17d3c30e3c72fe9755ba08508460b603daf5a7d1dbdd2d17f2f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a674f888a08034b7dd399703d6c4f633a9a4f16d0a3e1282ee45a010fb94fa9de56c9d8a814261bdb94a6538b89dc6c60bf70d742a81b72bab8395fa64810b5bb8fab4d4d897db2c544c0ec50b8eac8c63d2b1cd06a39702bd547f5ebaa6954f01cef3c9bacec15e2e3b2bd352e93a22adfe8efe33ffa78b02af242f8ee5476d4ef7a6f0c4704403b9bad2b648e90fff24f69a5ef05f5408ea197ed09a9510ee6063229de2984abdd46ea3ec78e3127002ed37c2564b8f8a621483fb2a5ff221e0d831d64759d17b8c59d0f2b06e7f6b7958fb5b939af4be5e55a95f8c6d785a91c7c3f0c17ae7f9ac5ff05f5ecddf0cef90d50e763be96496661c749e21ab63a1f50b30a65a9027ba357bf8c614497ee59b68bf6a5d45c81c567e347d545741fbbbea3e47b1750f272980087b7f8a13cce7014137f250370b8a70ae3eaf6d6f17759c3886871e97d063b7f26eed3226bb0b9ee6320a2b02fea7a06a0e37182adf9a87c0f0c8cd51e56d9e5e7708f156b6cb08566bc86ba6997bb7ae18b9cdf9e6cfda9c6390190e2d468e8c38a818a6a1397b5fbbaa4ddc9a36df424135a28d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) 4.561962025s ago: executing program 2 (id=502): socket$inet(0xa, 0x801, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000dff1e4406d046009b497000000010902120001080000"], 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x6, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000180)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) mlockall(0x2) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000000), 0x0, 0x101001a, &(0x7f0000001080)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x5}}]}}, 0xfb, 0x0, 0x0) r3 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, 0xffffffffffffffff, 0x1000) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r3, 0x40045532, &(0x7f0000000040)=0x44) bpf$BPF_PROG_DETACH(0x1c, 0x0, 0x0) fchdir(r1) r4 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1040, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./bus\x00', 0x1c1002, 0x40) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(r6, r5, 0x0, 0x7fffffff) ftruncate(r4, 0x2007ffb) sendfile(r4, r4, 0x0, 0x1000000201005) 4.476809072s ago: executing program 3 (id=503): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x40000000015, 0x5, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001bc0)=[{{0x0, 0x0, &(0x7f0000002600)=[{&(0x7f0000002280)="c4", 0x1}], 0x1}}], 0x1, 0x4050000) r1 = socket$inet6(0xa, 0x80003, 0x6) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0) socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000008040)=[{0xffffffffffffffff, 0x90}], 0x1, 0x0, 0x0, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000226aa140070ad0001310010203010902240001000000000904000002bd22f00009050303000000000009058aff", @ANYRES8], 0x0) syz_usb_control_io$cdc_ecm(r3, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000580)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000600)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f00ffffff03c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c001f4002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040) writev(0xffffffffffffffff, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 3.550772062s ago: executing program 1 (id=509): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f00000007c0)={0x8, {"dc5d3b0169633d3eba3eabbc09167be55101d4af4b22a373236464d2dbfaa84399b77bd438a54364a7ebc5bdaab4f9decb7c044318cd59a0af8279bcab35dd7daf7a0ceb381df2c32eff45b13e2c8f40e1895355bf6f165200cb1ca41a155730ee2e9f83183e9fafe029d0401b0770618254a8b2dc87b630072b1e2de160d1afed51b74c14b71ec1b226a324482d14ad586b1a4ce80e458fe45244c01eddeddf3564af838d6d5324f8a77023d6eb7aa14397a0e1413ea1c3dfdf063a35b709e627f36fe403ee3117365be5017682f53595f28543062c740a94a794312f5cebc315044b8ea000a5d0f27812ab0ce149d11e6f6f7620c5f3e250bf67d13a1ca39dbb7b8b5a31e3d7ba7ebe5849a7a09b61fc9f2cfc54b89e9cd0105bca49483ce55e0187ce2ad692a18219d881057c838587b915337169ee054655f26a04df913a658fccbf4def6aad750ca4796b74d322c67e9d4ee6a530a22dcc35db850b424d6ec9f62495b9f9fd2b000feadd57d26dbd505798c208d91eb0aab0fd97537631b8bf81ce0e2241c4272be4ff69b390e4485d574146b76d1fdbf7fc5334906805534cdae1e47240af7761a18fc8bd0a694be47529da98bc0f98eb7db3fc4a74cbb6e486f4de90fbf2452e72c2e1dca44543ad9ad094b8bc861eef1e814662d0b350339e3a510d459c6f83aabd5fd3dcb38224056d761e7df9b482b9905f1e2135c1929be328ecdb69c007a3efd548502c83106f6df1ab1178fac499eda92ad4373155227ec2df150c919d322ecb3ea37e659285f18a3e2f79b59900ca438df3a1381380a12d3ad7678e0a8d3bdfb40651389b4ac8c66138d442d70eafdc2df8b080028006b124e4ebe0d9883ef100f1934e425a4146056d800975675bb1913142adbc039a9c68c2f146a0e8903447313f5e5549905f397a9b1f21a93b80c4d04a8ea7a29a50fbc5407a9305bba420edf898ea678d6879489c39692c99bb6dacf61f5f97637b94c1031d635b5423d27f7b78fafa060000006eadc21466af5a10281e6a808748969d29efb444c99a4cb2111732a792dbca4376a125a68f7cdac065cc6173dc21caafba48c742d9a7df2f771ff2f5725b22c247d4e0c6106f9f5f6929b69929ab37e9a9b326ce618bb702b883b12026f1300f21f2c7440cac8c5f1210a78aa067211d2827f5dcc7578252c2ccc3f67bab9d1bb6939b21b550788ef550acfed4bf50c0b4fb3ca4d2872ee64f95d611a317d9daaf373a10d868680b2226396c95fa2b0ab4d6fce06c3b42cb97d17a7b5089061537fdeb1a53040869f7befca330358fdba86754fc2e46c2113e1484cb37534af8f0408a7ee313778dab49f08229964298f847ea66c4ec319f64b6a12da585bc59e82e0263c507b397d3efee3b4066f4d25566aa1549f6185f6375f84b65fa8945148b90430c86a5b6fdf58d5c812b98d9dc621fd9a3d9f1a577495356516d1cbcf5e8bb8923b54b247225b9c3892b18a9e137f3620c734052af9dc8f1ea36f0d4592d5ee32e35676a84dc891f97456f2ac3a4ab58a42bcdc221a4ac8bb28d428add2fcbe5b110a8afd5d23b31e827bd16167b2d88cae024afc04a722ac0b4d45c52512e6b6f102aac4be21bc89ce246539048370553665b0a4336a6db99d0d19399be6437bf21419304331b4342b2c1db580f0c9bf681fdb8e9fa3e025454197bbc82ef93ee2f385660818ec5127080675a8013766469afe3b1e36e81bf2f04c3a26eaf4517551e734d21ba3bc90e48aea0891792970c39f3f528397e9b7ae190f1760fe5960dc763ee0a17939c60bfcac0a8914be82c749e4fe85d1ac5fa733413468fb8941085e8c4d6e0b6d1e62e20da58440facd640ddbb6c1f694b3ca48757a34c5a11668368711a1d4f3a81d31ac30d71277d7ae77882b6841cfa6289e6cce84a3ad57eeb328f831888ac7d3cfcd3a472a48d903f20cec8c8ae8d0bea04ebf7413ef7693f8ed876e49bd5f89d7e1078208ff62712e330fc0341b9ccf26845578d44b1e0c66d1bebc14742baedfabb8e9a2c8f42730360c72997efe0ce786ff330c2eb6e0ff20896f813c2a515ce76f87d2a1a1c1588eb369231ddeb4a2f9f9591ecdecc74d20aeb50047beb3ab89a9e4e1b805a20b645c79d0bc5d0247fab8ba46a97a07630b1f1cb69b42b568af746733d2c581f057873d64fe6e659b00b4a26745f5fba1fe7406a86b007936c7cfdac53a4c5b0ea9f6604863c8e3f174eddbb09175f6e13cda9a860cf400ef9ed02b895502ac6e6de6a658249c3c6e8a653517eae2231e56e0f120547923c6549ebc1ed14c623637ce3d96af5c93a32e58e2d9659d8b5b145888b52d9a5b5cb3cdf594eb137bcef2ba068cfd2c6ccf7ab6e5b4ec55e9197bfb91c9b8729f7b50cf0b0326f7ea3e712c77674d48545ca2a86744c3c38f149d69cf811beacf7e5f49c7bfba20f1dcf3d7bc0b9c796016820a46495d244c9606a06fe2e14233eda78d69ae4523ad7b708b0c7ead44d7fd376fed60e3cc2ee25e9600adfbe87ac7c8fb8269aec9459602af0f420becda6120ce7d9626c65ae7f860639e8bf664eb4301ec18add0e436c0356c12ab6b4ca35da2b43c4a8c239fd0b59a2ce94843cdfa1667053165053633b062844dbb0d00070fde74fa3178eb5f1f5fd02e2088d8690379f39ab22c080cdcb29d700bac74fabd8a356fe99afe83a5d99aa5024e9158a299eda6c99b6701e64f1d68e7e2c0c6e88396bb535a02d0948f0a250a6e090041c96d9c9acd6134d44d516fd1010c39e572b86b05bb1326a2a4f23f11181186f9c2a01dc7b58c0129f4b851ca9b1e3dc35db7364e29ef646211796b1651511e041345abce427fa5d6e48b8fb078c8432061a4cc518a8f2a2caf709a5c1473a62112a6650afc64eec12f8f9c08cff1b6fbf7a1209fc8661f62303b7c5d49c1d0b32a9f37e81ed9ab6193816d40995ed49c10b9f5752e04d57535a3d16f06c65d32846c31ec9787ec4a965679eb804e86b45d007f38d8104550770dc6f313bc846e43a14a8c21d0628c744e3e83cb998d1b7acfe996541a8c03852dadf9326444c582b481cae844e4f3fe3d638903b38f24633b63adbad841ac6c4c1169d781a0e271e8a967b1c7e986fcb3a66168e86e3559a44fcfa92452260491da9397659af60453f4cd4be2d15439445ec2b4366a79d3283da912d9d499df1242bd174edc235848caa21d2c997aff0e95c7e5cc0803c90fab84e7be7b37909d0388acb6800baba183ecc8eea8c71c0d65d669e41f99ceae523b7a6b772f3b8ebba1d2127ccc3ddb7ddcb4ec73cbdc26fc87c3848e258a0b5484d3a13e40ec4e4a65dd92f09e9fe1e3e2f8b96c4e363aa3683860dee62dfcf8823ee4a3593a092e0bd9c4cedacf44a272faa164447b01f46a7795642a40c61b0034a37f0e9b792428a0ddcd144fe8263088eaac8016f8f1cd30b55ac90a8f10d785b7570dd9e639a4a068d3fe98a42010e24f69de817f676c2a224300d749571ad43f49d1fbe838f4566bc7b5f104c384ad87189213152b644d9fcbdf98bafeee569d640ce9045779f1d90024c023a7480a358dee276fba139c14b4fdb12885240903d0e61dc161659a68f62c92b899007e0f2b65bf0a069e9e57c9b6ae50a3b30dd1003fb0eead73ae2f6010b3b356b4060579a4f29935e1f00c01d12e5f44e8e3163d81dfef7ca8560604240c7e96e4454c6971614df306c768121abb3f628e3f1d2d026f58d1087334c5bdb74d7c949b0ee66a4531ba4e9b922aee3d0f802ed034734507a5913c52966f1f8bd4577840de0253aabc23299dced2a299859c07af9fb0f9c29b6533b9d84d471390d59ab315f5ddb226f6b8dd7889295f0fb1f7bd1adafe4cc520a1e84bf2a59d5b9795aeafc8d6fd66a8228aba8653b98622617ddfeb5d6795c9bd2f35d4a0c386e862675a50e3314c3fbb17aca151c13c7fc8b1d1b72ed0a958537b5ddc9e74bddc2b9571ec3f2b7775b125338d4852a75a63941564c65bb36dfb6bea4aab1ae7a4f285c2177aa98406eb2cc10934aa92d5a9612d4455c84ad200841d289b5c2d5deab0d8e2459598ef183d3dc46f6bad0b9513710600cfa4d69fcd5763cdcc4f2c2b7cd7d4491fd52f4aec82ce846c0988f6f0123e21e900d39c61085e68c9badc350b44004f6c042d64b0d0cbf91ad0592b198f1eeea1e52200bc8e6d62848d6884b10bdde72466039da488be6b340c23148f666f2fe6e032c07dac43586df182aca9116f4600313fa8375c76337ba86bdc391dae6450218f58f047ced64befc6bb5c2a60024669630a6279fedf2fe45e7e19ce582ad96ae0d023eb9b39f5f1e666e73bb038ae38157275be5eb3e7cbc8b05adf53e817646bdc2cfce98e5d162bf7faaca787db8717ab8b27b9e35609c5fb9fe9def07f010df8b43cf5c96851eadfdeff0b7bc5826e7e15490ae9c3d14166ee81bef007070e7981235a673804ad89943ee6b51ac63364f7870e121e6ff23a0c7d179527cd58dd7a4ca37247c2bd9efc79b720bb1ee2d39862e98cb81e93cf5b48d5d02ee8ac737ab504c867a1c49e678300803c94fbe978dea918a1e71b9791ee1e4d30056e86c26a4670b451a13ece52a89a7057fe2052e11c6666eb916d823ea66bf217c320acba3b714910734b2d27c2fa586bd7f7664b0d1422adabad2ce2afc10270057f11940fac1a51d023ce48bd04ea39b7f99381b239fd0ddeea0dce7863ec1f8f61775013b6414ecf86e686a340a3148f87a9d7d60a1f2da53436d16fc88d6a4e7c3d55e0dd004cbecc15a5558eb705d82aacb1862ddc251dd5d9cbf1d78f97900ce6e8dab0ea678cb823bd1e7bbd1e927878c19f4f322228f9b36287fc13e7c1293ea875ae73815e052d6c2ebc40df8f7b9d1f76e0b10e35aa160944983d8e6b790df0d9b13f3460657336d81f7d83c0350324b930ec9c7557ce12887f76372e126f504b0980fea27f31a780c05187b9b5353dafc6b101543b24332b96e15bc26b19062e52fa9f86d260ee3a3bc92a133e328407bb85357ee5c45cb87228f44888b14941b5911b050e9319fe88033f830a8490917a9c0572ebbc5492b4e1083a2e3d77215a34abef947b5b9a950e780662de18873e55899c92db3ad3d437e8407890afa6b0c04ef861b8bc85fbbe1bb67b3d9ef001409f84b8ec4f01d861cecc143a805b981ab5cf5b605057b63cb2c84ec358e510a69cd8c33a8a62fe4680d0c980145cc709157832bfaef261cb0466c237376ca2944ce9affffd4b1dc7cc9511da0b34bffb9ac216fb8cf7c6572d95627787720d1ba67c6512fcdb16f6329e9668681c404efebad559f81f05971b5efb6b4cca97ad0346753cc0a40a877242d8a808c602b03dc962cee38e646cb18abb079c70d357c30738a70f55cd3c5956a83a1bfcd6649dd765f16bfe968066345df7380bbc0c16b3b5af513d6458c791343952f33a051c5d711c1f35af1b47f3db9bbfb5c7c636b3a2b52805d606479879be0b404a28ade5649a3185e0f85a85fc15cd824671c2befdd0da509597c87d869f0bd7ad163ad93ca28fc0c4025eccaafe385ec3fc06c54ebcd7b07b6c7e0197c5b9ef886159a1585ae45248f865be760db6f5bc8f868fc6aefd04e34ecb51159e4cdcc2214b42b1ca9caec13ba3e1b2e7a3c736977b226213d265c2873195122a9b448088c8b50edd549be41c38ab176807b75e7267f86e400000000000000000000000000000001df00", 0x1000}}, 0x1006) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}}, 0x24}}, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r5, &(0x7f00003a1000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f0000000000)="9a01000000f800b8d58800000f23d00f21f8351000000d0f23f864640f79ea66baf80cb8c85f5480ef66bafc0cecc4c2adac17b9550200000f320f2860c7c4e11751df0f2e2d00000080b9800000c00f3235008000000f30", 0x58}], 0x1, 0x4a, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902120001000000"], 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r7, 0x4048ae9b, &(0x7f0000000080)={0x70003, 0x0, {[0xffffffffffffffff, 0x1f8, 0x2, 0xffffffffefffff15, 0x3, 0x4, 0x1, 0x4]}}) ioctl$KVM_RUN(r7, 0xae80, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r4, {0xb, 0x6}, {0xffff, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x8, 0xfff, 0x10000000, 0x7, 0xccb}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd0000110005000000a60c6b63851e0f982c"], 0xfce) 3.354198223s ago: executing program 0 (id=510): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000001000)={0x73622a85, 0x10b, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x54, 0x0, &(0x7f0000000e00)=[@acquire, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x58, 0x18, &(0x7f00000006c0)={@ptr={0x70742a85, 0xfffffffe, 0x0, 0x0, 0x2, 0x32}, @fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000bc0)={0x0, 0x28, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f00000004c0)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x1001}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) prlimit64(0x0, 0x7, &(0x7f0000000ec0), 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x1000000000000, &(0x7f0000000340)="cb"}) 2.654136386s ago: executing program 1 (id=511): fsopen(&(0x7f0000000140)='pipefs\x00', 0x0) close(0xffffffffffffffff) syz_clone(0xe50c1700, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r0, &(0x7f0000000480)=""/74, 0x4a) write$char_usb(r0, &(0x7f00000003c0)="90", 0x1) syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x0, 0x0) setsockopt$MRT6_TABLE(0xffffffffffffffff, 0x29, 0xcf, &(0x7f0000000040)=0xff, 0x4) 2.451216237s ago: executing program 0 (id=512): bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, 0x0, 0x0, 0x1, 0x5}, 0x94) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r3, 0x1, 0x2a, &(0x7f0000000100)=0xfffe, 0x4) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000240)="3d4077e50823a7746c0ee30dd0afdfb5ff2a258d495dc9d2c2a25bc7dc0b11bde0d15d0770675db17901", 0x2a}, {&(0x7f0000000080)="b28231adddba8ed6f23bf98ca8caa015ab797f57", 0x14}], 0x2, 0x0) recvmmsg(r3, &(0x7f0000001440)=[{{&(0x7f0000000280)=@un=@abs, 0x0, &(0x7f0000001400)=[{&(0x7f0000001480)=""/1}, {&(0x7f0000000300)=""/102}, {&(0x7f0000000380)=""/4096}, {&(0x7f0000001380)=""/111}]}}], 0x700, 0x40002002, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xffc1) setsockopt$sock_int(r3, 0x1, 0x10, &(0x7f0000000180)=0x55b7, 0x4) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 2.261908507s ago: executing program 0 (id=513): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010101}]}, &(0x7f0000000180)=0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$EBT_SO_GET_INFO(r2, 0x0, 0x80, &(0x7f00000001c0)={'nat\x00', 0x0, 0x0, 0x0, [0x8, 0x401, 0x5, 0x0, 0x911f, 0x100000001]}, 0x0) ioctl$XFS_IOC_DIOINFO(r1, 0x800c581e, &(0x7f0000000140)) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="6400000000010104000c0000141a000042000000240001801400018008000100e000000108000200e000e2012c00028005000100008c35c8209e1be9a3a686f14589050180080001000000000008000200ac1e00010c0002800500010000000000034000"], 0x64}}, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000040)='mem\x00\xffEev\xf2r\xf1\x18\x1d\xb9\x00y_hug$\bo-\x03Q`]o\x8cr\x9d_etl\xf9\xdd\a\xad\\H\xe94\b,H\xbf', 0x0, 0x0) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, &(0x7f0000000040), &(0x7f0000000100)=0xc) r3 = socket$inet_udp(0x2, 0x2, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl1\x00', r4, 0xc0, 0x10, 0x9, 0x0, {{0x14, 0x4, 0x2, 0x4, 0x50, 0x66, 0x0, 0x9, 0x4, 0x0, @rand_addr=0x64010100, @multicast1, {[@timestamp_addr={0x44, 0x34, 0x26, 0x1, 0x5, [{@empty, 0x7}, {@loopback, 0x53}, {@loopback, 0x8}, {@multicast2, 0x9}, {@local, 0x8000}, {@empty, 0xfffffc00}]}, @cipso={0x86, 0x6, 0x2}]}}}}}) r5 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='file0\x00', 0x0, 0x0) read(r5, &(0x7f0000000000), 0x12) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r5, 0xc0305602, &(0x7f0000000000)={0x0, 0x0, 0x3002}) 2.211794766s ago: executing program 4 (id=514): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000b00)=ANY=[@ANYBLOB="61124c000000000061138c0000000000bf2000000000000007000000080000003d0301000000000095000000000000006916000000000000bf67000000000000170600000fff07006706000002000000070600000ee60000bf050000000000001f650000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070500000419311f3d2401000000000095000000000000000500000000000000950000000000000032ed3c5be95e76b67754bb12dc8c27df8ecf264e0f84f9f17d3c30e3c72fe9755ba08508460b603daf5a7d1dbdd2d17f2f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a674f888a08034b7dd399703d6c4f633a9a4f16d0a3e1282ee45a010fb94fa9de56c9d8a814261bdb94a6538b89dc6c60bf70d742a81b72bab8395fa64810b5bb8fab4d4d897db2c544c0ec50b8eac8c63d2b1cd06a39702bd547f5ebaa6954f01cef3c9bacec15e2e3b2bd352e93a22adfe8efe33ffa78b02af242f8ee5476d4ef7a6f0c4704403b9bad2b648e90fff24f69a5ef05f5408ea197ed09a9510ee6063229de2984abdd46ea3ec78e3127002ed37c2564b8f8a621483fb2a5ff221e0d831d64759d17b8c59d0f2b06e7f6b7958fb5b939af4be5e55a95f8c6d785a91c7c3f0c17ae7f9ac5ff05f5ecddf0cef90d50e763be96496661c749e21ab63a1f50b30a65a9027ba357bf8c614497ee59b68bf6a5d45c81c567e347d545741fbbbea3e47b1750f272980087b7f8a13cce7014137f250370b8a70ae3eaf6d6f17759c3886871e97d063b7f26eed3226bb0b9ee6320a2b02fea7a06a0e37182adf9a87c0f0c8cd51e56d9e5e7708f156b6cb08566bc86ba6997bb7ae18b9cdf9e6cfda9c6390190e2d468e8c38a818a6a1397b5fbbaa4ddc9a36df424135a28d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) 2.09880167s ago: executing program 4 (id=515): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x1000}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c090) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 1.80716038s ago: executing program 1 (id=516): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x129642, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x202000, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x10001, 0x1, 0x9, 0x8000, 0x3, 0x5, 0x6, 0xb762, 0x4, 0x40007, 0x8, 0xf, 0x2, 0x80000001, 0x400, 0x1007fc, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xffffe4f5, 0xd6, 0x4, 0xfffb, 0x7, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0x2, 0x7, 0x6, 0x99, 0x9, 0x5, 0x6, 0x7, 0xfffffff7, 0x6d, 0x4, 0x9, 0xd05, 0x1000044, 0x8, 0x8, 0x1, 0xfffffffb, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x400, 0x8, 0x7, 0xcd, 0x4, 0x80000000, 0xc, 0x4, 0x65, 0x91, 0x659, 0x9, 0xb, 0x9, 0xc28, 0xd, 0x7, 0x3, 0x401, 0x3, 0x2, 0x7, 0x1, 0x10001, 0x3, 0x7, 0x4, 0x8, 0x8, 0x7, 0x1, 0x1, 0x1, 0x7, 0x40, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0x3, 0x7fffffff, 0xff, 0x9, 0xa7, 0xf, 0x1, 0xffffffff, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0x6, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x400002, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0xfffd, 0x2, 0x6, 0x3ff, 0xf04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x6, 0x9, 0x3, 0xfffffffb, 0x20001, 0x0, 0x3, 0x2, 0x5, 0x8, 0x3, 0x8, 0x800, 0xf06, 0x8, 0x7ff, 0x0, 0x9, 0x6, 0x5, 0x400001, 0x4d15, 0x1ff, 0x7, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x2, 0x5, 0x42ba, 0x400004, 0x9, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0xa89, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x5, 0x40ffe, 0x180000, 0x8000, 0x3, 0x200, 0x80, 0x6, 0x9aa, 0xe4cb, 0x402, 0x1, 0x1ff, 0x5, 0x9b4, 0x1, 0x8, 0x0, 0x8, 0xfffffffc, 0xd, 0xfffffffd, 0x4, 0x8, 0x901, 0x5, 0x2, 0x7b, 0xfffffeff, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x10000068, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x4, 0x80000000, 0x7, 0x0, 0x7, 0x8001, 0x2, 0x6, 0x4, 0xc, 0x8, 0xc9cd, 0x2, 0x9, 0x0, 0x200, 0x3, 0x9, 0xd, 0x2, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x3, 0x1000009, 0x3, 0x9, 0x0, 0x401, 0x3, 0x6, 0x33, 0x6, 0x8, 0x8001, 0x4, 0x6, 0x7, 0x5, 0xd, 0x2, 0x7, 0x1, 0x8, 0x3, 0x81, 0x3, 0x9, 0x8001, 0x20000c9, 0x5, 0x65e1, 0x10001, 0xc, 0x48001, 