last executing test programs: 8.142882398s ago: executing program 3 (id=586): sendmmsg(0xffffffffffffffff, &(0x7f0000004cc0)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000180)="4166deb08f5490e60cbd5dc80404c8a1d8b1dcefa938cbb0a2ca79523b6cc1574a6c7282edd54fa942633e7cf2fddaf1b19a9bd2aded624ffe3ed905bd5bc2ef28c3c689bdc609239748afb03e5201f0edcb4e0edfc9f07805d021a76bd013330c33937875ea24a4e7b7c9150afbfb67c43037a0f32d72c4b8b6a70cd359878738", 0x81}], 0x1}}], 0x1, 0x0) r0 = syz_io_uring_setup(0x10d6, &(0x7f0000000280)={0x0, 0x80003734, 0x100, 0xfffffffa, 0x280}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000540)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x4e24, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000340)=0x8) setsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000040)=@assoc_value={r6, 0x9}, 0x8) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x15523ea56aa22bf4, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r0, 0x47bc, 0x0, 0x4000000000000000, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8983, &(0x7f0000000240)) r7 = socket$inet_sctp(0x2, 0x0, 0x84) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x66, &(0x7f0000000100)={r5, 0x4}, &(0x7f0000000140)=0x8) 8.042634674s ago: executing program 1 (id=587): r0 = creat(&(0x7f0000000000)='./file0\x00', 0x40) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='coredump_filter\x00') fcntl$setstatus(r1, 0x4, 0x40800) syz_io_uring_setup(0xbd9, &(0x7f0000000640)={0x0, 0xe826, 0x800, 0x1, 0x3c3}, &(0x7f0000000dc0), &(0x7f0000000000)) (async) r2 = syz_io_uring_setup(0xbd9, &(0x7f0000000640)={0x0, 0xe826, 0x800, 0x1, 0x3c3}, &(0x7f0000000dc0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r2, 0x847ba, 0x0, 0xe, 0x0, 0x0) (async) io_uring_enter(r2, 0x847ba, 0x0, 0xe, 0x0, 0x0) fcntl$getown(r0, 0x9) (async) fcntl$getown(r0, 0x9) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x3) r8 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r8, 0x0, 0x0) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, 0x0) (async) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, 0x0) 7.744801195s ago: executing program 1 (id=589): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r3 = socket$tipc(0x1e, 0x5, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0x1d0, 0x21, 0x1, 0x0, 0x4, {{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@migrate={0x180, 0x11, [{@in6=@remote, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@rand_addr=' \x01\x00', @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x2b, 0x2, 0x0, 0x3501, 0x2, 0x2}, {@in=@multicast1, @in=@local, @in6=@private2, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x33, 0x4, 0x0, 0x34ff, 0x2, 0x2}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x35}, @in=@local, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x3c, 0x2, 0x0, 0x0, 0xa, 0x8}, {@in=@private=0xa010102, @in6=@empty, @in=@local, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x3c, 0x0, 0x0, 0x3505, 0x2, 0xa}, {@in=@loopback, @in6=@remote, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x33, 0x4, 0x0, 0x3503, 0xa, 0x2}]}]}, 0x1d0}}, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r6 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r6, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) bind$tipc(r3, 0x0, 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) r8 = syz_open_dev$video4linux(&(0x7f0000000000), 0x7, 0x48902) ioctl$VIDIOC_S_STD(r8, 0x40085618, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYRES16=r7, @ANYBLOB="05f300000000000000002000000004000380"], 0x18}}, 0x0) r10 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NODES(r9, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)={0x1c, r10, 0x8, 0x70bd2c, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x4000001) write(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8982, &(0x7f00000000c0)={0x7, 'vlan0\x00', {0x6}, 0x1000}) 7.221605112s ago: executing program 3 (id=591): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000004f40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0b04000000e1ffffff00020000114000048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000150900010073797a30000000000900020073797a32"], 0x94}}, 0x0) 6.836109863s ago: executing program 3 (id=592): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) writev(r0, &(0x7f0000000040), 0x0) 6.780463108s ago: executing program 3 (id=593): socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x3) ioctl$PPPIOCSCOMPRESS(r0, 0x4010744d) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000004d0400000000000006000000000000005504030001ed0ab025030100170000001c0080ff000000007b0a00fe000000006e04000000000000e5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379d00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a607c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a59234ed56bc83987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d06c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292cfbe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d700ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec52d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d105800f000000000000ef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f6845b6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd51015dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d0800bf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3aee1ff8c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6b8306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9000080ac970cc4fd0847683c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d680000000000000000000000000000000000be9ab5e329e962d96a283b6182c1cf6c8e350a7784ca39ecb9178f4118559f1eccb0b738a255146ebbc4357c16f94cd4"], &(0x7f00000001c0)='GPL\x00'}, 0x48) r3 = syz_io_uring_setup(0x49b, &(0x7f0000000200)={0x0, 0x4661, 0x400, 0x7, 0x123}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r3, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) 5.840009607s ago: executing program 4 (id=596): mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r1, &(0x7f0000000040)={0x2a, 0x1}, 0xc) r2 = socket$qrtr(0x2a, 0x2, 0x0) recvmmsg(r1, &(0x7f0000000ac0)=[{{0x0, 0xff2c, 0x0}, 0x1}], 0x40, 0x2, 0x0) connect$qrtr(r2, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) writev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)='~', 0x1}], 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r3 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) mmap$qrtrtun(&(0x7f0000135000/0x4000)=nil, 0x4000, 0x4, 0x80010, r0, 0xc) r4 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x24044081}, 0x8884) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r5, &(0x7f0000004e80)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_GETXATTR(r5, &(0x7f0000000040)={0x18, 0x0, r6, {0x7}}, 0x18) stat(&(0x7f00000007c0)='./file0/file0\x00', 0x0) ioctl$PAGEMAP_SCAN(r4, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f00002e3000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, 0x0, 0x0, 0x0, 0x41, 0x0, 0x20, 0x4a, 0x2a}) 5.427724204s ago: executing program 1 (id=597): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r3 = socket$tipc(0x1e, 0x5, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc0000001900010000000000000000007f000001000000000000000000000000fc01000000000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="feffffffffffffffa900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400000000000000000050000000000000000000000000000000044000500ac1414aa000000000000000000000000000080003c00000000000000ffffffff00000000000000000000000000000000000300"/180], 0xfc}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0x1d0, 0x21, 0x1, 0x0, 0x4, {{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@migrate={0x180, 0x11, [{@in6=@remote, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@rand_addr=' \x01\x00', @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x2b, 0x2, 0x0, 0x3501, 0x2, 0x2}, {@in=@multicast1, @in=@local, @in6=@private2, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x33, 0x4, 0x0, 0x34ff, 0x2, 0x2}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x35}, @in=@local, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x3c, 0x2, 0x0, 0x0, 0xa, 0x8}, {@in=@private=0xa010102, @in6=@empty, @in=@local, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x3c, 0x0, 0x0, 0x3505, 0x2, 0xa}, {@in=@loopback, @in6=@remote, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x33, 0x4, 0x0, 0x3503, 0xa, 0x2}]}]}, 0x1d0}}, 0x0) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r6 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r6, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) bind$tipc(r3, 0x0, 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) r8 = syz_open_dev$video4linux(0x0, 0x7, 0x48902) ioctl$VIDIOC_S_STD(r8, 0x40085618, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="18000000", @ANYRES16=r7, @ANYBLOB], 0x18}}, 0x0) r10 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NODES(r9, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)={0x1c, r10, 0x8, 0x70bd2c, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x4000001) write(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8982, &(0x7f00000000c0)={0x7, 'vlan0\x00', {0x6}, 0x1000}) 4.602035509s ago: executing program 3 (id=600): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000407d1eff0100000224000100000000090400000103000200092100000001220700b5d13bd08609058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect(0x5, 0x996, &(0x7f0000001000)=ANY=[@ANYBLOB="120100007d29d240b82227607a21000000010902840903000000000904510303020a000909210500000122c10e09"], 0x0) syz_usb_control_io(r0, &(0x7f0000000080)={0x2c, &(0x7f0000000140)={0x0, 0xf, 0xa0, {0xa0, 0x11, "3d7da329154298975aaba90eb5b64ad644734c0a2ff0e2be76617d5e647722f5e124b26ca2d3d3b6b0b02c6915080fe6f77b33806f5079b06645679d0bcf8091564247b12c528ad3f09690a11e58b8555b4e410367dbdadf292dbe03b6530d42fddef95d3d7976be8bbe5f484c042242456b6c7d94d0bebf427f15b8a911825bf9415f2f5c61920ab6fe1e739ab8fc34453b042299cd54e222e215ba957d"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 4.323957322s ago: executing program 4 (id=602): r0 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000400)={0x0, 'batadv0\x00', {0x5}}) socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$sock(r0, &(0x7f0000000380)={&(0x7f00000000c0)=@rc={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x80}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000140)="0ce090beea9ff0cbd10720bd61e0fb7bdba5a4770700eb69c09c172d6fa6c74a93935094108195dc3e57d0cad8f5e08dd59e112345b1a0407834f4b9492b0002c3ba0379b6194ffe6eba660df12a767e0c8844a4dffc9c3119bf16278a46ddea8898fa4088c1519be25cda32043586785ec88e4e966e776f269b16aea26d150e11bf69c1bab0868f933026fd2ae60775658aa9362382fdaa67bea05f92061008938d57eedf808d711daea26c33b56c6905cd33c1d6c9336b837cc8245e0b7f03f94436d9596fd397bb60a14413cbf2d7e46e3aa682a97f1f611c814f97bcc6b03a7d1385f6fda031e83a6645", 0xec}, {&(0x7f0000000240)="af10104e3bbbf1cda78e21bf03758984140e14df4c9ba1ca483cead60be3ae3e90317dacca47a6d6e85b6daa1065bebd89bcd1e6a3ea68a2dd3500374448beb79b640c46cb46bee14416ee8b79de3518cffb04a7bc78edc345e6047e4148599d1c", 0x61}, {&(0x7f0000000500)="350064583c1f5f324ff1b6dec0c49d167493826f9ae5d1eaa2c1495f5e9586edfb58614b7dc202b07718d8d8939e14053ce552d4a9af5e5680af9cd9d13fd2f19a7e6aad2f8080cb38a2a673b68579354dcbd84c137950358c76bae9dec0f30b7362e6c94f1b7d08368a047e640c575b71ccf4a840f58c8579e59782b85a3d13473038dfd597c7794a8102a59a1b733e1a1a3cf3cce51ca9b5e07cc02aded6b784e0497f24674e196991b3659f06e0da26309b7fa245a04404b415cafd4803cd29", 0xc1}], 0x3, &(0x7f0000000600)=[@mark={{0x14, 0x1, 0x24, 0xebf}}, @txtime={{0x18, 0x1, 0x3d, 0x7fffffff}}, @timestamping={{0x14, 0x1, 0x25, 0x6}}, @timestamping={{0x14, 0x1, 0x25, 0x10000}}, @txtime={{0x18, 0x1, 0x3d, 0x7}}, @txtime={{0x18, 0x1, 0x3d, 0xfffffffffffffff9}}], 0x90}, 0x240000d0) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) mlockall(0x2) mmap$binder(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1, 0x11, 0xffffffffffffffff, 0x800000000000) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1f}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}]}, @NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x3ff}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0xd8}}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r5, 0x89f1, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000280)={'syztnl1\x00', 0x0, 0x10, 0x20, 0x0, 0xfffffffd, {{0x5, 0x4, 0x0, 0x6, 0x14, 0x64, 0x1, 0x0, 0x5e55b37311de6d89, 0x0, @dev={0xac, 0x14, 0x14, 0x23}, @multicast1}}}}) syz_usb_connect(0x2, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xad, 0xf4, 0x9d, 0x20, 0x789, 0x160, 0xfd08, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc3, 0x0, 0x2, 0xdd, 0x54, 0xf5, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x3ff}}, {{0x9, 0x5, 0x82, 0x2, 0x8}}]}}]}}]}}, 0x0) write$FUSE_INIT(r3, &(0x7f0000004200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x8, 0x55610518, 0x0, 0x2008, 0x0, 0x0, 0x0, 0x0, 0x100, 0x4}}, 0x50) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x200, 0x80) execve(&(0x7f0000000740)='./file0\x00', &(0x7f00000008c0)={[&(0x7f0000000780)='batadv0\x00', &(0x7f00000007c0)='^:):{\xab.*\'\xf4\x00', &(0x7f0000000800)='!,\'\x00', &(0x7f0000000840)='rootmode', &(0x7f0000000880)='/dev/fuse\x00']}, &(0x7f0000000a80)={[&(0x7f0000000900)='^\x00', &(0x7f0000000940)='/dev/fuse\x00', &(0x7f0000000980)='^\x00', &(0x7f00000009c0)='(\\\xfe{{\x00', &(0x7f0000000a00)='/dev/fuse\x00', &(0x7f0000000a40)='./binderfs/binder0\x00']}) file_getattr(r2, &(0x7f00000003c0)='./file1\x00', &(0x7f00000006c0), 0x18, 0x1000) sendmsg$kcm(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000300020400bf050005001206", 0x2e}], 0x1}, 0x48000) 4.219491886s ago: executing program 0 (id=603): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) writev(r0, &(0x7f0000000040), 0x0) 4.037606946s ago: executing program 0 (id=605): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$l2tp6(0xa, 0x2, 0x73) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB="f8000000160001000000000000000000fe880000000000000000000000000001ff0100000000000000000000000000010000000000000082000000003300", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8800000000000000000000000000010000000033000000ff"], 0xf8}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) r3 = add_key$user(&(0x7f0000000140), 0x0, 0x0, 0x0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000380)={r3}, &(0x7f0000000480)=""/82, 0x52, 0x0) socket(0x1d, 0x2, 0x6) pipe(&(0x7f0000000600)={0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) set_mempolicy(0x6005, &(0x7f0000000080)=0xfffffffffffffffd, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@bloom_filter={0x1e, 0x6, 0x7f, 0x5, 0x101, 0x1, 0x7, '\x00', 0x0, r4, 0x3, 0x1, 0x1, 0x2}, 0x50) syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x101000) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @local}}, {0x14, 0x2, @in={0x2, 0x0, @multicast1}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)={0x94, r7, 0x1, 0xfffffffe, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x40, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}]}, @TIPC_NLA_NET={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x68}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4a9}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}]}, @TIPC_NLA_BEARER={0x4}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x0) 3.77683979s ago: executing program 1 (id=608): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x800) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e00000003000000000000040500060000"], 0x70}}, 0x40001) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) 3.618770117s ago: executing program 1 (id=609): unshare(0x20000400) socket$inet6(0xa, 0x1, 0x0) ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) ppoll(&(0x7f0000000000)=[{r0, 0x8108}], 0x1, 0x0, 0x0, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000002880), 0x2, 0x0) write$vga_arbiter(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="75617267657420584349b5b9613a31371a392e6500"], 0x15) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000040)=0x8) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x48, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0x0, 0x8110}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0xffffffffffffff89}}}, @IFLA_MASTER={0x8}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x48}}, 0x0) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x8012, r0, 0x0) r3 = syz_open_dev$usbmon(&(0x7f0000000000), 0xb, 0x101000) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r4, 0x0, 0x10, &(0x7f00000006c0)="170000000200020000ffbe8c5ee17688a2003c000303000afdff0230040000d90200bb6a880000d6c9db0000db00000200df01800a0000ebfc0607bdff59100ac45761547a681f009cee4a5acba400001fb700674f00c88ebbf9315033bf79ac2dfc061f15003901dee2ffffffffe9000000000000000062068f5ee50ce5af9b1c568302ffff02ff0331dd3bab0840024f0298e9e90539062a80e605007f71174ab498a30b3e5a1b47b63a6323ded2aa084cd36276a3afff0100000001000000", 0xc0) ioctl$MON_IOCQ_RING_SIZE(r3, 0x9205) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0xc, &(0x7f0000000200)=0xb, 0x4) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="180000003a00290200000000fbdbdf250200f8ff", @ANYRES16=r2, @ANYRES8=r4, @ANYBLOB="e07c02193509e95b3da583ce8ed5ab08ae8a779bc2f738f0998631fcee302fbc179b14b213bf31a925466c7d81d6af939bff96867573fb02809da7a585b477ebaa8b0b9b27843aeadebded4572404b87da9d1414115ac7d234c76af414828acabd5d7edf42c1ffe09c7d4da06a590e4991b447461c4e788f1e533ac20ef7747cffdb5fc6e925ed06190d9afe1c07007fdecda9"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) sendmsg$AUDIT_DEL_RULE(r6, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYRES8=r4], 0x428}, 0x1, 0x0, 0x0, 0x10000801}, 0x8840) setsockopt$IP_VS_SO_SET_ZERO(r4, 0x0, 0x48f, &(0x7f0000000d40)={0x2b, @private=0xa010102, 0x4e24, 0x0, 'ovf\x00', 0x11, 0x7fffffff, 0x17}, 0x2c) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48001}, 0x4c090) unlinkat$binderfs_device(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00') sync_file_range(0xffffffffffffffff, 0x1000, 0xffffffff, 0x1) ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000040)={0x8, 0x0, r4}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r8, 0x40085112, &(0x7f0000000140)=@t={0x4, 0x2, 0x6, 0x3, @generic=0x1}) preadv(r8, &(0x7f0000000400)=[{&(0x7f0000000040)=""/185, 0x8}, {0x0, 0x4}], 0x2, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) 3.008416089s ago: executing program 0 (id=611): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = syz_usb_connect$hid(0x2, 0x48, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x1b1c, 0x1b3e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x10, 0x3, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x10, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0xc33}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x7}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0xd6, 0xc3}}]}}}]}}]}}, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="00000b0000000b00d0e4c3a66cb0162a38"], 0x0, 0x0, 0x0, 0x0}, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = syz_io_uring_setup(0x12e, &(0x7f0000000340)={0x0, 0x5cb1, 0x2, 0x3, 0xfffffffd}, &(0x7f0000000140), &(0x7f0000000280)) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f00000000c0), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r4, 0xc4c85513, &(0x7f0000000b80)={0x7, 0x0, 0x2008, 0x7, 'syz1\x00', 0x900005}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x114, &(0x7f0000000200)=0x200, 0x0, 0x4) io_uring_enter(r3, 0x1e76, 0xf728, 0x5, 0x0, 0x0) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f0000ffa000/0x1000)=nil) io_uring_register$IORING_REGISTER_IOWQ_AFF(r3, 0x11, &(0x7f0000000040)="732fbfdb019d7da37edad2e06a44164ecdaa2c0071e55d0f2412f7561e683df8bf8bec", 0x23) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000007, 0x40032, 0xffffffffffffffff, 0x40000000) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = io_uring_setup(0x62c7, &(0x7f0000000480)={0x0, 0x0, 0x400, 0x4000001, 0x2}) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x20082, 0x0) writev(r6, &(0x7f0000000040)=[{&(0x7f0000000e40)='\b', 0x17ff}], 0x5) close_range(r5, 0xffffffffffffffff, 0x0) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r7, 0xc004743e, 0x110e22fff6) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r8, 0x4004743d, 0x110e22ffe6) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES8=r8], 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 2.693449084s ago: executing program 1 (id=612): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x1, 0x8, 0x7fffffff, 0x2, 0x80007, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x100001, 0x3, 0x0, 0x5, 0x6, 0x1, 0x7, 0x3c5b, 0x1, 0x24, 0x8006, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xd, 0x3, 0x2, 0x3e, 0x8f, 0x4006, 0x6, 0x80000000, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x10, 0x312, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x8001, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x8, 0xa6d, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x2000000, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x1, 0x800003, 0x1fe, 0x7e, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0x4000a9, 0x5, 0x9, 0xac8, 0x2000af, 0xfffffffe, 0x8, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x2, 0x5, 0x42c2, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x5, 0x2, 0x57, 0x4, 0x8000003, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x6, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0x6, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x45, 0x8, 0x30b1d693, 0x5, 0xf40, 0x7, 0x41, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x9, 0xffff3441, 0xfff]}, 0x45c) syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fffffff, 0x2) syz_open_dev$vim2m(&(0x7f0000000040), 0x40005, 0x2) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)={{0x12, 0x1, 0x0, 0x35, 0xff, 0xaa, 0x20, 0xccd, 0x10af, 0x384e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x59, 0x2, 0x1, 0x9b, 0x1e, 0x2a, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000300)={0x14, &(0x7f0000000240)={0x20, 0x5, 0x55, {0x55, 0x6, "35c4d53ed1a1155995005003328974c67b0a05caca0f82ef497621030b8dc904c55065f1fe27bce3ea72006b132716da8c37ac35477ab6a7528adfb8287059da0d119786a4d054e1850a0daeac3920510226b2"}}, &(0x7f00000002c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000008c0)={0x1c, &(0x7f0000000340)={0x20, 0x15, 0x5d, "d2ca2c916cbca82127fe2a97fcc17e077e5b380215ee7867471f09bb2a7b87d1261505fea4b94fd62e60933fdf4ae3423353ae55dbf6689a911fb743db59d6e321b23807aef97ff5611c4edf715f851fd562dfe102095987e2b719ce34"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000880)={0x0, 0x8, 0x1, 0x7}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_usb_control_io$lan78xx(r0, &(0x7f0000001180)={0x14, &(0x7f0000001080)={0x20, 0x24, 0xa, {0xa, 0x31, "c015634d891598ee"}}, &(0x7f00000010c0)={0x0, 0x3, 0xb5, @string={0xb5, 0x3, "c724634b164df08695cd71c5ec12d6995b2d47c278e1d94597e29a54f11674f45230d4c95493ca7843f72360f13dc3fe5c61c0cfafb4616e7026a5f872904031bb8dfaa761e3f5265bdfd86e8f797ee918cbbd2f0416d633d64124bfad673a544c1245b7e2b6f7a270bdc84ea358bb023d65ed09b1013ffd7f55de4690b47643cef078e08891db9df13306fc86657453f1124b626a8a371dadc8b8491ee12b0a1b53cab20f1ed2288ae7e3e01841b9f39949b0"}}}, &(0x7f00000013c0)={0x34, &(0x7f00000011c0)={0x20, 