0x0, 0xe, 0x3, 0x97, 0x7, 0xb, 0xffff6f3c, 0xbc4, 0x803, 0xb4, 0xf, 0x1, 0x3, 0xff, 0xfff, 0x0, 0xee3, 0x43, 0x9, 0x1, 0x3, 0x1, 0x3796, 0x6, 0x6, 0xbe, 0x3, 0x45, 0x1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x1, 0x9d6, 0x9, 0x6, 0xea6, 0x3, 0x5, 0x10, 0x8, 0xffffffff, 0x3ff, 0x96, 0x7, 0x2, 0x6, 0x9, 0x5, 0x5, 0x3, 0xd7da, 0x82, 0x7f, 0x9, 0x4, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x2, 0x5, 0x1ff, 0x4, 0x6, 0x1, 0x7, 0x7ff, 0xfffffffe, 0x0, 0xb, 0xfffffff7, 0x8000008, 0x101, 0xc57, 0x5, 0x2, 0x5, 0x8, 0x0, 0xf, 0x1982, 0x1, 0x80000000, 0x1, 0x9, 0x6, 0x7ffc, 0x2, 0x1, 0x2, 0x2, 0x9, 0x5, 0xffffff1c, 0x5, 0x5, 0x7, 0x692, 0x92, 0x4, 0x0, 0x2, 0x9, 0x1b8f, 0x14, 0x65, 0xc00, 0x9, 0x9, 0x3, 0x88, 0x10004, 0x295, 0x6, 0xcb1, 0x1, 0xb7e, 0x10001, 0x8000002, 0xa, 0x6, 0x1, 0x2, 0x3ff, 0xfb5, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d4, 0x2, 0x8000, 0xec, 0xd, 0x5, 0x84d3, 0xfffffeff, 0x2, 0x5, 0x7fffffff, 0x80, 0x2, 0x90, 0x2, 0x6, 0x3, 0x70, 0x0, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0x7, 0xa4a, 0x7, 0x400, 0xc, 0xfffffff9, 0x8001, 0xd, 0x1, 0x9, 0xfff, 0x421, 0x3ff, 0x2, 0xd, 0xfb6, 0xc, 0xfffffffd, 0xac, 0x0, 0xa, 0x0, 0x6, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x0) 1.766862548s ago: executing program 4 (id=517): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x4, 0x35dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, 0x0, 0x20004890) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200e61114120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 1.470185689s ago: executing program 1 (id=518): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x22020600) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x0) r0 = creat(&(0x7f0000002700)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000003700)) r1 = gettid() r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x1003ffffffc]}, 0x8, 0x800) poll(&(0x7f0000000000)=[{r2, 0x5}], 0x1, 0x90) timer_create(0x3, &(0x7f0000000040)={0x0, 0x11, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x0, 0x1}, {0x0, 0xe4c}}, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) sync() syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='attr/fscreate\x00') prctl$PR_SET_SECUREBITS(0x1c, 0x2c) setuid(0xee00) setgroups(0x0, 0x0) getgroups(0x1, &(0x7f0000000b00)=[0xee00]) setregid(0x0, r3) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xffffffd3) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1a7) 1.348578754s ago: executing program 4 (id=519): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x48800}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000500)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd27, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x8, 0xffff}, {}, {0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x21, 0x2}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) 1.193087306s ago: executing program 3 (id=520): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x0, 0x69, 0x9}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c090) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c6572"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 1.150161894s ago: executing program 4 (id=521): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f00000007c0)={0x8, {"dc5d3b0169633d3eba3eabbc09167be55101d4af4b22a373236464d2dbfaa84399b77bd438a54364a7ebc5bdaab4f9decb7c044318cd59a0af8279bcab35dd7daf7a0ceb381df2c32eff45b13e2c8f40e1895355bf6f165200cb1ca41a155730ee2e9f83183e9fafe029d0401b0770618254a8b2dc87b630072b1e2de160d1afed51b74c14b71ec1b226a324482d14ad586b1a4ce80e458fe45244c01eddeddf3564af838d6d5324f8a77023d6eb7aa14397a0e1413ea1c3dfdf063a35b709e627f36fe403ee3117365be5017682f53595f28543062c740a94a794312f5cebc315044b8ea000a5d0f27812ab0ce149d11e6f6f7620c5f3e250bf67d13a1ca39dbb7b8b5a31e3d7ba7ebe5849a7a09b61fc9f2cfc54b89e9cd0105bca49483ce55e0187ce2ad692a18219d881057c838587b915337169ee054655f26a04df913a658fccbf4def6aad750ca4796b74d322c67e9d4ee6a530a22dcc35db850b424d6ec9f62495b9f9fd2b000feadd57d26dbd505798c208d91eb0aab0fd97537631b8bf81ce0e2241c4272be4ff69b390e4485d574146b76d1fdbf7fc5334906805534cdae1e47240af7761a18fc8bd0a694be47529da98bc0f98eb7db3fc4a74cbb6e486f4de90fbf2452e72c2e1dca44543ad9ad094b8bc861eef1e814662d0b350339e3a510d459c6f83aabd5fd3dcb38224056d761e7df9b482b9905f1e2135c1929be328ecdb69c007a3efd548502c83106f6df1ab1178fac499eda92ad4373155227ec2df150c919d322ecb3ea37e659285f18a3e2f79b59900ca438df3a1381380a12d3ad7678e0a8d3bdfb40651389b4ac8c66138d442d70eafdc2df8b080028006b124e4ebe0d9883ef100f1934e425a4146056d800975675bb1913142adbc039a9c68c2f146a0e8903447313f5e5549905f397a9b1f21a93b80c4d04a8ea7a29a50fbc5407a9305bba420edf898ea678d6879489c39692c99bb6dacf61f5f97637b94c1031d635b5423d27f7b78fafa060000006eadc21466af5a10281e6a808748969d29efb444c99a4cb2111732a792dbca4376a125a68f7cdac065cc6173dc21caafba48c742d9a7df2f771ff2f5725b22c247d4e0c6106f9f5f6929b69929ab37e9a9b326ce618bb702b883b12026f1300f21f2c7440cac8c5f1210a78aa067211d2827f5dcc7578252c2ccc3f67bab9d1bb6939b21b550788ef550acfed4bf50c0b4fb3ca4d2872ee64f95d611a317d9daaf373a10d868680b2226396c95fa2b0ab4d6fce06c3b42cb97d17a7b5089061537fdeb1a53040869f7befca330358fdba86754fc2e46c2113e1484cb37534af8f0408a7ee313778dab49f08229964298f847ea66c4ec319f64b6a12da585bc59e82e0263c507b397d3efee3b4066f4d25566aa1549f6185f6375f84b65fa8945148b90430c86a5b6fdf58d5c812b98d9dc621fd9a3d9f1a577495356516d1cbcf5e8bb8923b54b247225b9c3892b18a9e137f3620c734052af9dc8f1ea36f0d4592d5ee32e35676a84dc891f97456f2ac3a4ab58a42bcdc221a4ac8bb28d428add2fcbe5b110a8afd5d23b31e827bd16167b2d88cae024afc04a722ac0b4d45c52512e6b6f102aac4be21bc89ce246539048370553665b0a4336a6db99d0d19399be6437bf21419304331b4342b2c1db580f0c9bf681fdb8e9fa3e025454197bbc82ef93ee2f385660818ec5127080675a8013766469afe3b1e36e81bf2f04c3a26eaf4517551e734d21ba3bc90e48aea0891792970c39f3f528397e9b7ae190f1760fe5960dc763ee0a17939c60bfcac0a8914be82c749e4fe85d1ac5fa733413468fb8941085e8c4d6e0b6d1e62e20da58440facd640ddbb6c1f694b3ca48757a34c5a11668368711a1d4f3a81d31ac30d71277d7ae77882b6841cfa6289e6cce84a3ad57eeb328f831888ac7d3cfcd3a472a48d903f20cec8c8ae8d0bea04ebf7413ef7693f8ed876e49bd5f89d7e1078208ff62712e330fc0341b9ccf26845578d44b1e0c66d1bebc14742baedfabb8e9a2c8f42730360c72997efe0ce786ff330c2eb6e0ff20896f813c2a515ce76f87d2a1a1c1588eb369231ddeb4a2f9f9591ecdecc74d20aeb50047beb3ab89a9e4e1b805a20b645c79d0bc5d0247fab8ba46a97a07630b1f1cb69b42b568af746733d2c581f057873d64fe6e659b00b4a26745f5fba1fe7406a86b007936c7cfdac53a4c5b0ea9f6604863c8e3f174eddbb09175f6e13cda9a860cf400ef9ed02b895502ac6e6de6a658249c3c6e8a653517eae2231e56e0f120547923c6549ebc1ed14c623637ce3d96af5c93a32e58e2d9659d8b5b145888b52d9a5b5cb3cdf594eb137bcef2ba068cfd2c6ccf7ab6e5b4ec55e9197bfb91c9b8729f7b50cf0b0326f7ea3e712c77674d48545ca2a86744c3c38f149d69cf811beacf7e5f49c7bfba20f1dcf3d7bc0b9c796016820a46495d244c9606a06fe2e14233eda78d69ae4523ad7b708b0c7ead44d7fd376fed60e3cc2ee25e9600adfbe87ac7c8fb8269aec9459602af0f420becda6120ce7d9626c65ae7f860639e8bf664eb4301ec18add0e436c0356c12ab6b4ca35da2b43c4a8c239fd0b59a2ce94843cdfa1667053165053633b062844dbb0d00070fde74fa3178eb5f1f5fd02e2088d8690379f39ab22c080cdcb29d700bac74fabd8a356fe99afe83a5d99aa5024e9158a299eda6c99b6701e64f1d68e7e2c0c6e88396bb535a02d0948f0a250a6e090041c96d9c9acd6134d44d516fd1010c39e572b86b05bb1326a2a4f23f11181186f9c2a01dc7b58c0129f4b851ca9b1e3dc35db7364e29ef646211796b1651511e041345abce427fa5d6e48b8fb078c8432061a4cc518a8f2a2caf709a5c1473a62112a6650afc64eec12f8f9c08cff1b6fbf7a1209fc8661f62303b7c5d49c1d0b32a9f37e81ed9ab6193816d40995ed49c10b9f5752e04d57535a3d16f06c65d32846c31ec9787ec4a965679eb804e86b45d007f38d8104550770dc6f313bc846e43a14a8c21d0628c744e3e83cb998d1b7acfe996541a8c03852dadf9326444c582b481cae844e4f3fe3d638903b38f24633b63adbad841ac6c4c1169d781a0e271e8a967b1c7e986fcb3a66168e86e3559a44fcfa92452260491da9397659af60453f4cd4be2d15439445ec2b4366a79d3283da912d9d499df1242bd174edc235848caa21d2c997aff0e95c7e5cc0803c90fab84e7be7b37909d0388acb6800baba183ecc8eea8c71c0d65d669e41f99ceae523b7a6b772f3b8ebba1d2127ccc3ddb7ddcb4ec73cbdc26fc87c3848e258a0b5484d3a13e40ec4e4a65dd92f09e9fe1e3e2f8b96c4e363aa3683860dee62dfcf8823ee4a3593a092e0bd9c4cedacf44a272faa164447b01f46a7795642a40c61b0034a37f0e9b792428a0ddcd144fe8263088eaac8016f8f1cd30b55ac90a8f10d785b7570dd9e639a4a068d3fe98a42010e24f69de817f676c2a224300d749571ad43f49d1fbe838f4566bc7b5f104c384ad87189213152b644d9fcbdf98bafeee569d640ce9045779f1d90024c023a7480a358dee276fba139c14b4fdb12885240903d0e61dc161659a68f62c92b899007e0f2b65bf0a069e9e57c9b6ae50a3b30dd1003fb0eead73ae2f6010b3b356b4060579a4f29935e1f00c01d12e5f44e8e3163d81dfef7ca8560604240c7e96e4454c6971614df306c768121abb3f628e3f1d2d026f58d1087334c5bdb74d7c949b0ee66a4531ba4e9b922aee3d0f802ed034734507a5913c52966f1f8bd4577840de0253aabc23299dced2a299859c07af9fb0f9c29b6533b9d84d471390d59ab315f5ddb226f6b8dd7889295f0fb1f7bd1adafe4cc520a1e84bf2a59d5b9795aeafc8d6fd66a8228aba8653b98622617ddfeb5d6795c9bd2f35d4a0c386e862675a50e3314c3fbb17aca151c13c7fc8b1d1b72ed0a958537b5ddc9e74bddc2b9571ec3f2b7775b125338d4852a75a63941564c65bb36dfb6bea4aab1ae7a4f285c2177aa98406eb2cc10934aa92d5a9612d4455c84ad200841d289b5c2d5deab0d8e2459598ef183d3dc46f6bad0b9513710600cfa4d69fcd5763cdcc4f2c2b7cd7d4491fd52f4aec82ce846c0988f6f0123e21e900d39c61085e68c9badc350b44004f6c042d64b0d0cbf91ad0592b198f1eeea1e52200bc8e6d62848d6884b10bdde72466039da488be6b340c23148f666f2fe6e032c07dac43586df182aca9116f4600313fa8375c76337ba86bdc391dae6450218f58f047ced64befc6bb5c2a60024669630a6279fedf2fe45e7e19ce582ad96ae0d023eb9b39f5f1e666e73bb038ae38157275be5eb3e7cbc8b05adf53e817646bdc2cfce98e5d162bf7faaca787db8717ab8b27b9e35609c5fb9fe9def07f010df8b43cf5c96851eadfdeff0b7bc5826e7e15490ae9c3d14166ee81bef007070e7981235a673804ad89943ee6b51ac63364f7870e121e6ff23a0c7d179527cd58dd7a4ca37247c2bd9efc79b720bb1ee2d39862e98cb81e93cf5b48d5d02ee8ac737ab504c867a1c49e678300803c94fbe978dea918a1e71b9791ee1e4d30056e86c26a4670b451a13ece52a89a7057fe2052e11c6666eb916d823ea66bf217c320acba3b714910734b2d27c2fa586bd7f7664b0d1422adabad2ce2afc10270057f11940fac1a51d023ce48bd04ea39b7f99381b239fd0ddeea0dce7863ec1f8f61775013b6414ecf86e686a340a3148f87a9d7d60a1f2da53436d16fc88d6a4e7c3d55e0dd004cbecc15a5558eb705d82aacb1862ddc251dd5d9cbf1d78f97900ce6e8dab0ea678cb823bd1e7bbd1e927878c19f4f322228f9b36287fc13e7c1293ea875ae73815e052d6c2ebc40df8f7b9d1f76e0b10e35aa160944983d8e6b790df0d9b13f3460657336d81f7d83c0350324b930ec9c7557ce12887f76372e126f504b0980fea27f31a780c05187b9b5353dafc6b101543b24332b96e15bc26b19062e52fa9f86d260ee3a3bc92a133e328407bb85357ee5c45cb87228f44888b14941b5911b050e9319fe88033f830a8490917a9c0572ebbc5492b4e1083a2e3d77215a34abef947b5b9a950e780662de18873e55899c92db3ad3d437e8407890afa6b0c04ef861b8bc85fbbe1bb67b3d9ef001409f84b8ec4f01d861cecc143a805b981ab5cf5b605057b63cb2c84ec358e510a69cd8c33a8a62fe4680d0c980145cc709157832bfaef261cb0466c237376ca2944ce9affffd4b1dc7cc9511da0b34bffb9ac216fb8cf7c6572d95627787720d1ba67c6512fcdb16f6329e9668681c404efebad559f81f05971b5efb6b4cca97ad0346753cc0a40a877242d8a808c602b03dc962cee38e646cb18abb079c70d357c30738a70f55cd3c5956a83a1bfcd6649dd765f16bfe968066345df7380bbc0c16b3b5af513d6458c791343952f33a051c5d711c1f35af1b47f3db9bbfb5c7c636b3a2b52805d606479879be0b404a28ade5649a3185e0f85a85fc15cd824671c2befdd0da509597c87d869f0bd7ad163ad93ca28fc0c4025eccaafe385ec3fc06c54ebcd7b07b6c7e0197c5b9ef886159a1585ae45248f865be760db6f5bc8f868fc6aefd04e34ecb51159e4cdcc2214b42b1ca9caec13ba3e1b2e7a3c736977b226213d265c2873195122a9b448088c8b50edd549be41c38ab176807b75e7267f86e400000000000000000000000000000001df00", 0x1000}}, 0x1006) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) r5 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r5, &(0x7f00003a1000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f0000000000)="9a01000000f800b8d58800000f23d00f21f8351000000d0f23f864640f79ea66baf80cb8c85f5480ef66bafc0cecc4c2adac17b9550200000f320f2860c7c4e11751df0f2e2d00000080b9800000c00f3235008000000f30", 0x58}], 0x1, 0x4a, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902120001000000"], 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r7, 0x4048ae9b, &(0x7f0000000080)={0x70003, 0x0, {[0xffffffffffffffff, 0x1f8, 0x2, 0xffffffffefffff15, 0x3, 0x4, 0x1, 0x4]}}) ioctl$KVM_RUN(r7, 0xae80, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r4, {0xb, 0x6}, {0xffff, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x8, 0xfff, 0x10000000, 0x7, 0xccb}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd0000110005000000a60c6b63851e0f982c"], 0xfce) 868.198852ms ago: executing program 2 (id=522): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, &(0x7f00000001c0)=ANY=[], 0x0, 0x0}, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000100)={0x0, 0x6, 0x2, &(0x7f0000000140)={0x2, "1a9c66bf2f615e427b2644e953449f6c12f206b2855cd8c82b1b9950cf5e1dee93"}}) 837.671498ms ago: executing program 0 (id=523): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000001000)={0x73622a85, 0x10b, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x54, 0x0, &(0x7f0000000e00)=[@acquire, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x58, 0x18, &(0x7f00000006c0)={@ptr={0x70742a85, 0xfffffffe, 0x0, 0x0, 0x2, 0x32}, @fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000bc0)={0x0, 0x28, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f00000004c0)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x1001}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) prlimit64(0x0, 0x7, &(0x7f0000000ec0), 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x1000000000000, &(0x7f0000000340)="cb"}) 779.45811ms ago: executing program 3 (id=524): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000380)={0x8, 0x4d, 0x2ba8}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) r1 = syz_usb_connect(0x5, 0x35, &(0x7f0000000500)=ANY=[], 0x0) syz_usb_disconnect(r1) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, &(0x7f0000000780)={0x34, &(0x7f0000000580)={0x20, 0x16, 0x1, "c2"}, 0x0, 0x0, 0x0, 0x0, 0x0}) 652.770316ms ago: executing program 0 (id=525): bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r3, 0x1, 0x2a, &(0x7f0000000100)=0xfffe, 0x4) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000240)="3d4077e50823a7746c0ee30dd0afdfb5ff2a258d495dc9d2c2a25bc7dc0b11bde0d15d0770675db17901", 0x2a}, {&(0x7f0000000080)="b28231adddba8ed6f23bf98ca8caa015ab797f57", 0x14}], 0x2, 0x0) recvmmsg(r3, &(0x7f0000001440)=[{{&(0x7f0000000280)=@un=@abs, 0x0, &(0x7f0000001400)=[{&(0x7f0000001480)=""/1}, {&(0x7f0000000300)=""/102}, {&(0x7f0000000380)=""/4096}, {&(0x7f0000001380)=""/111}]}}], 0x700, 0x40002002, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xffc1) setsockopt$sock_int(r3, 0x1, 0x10, &(0x7f0000000180)=0x55b7, 0x4) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 482.685611ms ago: executing program 0 (id=526): fsopen(&(0x7f0000000140)='pipefs\x00', 0x0) close(0xffffffffffffffff) syz_clone(0xe50c1700, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r0, &(0x7f0000000480)=""/74, 0x4a) write$char_usb(r0, &(0x7f00000003c0)="90", 0x1) syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x0, 0x0) setsockopt$MRT6_TABLE(0xffffffffffffffff, 0x29, 0xcf, &(0x7f0000000040)=0xff, 0x4) 34.320613ms ago: executing program 1 (id=527): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000b00)=ANY=[@ANYBLOB="61124c000000000061138c0000000000bf2000000000000007000000080000003d0301000000000095000000000000006916000000000000bf67000000000000170600000fff07006706000002000000070600000ee60000bf050000000000001f650000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070500000419311f3d2401000000000095000000000000000500000000000000950000000000000032ed3c5be95e76b67754bb12dc8c27df8ecf264e0f84f9f17d3c30e3c72fe9755ba08508460b603daf5a7d1dbdd2d17f2f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a674f888a08034b7dd399703d6c4f633a9a4f16d0a3e1282ee45a010fb94fa9de56c9d8a814261bdb94a6538b89dc6c60bf70d742a81b72bab8395fa64810b5bb8fab4d4d897db2c544c0ec50b8eac8c63d2b1cd06a39702bd547f5ebaa6954f01cef3c9bacec15e2e3b2bd352e93a22adfe8efe33ffa78b02af242f8ee5476d4ef7a6f0c4704403b9bad2b648e90fff24f69a5ef05f5408ea197ed09a9510ee6063229de2984abdd46ea3ec78e3127002ed37c2564b8f8a621483fb2a5ff221e0d831d64759d17b8c59d0f2b06e7f6b7958fb5b939af4be5e55a95f8c6d785a91c7c3f0c17ae7f9ac5ff05f5ecddf0cef90d50e763be96496661c749e21ab63a1f50b30a65a9027ba357bf8c614497ee59b68bf6a5d45c81c567e347d545741fbbbea3e47b1750f272980087b7f8a13cce7014137f250370b8a70ae3eaf6d6f17759c3886871e97d063b7f26eed3226bb0b9ee6320a2b02fea7a06a0e37182adf9a87c0f0c8cd51e56d9e5e7708f156b6cb08566bc86ba6997bb7ae18b9cdf9e6cfda9c6390190e2d468e8c38a818a6a1397b5fbbaa4ddc9a36df424135a28d1e5eaa50850ade812fe83ac7ea0136dc3729879ca51977eef8c2c546938b7b8a4656a71a783b302d7918e6c206af73"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) 0s ago: executing program 1 (id=528): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x1000}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c090) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) kernel console output (not intermixed with test programs): ] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 67.188969][ T2301] usb 2-1: config 0 descriptor?? [ 67.311040][ T4452] loop3: detected capacity change from 0 to 256 [ 67.359929][ T4452] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 67.395086][ T13] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 67.428872][ T13] usb 1-1: config 8 has 0 interfaces, different from the descriptor's value: 1 [ 67.451427][ T4452] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 67.474625][ T13] usb 1-1: New USB device found, idVendor=046d, idProduct=0960, bcdDevice=97.b4 [ 67.492221][ T1424] ieee802154 phy0 wpan0: encryption failed: -22 [ 67.498855][ T1424] ieee802154 phy1 wpan1: encryption failed: -22 [ 67.573622][ T2301] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 67.612810][ T13] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 67.667599][ T4454] device syzkaller0 entered promiscuous mode [ 67.898831][ T4459] netlink: 4 bytes leftover after parsing attributes in process `syz.2.68'. [ 67.925341][ T7] corsair-psu 0003:1B1C:1C03.0002: hidraw0: USB HID v0.00 Device [syz1] on syz0 [ 67.978639][ T4459] netlink: 4 bytes leftover after parsing attributes in process `syz.2.68'. [ 68.119830][ T4459] bond0: (slave bond_slave_0): Releasing backup interface [ 68.214263][ T26] kauditd_printk_skb: 292 callbacks suppressed [ 68.214282][ T26] audit: type=1326 audit(1790541103.505:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4465 comm="syz.4.70" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 68.248840][ T7] corsair-psu 0003:1B1C:1C03.0002: unable to initialize device (-110) [ 68.290823][ T7] corsair-psu: probe of 0003:1B1C:1C03.0002 failed with error -110 [ 69.363029][ T4467] ip_tables: iptables: counters copy to user failed while replacing table [ 69.423985][ T4469] capability: warning: `syz.2.71' uses deprecated v2 capabilities in a way that may be insecure [ 69.438820][ T13] usb 2-1: USB disconnect, device number 3 [ 69.598244][ T4471] device syzkaller0 entered promiscuous mode [ 69.609367][ T26] audit: type=1326 audit(1790541103.505:305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4465 comm="syz.4.70" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 69.689282][ T4474] tipc: Enabling of bearer rejected, failed to enable media [ 69.708005][ T4477] loop4: detected capacity change from 0 to 512 [ 69.745860][ T13] usb 1-1: USB disconnect, device number 2 [ 69.847160][ T26] audit: type=1326 audit(1790541103.545:306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4465 comm="syz.4.70" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fddb8f0c98e code=0x7ffc0000 [ 70.058176][ T4485] device syzkaller0 entered promiscuous mode [ 70.109121][ T26] audit: type=1326 audit(1790541103.545:307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4465 comm="syz.4.70" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 70.228062][ T4492] tipc: Started in network mode [ 70.262645][ T4492] tipc: Node identity 0219680d82c6, cluster identity 4711 [ 70.295412][ T26] audit: type=1326 audit(1790541103.545:308): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4465 comm="syz.4.70" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 70.345122][ T4492] tipc: Enabled bearer , priority 0 [ 70.395915][ T4493] device syzkaller0 entered promiscuous mode [ 70.478446][ T26] audit: type=1326 audit(1790541103.555:309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4465 comm="syz.4.70" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=199 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 70.517556][ T4492] tipc: Resetting bearer [ 70.588710][ T4495] device vlan2 entered promiscuous mode [ 70.636989][ T26] audit: type=1326 audit(1790541103.555:310): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4465 comm="syz.4.70" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 70.676230][ T4500] loop1: detected capacity change from 0 to 8192 [ 70.699706][ T4490] tipc: Resetting bearer [ 70.722166][ T4490] tipc: Disabling bearer [ 70.812409][ T2301] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 70.822178][ T4503] netlink: 4 bytes leftover after parsing attributes in process `syz.4.81'. [ 70.839844][ T26] audit: type=1326 audit(1790541103.555:311): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4465 comm="syz.4.70" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 70.930711][ T4503] device hsr_slave_0 left promiscuous mode [ 71.017498][ T26] audit: type=1326 audit(1790541103.555:312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4465 comm="syz.4.70" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 71.112524][ T2301] usb 4-1: Using ep0 maxpacket: 8 [ 71.126328][ T4509] loop2: detected capacity change from 0 to 512 [ 71.236522][ T26] audit: type=1326 audit(1790541103.555:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4465 comm="syz.4.70" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 71.261051][ T2301] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 71.303881][ T4509] EXT4-fs (loop2): mounted filesystem without journal. Opts: noauto_da_alloc,errors=remount-ro,. Quota mode: writeback. [ 71.356165][ T2301] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 71.388074][ T4509] ext4 filesystem being mounted at /18/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 71.414511][ T2301] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 71.448285][ T2301] usb 4-1: config 0 descriptor?? [ 71.804837][ T2301] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 71.845824][ T4528] device syzkaller0 entered promiscuous mode [ 71.871474][ T4529] Zero length message leads to an empty skb [ 72.364263][ T2301] usb 4-1: USB disconnect, device number 2 [ 72.675311][ T4548] tipc: Enabling of bearer rejected, failed to enable media [ 73.189008][ T4558] device syzkaller0 entered promiscuous mode [ 73.303299][ T4564] tipc: Enabling of bearer rejected, failed to enable media [ 73.467752][ T4567] device syzkaller0 entered promiscuous mode [ 73.858783][ T4578] tipc: Started in network mode [ 73.893845][ T4578] tipc: Node identity a60b84b44dcd, cluster identity 4711 [ 73.929223][ T4578] tipc: Enabled bearer , priority 0 [ 73.964612][ T4583] device syzkaller0 entered promiscuous mode [ 73.998440][ T4578] tipc: Resetting bearer [ 74.037210][ T4577] tipc: Resetting bearer [ 74.081540][ T4577] tipc: Disabling bearer [ 74.203982][ T7] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 74.295243][ T4594] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 74.406560][ T4596] FAULT_INJECTION: forcing a failure. [ 74.406560][ T4596] name failslab, interval 1, probability 0, space 0, times 1 [ 74.456735][ T4596] CPU: 0 PID: 4596 Comm: syz.1.117 Not tainted syzkaller #0 [ 74.464037][ T4596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 74.474088][ T4596] Call Trace: [ 74.477348][ T4596] [ 74.480259][ T4596] dump_stack_lvl+0x188/0x250 [ 74.484927][ T4596] ? show_regs_print_info+0x20/0x20 [ 74.490103][ T4596] ? load_image+0x410/0x410 [ 74.494584][ T4596] ? __might_sleep+0xf0/0xf0 [ 74.499164][ T4596] ? __lock_acquire+0x7b50/0x7b50 [ 74.504179][ T4596] ? do_syscall_64+0x4c/0xa0 [ 74.508747][ T4596] should_fail+0x383/0x4b0 [ 74.513145][ T4596] should_failslab+0x5/0x20 [ 74.517624][ T4596] slab_pre_alloc_hook+0x51/0xc0 [ 74.522537][ T4596] kmem_cache_alloc_node+0x47/0x2c0 [ 74.527709][ T4596] ? alloc_unbound_pwq+0x8a4/0xdf0 [ 74.532797][ T4596] alloc_unbound_pwq+0x8a4/0xdf0 [ 74.537714][ T4596] apply_wqattrs_prepare+0x382/0xad0 [ 74.543001][ T4596] apply_workqueue_attrs+0xd0/0x170 [ 74.548191][ T4596] alloc_workqueue+0xf1e/0x1450 [ 74.553018][ T4596] ? vsnprintf+0x1b22/0x1c20 [ 74.557590][ T4596] ? snprintf+0xe5/0x140 [ 74.561807][ T4596] ? lockdep_init_map_type+0x98/0x900 [ 74.567157][ T4596] ? apply_workqueue_attrs+0x170/0x170 [ 74.572591][ T4596] ? memset+0x1e/0x40 [ 74.576568][ T4596] ? lockdep_init_map_type+0x98/0x900 [ 74.581921][ T4596] nci_register_device+0x3fc/0x9f0 [ 74.587016][ T4596] ? nci_free_device+0x90/0x90 [ 74.591781][ T4596] ? nci_hci_allocate+0x1dd/0x2a0 [ 74.596780][ T4596] ? nci_allocate_device+0x241/0x350 [ 74.602055][ T4596] virtual_ncidev_open+0x55/0xc0 [ 74.606973][ T4596] ? virtual_ncidev_ioctl+0x90/0x90 [ 74.612165][ T4596] misc_open+0x31f/0x390 [ 74.616392][ T4596] chrdev_open+0x585/0x5f0 [ 74.620791][ T4596] ? cd_forget+0x160/0x160 [ 74.625188][ T4596] ? fsnotify_perm+0x3a7/0x560 [ 74.629934][ T4596] ? cd_forget+0x160/0x160 [ 74.634414][ T4596] do_dentry_open+0x7f7/0xf90 [ 74.639076][ T4596] ? vfs_open+0x2b/0x80 [ 74.643214][ T4596] path_openat+0x2718/0x2fb0 [ 74.647811][ T4596] ? __kasan_slab_alloc+0xa9/0xc0 [ 74.652816][ T4596] ? do_filp_open+0x400/0x400 [ 74.657503][ T4596] do_filp_open+0x1df/0x400 [ 74.661998][ T4596] ? vfs_tmpfile+0x300/0x300 [ 74.666586][ T4596] ? _raw_spin_unlock+0x24/0x40 [ 74.671415][ T4596] ? alloc_fd+0x59e/0x650 [ 74.675728][ T4596] do_sys_openat2+0x14b/0x500 [ 74.680412][ T4596] ? __lock_acquire+0x7b50/0x7b50 [ 74.685429][ T4596] ? do_sys_open+0xe0/0xe0 [ 74.689824][ T4596] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 74.695805][ T4596] ? lock_chain_count+0x20/0x20 [ 74.700657][ T4596] __x64_sys_openat+0x135/0x160 [ 74.705495][ T4596] do_syscall_64+0x4c/0xa0 [ 74.709900][ T4596] ? clear_bhb_loop+0x30/0x80 [ 74.714557][ T4596] ? clear_bhb_loop+0x30/0x80 [ 74.719229][ T4596] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 74.725130][ T4596] RIP: 0033:0x7f097ebb2159 [ 74.729528][ T4596] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.749156][ T4596] RSP: 002b:00007f097ce0a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 74.757580][ T4596] RAX: ffffffffffffffda RBX: 00007f097ee39fa0 RCX: 00007f097ebb2159 [ 74.765546][ T4596] RDX: 0000000000000002 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 74.773516][ T4596] RBP: 00007f097ec4906b R08: 0000000000000000 R09: 0000000000000000 [ 74.781471][ T4596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 74.789421][ T4596] R13: 00007f097ee3a038 R14: 00007f097ee39fa0 R15: 00007ffd1890a9a8 [ 74.797473][ T4596] [ 74.804020][ T7] usb 4-1: Using ep0 maxpacket: 8 [ 74.944574][ T7] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 74.998516][ T7] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 75.029089][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.076811][ T7] usb 4-1: config 0 descriptor?? [ 75.358918][ T4611] tipc: Enabling of bearer rejected, failed to enable media [ 75.374845][ T7] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 75.760407][ T4600] loop0: detected capacity change from 0 to 512 [ 75.820782][ T4600] EXT4-fs (loop0): Ignoring removed oldalloc option [ 75.928504][ T4600] EXT4-fs error (device loop0): ext4_validate_block_bitmap:429: comm syz.0.118: bg 0: block 5: invalid block bitmap [ 75.953657][ T4231] usb 4-1: USB disconnect, device number 3 [ 75.970827][ T4625] netlink: 28 bytes leftover after parsing attributes in process `syz.4.121'. [ 76.060424][ T4600] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 76.137677][ T4600] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #11: comm syz.0.118: invalid indirect mapped block 3 (level 2) [ 76.162300][ T4632] FAULT_INJECTION: forcing a failure. [ 76.162300][ T4632] name failslab, interval 1, probability 0, space 0, times 0 [ 76.186731][ T4633] tipc: Enabled bearer , priority 0 [ 76.215632][ T4633] device syzkaller0 entered promiscuous mode [ 76.225077][ T4600] EXT4-fs (loop0): 1 orphan inode deleted [ 76.230847][ T4600] EXT4-fs (loop0): 1 truncate cleaned up [ 76.242612][ T4632] CPU: 0 PID: 4632 Comm: syz.1.124 Not tainted syzkaller #0 [ 76.249902][ T4632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 76.259939][ T4632] Call Trace: [ 76.263286][ T4632] [ 76.266215][ T4632] dump_stack_lvl+0x188/0x250 [ 76.270877][ T4632] ? show_regs_print_info+0x20/0x20 [ 76.276154][ T4632] ? load_image+0x410/0x410 [ 76.280639][ T4632] ? __might_sleep+0xf0/0xf0 [ 76.285217][ T4632] ? __lock_acquire+0x7b50/0x7b50 [ 76.290234][ T4632] should_fail+0x383/0x4b0 [ 76.294650][ T4632] should_failslab+0x5/0x20 [ 76.299129][ T4632] slab_pre_alloc_hook+0x51/0xc0 [ 76.304044][ T4632] __kmalloc_node+0x6d/0x3a0 [ 76.308607][ T4632] ? kvmalloc_node+0x84/0x130 [ 76.313277][ T4632] kvmalloc_node+0x84/0x130 [ 76.317756][ T4632] __list_lru_init+0x4cb/0xac0 [ 76.322507][ T4632] alloc_super+0x787/0x970 [ 76.326899][ T4632] ? kernfs_get_tree+0x6b0/0x6b0 [ 76.331811][ T4632] sget_fc+0x2d4/0x6f0 [ 76.335857][ T4632] ? kernfs_test_super+0x100/0x100 [ 76.340948][ T4632] kernfs_get_tree+0x15c/0x6b0 [ 76.345780][ T4632] ? apparmor_capable+0x12c/0x190 [ 76.350799][ T4632] sysfs_get_tree+0x42/0x110 [ 76.355380][ T4632] vfs_get_tree+0x88/0x270 [ 76.359861][ T4632] do_new_mount+0x247/0xa40 [ 76.364369][ T4632] __se_sys_mount+0x2e3/0x3d0 [ 76.369027][ T4632] ? __x64_sys_mount+0xc0/0xc0 [ 76.373779][ T4632] ? lockdep_hardirqs_on+0x94/0x140 [ 76.378961][ T4632] ? __x64_sys_mount+0x1c/0xc0 [ 76.383707][ T4632] do_syscall_64+0x4c/0xa0 [ 76.388103][ T4632] ? clear_bhb_loop+0x30/0x80 [ 76.392759][ T4632] ? clear_bhb_loop+0x30/0x80 [ 76.397416][ T4632] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 76.403287][ T4632] RIP: 0033:0x7f097ebb2159 [ 76.407702][ T4632] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.427290][ T4632] RSP: 002b:00007f097ce0a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 76.435700][ T4632] RAX: ffffffffffffffda RBX: 00007f097ee39fa0 RCX: 00007f097ebb2159 [ 76.443650][ T4632] RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 0000000000000000 [ 76.451599][ T4632] RBP: 00007f097ec4906b R08: 0000000000000000 R09: 0000000000000000 [ 76.459563][ T4632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.467535][ T4632] R13: 00007f097ee3a038 R14: 00007f097ee39fa0 R15: 00007ffd1890a9a8 [ 76.475495][ T4632] [ 76.528684][ T4633] tipc: Resetting bearer [ 76.538290][ T4600] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. [ 76.565195][ T4630] tipc: Resetting bearer [ 76.636187][ T4630] tipc: Disabling bearer [ 76.891957][ T4649] device syzkaller0 entered promiscuous mode [ 76.986423][ T4652] device syzkaller0 entered promiscuous mode [ 77.018255][ T4652] tipc: Enabling of bearer rejected, failed to enable media [ 77.280005][ T4663] loop2: detected capacity change from 0 to 512 [ 77.404335][ T4665] loop3: detected capacity change from 0 to 256 [ 77.462099][ T4665] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 77.501007][ T4669] tipc: Started in network mode [ 77.506100][ T4233] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 77.549468][ T4669] tipc: Node identity 628d6f7f0f3c, cluster identity 4711 [ 77.578451][ T4665] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 77.597742][ T4669] tipc: Enabled bearer , priority 0 [ 77.627640][ T4672] device syzkaller0 entered promiscuous mode [ 77.709289][ T4669] tipc: Resetting bearer [ 77.769799][ T4667] tipc: Resetting bearer [ 77.798651][ T4667] tipc: Disabling bearer [ 77.893579][ T4231] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 77.902614][ T4233] usb 1-1: config 0 has an invalid descriptor of length 100, skipping remainder of the config [ 77.952265][ T4233] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 78.005276][ T4233] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 78.040445][ T4233] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 78.090012][ T4233] usb 1-1: config 0 descriptor?? [ 78.115909][ T4685] device syzkaller0 entered promiscuous mode [ 78.174071][ T4231] usb 3-1: Using ep0 maxpacket: 8 [ 78.236776][ T4687] binder: BINDER_SET_CONTEXT_MGR already set [ 78.274429][ T4687] binder: 4686:4687 ioctl 4018620d 200000001000 returned -16 [ 78.312490][ T4231] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 78.364139][ T2855] cfg80211: failed to load regulatory.db [ 78.387413][ T4231] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 78.428808][ T4231] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 78.481329][ T4231] usb 3-1: config 0 descriptor?? [ 78.508936][ T13] usb 1-1: USB disconnect, device number 3 [ 78.755358][ T4231] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 78.982443][ T2301] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 79.251754][ T4709] tipc: Started in network mode [ 79.265459][ T4709] tipc: Node identity 4ae2d124c5a, cluster identity 4711 [ 79.273108][ T4709] tipc: Enabled bearer , priority 0 [ 79.289302][ T4709] device syzkaller0 entered promiscuous mode [ 79.302082][ T4709] tipc: Resetting bearer [ 79.318289][ T4708] tipc: Resetting bearer [ 79.356058][ T4708] tipc: Disabling bearer [ 79.364882][ T2301] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 79.381143][ T4714] FAULT_INJECTION: forcing a failure. [ 79.381143][ T4714] name fail_futex, interval 1, probability 0, space 0, times 1 [ 79.396882][ T2301] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 79.409582][ T4714] CPU: 0 PID: 4714 Comm: syz.0.156 Not tainted syzkaller #0 [ 79.416872][ T4714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 79.426925][ T4714] Call Trace: [ 79.430188][ T4714] [ 79.433098][ T4714] dump_stack_lvl+0x188/0x250 [ 79.437773][ T4714] ? show_regs_print_info+0x20/0x20 [ 79.442951][ T4714] ? load_image+0x410/0x410 [ 79.447430][ T4714] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 79.453391][ T4714] ? lock_chain_count+0x20/0x20 [ 79.458219][ T4714] ? _raw_spin_lock_irqsave+0x8b/0x100 [ 79.463667][ T4714] ? lockdep_hardirqs_off+0x70/0x100 [ 79.468934][ T4714] should_fail+0x383/0x4b0 [ 79.473333][ T4714] get_futex_key+0x1a1/0x12d0 [ 79.478001][ T4714] ? futex_wait_restart+0x250/0x250 [ 79.483179][ T4714] ? __lock_acquire+0x13dc/0x7b50 [ 79.488182][ T4714] futex_wake+0x101/0x540 [ 79.492492][ T4714] ? do_inotify_init+0x450/0x450 [ 79.497416][ T4714] ? futex_wait+0x680/0x680 [ 79.501915][ T4714] ? verify_lock_unused+0x140/0x140 [ 79.507089][ T4714] ? verify_lock_unused+0x140/0x140 [ 79.512263][ T4714] ? fsnotify_perm+0x254/0x560 [ 79.517019][ T4714] do_futex+0xd83/0x12b0 [ 79.521238][ T4714] ? do_readv+0x276/0x460 [ 79.525544][ T4714] ? do_readv+0x276/0x460 [ 79.529865][ T4714] ? kfree+0x4a/0x2a0 [ 79.533827][ T4714] ? futex_exit_release+0x1c0/0x1c0 [ 79.539004][ T4714] ? __context_tracking_exit+0x4c/0x80 [ 79.544444][ T4714] __se_sys_futex+0x389/0x420 [ 79.549100][ T4714] ? __x64_sys_futex+0xf0/0xf0 [ 79.553843][ T4714] ? __x64_sys_futex+0x1d/0xf0 [ 79.558582][ T4714] do_syscall_64+0x4c/0xa0 [ 79.562988][ T4714] ? clear_bhb_loop+0x30/0x80 [ 79.567642][ T4714] ? clear_bhb_loop+0x30/0x80 [ 79.572297][ T4714] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 79.578164][ T4714] RIP: 0033:0x7f60d604b159 [ 79.582556][ T4714] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.602138][ T4714] RSP: 002b:00007f60d42a30e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 79.610529][ T4714] RAX: ffffffffffffffda RBX: 00007f60d62d2fa8 RCX: 00007f60d604b159 [ 79.618485][ T4714] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f60d62d2fac [ 79.626438][ T4714] RBP: 00007f60d62d2fa0 R08: 00136ae7f5b0c710 R09: 0000000000000000 [ 79.634387][ T4714] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000000 [ 79.642331][ T4714] R13: 00007f60d62d3038 R14: 00007ffc80f03ca0 R15: 00007ffc80f03d88 [ 79.650288][ T4714] [ 79.659078][ T2301] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 79.710896][ T4231] usb 3-1: USB disconnect, device number 4 [ 79.835102][ T2301] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 79.862505][ T2301] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.897901][ T2301] usb 5-1: Product: syz [ 79.904578][ T2301] usb 5-1: Manufacturer: syz [ 79.909244][ T2301] usb 5-1: SerialNumber: syz [ 79.923775][ T2301] usb 5-1: config 0 descriptor?? [ 80.094158][ T4729] netlink: 12 bytes leftover after parsing attributes in process `syz.1.162'. [ 80.194744][ T2301] adutux 5-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 80.306118][ T4736] loop1: detected capacity change from 0 to 512 [ 80.354461][ T4736] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 80.408350][ T4736] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 80.419933][ T4231] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 80.437025][ T4233] usb 5-1: USB disconnect, device number 2 [ 80.468720][ T4736] EXT4-fs error (device loop1): ext4_orphan_get:1436: comm syz.1.165: bad orphan inode 131083 [ 80.505696][ T4736] EXT4-fs (loop1): mounted filesystem without journal. Opts: stripe=0x000000000000003d,init_itable,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 80.703738][ T2301] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 80.794134][ T4231] usb 4-1: config index 0 descriptor too short (expected 64906, got 45) [ 80.861750][ T4746] tipc: Enabled bearer , priority 0 [ 80.886320][ T4746] device syzkaller0 entered promiscuous mode [ 80.916096][ T4746] tipc: Resetting bearer [ 80.934572][ T4745] tipc: Resetting bearer [ 80.956083][ T4745] tipc: Disabling bearer [ 80.983673][ T4231] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 81.001734][ T4231] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.048706][ T4231] usb 4-1: Product: syz [ 81.065589][ T4231] usb 4-1: Manufacturer: syz [ 81.087540][ T4231] usb 4-1: SerialNumber: syz [ 81.092640][ T2301] usb 3-1: config 0 has an invalid descriptor of length 100, skipping remainder of the config [ 81.126878][ T2301] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 81.148384][ T2301] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 81.171574][ T2301] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.196383][ T2301] usb 3-1: config 0 descriptor?? [ 81.495712][ T13] usb 3-1: USB disconnect, device number 5 [ 81.872467][ T4233] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 81.912529][ T4231] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -71 [ 82.012686][ T4231] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -71 [ 82.094744][ T4231] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -71 [ 82.132447][ T4233] usb 1-1: Using ep0 maxpacket: 8 [ 82.189784][ T4231] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 82.246736][ T4231] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 82.272539][ T4233] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 82.289070][ T4231] lan78xx: probe of 4-1:1.0 failed with error -71 [ 82.312417][ T4233] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 82.331836][ T4231] usb 4-1: USB disconnect, device number 4 [ 82.365399][ T4233] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.387012][ T4233] usb 1-1: config 0 descriptor?? [ 82.516196][ T4784] tipc: Started in network mode [ 82.521235][ T4784] tipc: Node identity 663898baa49, cluster identity 