0x4, 0xa6, "9925a13a3082913aa8206730d9904106e890bb527380eb47bd42d16de0658cd044b600348a992a6aedc39f2caa81db79a636a64840c987f943e02f67bcc6f4c302c79e5dc3f9d5dbf119ba8027c9ed36fe9638cc52992ec087f349c93a5fcff47e4fed4b63e2d09f56de63abb583996b9c2c7751bfffa713abbc9df44661ae1de25cca23fc8f6eb37565fcc7c385d537c7a12fe35fc5851a2e7010bc95e66f8d4d5d94ed29bf"}, &(0x7f0000001280)={0x0, 0xa, 0x1, 0x3}, &(0x7f00000012c0)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000001300)={0xc0, 0xa1, 0x4, 0x7}, &(0x7f0000001340)={0x40, 0xa0, 0x4, 0x1}, &(0x7f0000001380)={0xc0, 0xa2, 0x2f, "64e1a60deb07713ca8896c3fb40f12a30d9e5787549ae746556a360f3a6c2993acf6c243026d78ff60bb61210035e0"}}) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_TIMEOUT={0xb, 0x4, 0x0, 0x0, 0x5, &(0x7f0000000200)={0x77359400}, 0x1, 0x4}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x2c, &(0x7f0000000140)=ANY=[@ANYRES32=r3, @ANYRES32=r1, @ANYRESHEX=r3, @ANYRESHEX=r0, @ANYRESDEC=r0, @ANYRES8=r0], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000940)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x1b4, 0x6, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_RULE_COMPAT={0x1c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x8917}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x87}]}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_RULE_USERDATA={0x96, 0x7, 0x1, 0x0, "11c253af35ff0fd4abe9fc3dc319a374da09ca7663b7b3bbfefdef0945ffd9b51dbfa1ad547b3f7f31527f4be03a8de42ad526d6ee98bd5ea3860118782567bea05c0a0707cc40aa01692a6c5bec87d6e48ec86ff348324778fbf5bf4ecd12d47dc646fecff0726ec74e322eb7653d9c4f3521527e04eafd8aed1fa6c045b8ab7080aa58ae595a5ccbdae8a6a2e919c62f69"}, @NFTA_RULE_USERDATA={0x46, 0x7, 0x1, 0x0, "27c2ca005f943778986d7d627642f809938d8c68f80f7b26f45d71da89cff450ff261e26e1cdbd0d77acd50d157760ecdc220b6cb7f6fcb95b93b917fb6cb6bda08e"}, @NFTA_RULE_POSITION_ID={0x8}, @NFTA_RULE_USERDATA={0x8e, 0x7, 0x1, 0x0, "3a1b08b44bb5d61e4d8d026e142af6827e9978a46d1fb7ec12be3ad3b1d0a47cbd75576989d36f68bbdba56430318e3b3c4008b4a7f2fcf06e74f7039925ce1a3eab57321937ada57f7209a518fb56e50557f3adc56f4d0f9bc8ec6c8bc769dd1766e65c3ff479073853d21844b6a40721ce519b361bf9d3005ab8d1d502d0e654b6a5d2a8cc09dc9e1f"}]}, @NFT_MSG_NEWRULE={0x38, 0x6, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x2}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWSET={0xac, 0x9, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_EXPR={0x38, 0x11, 0x0, 0x1, @osf={{0x8}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_TTL={0x5, 0x2, 0xd}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_OSF_FLAGS={0x8}]}}}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x3d}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_SET_EXPRESSIONS={0x44, 0x12, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_FLAGS={0x8}, @NFTA_CONNLIMIT_COUNT={0x8}, @NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x6}]}}}, {0x10, 0x1, 0x0, 0x1, @lookup={{0xb}, @void}}]}]}, @NFT_MSG_DELTABLE={0xb4, 0x2, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x3}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0x87, 0x6, "fbd71b119ad2ad8efe58a8db1b02aa9b7176467ffd47485ccf722833806fe14e6425bf0a8471a19794303982a012e14912a622343097c057855b82f9b4ddacd406aba48ed54e6c9474f965fcfd6103eae3592231b7341f32d1cf0a822e35fe58f69a786fdbfcedf7cb00f050964ef8858a54155fa5fb90852e31bbf2032afa94c7419e"}]}, @NFT_MSG_NEWRULE={0x154, 0x6, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_RULE_ID={0x8}, @NFTA_RULE_COMPAT={0x3c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x3b}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x3c}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0xff}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x62}]}, @NFTA_RULE_COMPAT={0x4}, @NFTA_RULE_EXPRESSIONS={0x64, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}}}, {0x40, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_NAT_FLAGS={0x8, 0x7, 0x1, 0x0, 0x6}, @NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0xf}, @NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_NAT_REG_PROTO_MIN={0x8}, @NFTA_NAT_REG_ADDR_MAX={0x8, 0x4, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_USERDATA={0x80, 0x7, 0x1, 0x0, "4df12a30525314ed972f3528ddca21c0439db87ce1df527f82debb8aac18004c1670e523a4ef2f09dd83111141fbf5f0e88b80a3ba7dc0cb870921da206b70974510730f158ee9ee44e7811ce561151362c088184502ff63cdad8eea2e01c1d0ba847f51335ab40811a6c79c49add6083b2bdf8836eaa7e90727cc74"}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELOBJ={0x164, 0x14, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFTA_OBJ_USERDATA={0x71, 0x8, "d48704446e735faa7880a7ccf446a332392b1172f5b9a81fc4895b96347acc9c06ec287314b83f5bfe6a1114e17b104ec16b8af44e8f0d3b692349a3249a5a41475e945270697b5b0c3814b251f9f5a708e736fa5240b37c9234374e1ef422ea6a77802731d634ff3582f1a3b1"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_OBJ_USERDATA={0x91, 0x8, "d3eac0ecad789faa05de60b53e89c4d453c11473f9f35bc47ed7e90e0fa3ffe0d441adb15aee9cf39c5713a4095569c98ddf89e2ea117be1b945d8d2b3345a9b9eb6d6e8be41938592fe6880ee59fc5697fc2234334139c9de7454d17bd4048756f6a1b086f7f1d8b76b777629bdac0500e53ca1eadb0fab485b5d950d4c8f7c3ae6165fc16ce207d3834225e3"}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWRULE={0x28, 0x6, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWRULE={0x1c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_RULE_ID={0x8}]}, @NFT_MSG_DELOBJ={0x20, 0x14, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x690}, 0x1, 0x0, 0x0, 0x8000}, 0x4000010) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000540)={0x2c, &(0x7f0000000400)={0x0, 0x31, 0xffffffffffffffe1, "a04e5044f9cd1ab20551ca46d90ba916d62ca5e74e3d4cd3681b078f9968599df75430dcc00000000003b542cd5458b49079ca82837fe426f3511402000000d527e88c6bc7a5c14fc0bb6429dc45d57eb06befc81e971bd05872f5342959e44b2b8f38673256c32bf38ddf2ba5b6c6c6383d5894f473caabdce4087bab8cb3807be1ea286f0040000000000000fb76461dca436350889ce9d36b608da6588d47c1c3f7c2135741e934cc43b54beec1467ec470b85f7ab123a8e807fd1e80de371b1c4d4d56e898969e84421531b9e8d91732d7830ab38bd5215c3edb060cdbd8222a5d54c2338ebb6cfbea240a7bbf25a730bf38476d6b"}, 0x0, 0x0, 0x0, 0x0}) 2.148131326s ago: executing program 2 (id=613): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={0x0, &(0x7f00000003c0)=""/250, 0x0, 0xfa, 0x0, 0x9}, 0x28) (async, rerun: 32) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x23, &(0x7f0000000000), 0x0) (async, rerun: 32) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="30010000000101040000000000000000020000003c0001802c000180140003000000000000000000000000000000000014000400fc0100000000000000000000000000000c0002800500010000000000240002801400018008000100e000000108000200e00000010c0002800500010000000000080007400000000010000d8008000100640101809af5ca6e0e8d9cf3de4bc15240eb390204000380a4000d80080001000a01010124000380060001004e230000060002004e210000060002004e230000060001004e23000014000500fe8000000000000000000000000000aa14000380060002004e200000060002004e2200004c000380060001004e220000060002004e240000060002004e200000060001004e240000060001004e220000060002004e2300001dff01004e220000060001004e240000060002004e210000"], 0x130}}, 0x0) (async) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/vmallocinfo\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) (async, rerun: 32) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x802, 0x6b929545a606890f) (rerun: 32) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, &(0x7f0000000200)={0x7, 0x2, 0x2c1af2a9, 0x40, '\x00', 0x2}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000a00)=ANY=[@ANYRES16=0x0, @ANYRES16=r3, @ANYBLOB="00020cbd7000ffdbdf250600000008008300", @ANYRES64=r3, @ANYBLOB="38992adb0f3460c11b8f029fc00088745a6f397fd04bc7a4ee3d6c7b9809afe335ad681d62f0bdd0086022d923d898f7acc0d57e01f110c7ef4874e4a40a0a2e51708217ffca4f57b33744d9609b62ca9ef403543aacc5296a12860d9eb1c74e372043c97895e1e60e38a6a86a6c01b744e3ecfb125ad8a57260fdcf1caf783d2df91f7018be19be8216a4e421248a998cbd1787b5163f04387dfb650c19ac861efb4be800e95ce701def86338292c8d108943fe92cac3189774da6a0860bc975a8c30325eef717bc62065db5e36bb8b3f0b60cb5df097c696c64d8e8a411918c91ea4"], 0x1c}}, 0x41) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f00000004c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000800)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="ed33c50c02002abd7000fc0800030077393275761eaecca2cf5765973460886f02461c2254b283b79ea096401e48563d9b94ca431ff1813741d0f64eca8c41041d918e26d03e7a8c7886741a1c82c72019d744fac1aca50210b550775db8cbf63d538f4f669d8ab355f3cd9d", @ANYRES32=r4, @ANYBLOB="0c00990003000000360000000600b300000000000600b300030000000600b300000000000600b400c71100000600b400eb0e00000600b4002b2700000600b300030000000600b400650e0000"], 0x68}, 0x1, 0x0, 0x0, 0x20004088}, 0x4000) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async, rerun: 32) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f0000000000), 0x4) (async, rerun: 32) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000340)=0x80000001, 0x4) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, 0x0) (async) sendmsg$nl_generic(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="180000002e00010026bdf000fcdbdf1b04000000040010"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20008004) (async) close(0x3) syz_usb_connect(0x0, 0x24, &(0x7f00000002c0)=ANY=[@ANYRES16], 0x0) (async) r9 = fsopen(&(0x7f0000000180)='hfs\x00', 0x1) openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) (async) ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x80207011, &(0x7f00000000c0)) (async) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000080)='iocharset', &(0x7f0000000500)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\xdf2\xffK\x11\xd6\xceuc\x87\x92\xb9\x93\xc2Z(XQ\xf0\x1fx\xfa\x1b\xbe\xf2\xd6C\xf64\xe5\xa4\xc4\x03R\x8f\xbej4-o\xaa\nh\x10T\x962SR\xdcP\x958\xd1\xbb\x17\xe8t(r\xb1A\x19\"x\xed\tA\xa2\xc8\x86M\xd5\xdf\x052\r9\x82\xbdM]\xf7\xe5\"\x95;\xca\f\xa3\xe77\xee\xbd\'G\xf1\x85\x84,\xe4\xa7D\x13U\x10R\xfc\x11$\x9cyVA\xf8\xbb5\x0f\n8%>6\x84\x93\b\x06\xd4[!J0\xae\xbdY\x99=\xdd)t\"r\v4G\xf6\x1d\x88w\xe9\xcb\xce,\xe55?o\r<\xe0\x85\t\xb8\xb1\x1d\x90\x84\x19\xc0\x98!\xb0', 0x0) (async) read$FUSE(r1, &(0x7f0000002480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) syz_usb_connect(0x0, 0x2d, &(0x7f0000000300)=ANY=[@ANYRESHEX=r10], 0x0) 2.032933095s ago: executing program 2 (id=614): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000680)=@filter={'filter\x00', 0x42, 0x4, 0x398, 0xffffffff, 0x0, 0x250, 0x0, 0xffffffff, 0xffffffff, 0x300, 0x300, 0x300, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @private, 0x0, 0x0, 'ip6tnl0\x00', 'nr0\x00', {}, {}, 0x2f}, 0x74000002, 0xe8, 0x110, 0x1ba, {0x46010000, 0x2c000000000000}, [@common=@unspec=@limit={{0x48}, {0x0, 0xdf6, 0x0, 0x0, 0x0, 0x9}}, @common=@addrtype={{0x30}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@uncond, 0x287, 0xe0, 0x140, 0x0, {}, [@common=@unspec=@cpu={{0x28}}, @common=@unspec=@limit={{0x48}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x5, 0x6, 0x1, 0x7, 0x3, 0x3], 0x1, 0xb}, {0x4, [0x2, 0x4, 0x2, 0x4, 0x8, 0x4], 0x4, 0x2}}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@inet=@TCPOPTSTRIP={0x40}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f8) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0xa0000, 0x0) read$FUSE(r1, 0x0, 0x0) ioctl$VIDIOC_G_DV_TIMINGS(r1, 0xc0845658, &(0x7f0000000000)={0x0, @bt={0x0, 0x1, 0x0, 0x3, 0x0, 0x1000, 0x3e2a8e40, 0x9, 0x7fffffff, 0x9, 0x7, 0x6, 0x3, 0x7ff, 0x18, 0x0, {0x5, 0x3}, 0x9, 0x5}}) 1.88376581s ago: executing program 2 (id=615): socket$kcm(0x10, 0x2, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x8, 0x6, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES16, @ANYRESHEX], 0x0, 0x7, 0x0, 0x0, 0x41000, 0xf72cb191e650caa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080), 0x106, 0xa}}, 0x20) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0xffffffff, {0x2a00, 0x80010000, 0x0, 0x3ff, 0x0, 0x0, 0x4, 0x80009, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x8000000000000000]}}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) pivot_root(&(0x7f00000001c0)='./file0\x00', 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="020100030a0000002cbd7000fbdbdf252b629ffa9b8f631702000000000001000000000000000000030005000000000002004e21ac1e01010000000000000000020013000300000028bd70000382664e4f3a6843755e91350000"], 0x50}, 0x1, 0x7}, 0x0) openat$vimc1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CURSOR(r5, 0xc01c64a3, &(0x7f0000000280)={0x3, 0x0, 0x1, 0xffff, 0xa, 0x1ff, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR2(0xffffffffffffffff, 0xc02464bb, 0x0) syz_open_dev$dri(0x0, 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(0xffffffffffffffff, 0xc01064c5, &(0x7f0000000540)={&(0x7f0000000500)=[0x0], 0x1}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x12) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(0xffffffffffffffff, 0xc01864b0, 0x0) 1.521436526s ago: executing program 3 (id=616): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) unshare(0x28000600) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x2, 0x0, 0xfd8b, 0x3}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000ac0), 0x0, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) r5 = add_key$user(&(0x7f0000000140), 0x0, 0x0, 0x0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000380)={r5}, &(0x7f0000000480)=""/75, 0x4b, 0x0) socket(0xb, 0x2, 0x6) pipe(&(0x7f0000000600)={0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) set_mempolicy(0x6005, &(0x7f0000000080)=0xfffffffffffffffd, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@bloom_filter={0x1e, 0x6, 0x7f, 0x5, 0x101, 0x1, 0x7, '\x00', 0x0, r6, 0x3, 0x1, 0x1, 0xe}, 0x50) syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x101000) 1.128998783s ago: executing program 4 (id=617): ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x8, 0x70bd2a, 0x25dfdbfe, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x86) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0, {0x1, 0x4}}, './file0\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000200)={0x4, &(0x7f00000001c0)=[{0x5, 0x1, 0x6c, 0xfffffffb}, {0x59e1, 0x6, 0x9, 0x6}, {0x6ed, 0xa4, 0x3, 0x8}, {0xc, 0x16, 0xa, 0x7}]}, 0x10) munlockall() r3 = syz_io_uring_setup(0x7d97, &(0x7f0000000240)={0x0, 0xc89b, 0x80, 0x2, 0x110, 0x0, r2}, &(0x7f00000002c0), &(0x7f0000000300)) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PTP_SYS_OFFSET(r5, 0x43403d05, &(0x7f0000000380)={0xd}) r6 = syz_open_dev$hiddev(&(0x7f00000006c0), 0x3, 0x200200) ioctl$HIDIOCSREPORT(r6, 0x400c4808, &(0x7f0000000700)={0x2, 0x100, 0x1}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r7, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x14, 0x4, 0x1, 0x101, 0x0, 0x0, {0x7, 0x0, 0xa}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x20040084) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r2, 0xc01864c1, &(0x7f0000000840)={0x0, 0x0, 0xffffffffffffffff}) ioctl$FS_IOC_MEASURE_VERITY(r8, 0xc0046686, &(0x7f0000000880)={0x1, 0xf6, "0384615c8a390fbace48fc7b2c1325ce68bc50210c101399fac88151390dff8fb3ad45c0cf629e9fa024a529c744a1acaf3f42126f667b4b0b56377f0bcc139e26fdbb9c1bff4b26a64845685b0e3efa913bad91e4e0bac51710b9eae3280368752d80a4c9c15477598bcee6d546482e6f906609a0252a791ff0af564a4ab481bf7336f711a6699ba2750939d2bee12577e07b2bb673cead6ff758f9e9abd4971d463abe131c388f9d0d2aa87b077165f5d7a425e75d443191c831a7d9023ab2ecf345e00d66f5680d7eb1fbcc7042d5a08d398a3ba0b6b10c63ccc57aaab766710f67b4309207cc4299ac9041278d7b536679ca4b2c"}) ioctl$vim2m_VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f0000000980)={0x2a277d2841e653af, 0x9, 0x5, 0x4000}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000ac0)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fef000/0x10000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000009c0)="ef82a711a986875aadc5ad9185b69c0f7cacf4e43e73c09fe95e7215773740c22ebcb6d55fc7df6d2a404212c47f957c75b433ff9ff6e58404157087e637d59a2ab51715d3696fff8cdf876468ec618ce61e44043432957f6cf14758077037c91e94abc55f294bd296480d87eff801fbd95a6a07b848d27ff67af6810e5fcb1411c9c6ba2586fb4413be9f0b353631f04caa9fa40bb33c78356c8779ddf193dd2dffd99c9779a5ac8f9bdbc22a9d8d9b03a467ca7028dfda90bb91e730791ebc86d6e2208f494bf7ce2e15b521d23ecec842fa864d27242bdc075d0db26da299b5f6", 0xe2, r4}, 0x68) ioctl$vim2m_VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000bc0)=@multiplanar_mmap={0x100, 0x1, 0x4, 0x1000, 0x8, {0x0, 0xea60}, {0x5, 0x8, 0x4, 0x5, 0x7f, 0x5, "dc91bc8d"}, 0xa5, 0x1, {&(0x7f0000000b40)=[{0x1, 0x3, {0xfffffffffffffff3}, 0x10}, {0xfff, 0x3, {0x59a3}, 0x7fff}]}, 0x9, 0x0, r4}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000d00)={'pimreg1\x00', 0x0}) sendto$packet(r5, &(0x7f0000000c40)="8d4d7b2d8f2bdaf87e37c251edfb8b51a41616ea1b3c5935703f916e1dcb93eddf0d53f2ce347405df1ab7636dbfe8f6b1f9f4ae2b1a89f618b8c11c82d5326ee5c6c1849e044973f961f75c8fd95c6e0e29504b1a32dbdc83e02054937ec0adcd1531c5bb02a750cd6a44f2357580e8db11682ee222824c3a4a28908b4cc9dca40eacf172c6", 0x86, 0x4044810, &(0x7f0000000d40)={0x11, 0x6, r9, 0x1, 0x47, 0x6, @link_local}, 0x14) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000d80), 0x200000, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000dc0)='./cgroup.net/syz1\x00', 0x200002, 0x0) bind$vsock_stream(r5, &(0x7f0000000e00)={0x28, 0x0, 0x0, @my=0x1}, 0x10) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000e40), &(0x7f0000000e80), 0x2, 0x1) close(r2) copy_file_range(r7, &(0x7f0000000ec0)=0x9, r3, &(0x7f0000000f00)=0x6, 0x100, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r4, &(0x7f0000000f40)={0x28, 0x2, 0x0, {0x5, 0x1, 0x1}}, 0x28) setsockopt$MRT_PIM(r0, 0x0, 0xcf, &(0x7f0000000f80)=0x1, 0x4) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f0000000fc0)={0x7, 0x0, [{0x1a2, 0x0, 0x5}, {0x97c, 0x0, 0x7}, {0xb7d, 0x0, 0x9}, {0x89e, 0x0, 0x1}, {0xb88, 0x0, 0x100000001}, {0x204, 0x0, 0x4}, {0xa89}]}) 956.645048ms ago: executing program 2 (id=618): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="88020000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="6102330050300100080211000001080211"], 0x288}, 0x1, 0x0, 0x800000000000000, 0x800}, 0x0) 749.341022ms ago: executing program 2 (id=619): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x800) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e000000030000"], 0x70}}, 0x40001) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) 700.231668ms ago: executing program 4 (id=620): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x800) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a00"], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e"], 0x70}}, 0x40001) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x900000000000000) socket$nl_rdma(0x10, 0x3, 0x14) 612.181796ms ago: executing program 0 (id=621): r0 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000001a80)={'#! ', './file1/../file0', [{0x20, '\xeb)\'-!'}, {0x20, '-*.\x1f'}, {0x20, '!\\\\\'#'}, {0x20, '%^\\\x93\xca\xe9[\x04\fu\xd3\x10.\xee\\Q$e\xa9=B\x19I\xd2Le\x14P\x86\xd3\xe5b\x93y\xdf\xfb\x17B7\a\x9c\xb5?\x0f\xc8\x9b\x9aol)\x87Z\xcc\xa5\xc2\xffb\xb8\x00\xbb\n\xcb\xb1\xdaa\x18\xacG\t\x8e\x00*\xf8R\xa9\x8e\xaaUw\xc0!\x1fa\xf5\xecf\x14B\xd4\xd4\r\x143Y=\xa6!\x94P\xdb\x81vr\x8c\xfd/6\x16\xd8&\x96\xb0o\xae'}, {0x20, '/dev/loop#\x00'}, {0x20, '&/&'}]}, 0xa8) write$binfmt_script(r1, &(0x7f0000000400)={'#! ', './file1/../file0', [{0x20, 'f\xce\x01\x00\xc7\xbb\xb5\xb7\x01\xfb\x03\x92\xa7,x\x9f\xfc4(\xa4\x7f@\xdc\x0f\xbe\x0fs\xea6\xe4\xbf\\\x12\x19pnm;\x18S\xa0x\xc0\xcf>\xad\xf6c\x0f\x0f\x03\f\x15\x1c\xb3ei\\'}], 0xa, "0002784148b29e7bcaf3e29c2593b929f38d08de9a57967d49c269445df5a02a484a4fff1f05bbd60b043247a4e72e4f0bedb7c930aa4ab1e46695c1fb6ce947a12539fd90c30a1de6c9c3f7d33fc18866cb172e469352b6ba03830dbcf172d1f7cf467bf6bea0cf4c0aa3cc"}, 0xbb) write$UHID_INPUT(r1, &(0x7f00000007c0)={0x8, {"dc5d3b0169633d3eba3eabbc09167be55101d4af4b22a373236464d2dbfaa84399b77bd438a54364a7ebc5bdaab4f9decb7c044318cd59a0af8279bcab35dd7daf7a0ceb381df2c32eff45b13e2c8f40e1895355bf6f165200cb1ca41a155730ee2e9f83183f9fafe029d0401b0770618254a8b2dc87b630072b1e2de160d1afed51b74c14b71ec1b226a324482d14ad586b1a4ce80e458fe45244c01eddeddf3564af838d6d5324f8a77023d6eb7aa14397a0e1413ea1c3dfdf063a35b709e627f36fe403ee3117365be5017682f53595f28543062c740a94a794312f5cebc315044b8ea000a5d0f27812ab0ce149d11e6f6f7620c5f3e250bf67d13a1ca39dbb7b8b5a31e3d7ba7ebe5849a7a09b61fc9f2cfc54b89e9cd0105bca49483ce55e0187ce2ad692a18219d881057c838587b915337169ee054655f26a04df913a658fccbf4def6aad750ca4796b74d322c67e9d4ee6a530a22dcc35db850b424d6ec9f62495b9f9fd2b000feadd57d26dbd505798c208d91eb0aab0fd97537631b8bf81ce0e2241c4272be4ff69b390e4485d574146b76d1fdbf7fc5334906805534cdae1e47240af7761a18fc8bd0a694be47529da98bc0f98eb7db3fc4a74cbb6e486f4de90fbf2452e72c2e1dca44543ad9ad094b8bc861eef1e814662d0b350339e3a510d459c6f83aabd5fd3dcb38224056d761e7df9b482b9905f1e2135c1929be328ecdb69c007a3efd548502c83106f6df1ab1178fac499eda92ad4373155227ec2df150c919d322ecb3ea37e659285f18a3e2f79b59900ca438df3a1381380a12d3ad7678e0a8d3bdfb40651389b4ac8c66138d442d70eafdc2df8b080028006b124e4ebe0d9883ef100f1934e42794146382c1d628fd2ebe5859b6c243824903d056d800975675bb1913142adbc039a9c68c2f146a0e8903447313f5e5549905f397a9b1f21a93b80c4d04a8ea7a29a50fbc5407a9305bba420edf898ea678d6879489c39692c99bb6dacf61f5f97637b94c1031d635b5423b38b9196fafaaf87b2796eadc21466af5a10281e6a808748969d29efb444c99a4cb2111732a792dbca4376a125a68f7cdac065cc6173dc21caafba48c742d9a7df2f771ff2f5725b22c247d4e0c6106f9f5f6929b69929ab37e9a9b326ce618bb702b883b12026f1300f21f2c7440cac8c5f1210a78aa067211d2827f5dcc7578252c2ccc3f67bab9d1bb6939b21b550788ef550acfed4bf50c0b4fb3ca4d2872ee64f95d611a317d9daaf373a10d868680b2226396c95fa2b0ab4d6fce06c3b42cb97d17a7b5089061537fdeb1a53040869f7befca330358fdba86754fc2e46c2113e1484cb37534af8f0408a7ee313778dab49f08229964298f847ea66c4ec319f64b6a12da585bc59e82e0263c507b397d3efee3b4066f4d25566aa1549f6185f6375f84b65fa8945148b90430c86a5b6fdf58d5c812b98d9dc621fd9a3d9f1a577495356516d1cbcf5e8bb8923b54b247225b9c3892b18a9e137f3620c734052af9dc8f1ea36f0d4592d5ee32e35676a84dc891f97456f2ac3a4ab58a42bcdc221a4ac8bb28d428add2fcbe5b110a8afd5d23b31e827bd16167b2d88cae024afc04a722ac0b4d45c52512e6b6f102aac4be21bc89ce246539048370553665b0a4336a6db99d0d19399be6437bf21419304331b4342b2c1db580f0c9bf681fdb8e9fa3e025454197bbc82ef93ee2f385660818ec5127080675a8013766469afe3b1e36e81bf2f04c3a26eaf4517551e734d21ba3bc90e48aea0891792970c39f3f528397e9b7ae190f1760fe5960dc763ee0a17939c60bfcac0a8914be82c749e4fe85d1ac5fa733413468fb8941085e8c4d6e0b6d1e62e20da58440facd640ddbb6c1f694b3ca48757a34c5a11668368711a1d4f3a81d31ac30d71277d7ae77882b6841cfa6289e6cce84a3ad57eeb328f831888ac7d3cfcd3a472a48d903f20cec8c8ae8d0bea04ebf7413ef7693f8ed876e49bd5f89d7e1078208ff62712e330fc0341b9ccf26845578d44b1e0c66d1bebc14742baedfabb8e9a2c8f42730360c72997efe0ce786ff330c2eb6e0ff20896f813c2a515ce76f826c11a1c1588eb369231ddeb4a2f9f9591ecdecc74d20aeb50047beb3ab89a9e4e1b805a20b645c79d0bc5d0247fab8ba46a97a07630b1f1cb69b42b568af746733d2c581f057873d64fe6e659b00b4a26745f5fba1fe7406a86b007936c7cfdac53a4c5b0ea9f6604863c8e3f174eddbb09175f6e13cda9a860cf400ef9ed02b895502ac6e6de6a658249c3c6e8a653517eae2231e56e0f120547923c6549ebc1ed14c623637ce3d96af5c93a32e58e2d9659d8b5b145888b52d9a5b5cb3cdf594eb137bcef2ba068cfd2c6ccf7ab6e5b4ec55e9197bfb91c9b8729f7b50cf0b0326f7ea3e712c77674d48545ca2a86744c3c38f149d69cf811beacf7e5f49c7bfba20f1dcf3d7bc0b9c796016820a46495d244c9606a06fe2e14233eda78d69ae4523ad7b708b0c7ead44d7fd376fed60e3cc2ee25e9600