4711 [ 82.565623][ T4784] tipc: Enabled bearer , priority 0 [ 82.687556][ T4233] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 82.805930][ T4784] tipc: Disabling bearer [ 83.065083][ T4231] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 83.265559][ T13] usb 1-1: USB disconnect, device number 4 [ 83.312438][ T4232] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 83.445091][ T4231] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 83.469135][ T4231] usb 4-1: config 8 has 0 interfaces, different from the descriptor's value: 1 [ 83.495129][ T4231] usb 4-1: New USB device found, idVendor=046d, idProduct=0960, bcdDevice=97.b4 [ 83.521735][ T4231] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.704633][ T4232] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 83.715691][ T4233] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 83.745859][ T4232] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 83.818507][ T4232] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 83.848589][ T26] kauditd_printk_skb: 11 callbacks suppressed [ 83.848599][ T26] audit: type=1804 audit(1790541119.135:325): pid=4796 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.184" name="bus" dev="ramfs" ino=35369 res=1 errno=0 [ 84.082551][ T4232] usb 3-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 84.115078][ T4233] usb 5-1: config 0 has an invalid descriptor of length 100, skipping remainder of the config [ 84.146560][ T4232] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.195029][ T4233] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 84.214516][ T4232] usb 3-1: Product: syz [ 84.231377][ T4232] usb 3-1: Manufacturer: syz [ 84.269239][ T4233] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 84.282558][ T4232] usb 3-1: SerialNumber: syz [ 84.319394][ T4232] usb 3-1: config 0 descriptor?? [ 84.349206][ T4233] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.410917][ T4233] usb 5-1: config 0 descriptor?? [ 84.625993][ T4232] adutux 3-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 84.741124][ T4232] usb 5-1: USB disconnect, device number 3 [ 84.845187][ T4231] usb 3-1: USB disconnect, device number 6 [ 85.226984][ T4846] device syzkaller0 entered promiscuous mode [ 85.268003][ T4846] netlink: 4 bytes leftover after parsing attributes in process `syz.1.201'. [ 85.461240][ T4849] loop1: detected capacity change from 0 to 1024 [ 85.781656][ T4232] usb 4-1: USB disconnect, device number 5 [ 85.904652][ T4231] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 86.038517][ T4861] tipc: Enabled bearer , priority 0 [ 86.088292][ T4861] device syzkaller0 entered promiscuous mode [ 86.133844][ T4861] tipc: Resetting bearer [ 86.164510][ T4231] usb 5-1: Using ep0 maxpacket: 8 [ 86.189197][ T4860] tipc: Resetting bearer [ 86.206218][ T4860] tipc: Disabling bearer [ 86.292786][ T4231] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 86.312430][ T4232] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 86.329211][ T4868] loop2: detected capacity change from 0 to 256 [ 86.374274][ T4231] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 86.396349][ T4868] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 86.427100][ T4872] db_root: cannot be changed: target drivers registered [ 86.438744][ T4231] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.469681][ T4868] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 86.488737][ T4231] usb 5-1: config 0 descriptor?? [ 86.602499][ T4232] usb 4-1: Using ep0 maxpacket: 8 [ 86.742636][ T4232] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 86.806504][ T4231] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 86.835723][ T4232] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 86.906143][ T4232] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.949668][ T4232] usb 4-1: config 0 descriptor?? [ 87.104970][ T4230] usb 5-1: USB disconnect, device number 4 [ 87.244421][ T4232] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 87.257721][ T2301] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 87.345916][ T4894] tipc: Enabled bearer , priority 0 [ 87.362440][ T13] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 87.371893][ T4894] device syzkaller0 entered promiscuous mode [ 87.404602][ T4894] tipc: Resetting bearer [ 87.411481][ T4893] tipc: Resetting bearer [ 87.436991][ T4893] tipc: Disabling bearer [ 87.632843][ T2301] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 87.693103][ T2301] usb 3-1: config 8 has 0 interfaces, different from the descriptor's value: 1 [ 87.732629][ T13] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 87.752398][ T2301] usb 3-1: New USB device found, idVendor=046d, idProduct=0960, bcdDevice=97.b4 [ 87.790483][ T13] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 87.812407][ T2301] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.851080][ T13] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 87.940829][ T4232] usb 4-1: USB disconnect, device number 6 [ 88.072643][ T13] usb 1-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 88.112140][ T13] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.131326][ T26] audit: type=1804 audit(1790541123.415:326): pid=4882 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.215" name="bus" dev="ramfs" ino=35729 res=1 errno=0 [ 88.187069][ T13] usb 1-1: Product: syz [ 88.191273][ T13] usb 1-1: Manufacturer: syz [ 88.230729][ T13] usb 1-1: SerialNumber: syz [ 88.258346][ T13] usb 1-1: config 0 descriptor?? [ 88.538529][ T4921] loop3: detected capacity change from 0 to 1024 [ 88.553490][ T13] adutux 1-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 88.622099][ T4918] loop1: detected capacity change from 0 to 1024 [ 88.680466][ T4921] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 88.730066][ T4921] EXT4-fs (loop3): orphan cleanup on readonly fs [ 88.768541][ T4918] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 88.785050][ T13] usb 1-1: USB disconnect, device number 5 [ 88.835963][ T4921] EXT4-fs error (device loop3): ext4_free_blocks:6231: comm syz.3.232: Freeing blocks not in datazone - block = 0, count = 4096 [ 88.888159][ T4918] EXT4-fs (loop1): inline encryption not supported [ 88.943127][ T4921] EXT4-fs (loop3): Remounting filesystem read-only [ 88.965267][ T4918] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 88.992034][ T4921] EXT4-fs (loop3): 1 orphan inode deleted [ 89.037938][ T4921] EXT4-fs (loop3): mounted filesystem without journal. Opts: errors=remount-ro,i_version,barrier=0x0000000000000009,quota,max_dir_size_kb=0x0000000000000009,. Quota mode: writeback. [ 89.147763][ T4918] EXT4-fs (loop1): mounted filesystem without journal. Opts: block_validity,auto_da_alloc,noblock_validity,nomblk_io_submit,inlinecrypt,quota,nomblk_io_submit,grpjquota=,nolazytime,,errors=continue. Quota mode: writeback. [ 89.468877][ T4918] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 89.684625][ T2301] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 89.695125][ T4918] EXT4-fs error (device loop1): ext4_map_blocks:741: inode #15: comm syz.1.231: lblock 0 mapped to illegal pblock 0 (length 1) [ 89.710266][ T4941] tipc: Enabling of bearer rejected, failed to enable media [ 89.838392][ T13] usb 3-1: USB disconnect, device number 7 [ 89.946825][ T4918] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 89.972934][ T2301] usb 5-1: Using ep0 maxpacket: 8 [ 90.092594][ T2301] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 90.127988][ T26] audit: type=1326 audit(1790541125.415:327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4951 comm="syz.0.240" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 90.156145][ T4918] EXT4-fs (loop1): This should not happen!! Data will be lost [ 90.156145][ T4918] [ 90.176231][ T2301] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 90.216654][ T2301] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.262524][ T26] audit: type=1326 audit(1790541125.455:328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4951 comm="syz.0.240" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 90.289857][ T2301] usb 5-1: config 0 descriptor?? [ 90.420508][ T26] audit: type=1326 audit(1790541125.455:329): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4951 comm="syz.0.240" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 90.472446][ T13] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 90.558289][ T26] audit: type=1326 audit(1790541125.455:330): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4951 comm="syz.0.240" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 90.607324][ T2301] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 90.688548][ T26] audit: type=1326 audit(1790541125.455:331): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4951 comm="syz.0.240" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 90.742393][ T13] usb 4-1: Using ep0 maxpacket: 8 [ 90.780655][ T26] audit: type=1326 audit(1790541125.455:332): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4951 comm="syz.0.240" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 90.885162][ T13] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 90.914536][ T13] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.932464][ T26] audit: type=1326 audit(1790541125.455:333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4951 comm="syz.0.240" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 90.982587][ T2301] usb 5-1: USB disconnect, device number 5 [ 91.016892][ T13] pvrusb2: Hardware description: Terratec Grabster AV400 [ 91.042960][ T13] pvrusb2: ********** [ 91.075216][ T13] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 91.090018][ T26] audit: type=1326 audit(1790541125.455:334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4951 comm="syz.0.240" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 91.124627][ T13] pvrusb2: Important functionality might not be entirely working. [ 91.144725][ T13] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 91.170360][ T26] audit: type=1326 audit(1790541125.455:335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4951 comm="syz.0.240" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 91.202409][ T13] pvrusb2: ********** [ 91.258588][ T2423] pvrusb2: Invalid write control endpoint [ 91.305954][ T26] audit: type=1326 audit(1790541125.455:336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4951 comm="syz.0.240" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 91.401074][ T2423] pvrusb2: Invalid write control endpoint [ 91.428069][ T2423] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 91.508903][ T2423] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 91.610855][ T2423] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 91.740955][ T2423] pvrusb2: Device being rendered inoperable [ 91.820249][ T2301] usb 4-1: USB disconnect, device number 7 [ 91.839843][ T2423] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 91.895989][ T2423] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 91.955151][ T2423] pvrusb2: Attached sub-driver cx25840 [ 92.013581][ T2423] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 92.105663][ T2423] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 92.194922][ T4983] netlink: 4 bytes leftover after parsing attributes in process `syz.2.249'. [ 92.294043][ T4992] tipc: Enabling of bearer rejected, failed to enable media [ 92.735180][ T2301] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 92.814911][ T4230] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 92.822662][ T13] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 93.002496][ T2301] usb 3-1: Using ep0 maxpacket: 32 [ 93.082856][ T4230] usb 1-1: Using ep0 maxpacket: 8 [ 93.135084][ T2301] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 93.157828][ T2301] usb 3-1: config 0 has no interface number 0 [ 93.179646][ T2301] usb 3-1: config 0 interface 1 altsetting 9 has an invalid endpoint with address 0x0, skipping [ 93.190671][ T13] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 93.225081][ T4230] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 93.236224][ T13] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 93.253567][ T2301] usb 3-1: config 0 interface 1 has no altsetting 0 [ 93.275517][ T4230] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 93.297199][ T13] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 93.339185][ T4230] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.379184][ T4230] usb 1-1: config 0 descriptor?? [ 93.453078][ T2301] usb 3-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 93.485578][ T2301] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.524239][ T13] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 93.551766][ T2301] usb 3-1: Product: syz [ 93.568285][ T2301] usb 3-1: Manufacturer: syz [ 93.575823][ T13] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.599229][ T5010] loop3: detected capacity change from 0 to 164 [ 93.606940][ T2301] usb 3-1: SerialNumber: syz [ 93.624548][ T13] usb 5-1: Product: syz [ 93.638562][ T2301] usb 3-1: config 0 descriptor?? [ 93.661138][ T13] usb 5-1: Manufacturer: syz [ 93.688677][ T5010] rock: corrupted directory entry. extent=458780 out of volume (nzones=41) [ 93.707084][ T13] usb 5-1: SerialNumber: syz [ 93.745468][ T13] usb 5-1: config 0 descriptor?? [ 93.769189][ T5010] isofs_fill_super: root inode is not a directory. Corrupted media? [ 93.824996][ T4230] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 93.871514][ T4230] usb 1-1: USB disconnect, device number 6 [ 93.963424][ T2301] cx231xx 3-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 94.035096][ T2301] cx231xx 3-1:0.1: Failed to read PCB config [ 94.044468][ T13] adutux 5-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 94.070258][ T2301] cx231xx: probe of 3-1:0.1 failed with error -71 [ 94.115126][ T2301] usb 3-1: USB disconnect, device number 8 [ 94.266458][ T4230] usb 5-1: USB disconnect, device number 6 [ 94.424903][ T5020] device syzkaller0 entered promiscuous mode [ 94.494564][ T2301] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 94.762565][ T2301] usb 3-1: Using ep0 maxpacket: 32 [ 94.781837][ T5027] netlink: 8 bytes leftover after parsing attributes in process `syz.3.261'. [ 94.894771][ T2301] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 94.922988][ T2301] usb 3-1: config 0 has no interface number 0 [ 94.947274][ T2301] usb 3-1: config 0 interface 1 altsetting 9 has an invalid endpoint with address 0x0, skipping [ 94.985416][ T2301] usb 3-1: config 0 interface 1 has no altsetting 0 [ 95.163090][ T2301] usb 3-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 95.172587][ T4230] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 95.181888][ T5037] tipc: Enabling of bearer rejected, failed to enable media [ 95.197078][ T2301] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.216279][ T2301] usb 3-1: Product: syz [ 95.226081][ T2301] usb 3-1: Manufacturer: syz [ 95.235983][ T2301] usb 3-1: SerialNumber: syz [ 95.254383][ T2301] usb 3-1: config 0 descriptor?? [ 95.438623][ T4230] usb 1-1: Using ep0 maxpacket: 8 [ 95.488560][ T2301] cx231xx 3-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 95.562943][ T2301] cx231xx 3-1:0.1: Failed to read PCB config [ 95.572566][ T4230] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 95.607210][ T2301] cx231xx: probe of 3-1:0.1 failed with error -71 [ 95.632516][ T4230] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.670849][ T2301] usb 3-1: USB disconnect, device number 9 [ 95.725120][ T4230] pvrusb2: Hardware description: Terratec Grabster AV400 [ 95.740549][ T5051] device syzkaller0 entered promiscuous mode [ 95.778686][ T4230] pvrusb2: ********** [ 95.811264][ T4230] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 95.833980][ T26] kauditd_printk_skb: 301 callbacks suppressed [ 95.833995][ T26] audit: type=1326 audit(1790541131.125:638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5055 comm="syz.3.271" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 95.901843][ T4230] pvrusb2: Important functionality might not be entirely working. [ 95.934203][ T4230] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 95.986375][ T26] audit: type=1326 audit(1790541131.165:639): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5055 comm="syz.3.271" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 96.017432][ T4230] pvrusb2: ********** [ 96.064790][ T2423] pvrusb2: Invalid write control endpoint [ 96.205644][ T26] audit: type=1326 audit(1790541131.165:640): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5055 comm="syz.3.271" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 96.243830][ T2423] pvrusb2: Invalid write control endpoint [ 96.256199][ T2423] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 96.301719][ T2423] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 96.336110][ T26] audit: type=1326 audit(1790541131.165:641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5055 comm="syz.3.271" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 96.363702][ T2423] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 96.405384][ T2423] pvrusb2: Device being rendered inoperable [ 96.427442][ T2423] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 96.436554][ T13] usb 1-1: USB disconnect, device number 7 [ 96.461613][ T2423] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 96.474453][ T26] audit: type=1326 audit(1790541131.165:642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5055 comm="syz.3.271" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 96.532882][ T2423] pvrusb2: Attached sub-driver cx25840 [ 96.555791][ T2423] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 96.569978][ T4230] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 96.578464][ T5079] tipc: Enabling of bearer rejected, failed to enable media [ 96.612238][ T2423] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 96.627152][ T26] audit: type=1326 audit(1790541131.165:643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5055 comm="syz.3.271" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 96.738215][ T26] audit: type=1326 audit(1790541131.165:644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5055 comm="syz.3.271" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 96.796405][ T26] audit: type=1326 audit(1790541131.165:645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5055 comm="syz.3.271" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 96.854574][ T26] audit: type=1326 audit(1790541131.165:646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5055 comm="syz.3.271" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 96.911291][ T26] audit: type=1326 audit(1790541131.175:647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5055 comm="syz.3.271" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 97.012629][ T4230] usb 5-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 97.075118][ T4230] usb 5-1: config 8 has 0 interfaces, different from the descriptor's value: 1 [ 97.109026][ T4230] usb 5-1: New USB device found, idVendor=046d, idProduct=0960, bcdDevice=97.b4 [ 97.132474][ T4230] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.225986][ T5090] FAULT_INJECTION: forcing a failure. [ 97.225986][ T5090] name failslab, interval 1, probability 0, space 0, times 0 [ 97.260019][ T5090] CPU: 0 PID: 5090 Comm: syz.3.281 Not tainted syzkaller #0 [ 97.267352][ T5090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 97.277415][ T5090] Call Trace: [ 97.280768][ T5090] [ 97.283687][ T5090] dump_stack_lvl+0x188/0x250 [ 97.288383][ T5090] ? show_regs_print_info+0x20/0x20 [ 97.293578][ T5090] ? load_image+0x410/0x410 [ 97.298073][ T5090] ? __might_sleep+0xf0/0xf0 [ 97.302642][ T5090] ? __lock_acquire+0x7b50/0x7b50 [ 97.307663][ T5090] should_fail+0x383/0x4b0 [ 97.312069][ T5090] should_failslab+0x5/0x20 [ 97.316572][ T5090] slab_pre_alloc_hook+0x51/0xc0 [ 97.321508][ T5090] kmem_cache_alloc_trace+0x47/0x290 [ 97.326770][ T5090] ? call_usermodehelper_setup+0x8a/0x260 [ 97.332488][ T5090] call_usermodehelper_setup+0x8a/0x260 [ 97.338013][ T5090] ? umh_keys_init+0x40/0x40 [ 97.342584][ T5090] ? call_sbin_request_key+0xc70/0xc70 [ 97.348026][ T5090] call_sbin_request_key+0x83f/0xc70 [ 97.353296][ T5090] ? rcu_lock_release+0x20/0x20 [ 97.358139][ T5090] ? request_key_auth_rcu_disposal+0x20/0x20 [ 97.364103][ T5090] ? up_write+0x1b6/0x410 [ 97.368415][ T5090] request_key_and_link+0xd98/0x13b0 [ 97.373685][ T5090] ? complete_request_key+0xa0/0xa0 [ 97.378863][ T5090] ? __might_sleep+0xf0/0xf0 [ 97.383449][ T5090] ? restrict_link_reject+0x10/0x10 [ 97.388623][ T5090] ? keyring_search_rcu+0x280/0x280 [ 97.393804][ T5090] ? down_read+0x1aa/0x2e0 [ 97.398202][ T5090] __se_sys_request_key+0x293/0x350 [ 97.403382][ T5090] ? __x64_sys_request_key+0xa0/0xa0 [ 97.408651][ T5090] ? lockdep_hardirqs_on+0x94/0x140 [ 97.413829][ T5090] do_syscall_64+0x4c/0xa0 [ 97.418344][ T5090] ? clear_bhb_loop+0x30/0x80 [ 97.423274][ T5090] ? clear_bhb_loop+0x30/0x80 [ 97.427956][ T5090] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 97.433936][ T5090] RIP: 0033:0x7f0014a85159 [ 97.438353][ T5090] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.457952][ T5090] RSP: 002b:00007f0012cdd028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 97.466350][ T5090] RAX: ffffffffffffffda RBX: 00007f0014d0cfa0 RCX: 00007f0014a85159 [ 97.474400][ T5090] RDX: 0000200000001fee RSI: 0000200000001ffb RDI: 0000200000000040 [ 97.482351][ T5090] RBP: 00007f0014b1c06b R08: 0000000000000000 R09: 0000000000000000 [ 97.490301][ T5090] R10: fffffffffffffffe R11: 0000000000000246 R12: 0000000000000000 [ 97.498260][ T5090] R13: 00007f0014d0d038 R14: 00007f0014d0cfa0 R15: 00007ffc9eae9a58 [ 97.506225][ T5090] [ 97.662417][ T7] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 98.055122][ T7] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 98.143631][ T7] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 98.224247][ T7] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 98.435095][ T7] usb 3-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 98.477485][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.524643][ T7] usb 3-1: Product: syz [ 98.549832][ T7] usb 3-1: Manufacturer: syz [ 98.582239][ T7] usb 3-1: SerialNumber: syz [ 98.612292][ T7] usb 3-1: config 0 descriptor?? [ 98.904176][ T7] adutux 3-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 99.050799][ T5128] tipc: Enabled bearer , priority 0 [ 99.130533][ T5127] tipc: Disabling bearer [ 99.143922][ T1108] usb 3-1: USB disconnect, device number 10 [ 99.247434][ T5129] usb 5-1: USB disconnect, device number 7 [ 99.562585][ T5131] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 99.834740][ T5160] < [ 99.842579][ T5131] usb 4-1: Using ep0 maxpacket: 32 [ 99.921991][ T5164] loop4: detected capacity change from 0 to 1024 [ 99.982804][ T5131] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 100.027731][ T5131] usb 4-1: config 0 has no interface number 0 [ 100.039898][ T5164] EXT4-fs (loop4): mounted filesystem without journal. Opts: resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x0000000000000080,delalloc,nogrpid,noauto_da_alloc,usrquota,,errors=continue. Quota mode: writeback. [ 100.091319][ T5131] usb 4-1: config 0 interface 1 altsetting 9 has an invalid endpoint with address 0x0, skipping [ 100.154871][ T5131] usb 4-1: config 0 interface 1 has no altsetting 0 [ 100.342636][ T5131] usb 4-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 100.415488][ T5131] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.462005][ T5131] usb 4-1: Product: syz [ 100.482657][ T5174] tipc: Enabled bearer , priority 0 [ 100.500025][ T5131] usb 4-1: Manufacturer: syz [ 100.520863][ T5131] usb 4-1: SerialNumber: syz [ 100.561648][ T5131] usb 4-1: config 0 descriptor?? [ 100.644449][ T5173] tipc: Disabling bearer [ 100.853556][ T5131] cx231xx 4-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 100.902565][ T5131] cx231xx 4-1:0.1: Failed to read PCB config [ 100.928862][ T5131] cx231xx: probe of 4-1:0.1 failed with error -71 [ 100.942546][ T5129] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 100.971748][ T26] kauditd_printk_skb: 243 callbacks suppressed [ 100.971758][ T26] audit: type=1326 audit(1790541136.255:891): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5180 comm="syz.0.307" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 101.026903][ T5131] usb 4-1: USB disconnect, device number 8 [ 101.118135][ T26] audit: type=1326 audit(1790541136.295:892): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5180 comm="syz.0.307" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 101.199522][ T26] audit: type=1326 audit(1790541136.295:893): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5180 comm="syz.0.307" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 101.227901][ T7] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 101.272589][ T5129] usb 3-1: Using ep0 maxpacket: 8 [ 101.336323][ T26] audit: type=1326 audit(1790541136.295:894): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5180 comm="syz.0.307" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 101.413655][ T5129] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 101.432506][ T5131] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 101.450116][ T26] audit: type=1326 audit(1790541136.295:895): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5180 comm="syz.0.307" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 101.477348][ T5129] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.544347][ T5129] pvrusb2: Hardware description: Terratec Grabster AV400 [ 101.648340][ T5129] pvrusb2: ********** [ 101.654860][ T26] audit: type=1326 audit(1790541136.295:896): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5180 comm="syz.0.307" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 101.689472][ T5129] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 102.686638][ T7] usb 5-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 102.715554][ T5129] pvrusb2: Important functionality might not be entirely working. [ 102.747590][ T7] usb 5-1: config 8 has 0 interfaces, different from the descriptor's value: 1 [ 102.771302][ T5129] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 102.847398][ T26] audit: type=1326 audit(1790541136.295:897): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5180 comm="syz.0.307" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 102.875747][ T7] usb 5-1: New USB device found, idVendor=046d, idProduct=0960, bcdDevice=97.b4 [ 102.908210][ T5129] pvrusb2: ********** [ 102.923092][ T7] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.973445][ T2423] pvrusb2: Invalid write control endpoint [ 102.982549][ T5131] usb 4-1: device not accepting address 9, error -71 [ 103.014528][ T26] audit: type=1326 audit(1790541136.295:898): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5180 comm="syz.0.307" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 103.117066][ T2423] pvrusb2: Invalid write control endpoint [ 103.136445][ T2423] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 103.166318][ T26] audit: type=1326 audit(1790541136.295:899): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5180 comm="syz.0.307" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 103.198981][ T7] usb 3-1: USB disconnect, device number 11 [ 103.215215][ T2423] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 103.265652][ T2423] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 103.314993][ T2423] pvrusb2: Device being rendered inoperable [ 103.341348][ T26] audit: type=1326 audit(1790541136.315:900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5180 comm="syz.0.307" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f60d604b159 code=0x7ffc0000 [ 103.372553][ T2423] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 103.397715][ T2423] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 103.435890][ T2423] pvrusb2: Attached sub-driver cx25840 [ 103.472542][ T2423] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 103.512376][ T5131] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 103.533002][ T2423] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 104.879876][ T7] usb 5-1: USB disconnect, device number 8 [ 104.922684][ T5131] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 105.030500][ T5235] tipc: Enabling of bearer rejected, failed to enable media [ 105.081397][ T5131] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 105.108571][ T5237] device syzkaller0 entered promiscuous mode [ 105.155436][ T5131] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 105.267857][ T5244] tipc: Enabling of bearer rejected, failed to enable media [ 105.374678][ T5131] usb 4-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 105.407599][ T5131] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.450200][ T5131] usb 4-1: Product: syz [ 105.476552][ T5131] usb 4-1: Manufacturer: syz [ 105.501472][ T5131] usb 4-1: SerialNumber: syz [ 105.527319][ T5131] usb 4-1: config 0 descriptor?? [ 105.805729][ T5131] adutux 4-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 105.843256][ T4232] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 106.035201][ T4231] usb 4-1: USB disconnect, device number 10 [ 106.102529][ T4232] usb 1-1: Using ep0 maxpacket: 8 [ 106.114388][ T5273] device syzkaller0 entered promiscuous mode [ 106.214159][ T5131] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 106.234233][ T4232] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 106.257264][ T4232] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 106.279292][ T4232] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.305052][ T4232] usb 1-1: config 0 descriptor?? [ 106.463455][ T5131] usb 3-1: Using ep0 maxpacket: 16 [ 106.474054][ T4231] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 106.576038][ T4232] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 106.604290][ T5131] usb 3-1: config 157 has an invalid descriptor of length 0, skipping remainder of the config [ 106.635184][ T5131] usb 3-1: config 157 has 0 interfaces, different from the descriptor's value: 1 [ 106.733603][ T4231] usb 5-1: Using ep0 maxpacket: 8 [ 106.813622][ T5131] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 106.834590][ T5131] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.854488][ T5131] usb 3-1: Product: syz [ 106.864158][ T4231] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 106.875682][ T5131] usb 3-1: Manufacturer: syz [ 106.887931][ T5131] usb 3-1: SerialNumber: syz [ 106.895381][ T4231] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.965141][ T4231] pvrusb2: Hardware description: Terratec Grabster AV400 [ 106.979992][ T4231] pvrusb2: ********** [ 106.990673][ T4231] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 107.020034][ T4231] pvrusb2: Important functionality might not be entirely working. [ 107.041064][ T4231] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 107.076102][ T4231] pvrusb2: ********** [ 107.097033][ T7] usb 1-1: USB disconnect, device number 8 [ 107.169064][ T5280] tipc: Enabled bearer , priority 0 [ 107.179516][ T2423] pvrusb2: Invalid write control endpoint [ 107.276007][ T2423] pvrusb2: Invalid write control endpoint [ 107.282510][ T2423] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 107.312081][ T5279] tipc: Disabling bearer [ 107.329345][ T2423] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 107.360031][ T2423] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 107.422224][ T2423] pvrusb2: Device being rendered inoperable [ 107.449141][ T5271] pvrusb2: Attempted to execute control transfer when device not ok [ 107.469791][ T5290] device syzkaller0 entered promiscuous mode [ 107.486076][ T2423] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 107.494006][ T7] usb 5-1: USB disconnect, device number 9 [ 107.520446][ T5131] usb 3-1: USB disconnect, device number 12 [ 107.528367][ T2423] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 107.540755][ T5290] tipc: Enabling of bearer rejected, failed to enable media [ 107.578919][ T2423] pvrusb2: Attached sub-driver cx25840 [ 107.617609][ T2423] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 107.688715][ T2423] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 107.730201][ T5294] tipc: Enabled bearer , priority 0 [ 107.771022][ T5294] device syzkaller0 entered promiscuous mode [ 107.792011][ T5296] device syzkaller0 entered promiscuous mode [ 107.816845][ T5294] tipc: Resetting bearer [ 107.851462][ T5293] tipc: Resetting bearer [ 107.870120][ T5293] tipc: Disabling bearer [ 107.959310][ T5298] binder: 5297:5298 ioctl 4018620d 0 returned -22 [ 108.129580][ T5304] device syzkaller0 entered promiscuous mode [ 108.464929][ T7] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 108.565657][ T4232] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 108.573410][ T4231] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 108.825081][ T4232] usb 5-1: Using ep0 maxpacket: 32 [ 108.832593][ T7] usb 3-1: config 0 has an invalid descriptor of length 100, skipping remainder of the config [ 108.860684][ T7] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 108.886459][ T7] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 108.908221][ T7] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.935236][ T7] usb 3-1: config 0 descriptor?? [ 108.954795][ T4231] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 108.966237][ T4232] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 108.998345][ T4232] usb 5-1: config 0 has no interface number 0 [ 109.008938][ T4231] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 109.042268][ T4232] usb 5-1: config 0 interface 1 altsetting 9 has an invalid endpoint with address 0x0, skipping [ 109.068387][ T4231] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 109.098002][ T4232] usb 5-1: config 0 interface 1 has no altsetting 0 [ 109.213759][ T7] usb 3-1: USB disconnect, device number 13 [ 109.272574][ T4231] usb 1-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 109.282276][ T4232] usb 5-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 109.307309][ T4231] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.318387][ T4232] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.346853][ T4232] usb 5-1: Product: syz [ 109.351145][ T4231] usb 1-1: Product: syz [ 109.361236][ T4232] usb 5-1: Manufacturer: syz [ 109.369716][ T4231] usb 1-1: Manufacturer: syz [ 109.384314][ T4232] usb 5-1: SerialNumber: syz [ 109.395200][ T4231] usb 1-1: SerialNumber: syz [ 109.420671][ T4232] usb 5-1: config 0 descriptor?? [ 109.435801][ T4231] usb 1-1: config 0 descriptor?? [ 109.704117][ T4231] adutux 1-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 109.724183][ T4232] cx231xx 5-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 109.772551][ T4232] cx231xx 5-1:0.1: Failed to read PCB config [ 109.784447][ T4232] cx231xx: probe of 5-1:0.1 failed with error -71 [ 109.809894][ T4232] usb 5-1: USB disconnect, device number 10 [ 109.928271][ T5131] usb 1-1: USB disconnect, device number 9 [ 110.070066][ T5319] device syzkaller0 entered promiscuous mode [ 110.104850][ T5319] tipc: Enabled bearer , priority 0 [ 110.141588][ T5318] tipc: Resetting bearer [ 110.212082][ T5318] tipc: Disabling bearer [ 110.283513][ T4232] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 110.377937][ T5325] device syzkaller0 entered promiscuous mode [ 110.398080][ T5325] tipc: Enabling of bearer rejected, failed to enable media [ 110.533571][ T5131] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 110.564020][ T4232] usb 5-1: Using ep0 maxpacket: 32 [ 110.684167][ T4232] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 110.706878][ T4232] usb 5-1: config 0 has no interface number 0 [ 110.735066][ T4232] usb 5-1: config 0 interface 1 altsetting 9 has an invalid endpoint with address 0x0, skipping [ 110.786239][ T4232] usb 5-1: config 0 interface 1 has no altsetting 0 [ 110.794693][ T5131] usb 4-1: Using ep0 maxpacket: 8 [ 110.823621][ T7] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 110.891540][ T5337] tipc: Enabling of bearer rejected, failed to enable media [ 110.926212][ T5131] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 110.960075][ T5131] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 110.983787][ T4232] usb 5-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 111.008363][ T5131] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.023537][ T4232] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.058436][ T4232] usb 5-1: Product: syz [ 111.070920][ T5131] usb 4-1: config 0 descriptor?? [ 111.088371][ T4232] usb 5-1: Manufacturer: syz [ 111.094990][ T7] usb 3-1: Using ep0 maxpacket: 8 [ 111.112267][ T4232] usb 5-1: SerialNumber: syz [ 111.135629][ T4232] usb 5-1: config 0 descriptor?? [ 111.223647][ T7] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 111.254906][ T7] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.318317][ T7] pvrusb2: Hardware description: Terratec Grabster AV400 [ 111.327563][ T4232] cx231xx 5-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 111.378803][ T5345] binder: 5344:5345 ioctl 4018620d 0 returned -22 [ 111.386505][ T5131] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 111.399586][ T7] pvrusb2: ********** [ 111.421067][ T7] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 111.432674][ T4232] cx231xx 5-1:0.1: Failed to read PCB config [ 111.438698][ T4232] cx231xx: probe of 5-1:0.1 failed with error -71 [ 111.450939][ T5346] device syzkaller0 entered promiscuous mode [ 111.495235][ T7] pvrusb2: Important functionality might not be entirely working. [ 111.506408][ T4232] usb 5-1: USB disconnect, device number 11 [ 111.531249][ T7] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 111.558946][ T7] pvrusb2: ********** [ 111.606399][ T2423] pvrusb2: Invalid write control endpoint [ 111.732839][ T2423] pvrusb2: Invalid write control endpoint [ 111.752089][ T2423] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 111.824998][ T2423] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 111.852991][ T4232] usb 4-1: USB disconnect, device number 11 [ 111.888133][ T2423] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 111.949883][ T2423] pvrusb2: Device being rendered inoperable [ 111.970758][ T2423] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 111.985680][ T5131] usb 3-1: USB disconnect, device number 14 [ 112.008644][ T2423] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 112.050966][ T2423] pvrusb2: Attached sub-driver cx25840 [ 112.086922][ T2423] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 112.134617][ T2423] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 112.285255][ T5365] device syzkaller0 entered promiscuous mode [ 112.323819][ T5365] tipc: Enabled bearer , priority 0 [ 112.355441][ T5364] tipc: Resetting bearer [ 112.436286][ T5364] tipc: Disabling bearer [ 112.607192][ T5372] tipc: Enabled bearer , priority 0 [ 112.647241][ T5374] device syzkaller0 entered promiscuous mode [ 112.690927][ T5372] device syzkaller0 entered promiscuous mode [ 112.734677][ T5131] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 112.762268][ T5372] tipc: Resetting bearer [ 112.795630][ T5368] tipc: Resetting bearer [ 112.876871][ T5368] tipc: Disabling bearer [ 113.038235][ T5389] device syzkaller0 entered promiscuous mode [ 113.103686][ T5131] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 