adfbe87ac7c8fb8269aec9459602af0f420becda6120ce7d9626c65ae7f860639e8bf664eb4301ec18add0e436c0356c12ab6b4ca35da2b43c4a8c239fd0b59a2ce94843cdfa1667053165053633b062844dbb0d00070fde74fa3178eb5f1f5fd02e2088d8690379f39ab22c080cdcb29d700bac74fabd8a356fe99afe83a5d99aa5024e9158a299eda6c99b6701e64f1d68e7e2c0c6e88396bb535a02d0948f0a250a6e090041c96d9c9acd6134d44d516fd1010c39e572b86b05bb1326a2a4f23f11181186f9c2a01dc7b58c0129f4b851ca9b1e3dc35db7364e29ef646211796b1651511e041345abce427fa5d6e48b8fb078c8432061a4cc518a8f2a2caf709a5c1473a62112a6650afc64eec12f8f9c08cff1b6fbf7a1209fc8661f62303b7c5d49c1d0b32a9f37e81ed9ab6193816d40995ed49c10b9f5752e04d57535a3d16f06c65d32846c31ec9787ec4a965679eb804e86b45d007f38d8104550770dc6f313bc846e43a14a8c21d0628c744e3e83cb998d1b7acfe996541a8c03852dadf9326444c582b481cae844e4f3fe3d638903b38f24633b63adbad841ac6c4c1169d781a0e271e8a967b1c7e986fcb3a66168e86e3559a44fcfa92452260491da9397659af60453f4cd4be2d15439445ec2b4366a79d3283da912d9d499df1242bd174edc235848caa21d2c997aff0e95c7e5cc0803c90fab84e7be7b37909d0e2f3bc9974e3388acb6800baba183ecc8eea8c71c0d65d669e41f99ceae523b7a6b772f3b8ebba1d2127ccc3ddb7ddcb4ec73cbdc26fc87c3848e258a0b5484d3a13e40ec4e4a65dd92f09e9fe1e3e2f8b96c4e363aa3683860dee62dfcf8823ee4a3593a092e0bd9c4cedacf44a272faa164447b01f46a7795642a40c61b0034a37f0e9b792428a0ddcd144fe8263088eaac8016f8f1cd30b55ac90a8f10d785b7570dd9e639a4a068d3fe98a420b9f72e79de817f676c2a224300d749571ad43f49d1fbe838f4566bc7b5f104c384ad87189213152b644d9fcbdf98bafeee569d640ce9045779f1d90024c023a7480a358dee276fba139c14b4fdb12885240903d0e61dc161659a68f62c92b899007e0f2b65bf0a069e9e57c9b6ae50a3b30dd1003fb0eead73ae2f6010b3b356b4060579a4f29935e1f00c01d12e5f44e8e3163d81dfef7ca8560604240c7e96e4454c6971614df306c768121abb3f628e3f1d2d026f58d1087334c5bdb74d7c949b0ee66a4531ba4e9b922aee3d0f802ed034734507a5913c52966f1f8bd4577840de0253aabc23299dced2a299859c07af9fb0f9c29b6533b9d84d471390d59ab315f5ddb226f6b8dd7889295f0fb1f7bd1adafe4cc520a1e84bf2a59d5b9795aeafc8d6fd66a8228aba8653b98622617ddfeb5d6795c9bd2f35d4a0c386e862675a50e3314c3fbb17aca151c13c7fc8b1d1b72ed0a958537b5ddc9e74bddc2b9571ec3f2b7775b125338d4852a75a63941564c65bb36dfb6bea4aab1ae7a4f285c2177aa98406eb2cc10934aa92d5a9612d4455c84ad200841d289b5c2d5deab0d8e2459598ef183d3dc47f6bad0b9513710600cfa4d69fcd5763cdcc4f2c2b7cd7d4491fd52f4aec82ce846c0988f6f0123e21e900d39c61085e68c9badc350b44004f6c042d64b0d0cbf91ad0592b198f1eeea1e52200bc8e6d62848d6884b10bdde72466039da488be6b340c23148f666f2fe6e032c07dac43586df182aca9116f4600313fa8375c76337ba86bdc391dae6450218f58f047ced64befc6bb5c2a60024669630a6279fedf2fe45e7e19ce582ad96ae0d023eb9b39f5f1e666e73bb038ae38157275be5eb3e7cbc8b05adf53e817646bdc2cfce98e5d162bf7faaca787db8717ab8b27b9e35609c5fb9fe9def07f010df8b43cf5c96851eadfdeff0b7bc5826e7e15490ae9c3d14166ee81bef007070e7981235a673804ad89943ee6b51ac63364f7870e121e6ff23a0c7d179527cd58dd7a4ca37247c2bd9efc79b720bb1ee2d39862e98cb81e93cf5b48d5d02ee8ac737ab504c867a1c49e678300803c94fbe978dea918a1e71b9791ee1e4d30056e86c26a4675a8b090be2365c0b451a13ece52a89a7057fe2052e11c6666eb916d823ea66bf217c320acba3b714910734b2d27c2fa586bd7f7664b0d1422adabad2ce2afc10270057f11940fac1a51d023ce48bd04ea39b7f99381b239fd0ddeea0dce7863ec1f8f61775013b6414ecf86e686a340a3148f87a9d7d60a1f2da53436d16fc88d6a4e7c3d55e0dd004cbecc15a5558eb705d82aacb1862ddc251dd5d9cbf1d78f97900ce6e8dab0ea678cb823bd1e7bbd1e927841af08f5427878c19f4f322228f9b36287fc13e7c1293ea875ae73815e052d6c2ebc40df8f7b9d1f76e0b10e35aa160944983d8e6b790df0d9b13f3460657336d81f7d83c0350324b930ec9c7557ce12887f76372e126f504b0980fea27f31a780c05187b9b5353dafc6b101543b24332b96e15bc26b19062e52fa9f86d260ee3a3bc92a133e328407bb85357ee5c45cb87228f44888b14941b5911b050e9319fe88033f830a8490917a9c0572ebbc5492b4e1083a2e3d77215a34abef947b5b9a950e780662de18873e55899c92db3ad3d437e8407890afa6b0c04ef861b8bc85fbbe1bb67b3d9ef001409f84b8ec4f01d861cecc143a805b981ab5cf5b605057b63cb2c84ec358e510a69cd8c33a8a62fe4680d0c980145cc709157832bfaef261cb0466c237376ca2944ce9affffd4b1dc7cc9511da0b34bffb9ac216fb8cf7c6572d95627787720d1ba67c6512fcdb16f6329e9668681c404efebad559f81f05971b5efb6b4cca97ad0346753cc0a40a877242d8a808c602b03dc962cee38e646cb18abb079c70d357c30738a70f55cd3c5956a83a1bfcd6649dd765f16bfe968066345df7380bbc0c16b3b5af513d6458c791343952f33a051c5d711c1f35af1b47f3db9bbfb5c7c636b3a2b52805d606479879be0b404a28ade5649a3185e0f85a85fc15cd824671c2befdd0da509597c87d869f0bd7ad163ad93ca28fc0c4025eccaafe385ec3fc06c54ebcd7b07b6c7e0197c5b9ef886159a1585ae45248f865be760db6f5bc8f868fc6aefd04e34ecb51159e4cdcc2214b42b1ca9caec13ba3e1b2e7a3c736977b226213d265c2873195122a9b448088c8b50edd549be41c38ab176807b75e7267f86e4", 0x1000}}, 0x1006) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7fb0000e60080b8785d960001007fffffffffffffff00", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "9001001c551265406c7f306003d8a0f4bd0000000300"}}) 506.167791ms ago: executing program 2 (id=622): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket(0x10, 0x803, 0x0) r4 = socket(0x10, 0x803, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYRES16=r5], 0x3c}, 0x1, 0x0, 0x0, 0x40020c1}, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) fsync(r1) ioctl$sock_inet6_SIOCSIFADDR(r7, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2}) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$IP_VS_SO_GET_DESTS(r4, 0x0, 0x484, &(0x7f00000002c0)=""/145, &(0x7f00000001c0)=0x91) ioctl$sock_inet6_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000180)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2d, r6}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 440.001494ms ago: executing program 4 (id=623): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r2, &(0x7f00000000c0)=[{&(0x7f0000000000)="77690addcfbe1fbb66ec", 0xfd9c}], 0x1, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r2, 0x0, 0x10000008ebc, 0x0) splice(r1, 0x0, r4, 0x0, 0x80000025a5, 0x0) close(0x3) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) close(0x4) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03400000000000000000010000000900010073797a300000000040000000160a07000000000000000000010000000900010073797a30000000000900020073797a3000000000140003800800024000000000080001400000000038000000160a09010000000000000000010000000900020073797a30000000000900010073797a300000000008000740000000000400038014000000110001"], 0xc0}}, 0x0) 246.925659ms ago: executing program 0 (id=624): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e1d, 0x8, @ipv4={'\x00', '\xff\xff', @loopback}, 0x2}, 0x1c) syz_emit_ethernet(0x42, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb86dd6a000000000c1100fe8000000079760000000000000000aa00000000000000000000ffff7f000001321d4e20"], 0x0) 116.345847ms ago: executing program 0 (id=625): openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x0, 0x8000) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket(0x840000000002, 0x3, 0xfa) getsockname$inet(r2, 0x0, &(0x7f0000002280)) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000100900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYRES64=r3], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWCHAIN={0x34, 0x3, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffb}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}], {0x14}}, 0x5c}}, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xe}, {0xfff1, 0xffff}, {0x4, 0x7}}}, 0x24}}, 0x4000) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=@deltfilter={0x8c, 0x2d, 0x1, 0x78bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xfff1, 0xc}, {0xd, 0xffff}, {0x10, 0x6}}, [@filter_kind_options=@f_flower={{0xb}, {0x5c, 0x2, [@TCA_FLOWER_KEY_TCP_SRC_MASK={0x6}, @TCA_FLOWER_KEY_CT_STATE_MASK={0x6, 0x5c, 0x8}, @TCA_FLOWER_KEY_ENC_KEY_ID={0x8, 0x1a, 0x7}, @TCA_FLOWER_KEY_UDP_DST_MASK={0x6}, @TCA_FLOWER_KEY_PORT_DST_MAX={0x6, 0x5a, 0x4e21}, @TCA_FLOWER_KEY_ENC_IPV6_SRC_MASK={0x14, 0x20, [0xff, 0x0, 0xffffffff]}, @TCA_FLOWER_KEY_ARP_THA_MASK={0xa, 0x42, [0xff, 0xff, 0x0, 0xff]}, @TCA_FLOWER_KEY_SCTP_DST={0x6}, @TCA_FLOWER_FLAGS={0x8, 0x16, 0xc}]}}]}, 0x8c}}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000300)={0x6, 0x2, 0x4}) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES8=r0], 0x50) unshare(0x62040200) socket$inet6(0xa, 0x800000000000002, 0x0) r7 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f00000003c0)={0xc}) r8 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r8, &(0x7f00000001c0)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB="300000001000010028bd7000f9dbdf2500000000", @ANYRES16=r4, @ANYBLOB="15888844000700000dfb1088d4673b758647eb0200000000"], 0x30}, 0x1, 0x0, 0x0, 0x24000040}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYBLOB="158804e50300040008001b000000000008000d131730a200"], 0x30}, 0x1, 0x0, 0x0, 0x46801}, 0x4000000) 0s ago: executing program 4 (id=626): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYRESHEX], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x0, 0x0}) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r3, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000080), 0x0, &(0x7f0000000080)=""/55, 0x37}, 0xa4}, {{0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000001000)=""/260, 0x104}, {&(0x7f0000000b00)=""/207, 0xcf}, {&(0x7f00000004c0)=""/27, 0x1b}, {&(0x7f0000000f00)=""/245, 0xf5}, {&(0x7f00000009c0)=""/226, 0xe2}, {&(0x7f0000000c00)=""/55, 0x37}, {&(0x7f0000000c40)=""/159, 0x9f}], 0x7, &(0x7f0000000d80)=""/208, 0xd0}, 0x91}], 0x2, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f00000005c0)=@generic={&(0x7f0000000580)='./bus\x00', 0x0, 0x8}, 0x18) (async) openat$vsock(0xffffffffffffff9c, 0x0, 0x2c0c2, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x4, 0x8001, 0x0, 0xb49, 0xfffffffffffffffe, 0x7, 0x5, 0x8}, 0x0) syz_genetlink_get_family_id$batadv(0x0, r1) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000f40)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) socketpair$unix(0x1, 0x1, 0x0, 0x0) (async, rerun: 64) poll(0x0, 0x0, 0x9) (rerun: 64) setitimer(0x2, 0x0, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000740)=ANY=[], 0x7c}}, 0x20000000) (async) sendmsg$NFT_BATCH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a09040000000000000000ffffffffffffffff3c0001800e000100696d6d65f669617465000000280002801c000280180002800900020073797a320000000008000180ffffffe5bdf861a0846b373d427687fc08000140000000000900010073797a30000000000900020073797a32000000001400000011000100"], 0x94}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000002000000000f40600000a14000000020a01"], 0x3c}, 0x1, 0x0, 0x0, 0x4011}, 0x4000094) (async, rerun: 64) prlimit64(0x0, 0x0, 0x0, &(0x7f0000000180)) (async, rerun: 64) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c0000001000390400"/20, @ANYBLOB="01980000031300001c0012800900010069706970000083000c00028008000300e00000015c413394c2cd647ccea14a0fa72abaaded37e53e987e722424214f79ed6432be46dbbcbf8bc3039a06c208aa6c7b8658e45d6d0c"], 0x3c}}, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r6, 0xe503, 0x0) (async) mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc000, 0x103) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030301a30303130303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) kernel console output (not intermixed with test programs): ilable [ 94.842704][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 94.897646][ T6221] xt_CT: You must specify a L4 protocol and not use inversions on it [ 94.898868][ T6218] gretap0: entered promiscuous mode [ 95.058619][ T10] usb 1-1: config 252 has an invalid interface number: 254 but max is 0 [ 95.068435][ T10] usb 1-1: config 252 has no interface number 0 [ 95.104136][ T10] usb 1-1: config 252 interface 254 altsetting 1 endpoint 0x6 has invalid wMaxPacketSize 0 [ 95.128705][ T10] usb 1-1: config 252 interface 254 altsetting 1 bulk endpoint 0x6 has invalid maxpacket 0 [ 95.152728][ T10] usb 1-1: config 252 interface 254 altsetting 1 endpoint 0x8 has invalid wMaxPacketSize 0 [ 95.185154][ T10] usb 1-1: config 252 interface 254 has no altsetting 0 [ 95.223710][ T10] usb 1-1: New USB device found, idVendor=057c, idProduct=2200, bcdDevice=46.29 [ 95.241557][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.253966][ T10] usb 1-1: Product: syz [ 95.272882][ T10] usb 1-1: Manufacturer: syz [ 95.284967][ T10] usb 1-1: SerialNumber: syz [ 95.368005][ T10] bfusb 1-1:252.254: probe with driver bfusb failed with error -5 [ 95.581066][ T6228] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 95.595143][ T6228] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.610293][ T10] usb 1-1: USB disconnect, device number 3 [ 96.300043][ T6242] netlink: 8 bytes leftover after parsing attributes in process `syz.4.108'. [ 97.953943][ T6261] netlink: 52 bytes leftover after parsing attributes in process `syz.1.114'. [ 97.966822][ T6261] netlink: 76 bytes leftover after parsing attributes in process `syz.1.114'. [ 98.010483][ T6261] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.017667][ T6261] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.025465][ T6261] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.032669][ T6261] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.074618][ T6261] netlink: 52 bytes leftover after parsing attributes in process `syz.1.114'. [ 98.096822][ T6263] xt_CT: You must specify a L4 protocol and not use inversions on it [ 98.253173][ T6261] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.260492][ T6261] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.794841][ T10] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 98.828358][ T6277] netlink: 80 bytes leftover after parsing attributes in process `syz.3.116'. [ 98.849428][ T9] IPVS: starting estimator thread 0... [ 98.943230][ T6277] IPVS: sh: FWM 3 0x00000003 - no destination available [ 98.960723][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 98.975719][ T6278] IPVS: using max 37 ests per chain, 88800 per kthread [ 98.992456][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 99.015270][ T10] usb 2-1: config 2 has an invalid interface number: 95 but max is 0 [ 99.177617][ T10] usb 2-1: config 2 has no interface number 0 [ 99.184328][ T10] usb 2-1: config 2 interface 95 has no altsetting 0 [ 99.246535][ T10] usb 2-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice=e3.7d [ 99.264134][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.288232][ T10] usb 2-1: Product: syz [ 99.293568][ T10] usb 2-1: Manufacturer: syz [ 99.299538][ T10] usb 2-1: SerialNumber: syz [ 99.327996][ T10] usb 2-1: unknown interface protocol 0x7f, assuming v1 [ 99.348019][ T10] usb 2-1: cannot find UAC_HEADER [ 99.660429][ T10] snd-usb-audio 2-1:2.95: probe with driver snd-usb-audio failed with error -22 [ 99.721937][ T10] usb 2-1: USB disconnect, device number 4 [ 99.759351][ T5834] udevd[5834]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:2.95/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 100.855440][ T10] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 100.887875][ T6313] xt_CT: You must specify a L4 protocol and not use inversions on it [ 100.900140][ T6311] loop2: detected capacity change from 0 to 7 [ 100.907738][ T6311] loop2: [ 100.910825][ T6311] loop2: partition table partially beyond EOD, truncated [ 100.920394][ T6311] fuse: Unknown parameter 'rooU‹­e' [ 101.016881][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 101.180096][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 101.313479][ T6315] rtc_cmos 00:00: Alarms can be up to one day in the future [ 101.322001][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 101.345016][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 101.345073][ T10] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 101.345094][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.373280][ T10] usb 3-1: config 0 descriptor?? [ 101.631397][ T5899] rtc_cmos 00:00: Alarms can be up to one day in the future [ 101.639220][ T5899] rtc_cmos 00:00: Alarms can be up to one day in the future [ 101.658248][ T5899] rtc_cmos 00:00: Alarms can be up to one day in the future [ 101.685146][ T5899] rtc_cmos 00:00: Alarms can be up to one day in the future [ 101.713002][ T5899] rtc rtc0: __rtc_set_alarm: err=-22 [ 101.786474][ T10] plantronics 0003:047F:FFFF.0003: ignoring exceeding usage max [ 101.857800][ T10] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 101.886661][ T6324] netlink: 80 bytes leftover after parsing attributes in process `syz.1.134'. [ 101.937802][ T6324] IPVS: sh: FWM 3 0x00000003 - no destination available [ 101.945027][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 101.971605][ T5899] IPVS: starting estimator thread 0... [ 102.064915][ T6326] IPVS: using max 32 ests per chain, 76800 per kthread [ 102.101951][ T6329] xt_TPROXY: Can be used only with -p tcp or -p udp [ 102.154149][ T6330] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 64993 [ 102.705318][ T5899] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 102.715908][ T6341] FAULT_INJECTION: forcing a failure. [ 102.715908][ T6341] name failslab, interval 1, probability 0, space 0, times 1 [ 102.783209][ T6341] CPU: 1 UID: 0 PID: 6341 Comm: syz.0.141 Not tainted syzkaller #0 PREEMPT(full) [ 102.783235][ T6341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 102.783245][ T6341] Call Trace: [ 102.783252][ T6341] [ 102.783257][ T6341] dump_stack_lvl+0xe8/0x150 [ 102.783276][ T6341] should_fail_ex+0x412/0x560 [ 102.783290][ T6341] should_failslab+0xa8/0x100 [ 102.783304][ T6341] __kmalloc_cache_noprof+0x88/0x660 [ 102.783321][ T6341] ? tcf_proto_create+0x65/0x330 [ 102.783350][ T6341] tcf_proto_create+0x65/0x330 [ 102.783382][ T6341] tc_new_tfilter+0x11fc/0x1630 [ 102.783421][ T6341] ? __pfx_tc_new_tfilter+0x10/0x10 [ 102.783472][ T6341] ? __pfx_tc_new_tfilter+0x10/0x10 [ 102.783494][ T6341] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 102.783527][ T6341] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 102.783544][ T6341] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 102.783554][ T6341] ? ref_tracker_free+0x693/0x840 [ 102.783565][ T6341] ? __copy_skb_header+0xa3/0x4a0 [ 102.783580][ T6341] ? __pfx_ref_tracker_free+0x10/0x10 [ 102.783590][ T6341] ? __skb_clone+0x63/0x7a0 [ 102.783612][ T6341] netlink_rcv_skb+0x232/0x4b0 [ 102.783671][ T6341] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 102.783690][ T6341] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 102.783706][ T6341] ? netlink_deliver_tap+0x2e/0x1b0 [ 102.783720][ T6341] netlink_unicast+0x80f/0x9b0 [ 102.783734][ T6341] ? __pfx_netlink_unicast+0x10/0x10 [ 102.783743][ T6341] ? __kvmalloc_node_noprof+0x393/0x8a0 [ 102.783758][ T6341] ? netlink_sendmsg+0x650/0xb40 [ 102.783775][ T6341] ? skb_put+0x11b/0x210 [ 102.783799][ T6341] netlink_sendmsg+0x813/0xb40 [ 102.783828][ T6341] ? __pfx_netlink_sendmsg+0x10/0x10 [ 102.783845][ T6341] ? aa_sock_msg_perm+0xf1/0x1b0 [ 102.783857][ T6341] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 102.783868][ T6341] ? __pfx_netlink_sendmsg+0x10/0x10 [ 102.783878][ T6341] ____sys_sendmsg+0xa68/0xad0 [ 102.783896][ T6341] ? __pfx_____sys_sendmsg+0x10/0x10 [ 102.783925][ T6341] ? import_iovec+0x73/0xa0 [ 102.783952][ T6341] ___sys_sendmsg+0x2a5/0x360 [ 102.783981][ T6341] ? __pfx____sys_sendmsg+0x10/0x10 [ 102.784012][ T6341] ? __fget_files+0x2a/0x420 [ 102.784025][ T6341] ? __fget_files+0x3a0/0x420 [ 102.784042][ T6341] __x64_sys_sendmsg+0x1bd/0x2a0 [ 102.784065][ T6341] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 102.784098][ T6341] ? __pfx_ksys_write+0x10/0x10 [ 102.784126][ T6341] do_syscall_64+0x14d/0xf80 [ 102.784141][ T6341] ? trace_irq_disable+0x3b/0x150 [ 102.784155][ T6341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.784164][ T6341] ? clear_bhb_loop+0x40/0x90 [ 102.784176][ T6341] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.784189][ T6341] RIP: 0033:0x7fb37b99c629 [ 102.784204][ T6341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.784217][ T6341] RSP: 002b:00007fb37c836028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 102.784235][ T6341] RAX: ffffffffffffffda RBX: 00007fb37bc15fa0 RCX: 00007fb37b99c629 [ 102.784245][ T6341] RDX: 0000000000000800 RSI: 00002000000001c0 RDI: 0000000000000004 [ 102.784255][ T6341] RBP: 00007fb37c836090 R08: 0000000000000000 R09: 0000000000000000 [ 102.784264][ T6341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 102.784274][ T6341] R13: 00007fb37bc16038 R14: 00007fb37bc15fa0 R15: 00007fb37bd3fa48 [ 102.784302][ T6341] [ 103.455472][ T9] usb 3-1: reset high-speed USB device number 4 using dummy_hcd [ 103.518482][ T5899] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 103.540458][ T5899] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 103.591269][ T6345] netlink: 28 bytes leftover after parsing attributes in process `syz.0.142'. [ 103.601364][ T5899] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 103.614844][ T9] usb 3-1: device descriptor read/64, error -32 [ 103.634980][ T6345] netlink: 28 bytes leftover after parsing attributes in process `syz.0.142'. [ 103.644236][ T5899] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 103.685414][ T5899] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 103.703031][ T6345] bridge0: entered promiscuous mode [ 103.717973][ T6345] ip6gretap0: entered promiscuous mode [ 103.729006][ T5899] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 103.745131][ T5899] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 103.746208][ T6345] debugfs: 'hsr1' already exists in 'hsr' [ 103.753401][ T5899] usb 4-1: Product: syz [ 103.753420][ T5899] usb 4-1: Manufacturer: syz [ 103.801291][ T5899] cdc_wdm 4-1:1.0: skipping garbage [ 103.835311][ T5899] cdc_wdm 4-1:1.0: skipping garbage [ 103.853427][ T6345] Cannot create hsr debugfs directory [ 103.863074][ T9] usb 3-1: reset high-speed USB device number 4 using dummy_hcd [ 103.893058][ T6347] xt_CT: You must specify a L4 protocol and not use inversions on it [ 103.944297][ T5899] cdc_wdm 4-1:1.0: cdc-wdm1: USB WDM device [ 103.986963][ T5899] cdc_wdm 4-1:1.0: Unknown control protocol [ 104.041117][ T6350] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 104.051378][ T6350] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 104.066226][ T6351] loop8: detected capacity change from 0 to 8 [ 104.079135][ T6351] Dev loop8: unable to read RDB block 8 [ 104.087898][ T6351] loop8: unable to read partition table [ 104.093780][ T6351] loop8: partition table beyond EOD, truncated [ 104.119113][ T5819] usb 4-1: USB disconnect, device number 2 [ 104.136153][ T6351] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 104.256315][ T6360] geneve2: entered promiscuous mode [ 104.353146][ T6364] unsupported nla_type 52263 [ 104.394918][ T5928] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 104.415738][ T980] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 104.574911][ T5928] usb 2-1: Using ep0 maxpacket: 16 [ 104.593904][ T5928] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 104.615157][ T5928] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 104.630000][ T5928] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 104.654956][ T10] usb 3-1: USB disconnect, device number 4 [ 104.738001][ T5928] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 104.755986][ T5928] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 104.782073][ T5928] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 104.896079][ T5928] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 104.915020][ T5928] usb 2-1: Manufacturer: syz [ 104.937229][ T5928] usb 2-1: config 0 descriptor?? [ 105.465227][ T5928] rc_core: IR keymap rc-hauppauge not found [ 105.475946][ T5928] Registered IR keymap rc-empty [ 105.504057][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 105.544929][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 105.567078][ T5928] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 105.648548][ T6383] netlink: 80 bytes leftover after parsing attributes in process `syz.3.153'. [ 105.794877][ T6379] IPVS: sh: FWM 3 0x00000003 - no destination available [ 105.802370][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 105.841825][ T5928] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input8 [ 105.937243][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 105.984837][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 106.026046][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 106.068111][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 106.105507][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 106.114945][ T24] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 106.155002][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 106.199004][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 106.224879][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 106.256618][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 106.272055][ T24] usb 3-1: config 0 has an invalid interface number: 195 but max is 0 [ 106.301455][ T24] usb 3-1: config 0 has no interface number 0 [ 106.315053][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 106.348581][ T5928] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 106.360221][ T24] usb 3-1: config 0 interface 195 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 106.381898][ T5928] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 106.405346][ T24] usb 3-1: New USB device found, idVendor=0789, idProduct=0160, bcdDevice=fd.08 [ 106.489929][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.543412][ T24] usb 3-1: Product: syz [ 106.601780][ T24] usb 3-1: Manufacturer: syz [ 106.635522][ T24] usb 3-1: SerialNumber: syz [ 106.666377][ T24] usb 3-1: config 0 descriptor?? [ 106.704213][ T6385] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 106.712145][ T6393] loop2: detected capacity change from 0 to 7 [ 106.802195][ T10] usb 2-1: USB disconnect, device number 5 [ 106.812264][ T5834] Dev loop2: unable to read RDB block 7 [ 106.824132][ T5834] loop2: unable to read partition table [ 106.832721][ T5834] loop2: partition table beyond EOD, truncated [ 106.867264][ T6393] Dev loop2: unable to read RDB block 7 [ 106.889950][ T6393] loop2: unable to read partition table [ 106.900386][ T6393] loop2: partition table beyond EOD, truncated [ 106.922112][ T6393] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ÿ€¨â·û¿ªæ) failed (rc=-5) [ 106.939836][ T6385] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 106.961220][ T6385] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 106.983414][ T6385] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 107.011247][ T6385] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 107.111933][ T6395] netlink: 44 bytes leftover after parsing attributes in process `syz.1.156'. [ 107.266972][ T24] asix 3-1:0.195: probe with driver asix failed with error -71 [ 107.347653][ T24] usb 3-1: USB disconnect, device number 5 [ 107.625680][ T980] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 107.648786][ T980] usb 5-1: can't read configurations, error -71 [ 107.758811][ T6410] xt_CT: You must specify a L4 protocol and not use inversions on it [ 108.081525][ T6415] loop8: detected capacity change from 0 to 8 [ 108.128378][ T6415] Dev loop8: unable to read RDB block 8 [ 108.184064][ T6415] loop8: unable to read partition table [ 108.224191][ T6415] loop8: partition table beyond EOD, truncated [ 108.265961][ T6415] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 109.176768][ T6441] netlink: 28 bytes leftover after parsing attributes in process `syz.4.171'. [ 109.245109][ T6441] netlink: 28 bytes leftover after parsing attributes in process `syz.4.171'. [ 109.285908][ T6441] bridge0: entered promiscuous mode [ 109.292362][ T6441] ip6gretap0: entered promiscuous mode [ 109.321551][ T6441] debugfs: 'hsr1' already exists in 'hsr' [ 109.351005][ T6441] Cannot create hsr debugfs directory [ 109.522598][ T6447] netlink: 80 bytes leftover after parsing attributes in process `syz.0.170'. [ 109.557974][ T6447] IPVS: sh: FWM 3 0x00000003 - no destination available [ 109.565552][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 111.139374][ T6469] Zero length message leads to an empty skb [ 111.376621][ T10] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 111.557569][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 111.579168][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 111.639118][ T10] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 111.660568][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.693347][ T6480] loop2: detected capacity change from 0 to 7 [ 111.704923][ T10] usb 4-1: Product: syz [ 111.709134][ T10] usb 4-1: Manufacturer: syz [ 111.726086][ T6480] Dev loop2: unable to read RDB block 7 [ 111.731725][ T6480] loop2: unable to read partition table [ 111.737561][ T5928] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 111.746747][ T10] usb 4-1: SerialNumber: syz [ 111.746957][ T6480] loop2: partition table beyond EOD, truncated [ 111.774959][ T6480] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– Ú¾¨â·û¿ªæ) failed (rc=-5) [ 111.894793][ T5928] usb 1-1: device descriptor read/64, error -71 [ 112.069205][ T9] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 112.175001][ T5928] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 112.251474][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 112.264107][ T9] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0069, bcdDevice=6e.55 [ 112.273539][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.281843][ T9] usb 3-1: Product: syz [ 112.288463][ T9] usb 3-1: Manufacturer: syz [ 112.300643][ T9] usb 3-1: SerialNumber: syz [ 112.305540][ T5928] usb 1-1: device descriptor read/64, error -71 [ 112.329280][ T9] usb 3-1: config 0 descriptor?? [ 112.411344][ T6494] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 112.436262][ T6494] overlayfs: missing 'lowerdir' [ 112.485922][ T5928] usb usb1-port1: attempt power cycle [ 112.519034][ T10] usb 4-1: 0:2 : does not exist [ 112.539115][ T9] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 112.611069][ T9] dvb_usb_af9015 3-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 112.626515][ T10] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 112.689793][ T9] usb 3-1: USB disconnect, device number 6 [ 112.769681][ T10] usb 4-1: USB disconnect, device number 3 [ 112.851760][ T5834] udevd[5834]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 112.875706][ T5928] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 112.912820][ T5928] usb 1-1: device descriptor read/8, error -71 [ 112.996053][ T6499] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 113.141455][ T6499] overlayfs: missing 'lowerdir' [ 113.294973][ T5928] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 113.335874][ T5928] usb 1-1: device descriptor read/8, error -71 [ 113.455023][ T5928] usb usb1-port1: unable to enumerate USB device [ 113.845158][ T6507] loop8: detected capacity change from 0 to 8 [ 113.853345][ T6508] netlink: 80 bytes leftover after parsing attributes in process `syz.2.189'. [ 113.872415][ T5899] IPVS: starting estimator thread 0... [ 113.893564][ T5834] Dev loop8: unable to read RDB block 8 [ 113.900421][ T5834] loop8: unable to read partition table [ 113.906878][ T5834] loop8: partition table beyond EOD, truncated [ 113.915786][ T6507] Dev loop8: unable to read RDB block 8 [ 113.925602][ T6507] loop8: unable to read partition table [ 113.933267][ T6501] IPVS: sh: FWM 3 0x00000003 - no destination available [ 113.998047][ T6509] IPVS: using max 30 ests per chain, 72000 per kthread [ 114.026821][ T6507] loop8: partition table beyond EOD, truncated [ 114.055418][ T6507] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 114.991862][ T6516] loop2: detected capacity change from 0 to 7 [ 115.002272][ T6518] netlink: 28 bytes leftover after parsing attributes in process `syz.0.194'. [ 115.021879][ T6516] loop2: [ 115.031862][ T6516] loop2: partition table partially beyond EOD, truncated [ 115.044883][ T6518] netlink: 28 bytes leftover after parsing attributes in process `syz.0.194'. [ 115.086101][ T6520] binder: 6519:6520 unknown command 0 [ 115.111653][ T6520] binder: 6519:6520 ioctl c0306201 200000000080 returned -22 [ 115.351170][ T6525] bond_slave_0: entered promiscuous mode [ 115.356946][ T6525] bond_slave_1: entered promiscuous mode [ 115.375520][ T6525] vlan2: entered promiscuous mode [ 115.380843][ T6525] bond0: entered promiscuous mode [ 115.433426][ T6531] netlink: 84 bytes leftover after parsing attributes in process `syz.3.196'. [ 115.812665][ T6539] input: syz1 as /devices/virtual/input/input9 [ 117.010485][ T6558] loop8: detected capacity change from 0 to 8 [ 117.090565][ T6558] Dev loop8: unable to read RDB block 8 [ 117.124989][ T6558] loop8: unable to read partition table [ 117.130855][ T6558] loop8: partition table beyond EOD, truncated [ 117.281828][ T6570] netlink: 80 bytes leftover after parsing attributes in process `syz.3.209'. [ 117.342993][ T6570] IPVS: sh: FWM 3 0x00000003 - no destination available [ 117.350337][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 117.361185][ T6558] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 117.486449][ T6573] netlink: 84 bytes leftover after parsing attributes in process `syz.0.211'. [ 117.998223][ T6589] netlink: 20 bytes leftover after parsing attributes in process `syz.0.216'. [ 118.042771][ T6589] netlink: 20 bytes leftover after parsing attributes in process `syz.0.216'. [ 118.129304][ T6577] netlink: 28 bytes leftover after parsing attributes in process `syz.4.213'. [ 118.170401][ T6589] netlink: 7 bytes leftover after parsing attributes in process `syz.0.216'. [ 118.180380][ T6583] IPVS: sh: FWM 3 0x00000003 - no destination available [ 118.187917][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 119.194216][ T6603] loop2: detected capacity change from 0 to 7 [ 119.207786][ T6603] Dev loop2: unable to read RDB block 7 [ 119.240045][ T6603] loop2: unable to read partition table [ 119.254583][ T6603] loop2: partition table beyond EOD, truncated [ 119.290202][ T6603] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ÿî¨â·û¿ªæ) failed (rc=-5) [ 119.466643][ T5928] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 119.524779][ T9] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 119.625587][ T5928] usb 2-1: Using ep0 maxpacket: 8 [ 119.646035][ T5928] usb 2-1: config 1 interface 0 altsetting 232 endpoint 0x81 has an invalid bInterval 195, changing to 11 [ 119.659319][ T5928] usb 2-1: config 1 interface 0 has no altsetting 0 [ 119.663950][ T6613] netlink: 'syz.0.224': attribute type 13 has an invalid length. [ 119.673476][ T5928] usb 2-1: New USB device found, idVendor=28bd, idProduct=0905, bcdDevice= 0.40 [ 119.684156][ T5928] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.692467][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 119.698141][ T5928] usb 2-1: Product: ë‘”å¾â¬ŽË¤å¯ªë®´å¿á´·ç§°ä–‹éƒ½á‚žé¬¤í‚™ï†–é  æâ¸ƒî˜ [ 119.707893][ T5928] usb 2-1: Manufacturer: 狙ꡙ᪄â—劒꧓ë¡â‘·Îã•ä·±æ™“ì‚©ï½á‹‹è¢°éº”ì‚™í¿ß¤ã”¼ê„³ãµ‡È´è íŸ¥ï±“⪔ꇰ嬜é¤î¨¦ìŠ‘멂퓀䉹៱凗Ꜽ⣡挿嘙굹軃釣ផ椪íî¥ï™¨é‰œâš¸á±¸æµê’œç•áº­ì«±çªå®ƒ [ 119.731579][ T5928] usb 2-1: SerialNumber: à°‡ [ 119.736939][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 119.755920][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 119.824744][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 119.854849][ T9] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 119.876124][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.894808][ T10] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 119.906867][ T9] usb 5-1: config 0 descriptor?? [ 120.048077][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 120.075822][ T10] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 120.087720][ T10] usb 3-1: config 0 has no interface number 0 [ 120.093961][ T10] usb 3-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 120.118077][ T10] usb 3-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 120.127816][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.136195][ T10] usb 3-1: Product: syz [ 120.141175][ T10] usb 3-1: Manufacturer: syz [ 120.146213][ T10] usb 3-1: SerialNumber: syz [ 120.162040][ T10] usb 3-1: config 0 descriptor?? [ 120.184566][ T6623] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 120.211820][ T6623] overlayfs: missing 'lowerdir' [ 120.274358][ T5928] usbhid 2-1:1.0: can't add hid device: -71 [ 120.289818][ T5928] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 120.299888][ T10] em28xx 3-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 120.315192][ T5928] usb 2-1: USB disconnect, device number 6 [ 120.328475][ T10] em28xx 3-1:0.132: Video interface 132 found: [ 120.358230][ T9] microsoft 0003:045E:07DA.0004: item fetching failed at offset 31/34 [ 120.456774][ T9] microsoft 0003:045E:07DA.0004: parse failed [ 120.463134][ T9] microsoft 0003:045E:07DA.0004: probe with driver microsoft failed with error -22 [ 120.548268][ T980] usb 5-1: USB disconnect, device number 9 [ 120.685653][ T10] em28xx 3-1:0.132: unknown em28xx chip ID (0) [ 120.869588][ T6625] netlink: 4 bytes leftover after parsing attributes in process `syz.3.227'. [ 121.285440][ T5928] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 121.757212][ T5928] usb 4-1: config 1 interface 0 altsetting 167 bulk endpoint 0x82 has invalid maxpacket 1024 [ 121.779328][ T5928] usb 4-1: config 1 interface 0 altsetting 167 bulk endpoint 0x3 has invalid maxpacket 1023 [ 121.807513][ T5928] usb 4-1: config 1 interface 0 altsetting 167 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 121.836920][ T5928] usb 4-1: config 1 interface 0 has no altsetting 0 [ 121.853741][ T5928] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 121.875331][ T10] em28xx 3-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 121.890751][ T10] em28xx 3-1:0.132: board has no eeprom [ 121.897996][ T5928] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.927977][ T5928] usb 4-1: Manufacturer: ᭑轆衿뎂郞Ⳕ核ã½ê㋵咒㠅蚚淤댉胳쵄튂䘾â’ࠑ豮黿㨴뎔ᘰि沑Ⓢ款঄È㣯ꦧ⩛ඇ뮳ì±ãŠ¶é¹½ìŠ¡é›‰ì¾ê«¬ë“™é¯á™—驞㽱爫畵ᰬ婕劯沼糯減ꕦ舯ç‡å‹‡í’郜礤쑷檿⢱䷥ [ 121.965524][ T10] em28xx 3-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 121.995834][ T10] em28xx 3-1:0.132: analog set to bulk mode. [ 122.011522][ T5819] em28xx 3-1:0.132: Registering V4L2 extension [ 122.034909][ T5928] usb 4-1: SerialNumber: በ[ 122.122923][ T6626] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 122.142190][ T6626] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 122.205445][ T6638] netlink: 80 bytes leftover after parsing attributes in process `syz.0.230'. [ 122.272850][ T5819] em28xx 3-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 122.303277][ T5819] em28xx 3-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 122.323765][ T5819] em28xx 3-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 122.338056][ T5819] em28xx 3-1:0.132: failed to trigger read from i2c address 0x40 (error=-5) [ 122.365145][ T6632] IPVS: sh: FWM 3 0x00000003 - no destination available [ 122.403265][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 122.479617][ T5928] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 122.511362][ T5819] em28xx 3-1:0.132: failed to trigger read from i2c address 0x84 (error=-5) [ 122.549110][ T5928] usb 4-1: USB disconnect, device number 4 [ 122.650705][ T5819] em28xx 3-1:0.132: failed to trigger read from i2c address 0x86 (error=-5) [ 122.677434][ T5819] em28xx 3-1:0.132: failed to trigger read from i2c address 0x94 (error=-5) [ 122.718261][ T5819] em28xx 3-1:0.132: failed to trigger read from i2c address 0x96 (error=-5) [ 122.817815][ T5819] em28xx 3-1:0.132: failed to trigger read from i2c address 0xc0 (error=-5) [ 122.836084][ T5819] em28xx 3-1:0.132: failed to trigger read from i2c address 0xc2 (error=-5) [ 122.939530][ T5819] em28xx 3-1:0.132: failed to trigger read from i2c address 0xc4 (error=-5) [ 122.963879][ T5819] em28xx 3-1:0.132: failed to trigger read from i2c address 0xc6 (error=-5) [ 122.984050][ T5819] em28xx 3-1:0.132: failed to trigger read from i2c address 0xc8 (error=-5) [ 123.045330][ T5819] em28xx 3-1:0.132: Config register raw data: 0xfffffffb [ 123.077870][ T980] usb 3-1: USB disconnect, device number 7 [ 123.084529][ T980] em28xx 3-1:0.132: Disconnecting em28xx [ 123.106536][ T5819] em28xx 3-1:0.132: AC97 chip type couldn't be determined [ 123.113786][ T5819] em28xx 3-1:0.132: No AC97 audio processor [ 123.136369][ T6652] netlink: 84 bytes leftover after parsing attributes in process `syz.1.235'. [ 123.184278][ T5819] usb 3-1: Decoder not found [ 123.197354][ T6652] netlink: 84 bytes leftover after parsing attributes in process `syz.1.235'. [ 123.201103][ T5819] em28xx 3-1:0.132: failed to create media graph [ 123.241546][ T6652] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 123.257221][ T5819] em28xx 3-1:0.132: V4L2 device video103 deregistered [ 123.277351][ T5819] em28xx 3-1:0.132: Remote control support is not available for this card. [ 123.337405][ T980] em28xx 3-1:0.132: Closing input extension [ 123.394433][ T980] em28xx 3-1:0.132: Freeing device [ 123.424779][ T6660] netlink: 52 bytes leftover after parsing attributes in process `syz.3.238'. [ 123.498871][ T6660] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.506238][ T6660] bridge0: port 1(bridge_slave_0) entered disabled state [ 123.547830][ T6667] netlink: 76 bytes leftover after parsing attributes in process `syz.3.238'. [ 123.595261][ T6667] bridge0: port 2(bridge_slave_1) entered blocking state [ 123.595400][ T6667] bridge0: port 2(bridge_slave_1) entered forwarding state [ 123.595671][ T6667] bridge0: port 1(bridge_slave_0) entered blocking state [ 123.595777][ T6667] bridge0: port 1(bridge_slave_0) entered forwarding state [ 123.600041][ T6667] netlink: 52 bytes leftover after parsing attributes in process `syz.3.238'. [ 123.609861][ T6670] netlink: 28 bytes leftover after parsing attributes in process `syz.0.243'. [ 123.609886][ T6670] netlink: 28 bytes leftover after parsing attributes in process `syz.0.243'. [ 123.621355][ T6668] geneve2: entered promiscuous mode [ 123.731550][ T6667] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.738968][ T6667] bridge0: port 1(bridge_slave_0) entered disabled state [ 123.782160][ T6670] erspan0: entered promiscuous mode [ 123.796369][ T6670] gretap0: entered promiscuous mode [ 123.837265][ T6673] vlan2: entered promiscuous mode [ 123.842509][ T6673] bridge0: entered promiscuous mode [ 124.072958][ T6681] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 124.166073][ T6689] tipc: Failed to remove unknown binding: 66,1,1/8432298:856897517/856897519 [ 124.261528][ T6692] loop2: detected capacity change from 0 to 7 [ 124.270344][ T6692] loop2: [ 124.273792][ T6692] loop2: partition table partially beyond EOD, truncated [ 124.344802][ T5819] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 124.474270][ T6694] netlink: 80 bytes leftover after parsing attributes in process `syz.1.250'. [ 124.623471][ T6688] IPVS: sh: FWM 3 0x00000003 - no destination available [ 124.669386][ T5819] usb 3-1: config 0 has an invalid interface number: 33 but max is 0 [ 124.678404][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 124.694073][ T5819] usb 3-1: config 0 has no interface number 0 [ 124.702188][ T5819] usb 3-1: New USB device found, idVendor=24cf, idProduct=59e4, bcdDevice= 9.43 [ 124.713132][ T5819] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.738374][ T5819] usb 3-1: config 0 descriptor?? [ 124.763055][ T5819] usb-storage 3-1:0.33: USB Mass Storage device detected [ 125.012855][ T6705] loop8: detected capacity change from 0 to 8 [ 125.020337][ T6705] Dev loop8: unable to read RDB block 8 [ 125.078068][ T6705] loop8: unable to read partition table [ 125.084017][ T5819] usb 3-1: USB disconnect, device number 8 [ 125.127881][ T6705] loop8: partition table beyond EOD, truncated [ 125.134109][ T6705] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 125.649289][ T6714] xt_CT: You must specify a L4 protocol and not use inversions on it [ 125.664789][ T5928] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 125.858136][ T5928] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 125.881339][ T5928] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 125.959009][ T6729] netlink: 28 bytes leftover after parsing attributes in process `syz.3.263'. [ 125.992706][ T5928] usb 5-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 126.009382][ T6729] netlink: 28 bytes leftover after parsing attributes in process `syz.3.263'. [ 126.025941][ T5928] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.036240][ T6728] netlink: 44 bytes leftover after parsing attributes in process `syz.2.264'. [ 126.116605][ T5928] usb 5-1: config 0 descriptor?? [ 126.189105][ T6729] erspan0: entered promiscuous mode [ 126.200486][ T6729] gretap0: entered promiscuous mode [ 126.264858][ T6729] debugfs: 'hsr1' already exists in 'hsr' [ 126.291057][ T6729] Cannot create hsr debugfs directory [ 126.777965][ T6742] tipc: Failed to remove unknown binding: 66,1,1/0:1644751216/1644751218 [ 127.030711][ T5928] usbhid 5-1:0.0: can't add hid device: -32 [ 127.037530][ T5928] usbhid 5-1:0.0: probe with driver usbhid failed with error -32 [ 127.057229][ T5928] usb 5-1: USB disconnect, device number 10 [ 127.217852][ T6748] netlink: 80 bytes leftover after parsing attributes in process `syz.3.267'. [ 127.287189][ T6750] netlink: 169384 bytes leftover after parsing attributes in process `syz.1.268'. [ 127.402844][ T6751] IPVS: sh: FWM 3 0x00000003 - no destination available [ 127.417041][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 127.431011][ T6747] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 127.486832][ T6747] team0: Port device batadv1 added [ 128.537082][ T6768] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 128.586947][ T6768] overlayfs: missing 'lowerdir' [ 128.610646][ T6769] 8021q: VLANs not supported on vcan0 [ 128.816020][ T6771] xt_TPROXY: Can be used only with -p tcp or -p udp [ 128.991801][ T6778] FAULT_INJECTION: forcing a failure. [ 128.991801][ T6778] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 129.038726][ T6778] CPU: 0 UID: 0 PID: 6778 Comm: syz.3.277 Not tainted syzkaller #0 PREEMPT(full) [ 129.038751][ T6778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 129.038761][ T6778] Call Trace: [ 129.038769][ T6778] [ 129.038777][ T6778] dump_stack_lvl+0xe8/0x150 [ 129.038813][ T6778] should_fail_ex+0x412/0x560 [ 129.038838][ T6778] _copy_to_user+0x31/0xb0 [ 129.038864][ T6778] simple_read_from_buffer+0xe1/0x170 [ 129.038891][ T6778] proc_fail_nth_read+0x1bb/0x230 [ 129.038916][ T6778] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 129.038942][ T6778] ? rw_verify_area+0x2a6/0x4d0 [ 129.038958][ T6778] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 129.038981][ T6778] vfs_read+0x20c/0xa70 [ 129.038995][ T6778] ? fdget_pos+0x246/0x320 [ 129.039021][ T6778] ? __pfx___mutex_lock+0x10/0x10 [ 129.039054][ T6778] ? __pfx_vfs_read+0x10/0x10 [ 129.039072][ T6778] ? __fget_files+0x2a/0x420 [ 129.039098][ T6778] ? __fget_files+0x3a0/0x420 [ 129.039119][ T6778] ? __fget_files+0x2a/0x420 [ 129.039149][ T6778] ksys_read+0x150/0x270 [ 129.039169][ T6778] ? __pfx_ksys_read+0x10/0x10 [ 129.039185][ T6778] ? __pfx_do_pagemap_cmd+0x10/0x10 [ 129.039211][ T6778] do_syscall_64+0x14d/0xf80 [ 129.039234][ T6778] ? trace_irq_disable+0x3b/0x150 [ 129.039257][ T6778] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.039274][ T6778] ? clear_bhb_loop+0x40/0x90 [ 129.039294][ T6778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.039311][ T6778] RIP: 0033:0x7f0056b5cece [ 129.039335][ T6778] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 129.039353][ T6778] RSP: 002b:00007f0057a46fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 129.039371][ T6778] RAX: ffffffffffffffda RBX: 00007f0057a476c0 RCX: 00007f0056b5cece [ 129.039383][ T6778] RDX: 000000000000000f RSI: 00007f0057a470a0 RDI: 0000000000000004 [ 129.039393][ T6778] RBP: 00007f0057a47090 R08: 0000000000000000 R09: 0000000000000000 [ 129.039403][ T6778] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 129.039413][ T6778] R13: 00007f0056e16038 R14: 00007f0056e15fa0 R15: 00007f0056f3fa48 [ 129.039441][ T6778] [ 129.481522][ T9] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 129.744753][ T9] usb 2-1: device descriptor read/64, error -71 [ 129.979694][ T6792] fuse: Bad value for 'fd' [ 130.174349][ T9] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 130.224314][ T5928] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 130.366228][ T6792] netlink: 40 bytes leftover after parsing attributes in process `syz.0.280'. [ 130.444890][ T9] usb 2-1: device descriptor read/64, error -71 [ 130.460561][ T5928] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 130.472236][ T5928] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 130.491381][ T5928] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 130.557507][ T6799] netlink: 80 bytes leftover after parsing attributes in process `syz.2.281'. [ 130.595199][ T9] usb usb2-port1: attempt power cycle [ 130.657644][ T5928] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 130.689222][ T5928] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 130.714758][ T5928] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.749399][ T5928] usb 4-1: config 0 descriptor?? [ 130.770745][ T6799] IPVS: sh: FWM 3 0x00000003 - no destination available [ 131.042649][ T9] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 131.073259][ T9] usb 2-1: device descriptor read/8, error -71 [ 131.329035][ T9] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 131.380739][ T9] usb 2-1: device descriptor read/8, error -71 [ 131.495111][ T9] usb usb2-port1: unable to enumerate USB device [ 132.056701][ T6829] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 132.498115][ T6839] loop2: detected capacity change from 0 to 7 [ 132.624979][ T6839] Dev loop2: unable to read RDB block 7 [ 132.635123][ T6839] loop2: unable to read partition table [ 132.648048][ T6839] loop2: partition table beyond EOD, truncated [ 132.677994][ T6839] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– €ÿ¨â·û¿ªæ) failed (rc=-5) [ 132.760316][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.767188][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.062780][ T5928] usbhid 4-1:0.0: can't add hid device: -71 [ 133.074399][ T5928] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 133.124305][ T5928] usb 4-1: USB disconnect, device number 5 [ 133.895178][ T5819] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 134.012528][ T6874] loop2: detected capacity change from 0 to 7 [ 134.105339][ T5819] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 134.129925][ T6874] loop2: [ 134.132898][ T6874] loop2: partition table partially beyond EOD, truncated [ 134.256801][ T5819] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 134.300736][ T6881] netlink: 80 bytes leftover after parsing attributes in process `syz.3.301'. [ 134.325648][ T5819] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 134.369422][ T5819] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 134.413470][ T5819] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 134.455132][ T6885] netlink: 76 bytes leftover after parsing attributes in process `syz.4.302'. [ 134.464899][ T5928] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 134.482916][ T5819] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.557905][ T5819] usb 2-1: config 0 descriptor?? [ 134.634917][ T5928] usb 1-1: device descriptor read/64, error -71 [ 134.828217][ T6894] trusted_key: encrypted_key: insufficient parameters specified [ 134.927532][ T5928] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 135.086618][ T6897] loop2: detected capacity change from 0 to 7 [ 135.096866][ T5819] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 135.115969][ T6897] Dev loop2: unable to read RDB block 7 [ 135.151982][ T5928] usb 1-1: device descriptor read/64, error -71 [ 135.173408][ T6897] loop2: unable to read partition table [ 135.192663][ T6897] loop2: partition table beyond EOD, truncated [ 135.233036][ T6897] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– —ÿ¨â·û¿ªæ) failed (rc=-5) [ 135.336981][ T5928] usb usb1-port1: attempt power cycle [ 135.703992][ T5928] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 135.755538][ T5928] usb 1-1: device descriptor read/8, error -71 [ 135.888203][ T6913] workqueue: name exceeds WQ_NAME_LEN. Truncating to: 1ùà^!‚lø$pOcÚÉ”ÎÜr$åG—•µt:‹ [ 136.024764][ T5928] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 136.070535][ T5928] usb 1-1: device descriptor read/8, error -71 [ 136.195261][ T5928] usb usb1-port1: unable to enumerate USB device [ 136.376031][ T6921] netlink: 28 bytes leftover after parsing attributes in process `syz.3.310'. [ 136.410459][ T6921] netlink: 28 bytes leftover after parsing attributes in process `syz.3.310'. [ 136.597923][ T6921] bridge0: entered promiscuous mode [ 136.685986][ T6921] ip6gretap0: entered promiscuous mode [ 136.700480][ T6921] debugfs: 'hsr2' already exists in 'hsr' [ 136.794880][ T6921] Cannot create hsr debugfs directory [ 136.801606][ T6921] hsr2: Slave A (bridge0) is not up; please bring it up to get a fully working HSR network [ 136.844770][ T5892] usb 2-1: reset high-speed USB device number 11 using dummy_hcd [ 136.984934][ T5892] usb 2-1: device descriptor read/64, error -32 [ 137.218622][ T6935] netlink: 76 bytes leftover after parsing attributes in process `syz.3.313'. [ 137.272342][ T6935] bridge0: port 2(bridge_slave_1) entered blocking state [ 137.280120][ T6935] bridge0: port 2(bridge_slave_1) entered forwarding state [ 137.288575][ T6935] bridge0: port 1(bridge_slave_0) entered blocking state [ 137.295793][ T6935] bridge0: port 1(bridge_slave_0) entered forwarding state [ 137.324760][ T9] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 137.467170][ T5892] usb 2-1: reset high-speed USB device number 11 using dummy_hcd [ 137.506883][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 137.538148][ T9] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=8e.0b [ 137.574772][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.593099][ T9] usb 1-1: Product: syz [ 137.601855][ T9] usb 1-1: Manufacturer: syz [ 137.609975][ T9] usb 1-1: SerialNumber: syz [ 137.626203][ T5892] usb 2-1: device firmware changed [ 137.632610][ T9] usb 1-1: config 0 descriptor?? [ 137.639777][ T980] usb 2-1: USB disconnect, device number 11 [ 137.784455][ T6943] vlan2: entered promiscuous mode [ 137.816679][ T6945] FAULT_INJECTION: forcing a failure. [ 137.816679][ T6945] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 137.831857][ T6945] CPU: 0 UID: 0 PID: 6945 Comm: syz.2.316 Tainted: G L syzkaller #0 PREEMPT(full) [ 137.831885][ T6945] Tainted: [L]=SOFTLOCKUP [ 137.831891][ T6945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 137.831899][ T6945] Call Trace: [ 137.831906][ T6945] [ 137.831913][ T6945] dump_stack_lvl+0xe8/0x150 [ 137.831943][ T6945] should_fail_ex+0x412/0x560 [ 137.831968][ T6945] _copy_from_iter+0x1d3/0x1670 [ 137.832002][ T6945] ? rcu_is_watching+0x15/0xb0 [ 137.832030][ T6945] ? __pfx__copy_from_iter+0x10/0x10 [ 137.832057][ T6945] ? netlink_sendmsg+0x650/0xb40 [ 137.832076][ T6945] ? skb_put+0x11b/0x210 [ 137.832100][ T6945] netlink_sendmsg+0x6c0/0xb40 [ 137.832127][ T6945] ? __pfx_netlink_sendmsg+0x10/0x10 [ 137.832150][ T6945] ? aa_sock_msg_perm+0xf1/0x1b0 [ 137.832171][ T6945] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 137.832190][ T6945] ? __pfx_netlink_sendmsg+0x10/0x10 [ 137.832209][ T6945] ____sys_sendmsg+0xa68/0xad0 [ 137.832235][ T6945] ? __pfx_____sys_sendmsg+0x10/0x10 [ 137.832260][ T6945] ? import_iovec+0x73/0xa0 [ 137.832280][ T6945] ___sys_sendmsg+0x2a5/0x360 [ 137.832302][ T6945] ? __pfx____sys_sendmsg+0x10/0x10 [ 137.832355][ T6945] ? __fget_files+0x2a/0x420 [ 137.832376][ T6945] ? __fget_files+0x3a0/0x420 [ 137.832406][ T6945] __x64_sys_sendmsg+0x1bd/0x2a0 [ 137.832432][ T6945] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 137.832463][ T6945] ? __pfx_ksys_write+0x10/0x10 [ 137.832502][ T6945] do_syscall_64+0x14d/0xf80 [ 137.832525][ T6945] ? trace_irq_disable+0x3b/0x150 [ 137.832548][ T6945] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.832565][ T6945] ? clear_bhb_loop+0x40/0x90 [ 137.832585][ T6945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.832602][ T6945] RIP: 0033:0x7fbcb9b9c629 [ 137.832619][ T6945] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 137.832631][ T6945] RSP: 002b:00007fbcbab07028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 137.832649][ T6945] RAX: ffffffffffffffda RBX: 00007fbcb9e15fa0 RCX: 00007fbcb9b9c629 [ 137.832661][ T6945] RDX: 0000000000000098 RSI: 0000200000000040 RDI: 0000000000000005 [ 137.832671][ T6945] RBP: 00007fbcbab07090 R08: 0000000000000000 R09: 0000000000000000 [ 137.832681][ T6945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 137.832691][ T6945] R13: 00007fbcb9e16038 R14: 00007fbcb9e15fa0 R15: 00007fbcb9f3fa48 [ 137.832718][ T6945] [ 138.089458][ T980] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 138.114625][ T6931] netlink: 'syz.0.311': attribute type 1 has an invalid length. [ 138.207030][ T6949] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 138.248811][ T980] usb 2-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 138.259193][ T980] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.271680][ T980] usb 2-1: Product: syz [ 138.276471][ T980] usb 2-1: Manufacturer: syz [ 138.281603][ T980] usb 2-1: SerialNumber: syz [ 138.286236][ T6931] veth3: entered promiscuous mode [ 138.289372][ T6931] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 138.307980][ T6931] netlink: 28 bytes leftover after parsing attributes in process `syz.0.311'. [ 138.329411][ T6931] 8021q: adding VLAN 0 to HW filter on device bond1 [ 138.337755][ T37] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 138.351198][ T980] usb 2-1: config 0 descriptor?? [ 138.387873][ T980] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 138.411673][ T6949] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.437515][ T6956] loop2: detected capacity change from 0 to 7 [ 138.466306][ T6949] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.478992][ T6956] Dev loop2: unable to read RDB block 7 [ 138.497824][ T6956] loop2: unable to read partition table [ 138.506710][ T6956] loop2: partition table beyond EOD, truncated [ 138.514166][ T6956] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– Ôÿ¨â·û¿ªæ) failed (rc=-5) [ 138.536049][ T276] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 138.698886][ T9] usb 1-1: USB disconnect, device number 12 [ 138.791284][ T6402] udevd[6402]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 138.919283][ T6972] loop8: detected capacity change from 0 to 8 [ 139.010378][ T6975] input: syz1 as /devices/virtual/input/input11 [ 139.029712][ T6972] Dev loop8: unable to read RDB block 8 [ 139.059511][ T6973] netlink: 80 bytes leftover after parsing attributes in process `syz.4.320'. [ 139.107283][ T6972] loop8: unable to read partition table [ 139.137490][ T6973] IPVS: sh: FWM 3 0x00000003 - no destination available [ 139.144726][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 139.174379][ T6972] loop8: partition table beyond EOD, truncated [ 139.199993][ T6972] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 139.490322][ T6989] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 139.509916][ T6989] overlayfs: missing 'lowerdir' [ 139.530415][ T6929] netlink: 20 bytes leftover after parsing attributes in process `syz.1.312'. [ 139.541417][ T6929] netlink: 20 bytes leftover after parsing attributes in process `syz.1.312'. [ 139.558102][ T6929] netlink: 28 bytes leftover after parsing attributes in process `syz.1.312'. [ 139.620494][ T980] gspca_sunplus: reg_r err -71 [ 139.674871][ T980] sunplus 2-1:0.0: probe with driver sunplus failed with error -71 [ 139.684770][ T5884] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 139.737836][ T980] usb 2-1: USB disconnect, device number 12 [ 140.070200][ T5884] usb 3-1: config 0 has an invalid interface number: 195 but max is 0 [ 140.091620][ T5884] usb 3-1: config 0 has no interface number 0 [ 140.113045][ T5884] usb 3-1: config 0 interface 195 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 140.189250][ T5884] usb 3-1: New USB device found, idVendor=0789, idProduct=0160, bcdDevice=fd.08 [ 140.210775][ T5884] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 140.258424][ T5884] usb 3-1: Product: syz [ 140.282850][ T5884] usb 3-1: Manufacturer: syz [ 140.350675][ T5884] usb 3-1: SerialNumber: syz [ 140.400432][ T5884] usb 3-1: config 0 descriptor?? [ 140.428059][ T6986] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 140.604938][ T5899] usb 2-1: new low-speed USB device number 13 using dummy_hcd [ 140.651213][ T5884] asix 3-1:0.195: probe with driver asix failed with error -71 [ 140.681016][ T5884] usb 3-1: USB disconnect, device number 9 [ 140.775406][ T5899] usb 2-1: Invalid ep0 maxpacket: 64 [ 140.954881][ T5899] usb 2-1: new low-speed USB device number 14 using dummy_hcd [ 141.023366][ T7005] veth0_to_team: entered promiscuous mode [ 141.161006][ T5899] usb 2-1: Invalid ep0 maxpacket: 64 [ 141.173930][ T5899] usb usb2-port1: attempt power cycle [ 141.406824][ T7022] tipc: Failed to remove unknown binding: 66,1,1/8432298:311129272/311129274 [ 141.524801][ T5899] usb 2-1: new low-speed USB device number 15 using dummy_hcd [ 141.556360][ T5899] usb 2-1: Invalid ep0 maxpacket: 64 [ 141.654788][ T5884] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 141.705578][ T5899] usb 2-1: new low-speed USB device number 16 using dummy_hcd [ 141.756463][ T5899] usb 2-1: Invalid ep0 maxpacket: 64 [ 141.762508][ T5899] usb usb2-port1: unable to enumerate USB device [ 141.784943][ T5884] usb 4-1: device descriptor read/64, error -71 [ 142.022679][ T7034] netlink: 64 bytes leftover after parsing attributes in process `syz.4.333'. [ 142.024998][ T5884] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 142.194860][ T7038] loop8: detected capacity change from 0 to 8 [ 142.226155][ T7038] Dev loop8: unable to read RDB block 8 [ 142.232129][ T7038] loop8: unable to read partition table [ 142.247399][ T7038] loop8: partition table beyond EOD, truncated [ 142.264147][ T7038] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 142.294915][ T5884] usb 4-1: device descriptor read/64, error -71 [ 142.424406][ T5884] usb usb4-port1: attempt power cycle [ 142.804819][ T5884] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 142.826137][ T5884] usb 4-1: device descriptor read/8, error -71 [ 143.014813][ T5899] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 143.115827][ T5884] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 143.202735][ T5884] usb 4-1: device descriptor read/8, error -71 [ 143.226951][ T7052] netlink: 80 bytes leftover after parsing attributes in process `syz.0.338'. [ 143.241196][ T7052] IPVS: sh: FWM 3 0x00000003 - no destination available [ 143.261000][ T9] IPVS: starting estimator thread 0... [ 143.284789][ T5819] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 143.345496][ T5884] usb usb4-port1: unable to enumerate USB device [ 143.356648][ T7056] IPVS: using max 35 ests per chain, 84000 per kthread [ 143.494749][ T5819] usb 5-1: Using ep0 maxpacket: 8 [ 143.533619][ T5819] usb 5-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 143.568701][ T5819] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.603084][ T7058] loop2: detected capacity change from 0 to 7 [ 143.618972][ T5819] usb 5-1: Product: syz [ 143.640867][ T7058] Dev loop2: unable to read RDB block 7 [ 143.648036][ T7058] loop2: unable to read partition table [ 143.664298][ T5819] usb 5-1: Manufacturer: syz [ 143.680151][ T7058] loop2: partition table beyond EOD, truncated [ 143.689118][ T5819] usb 5-1: SerialNumber: syz [ 143.694875][ T7058] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ïÿ¨â·û¿ªæ) failed (rc=-5) [ 143.736362][ T5819] usb 5-1: config 0 descriptor?? [ 143.780775][ T5819] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 143.847116][ T5819] pctv452e: pctv452e_power_ctrl: 1 [ 143.847116][ T5819] [ 143.948557][ T5819] usb 5-1: selecting invalid altsetting 3 [ 143.971857][ T5819] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 143.971857][ T5819] [ 144.028954][ T5819] dvb-usb: bulk message failed: -22 (5/0) [ 144.067824][ T5819] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 144.095075][ T9] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 144.120682][ T12] IPVS: stop unused estimator thread 0... [ 144.143068][ T5819] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 144.163654][ T5819] usb 5-1: media controller created [ 144.173025][ T5819] dvb-usb: bulk message failed: -22 (8/0) [ 144.183000][ T5819] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 144.200963][ T5819] dvb-usb: MAC address reading failed. [ 144.240368][ T5819] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 144.255240][ T5899] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 144.361249][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 144.371326][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 144.421473][ T9] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 144.437836][ T5899] usb 2-1: config 0 has an invalid interface number: 50 but max is 0 [ 144.445457][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 144.456329][ T5899] usb 2-1: config 0 has no interface number 0 [ 144.474272][ T5899] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 144.505734][ T9] usb 3-1: config 0 descriptor?? [ 144.518177][ T7066] netlink: zone id is out of range [ 144.518640][ T5899] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 144.532330][ T7066] netlink: del zone limit has 8 unknown bytes [ 144.555926][ T5899] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.564980][ T5819] DVB: Unable to find symbol stb0899_attach() [ 144.577907][ T5899] usb 2-1: Product: syz [ 144.578535][ T5819] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 144.596152][ T5899] usb 2-1: Manufacturer: syz [ 144.606518][ T5899] usb 2-1: SerialNumber: syz [ 144.625781][ T5899] usb 2-1: config 0 descriptor?? [ 144.670704][ T5899] yurex 2-1:0.50: USB YUREX device now attached to Yurex #0 [ 144.760157][ T5819] rc_core: IR keymap rc-tt-1500 not found [ 144.777664][ T5819] Registered IR keymap rc-empty [ 144.786447][ T5819] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 144.822342][ T5819] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input12 [ 144.860810][ T5819] dvb-usb: schedule remote query interval to 100 msecs. [ 144.879568][ T5819] pctv452e: pctv452e_power_ctrl: 0 [ 144.879568][ T5819] [ 144.893056][ T5819] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 144.989736][ T5819] dvb-usb: bulk message failed: -22 (4/0) [ 144.997393][ T5819] dvb-usb: error -22 while querying for an remote control event. [ 145.037835][ T7073] bond2: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 145.084406][ T7082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 145.093532][ T7082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 145.114775][ T5819] dvb-usb: bulk message failed: -22 (4/0) [ 145.124197][ T5819] dvb-usb: error -22 while querying for an remote control event. [ 145.285413][ T7073] bond2 (unregistering): Released all slaves [ 145.382730][ T5884] dvb-usb: bulk message failed: -22 (4/0) [ 145.398243][ T5884] dvb-usb: error -22 while querying for an remote control event. [ 145.472334][ T980] usb 5-1: USB disconnect, device number 11 [ 145.816129][ T980] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 146.378497][ T7098] netlink: 84 bytes leftover after parsing attributes in process `syz.4.351'. [ 146.410483][ T7100] netlink: 84 bytes leftover after parsing attributes in process `syz.0.352'. [ 146.446928][ T7100] netlink: 84 bytes leftover after parsing attributes in process `syz.0.352'. [ 146.469705][ T7100] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 146.922881][ C1] usb 2-1: yurex_control_callback - control failed: -2 [ 146.957534][ T5892] usb 2-1: USB disconnect, device number 17 [ 146.977069][ T5892] yurex 2-1:0.50: USB YUREX #0 now disconnected [ 147.004789][ T980] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 147.094884][ T9] usbhid 3-1:0.0: can't add hid device: -71 [ 147.100925][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 147.196094][ T7117] netlink: 80 bytes leftover after parsing attributes in process `syz.4.354'. [ 147.237997][ T9] usb 3-1: USB disconnect, device number 10 [ 147.322105][ T7123] input: syz1 as /devices/virtual/input/input13 [ 147.388769][ T7125] bond_slave_0: entered promiscuous mode [ 147.394586][ T7125] bond_slave_1: entered promiscuous mode [ 147.440260][ T7108] IPVS: sh: FWM 3 0x00000003 - no destination available [ 147.461974][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 147.541250][ T7125] vlan2: entered promiscuous mode [ 147.565008][ T7125] bond0: entered promiscuous mode [ 147.702687][ T7130] loop8: detected capacity change from 0 to 8 [ 147.723721][ T7130] Dev loop8: unable to read RDB block 8 [ 147.732167][ T7130] loop8: unable to read partition table [ 147.742891][ T7130] loop8: partition table beyond EOD, truncated [ 147.754781][ T7130] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 147.839046][ T7135] netlink: 76 bytes leftover after parsing attributes in process `syz.0.362'. [ 147.952206][ T7135] netlink: 52 bytes leftover after parsing attributes in process `syz.0.362'. [ 148.016824][ T7135] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.024205][ T7135] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.159827][ T7142] binder: 7140:7142 ioctl c0306201 200000000640 returned -22 [ 148.474948][ T59] batman_adv: batadv0: IGMP Querier appeared [ 148.481025][ T59] batman_adv: batadv0: MLD Querier appeared [ 148.774950][ T5884] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 148.915031][ T5884] usb 2-1: device descriptor read/64, error -71 [ 149.254921][ T5884] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 149.687492][ T5884] usb 2-1: device descriptor read/64, error -71 [ 149.808712][ T5884] usb usb2-port1: attempt power cycle [ 150.098064][ T7168] input: syz1 as /devices/virtual/input/input14 [ 150.334991][ T5884] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 150.375857][ T5884] usb 2-1: device descriptor read/8, error -71 [ 150.705186][ T5884] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 150.730585][ T5884] usb 2-1: device descriptor read/8, error -71 [ 150.867282][ T5884] usb usb2-port1: unable to enumerate USB device [ 150.889400][ T7171] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 151.082563][ T7172] overlayfs: missing 'lowerdir' [ 151.124139][ T7177] loop8: detected capacity change from 0 to 8 [ 151.131538][ T7177] Dev loop8: unable to read RDB block 8 [ 151.137220][ T7177] loop8: unable to read partition table [ 151.143951][ T7177] loop8: partition table beyond EOD, truncated [ 151.150789][ T7177] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 151.319477][ T7179] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 151.365882][ T7185] netlink: 'syz.0.377': attribute type 126 has an invalid length. [ 151.510523][ T7190] xt_CT: You must specify a L4 protocol and not use inversions on it [ 151.677801][ T7195] netlink: 24 bytes leftover after parsing attributes in process `syz.0.381'. [ 151.684898][ T5819] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 151.771732][ T7200] netlink: 80 bytes leftover after parsing attributes in process `syz.2.379'. [ 151.854466][ T7206] IPVS: sh: FWM 3 0x00000003 - no destination available [ 151.888811][ T5819] usb 5-1: config 0 has an invalid interface number: 33 but max is 0 [ 151.898894][ T5819] usb 5-1: config 0 has no interface number 0 [ 151.912889][ T5819] usb 5-1: New USB device found, idVendor=24cf, idProduct=59e4, bcdDevice= 9.43 [ 151.936118][ T5819] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.080013][ T5819] usb 5-1: config 0 descriptor?? [ 152.108163][ T5819] usb-storage 5-1:0.33: USB Mass Storage device detected [ 152.295514][ T7215] FAULT_INJECTION: forcing a failure. [ 152.295514][ T7215] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 152.421557][ T7215] CPU: 0 UID: 0 PID: 7215 Comm: syz.0.384 Tainted: G L syzkaller #0 PREEMPT(full) [ 152.421585][ T7215] Tainted: [L]=SOFTLOCKUP [ 152.421592][ T7215] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 152.421601][ T7215] Call Trace: [ 152.421608][ T7215] [ 152.421616][ T7215] dump_stack_lvl+0xe8/0x150 [ 152.421644][ T7215] should_fail_ex+0x412/0x560 [ 152.421669][ T7215] _copy_to_user+0x31/0xb0 [ 152.421694][ T7215] simple_read_from_buffer+0xe1/0x170 [ 152.421722][ T7215] proc_fail_nth_read+0x1bb/0x230 [ 152.421751][ T7215] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 152.421776][ T7215] ? rw_verify_area+0x2a6/0x4d0 [ 152.421792][ T7215] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 152.421815][ T7215] vfs_read+0x20c/0xa70 [ 152.421831][ T7215] ? fdget_pos+0x246/0x320 [ 152.421853][ T7215] ? __pfx___mutex_lock+0x10/0x10 [ 152.421872][ T7215] ? __pfx_vfs_read+0x10/0x10 [ 152.421886][ T7215] ? __fget_files+0x2a/0x420 [ 152.421911][ T7215] ? __fget_files+0x3a0/0x420 [ 152.421932][ T7215] ? __fget_files+0x2a/0x420 [ 152.421962][ T7215] ksys_read+0x150/0x270 [ 152.421982][ T7215] ? __pfx_ksys_read+0x10/0x10 [ 152.422009][ T7215] do_syscall_64+0x14d/0xf80 [ 152.422032][ T7215] ? trace_irq_disable+0x3b/0x150 [ 152.422054][ T7215] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.422071][ T7215] ? clear_bhb_loop+0x40/0x90 [ 152.422099][ T7215] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.422116][ T7215] RIP: 0033:0x7fb37b95cece [ 152.422132][ T7215] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 152.422146][ T7215] RSP: 002b:00007fb37c835fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 152.422165][ T7215] RAX: ffffffffffffffda RBX: 00007fb37c8366c0 RCX: 00007fb37b95cece [ 152.422177][ T7215] RDX: 000000000000000f RSI: 00007fb37c8360a0 RDI: 0000000000000004 [ 152.422187][ T7215] RBP: 00007fb37c836090 R08: 0000000000000000 R09: 0000000000000000 [ 152.422197][ T7215] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 152.422206][ T7215] R13: 00007fb37bc16038 R14: 00007fb37bc15fa0 R15: 00007fb37bd3fa48 [ 152.422235][ T7215] [ 152.675018][ T7213] loop2: detected capacity change from 0 to 7 [ 152.760418][ T7213] Dev loop2: unable to read RDB block 7 [ 152.844795][ T7213] loop2: unable to read partition table [ 152.869435][ T7213] loop2: partition table beyond EOD, truncated [ 152.917140][ T7213] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 153.139447][ T7230] netlink: 'syz.2.391': attribute type 126 has an invalid length. [ 153.254983][ T980] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 153.282610][ T7238] bond_slave_0: entered promiscuous mode [ 153.288377][ T7238] bond_slave_1: entered promiscuous mode [ 153.302323][ T7238] vlan3: entered promiscuous mode [ 153.315562][ T7238] bond0: entered promiscuous mode [ 153.404790][ T980] usb 1-1: Using ep0 maxpacket: 16 [ 153.436597][ T980] usb 1-1: config 4 has an invalid interface number: 184 but max is 0 [ 153.451888][ T980] usb 1-1: config 4 has no interface number 0 [ 153.466449][ T980] usb 1-1: config 4 interface 184 has no altsetting 0 [ 153.486018][ T980] usb 1-1: New USB device found, idVendor=27c6, idProduct=5395, bcdDevice=56.91 [ 153.508591][ T980] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.533767][ T980] usb 1-1: Product: syz [ 153.543289][ T980] usb 1-1: Manufacturer: syz [ 153.555801][ T980] usb 1-1: SerialNumber: syz [ 153.828364][ T7221] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 153.847962][ T7221] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.868689][ T7221] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 153.949821][ T7254] netlink: 4 bytes leftover after parsing attributes in process `syz.3.398'. [ 154.050059][ T7258] netlink: 80 bytes leftover after parsing attributes in process `syz.1.397'. [ 154.109352][ T7258] IPVS: sh: FWM 3 0x00000003 - no destination available [ 154.116703][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 154.280350][ T5892] usb 5-1: USB disconnect, device number 12 [ 154.303546][ T980] usb 1-1: USB disconnect, device number 15 [ 155.442007][ T7276] vlan2: entered promiscuous mode [ 155.497496][ T7278] netlink: 'syz.2.403': attribute type 126 has an invalid length. [ 155.825759][ T7280] syzkaller0: entered promiscuous mode [ 155.831350][ T7280] syzkaller0: entered allmulticast mode [ 155.879751][ T7280] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 155.933077][ T7280] netlink: 20 bytes leftover after parsing attributes in process `syz.0.405'. [ 156.277191][ T7301] netlink: 52 bytes leftover after parsing attributes in process `syz.2.412'. [ 156.292063][ T7301] bridge0: port 2(bridge_slave_1) entered disabled state [ 156.299638][ T7301] bridge0: port 1(bridge_slave_0) entered disabled state [ 156.431111][ T7307] geneve2: entered promiscuous mode [ 156.435236][ T7308] netlink: 'syz.0.416': attribute type 126 has an invalid length. [ 156.763090][ T7317] netlink: 28 bytes leftover after parsing attributes in process `syz.2.420'. [ 156.802141][ T7317] netlink: 28 bytes leftover after parsing attributes in process `syz.2.420'. [ 156.949560][ T7317] ip6gretap0: entered promiscuous mode [ 156.969029][ T7317] debugfs: 'hsr1' already exists in 'hsr' [ 156.995503][ T7317] Cannot create hsr debugfs directory [ 157.016297][ T7317] hsr1: Slave A (bridge0) is not up; please bring it up to get a fully working HSR network [ 157.272821][ T7324] netlink: 84 bytes leftover after parsing attributes in process `syz.4.422'. [ 157.364868][ T7324] netlink: 84 bytes leftover after parsing attributes in process `syz.4.422'. [ 157.401253][ T7324] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 157.524782][ T5819] usb 2-1: new low-speed USB device number 22 using dummy_hcd [ 157.655928][ T7336] netlink: 190972 bytes leftover after parsing attributes in process `syz.3.424'. [ 157.684760][ T5819] usb 2-1: device descriptor read/64, error -71 [ 157.718868][ T7338] netlink: 4 bytes leftover after parsing attributes in process `syz.4.425'. [ 158.064024][ T5819] usb 2-1: new low-speed USB device number 23 using dummy_hcd [ 158.082017][ T7342] geneve2: entered promiscuous mode [ 158.375566][ T9] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 158.384511][ T5819] usb 2-1: device descriptor read/64, error -71 [ 158.414450][ T7346] FAULT_INJECTION: forcing a failure. [ 158.414450][ T7346] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 158.505413][ T5819] usb usb2-port1: attempt power cycle [ 158.534880][ T9] usb 1-1: device descriptor read/64, error -71 [ 158.544847][ T7346] CPU: 1 UID: 0 PID: 7346 Comm: syz.2.430 Tainted: G L syzkaller #0 PREEMPT(full) [ 158.544876][ T7346] Tainted: [L]=SOFTLOCKUP [ 158.544882][ T7346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 158.544891][ T7346] Call Trace: [ 158.544898][ T7346] [ 158.544905][ T7346] dump_stack_lvl+0xe8/0x150 [ 158.544932][ T7346] should_fail_ex+0x412/0x560 [ 158.544954][ T7346] _copy_to_user+0x31/0xb0 [ 158.544978][ T7346] simple_read_from_buffer+0xe1/0x170 [ 158.545005][ T7346] proc_fail_nth_read+0x1bb/0x230 [ 158.545030][ T7346] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 158.545061][ T7346] ? rw_verify_area+0x2a6/0x4d0 [ 158.545076][ T7346] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 158.545099][ T7346] vfs_read+0x20c/0xa70 [ 158.545114][ T7346] ? fdget_pos+0x246/0x320 [ 158.545140][ T7346] ? __pfx___mutex_lock+0x10/0x10 [ 158.545165][ T7346] ? __pfx_vfs_read+0x10/0x10 [ 158.545183][ T7346] ? __fget_files+0x2a/0x420 [ 158.545208][ T7346] ? __fget_files+0x3a0/0x420 [ 158.545226][ T7346] ? __fget_files+0x2a/0x420 [ 158.545255][ T7346] ksys_read+0x150/0x270 [ 158.545282][ T7346] ? __pfx_ksys_read+0x10/0x10 [ 158.545298][ T7346] ? __pfx_v4l2_ioctl+0x10/0x10 [ 158.545325][ T7346] do_syscall_64+0x14d/0xf80 [ 158.545347][ T7346] ? trace_irq_disable+0x3b/0x150 [ 158.545371][ T7346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.545388][ T7346] ? clear_bhb_loop+0x40/0x90 [ 158.545409][ T7346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.545440][ T7346] RIP: 0033:0x7fbcb9b5cece [ 158.545456][ T7346] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 158.545470][ T7346] RSP: 002b:00007fbcbab06fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 158.545488][ T7346] RAX: ffffffffffffffda RBX: 00007fbcbab076c0 RCX: 00007fbcb9b5cece [ 158.545499][ T7346] RDX: 000000000000000f RSI: 00007fbcbab070a0 RDI: 0000000000000004 [ 158.545509][ T7346] RBP: 00007fbcbab07090 R08: 0000000000000000 R09: 0000000000000000 [ 158.545518][ T7346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 158.545527][ T7346] R13: 00007fbcb9e16038 R14: 00007fbcb9e15fa0 R15: 00007fbcb9f3fa48 [ 158.545554][ T7346] [ 159.027689][ T9] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 159.094806][ T5819] usb 2-1: new low-speed USB device number 24 using dummy_hcd [ 159.180201][ T5819] usb 2-1: device descriptor read/8, error -71 [ 159.202302][ T9] usb 1-1: device descriptor read/64, error -71 [ 159.220731][ T7362] Cannot find set identified by id 65534 to match [ 159.244738][ T7363] netlink: 28 bytes leftover after parsing attributes in process `syz.2.433'. [ 159.254569][ T7363] netlink: 28 bytes leftover after parsing attributes in process `syz.2.433'. [ 159.315065][ T9] usb usb1-port1: attempt power cycle [ 159.425831][ T5819] usb 2-1: new low-speed USB device number 25 using dummy_hcd [ 159.468947][ T5819] usb 2-1: device descriptor read/8, error -71 [ 159.587597][ T5819] usb usb2-port1: unable to enumerate USB device [ 159.694776][ T9] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 159.944955][ T9] usb 1-1: device not accepting address 18, error -71 [ 160.559760][ T7380] netlink: 84 bytes leftover after parsing attributes in process `syz.4.440'. [ 160.594765][ T10] usb 2-1: new full-speed USB device number 26 using dummy_hcd [ 160.766752][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 160.793112][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 160.824091][ T10] usb 2-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 160.850138][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.064363][ T10] usb 2-1: config 0 descriptor?? [ 161.090370][ T7373] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 161.319399][ T7373] bond0: (slave bond_slave_1): Releasing backup interface [ 161.327542][ T7373] bond_slave_1: left promiscuous mode [ 161.495733][ T7388] Cannot find set identified by id 65534 to match [ 161.696147][ T10] creative-sb0540 0003:041E:3100.0006: item fetching failed at offset 1/5 [ 161.800758][ T10] creative-sb0540 0003:041E:3100.0006: parse failed [ 161.814759][ T10] creative-sb0540 0003:041E:3100.0006: probe with driver creative-sb0540 failed with error -22 [ 162.030938][ T10] usb 2-1: USB disconnect, device number 26 [ 162.257467][ T7393] xt_CT: You must specify a L4 protocol and not use inversions on it [ 162.426273][ T7397] tipc: Failed to remove unknown binding: 66,1,1/0:3777509628/3777509630 [ 162.497282][ T7400] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 162.508546][ T7400] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 162.605349][ T5877] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 162.735011][ T10] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 162.767241][ T5877] usb 1-1: config 0 has an invalid interface number: 33 but max is 0 [ 162.805108][ T5877] usb 1-1: config 0 has no interface number 0 [ 162.818793][ T5877] usb 1-1: New USB device found, idVendor=24cf, idProduct=59e4, bcdDevice= 9.43 [ 162.839679][ T5877] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.879081][ T5877] usb 1-1: config 0 descriptor?? [ 162.892817][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 162.923215][ T5877] usb-storage 1-1:0.33: USB Mass Storage device detected [ 162.923416][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 163.068781][ T10] usb 4-1: New USB device found, idVendor=05ac, idProduct=0272, bcdDevice= 0.00 [ 163.094719][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 163.126253][ T10] usb 4-1: config 0 descriptor?? [ 163.213116][ T7415] netlink: 84 bytes leftover after parsing attributes in process `syz.1.451'. [ 163.227171][ T5819] usb 1-1: USB disconnect, device number 20 [ 163.261113][ T10] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input15 [ 163.454403][ T5176] bcm5974 4-1:0.0: could not read from device [ 163.472837][ T5176] bcm5974 4-1:0.0: could not read from device [ 163.488476][ T10] usb 4-1: USB disconnect, device number 10 [ 163.792810][ T7418] netlink: 80 bytes leftover after parsing attributes in process `syz.1.452'. [ 163.846106][ T10] IPVS: starting estimator thread 0... [ 163.853314][ T7418] IPVS: sh: FWM 3 0x00000003 - no destination available [ 163.860954][ T7424] netlink: 52 bytes leftover after parsing attributes in process `syz.0.453'. [ 163.902811][ T7425] netlink: 76 bytes leftover after parsing attributes in process `syz.0.453'. [ 163.945385][ T7425] netlink: 52 bytes leftover after parsing attributes in process `syz.0.453'. [ 163.954587][ T7422] IPVS: using max 35 ests per chain, 84000 per kthread [ 164.303752][ T7428] vlan2: entered promiscuous mode [ 164.548213][ T5877] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 164.714749][ T5877] usb 1-1: Using ep0 maxpacket: 8 [ 164.726999][ T5877] usb 1-1: too many configurations: 242, using maximum allowed: 8 [ 164.738831][ T5877] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 164.757218][ T5877] usb 1-1: can't read configurations, error -61 [ 164.869656][ T276] IPVS: stop unused estimator thread 0... [ 164.904763][ T5877] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 165.075101][ T5877] usb 1-1: Using ep0 maxpacket: 8 [ 165.091093][ T7447] netlink: 84 bytes leftover after parsing attributes in process `syz.2.462'. [ 165.107221][ T5877] usb 1-1: too many configurations: 242, using maximum allowed: 8 [ 165.126716][ T5877] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 165.135132][ T5877] usb 1-1: can't read configurations, error -61 [ 165.147802][ T5877] usb usb1-port1: attempt power cycle [ 165.164956][ T5892] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 165.324877][ T5892] usb 5-1: Using ep0 maxpacket: 16 [ 165.337471][ T5892] usb 5-1: config 254 has an invalid interface number: 235 but max is 0 [ 165.347661][ T5892] usb 5-1: config 254 has no interface number 0 [ 165.354148][ T5892] usb 5-1: config 254 interface 235 altsetting 2 bulk endpoint 0x6 has invalid maxpacket 32 [ 165.369180][ T5892] usb 5-1: config 254 interface 235 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 165.382180][ T5892] usb 5-1: config 254 interface 235 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 165.393494][ T5892] usb 5-1: config 254 interface 235 has no altsetting 0 [ 165.404046][ T7457] netlink: 52 bytes leftover after parsing attributes in process `syz.3.466'. [ 165.416849][ T5892] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=2b.f1 [ 165.426965][ T5892] usb 5-1: New USB device strings: Mfr=1, Product=251, SerialNumber=3 [ 165.435735][ T5892] usb 5-1: Product: syz [ 165.440073][ T5892] usb 5-1: Manufacturer: syz [ 165.445884][ T7457] bridge0: port 2(bridge_slave_1) entered disabled state [ 165.453220][ T7457] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.462119][ T5892] usb 5-1: SerialNumber: syz [ 165.470193][ T7442] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 165.493529][ T7459] tipc: Failed to remove unknown binding: 66,1,1/0:3024439681/3024439683 [ 165.516785][ T5899] usb 2-1: new full-speed USB device number 27 using dummy_hcd [ 165.517093][ T7460] netlink: 76 bytes leftover after parsing attributes in process `syz.3.466'. [ 165.528275][ T5877] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 165.545068][ T7460] netlink: 52 bytes leftover after parsing attributes in process `syz.3.466'. [ 165.565355][ T5877] usb 1-1: Using ep0 maxpacket: 8 [ 165.571425][ T5877] usb 1-1: too many configurations: 242, using maximum allowed: 8 [ 165.581287][ T5877] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 165.589376][ T5877] usb 1-1: can't read configurations, error -61 [ 165.689926][ T5899] usb 2-1: config 0 has an invalid interface number: 195 but max is 0 [ 165.698394][ T5899] usb 2-1: config 0 has no interface number 0 [ 165.705846][ T5899] usb 2-1: config 0 interface 195 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 165.775947][ T5877] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 165.789477][ T7463] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 165.800834][ T7463] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 165.811494][ T5877] usb 1-1: Using ep0 maxpacket: 8 [ 165.829810][ T5899] usb 2-1: New USB device found, idVendor=0789, idProduct=0160, bcdDevice=fd.08 [ 165.859949][ T5877] usb 1-1: too many configurations: 242, using maximum allowed: 8 [ 165.893435][ T5899] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.905170][ T5877] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 165.919375][ T5877] usb 1-1: can't read configurations, error -61 [ 165.929519][ T5899] usb 2-1: Product: syz [ 165.936249][ T5892] usbtest 5-1:254.235: couldn't get endpoints, -71 [ 165.945476][ T5877] usb usb1-port1: unable to enumerate USB device [ 165.953531][ T5892] usbtest 5-1:254.235: probe with driver usbtest failed with error -71 [ 165.962534][ T5899] usb 2-1: Manufacturer: syz [ 165.973233][ T5899] usb 2-1: SerialNumber: syz [ 165.994399][ T5892] usb 5-1: USB disconnect, device number 13 [ 166.016636][ T5899] usb 2-1: config 0 descriptor?? [ 166.036366][ T7453] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 166.253794][ T7449] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 166.282200][ T7449] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 166.291005][ T7449] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 166.298772][ T7449] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 166.355782][ T7473] kAFS: unable to lookup cell 'ÿ' [ 166.369432][ T7473] kAFS: unable to lookup cell '(,c¾Ì' [ 166.479897][ T5899] asix 2-1:0.195: probe with driver asix failed with error -71 [ 166.514571][ T5899] usb 2-1: USB disconnect, device number 27 [ 167.466180][ T7490] netlink: 28 bytes leftover after parsing attributes in process `syz.0.475'. [ 167.724429][ T7502] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 167.774176][ T7509] xt_CT: You must specify a L4 protocol and not use inversions on it [ 167.859534][ T7512] loop8: detected capacity change from 0 to 8 [ 167.876672][ T7512] Dev loop8: unable to read RDB block 8 [ 167.882374][ T7512] loop8: unable to read partition table [ 167.892141][ T7512] loop8: partition table beyond EOD, truncated [ 167.902276][ T7512] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 167.984893][ T5884] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 168.144925][ T5884] usb 1-1: Using ep0 maxpacket: 32 [ 168.155971][ T5884] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 168.173768][ T5884] usb 1-1: can't read configurations, error -61 [ 168.304740][ T5819] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 168.355516][ T5884] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 168.449982][ T5819] usb 5-1: device descriptor read/64, error -71 [ 168.575081][ T5884] usb 1-1: Using ep0 maxpacket: 32 [ 168.585405][ T5884] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 168.598066][ T5884] usb 1-1: can't read configurations, error -61 [ 168.619734][ T5884] usb usb1-port1: attempt power cycle [ 168.705241][ T5819] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 168.883798][ T7531] __nla_validate_parse: 4 callbacks suppressed [ 168.883821][ T7531] netlink: 64 bytes leftover after parsing attributes in process `syz.2.489'. [ 168.900252][ T5819] usb 5-1: device descriptor read/64, error -71 [ 168.907801][ T9] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 168.974817][ T5884] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 169.003278][ T5884] usb 1-1: Using ep0 maxpacket: 32 [ 169.016628][ T5819] usb usb5-port1: attempt power cycle [ 169.115264][ T9] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 169.125165][ T5884] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 169.132846][ T5884] usb 1-1: can't read configurations, error -61 [ 169.144810][ T9] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 169.162758][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 169.174383][ T9] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 169.208990][ T9] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 169.225410][ T9] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 169.233669][ T9] usb 2-1: Product: syz [ 169.249539][ T9] usb 2-1: Manufacturer: syz [ 169.274979][ T9] cdc_wdm 2-1:1.0: skipping garbage [ 169.284801][ T9] cdc_wdm 2-1:1.0: skipping garbage [ 169.284871][ T9] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 169.295741][ T5884] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 169.315999][ T5884] usb 1-1: Using ep0 maxpacket: 32 [ 169.317834][ T5884] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 169.317869][ T5884] usb 1-1: can't read configurations, error -61 [ 169.318074][ T5884] usb usb1-port1: unable to enumerate USB device [ 169.374792][ T5819] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 169.397009][ T5819] usb 5-1: device descriptor read/8, error -71 [ 169.572412][ T30] audit: type=1326 audit(1771582692.883:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7538 comm="syz.3.493" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0056b9c629 code=0x0 [ 169.675754][ T5819] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 169.709646][ T5819] usb 5-1: device descriptor read/8, error -71 [ 169.825031][ T5819] usb usb5-port1: unable to enumerate USB device [ 169.864931][ T5877] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 169.934865][ T9] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 170.009184][ T5899] usb 2-1: USB disconnect, device number 28 [ 170.019658][ T5877] usb 3-1: Using ep0 maxpacket: 16 [ 170.045522][ T5877] usb 3-1: config 0 has no interfaces? [ 170.051896][ T7546] netlink: 84 bytes leftover after parsing attributes in process `syz.1.494'. [ 170.064461][ T5877] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 170.065850][ T7546] netlink: 84 bytes leftover after parsing attributes in process `syz.1.494'. [ 170.083918][ T5877] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 170.087748][ T7546] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 170.092509][ T5877] usb 3-1: Manufacturer: syz [ 170.112508][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 170.121382][ T9] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 170.126873][ T5877] usb 3-1: config 0 descriptor?? [ 170.132928][ T9] usb 4-1: config 0 has no interface number 0 [ 170.152444][ T9] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 170.162020][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.184719][ T9] usb 4-1: Product: syz [ 170.189017][ T9] usb 4-1: Manufacturer: syz [ 170.198153][ T9] usb 4-1: SerialNumber: syz [ 170.205737][ T9] usb 4-1: config 0 descriptor?? [ 170.213163][ T9] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 170.324860][ T7550] netlink: 1016 bytes leftover after parsing attributes in process `syz.1.495'. [ 170.334153][ T7550] netlink: 12 bytes leftover after parsing attributes in process `syz.1.495'. [ 170.418221][ T9] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 170.434214][ T9] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 171.984751][ T5899] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 172.146584][ T5899] usb 2-1: Using ep0 maxpacket: 32 [ 172.159276][ T5899] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 172.171151][ T5899] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 172.185894][ T5899] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 172.196377][ T5899] usb 2-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 172.205063][ T5899] usb 2-1: Product: syz [ 172.209767][ T5899] usb 2-1: Manufacturer: syz [ 172.222810][ T5899] hub 2-1:4.0: USB hub found [ 172.264860][ T5884] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 172.425616][ T5899] hub 2-1:4.0: 7 ports detected [ 172.431890][ T5899] hub 2-1:4.0: insufficient power available to use all downstream ports [ 172.444710][ T5884] usb 5-1: config 0 has an invalid descriptor of length 214, skipping remainder of the config [ 172.456088][ T5884] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 172.476129][ T5884] usb 5-1: New USB device found, idVendor=0079, idProduct=1846, bcdDevice= 0.00 [ 172.496131][ T5884] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.511745][ T5892] usb 3-1: USB disconnect, device number 11 [ 172.626310][ T5884] usb 5-1: config 0 descriptor?? [ 172.669698][ C0] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 172.670235][ T5877] usb 4-1: USB disconnect, device number 11 [ 172.760589][ T5877] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 172.783991][ T7580] netlink: 'syz.3.504': attribute type 1 has an invalid length. [ 172.811996][ T5877] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 172.852147][ T5877] quatech2 4-1:0.51: device disconnected [ 172.898395][ T7584] netlink: 16 bytes leftover after parsing attributes in process `syz.3.504'. [ 173.109821][ T7580] bond1: (slave ip6gretap1): making interface the new active one [ 173.148649][ T7580] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 173.171884][ T7584] 8021q: adding VLAN 0 to HW filter on device bond1 [ 173.379281][ T7595] x_tables: duplicate underflow at hook 1 [ 173.456252][ T7596] input: syz1 as /devices/virtual/input/input16 [ 173.492474][ T5899] hub 2-1:4.0: hub_hub_status failed (err = -32) [ 173.507449][ T5819] usb 1-1: new full-speed USB device number 29 using dummy_hcd [ 173.513143][ T5899] hub 2-1:4.0: config failed, can't get hub status (err -32) [ 173.700729][ T5819] usb 1-1: config 0 has an invalid interface number: 195 but max is 0 [ 173.711531][ T5819] usb 1-1: config 0 has no interface number 0 [ 173.725004][ T5819] usb 1-1: config 0 interface 195 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 173.745967][ T5819] usb 1-1: New USB device found, idVendor=0789, idProduct=0160, bcdDevice=fd.08 [ 173.755846][ T5819] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 173.764359][ T5819] usb 1-1: Product: syz [ 173.768795][ T5819] usb 1-1: Manufacturer: syz [ 173.773536][ T5819] usb 1-1: SerialNumber: syz [ 173.783602][ T5819] usb 1-1: config 0 descriptor?? [ 173.789758][ T7592] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 174.000450][ T7608] netlink: 32 bytes leftover after parsing attributes in process `syz.2.512'. [ 174.000629][ T7590] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 174.019405][ T7590] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 174.028336][ T7590] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 174.036215][ T7590] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 174.047541][ T7590] bridge0: port 3(batadv0) entered disabled state [ 174.225002][ T5819] asix 1-1:0.195: probe with driver asix failed with error -71 [ 174.255736][ T5819] usb 1-1: USB disconnect, device number 29 [ 174.614904][ T5899] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 174.865609][ T5899] usb 4-1: Using ep0 maxpacket: 32 [ 174.883480][ T5899] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 174.907799][ T5899] usb 4-1: config 0 has no interface number 0 [ 174.940231][ T5899] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 174.961153][ T5899] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.989731][ T5899] usb 4-1: Product: syz [ 175.004157][ T5899] usb 4-1: Manufacturer: syz [ 175.012497][ T5899] usb 4-1: SerialNumber: syz [ 175.030580][ T5899] usb 4-1: config 0 descriptor?? [ 175.098478][ T5884] usb 5-1: string descriptor 0 read error: -71 [ 175.120889][ T5884] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 175.120945][ T24] usb 2-1: reset high-speed USB device number 29 using dummy_hcd [ 175.164317][ T5884] usb 5-1: USB disconnect, device number 18 [ 175.208297][ T24] usb 2-1: device reset changed ep0 maxpacket size! [ 175.235856][ T24] usb 2-1: USB disconnect, device number 29 [ 175.459426][ T5899] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 175.471447][ T5899] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 175.604794][ T24] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 175.684735][ T5884] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 175.760170][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 175.788575][ T24] usb 2-1: config 0 has an invalid interface number: 39 but max is 0 [ 175.836884][ T24] usb 2-1: config 0 has no interface number 0 [ 175.851387][ T5884] usb 5-1: config 0 has an invalid interface number: 69 but max is 0 [ 175.864412][ T5884] usb 5-1: config 0 has no interface number 0 [ 175.872389][ T5884] usb 5-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 175.890103][ T5884] usb 5-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 175.904545][ T24] usb 2-1: New USB device found, idVendor=0547, idProduct=7303, bcdDevice=30.27 [ 175.906269][ T5884] usb 5-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 175.923953][ T5884] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 175.924007][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 175.933225][ T5884] usb 5-1: Product: syz [ 175.950468][ T5884] usb 5-1: Manufacturer: syz [ 175.950497][ T24] usb 2-1: Product: syz [ 175.956702][ T5884] usb 5-1: SerialNumber: syz [ 175.964515][ T24] usb 2-1: Manufacturer: syz [ 175.968276][ T5884] usb 5-1: config 0 descriptor?? [ 175.977572][ T24] usb 2-1: SerialNumber: syz [ 175.978277][ T7633] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 175.999103][ T5884] cyberjack 5-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 176.008738][ T24] usb 2-1: config 0 descriptor?? [ 176.018065][ T24] gspca_main: dtcs033-2.14.0 probing 0547:7303 [ 176.030414][ T5884] usb 5-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 176.117553][ T7615] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 176.130010][ T5877] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 176.145213][ T7615] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.242392][ T7623] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 176.267431][ T7623] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.291381][ T5892] usb 2-1: USB disconnect, device number 30 [ 176.321366][ T5877] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 176.352125][ T5877] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 176.365853][ T5877] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 176.379391][ T5877] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 176.410143][ T7615] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 176.423843][ T5877] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.423936][ T7615] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.456580][ T5877] usb 3-1: config 0 descriptor?? [ 176.464066][ T7630] netlink: 20 bytes leftover after parsing attributes in process `syz.4.520'. [ 176.481265][ T5819] usb 5-1: USB disconnect, device number 19 [ 176.510328][ T5819] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 176.545301][ T5819] cyberjack 5-1:0.69: device disconnected [ 176.887083][ T5877] plantronics 0003:047F:FFFF.0007: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 177.014819][ T5819] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 177.091407][ T7639] netlink: 32 bytes leftover after parsing attributes in process `syz.2.522'. [ 177.138935][ T7653] netlink: 8 bytes leftover after parsing attributes in process `syz.4.525'. [ 177.166473][ T5819] usb 1-1: config 171 has an invalid interface number: 109 but max is 0 [ 177.179751][ T5819] usb 1-1: config 171 has an invalid descriptor of length 0, skipping remainder of the config [ 177.181059][ T5877] usb 3-1: USB disconnect, device number 12 [ 177.202065][ T5819] usb 1-1: config 171 has no interface number 0 [ 177.214285][ T5819] usb 1-1: config 171 interface 109 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1023 [ 177.225059][ T5819] usb 1-1: config 171 interface 109 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 177.237069][ T5819] usb 1-1: config 171 interface 109 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 12 [ 177.282100][ T5819] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=fd.2e [ 177.300309][ T5819] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.320197][ T5819] usb 1-1: Product: syz [ 177.334220][ T5819] usb 1-1: Manufacturer: syz [ 177.343720][ T5819] usb 1-1: SerialNumber: syz [ 177.343782][ T5899] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000038: -61 [ 177.382359][ T5899] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -61 [ 177.383377][ T7649] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 177.715981][ T5819] ath6kl: Failed to submit usb control message: -71 [ 177.731443][ T5819] ath6kl: unable to send the bmi data to the device: -71 [ 177.744310][ T5819] ath6kl: Unable to send get target info: -71 [ 177.754580][ T5819] ath6kl: Failed to init ath6kl core: -71 [ 177.762148][ T5819] ath6kl_usb 1-1:171.109: probe with driver ath6kl_usb failed with error -71 [ 177.784853][ T7668] netlink: 80 bytes leftover after parsing attributes in process `syz.1.529'. [ 177.794836][ T5884] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 177.809773][ T7668] netlink: 52 bytes leftover after parsing attributes in process `syz.1.529'. [ 177.838607][ T5819] usb 1-1: USB disconnect, device number 30 [ 177.943239][ T7670] macvlan2: entered allmulticast mode [ 177.950911][ T7670] veth1_vlan: entered allmulticast mode [ 177.956467][ T7676] netlink: 68 bytes leftover after parsing attributes in process `syz.2.531'. [ 177.977857][ T7668] IPVS: sh: FWM 3 0x00000003 - no destination available [ 177.979328][ T7670] veth1_vlan: left allmulticast mode [ 177.991326][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 178.025280][ T5884] usb 5-1: Using ep0 maxpacket: 16 [ 178.032438][ T5884] usb 5-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 178.049256][ T5884] usb 5-1: config 0 interface 0 has no altsetting 0 [ 178.056277][ T5884] usb 5-1: New USB device found, idVendor=172f, idProduct=0034, bcdDevice= 0.00 [ 178.058619][ T7674] team0 (unregistering): Failed to send options change via netlink (err -105) [ 178.075578][ T7674] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 178.077061][ T5884] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.139105][ T7674] team0 (unregistering): Port device team_slave_0 removed [ 178.156507][ T5884] usb 5-1: config 0 descriptor?? [ 178.189404][ T7674] team0 (unregistering): Failed to send options change via netlink (err -105) [ 178.221027][ T7674] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 178.258211][ T7674] team0 (unregistering): Port device team_slave_1 removed [ 178.285413][ T7674] team0 (unregistering): Failed to send options change via netlink (err -105) [ 178.310866][ T7674] team0 (unregistering): Failed to send port change of device batadv1 via netlink (err -105) [ 178.333149][ T7674] team0 (unregistering): Port device batadv1 removed [ 178.639171][ T5899] usb 4-1: USB disconnect, device number 12 [ 178.781242][ T5884] usbhid 5-1:0.0: can't add hid device: -71 [ 178.788335][ T5884] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 178.816066][ T5884] usb 5-1: USB disconnect, device number 20 [ 178.977096][ T7684] macsec0: entered promiscuous mode [ 179.187410][ T7682] macsec0: left promiscuous mode [ 179.352911][ T7692] FAULT_INJECTION: forcing a failure. [ 179.352911][ T7692] name failslab, interval 1, probability 0, space 0, times 0 [ 179.442017][ T7692] CPU: 1 UID: 0 PID: 7692 Comm: syz.0.535 Tainted: G L syzkaller #0 PREEMPT(full) [ 179.442037][ T7692] Tainted: [L]=SOFTLOCKUP [ 179.442041][ T7692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 179.442047][ T7692] Call Trace: [ 179.442051][ T7692] [ 179.442056][ T7692] dump_stack_lvl+0xe8/0x150 [ 179.442074][ T7692] should_fail_ex+0x412/0x560 [ 179.442089][ T7692] should_failslab+0xa8/0x100 [ 179.442102][ T7692] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 179.442118][ T7692] ? __alloc_skb+0x186/0x7d0 [ 179.442130][ T7692] ? __alloc_skb+0x1d0/0x7d0 [ 179.442140][ T7692] ? __local_bh_enable_ip+0xd0/0x130 [ 179.442155][ T7692] __alloc_skb+0x1d0/0x7d0 [ 179.442169][ T7692] pfkey_sendmsg+0x212/0x1120 [ 179.442180][ T7692] ? __lock_acquire+0x6b5/0x2cf0 [ 179.442198][ T7692] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 179.442207][ T7692] ? aa_sk_perm+0x15a/0x960 [ 179.442218][ T7692] ? aa_sk_perm+0x82d/0x960 [ 179.442231][ T7692] ? __pfx_aa_sk_perm+0x10/0x10 [ 179.442240][ T7692] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 179.442255][ T7692] ? aa_sock_msg_perm+0xf1/0x1b0 [ 179.442267][ T7692] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 179.442278][ T7692] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 179.442288][ T7692] ____sys_sendmsg+0xa68/0xad0 [ 179.442301][ T7692] ? __lock_acquire+0x6b5/0x2cf0 [ 179.442316][ T7692] ? __pfx_____sys_sendmsg+0x10/0x10 [ 179.442333][ T7692] ? import_iovec+0x73/0xa0 [ 179.442348][ T7692] ___sys_sendmsg+0x2a5/0x360 [ 179.442366][ T7692] ? __pfx____sys_sendmsg+0x10/0x10 [ 179.442400][ T7692] __sys_sendmmsg+0x27c/0x4e0 [ 179.442416][ T7692] ? __pfx___sys_sendmmsg+0x10/0x10 [ 179.442429][ T7692] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 179.442455][ T7692] ? ksys_write+0x242/0x270 [ 179.442466][ T7692] ? __pfx_ksys_write+0x10/0x10 [ 179.442478][ T7692] __x64_sys_sendmmsg+0xa0/0xc0 [ 179.442492][ T7692] do_syscall_64+0x14d/0xf80 [ 179.442506][ T7692] ? trace_irq_disable+0x3b/0x150 [ 179.442520][ T7692] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.442529][ T7692] ? clear_bhb_loop+0x40/0x90 [ 179.442540][ T7692] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.442550][ T7692] RIP: 0033:0x7fb37b99c629 [ 179.442560][ T7692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 179.442568][ T7692] RSP: 002b:00007fb37c836028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 179.442580][ T7692] RAX: ffffffffffffffda RBX: 00007fb37bc15fa0 RCX: 00007fb37b99c629 [ 179.442586][ T7692] RDX: 00000000000003ef RSI: 0000200000000180 RDI: 0000000000000003 [ 179.442592][ T7692] RBP: 00007fb37c836090 R08: 0000000000000000 R09: 0000000000000000 [ 179.442598][ T7692] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 179.442611][ T7692] R13: 00007fb37bc16038 R14: 00007fb37bc15fa0 R15: 00007fb37bd3fa48 [ 179.442635][ T7692] [ 180.185298][ T5819] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 180.357624][ T5819] usb 2-1: config 0 has too many interfaces: 204, using maximum allowed: 32 [ 180.366692][ T5819] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 204 [ 180.384881][ T5899] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 180.384879][ T5819] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 180.384909][ T5819] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 180.444028][ T5819] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 180.474560][ T5819] usb 2-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 180.493912][ T5819] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.527469][ T5819] usb 2-1: config 0 descriptor?? [ 180.536649][ T5892] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 180.544574][ T5899] usb 1-1: Using ep0 maxpacket: 8 [ 180.557669][ T5899] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 180.578533][ T5899] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 180.596255][ T5899] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 180.613533][ T7711] netlink: 'syz.2.542': attribute type 6 has an invalid length. [ 180.622306][ T7711] netlink: 'syz.2.542': attribute type 7 has an invalid length. [ 180.630189][ T7711] netlink: 'syz.2.542': attribute type 8 has an invalid length. [ 180.638594][ T5899] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 180.649960][ T5899] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 180.670666][ T5899] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 180.715357][ T5892] usb 5-1: Using ep0 maxpacket: 32 [ 180.722443][ T5899] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.732328][ T5892] usb 5-1: config 0 interface 0 has no altsetting 0 [ 180.739205][ T5892] usb 5-1: New USB device found, idVendor=5543, idProduct=0522, bcdDevice= 0.00 [ 180.760917][ T5899] usb 1-1: config 0 descriptor?? [ 180.769920][ T5892] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.784796][ T7704] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 180.808804][ T5892] usb 5-1: config 0 descriptor?? [ 180.945051][ T9] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 180.964489][ T7700] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.981730][ T7700] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.033043][ T5819] input: HID 28bd:0909 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:28BD:0909.0008/input/input17 [ 181.056678][ T7719] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 181.069341][ T7707] iommufd_mock iommufd_mock0: Adding to iommu group 1 [ 181.150588][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 181.150608][ T9] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 181.150628][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 181.150649][ T9] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 181.153225][ T9] usb 3-1: New USB device found, idVendor=0bfd, idProduct=010c, bcdDevice=2d.16 [ 181.153253][ T9] usb 3-1: New USB device strings: Mfr=28, Product=2, SerialNumber=3 [ 181.153274][ T9] usb 3-1: Product: syz [ 181.153287][ T9] usb 3-1: Manufacturer: syz [ 181.153302][ T9] usb 3-1: SerialNumber: syz [ 181.160755][ T9] usb 3-1: config 0 descriptor?? [ 181.169263][ T9] kvaser_usb 3-1:0.0: CMD_MAP_CHANNEL_REQ failed for CAN0 [ 181.169289][ T9] kvaser_usb 3-1:0.0: error -EMSGSIZE: Failed to initialize card [ 181.169394][ T9] kvaser_usb 3-1:0.0: probe with driver kvaser_usb failed with error -90 [ 181.210706][ T5819] uclogic 0003:28BD:0909.0008: input,hidraw0: USB HID v0.00 Mouse [HID 28bd:0909] on usb-dummy_hcd.1-1/input0 [ 181.233406][ T5899] usb 1-1: USB disconnect, device number 31 [ 181.235324][ T5821] Bluetooth: hci5: Opcode 0x0c03 failed: -19 [ 181.317622][ T5892] uclogic 0003:5543:0522.0009: unbalanced collection at end of report description [ 181.318337][ T5892] uclogic 0003:5543:0522.0009: parse failed [ 181.318469][ T5892] uclogic 0003:5543:0522.0009: probe with driver uclogic failed with error -22 [ 181.337567][ T9] usb 2-1: USB disconnect, device number 31 [ 181.440889][ T7720] fido_id[7720]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 181.532026][ T5819] usb 5-1: USB disconnect, device number 21 [ 182.128115][ T7734] netlink: 28 bytes leftover after parsing attributes in process `syz.4.548'. [ 182.145594][ T7734] netlink: 28 bytes leftover after parsing attributes in process `syz.4.548'. [ 182.500839][ T7743] tipc: Started in network mode [ 182.526023][ T7743] tipc: Node identity fe800000000000000000000000000016, cluster identity 4711 [ 182.646534][ T7743] tipc: Enabled bearer , priority 10 [ 183.435667][ T9] usb 3-1: USB disconnect, device number 13 [ 183.654827][ T5884] tipc: Node number set to 4269801494 [ 184.521061][ T7779] netlink: 28 bytes leftover after parsing attributes in process `syz.1.562'. [ 184.540620][ T7779] netlink: 28 bytes leftover after parsing attributes in process `syz.1.562'. [ 184.589479][ T7779] bridge0: entered promiscuous mode [ 184.611608][ T7779] ip6gretap0: entered promiscuous mode [ 184.647306][ T7779] debugfs: 'hsr2' already exists in 'hsr' [ 184.663189][ T7779] Cannot create hsr debugfs directory [ 184.689566][ T7779] hsr2: Slave A (bridge0) is not up; please bring it up to get a fully working HSR network [ 184.725046][ T5884] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 184.875183][ T5884] usb 4-1: Using ep0 maxpacket: 16 [ 184.882014][ T5884] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 184.902107][ T5884] usb 4-1: config 0 has an invalid descriptor of length 129, skipping remainder of the config [ 184.936264][ T5884] usb 4-1: config 0 has no interface number 0 [ 184.959121][ T5884] usb 4-1: New USB device found, idVendor=046c, idProduct=14e8, bcdDevice= b.28 [ 184.968868][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.999687][ T5884] usb 4-1: Product: syz [ 185.003919][ T5884] usb 4-1: Manufacturer: syz [ 185.019411][ T5884] usb 4-1: SerialNumber: syz [ 185.039636][ T5884] usb 4-1: config 0 descriptor?? [ 185.070939][ T5884] uvcvideo 4-1:0.105: probe with driver uvcvideo failed with error -22 [ 185.252474][ T5884] usb 4-1: USB disconnect, device number 13 [ 185.497121][ T7803] netlink: 52 bytes leftover after parsing attributes in process `syz.0.570'. [ 