113.119392][ T5131] usb 4-1: config 8 has 0 interfaces, different from the descriptor's value: 1 [ 113.129245][ T5131] usb 4-1: New USB device found, idVendor=046d, idProduct=0960, bcdDevice=97.b4 [ 113.141445][ T5131] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.232526][ T5129] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 113.309738][ T5395] binder: 5394:5395 ioctl 4018620d 0 returned -22 [ 113.401266][ T26] kauditd_printk_skb: 131 callbacks suppressed [ 113.401276][ T26] audit: type=1804 audit(1790541148.685:1032): pid=5367 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.361" name="bus" dev="ramfs" ino=37260 res=1 errno=0 [ 113.429240][ T5130] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 113.467418][ T26] audit: type=1804 audit(1790541148.725:1033): pid=5367 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.361" name="bus" dev="ramfs" ino=37260 res=1 errno=0 [ 113.612507][ T5129] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 113.655631][ T5129] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 113.692452][ T5130] usb 5-1: Using ep0 maxpacket: 16 [ 113.708217][ T5129] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 113.825069][ T5130] usb 5-1: config 157 has 0 interfaces, different from the descriptor's value: 1 [ 113.912675][ T5129] usb 1-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 113.957047][ T5129] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.009450][ T5129] usb 1-1: Product: syz [ 114.014188][ T5130] usb 5-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 114.045822][ T5129] usb 1-1: Manufacturer: syz [ 114.058262][ T5130] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.078252][ T5129] usb 1-1: SerialNumber: syz [ 114.109764][ T5129] usb 1-1: config 0 descriptor?? [ 114.117248][ T5130] usb 5-1: Product: syz [ 114.134043][ T5130] usb 5-1: Manufacturer: syz [ 114.166396][ T5130] usb 5-1: SerialNumber: syz [ 114.395214][ T5129] adutux 1-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 114.493464][ T5131] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 114.616231][ T5130] usb 1-1: USB disconnect, device number 10 [ 114.666790][ T5129] usb 5-1: USB disconnect, device number 12 [ 114.753538][ T5131] usb 3-1: Using ep0 maxpacket: 8 [ 114.884193][ T5131] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 114.917753][ T5131] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.994614][ T5131] pvrusb2: Hardware description: Terratec Grabster AV400 [ 115.019591][ T5131] pvrusb2: ********** [ 115.034500][ T5131] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 115.070461][ T5131] pvrusb2: Important functionality might not be entirely working. [ 115.098699][ T5131] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 115.139890][ T5131] pvrusb2: ********** [ 115.214407][ T2423] pvrusb2: Invalid write control endpoint [ 115.296473][ T5418] device syzkaller0 entered promiscuous mode [ 115.322741][ T2423] pvrusb2: Invalid write control endpoint [ 115.350464][ T2423] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 115.398979][ T2423] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 115.450321][ T2423] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 115.520424][ T5421] device syzkaller0 entered promiscuous mode [ 115.529008][ T2423] pvrusb2: Device being rendered inoperable [ 115.554566][ T5131] usb 3-1: USB disconnect, device number 15 [ 115.560653][ T2423] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 115.585767][ T5426] tipc: Enabled bearer , priority 0 [ 115.618774][ T2423] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 115.649146][ T5420] tipc: Resetting bearer [ 115.686749][ T2423] pvrusb2: Attached sub-driver cx25840 [ 115.698231][ T4232] usb 4-1: USB disconnect, device number 12 [ 115.741727][ T2423] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 115.775760][ T5420] tipc: Disabling bearer [ 115.801775][ T2423] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 115.930787][ T5432] tipc: Enabling of bearer rejected, failed to enable media [ 116.007148][ T5434] device syzkaller0 entered promiscuous mode [ 116.464973][ T4232] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 116.521680][ T5456] binder: BINDER_SET_CONTEXT_MGR already set [ 116.548180][ T5456] binder: 5455:5456 ioctl 4018620d 200000001000 returned -16 [ 116.732963][ T4232] usb 3-1: Using ep0 maxpacket: 32 [ 116.765399][ T5131] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 116.864645][ T4232] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 116.892081][ T4232] usb 3-1: config 0 has no interface number 0 [ 116.915317][ T4232] usb 3-1: config 0 interface 1 altsetting 9 has an invalid endpoint with address 0x0, skipping [ 116.952874][ T4232] usb 3-1: config 0 interface 1 has no altsetting 0 [ 117.133019][ T4232] usb 3-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 117.144567][ T5131] usb 4-1: config 0 has an invalid descriptor of length 100, skipping remainder of the config [ 117.165753][ T4232] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.176054][ T5131] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 117.195079][ T4232] usb 3-1: Product: syz [ 117.201537][ T5131] usb 4-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 117.216837][ T4232] usb 3-1: Manufacturer: syz [ 117.226885][ T4232] usb 3-1: SerialNumber: syz [ 117.236240][ T5131] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.256148][ T4232] usb 3-1: config 0 descriptor?? [ 117.276687][ T5131] usb 4-1: config 0 descriptor?? [ 117.385917][ T5473] device syzkaller0 entered promiscuous mode [ 117.432457][ T5129] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 117.544007][ T4232] cx231xx 3-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 117.588220][ T13] usb 4-1: USB disconnect, device number 13 [ 117.602568][ T4232] cx231xx 3-1:0.1: Failed to read PCB config [ 117.623409][ T4232] cx231xx: probe of 3-1:0.1 failed with error -71 [ 117.648401][ T4232] usb 3-1: USB disconnect, device number 16 [ 117.682378][ T5129] usb 1-1: Using ep0 maxpacket: 16 [ 117.802743][ T5129] usb 1-1: config 157 has 0 interfaces, different from the descriptor's value: 1 [ 117.855177][ T5130] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 117.975075][ T5129] usb 1-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 117.985921][ T5129] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.997646][ T5129] usb 1-1: Product: syz [ 118.001890][ T5129] usb 1-1: Manufacturer: syz [ 118.006805][ T5129] usb 1-1: SerialNumber: syz [ 118.102432][ T5130] usb 5-1: Using ep0 maxpacket: 8 [ 118.112715][ T4232] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 118.222493][ T5130] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 118.234640][ T5130] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.283846][ T5130] pvrusb2: Hardware description: Terratec Grabster AV400 [ 118.307651][ T5130] pvrusb2: ********** [ 118.319732][ T5130] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 118.336708][ T5481] device syzkaller0 entered promiscuous mode [ 118.343009][ T5130] pvrusb2: Important functionality might not be entirely working. [ 118.356324][ T5130] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 118.368270][ T4232] usb 3-1: Using ep0 maxpacket: 32 [ 118.376139][ T5130] pvrusb2: ********** [ 118.467547][ T5483] tipc: Enabled bearer , priority 0 [ 118.477821][ T5129] usb 1-1: USB disconnect, device number 11 [ 118.489894][ T5483] device syzkaller0 entered promiscuous mode [ 118.499679][ T4232] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 118.509585][ T2423] pvrusb2: Invalid write control endpoint [ 118.539542][ T4232] usb 3-1: config 0 has no interface number 0 [ 118.558241][ T4232] usb 3-1: config 0 interface 1 altsetting 9 has an invalid endpoint with address 0x0, skipping [ 118.579757][ T2423] pvrusb2: Invalid write control endpoint [ 118.587751][ T2423] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 118.599855][ T4232] usb 3-1: config 0 interface 1 has no altsetting 0 [ 118.618556][ T5485] tipc: Resetting bearer [ 118.626358][ T2423] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 118.639912][ T5482] tipc: Resetting bearer [ 118.648009][ T2423] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 118.666204][ T5482] tipc: Disabling bearer [ 118.672140][ T2423] pvrusb2: Device being rendered inoperable [ 118.688319][ T2423] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 118.697047][ T2423] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 118.711889][ T2301] usb 5-1: USB disconnect, device number 13 [ 118.731006][ T2423] pvrusb2: Attached sub-driver cx25840 [ 118.761827][ T2423] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 118.774158][ T4232] usb 3-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 118.805916][ T4232] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.825665][ T2423] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 118.844148][ T5487] device syzkaller0 entered promiscuous mode [ 118.851371][ T4232] usb 3-1: Product: syz [ 118.862277][ T4232] usb 3-1: Manufacturer: syz [ 118.890623][ T5487] tipc: Enabled bearer , priority 0 [ 118.899992][ T4232] usb 3-1: SerialNumber: syz [ 118.925478][ T4232] usb 3-1: config 0 descriptor?? [ 118.940685][ T5486] tipc: Resetting bearer [ 118.968993][ T5486] tipc: Disabling bearer [ 119.173582][ T4232] cx231xx 3-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 119.242645][ T4232] cx231xx 3-1:0.1: Failed to read PCB config [ 119.258547][ T5493] device syzkaller0 entered promiscuous mode [ 119.275703][ T4232] cx231xx: probe of 3-1:0.1 failed with error -71 [ 119.330649][ T4232] usb 3-1: USB disconnect, device number 17 [ 119.349134][ T5497] binder: BINDER_SET_CONTEXT_MGR already set [ 119.373044][ T2301] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 119.386896][ T5497] binder: 5496:5497 ioctl 4018620d 200000001000 returned -16 [ 119.754573][ T2301] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 119.785035][ T2301] usb 1-1: config 8 has 0 interfaces, different from the descriptor's value: 1 [ 119.819873][ T2301] usb 1-1: New USB device found, idVendor=046d, idProduct=0960, bcdDevice=97.b4 [ 119.834443][ T5129] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 119.863459][ T2301] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.094425][ T5129] usb 4-1: Using ep0 maxpacket: 8 [ 120.154638][ T26] audit: type=1804 audit(1790541155.445:1034): pid=5489 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.395" name="bus" dev="ramfs" ino=37693 res=1 errno=0 [ 120.233165][ T5129] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 120.276414][ T26] audit: type=1804 audit(1790541155.465:1035): pid=5489 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.395" name="bus" dev="ramfs" ino=37693 res=1 errno=0 [ 120.299400][ T5129] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 120.348004][ T5129] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.401262][ T5129] usb 4-1: config 0 descriptor?? [ 120.669227][ T5521] device syzkaller0 entered promiscuous mode [ 120.694990][ T2301] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 120.724094][ T5129] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 120.870085][ T5525] tipc: Enabling of bearer rejected, failed to enable media [ 121.095060][ T2301] usb 5-1: config 0 has an invalid descriptor of length 100, skipping remainder of the config [ 121.123567][ T2301] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 121.162601][ T2301] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 121.182424][ T5129] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 121.204028][ T2301] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.229380][ T2301] usb 5-1: config 0 descriptor?? [ 121.246138][ T13] usb 4-1: USB disconnect, device number 14 [ 121.285593][ T5536] tipc: Enabling of bearer rejected, failed to enable media [ 121.442394][ T5129] usb 3-1: Using ep0 maxpacket: 16 [ 121.481000][ T13] usb 5-1: USB disconnect, device number 14 [ 121.723001][ T5129] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 121.755088][ T5129] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.783469][ T5129] usb 3-1: Product: syz [ 121.797965][ T5129] usb 3-1: Manufacturer: syz [ 121.811315][ T5129] usb 3-1: SerialNumber: syz [ 121.982379][ T13] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 122.113474][ T5129] usb 3-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 122.197484][ T5129] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 122.216868][ T5547] device syzkaller0 entered promiscuous mode [ 122.242477][ T13] usb 4-1: Using ep0 maxpacket: 8 [ 122.308631][ T5129] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 122.371072][ T5129] usb 3-1: media controller created [ 122.379348][ T13] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 122.417341][ T13] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.430392][ T5129] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 122.504934][ T13] pvrusb2: Hardware description: Terratec Grabster AV400 [ 122.514320][ T5130] usb 1-1: USB disconnect, device number 12 [ 122.524369][ T5129] zl10353_read_register: readreg error (reg=127, ret==-71) [ 122.538678][ T13] pvrusb2: ********** [ 122.558488][ T13] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 122.611464][ T5129] dvb_usb_gl861: probe of 3-1:157.0 failed with error -5 [ 122.623087][ T13] pvrusb2: Important functionality might not be entirely working. [ 122.671860][ T13] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 122.686944][ T5129] usb 3-1: USB disconnect, device number 18 [ 122.715527][ T5556] binder: BINDER_SET_CONTEXT_MGR already set [ 122.731745][ T13] pvrusb2: ********** [ 122.741903][ T5556] binder: 5555:5556 ioctl 4018620d 200000001000 returned -16 [ 122.793977][ T2423] pvrusb2: Invalid write control endpoint [ 122.926314][ T2423] pvrusb2: Invalid write control endpoint [ 122.954162][ T2423] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 123.006722][ T2423] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 123.048466][ T2423] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 123.099440][ T2423] pvrusb2: Device being rendered inoperable [ 123.138221][ T2423] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 123.154669][ T5130] usb 4-1: USB disconnect, device number 15 [ 123.190167][ T2423] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 123.230438][ T5568] device syzkaller0 entered promiscuous mode [ 123.246830][ T2423] pvrusb2: Attached sub-driver cx25840 [ 123.267069][ T2423] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 123.296424][ T5569] device syzkaller0 entered promiscuous mode [ 123.340337][ T2423] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 123.486390][ T5572] tipc: Enabled bearer , priority 0 [ 123.540019][ T5572] device syzkaller0 entered promiscuous mode [ 123.587605][ T5572] tipc: Resetting bearer [ 123.617071][ T5571] tipc: Resetting bearer [ 123.648212][ T5571] tipc: Disabling bearer [ 123.698580][ T5578] device syzkaller0 entered promiscuous mode [ 123.734211][ T5579] tipc: Enabled bearer , priority 0 [ 123.779753][ T5576] tipc: Resetting bearer [ 123.841843][ T5576] tipc: Disabling bearer [ 124.025322][ T2301] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 124.205713][ T5129] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 124.292444][ T2301] usb 4-1: Using ep0 maxpacket: 32 [ 124.333901][ T4232] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 124.413176][ T2301] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 124.421188][ T2301] usb 4-1: config 0 has no interface number 0 [ 124.448874][ T2301] usb 4-1: config 0 interface 1 altsetting 9 has an invalid endpoint with address 0x0, skipping [ 124.464659][ T5129] usb 1-1: Using ep0 maxpacket: 8 [ 124.470435][ T5591] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 124.479306][ T2301] usb 4-1: config 0 interface 1 has no altsetting 0 [ 124.593178][ T5129] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 124.607634][ T5129] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 124.617115][ T5129] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.633322][ T5129] usb 1-1: config 0 descriptor?? [ 124.652065][ T2301] usb 4-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 124.667518][ T2301] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.693013][ T2301] usb 4-1: Product: syz [ 124.701592][ T2301] usb 4-1: Manufacturer: syz [ 124.708237][ T4232] usb 3-1: config 0 has an invalid descriptor of length 100, skipping remainder of the config [ 124.727118][ T2301] usb 4-1: SerialNumber: syz [ 124.735837][ T4232] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 124.756158][ T2301] usb 4-1: config 0 descriptor?? [ 124.771918][ T4232] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 124.794338][ T4232] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.820237][ T4232] usb 3-1: config 0 descriptor?? [ 124.894812][ T5129] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 124.984467][ T5130] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 125.043510][ T2301] cx231xx 4-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 125.083501][ T2301] cx231xx 4-1:0.1: Failed to read PCB config [ 125.100616][ T2301] cx231xx: probe of 4-1:0.1 failed with error -71 [ 125.145115][ T2301] usb 4-1: USB disconnect, device number 16 [ 125.173331][ T5129] usb 3-1: USB disconnect, device number 19 [ 125.234623][ T5130] usb 5-1: Using ep0 maxpacket: 16 [ 125.296715][ T4232] usb 1-1: USB disconnect, device number 13 [ 125.523026][ T5130] usb 5-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 125.540811][ T5130] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.563092][ T2301] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 125.570935][ T5130] usb 5-1: Product: syz [ 125.581948][ T5130] usb 5-1: Manufacturer: syz [ 125.592194][ T5130] usb 5-1: SerialNumber: syz [ 125.822453][ T2301] usb 4-1: Using ep0 maxpacket: 32 [ 125.831890][ T5595] device syzkaller0 entered promiscuous mode [ 125.895564][ T5130] usb 5-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 125.914892][ T5130] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 125.927826][ T5130] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 125.943070][ T5130] usb 5-1: media controller created [ 125.962835][ T2301] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 125.980941][ T5130] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 125.992250][ T2301] usb 4-1: config 0 has no interface number 0 [ 126.010012][ T2301] usb 4-1: config 0 interface 1 altsetting 9 has an invalid endpoint with address 0x0, skipping [ 126.042107][ T2301] usb 4-1: config 0 interface 1 has no altsetting 0 [ 126.052515][ T5130] zl10353_read_register: readreg error (reg=127, ret==-71) [ 126.091035][ T5130] dvb_usb_gl861: probe of 5-1:157.0 failed with error -5 [ 126.113974][ T5130] usb 5-1: USB disconnect, device number 15 [ 126.233538][ T2301] usb 4-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 126.258533][ T2301] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.290741][ T2301] usb 4-1: Product: syz [ 126.296521][ T5129] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 126.321835][ T2301] usb 4-1: Manufacturer: syz [ 126.349537][ T2301] usb 4-1: SerialNumber: syz [ 126.361996][ T26] audit: type=1326 audit(1790541161.645:1036): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5613 comm="syz.2.431" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88af0f6159 code=0x7ffc0000 [ 126.401832][ T2301] usb 4-1: config 0 descriptor?? [ 126.476222][ T5618] tipc: Enabled bearer , priority 0 [ 126.490029][ T26] audit: type=1326 audit(1790541161.705:1037): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5613 comm="syz.2.431" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88af0f6159 code=0x7ffc0000 [ 126.537050][ T5623] device syzkaller0 entered promiscuous mode [ 126.588984][ T5618] tipc: Resetting bearer [ 126.617546][ T5625] tipc: Enabling of bearer rejected, failed to enable media [ 126.631593][ T26] audit: type=1326 audit(1790541161.705:1038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5613 comm="syz.2.431" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88af0f6159 code=0x7ffc0000 [ 126.664295][ T5617] tipc: Resetting bearer [ 126.696171][ T5617] tipc: Disabling bearer [ 126.735511][ T5129] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 126.765667][ T26] audit: type=1326 audit(1790541161.705:1039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5613 comm="syz.2.431" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f88af0f6159 code=0x7ffc0000 [ 126.800712][ T5129] usb 1-1: config 8 has 0 interfaces, different from the descriptor's value: 1 [ 126.856695][ T5129] usb 1-1: New USB device found, idVendor=046d, idProduct=0960, bcdDevice=97.b4 [ 126.896565][ T5129] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.906394][ T2301] cx231xx 4-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 126.923040][ T26] audit: type=1326 audit(1790541161.705:1040): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5613 comm="syz.2.431" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88af0f6159 code=0x7ffc0000 [ 127.006376][ T2301] cx231xx 4-1:0.1: Identified as Conexant Hybrid TV - RDU253S (card=4) [ 127.089622][ T26] audit: type=1326 audit(1790541161.705:1041): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5613 comm="syz.2.431" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88af0f6159 code=0x7ffc0000 [ 127.175072][ T2301] cx231xx 4-1:0.1: cx231xx_send_gpio_cmd: failed with status --110 [ 127.194543][ T26] audit: type=1326 audit(1790541161.705:1042): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5613 comm="syz.2.431" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88af0f6159 code=0x7ffc0000 [ 127.242518][ T2301] cx231xx 4-1:0.1: cx231xx_send_gpio_cmd: failed with status --71 [ 127.302448][ T2301] cx231xx 4-1:0.1: cx231xx_send_gpio_cmd: failed with status --71 [ 127.340856][ T26] audit: type=1326 audit(1790541161.705:1043): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5613 comm="syz.2.431" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7f88af0f6159 code=0x7ffc0000 [ 127.365377][ T2301] cx231xx 4-1:0.1: cx231xx_send_gpio_cmd: failed with status --71 [ 127.382371][ T13] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 127.402524][ T2301] cx231xx 4-1:0.1: cx231xx_send_gpio_cmd: failed with status --71 [ 127.431395][ T2301] cx231xx 4-1:0.1: Failed to set devmode to analog: error: -71 [ 127.460966][ T26] audit: type=1326 audit(1790541161.705:1044): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5613 comm="syz.2.431" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88af0f6159 code=0x7ffc0000 [ 127.509363][ T2301] i2c i2c-2: Added multiplexed i2c bus 4 [ 127.535346][ T2301] i2c i2c-2: Added multiplexed i2c bus 5 [ 127.592440][ T2301] cx231xx 4-1:0.1: cx231xx_dev_init: Failed to set Power - errCode [-71]! [ 127.601899][ T26] audit: type=1326 audit(1790541161.715:1045): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5613 comm="syz.2.431" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88af0f6159 code=0x7ffc0000 [ 127.644054][ T1424] ieee802154 phy0 wpan0: encryption failed: -22 [ 127.650456][ T1424] ieee802154 phy1 wpan1: encryption failed: -22 [ 127.662396][ T2301] cx231xx 4-1:0.1: cx231xx_init_dev: cx231xx_i2c_register - errCode [-71]! [ 127.745928][ T2301] cx231xx: probe of 4-1:0.1 failed with error -71 [ 127.772558][ T13] usb 5-1: config 0 has an invalid descriptor of length 100, skipping remainder of the config [ 127.843812][ T2301] usb 4-1: USB disconnect, device number 17 [ 127.881433][ T13] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 127.934716][ T5639] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 127.952407][ T13] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 127.990701][ T13] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.025439][ T13] usb 5-1: config 0 descriptor?? [ 128.138008][ T5644] device syzkaller0 entered promiscuous mode [ 128.174079][ T5644] tipc: Enabling of bearer rejected, failed to enable media [ 128.367166][ T7] usb 5-1: USB disconnect, device number 16 [ 128.465397][ T5649] device syzkaller0 entered promiscuous mode [ 128.595165][ T5129] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 128.612207][ T5652] binder: 5651:5652 ioctl c0306201 0 returned -14 [ 128.863943][ T5129] usb 4-1: Using ep0 maxpacket: 8 [ 128.995139][ T5129] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 129.051676][ T5129] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 129.097814][ T5129] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.148416][ T5129] usb 4-1: config 0 descriptor?? [ 129.456864][ T5129] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 129.583079][ T5131] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 129.669840][ T5664] device syzkaller0 entered promiscuous mode [ 129.688851][ T5664] tipc: Enabled bearer , priority 0 [ 129.715124][ T5663] tipc: Resetting bearer [ 129.740660][ T5663] tipc: Disabling bearer [ 129.842486][ T5131] usb 5-1: Using ep0 maxpacket: 16 [ 129.860474][ T13] usb 4-1: USB disconnect, device number 18 [ 129.891093][ T5666] tipc: Enabled bearer , priority 0 [ 129.916771][ T4232] usb 1-1: USB disconnect, device number 14 [ 129.936615][ T5666] device syzkaller0 entered promiscuous mode [ 129.986221][ T5665] tipc: Resetting bearer [ 130.029065][ T5665] tipc: Disabling bearer [ 130.132592][ T5131] usb 5-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 130.161227][ T5131] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.194610][ T5131] usb 5-1: Product: syz [ 130.209303][ T5131] usb 5-1: Manufacturer: syz [ 130.241267][ T5131] usb 5-1: SerialNumber: syz [ 130.543423][ T5131] usb 5-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 130.587184][ T5131] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 130.623098][ T4232] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 130.652094][ T5131] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 130.686736][ T5131] usb 5-1: media controller created [ 130.728360][ T5131] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 130.782509][ T5131] zl10353_read_register: readreg error (reg=127, ret==-71) [ 130.834540][ T4232] usb 3-1: device descriptor read/64, error -71 [ 130.847332][ T5677] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 130.865570][ T5131] dvb_usb_gl861: probe of 5-1:157.0 failed with error -5 [ 130.896998][ T5131] usb 5-1: USB disconnect, device number 17 [ 131.122537][ T4232] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 131.197231][ T5688] device syzkaller0 entered promiscuous mode [ 131.255935][ T5688] tipc: Enabling of bearer rejected, failed to enable media [ 131.354433][ T4232] usb 3-1: device descriptor read/64, error -71 [ 131.497789][ T4232] usb usb3-port1: attempt power cycle [ 131.515213][ T5699] tipc: Enabled bearer , priority 0 [ 131.522479][ T5131] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 131.565739][ T5703] device syzkaller0 entered promiscuous mode [ 131.648062][ T5698] tipc: Resetting bearer [ 131.666763][ T26] kauditd_printk_skb: 251 callbacks suppressed [ 131.666773][ T26] audit: type=1804 audit(1790541166.955:1297): pid=5708 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.459" name="bus" dev="ramfs" ino=38549 res=1 errno=0 [ 131.723676][ T5698] tipc: Disabling bearer [ 131.751055][ T5709] device syzkaller0 entered promiscuous mode [ 131.775579][ T5710] tipc: Enabled bearer , priority 0 [ 131.799384][ T26] audit: type=1804 audit(1790541166.985:1298): pid=5708 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.459" name="bus" dev="ramfs" ino=38549 res=1 errno=0 [ 131.833814][ T5704] tipc: Resetting bearer [ 131.901358][ T5704] tipc: Disabling bearer [ 131.913601][ T5131] usb 4-1: config 0 has an invalid descriptor of length 100, skipping remainder of the config [ 131.942438][ T4232] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 131.960297][ T5131] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 132.000018][ T5131] usb 4-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 132.037251][ T5131] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.046048][ T4232] usb 3-1: device descriptor read/8, error -71 [ 132.079913][ T5131] usb 4-1: config 0 descriptor?? [ 132.313993][ T4232] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 132.373921][ T5129] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 132.399441][ T5131] usb 4-1: USB disconnect, device number 19 [ 132.423548][ T4232] usb 3-1: device descriptor read/8, error -71 [ 132.554985][ T4232] usb usb3-port1: unable to enumerate USB device [ 132.594029][ T7] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 132.633943][ T5129] usb 5-1: Using ep0 maxpacket: 8 [ 132.754187][ T5129] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 132.778311][ T5129] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 132.800425][ T5129] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.827832][ T5129] usb 5-1: config 0 descriptor?? [ 132.963571][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 132.988882][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 133.019598][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 133.223106][ T7] usb 1-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 133.262901][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.307477][ T7] usb 1-1: Product: syz [ 133.317025][ T5129] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 133.341019][ T7] usb 1-1: Manufacturer: syz [ 133.358314][ T5724] device syzkaller0 entered promiscuous mode [ 133.368365][ T7] usb 1-1: SerialNumber: syz [ 133.385601][ T5129] usb 5-1: USB disconnect, device number 18 [ 133.419074][ T7] usb 1-1: config 0 descriptor?? [ 133.716231][ T7] adutux 1-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 133.803581][ T5131] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 133.934787][ T5129] usb 1-1: USB disconnect, device number 15 [ 134.062411][ T5131] usb 3-1: Using ep0 maxpacket: 16 [ 134.354588][ T5131] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 134.388341][ T5131] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.420957][ T5131] usb 3-1: Product: syz [ 134.444692][ T5131] usb 3-1: Manufacturer: syz [ 134.481023][ T5131] usb 3-1: SerialNumber: syz [ 134.504026][ T26] audit: type=1326 audit(1790541169.795:1299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5732 comm="syz.3.467" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 134.607387][ T26] audit: type=1326 audit(1790541169.845:1300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5732 comm="syz.3.467" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 134.711212][ T26] audit: type=1326 audit(1790541169.845:1301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5732 comm="syz.3.467" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 134.813489][ T5131] usb 3-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 134.841053][ T26] audit: type=1326 audit(1790541169.845:1302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5732 comm="syz.3.467" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 134.888608][ T5131] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 134.938985][ T5131] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 134.998148][ T5131] usb 3-1: media controller created [ 135.010177][ T26] audit: type=1326 audit(1790541169.845:1303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5732 comm="syz.3.467" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 135.069538][ T5131] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 135.099361][ T5739] device syzkaller0 entered promiscuous mode [ 135.137164][ T5739] tipc: Enabling of bearer rejected, failed to enable media [ 135.169210][ T26] audit: type=1326 audit(1790541169.845:1304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5732 comm="syz.3.467" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 135.197554][ T5131] zl10353_read_register: readreg error (reg=127, ret==-71) [ 135.293628][ T5131] dvb_usb_gl861: probe of 3-1:157.0 failed with error -5 [ 135.345167][ T5131] usb 3-1: USB disconnect, device number 24 [ 135.356704][ T26] audit: type=1326 audit(1790541169.845:1305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5732 comm="syz.3.467" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 135.446566][ T5743] device syzkaller0 entered promiscuous mode [ 135.475919][ T5750] tipc: Enabled bearer , priority 0 [ 135.506674][ T26] audit: type=1326 audit(1790541169.845:1306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5732 comm="syz.3.467" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7f0014a85159 code=0x7ffc0000 [ 135.548767][ T5757] device syzkaller0 entered promiscuous mode [ 135.638120][ T5748] tipc: Enabled bearer , priority 0 [ 135.667182][ T5742] tipc: Resetting bearer [ 135.716193][ T5742] tipc: Disabling bearer [ 135.750409][ T5746] tipc: Resetting bearer [ 135.775411][ T5746] tipc: Disabling bearer [ 135.890045][ T5767] device syzkaller0 entered promiscuous mode [ 136.194542][ T5130] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 136.320235][ T5129] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 136.414673][ T5130] usb 5-1: device descriptor read/64, error -71 [ 136.574852][ T5129] usb 1-1: Using ep0 maxpacket: 8 [ 136.694496][ T5130] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 136.702720][ T5129] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 136.728680][ T5129] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 136.751033][ T5129] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.792205][ T5129] usb 1-1: config 0 descriptor?? [ 136.915158][ T5130] usb 5-1: device descriptor read/64, error -71 [ 137.043116][ T5130] usb usb5-port1: attempt power cycle [ 137.155840][ T4232] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 137.276897][ T5129] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 137.330867][ T5129] usb 1-1: USB disconnect, device number 16 [ 137.472410][ T5130] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 137.543519][ T4232] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 137.577357][ T4232] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 137.592547][ T5130] usb 5-1: device descriptor read/8, error -71 [ 137.623477][ T4232] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 137.814058][ T5129] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 137.822638][ T4232] usb 3-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 137.865482][ T4232] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.876626][ T5130] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 137.902989][ T5804] device syzkaller0 entered promiscuous mode [ 137.917446][ T4232] usb 3-1: Product: syz [ 137.940033][ T4232] usb 3-1: Manufacturer: syz [ 137.947321][ T5804] tipc: Enabling of bearer rejected, failed to enable media [ 137.962379][ T4232] usb 3-1: SerialNumber: syz [ 137.990361][ T4232] usb 3-1: config 0 descriptor?? [ 137.997539][ T5130] usb 5-1: device descriptor read/8, error -71 [ 138.093903][ T5129] usb 4-1: Using ep0 maxpacket: 16 [ 138.124355][ T5130] usb usb5-port1: unable to enumerate USB device [ 138.286009][ T4232] adutux 3-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 138.394037][ T5129] usb 4-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 138.420549][ T5129] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.453980][ T5129] usb 4-1: Product: syz [ 138.458254][ T5129] usb 4-1: Manufacturer: syz [ 138.497933][ T5129] usb 4-1: SerialNumber: syz [ 138.519460][ T4232] usb 3-1: USB disconnect, device number 25 [ 138.709313][ T26] kauditd_printk_skb: 112 callbacks suppressed [ 138.709323][ T26] audit: type=1326 audit(1790541173.995:1419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5812 comm="syz.4.487" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 138.793420][ T5129] usb 4-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 138.812417][ T13] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 138.850350][ T5129] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 138.877328][ T26] audit: type=1326 audit(1790541174.035:1420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5812 comm="syz.4.487" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 138.917392][ T5129] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 138.949068][ T5129] usb 4-1: media controller created [ 138.976724][ T26] audit: type=1326 audit(1790541174.035:1421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5812 comm="syz.4.487" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 139.006902][ T5129] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 139.062519][ T5129] zl10353_read_register: readreg error (reg=127, ret==-71) [ 139.095169][ T26] audit: type=1326 audit(1790541174.035:1422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5812 comm="syz.4.487" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 139.151846][ T5129] dvb_usb_gl861: probe of 4-1:157.0 failed with error -5 [ 139.196353][ T5129] usb 4-1: USB disconnect, device number 20 [ 139.231107][ T26] audit: type=1326 audit(1790541174.035:1423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5812 comm="syz.4.487" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 139.261337][ T13] usb 1-1: config 0 has an invalid descriptor of length 100, skipping remainder of the config [ 139.300258][ T13] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 139.339053][ T13] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 139.358715][ T26] audit: type=1326 audit(1790541174.045:1424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5812 comm="syz.4.487" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 139.389448][ T13] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.426711][ T13] usb 1-1: config 0 descriptor?? [ 139.437471][ T5818] device syzkaller0 entered promiscuous mode [ 139.475116][ T26] audit: type=1326 audit(1790541174.045:1425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5812 comm="syz.4.487" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 139.571641][ T26] audit: type=1326 audit(1790541174.045:1426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5812 comm="syz.4.487" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 139.678144][ T5820] device syzkaller0 entered promiscuous mode [ 139.688903][ T26] audit: type=1326 audit(1790541174.045:1427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5812 comm="syz.4.487" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 139.745637][ T5821] tipc: Enabled bearer , priority 0 [ 139.765118][ T4232] usb 1-1: USB disconnect, device number 17 [ 139.807175][ T5819] tipc: Resetting bearer [ 139.852267][ T5819] tipc: Disabling bearer [ 139.861072][ T26] audit: type=1326 audit(1790541174.045:1428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5812 comm="syz.4.487" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fddb8f4c159 code=0x7ffc0000 [ 140.020792][ T5831] binder: BINDER_SET_CONTEXT_MGR already set [ 140.048455][ T5831] binder: 5830:5831 ioctl 4018620d 200000001000 returned -16 [ 140.194890][ T5841] device syzkaller0 entered promiscuous mode [ 140.235507][ T5841] tipc: Enabling of bearer rejected, failed to enable media [ 140.803950][ T4232] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 140.883939][ T13] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 141.073448][ T4232] usb 1-1: Using ep0 maxpacket: 16 [ 141.092570][ T13] usb 5-1: device descriptor read/64, error -71 [ 141.307561][ T5873] tipc: Enabling of bearer rejected, failed to enable media [ 141.364125][ T4232] usb 1-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 141.388441][ T4232] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.397874][ T13] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 141.424141][ T5129] usb 3-1: new full-speed USB device number 26 using dummy_hcd [ 141.441953][ T4232] usb 1-1: Product: syz [ 141.452084][ T4232] usb 1-1: Manufacturer: syz [ 141.477321][ T4232] usb 1-1: SerialNumber: syz [ 141.604036][ T13] usb 5-1: device descriptor read/64, error -71 [ 141.663999][ T5130] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 141.734028][ T13] usb usb5-port1: attempt power cycle [ 141.783903][ T4232] usb 1-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 141.802830][ T5129] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 141.838854][ T4232] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 141.850781][ T5129] usb 3-1: config 8 has 0 interfaces, different from the descriptor's value: 1 [ 141.871668][ T4232] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 141.883550][ T5129] usb 3-1: New USB device found, idVendor=046d, idProduct=0960, bcdDevice=97.b4 [ 141.903905][ T4232] usb 1-1: media controller created [ 141.909195][ T5129] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.947640][ T4232] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 141.998380][ T5890] tipc: Enabling of bearer rejected, failed to enable media [ 142.037942][ T4232] zl10353_read_register: readreg error (reg=127, ret==-71) [ 142.047739][ T5130] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 142.082019][ T5130] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 142.108446][ T4232] dvb_usb_gl861: probe of 1-1:157.0 failed with error -5 [ 142.123061][ T5130] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 142.150261][ T4232] usb 1-1: USB disconnect, device number 18 [ 142.174601][ T13] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 142.314726][ T13] usb 5-1: device descriptor read/8, error -71 [ 142.354832][ T5130] usb 4-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 142.370004][ T5906] binder: BINDER_SET_CONTEXT_MGR already set [ 142.386362][ T5130] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.398937][ T5906] binder: 5905:5906 ioctl 4018620d 200000001000 returned -16 [ 142.416397][ T5130] usb 4-1: Product: syz [ 142.427982][ T5130] usb 4-1: Manufacturer: syz [ 142.440068][ T5130] usb 4-1: SerialNumber: syz [ 142.462289][ T5130] usb 4-1: config 0 descriptor?? [ 142.603649][ T13] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 142.703676][ T13] usb 5-1: device descriptor read/8, error -71 [ 142.725235][ T5130] adutux 4-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 142.834096][ T13] usb usb5-port1: unable to enumerate USB device [ 142.945867][ T13] usb 4-1: USB disconnect, device number 21 [ 143.647157][ T5921] device syzkaller0 entered promiscuous mode [ 143.978831][ T5927] tipc: Enabling of bearer rejected, failed to enable media [ 144.208765][ T13] usb 3-1: USB disconnect, device number 26 [ 144.248508][ T26] kauditd_printk_skb: 222 callbacks suppressed [ 144.248518][ T26] audit: type=1326 audit(1790541179.535:1651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5929 comm="syz.1.518" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f097ebb2159 code=0x7ffc0000 [ 144.499734][ T26] audit: type=1326 audit(1790541179.575:1652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5929 comm="syz.1.518" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f097ebb2159 code=0x7ffc0000 [ 144.603146][ T5936] device syzkaller0 entered promiscuous mode [ 144.669273][ T5936] tipc: Enabling of bearer rejected, failed to enable media [ 144.701571][ T26] audit: type=1326 audit(1790541179.575:1653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5929 comm="syz.1.518" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f097ebb2159 code=0x7ffc0000 [ 144.873885][ T5942] binder: BINDER_SET_CONTEXT_MGR already set [ 144.901862][ T26] audit: type=1326 audit(1790541179.575:1654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5929 comm="syz.1.518" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f097ebb2159 code=0x7ffc0000 [ 144.932398][ T13] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 144.946991][ T5942] binder: 5939:5942 ioctl 4018620d 200000001000 returned -16 [ 145.021584][ T26] audit: type=1326 audit(1790541179.605:1655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5929 comm="syz.1.518" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f097ebb2159 code=0x7ffc0000 [ 145.085463][ T26] audit: type=1326 audit(1790541179.605:1656): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5929 comm="syz.1.518" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f097ebb2159 code=0x7ffc0000 [ 145.116596][ T2301] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 145.202863][ T26] audit: type=1326 audit(1790541179.605:1657): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5929 comm="syz.1.518" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f097ebb2159 code=0x7ffc0000 [ 145.232368][ T5130] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 145.309434][ T26] audit: type=1326 audit(1790541179.615:1658): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5929 comm="syz.1.518" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7f097ebb2159 code=0x7ffc0000 [ 145.339318][ T13] usb 5-1: config 0 has an invalid descriptor of length 100, skipping remainder of the config [ 145.370012][ T13] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 145.394980][ T2301] usb 3-1: Using ep0 maxpacket: 16 [ 145.400425][ T13] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 145.423635][ T26] audit: type=1326 audit(1790541179.615:1659): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5929 comm="syz.1.518" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f097ebb2159 code=0x7ffc0000 [ 145.452380][ T5130] usb 4-1: device descriptor read/64, error -71 [ 145.465154][ T13] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.492968][ T13] usb 5-1: config 0 descriptor?? [ 145.517230][ T26] audit: type=1326 audit(1790541179.615:1660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5929 comm="syz.1.518" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f097ebb2159 code=0x7ffc0000 [ 145.712518][ T2301] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 145.738671][ T2301] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.749653][ T5130] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 145.776012][ T5938] ================================================================== [ 145.784269][ T5938] BUG: KASAN: use-after-free in tcf_ct_act+0x361f/0x3b40 [ 145.791373][ T5938] Write of size 4 at addr ffff88801e9c7814 by task syz.4.521/5938 [ 145.799364][ T5938] [ 145.801683][ T5938] CPU: 0 PID: 5938 Comm: syz.4.521 Not tainted syzkaller #0 [ 145.808948][ T5938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 145.818987][ T5938] Call Trace: [ 145.822258][ T5938] [ 145.825204][ T5938] dump_stack_lvl+0x188/0x250 [ 145.829866][ T5938] ? show_regs_print_info+0x20/0x20 [ 145.835061][ T5938] ? load_image+0x410/0x410 [ 145.839542][ T5938] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 145.844985][ T5938] ? ipv6_defrag+0x3a0/0x3a0 [ 145.849556][ T5938] print_address_description+0x60/0x2d0 [ 145.855105][ T5938] ? tcf_ct_act+0x361f/0x3b40 [ 145.859782][ T5938] kasan_report+0xdf/0x130 [ 145.864185][ T5938] ? tcf_ct_act+0x361f/0x3b40 [ 145.868845][ T5938] tcf_ct_act+0x361f/0x3b40 [ 145.873357][ T5938] ? tunnel_key_exit_net+0x100/0x100 [ 145.878637][ T5938] ? __lock_acquire+0x13dc/0x7b50 [ 145.883646][ T5938] ? skb_copy_bits+0x310/0x740 [ 145.888390][ T5938] ? skb_zerocopy+0x198/0x10a0 [ 145.893141][ T5938] ? rcu_lockdep_current_cpu_online+0x35/0x130 [ 145.899278][ T5938] ? rcu_read_lock_held+0x40/0x40 [ 145.904284][ T5938] tcf_action_exec+0x177/0x570 [ 145.909030][ T5938] tcf_classify+0x218/0xad0 [ 145.913522][ T5938] __netif_receive_skb_core+0x1cd8/0x3670 [ 145.919234][ T5938] ? set_rps_cpu+0x660/0x660 [ 145.923808][ T5938] ? ktime_get_with_offset+0xff/0x320 [ 145.929329][ T5938] ? read_lock_is_recursive+0x10/0x10 [ 145.934738][ T5938] ? lock_chain_count+0x20/0x20 [ 145.939582][ T5938] ? do_user_addr_fault+0x69f/0xc90 [ 145.944796][ T5938] __netif_receive_skb+0x74/0x290 [ 145.949841][ T5938] ? ktime_get_with_offset+0x2d7/0x320 [ 145.955310][ T5938] netif_receive_skb+0x19e/0x700 [ 145.960248][ T5938] ? __bpf_trace_softirq+0x10/0x10 [ 145.965431][ T5938] ? netif_receive_skb_core+0x210/0x210 [ 145.971075][ T5938] tun_rx_batched+0x606/0x760 [ 145.975741][ T5938] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0 [ 145.981911][ T5938] ? local_bh_enable+0x20/0x20 [ 145.986676][ T5938] ? __local_bh_enable_ip+0x136/0x1c0 [ 145.992158][ T5938] ? read_lock_is_recursive+0x10/0x10 [ 145.997532][ T5938] ? __local_bh_enable_ip+0x136/0x1c0 [ 146.002896][ T5938] ? _local_bh_enable+0xa0/0xa0 [ 146.007738][ T5938] tun_get_user+0x2bf4/0x3b10 [ 146.012469][ T5938] ? tun_ring_recv+0xc90/0xc90 [ 146.017254][ T5938] ? rcu_lock_release+0x5/0x20 [ 146.022110][ T5938] ? __lock_acquire+0x7b50/0x7b50 [ 146.027150][ T5938] tun_chr_write_iter+0x112/0x1e0 [ 146.032176][ T5938] vfs_write+0x748/0xd70 [ 146.036447][ T5938] ? file_end_write+0x250/0x250 [ 146.041320][ T5938] ? __fget_files+0x402/0x470 [ 146.045996][ T5938] ? __fdget_pos+0x1e2/0x370 [ 146.050602][ T5938] ? ksys_write+0x70/0x260 [ 146.055012][ T5938] ksys_write+0x153/0x260 [ 146.059329][ T5938] ? __ia32_sys_read+0x80/0x80 [ 146.064079][ T5938] ? lockdep_hardirqs_on+0x94/0x140 [ 146.069467][ T5938] do_syscall_64+0x4c/0xa0 [ 146.074114][ T5938] ? clear_bhb_loop+0x30/0x80 [ 146.078838][ T5938] ? clear_bhb_loop+0x30/0x80 [ 146.083515][ T5938] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 146.089400][ T5938] RIP: 0033:0x7fddb8f4c159 [ 146.093808][ T5938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.113511][ T5938] RSP: 002b:00007fddb71a4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 146.121952][ T5938] RAX: ffffffffffffffda RBX: 00007fddb91d3fa0 RCX: 00007fddb8f4c159 [ 146.129917][ T5938] RDX: 0000000000000fce RSI: 0000200000001280 RDI: 0000000000000003 [ 146.137872][ T5938] RBP: 00007fddb8fe306b R08: 0000000000000000 R09: 0000000000000000 [ 146.145828][ T5938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 146.153787][ T5938] R13: 00007fddb91d4038 R14: 00007fddb91d3fa0 R15: 00007fff138415d8 [ 146.161753][ T5938] [ 146.164756][ T5938] [ 146.167061][ T5938] Allocated by task 5938: [ 146.171365][ T5938] __kasan_slab_alloc+0x92/0xc0 [ 146.176201][ T5938] slab_post_alloc_hook+0x4c/0x380 [ 146.181290][ T5938] kmem_cache_alloc_node+0x184/0x2c0 [ 146.186557][ T5938] __alloc_skb+0xf4/0x750 [ 146.190863][ T5938] alloc_skb_with_frags+0xa7/0x720 [ 146.195967][ T5938] sock_alloc_send_pskb+0x87f/0x9a0 [ 146.201144][ T5938] tun_get_user+0x8f7/0x3b10 [ 146.205710][ T5938] tun_chr_write_iter+0x112/0x1e0 [ 146.210711][ T5938] vfs_write+0x748/0xd70 [ 146.214956][ T5938] ksys_write+0x153/0x260 [ 146.219261][ T5938] do_syscall_64+0x4c/0xa0 [ 146.223683][ T5938] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 146.229557][ T5938] [ 146.231878][ T5938] Freed by task 5938: [ 146.236032][ T5938] kasan_set_track+0x4b/0x70 [ 146.240622][ T5938] kasan_set_free_info+0x1f/0x40 [ 146.245553][ T5938] ____kasan_slab_free+0xd5/0x110 [ 146.250559][ T5938] slab_free_freelist_hook+0xec/0x170 [ 146.256015][ T5938] kmem_cache_free+0x8f/0x210 [ 146.260668][ T5938] nf_ct_frag6_gather+0x1002/0x1da0 [ 146.265843][ T5938] tcf_ct_act+0xc8d/0x3b40 [ 146.270244][ T5938] tcf_action_exec+0x177/0x570 [ 146.275008][ T5938] tcf_classify+0x218/0xad0 [ 146.279503][ T5938] __netif_receive_skb_core+0x1cd8/0x3670 [ 146.285201][ T5938] __netif_receive_skb+0x74/0x290 [ 146.290204][ T5938] netif_receive_skb+0x19e/0x700 [ 146.295120][ T5938] tun_rx_batched+0x606/0x760 [ 146.299773][ T5938] tun_get_user+0x2bf4/0x3b10 [ 146.304430][ T5938] tun_chr_write_iter+0x112/0x1e0 [ 146.309436][ T5938] vfs_write+0x748/0xd70 [ 146.313677][ T5938] ksys_write+0x153/0x260 [ 146.317997][ T5938] do_syscall_64+0x4c/0xa0 [ 146.322406][ T5938] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 146.328301][ T5938] [ 146.330606][ T5938] The buggy address belongs to the object at ffff88801e9c7780 [ 146.330606][ T5938] which belongs to the cache skbuff_head_cache of size 232 [ 146.345186][ T5938] The buggy address is located 148 bytes inside of [ 146.345186][ T5938] 232-byte region [ffff88801e9c7780, ffff88801e9c7868) [ 146.358442][ T5938] The buggy address belongs to the page: [ 146.364063][ T5938] page:ffffea00007a71c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1e9c7 [ 146.374190][ T5938] memcg:ffff88805e8a2301 [ 146.378408][ T5938] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 146.385953][ T5938] raw: 00fff00000000200 0000000000000000 0000000100000001 ffff88801bbe4140 [ 146.394533][ T5938] raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff88805e8a2301 [ 146.403087][ T5938] page dumped because: kasan: bad access detected [ 146.409487][ T5938] page_owner tracks the page as allocated [ 146.415175][ T5938] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY), pid 4188, ts 56040841177, free_ts 55986635193 [ 146.431208][ T5938] get_page_from_freelist+0x24f6/0x2670 [ 146.436759][ T5938] __alloc_pages+0x1ee/0x480 [ 146.441328][ T5938] new_slab+0xc0/0x4b0 [ 146.445372][ T5938] ___slab_alloc+0x807/0xdd0 [ 146.449938][ T5938] kmem_cache_alloc_node+0x118/0x2c0 [ 146.455212][ T5938] __alloc_skb+0xf4/0x750 [ 146.459537][ T5938] rtmsg_ifinfo_build_skb+0x80/0x180 [ 146.464821][ T5938] rtmsg_ifinfo+0x71/0x120 [ 146.469222][ T5938] __dev_notify_flags+0xdc/0x300 [ 146.474140][ T5938] dev_change_flags+0xda/0x1a0 [ 146.478883][ T5938] do_setlink+0xca4/0x29d0 [ 146.484864][ T5938] rtnl_newlink+0x15bb/0x1920 [ 146.489886][ T5938] rtnetlink_rcv_msg+0x7f1/0xf10 [ 146.494843][ T5938] netlink_rcv_skb+0x1e9/0x430 [ 146.499590][ T5938] netlink_unicast+0x78f/0x940 [ 146.504425][ T5938] netlink_sendmsg+0x8ba/0xbe0 [ 146.509259][ T5938] page last free stack trace: [ 146.514043][ T5938] free_unref_page_prepare+0x637/0x6c0 [ 146.519585][ T5938] free_unref_page+0x8f/0x2a0 [ 146.524266][ T5938] __unfreeze_partials+0x188/0x1e0 [ 146.529504][ T5938] put_cpu_partial+0x12d/0x190 [ 146.534284][ T5938] qlist_free_all+0x35/0x90 [ 146.538790][ T5938] kasan_quarantine_reduce+0x150/0x160 [ 146.544317][ T5938] __kasan_slab_alloc+0x2f/0xc0 [ 146.549153][ T5938] slab_post_alloc_hook+0x4c/0x380 [ 146.554246][ T5938] __kmalloc+0x189/0x340 [ 146.558466][ T5938] fib_create_info+0xad1/0x2450 [ 146.563322][ T5938] fib_table_insert+0xe4/0x1b80 [ 146.568155][ T5938] fib_magic+0x2ca/0x3b0 [ 146.572492][ T5938] fib_add_ifaddr+0x135/0x5c0 [ 146.577171][ T5938] fib_inetaddr_event+0x13c/0x1c0 [ 146.582203][ T5938] blocking_notifier_call_chain+0x103/0x1b0 [ 146.588119][ T5938] __inet_insert_ifa+0x9ea/0xbd0 [ 146.593051][ T5938] [ 146.595387][ T5938] Memory state around the buggy address: [ 146.600998][ T5938] ffff88801e9c7700: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc [ 146.609039][ T5938] ffff88801e9c7780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 146.617083][ T5938] >ffff88801e9c7800: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 146.625122][ T5938] ^ [ 146.629691][ T5938] ffff88801e9c7880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 146.637732][ T5938] ffff88801e9c7900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 146.645770][ T5938] ================================================================== [ 146.653809][ T5938] Disabling lock debugging due to kernel taint [ 146.660115][ T5938] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 146.667287][ T5938] CPU: 0 PID: 5938 Comm: syz.4.521 Tainted: G B syzkaller #0 [ 146.675944][ T5938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 146.686001][ T5938] Call Trace: [ 146.689283][ T5938] [ 146.692218][ T5938] dump_stack_lvl+0x188/0x250 [ 146.696879][ T5938] ? show_regs_print_info+0x20/0x20 [ 146.702496][ T5938] ? load_image+0x410/0x410 [ 146.706980][ T5938] panic+0x2f8/0x850 [ 146.710861][ T5938] ? bpf_jit_dump+0xd0/0xd0 [ 146.715350][ T5938] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 146.721247][ T5938] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 146.727116][ T5938] ? _raw_spin_unlock+0x40/0x40 [ 146.731974][ T5938] ? tcf_ct_act+0x361f/0x3b40 [ 146.736674][ T5938] check_panic_on_warn+0x80/0xa0 [ 146.741833][ T5938] ? tcf_ct_act+0x361f/0x3b40 [ 146.746625][ T5938] end_report+0x6d/0xf0 [ 146.750783][ T5938] kasan_report+0x102/0x130 [ 146.755289][ T5938] ? tcf_ct_act+0x361f/0x3b40 [ 146.760056][ T5938] tcf_ct_act+0x361f/0x3b40 [ 146.764705][ T5938] ? tunnel_key_exit_net+0x100/0x100 [ 146.770099][ T5938] ? __lock_acquire+0x13dc/0x7b50 [ 146.775219][ T5938] ? skb_copy_bits+0x310/0x740 [ 146.779990][ T5938] ? skb_zerocopy+0x198/0x10a0 [ 146.784920][ T5938] ? rcu_lockdep_current_cpu_online+0x35/0x130 [ 146.791069][ T5938] ? rcu_read_lock_held+0x40/0x40 [ 146.796092][ T5938] tcf_action_exec+0x177/0x570 [ 146.800855][ T5938] tcf_classify+0x218/0xad0 [ 146.805364][ T5938] __netif_receive_skb_core+0x1cd8/0x3670 [ 146.811088][ T5938] ? set_rps_cpu+0x660/0x660 [ 146.815698][ T5938] ? ktime_get_with_offset+0xff/0x320 [ 146.821069][ T5938] ? read_lock_is_recursive+0x10/0x10 [ 146.826554][ T5938] ? lock_chain_count+0x20/0x20 [ 146.831404][ T5938] ? do_user_addr_fault+0x69f/0xc90 [ 146.836615][ T5938] __netif_receive_skb+0x74/0x290 [ 146.841628][ T5938] ? ktime_get_with_offset+0x2d7/0x320 [ 146.847065][ T5938] netif_receive_skb+0x19e/0x700 [ 146.852078][ T5938] ? __bpf_trace_softirq+0x10/0x10 [ 146.857212][ T5938] ? netif_receive_skb_core+0x210/0x210 [ 146.862771][ T5938] tun_rx_batched+0x606/0x760 [ 146.867436][ T5938] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0 [ 146.873407][ T5938] ? local_bh_enable+0x20/0x20 [ 146.878168][ T5938] ? __local_bh_enable_ip+0x136/0x1c0 [ 146.883528][ T5938] ? read_lock_is_recursive+0x10/0x10 [ 146.888911][ T5938] ? __local_bh_enable_ip+0x136/0x1c0 [ 146.894280][ T5938] ? _local_bh_enable+0xa0/0xa0 [ 146.899113][ T5938] tun_get_user+0x2bf4/0x3b10 [ 146.903782][ T5938] ? tun_ring_recv+0xc90/0xc90 [ 146.908542][ T5938] ? rcu_lock_release+0x5/0x20 [ 146.913575][ T5938] ? __lock_acquire+0x7b50/0x7b50 [ 146.918595][ T5938] tun_chr_write_iter+0x112/0x1e0 [ 146.923627][ T5938] vfs_write+0x748/0xd70 [ 146.927864][ T5938] ? file_end_write+0x250/0x250 [ 146.932707][ T5938] ? __fget_files+0x402/0x470 [ 146.937594][ T5938] ? __fdget_pos+0x1e2/0x370 [ 146.942171][ T5938] ? ksys_write+0x70/0x260 [ 146.946590][ T5938] ksys_write+0x153/0x260 [ 146.950904][ T5938] ? __ia32_sys_read+0x80/0x80 [ 146.955662][ T5938] ? lockdep_hardirqs_on+0x94/0x140 [ 146.960844][ T5938] do_syscall_64+0x4c/0xa0 [ 146.965236][ T5938] ? clear_bhb_loop+0x30/0x80 [ 146.969896][ T5938] ? clear_bhb_loop+0x30/0x80 [ 146.974568][ T5938] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 146.980569][ T5938] RIP: 0033:0x7fddb8f4c159 [ 146.985058][ T5938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 147.004774][ T5938] RSP: 002b:00007fddb71a4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 147.013176][ T5938] RAX: ffffffffffffffda RBX: 00007fddb91d3fa0 RCX: 00007fddb8f4c159 [ 147.021303][ T5938] RDX: 0000000000000fce RSI: 0000200000001280 RDI: 0000000000000003 [ 147.029256][ T5938] RBP: 00007fddb8fe306b R08: 0000000000000000 R09: 0000000000000000 [ 147.037245][ T5938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 147.045740][ T5938] R13: 00007fddb91d4038 R14: 00007fddb91d3fa0 R15: 00007fff138415d8 [ 147.053864][ T5938] [ 147.056940][ T5938] Kernel Offset: disabled [ 147.061539][ T5938] Rebooting in 86400 seconds..