186.064006][ T7819] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 186.120205][ T7819] overlayfs: missing 'lowerdir' [ 186.421179][ T5892] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 186.595522][ T5892] usb 3-1: Using ep0 maxpacket: 8 [ 186.609584][ T5892] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 186.618211][ T5892] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 186.643698][ T5892] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 186.680386][ T5892] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 186.694743][ T5884] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 186.716967][ T5892] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 186.856768][ T5892] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 186.875100][ T5892] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.915465][ T5884] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 186.944225][ T5884] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 186.967957][ T5884] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 187.004060][ T5884] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 187.014990][ T5884] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 187.033766][ T5884] usb 5-1: Product: syz [ 187.064240][ T5884] usb 5-1: Manufacturer: syz [ 187.074413][ T5884] usb 5-1: SerialNumber: syz [ 187.239342][ T5892] usb 3-1: usb_control_msg returned -32 [ 187.246102][ T5892] usbtmc 3-1:16.0: can't read capabilities [ 187.319015][ T5884] usblp 5-1:1.0: usblp1: USB Unidirectional printer dev 22 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 187.404142][ T5899] usb 5-1: USB disconnect, device number 22 [ 187.445757][ T5899] usblp1: removed [ 187.593926][ T7822] usbtmc 3-1:16.0: INITIATE_CLEAR returned 0 [ 187.634846][ T5892] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 187.801083][ T5892] usb 1-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 187.824305][ T5892] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.850010][ T5892] usb 1-1: Product: syz [ 187.860237][ T5892] usb 1-1: Manufacturer: syz [ 187.874175][ T5892] usb 1-1: SerialNumber: syz [ 187.890665][ T5892] usb 1-1: config 0 descriptor?? [ 187.906128][ T5892] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 188.329608][ T5899] usb 3-1: USB disconnect, device number 14 [ 188.456572][ T30] audit: type=1326 audit(1771582711.773:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7872 comm="syz.2.590" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fbcb9b9c629 code=0x0 [ 188.736280][ T5892] gspca_sq905c: sq905c_read: usb_control_msg failed (-110) [ 188.744572][ T5892] sq905c 1-1:0.0: Reading version command failed [ 188.751450][ T5892] sq905c 1-1:0.0: probe with driver sq905c failed with error -110 [ 189.105415][ T9] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 189.241385][ T7888] netlink: 28 bytes leftover after parsing attributes in process `syz.4.594'. [ 189.270837][ T9] usb 3-1: device descriptor read/64, error -71 [ 189.314233][ T7888] netlink: 28 bytes leftover after parsing attributes in process `syz.4.594'. [ 189.351904][ T7888] erspan0: entered promiscuous mode [ 189.402555][ T7888] gretap0: entered promiscuous mode [ 189.427407][ T7888] debugfs: 'hsr2' already exists in 'hsr' [ 189.433390][ T7888] Cannot create hsr debugfs directory [ 189.557802][ T9] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 189.734804][ T9] usb 3-1: device descriptor read/64, error -71 [ 189.751306][ T7892] input: syz0 as /devices/virtual/input/input18 [ 189.845179][ T9] usb usb3-port1: attempt power cycle [ 190.227439][ T9] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 190.256155][ T9] usb 3-1: device descriptor read/8, error -71 [ 190.517316][ T5884] usb 1-1: USB disconnect, device number 32 [ 190.524788][ T9] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 190.563157][ T9] usb 3-1: device descriptor read/8, error -71 [ 190.684913][ T9] usb usb3-port1: unable to enumerate USB device [ 190.774825][ T7904] tipc: Failed to remove unknown binding: 66,1,1/0:56779858/56779860 [ 191.435344][ T5899] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 191.667898][ T5899] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 191.694287][ T5899] usb 4-1: can't read configurations, error -61 [ 191.834817][ T5899] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 191.870687][ T7923] tipc: Started in network mode [ 191.875998][ T7923] tipc: Node identity ac1414aa, cluster identity 4711 [ 191.884779][ T5892] usb 5-1: new full-speed USB device number 23 using dummy_hcd [ 191.892508][ T7923] tipc: Enabled bearer , priority 10 [ 192.048177][ T5892] usb 5-1: config 0 has an invalid interface number: 195 but max is 0 [ 192.058780][ T5899] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 192.072879][ T5899] usb 4-1: can't read configurations, error -61 [ 192.079558][ T5892] usb 5-1: config 0 has no interface number 0 [ 192.090405][ T5892] usb 5-1: config 0 interface 195 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 192.102168][ T5899] usb usb4-port1: attempt power cycle [ 192.120504][ T5892] usb 5-1: New USB device found, idVendor=0789, idProduct=0160, bcdDevice=fd.08 [ 192.123631][ T7928] binder: 7927:7928 ioctl c0306201 2000000003c0 returned -14 [ 192.155170][ T5892] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.165360][ T5892] usb 5-1: Product: syz [ 192.176593][ T5892] usb 5-1: Manufacturer: syz [ 192.181414][ T7928] binder: 7927:7928 ioctl c0306201 2000000001c0 returned -14 [ 192.196123][ T5892] usb 5-1: SerialNumber: syz [ 192.219095][ T5892] usb 5-1: config 0 descriptor?? [ 192.229726][ T7916] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 192.293215][ T7933] netlink: 4 bytes leftover after parsing attributes in process `syz.1.609'. [ 192.369737][ T7933] IPVS: set_ctl: invalid protocol: 43 10.1.1.2:20004 [ 192.444810][ T5899] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 192.469932][ T5899] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 192.480843][ T5899] usb 4-1: can't read configurations, error -61 [ 192.553807][ T7938] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 192.570657][ T7938] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 192.594218][ T7938] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 192.614211][ T7938] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 192.614825][ T5899] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 192.633838][ T7939] ALSA: mixer_oss: invalid OSS volume '' [ 192.702789][ T7940] netlink: 20 bytes leftover after parsing attributes in process `syz.2.610'. [ 192.852261][ T5899] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 192.889767][ T5899] usb 4-1: can't read configurations, error -61 [ 192.900009][ T5899] usb usb4-port1: unable to enumerate USB device [ 193.004758][ T9] tipc: Node number set to 2886997162 [ 193.274816][ T5899] usb 1-1: new full-speed USB device number 33 using dummy_hcd [ 193.450795][ T5899] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 193.472935][ T5899] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 193.508720][ T5899] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1b3e, bcdDevice= 0.00 [ 193.529581][ T5899] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.551382][ T5899] usb 1-1: config 0 descriptor?? [ 193.564976][ T9] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 193.573152][ T7943] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 193.684982][ T7950] netlink: 164 bytes leftover after parsing attributes in process `syz.2.613'. [ 193.746293][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 193.766030][ T9] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 193.774154][ T9] usb 2-1: config 0 has no interface number 0 [ 193.791414][ T9] usb 2-1: config 0 interface 89 has no altsetting 0 [ 193.807100][ T9] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 193.812961][ T7953] xt_limit: Overflow, try lower: 0/0 [ 193.816468][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.855702][ T9] usb 2-1: Product: syz [ 193.859936][ T9] usb 2-1: Manufacturer: syz [ 193.864567][ T9] usb 2-1: SerialNumber: syz [ 193.885631][ T9] usb 2-1: config 0 descriptor?? [ 193.908226][ T9] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 193.918068][ T9] em28xx 2-1:0.89: Video interface 89 found: bulk [ 194.207229][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.213601][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.511785][ T9] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 194.638116][ T5892] asix 5-1:0.195: probe with driver asix failed with error -71 [ 194.682741][ T5892] usb 5-1: USB disconnect, device number 23 [ 195.199927][ T5899] usb 1-1: string descriptor 0 read error: -71 [ 195.200543][ T9] em28xx 2-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=153) [ 195.235034][ T9] em28xx 2-1:0.89: board has no eeprom [ 195.284973][ T5899] usbhid 1-1:0.0: can't add hid device: -71 [ 195.296742][ T5899] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 195.306221][ T7977] loop8: detected capacity change from 0 to 8 [ 195.315225][ T7977] Dev loop8: unable to read RDB block 8 [ 195.324743][ T7977] loop8: unable to read partition table [ 195.330546][ T7977] loop8: partition table beyond EOD, truncated [ 195.354755][ T7977] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 195.362671][ T5899] usb 1-1: USB disconnect, device number 33 [ 195.385389][ T7979] netlink: 'syz.2.622': attribute type 1 has an invalid length. [ 195.521221][ T7983] netlink: 28 bytes leftover after parsing attributes in process `syz.2.622'. [ 195.608744][ T7979] bond1: entered promiscuous mode [ 195.614054][ T7979] 8021q: adding VLAN 0 to HW filter on device bond1 [ 195.684846][ T9] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 195.707084][ T7983] bond1: entered allmulticast mode [ 195.728508][ T9] em28xx 2-1:0.89: analog set to bulk mode. [ 195.766965][ T5884] em28xx 2-1:0.89: Registering V4L2 extension [ 195.852352][ T7979] bond1: (slave bridge1): making interface the new active one [ 195.904716][ T7979] bridge1: entered promiscuous mode [ 195.944289][ T7979] bridge1: entered allmulticast mode [ 195.950042][ T5928] usb 2-1: USB disconnect, device number 32 [ 195.951353][ T5928] em28xx 2-1:0.89: Disconnecting em28xx [ 195.981210][ T7996] netlink: 16 bytes leftover after parsing attributes in process `syz.0.625'. [ 195.990814][ T5884] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 195.992078][ T7979] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 196.008321][ T5884] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 196.016524][ T5884] em28xx 2-1:0.89: No AC97 audio processor [ 196.114593][ T5884] usb 2-1: Decoder not found [ 196.132281][ T5884] em28xx 2-1:0.89: failed to create media graph [ 196.154622][ T5884] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 196.200143][ T5884] em28xx 2-1:0.89: Registering snapshot button... [ 196.217964][ T7999] ================================================================== [ 196.226049][ T7999] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 196.233425][ T7999] Read of size 8 at addr ffff888021684748 by task v4l_id/7999 [ 196.240864][ T7999] [ 196.243193][ T7999] CPU: 0 UID: 0 PID: 7999 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 196.243208][ T7999] Tainted: [L]=SOFTLOCKUP [ 196.243212][ T7999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 196.243219][ T7999] Call Trace: [ 196.243225][ T7999] [ 196.243230][ T7999] dump_stack_lvl+0xe8/0x150 [ 196.243247][ T7999] print_report+0xba/0x230 [ 196.243259][ T7999] ? v4l2_fh_open+0xac/0x420 [ 196.243268][ T7999] kasan_report+0x117/0x150 [ 196.243280][ T7999] ? v4l2_fh_open+0xac/0x420 [ 196.243289][ T7999] v4l2_fh_open+0xac/0x420 [ 196.243298][ T7999] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 196.243314][ T7999] em28xx_v4l2_open+0x157/0x9a0 [ 196.243327][ T7999] ? do_raw_spin_lock+0x12b/0x2f0 [ 196.243338][ T7999] v4l2_open+0x1bf/0x3a0 [ 196.243348][ T7999] chrdev_open+0x4cd/0x5e0 [ 196.243359][ T7999] ? __pfx_chrdev_open+0x10/0x10 [ 196.243369][ T7999] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 196.243385][ T7999] ? __pfx_chrdev_open+0x10/0x10 [ 196.243394][ T7999] do_dentry_open+0x785/0x14e0 [ 196.243409][ T7999] vfs_open+0x3b/0x340 [ 196.243419][ T7999] ? path_openat+0x2df0/0x3860 [ 196.243429][ T7999] path_openat+0x2e08/0x3860 [ 196.243440][ T7999] ? __pfx_stack_trace_save+0x10/0x10 [ 196.243450][ T7999] ? stack_depot_save_flags+0x33/0x810 [ 196.243463][ T7999] ? __pfx_path_openat+0x10/0x10 [ 196.243471][ T7999] ? __x64_sys_openat+0x138/0x170 [ 196.243483][ T7999] ? do_syscall_64+0x14d/0xf80 [ 196.243496][ T7999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.243507][ T7999] ? __lock_acquire+0x6b5/0x2cf0 [ 196.243519][ T7999] do_file_open+0x23e/0x4a0 [ 196.243528][ T7999] ? __pfx_do_file_open+0x10/0x10 [ 196.243541][ T7999] ? _raw_spin_unlock+0x28/0x50 [ 196.243553][ T7999] ? alloc_fd+0x64b/0x6c0 [ 196.243566][ T7999] do_sys_openat2+0x113/0x200 [ 196.243579][ T7999] ? __pfx_do_sys_openat2+0x10/0x10 [ 196.243591][ T7999] ? exc_page_fault+0x6a/0xc0 [ 196.243603][ T7999] ? do_user_addr_fault+0xc6f/0x1340 [ 196.243616][ T7999] __x64_sys_openat+0x138/0x170 [ 196.243629][ T7999] do_syscall_64+0x14d/0xf80 [ 196.243642][ T7999] ? trace_irq_disable+0x3b/0x150 [ 196.243655][ T7999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.243664][ T7999] ? clear_bhb_loop+0x40/0x90 [ 196.243674][ T7999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.243684][ T7999] RIP: 0033:0x7efc0b4a7407 [ 196.243694][ T7999] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 196.243702][ T7999] RSP: 002b:00007ffdec24b500 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 196.243714][ T7999] RAX: ffffffffffffffda RBX: 00007efc0bbb2880 RCX: 00007efc0b4a7407 [ 196.243722][ T7999] RDX: 0000000000000000 RSI: 00007ffdec24cf1c RDI: ffffffffffffff9c [ 196.243739][ T7999] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 196.243745][ T7999] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 196.243754][ T7999] R13: 00007ffdec24b750 R14: 00007efc0bd19000 R15: 0000559c9976a4d8 [ 196.243764][ T7999] [ 196.243768][ T7999] [ 196.543778][ T7999] Allocated by task 5884: [ 196.548091][ T7999] kasan_save_track+0x3e/0x80 [ 196.552763][ T7999] __kasan_kmalloc+0x93/0xb0 [ 196.557333][ T7999] __kmalloc_cache_noprof+0x31c/0x660 [ 196.562686][ T7999] em28xx_v4l2_init+0x10b/0x2e70 [ 196.567614][ T7999] em28xx_init_extension+0x120/0x1c0 [ 196.572879][ T7999] process_scheduled_works+0xb02/0x1830 [ 196.578409][ T7999] worker_thread+0xa50/0xfc0 [ 196.583077][ T7999] kthread+0x388/0x470 [ 196.587129][ T7999] ret_from_fork+0x51e/0xb90 [ 196.591700][ T7999] ret_from_fork_asm+0x1a/0x30 [ 196.596453][ T7999] [ 196.598757][ T7999] Freed by task 5884: [ 196.602715][ T7999] kasan_save_track+0x3e/0x80 [ 196.607380][ T7999] kasan_save_free_info+0x46/0x50 [ 196.612392][ T7999] __kasan_slab_free+0x5c/0x80 [ 196.617225][ T7999] kfree+0x1c1/0x630 [ 196.621104][ T7999] em28xx_v4l2_init+0x1683/0x2e70 [ 196.626112][ T7999] em28xx_init_extension+0x120/0x1c0 [ 196.631380][ T7999] process_scheduled_works+0xb02/0x1830 [ 196.636923][ T7999] worker_thread+0xa50/0xfc0 [ 196.641525][ T7999] kthread+0x388/0x470 [ 196.645593][ T7999] ret_from_fork+0x51e/0xb90 [ 196.650179][ T7999] ret_from_fork_asm+0x1a/0x30 [ 196.654933][ T7999] [ 196.657239][ T7999] The buggy address belongs to the object at ffff888021684000 [ 196.657239][ T7999] which belongs to the cache kmalloc-8k of size 8192 [ 196.671449][ T7999] The buggy address is located 1864 bytes inside of [ 196.671449][ T7999] freed 8192-byte region [ffff888021684000, ffff888021686000) [ 196.685487][ T7999] [ 196.687798][ T7999] The buggy address belongs to the physical page: [ 196.694229][ T7999] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21680 [ 196.702976][ T7999] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 196.711543][ T7999] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 196.719080][ T7999] page_type: f5(slab) [ 196.723060][ T7999] raw: 00fff00000000040 ffff88813fea9280 dead000000000100 dead000000000122 [ 196.731626][ T7999] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 196.740287][ T7999] head: 00fff00000000040 ffff88813fea9280 dead000000000100 dead000000000122 [ 196.748951][ T7999] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 196.757602][ T7999] head: 00fff00000000003 ffffea000085a001 00000000ffffffff 00000000ffffffff [ 196.766255][ T7999] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 196.774903][ T7999] page dumped because: kasan: bad access detected [ 196.781303][ T7999] page_owner tracks the page as allocated [ 196.787077][ T7999] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5530, tgid 5530 (dhcpcd-run-hook), ts 42901409905, free_ts 42841881206 [ 196.807909][ T7999] post_alloc_hook+0x231/0x280 [ 196.812682][ T7999] get_page_from_freelist+0x24dc/0x2580 [ 196.818214][ T7999] __alloc_frozen_pages_noprof+0x18d/0x380 [ 196.824006][ T7999] allocate_slab+0x77/0x660 [ 196.828512][ T7999] refill_objects+0x331/0x3c0 [ 196.833178][ T7999] __pcs_replace_empty_main+0x2b9/0x620 [ 196.838718][ T7999] __kmalloc_cache_noprof+0x392/0x660 [ 196.844071][ T7999] tomoyo_init_log+0x112e/0x1fb0 [ 196.848999][ T7999] tomoyo_supervisor+0x353/0x1570 [ 196.854014][ T7999] tomoyo_env_perm+0x151/0x1f0 [ 196.858763][ T7999] tomoyo_find_next_domain+0x15cb/0x1aa0 [ 196.864383][ T7999] tomoyo_bprm_check_security+0x11b/0x180 [ 196.870087][ T7999] security_bprm_check+0x85/0x240 [ 196.875095][ T7999] bprm_execve+0x896/0x1460 [ 196.879581][ T7999] do_execveat_common+0x50d/0x690 [ 196.884586][ T7999] __x64_sys_execve+0x97/0xc0 [ 196.889245][ T7999] page last free pid 5486 tgid 5486 stack trace: [ 196.895556][ T7999] __free_frozen_pages+0xc2b/0xdb0 [ 196.900653][ T7999] __slab_free+0x263/0x2b0 [ 196.905074][ T7999] qlist_free_all+0x97/0x100 [ 196.909647][ T7999] kasan_quarantine_reduce+0x148/0x160 [ 196.915089][ T7999] __kasan_slab_alloc+0x22/0x80 [ 196.919927][ T7999] kmem_cache_alloc_node_noprof+0x384/0x690 [ 196.925901][ T7999] __alloc_skb+0x1d0/0x7d0 [ 196.930305][ T7999] alloc_skb_with_frags+0xca/0x890 [ 196.935411][ T7999] sock_alloc_send_pskb+0x878/0x990 [ 196.940618][ T7999] unix_dgram_sendmsg+0x460/0x18e0 [ 196.945743][ T7999] sock_write_iter+0x503/0x550 [ 196.950491][ T7999] do_iter_readv_writev+0x619/0x8c0 [ 196.955675][ T7999] vfs_writev+0x33c/0x990 [ 196.959989][ T7999] do_writev+0x154/0x2e0 [ 196.964218][ T7999] do_syscall_64+0x14d/0xf80 [ 196.968794][ T7999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.974674][ T7999] [ 196.976979][ T7999] Memory state around the buggy address: [ 196.982588][ T7999] ffff888021684600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 196.990633][ T7999] ffff888021684680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 196.998765][ T7999] >ffff888021684700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 197.006804][ T7999] ^ [ 197.013195][ T7999] ffff888021684780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 197.021255][ T7999] ffff888021684800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 197.029394][ T7999] ================================================================== [ 197.041031][ T5832] Bluetooth: hci2: command 0x0406 tx timeout [ 197.047150][ T5832] Bluetooth: hci0: command 0x0406 tx timeout [ 197.048314][ T5884] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input19 [ 197.054190][ T5832] Bluetooth: hci1: command 0x0406 tx timeout [ 197.069828][ T5832] Bluetooth: hci4: command 0x0406 tx timeout [ 197.075978][ T5832] Bluetooth: hci3: command 0x0406 tx timeout [ 197.098470][ T5884] em28xx 2-1:0.89: Remote control support is not available for this card. [ 197.114800][ T9] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 197.156532][ T5928] em28xx 2-1:0.89: Closing input extension [ 197.163291][ T5928] em28xx 2-1:0.89: Deregistering snapshot button [ 197.207675][ T7999] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 197.215004][ T7999] CPU: 0 UID: 0 PID: 7999 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 197.225518][ T7999] Tainted: [L]=SOFTLOCKUP [ 197.229847][ T7999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 197.239915][ T7999] Call Trace: [ 197.243199][ T7999] [ 197.246134][ T7999] vpanic+0x56c/0xa60 [ 197.250134][ T7999] ? __pfx_vpanic+0x10/0x10 [ 197.254653][ T7999] panic+0xc5/0xd0 [ 197.258387][ T7999] ? __pfx_panic+0x10/0x10 [ 197.262824][ T7999] ? preempt_schedule_thunk+0x16/0x30 [ 197.268206][ T7999] ? preempt_schedule_thunk+0x16/0x30 [ 197.273579][ T7999] ? v4l2_fh_open+0xac/0x420 [ 197.278152][ T7999] check_panic_on_warn+0x89/0xb0 [ 197.283075][ T7999] ? v4l2_fh_open+0xac/0x420 [ 197.287647][ T7999] end_report+0x73/0x180 [ 197.291876][ T7999] ? v4l2_fh_open+0xac/0x420 [ 197.296456][ T7999] kasan_report+0x128/0x150 [ 197.300964][ T7999] ? v4l2_fh_open+0xac/0x420 [ 197.305542][ T7999] v4l2_fh_open+0xac/0x420 [ 197.309953][ T7999] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 197.315925][ T7999] em28xx_v4l2_open+0x157/0x9a0 [ 197.320766][ T7999] ? do_raw_spin_lock+0x12b/0x2f0 [ 197.325777][ T7999] v4l2_open+0x1bf/0x3a0 [ 197.330013][ T7999] chrdev_open+0x4cd/0x5e0 [ 197.334413][ T7999] ? __pfx_chrdev_open+0x10/0x10 [ 197.339335][ T7999] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 197.345670][ T7999] ? __pfx_chrdev_open+0x10/0x10 [ 197.350594][ T7999] do_dentry_open+0x785/0x14e0 [ 197.355355][ T7999] vfs_open+0x3b/0x340 [ 197.359407][ T7999] ? path_openat+0x2df0/0x3860 [ 197.365109][ T7999] path_openat+0x2e08/0x3860 [ 197.369692][ T7999] ? __pfx_stack_trace_save+0x10/0x10 [ 197.375177][ T7999] ? stack_depot_save_flags+0x33/0x810 [ 197.380629][ T7999] ? __pfx_path_openat+0x10/0x10 [ 197.385550][ T7999] ? __x64_sys_openat+0x138/0x170 [ 197.390571][ T7999] ? do_syscall_64+0x14d/0xf80 [ 197.395334][ T7999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.401491][ T7999] ? __lock_acquire+0x6b5/0x2cf0 [ 197.406427][ T7999] do_file_open+0x23e/0x4a0 [ 197.410940][ T7999] ? __pfx_do_file_open+0x10/0x10 [ 197.415975][ T7999] ? _raw_spin_unlock+0x28/0x50 [ 197.420841][ T7999] ? alloc_fd+0x64b/0x6c0 [ 197.425215][ T7999] do_sys_openat2+0x113/0x200 [ 197.429892][ T7999] ? __pfx_do_sys_openat2+0x10/0x10 [ 197.435093][ T7999] ? exc_page_fault+0x6a/0xc0 [ 197.439803][ T7999] ? do_user_addr_fault+0xc6f/0x1340 [ 197.445082][ T7999] __x64_sys_openat+0x138/0x170 [ 197.449929][ T7999] do_syscall_64+0x14d/0xf80 [ 197.454511][ T7999] ? trace_irq_disable+0x3b/0x150 [ 197.459522][ T7999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.465579][ T7999] ? clear_bhb_loop+0x40/0x90 [ 197.470260][ T7999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.476151][ T7999] RIP: 0033:0x7efc0b4a7407 [ 197.480590][ T7999] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 197.500223][ T7999] RSP: 002b:00007ffdec24b500 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 197.508660][ T7999] RAX: ffffffffffffffda RBX: 00007efc0bbb2880 RCX: 00007efc0b4a7407 [ 197.516626][ T7999] RDX: 0000000000000000 RSI: 00007ffdec24cf1c RDI: ffffffffffffff9c [ 197.524585][ T7999] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 197.532639][ T7999] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 197.540600][ T7999] R13: 00007ffdec24b750 R14: 00007efc0bd19000 R15: 0000559c9976a4d8 [ 197.548579][ T7999] [ 197.551771][ T7999] Kernel Offset: disabled [ 197.556094][ T7999] Rebooting in 86400 seconds..